remove terraform effect and hercules secrets

also move cachix deploy token to repo root secrets
This commit is contained in:
zowoq 2023-09-15 11:39:35 +10:00
parent 9b325d8c38
commit c896c3e3b5
7 changed files with 30 additions and 79 deletions

View file

@ -5,7 +5,6 @@ keys:
- &build04 age1r464z5e2shvnh9ekzapgghevr9wy7spd4d7pt5a89ucdk6kr6yhqzv5gkj
- &web01 age1dg06e2l664lek3het63vrdrvzyrzt2tcf4peellhxc33aj2wf3ysgja8gl
- &web02 age158v8dpppnw3yt2kqgqekwamaxpst5alfrnvvt7z36wfdk4veydrsqxc2tl
- &hercules_tf age1lk9prt0l75xyj4r9lvel5cdac4ll8jnywrm0fp8nackeqzmwkfqq974lst
- &mic92 age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
- &ryantm age1d87z3zqlv6ullnzyng8l722xzxwqr677csacf3zf3l28dau7avfs6pc7ay
- &zimbatm age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
@ -24,7 +23,6 @@ creation_rules:
- path_regex: terraform/secrets.yaml$
key_groups:
- age:
- *hercules_tf
- *mic92
- *ryantm
- *zimbatm

View file

@ -1,35 +0,0 @@
{ self, withSystem, ... }:
{
herculesCI = { config, ... }:
withSystem "x86_64-linux" ({ hci-effects, pkgs, self', ... }:
let
inherit (config.repo) ref;
inherit (hci-effects) mkEffect runIf;
inherit (pkgs.lib) hasPrefix;
in
{
onPush.default.outputs.effects = {
terraform-deploy = runIf (hasPrefix "refs/heads/gh-readonly-queue/master/" ref)
(mkEffect {
name = "terraform-deploy";
inputs = [ self'.devShells.terraform.nativeBuildInputs ];
src = self;
secretsMap.tf-secrets = "tf-secrets";
effectScript = ''
export TF_IN_AUTOMATION=1
export TF_INPUT=0
export SOPS_AGE_KEY="$(readSecretString tf-secrets .SOPS_AGE_KEY)"
export TF_TOKEN_app_terraform_io="$(readSecretString tf-secrets .TF_TOKEN_app_terraform_io)"
set -eux
pushd terraform
terraform init
terraform validate
terraform apply -auto-approve
set +x
'';
});
};
}
);
}

View file

@ -56,7 +56,6 @@
imports = [
inputs.hercules-ci-effects.flakeModule
inputs.treefmt-nix.flakeModule
./dev/effect.nix
];
perSystem = { config, pkgs, ... }:

View file

@ -9,14 +9,12 @@ in
{
sops.secrets."binary-caches.json" = herculesSecret;
sops.secrets."cluster-join-token.key" = herculesSecret;
sops.secrets."hercules-secrets" = herculesSecret;
services.hercules-ci-agent = {
enable = true;
settings = {
binaryCachesPath = secrets."binary-caches.json".path;
clusterJoinTokenPath = secrets."cluster-join-token.key".path;
secretsJsonPath = secrets."hercules-secrets".path;
};
};
}

