sercanto/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor storage box

Browse source 
this is now under the nix-community hetzner account
This commit is contained in:
zowoq 2023-05-07 10:24:24 +10:00
parent 6b948a13c8
commit d40867bc26
4 changed files with 13 additions and 17 deletions

13
hosts/build02/nixpkgs-update-backup.nix
View file

@ -1,15 +1,8 @@
{ config, ... }:
{
# 100GB storagebox is under the build03 hetzner account
# 100GB storagebox is under the nix-community hetzner account
sops.secrets.hetzner-build03-borgbackup-ssh = { };
programs.ssh.knownHosts = {
"hetzner-storage-box" = {
hostNames = [ "[u348918.your-storagebox.de]:23" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
};
};
sops.secrets.hetzner-borgbackup-ssh = { };
systemd.services.borgbackup-job-nixpkgs-update.serviceConfig.ReadWritePaths = [
"/var/log/telegraf"
@ -23,7 +16,7 @@
encryption.mode = "none";
compression = "auto,zstd";
startAt = "daily";
environment.BORG_RSH = "ssh -oPort=23 -i ${config.sops.secrets.hetzner-build03-borgbackup-ssh.path}";
environment.BORG_RSH = "ssh -oPort=23 -i ${config.sops.secrets.hetzner-borgbackup-ssh.path}";
preHook = ''
set -x
'';

