- Services: Added Part-DB

- Implementation: Added nix-sops based secret version controlling.
2026-02-07 17:31:23 +01:00 · 2026-02-07 17:31:23 +01:00 · 5e68e6ee96
commit 5e68e6ee96
parent 99a0ed1719
19 changed files with 258 additions and 86 deletions
--- a/nix-system-configs/secrets/songsheet/example.yaml
+++ b/nix-system-configs/secrets/songsheet/example.yaml
@ -0,0 +1,31 @@
+#ENC[AES256_GCM,data:WivH9NVGw2eQUc+4xk3IXc355x7dddo3f/C0f8Pl0JJJCBhvmGI=,iv:5g32fF7BGOUO5/5GkelUBeTP7d0oyIPhAajZHpXIKiY=,tag:fNlYIPKPH8CiZsPvQmgODg==,type:comment]
+example-key: ENC[AES256_GCM,data:aoCe/3ALWztLUQ9wyQ==,iv:BFDhmeK5LqqVvh5lBoPIaAXkV0Qi0K2maEwSFuOLO2Q=,tag:PIKqisBResQh7nhv8kxXAg==,type:str]
+#ENC[AES256_GCM,data:QMlHRBS1gtTdUMs/gzvekyAAnDHqE9KA+deYvxP18aIln5vX/aFoi/heQp/9W33hiqv5Oc4nepg=,iv:ceJjaqud+qbMWmfJHDmKJeGtO/2BsWQEzeMtQL1WZI0=,tag:QlR7GZ3Om3mT0Ycq3UdJCA==,type:comment]
+#ENC[AES256_GCM,data:E1y/QQ1q5u1nC0gjutZuiA1TN6zLWD3EI9qdu8phRZ34GNIytQ5FJpTv+P9JGUN19wpj8S/ZFX3SxqGLIxq5eCr8Zl4gL5bc,iv:3mdIV8+2BEX9NX2PfWtjqKZmR45CpEKvGrd5FqvgMhM=,tag:x5aAWNR/M3OqLRmCAx8frg==,type:comment]
+myservice:
+    my_subdir:
+        my_secret: ENC[AES256_GCM,data:mTlHHpNvgJGz,iv:Nb3HWXKMI8DopwB020lYBJc/wsLAxl+6ZpYtrtDc4Ic=,tag:sV/2xqwdWzAdcKo6Z1aS+A==,type:str]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArMmt5dzBaOHV2ZXJNVjUx
+            Smdxc2w0QXBuQlVZZzYwK0h6Ry9ydnEyWFFNCkdZLzk5RkV0U0I0dmROdUZNUHND
+            YWRlQnRadWh4YWVHRFF4N0JsanJjc00KLS0tIFlNWG9nSUVRRnJJY0xVZDNzNVE1
+            MU5xUGlNcWxYZUR5bnI4NXlzZ1F1ejAK+jaAVZ1ePZNWzyIRNZQwLn1YIbQ6czTw
+            jOO6XHvDJAFzJotjPRqjstiB6aWzGoNXsE2DzWu0MXSIpeGpn9d3tQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSGFBTktSaHorcE9iOEhh
+            NDhFbGpySXRYeGhkb1BqTjU3M0V4M0srL1ZFCk81OVRnUzhZMVNnMzlkbTc0ZDh0
+            akJqMHRXV0xvY3JqczNsV0lQeVRGNEUKLS0tIDgwYk9vOTB2aUVxWnpzRTZMQUZx
+            UzdHOG0yUGFLZnVGeExwMEp3LzJ6QncKDGGZ1LvafbZ52GOIk8SyhvPIU9hayd+G
+            FGOgC5n0pbBhk7/OM6JQrc+I5df5Kg4mAaTZ+ANgPBDUrfwFA0EyqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-07T15:38:34Z"
