deploy hercules-ci on build03

build03/configuration.nix

@@ -14,13 +14,14 @@
 
     ../roles/buildkite.nix
     ../roles/common.nix
+    ../roles/hercules-ci.nix
     ../roles/hetzner-network.nix
     ../roles/nginx.nix
 
     ../services/hound
     ../services/hydra
-    ../services/matterbridge.nix
     ../services/marvin-mk2.nix
+    ../services/matterbridge.nix
   ];
 
   # /boot is a mirror raid

build03/secrets.yaml

@@ -1,3 +1,6 @@
+#ENC[AES256_GCM,data:Unmxzr3fhszbLZX7,iv:pzVp9Rc4jKcfjl8wSxlhG7+UB39ZIF+1oD2BuRg6y+0=,tag:l0GBzXMpdaqw1hsBYsYsHQ==,type:comment]
+cluster-join-token.key: ENC[AES256_GCM,data:S0NukLMU0+Eh7zdTVgia1R3eLf46o1L3c2uZ5P6KkhnCnmnjQfdn5B2YEQf7nFQHygzVQR04hti+JaRtS2RIt3e/AirjipZpfMHlB8LStlI++kR/WD8iobc439US4QCb3aqH7WpDuU7BTwXaPygAlnE76Pwnjd6vJER3TaKaJXLb5jDo9Prn+O9n/SKUT6AxneLYPBMaIiy+t/NlL5e2/fivEA7zvifi6PCQpr0vtTPgqUGyMwZU/A4wYWoh2NnHfCpowvvhoMvLTl0LG/nWC9vE+qYTPkpl06fkLfwVngyV04HgBv97BqYC1A==,iv:5msnqFdS0bD3gFxzNc1/aZaPR7OWkdIyTn17VwfxhQI=,tag:GSXJKzh/SHZmxz2qyMOFjA==,type:str]
+binary-caches.json: ENC[AES256_GCM,data:8DE=,iv:MjBAb2XQbe7i+IBdd3yiLhRTCsuX3OQ5QPxHInL40Q0=,tag:3NBbqIg3Wl1F5faqwNpUnA==,type:str]
 buildkite-token: ENC[AES256_GCM,data:ckvzbyXHuW3N4tgZMYd+dPre+YOEnJj3T627wER3+7L9CMrZtYQlj6qU+HyeplMGqig=,iv:OmXO+85jtY6nGNm62+sF8QJF4q93mx06jNKherySD+o=,tag:mCj29oJTwEmjMN+QpmzUmQ==,type:str]
 buildkite-agent-key: ENC[AES256_GCM,data:WSVCUQ393JkN3Dq14UYo5jYm0b0J0Edqe6k/z5FRohmuQvQCZfAOYPil7cQSoP36xUxdd9kWVgsWnD2jXUumX9bbUm8t1uxf8CwDWqV3iHfDOvjfWyW7ifp7SLAo0JGI+xD1Zjy5ftzHQcjbX9VOQHJ5aBzVQUBdwfxUSSkNTBSp05iWkOIsEJKaJEUhXbZiQ81yxW0uyVq7vRVAskEPz3FxY+DmcZeu4O+kStiygGUaXSTKrzG2iE1ESnHBkd0LyajNbVq1CjohV5SpBVoP9Kf0tOi47xvirNDUlk93uTCTTk9h2KDJ/qHlwM1Cx3d30VUFsIh9eIRFP5q9qePxqdSlZcZGp0Llp1IeMZACQLEfZYA4ZlHEkOQqt8fy36PXuAY/37bM3urARjStXZIEJq3rA+d4js9zTD/16iOJqw7Sv51HrMSUQA+za/HgK13UnV69p9hvPKvAd9Xwg/SBm4TG294Ez0K/0qBckQ2z7HgmX9EY0ZjGQdqWPzLmHjYI9YzcfiT+2HuIblF/uMGJm9ZD+d/tAfUMSCVc9yhsKU5fp9c=,iv:l3rVZA9QigI96ibMu9WRlA4UbVRzFt8CwF7+dCZ6tX0=,tag:B6EhsV97IVwaji8IgJHgPQ==,type:str]
 buildkite-agent-key-pub: ENC[AES256_GCM,data:dqARMa5gzgO3qgMh7BXUJIcqcNusxW0tladrUVb9MTew92K2IHKMYAlKRGENKIHPnPAYaW9yISmXs4cD3rPCosrHoZsgtVvCGS83atqthnR7StmuEKWdxQ35573BOEXqt71v+yRk0CJQJIMEUbI=,iv:2fCB8h/vI2DEL/XSWJLhUjZgjzFYDtr7ncMpE6x8Wg4=,tag:lIq7abSvadAc9CnRa6EJkg==,type:str]
@@ -41,8 +44,8 @@ sops:
             dkdxUGVnYms5SXF1QUtqRlBUSkxpSlkKtUELjyaXUHhRcUTElgLBPvppSjldWAh+
             pjDzatq8F7NDPLpvHOAymYwu0G0B+LueWo3rO/coqONPxS9MMJQuvA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-09-29T18:08:50Z"
-    mac: ENC[AES256_GCM,data:zv/xhSqJ/t4MfKbWr4g0NBsAu7KlazNgVJReQpIUXtwJ/dNzqLbiz1GRpft41Y2uZ2wIUcICtkL2Ye81o5Ing5F4PWBY6H07IMLb+xlF+0F08vbQYDuV4RzQuE+iWFOd/WVisLpId5uDr50ansUON4y9Gow2BcDwpSoo4N0pKzI=,iv:Ckwq+pry3ppPsF0uVSvyfM0e+64YR9M+0+MK+p1bHRw=,tag:cpg1DFHDLrPmuvMvi1/Prg==,type:str]
+    lastmodified: "2021-11-11T22:01:58Z"
+    mac: ENC[AES256_GCM,data:/ZOHttzBY+xdb28XfX4yWMZHQE2jOTu1C10pf0rc5/tJ6bk2exhC0qWIEbTcTb13XK3GM+5oPuj26Q6Q0QinP0ojNCapBmAPQPJbvSUEkx2GwFiA6Olwj0JsdFMnUM8wkP5essl7i7gHaV/0weNPQVj0y43YFtxo7s1n3k70p28=,iv:fPx3PsTMsbXHJt6iONRwkKodpipmHySM0DjA5yfZsS4=,tag:PDdUXOu6eWO2JW/r8Sat/w==,type:str]
     pgp:
         - created_at: "2021-09-29T17:02:42Z"
           enc: |

roles/hercules-ci.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  sops.secrets."binary-caches.json".owner = "hercules-ci-agent";
+  sops.secrets."cluster-join-token.key".owner = "hercules-ci-agent";
+
+  services.hercules-ci-agent = {
+    enable = true;
+    # For some reason it wants a directory, and looks for specific filenames
+    # in there.
+    settings.staticSecretsDirectory =
+      builtins.dirOf config.sops.secrets."cluster-join-token.key".path;
+  };
+}