6
hosts/build02/secrets.yaml
View file

@ -3,7 +3,7 @@ github-r-ryantm-key: ENC[AES256_GCM,data:Z6kGGGGLClFWxBu4RpPw3F/QrkLVIgkvLzi5ALU
github-r-ryantm-token: ENC[AES256_GCM,data:X77cQQQDFcUe9VcHZwbhZdyg6wFsAEwRMDaDojWYyHJf4RxWwRm8Vg==,iv:/PxtdHM1eTbRZb0KrjuSSutxBVwmFaSejp62qb+/D10=,tag:K/EH8Rl6CeZcigftKO3hNw==,type:str]
github-token-with-username: ENC[AES256_GCM,data:9k+TaxVIQ6BUASckGTAAdDsSS1OQ7WfF6oUdY8t/24VU5bK3M2Uozbfh6qUtmZFLcA==,iv:4AE/eoXHm1/gd3SdRYY+LyI56YFod8YD7ZKZ6uG840k=,tag:fboN3lX6vKVZHEtaZ+C8Gw==,type:str]
id_buildfarm: ENC[AES256_GCM,data:4Oq/x3xuWH9FsCFjRgg978X4bJMd/JwxtIVSQBEMEurL9o5WqACBhpd8HXOPnFs3p4XL2Mfi+if1zzWai2LmiySuyU4VGAn+c+IK29C7nvgjFF1ywuu0ivWKMHCx7slDgsGzEO4AQ6IdxcVoRpANaChz9HF33ebZcwiasu2ZxPouSjKp7vpXUv7ZiCkagDxpLGRwkwsWdGHkBJsWli0PVwttXyy+UG6CajOQbPkk0CPcQLsgi2NFOrfbUXth5gcFF94WSoHElsU5BETZcHKJnXu6s0rdR1gsV1b4nzHlyTgDD2R47B/4ly+ocnQw4k7Nm9U0aei3DSoGxXdfYCFyL3N3w5ZHjkwm5Nl3RpI+6Zv1LHhHYROnfE+/E0GyBWQ33l9OqkrDHcxMnn0R7hvDkGjxEmrXyw2JD89xkDuOERMasBm6Th3cJ/1kVaxnw8b+8HsYX10Wx1PuYEagTEvlXL+bXBj2Rv+u+l1VLU04L6useL10yW2+Kop+T37w69Dc01FB98xm1UJF8SfMg2pgKqp4Ze+8bUk6ITrf,iv:KlHLfglujK0WnUW9K7ePwXAtoFsb0l4TeKk5OUVlr5U=,tag:IAZb34yvAjneJWI9XOi1Ug==,type:str]
hetzner-build03-borgbackup-ssh: ENC[AES256_GCM,data:HfeKBdbLeta4r2iqkqbj7id/AEebLXEob7uU2jsOa3sca2AkItnzfa626ixTp9OqlYxNOIRU0ZrC+tF5vmEa4ZQtHZeXlKWc2rmP/B/DhyIaYcxS7XObUeKpQ34g9N6mwzh1Uxoj7obZYZbUW44Opkrz5Fj62b+F9qOmGU8x2VXp7LiMElANLIjKIGD6I6BrYUbVwjVFw2ypajfWKnQS8Azdn5fIxVI2hlODIuztIOHkENDqMNmljMDqGD4jcRXGnFdeAjEAijj4IXRKWmCcWm07RcmG2vQGzmr6Z3l5K40+GpumfLdBz+bl3zZl9pHfksjq5mEZcAWscsW8SVPTFI+015RNsirfhTDI+j7ByXsQMf6xCi34Vz+vdv0ylGh09zCqVETwM5O3/pdbnAcsiyj7erYdiCyYzuTGhHmNSOTLdPe2Cahw3Ih3QQxREbAlyYtLc4rjoMaka33IxIzkc4wb2Cc+9Ji9m6MS7imS/KZoX0YJ0pAbNwkBHRwZEouVXNID,iv:dU7xtqDWfvJGC953fElbBq6xou3cVTs7Vs5xQk1sI8M=,tag:onXBKtpBRAgFI8Br8yJx3g==,type:str]
hetzner-borgbackup-ssh: ENC[AES256_GCM,data:/IFOie/xNTdthMSaH6Ltz07E9zoSC++OItZrWLuJAB8oqgVBZgs9uRdfz7ISKVgOwjTXBpWj1BJGFX/qO6repWPrIfULnrUzGrBmYc6yFmh38CI1ePr5vQMbPdXR009bh3rcuJ/FE56eDAZbeR3VWyYxRg/qtaddYiQFx08UVQjrWvw5ow9tz7zATN7c+KOclM1Uz2E7kSmO4vzXiDlaFjPQfFmCw+km0rxhUMnK07o2+7dt90/mtLIBZEOkof0e3LhJxcOEu+hsZjmkCENxASVyn6U2CHzh0x/L6Jic/8Z6rycW4OIzTGnQ08ZHYWGUwRN14CnAnVdwbZEBLWmX5gdoYiC5Qj2z3Egd91F8daCXlllLTkFiKAydLsuVOSCptO5rPPxOc2Uxbq93GyhDwQSDJf/sYDHf1MeQ0vCmAdFc9yJx5tjCYyAWYqiHML2edy9V3mhT2LnzBhWl0r0cp5xQyYeF7X1UYzIiyg3+VrEd61Yhhza8MmbE46/lVNoPMQkn,iv:nPYh3g8FnyuLcrvJchxzXK6wxJX65LQUpsk6QYY2h1w=,tag:pV88bePvVCVdRUVvM3E/bg==,type:str]
sops:
kms: []
gcp_kms: []
@ -64,8 +64,8 @@ sops:
blYxOTlvUXRIZVR1bFByOXlWRFdGbnMKX2tfgtOnWMm8g4tCPeO3/poTkncZUCoS
MrBJuCFYJJUUwwvu/1Whyv2WNE0uenaa+fe5kade0vO8Ke2OPfxVfA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-04-30T04:02:55Z"
mac: ENC[AES256_GCM,data:ZIEXlVfPVcIkub1q5jHuZv2T57ypQgJuFX6d8nKVZDTdeJO2scj+rPf9wIFRAPK8mIiqz39Q2mgRG0Yh3fDfyrVmjpwhzam57l9ooxHrdFLiQf4jcgp7CbON3DrF+OfwfBLNtd+730wOhyg/72xozxGFjgvMKYPEbsb8sovM9nc=,iv:ejocsGwstb+pNkXeyl+kPqyBIpSgIYQz2gHtAu4KNVM=,tag:5yt+FnVUvZ/kzr7n9QJagw==,type:str]
lastmodified: "2023-07-02T00:08:59Z"
mac: ENC[AES256_GCM,data:zA3z9hwx9+m4bbvM7lsmgeZlD9PWmcsWEBFOWdPZKnQMy56UZf+qRQjNBA66UhKbEgmr5BKvQXCta5HZJ/M7rIp44uiHAq1r+ssoEBW1AKafmv4JSeeLA0S4WidpQv0n+Cq30EauX4CECwfi5rviL997q/Yamg4T3+mW9rQI3jk=,iv:AfS7TSNIOypDO7LZmcxbQwRYHzfjGECSBcnBnZtVeww=,tag:P+Wbc0FEZ3lkmkwU6Iqg2g==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