View file

@ -1,6 +1,5 @@
cluster-join-token.key: ENC[AES256_GCM,data:Ba8S5Cx3NJR/FoKkSVc5pX1bwKkYHAhTid3dlWcGRXPCmVtrMgBKLjDZ5b3AajZio+IvS7XNajsVqPUB/rsBUPL+mz/DPbnI4bibLkB0KZl5v6FnMf6RbGr7RWbEsGXWlJh77l/AmGRWJTj7Dh3LaQ53dguhNIDuXGvNhTLs690/93Xnc+x+d5tzl2hNz/A4/IQxpsRoJJKygqGndbc0bTUPo0QZMLtf8kHQtCiozfm1SeW49ITnM+4VCOJB8NkSkwUfy5Rs574fFijYSOGT8LSSH0ly2oxHEY+UaJudRhjr5uzrcZPI/WrrtkI=,iv:87JRtvlkkExu37uYRaHojsk1vjhO1ocw2L9yE+7shpI=,tag:0de71eZjy8F/w0LQzOVAyg==,type:str]
binary-caches.json: ENC[AES256_GCM,data:pshvo/BxcIDXrWpW6jb1Hti8pqIEER+andBFpbOArKdaSb1LoVC45G+QwqLxjnDckiBeJm+refQE/x8i6QI0kYHcHEmX4iByvtcDM7RB6ZQSghTO0oqhi1blZRp+NjVdpgeti9VOkLPOYR+ruCDXeZmjt9fWnpGxC6ok5h5z5XLtq5xICy0DBl4VJXw3NwMnpIfj4vvczTP1TlUmP3GElHImRj6F59Vyw4jbTZRIqrib97x8nrO24t3P6RqooY0WHPR1sQXJebxCCO3TiJjxLHNtjLhJgez/O6Ou8CJx999wGvGmm3k8DzUDh94bnG12tal0PrPSJLdsQItpYqDPbK6f6R0wVmzcAywW22SCqk6kaCLGSDCYQRh3xGNsdmVfDQSJPjnAOJDNjJR5adoe8KPHIrc5eZiXjS9mJO7eYPX2IfkNHlM18NjT/Q716Ez9tnBatVb5+YKLlZMm+SSgWNxwZhBiQUvR3wdX3jOXIAjdfCGy4ocCffP05WC4YzjHo5E1EsOBN/cr5LfAS36XFwChHJ6iE4zjwsQe3X7jN9mlZdksBe8gEKFns2rr5IMmXG/enLdVjigRgDShNglP,iv:IOqba6lLXCEVZ+HNaH3uM4E3lbKzm8XCXlbAp6UPBIE=,tag:RX2d2UEWpZu48pW1UUaQcQ==,type:str]
hercules-secrets: ENC[AES256_GCM,data:qnSdLa773knydBo0ggwzUHMISolz574e+3KCeYavhUChZ8+XGyNE7wHr86GMt6azDr47Io0pzvkzhttyZxTFXnl89DNbupbkk3YV52BDSAI5qCnBmm4nsqSfEJBUHcMJ69BamHgSY+hpFDABONUdIxsyRQR5D0FMzS06ptUIjdpMM4+HDkSaQucBWF8muidqpSyu4Vsjc2y5cpNcBL10QYWnPgy7+pDPzd+EAS4C2JqHI/nbyclPK4g0H0aBzeFCiOJaES1nMwcmYVez6RyV1i2ryJfXm1MNxuswAMVd/cJXu3hVvNAV20YIqEFrUPEr4bTwJ1v7aQ6AfsviXy1RQiq48+GHDTfjoEe6IajcLYlvCtcEgvhdTa6eoQs5giATTK7oVjC/0Kbzum4GOKHJ9U1K7fTUzfCudwBm2YpGQzVMm2ekxCciZS0mqfcxJAHyLIasaGlYo/GBDwyRAvJxWdPO4EFjgzoqcWyRRTUxZUVOPCTp7MLpVbJLbjVVnH28TU+ASH5jf0GWtna+oHPv2G4Ou69jwEmeqP7aH4RKC1/X/sedsOKDcDGVYLwhqWPvtxa+/Zi2hgnut3CGPBtq5MPQysJV5epR8h59afviszXBVCpCAYT/+yx0OrzjzPGdqiCPWhn2Hez3jZMuS5yNxi2lYzDK8oUd7ap1cE8JIwd4+20ho0imsrGDy1IZwjMj68TWhbVaPJIVJM7ocZh1gKE3yYtZ7nz3M9TiWt7EP9DOl3C2Hk6IaU+KP9BB6ztppKbAmDezNeaB2BDBc+vrrMzg+78qdxmj2HLlWijuduBj6pf3r/MVFPtWyPvvpZYwFzHj3REB6AVokYhLeyLrsAXJeK1UMkOcn2jpP49sQilYg5bNKXPku5vm26W4k/Zk2mBoGa+hwuq3GWNO7hjPhLQb62ANOtnn3NEKtC0UIt0vYyBF+Z1vEs7O2M4EAQI4nGttV26QzxBWzNOIBIMo6c7l21oX3D9alDvRoUO1W3wbav6+E79hFu3cqQLzjxsIzSCE5YoMD3MMEmZrF4yaFkVBP7qRNO7lyxKJM5tyuXeOmKr3/RmxD9O4h1t1zhqQh7VjlFoEtINSmnfYecqB9qC+Wb/huGA0w7RudGYHjlwudL+avsiKpGoMz90Z/Xf4krM/wZo=,iv:XD47L1jJhqXF7AIRN2yLhr3uTEFIMLeanAlGHCu6H18=,tag:taCIc+0ULwdUW1XSf0TlJg==,type:str]
sops:
kms: []
gcp_kms: []
@ -79,8 +78,8 @@ sops:
LzIvbE1pMUR1ZklLUWk1Q2RITDBpajgKC89UN6Emwuru91p0H0f57OI1/o3jjOeE
Lwbnzsp4YLyJNEA2ZBqC0lTiS7jMNpLNqFylZV2x0w7GnMKI5Zpqjw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-08-01T23:08:51Z"
mac: ENC[AES256_GCM,data:aBuGtgt4YvcrpPsXYp6LX6zHSF+68wFZWEPjIlnFe3MyK3p5DevETpGSsKjodNiSQ+5NpIy3ecYz+nfAUjqxAbGHtniuBxwBkzQUBwCOcDZPp8Rh+YBtSjwgTsG/wkxDhTP9wiSq0nlpGxzv3Rh93BV+WB1i/9cO8slnYglbzw8=,iv:qx5or2iJ/jTua+9vdgj7URymEJKZc+gqE5EYIZwE4Dg=,tag:vvIoNkfqDVAJmP2TMdrEEQ==,type:str]
lastmodified: "2023-09-15T01:37:59Z"
mac: ENC[AES256_GCM,data:jKt1zmY+xkXV8qroMAah6w8h2onyKuDhneaOt9q8as1+UpEfhkpJza2LI8pQspoThvoNZK0Q1C0oEgF74S5UH6zYxfOiBVkXy72/kNm2XuiJfTXj1x+Rcdb1Itq34Ffrw+TsncEVSpvdcIGSFINce5PsvBnBdsdp9kSFQi6ZG+A=,iv:5IblazbdAGIODlCbxAu8XGFXF4G/esZ7LBZ3cmUG8gM=,tag:HMWFzpFokXAwY5XMpb6Tjw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

