darwin02: add hercules ci agent

hosts/darwin02/configuration.nix

@@ -3,6 +3,10 @@ let
   asGB = size: toString (size * 1024 * 1024);
 in
 {
+  # hercules secrets are installed manually from ./secrets.yaml
+  # https://docs.hercules-ci.com/hercules-ci/getting-started/deploy/nix-darwin
+  services.hercules-ci-agent.enable = true;
+
   imports = [ ./builder.nix ];
 
   services.nix-daemon.enable = true;

hosts/darwin02/secrets.yaml

@@ -0,0 +1,58 @@
+cluster-join-token.key: ENC[AES256_GCM,data:0Q/+kD4sN0GRchBFWGbeveH67gOAOlIV+aSwKgKN9DPnUkd7ynWvIr3b76M/iqLrbcjxBmQP2IB/nETAKZorV2fUeJGbP7l1HGTAEPjiu7Nq3GtrFtyigo6lHmdmsVhDiQb5k7895Dx5czdpi4lW7mK9xg5804TRHAUULs+sUNb7vApfaXV6P4/is4XjghANSWtgmPERFGwdAeuwdByUuFfXR3ZbpsJWSGIxOQaK7KacIvc/O/RI7U8JZZQK/42Od7vbFIIVwNt5uf+TJKg8OfLHqYkNEF9BPXCA7DRLobiEYT+hfaN0uYQaXt4=,iv:VgKLf09ewERooRgD8Mcue1cbW23QhtVMWlYMnbv1dJo=,tag:Ng2scAGNRszOuDTAiPgvbA==,type:str]
+binary-caches.json: ENC[AES256_GCM,data:iG41o/T4wChrT8LnFbfFlszBTr4h2uTKHs4E5U1qjsK79ENa4mcN/fXozmQC4hz1hwALngWOycgmZZQ2mYu/NpcSoh1DG2Q7yxdrWW3LsnKOXg2qh3Fa9Jdx1zdtBLqVJic7dxW2ZDQzCp7HkMRwiBeqltKKKPHZcDMK1Lt1paovQCI8KsBonu3ygAsC/TbNAy+VrA1y/6F0guSi2701VrvViEVV+YNvhNaq7ax7NFAHUJpPM2SSrTJaPGwsGG162AYQQeVBRfs18RPb5aqZSYOihM7biWCzr1aI+Ds0iD7nnDpd6gxSSDIBMPrn3a86JmyGcezVCB2CYn5KWwaMQ+N5OHgwGNBDyapLy0he6kZrjFM951L/y+P//DFc6/n5FqgdKazGsUcC1gxYBe1HDmpHmhG8yDsnSZr/kGr/ywo=,iv:JPJ7FfvpN9QBmQnaeonhZQB2mw2a8SWifT3ZLEvqSVY=,tag:o7Tu6s59MUf8Gd/WNhKL/w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age12w8we2htlf3sxd9xjlt65353tgl58034l93w8vwphhm98zv69dzsvzt8fh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TzI4MG4vRlVRbi9CMW1C
+            Z0VGdnlVOFhBQXBCeWpYM1VpNkRHK0dQb2xNCjQrYTVtSUQ1dVNWNE5tUVBoMXAr
+            RGVsY1MvSkxXdmErenZiQ3ZVT1d5VDAKLS0tIHBuTEJmR2U0SkF0QmV4Ylo4RWR5
+            WVpEUlZNMXcyKzFrZllGcXNMQWdLNW8K40dlAKQMd3cOzNyuhx/qNTpo3iP2QMiH
+            c9YAafx+DqGyBDeyzUl6aDYltfWId51qJesvPB+edijxawXLbtPvhA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIRTJwOU85aHhyd0ZUSTh1
+            d1psOVd5Z2g1Zm1PakFUYkNDb3htUjhvMVdjCmxkWVM2enpjSzdib0lZNFJzdFV6
+            cVZzemVnTzhSTHJ5Z2xORjN1R1ZDYWMKLS0tIGRGWnNHa0JVbldZOWpTeWEwUGo5
+            M1NEcHl2dkhCZlZieFc2R2U2RTF5WEkKCtmyyFhWlED5D4atqlNyVZH4Ne9a66Rh
+            WsfJhaD5pxBfZjv5wuVOkm0dwg49Tj/Df0V2XrZJ3fN4ObgYTS/BLA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1d87z3zqlv6ullnzyng8l722xzxwqr677csacf3zf3l28dau7avfs6pc7ay
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkUzl5Z2U0Y1dvMVBCek9n
+            akpxNm9QUDZIZGJEKzJIQXB2U1lhMW43MWdnCjBDSlBPN09RUGlPYjViSmxkU2NG
+            MW1xZVY0aS83Wm1DbVV4dU1KMXRnSncKLS0tIEYvK0oyOEZhZFJqOFN5RUVXSEVw
+            QUdtNW9WL3lSNjlqQnFXTGJVNDk2Y1EK+vmXsG/SxYe/I3v7/YhH0qlb93dT6n+/
+            5dnuinW43H8UqvSv12nThlOVwNXsuNDnMADFUvugGaxhkFdkcUKqig==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByTFV5ZVBuOTQwNHRYN21M
+            dnhpU2FvUWhRSEIrTUF2cmpWMjhveXFoaDJFCm43UXVKS2VXK0NxWFF4TjRDa2VD
+            RHlFdmhoamxpU3pzVXRNdUx5Y3h1QkUKLS0tIFd5MDVWK3Y0dktzNVVSbWxRaWxK
+            dTZxMEtNdEs0U2svZ0tGWGdyOGhwZGcKf66QYQe9gacgNw04+B7DYGl5MnKYbHOv
+            hqZpOULKNaIgMAzc0PhYWe45SV4dnC6EZG4J/Dr1hl4pOjeH/MGwFg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m7xhem3qll35d539f364pm6txexvnp6k0tk34d8jxu4ry3pptv7smm0k5n
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZEw2T2NNNXdDRTBRcTNy
+            dFBDcW5GV25lQ1FEUVNzY0FDV2tnYWxNSnhRCmlRUnN3L29ISmZtcm9aYTEwakZz
+            TVkyblNmeUIzaUhXWlYvd1hraG1odzAKLS0tIHJqekNLOGZJYTBYcVRZQUFYQzgr
+            SUJuM1kxck5lcWp4WkNhOTdPQWxidDgKHuxRgoq6wNn/ebVJDPd2lLMEIP7yKYSu
+            f/Ni45xuSPkjEIb/3XNVdMHaCU4dgCwYQtV5AhSXISSVugHQsepZww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-06-05T03:58:49Z"
+    mac: ENC[AES256_GCM,data:dnEEYQhSdeIt6jm/J4RHAnnTcvUB5YbLSmlcILMub382GPQD6GzFTwndhRfc1RvJFRKh7IMFZ2GYFyPdhJEjLr7BBTOWj1ti9qNFP+W/WzhTsL6i6M5Pq5Pf940VRp2zvkfHSE5PzFsAxyPCz4bSUEwRtwESYEg05gI+QWEz/gg=,iv:2p1+ofl/XbV+wb4fyKKStGAFAg6II28XA6FFjLaUYwE=,tag:qsOQ+EhCL1yePPjEsQELzA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3