4
modules/nixos/security.nix
View file

@ -27,6 +27,10 @@
hostNames = [ "aarch64.nixos.community" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUTz5i9u5H2FHNAmZJyoJfIGyUm/HfGhfwnc142L3ds";
};
hetzner-storage-box = {
hostNames = [ "[u348918.your-storagebox.de]:23" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
};
};
services.openssh = {

7
secrets.yaml
View file

@ -1,11 +1,10 @@
build02-root: ENC[AES256_GCM,data:cNqf/Gw+d6mi5buPZu4+,iv:afT+IPf1HY98QQeBEVEfelEpcxTZHsAmDttEdyfvkWA=,tag:MUjl56D52rsHfpqt4tGcnw==,type:str]
build02-admin: ENC[AES256_GCM,data:rTVQQnj9yBaiUnib4GAYBsoDZjs8PJ0kb6GLr3iOhhW92s26veybw3ZsdGSEJPdsE0xD9NtaN8DHfMP/bgA1gUX9y2+qcmRfkbT67LFo9fkw4AKSkC5fABtq1EeHQfE3zLMebVO2g9xnQ3w7Y/HFX8rUlYDA7GhYrTgL7FwXNE+/J6rckv9aW0GxKjvFAhqkCbXxDGHebxpIBDbgF1JldmHDFQ==,iv:YXERjZTyNGAlK/9C4i2L/P9p+P9cz46/yk/fda3ryu8=,tag:MuDFM6zg+LSoPkkmK3UFgA==,type:str]
build03-storagebox: ENC[AES256_GCM,data:CclKBgAoiaK2jf1l2IuE8w==,iv:IEn77G6EwrfNucNDmrrlliKZFx1S0rfbXOXzqqU2NUI=,tag:BtbzDUjDfRwj2fhNexXx+g==,type:str]
build04-root: ENC[AES256_GCM,data:Qy3xWgN6HCYRxAd/WArd,iv:2OT9i2YFHqiRx8cyPZ6oW/rxWNgqXdzD+Kk4dP1HbrY=,tag:JQ76gLcCau+ozMOZPcifeg==,type:str]
nix-community-alert-bot: ENC[AES256_GCM,data:Yg69dnfFGXtMTLeyXnMjeIc8+fBmeA4lEYNwSh/ahHdVd/um8oe+CSBDhIqio2sB+GrrpoNAwMf+6rC5fK7q71eAoKcrzjz2nneJdYY=,iv:fbF8t1ySI4qJ+uj33k2N9C/x7bCFdR5OBI/CGhz3zC8=,tag:xcY0Zxtb/w9vRpA56ro8Hw==,type:str]
nix-infra-bot: ENC[AES256_GCM,data:+YRdg8wzRtAUF5GbWvO++qgcyi0st/nMu5PS/IgcBpFj1Zsazta7URuLkSiDFpZDzQYt3bgRzv2dXjPS23hZFoLqgaYysq1E8RF+lvQYHbkMXfR8d8DeFIOtkucW1EIdYMnzEgvfonbF1j3fiy7aDvzDjMK0CJrHzqnDpiYb7W0rMCTyuOyrm0RVw91GN6VTZOrR3dOykJoO4di0qLMlQ2hdYNQi3XQBntvB58gjr3AmtUhuSfw9F4UXdqAPLXi1FnT5rxpBEA09N9Y=,iv:LFqq3WvxlOaz2hQpbcjMDXWWdGqJRjLSQLLZdypHK6I=,tag:PG5sECQOZ6AKW8eGbQSA8Q==,type:str]