View file

@ -36,6 +36,7 @@ nix-community-lemmy:
admin:
User: ENC[AES256_GCM,data:8e18x2c=,iv:mM1STVLVWUcxLPMiAUBg1TJoc50feC2e0IEBqs8ub8c=,tag:7ILey8RvTTirdWwnGi4+Zg==,type:str]
Pass: ENC[AES256_GCM,data:JQcs+zzybUA1PtPaVQFcknA7WcrouJnHkA==,iv:eYPy+nhK7Vjq3mDtxJ95geq+rS6FoE2WMnbhz91QWyI=,tag:ZmfJ/tRgQhAamtQ7Xg561A==,type:str]
cachix-activate-token: ENC[AES256_GCM,data:fGMXY5qAfrSJ5FAWbKbq5B703iDGMsz8OFC1Z1XYnpYtpyjo3PX0AQx8ScLJ0btfIJ/LSABEQUTNE0nh3sAWeOfROMQwVMRVg48dzqv+AoruovFzWUxb0AgGQt0DaIKWbSd7Rto4dkGTf72YPB6d2pXnUb8RMk4kl8oOht7B7BK6OghHud3hs7mXPmRggjlQPRjInkUQDePa,iv:/tvqOmch75tpMwGkrkjGQtZzaCBxUoypludPR32f+2A=,tag:de1d0QFpH/qom0r5cdhmwQ==,type:str]
sops:
kms: []
gcp_kms: []
@ -87,8 +88,8 @@ sops:
MkcvL1JyVFBJV0Y5RFFCMGN1OUFXdU0Kdx1wy6ZOOTg1a6VKaq52SMBvC26lMsW/
oMP+hmXc2WtoqZp+jZ9rrXz6cZW6/dO7CPqxl3aUEKg6BkXIwgyKeg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-08-12T00:50:11Z"
mac: ENC[AES256_GCM,data:E1MYlrlHS2fsCapkIPXx1ljOTgXnAqHqvOvk40Aubd6sJqYwGPVsOuH4uLZHTIrpeZYqX7e8VHaboV1qwobcIIUpvSWJV2AJGHj4cJpL43JAktp7ANJqMV4NoGjPqfIcNLCi6hJjM0wJDvNLglkQ7TPUQUoxNyp9knuQuaQNcgY=,iv:s+BU1mtqx14WZawZUxvYj4tmNtLGleFxkvsvpm/LIww=,tag:90eIIWQ8WoYDEDLzlqOIQg==,type:str]
lastmodified: "2023-09-15T01:36:31Z"
mac: ENC[AES256_GCM,data:RklmTsU9Bze49lCGf/owxp+CealztAJZ+MMlvZRmBHThLIW30ej1tLO5N0hrbfjaauL6xOK/T/wfCWfZaG0mA/pjwwXkMda7e6NqWNGmtpzH2KcQFW4zFzeMfLsnTL+1ebyakhDZQZhmypvfs252cINMGur53SGnrab5PyjlsQc=,iv:cuuVxkZI3UzwL8ln6xZRX4ogDVwufDf2JG1p+vhJ68Q=,tag:ZlDBNtpGFBq8mUcJbmWu+A==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