+    mac: ENC[AES256_GCM,data:xZg0gY7K1scWgZ4ITRLVPqx3igffvcQTf0/UyUPO7y0AEmxWpPt5sAdHJujjTjXAuSiLV8+XlEAH9ePh6gx8NZDXfscMsjyyOXGcDpYzwSfoWpFsSB4oeDkOw/vy0YTmEbs9R9pXU6Kc3TRnXbZNYzwZqgoI20GXxBesDxDrp4k=,iv:KCKtqUfdi8alD7wxVgF/wTjUoHfYC48r7Ar8NKy4TFM=,tag:U0RU11e/I4C361dDe5jH8Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/nix-system-configs/secrets/songsheet/secrets.yaml
+++ b/nix-system-configs/secrets/songsheet/secrets.yaml
@ -0,0 +1,25 @@
+songsheet/database: ENC[AES256_GCM,data:cNZsgTmTSjHXK7k0R7/Kz7kW6MacTkzcqZrZd/DswVm1yPQEm9oJyPNCv39LqEvKKNBa4XA0HmjaHzOBHMAr1zSG1vRRB7Fe3ZSQaxAeamRh7X7BxkxXkdvnCtcQ6wNe,iv:aF7skRVNlvoJp9UNBNMEZSMI/hRXnZ6GaDX+GOvVqdQ=,tag:Kytf5ciAd1uSUZVwfOJpbA==,type:str]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMZE9QbHFZUGFBa0V6dVha
+            YUQ1a2FKdG96dTVvbW91VzVQL2tkZ3pKdFJBCmJmUWZYaVRmWkM3ZUNxbzhrRXg4
+            L1p1SXhvQXFzUmNaYUVhRm5PNmVzcFUKLS0tIEl0aXJGcmRPVmpmMVlSb3BZVnhL
+            K3BpOGZQbG0wR1UveGkwWUU3SjV6NU0K1ThvPddlKv/KaZceGuGv8DDKgdAi7+yZ
+            rmRI6b9IibZ7F7ECMjEB5Ks+ETi4Voi2lm8UhxlTaL8SDfJc4tCiIw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NEs3NjR4Ty8xeG1HQ0JT
+            REVBN1VWRlJ3UlhsTk5BUTN2TStBMTdVa21RCkhtQWFXeXQyMFlMSnpBWnExWHR1
+            WGhMZUMzdWZlWXRkdEY4Wm5xVllIUUUKLS0tIDRyaVpLUEFKNk05SnZJZ3N6N3Vv
+            OVZNS1ErTm9hN3IvSHB3bkY1SE5OQlEK1g4PhqXmqIlDLYBiHnH7Z4hgDyhJLH8H
+            yxfbmpCb9eF3qDhTVD7Cw20sO4YX32OujkCrbnEYS5/tRxEiOyoNHQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-07T16:09:47Z"
+    mac: ENC[AES256_GCM,data:BR7Vh6P+BseiL7kiK7aHDyV8P5yWxZH3FCX4ubUevOZyGqv+J7CwO+Ezz/E6N3V5E15krfqTPJZtsA+5lXxf8Jl13ylZ/kR27iOOLFy4XTOaQ5aKMGLIjJ7Mz/V4axdfvW/rNgpKAYXth1OaGrl054ua6i6AQ95LHphbofihtTo=,iv:YUku5Nu8xA5E9vNvcGp1M/3x3ug8yNDpciGhXneUtAQ=,tag:AM0rl4ScEji9jkykYoJvzA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/nix-system-configs/secrets/traefik/test.yaml
+++ b/nix-system-configs/secrets/traefik/test.yaml
@ -0,0 +1,34 @@
+hello: ENC[AES256_GCM,data:Ht0+7vR6M8YQn3AiMd8VRXX8r5LIjIy/lA8wDytdZwJI8aj8NmJxgC5a5llBSA==,iv:7nmFM2BZYX//LVEdCOCtMSOJL15an/A3UOGtTjma57c=,tag:1GxNe1Kh5v4KNJAoi8TKmA==,type:str]