cloudflare.com: ENC[AES256_GCM,data:HtBSlzYtzeV4qrBlNdQXNQGRwEt/4dKt6iH4+ryOHib5HDJxJhG6zYneItFxQ10/fuJlXqLizfladsUzADvvEwCp4KJ06HaZn1do56J3lelDz+ROOuKzvTncGt/Fu4rjwT2SSHXmV+XTy8B3iBXDoX/d/u87J+j5y+BLY2XDLcq7YMDizyV/qg4kboKp9r5lravvNx2ZOj9T1TnKkJBJ32lH7Iz7SHo4qYOc/IBGXAS+e2qGVPCLWuygKg3mxTJ2Y/y6ba6JuC97fEo=,iv:dOACToYa8S44ANNIsHktD/lAG+VR/+mMqcdF8n77yaA=,tag:eqtUmKOGb/hFLIRl0FXNeA==,type:str]
hetzner.com: ENC[AES256_GCM,data:/d7o18AVUd0QtNJN1i03DAEJPebmbiA48QpZBScTJAFxnh+FS3Pf0wmq2CvLoTd/BRVTRUWyHKepzjYA5uOvzgviIh5D1MNLt/M1LxD3qz38jCIpwcqarjdxTVrsqgXFcSGTLxmgwgc=,iv:Sesoc31WoKH9kkfUEc7MGq9tdAivxWFFFI8ooLg7e/o=,tag:k8UpnH1LpdCmCBKLG5jU5Q==,type:str]
hetzner.com: ENC[AES256_GCM,data:rcYjYibR7lrdr8JTJ/ljS913kTjsC2J8HEcORA15x52l7+yYFS6FCsrWanFQaM8yc2w7NDp6+ND8PhQh5PLzuIJZyWHcosetJ9/Ow3SJjqNMnH2GogD/23iS3zwg2gKvnyMp/7gDIUkzsqHVysx3GIWjzq7Hdyq8Ls9/GIPqU8VYccR+nQ==,iv:kXygbJHHIJUkz/NAuAPBxqGAepLO/o3WVYz6YEwmrio=,tag:SKOCB1T8Cv5qkH856UAHvw==,type:str]
darwin02-m1: ENC[AES256_GCM,data:0WKa4cWpEqWvZrEn,iv:ig+gD7ucGVh2WKVzmuxMiM9A2RJVM0E5avRzzc2Zqjk=,tag:6y0rEvjui0spqeE9uP+L7w==,type:str]
sops:
kms: []
@ -58,8 +57,8 @@ sops:
MkcvL1JyVFBJV0Y5RFFCMGN1OUFXdU0Kdx1wy6ZOOTg1a6VKaq52SMBvC26lMsW/
oMP+hmXc2WtoqZp+jZ9rrXz6cZW6/dO7CPqxl3aUEKg6BkXIwgyKeg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-06-04T04:05:42Z"
mac: ENC[AES256_GCM,data:nU8FuHREK7NxNpMXYKyQVIv2FpncnMr5UhyrfXV7dgbCvnIxlLWP60O5dAXaZqK1DWtD3XaJzmznyyFEnBMmvJLKY9TOcp5QWIxEZk5vZYEq0hkEdWLplJKYYp2h+YOhptIDqSbOPi7SUreK+qICOpOYYYxgtJxGH+ze3pGFmPM=,iv:FL3KBQNbS0yN26cIs8tLahu/u+W7571TvT1OWRBfdYw=,tag:HP7RbM+UjQ4RNjuKQubm8w==,type:str]
lastmodified: "2023-07-02T00:08:00Z"
mac: ENC[AES256_GCM,data:iFcgo424SyC/tLdDWkgWfJQBJMjdq1Cl3tuve23yLuXd5jT0R/3c6OFBluKi2mtljt/3uPu8U4diA1HMUOHkuQ51my/CRXO3mrPkClltJe7qnitfdRzhtXEJa7ESMbdRRe6r5Qp8z7eHsCYDmZvebtBHUhxwfqcrgWEMddzjtOE=,iv:FVg44atkuC0d8HjfoWisgYVtnJglFlAw6nNpvIiFEEc=,tag:DHyZk8tEpvGajqUjRNR1Mg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3