View file

@ -9,59 +9,50 @@ sops:
azure_kv: []
hc_vault: []
age:
- recipient: age1lk9prt0l75xyj4r9lvel5cdac4ll8jnywrm0fp8nackeqzmwkfqq974lst
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQ3g4ZVRLWUpKS2puQkRI
bHN6bUgzRWRUMVJKTmpUT0hIblYvVmtVaDFJCnVia2JFRndCc2R6UElhUlhjODVn
Q0dMazdzQ2RoMHlLUFJNekxKZGhRZE0KLS0tIE9tQ3EvdjJGdCtVd1BZVjI0cmdh
Y1RUODN1amtibWNZWnA1WWxKUGM3eVUK6r72hXq3sclDrit1Jy4qNGDlGHG2wIUq
YxMsSN13Nxel8Lz71oS8J7cfBOfVVDk94fjLumJK3O0xd7rKhHzUDQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTXJ2WS9Maml4OGpoSGJW
WDJwWEl0SDY4T3ZWRVJkRHVvcVdTNG9UR1JzCkY3VUVpeE5nTGdhZ3NCS2VJSHlZ
ZHRFbEdrbkZlaVI2d0ZRcU9EOFk2SlEKLS0tIG5TZEVlZm9FTzM1M0FxdzdlZjJV
MGkwQkRCa1VxeHNCTFhuZEVkNnVOUFkK3kYg9gjAS4oTNmLvc/vg70ec+BOTQEpC
/mtkf2aOZfgx9hgqsI5OhdhCM/oQGEl0Cp6LjbdCj38g0VRrgAvyfA==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbVlqTHNFeVU0TVlVZ2xN
bVpmUklPNHMxZGpQUXVkOGMyVGV3ZFZlajIwCkhtUVFzQTQzdCt4QnpzTGJWQnhz
L3hhS0pqK1gzOUVtMWVleTVqT3VMc2MKLS0tIEhlQmtxa2IwWUxUV1U2eFFDdlJn
Rzc5NzJCVHdYN1RpTFN0SGVIVG5YSlEKoUDHDn9bcK8YsRGQ1xE0TWxRD/jHNxOL
o6fqZJ3560SvLvOFArHiD2ktOg1YrzN6fuMmWLdM+3/CpYgzX8x/oQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1d87z3zqlv6ullnzyng8l722xzxwqr677csacf3zf3l28dau7avfs6pc7ay
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqd3VaN3pQZm1OUWpMQ3VR
RHpOazNaSUdpNXRjOGM4TDJqRTVCQVVsRWs4CjJVcUQ5Z1BQaE9TMERxRGdsKzMv
VlF6Q0xBK0tOTGUzMFJPYzVRdnNoZ0EKLS0tIG5OdnphbmZ5TXlSMUUwb2M3ZUVj
NzFrckhqMVZEczAwb2xNY0dDUTZKTHMKUyVn+283k7chPBsJhCaVB0pBVUsDczxC
aE7BhLdwIF0zGg+Nc1h5+ujQs2Ht8Xj3K7p8Pt8Q0HJ74azLBHSH6w==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZek1Mci9kc3NzcEg4b2Fk
bVpETnhna2t5bktZTGNVdk5oRWxqaGsvRnpZCkpDYy9xWlg1dE1NOEFxYXVocmQw
ZnloVDlwZkQ0SXNMaEdqRkF6WHNQSFkKLS0tIG13V3lTYnBuR0NEZkhWeFlsSjdP
SkdEOXdGNStCTmw5TWZSTExMQTNReFEKUBX0pfPILtaDqb/YV2L7Er1ARxYT0HbO
Pq4s/TD2/O+65KUwBo+ED8tm7QKdqfM3mVeGdz0HPDFzX+ITgU283Q==
-----END AGE ENCRYPTED FILE-----
- recipient: age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxd0Y5ZTlZY1Nhckk2Tm1U
TWI5RXAzSzBUN1NTczhrVTllYUxxbllVMVRNCjJyVHhFRS9MV0tDcTM3cGtIaHIy
eHRJaWsvV0V6eDBaM25QSFlZM081TG8KLS0tIDBLaEpHYjVWSjYvUW51dEltbzBI
K1ZFMG8vZlQ3a2J4L0tyaDFjTE1kNDAK8lBL892EIFigwu8TQ6ekEALF9yBew0tW
