root/the_prg_server_configuration_old
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sunset the build machine configuration and move it to the newer format. Setup the Forgejo Runner.

Browse source
This commit is contained in:
Root User 2026-02-12 16:50:52 +01:00
parent b66ab168d6
commit c7d4fc7e47
Signed by: root
GPG key ID: 087F0A95E5766D72
8 changed files with 413 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix-system-configs/modules/secrets-config/notes.md
View file

@ -1,6 +1,7 @@
To generate the keys beforehand
```ssh
nix-shell -p age
/var/lib/sops-nix/key.txt
sudo mkdir /var/lib/sops-nix
age-keygen -o /var/lib/sops-nix/key.txt
```
And then update the .sops.yaml in the project directory accordingly.

38
nix-system-configs/modules/secrets-config/sops-build-machine.nix Normal file
View file

@ -0,0 +1,38 @@
{
config,
pkgs,
lib,
...
}: {
imports = let
# replace this with an actual commit id or tag
commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
in [
"${builtins.fetchTarball {
url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
# replace this with an actual hash
sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
}}/modules/sops"
];
# This will add secrets.yml to the nix store
# You can avoid this by adding a string to the full path instead, i.e.
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
# This will automatically import SSH keys as age keys
#sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
# This is using an age key that is expected to already be in the filesystem
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# This will generate a new key if the key specified above does not exist
sops.age.generateKey = true;
# Export individual WireGuard keys from the SOPS YAML as text secrets so they
# are available both as strings and as files (.path)
sops.secrets.":" = {
format = "yaml";
sopsFile = ../../secrets/build_machine/secrets.yaml;
owner = "root";
mode = "0400";
};
}

15
nix-system-configs/modules/secrets-config/sops-wireguard.nix
View file

@ -35,12 +35,12 @@
mode = "0400";
};
sops.secrets."wireguard_preshared" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0400";
};
sops.secrets."wireguard_preshared" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0400";
};
sops.secrets."wireguard_public" = {
format = "yaml";
@ -48,7 +48,4 @@
owner = "root";
mode = "0444";
};
}