+example_key: ENC[AES256_GCM,data:DPLNFkv40KHgypLLWg==,iv:c3LfkDlckJbSiWBmfD6O6MXvIPM8ps8Rv1h2W9DDyOs=,tag:d+e23wPKvwFySmevmULMdQ==,type:str]
+#ENC[AES256_GCM,data:arG8CBMdLjfBCjmdyTP/lw==,iv:9PcE6aokqhUp/+j3QaJSPJ6H+YjnFOkztinI9sSTZ+k=,tag:+KNsGsKIf8XRNf2V3FRRUg==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:/nVGqCjXBoYAkdCHOrRO93/jJg==,iv:rdONhvd1j8AvWi9M19pR1p00QwuB3bz/Q/S4U8ZfjBQ=,tag:iWDJ7o4ChllJJcNDvhGthQ==,type:str]
+    - ENC[AES256_GCM,data:/Kgmo6PFheSZbNlKnUVG4rEAwA==,iv:WSEH0q234nDkiGcM3gs/vztWiV6UlkLSSy57kJWKt9c=,tag:d+hu8tM2LOSNn2orVxQZhA==,type:str]
+example_number: ENC[AES256_GCM,data:qfxirRhQiqU5XN9iRg==,iv:dTiPBUs5RCEYD04DQZxoXB8lPDrAu+Ra4NvLBmx3X9E=,tag:w43whPCNQmUumBdZ2sD5pw==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:+1KdwA==,iv:8JXmEdeukxQIDfy4eacQ48Ayl3cCRfPNcSjzQYC/Yuw=,tag:erCKahtbNDD1S8MilF09Jg==,type:bool]
+    - ENC[AES256_GCM,data:Y0eWzvE=,iv:MjhUjfHcE+WPkxnwK7m1RMujVcauo6Ftx496R+wdJ7c=,tag:FqiTsd4UinkJ1hnST20Ekw==,type:bool]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaHlPc3ZZWVZJQXhXaG1u
+            OHFDVGxmcWVZbHpmRUlqYlZMRkp0WlU4L25ZCkRGbzJvRDRKOE82bUVlTFVJcTQy
+            R20rRklCZnMwbVEwQ3FtZGpYNlI3VEkKLS0tIFVLdkp1SEM1Mm1xRi9ZV0o5RlA1
+            cWtGaTJkdU12NkI4WVREOEt1VHVYYVkKs4lPeAhAazGAo5MZp7gKVYlrYBoNKBid
+            91ayxAbJKVrUnapd+QNDFG2+apDuirbWhKSxCPnLUEed+YMKNzQVgQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUWmpCTGtoS3NpdDVrMS9V
+            ZG9mZHgzeUpTWVRLVDVMbzFybmF3Q09KekJrCjlBdEZzcmxWcFUxdnNNZ2FuK3Nn
+            d1RZLytJK0RNVjdTVzFRWHpwMUMzRnMKLS0tIHFMdjErdzNDc2I1czVCRzBlR3o0
+            NkMrTEtzK3BSVWN0bk1ITHlORVd0bWcKSN/WwEZ2KJwYr3WLShF2gAG/ECKYk8ut
+            Ay3lMgsQJERQ5xQnauEqinELaN/FQHJgBFYkRgIAb/JU14a6viwDoA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-07T16:28:39Z"
+    mac: ENC[AES256_GCM,data:CK6lT9nrLAE6r+6C5vadtYr6/uP9WcbpRM1QZnNjOblaDvgfGQvQMc3u3Ddu93d9sg5M6bVIh8gUDz+f5KkqMEAnLD+thy1Zl05lDUQFm0TCy1X1uHks3V/XvMl3m5kZYFf6sq4fpN3dwdP2NdofbffyTeD8mqA9j6YHTID4yxk=,iv:GhgePFxI0L83aOaoW5LB/5Q8h730GTcmvQdktrDmRls=,tag:AzOPttDhfJmw2JfnquoAjQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0