Ah5zpwNd+oPPca3WhWKK8x9fTPl7o1suQh6zc7VtojStwKpqr9EZIw==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByZUtTVHl2YVZZY1U3dnVP
c2ZmQmRnQWFtTmdwcmZXbVQ3b0swNTdtcmtRCjZyaUlCNkxSRDNheEsydnJVZU5o
N2tQUS92WWxkQllidFhTb2NTU04wSUkKLS0tIGRFOUMzbFJyWTJuUFVkNElmNEtY
QWhDdklqQjdmcTM4R1VQV0p4T1ZDRDQKdXd9UqMhjXvGlKqYaTEcKDh5q8qElmWp
Oc3f4HZesjx2OrEgIuzjct4yoiYJ1nEQWnuloZcOoFmL/udTMAS+cQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1m7xhem3qll35d539f364pm6txexvnp6k0tk34d8jxu4ry3pptv7smm0k5n
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSENCdHljWVJoRXFVYUJN
Ly9JOFMrSFdSQkVVYmYxYWYvVThqSENkYUFzCktacGtYT1JEb0dibGJTVlJPSktG
d3pIM3BpTktEU3daZWNBU0lGU05xRUEKLS0tIEFEUGFhSWd3a011cmdOZ29BVE80
VmNPWm9udUNJem5obFcwckljQ2p6blEKxpIC0o0eW678EWyR8/nCrWcFLOmKAZxO
ZJPM+OSTjhMfZFcGX35X2rFcpZMoXxzre4Fq5WjGy6ao4bipNIpYew==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNVdmV3lNV3RzV1Q1aU9j
WjFrWUpEOUl1ODFhUHdXcnZCZ0o0VDJ3R1NNCmRjWWEySEc5elNheENWNXdrREE3
VnRCV2JnRHlLQW90ZnpSYUQvd3pUVGcKLS0tIE1ta0hMZi9PM3dFdlBQUnM5OTBK
UFJUMGJndFBNRDFmV210SkdKbXh3SVUKmoGpFJUwPUW9dZcPRgbXLonGNf8K3ASl
fNPYQCyw0fODZRnxe0RD5L9ktHIc0lAg+v3u5RW4VZ07GFsIfzoxkA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1dzvjjum2p240qtdt2qcxpm7pl2s5w36mh4fs3q9dhhq0uezvdqaq9vrgfy
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVGl5NzJGTjhhNHZXK2NV
ZW9TMGdnMW0yQlVLcTFxVVNLSTZLcWVFYUhZCjJuVVlJTVhveEZVeFJVWldraE9I
K0x6T21yRERCWVc2SFc3eDdWcVo3MEkKLS0tIE13SUtBWFZHc25ad2dCSW15d0lp
K1Y4c2xiMFRjbS94bVRZdVBUM2phbmMKlpXGtcNJzylTFpSjFc6AqmmUxxZSF0Lp
H4oMFAtd+6SFMnEHA7ritkiQVuYcbDnnBKlc8mS5amu4lb2QPdrUwA==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhVXdteGd5NEpxN2h5dE4r
K0czVU91aDNHdTIwQ1NXZWdPSE1BajVXeVhnCkdrMEMyRVlWMHBUdHdhOEJvU3g4
REw2NFZ0TzZ1cDBQSTZmMjk2eDFpWGcKLS0tIFY1c2lydDFpd3l4MUxraXlsbUxr
aUhpWnU2eHdQY2NjaEZPNWNPeVlhYjgKV4lec3/DD7lrt11Cut9YRzQqnSFiRkII
mrrs8Y0NrX7hibd5skmMXdgkPNna8EotkUHbWq1qg5qO/D+AamsSCA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-06-01T23:41:51Z"
mac: ENC[AES256_GCM,data:XFbeS4w5FP7uL6lry+Vubkwu1vWXO6SbMf8f5eI2lSkRBw9C4awdijyQpM56SO07RNgUj+PkPpx4GvNSWnCpSy04YrH6aErcvO7FqbVFlIUQXIdMgM3ZdZum0+SXIP/AjUArfKiq3+3VxcEGMuDMjuohoBffnyjKRLnMvaSuMlQ=,iv:HPhNL8m/kAho9J3C+4FKljbJXSmVvvC527Uu8F1pjDU=,tag:D7jfGYpoNLjwRYgdRR8QNA==,type:str]