This brings the openbao agent, a Go proxy to make the link between
systemd's LoadCredential and the openbao agent.
All that remains is to configure authentication on every system we need
to use OpenBao and then the templates for every secret we care about.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Later, we should ensure we trust only our infra chain on all systems to
allow parallel paths that have nothing to do with the infrastructure or
multi-tenancy.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
We can now derive an infinite amount of subCAs as long as we do not
violate extensions constraints.
Additionally, we can build Vault policies specific to the PKI endpoint
without encoding the mountpoints.
Additionally, we can build Vault roles specific to the PKI endpoint
without encoding the mountpoints.
This adds an example of deep-derivation.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This is our first CA, stored on an offline NitroHSM held by Raito.
Expiry date is set in 3650 days.
This was initialized at 38C3 on day 4, in presence of:
- 4 witness
- 3 board members
This was not backupped on the same day to other HSMs.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This way, we can autogenerate records for storage and builders nodes by
reading directly the configuration.
This makes evaluation of `nix run .#tf` slower, but this makes things
more safer and easier, so it's good.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
We really don't want to cache them for a year, which is the default.
Yes, computing them may be expensive, but not worth a multi-gigabyte
redis database that takes minutes to load into RAM on service (re)start.
It has been a recurring issue that flake lockfile bumps in this repo
here make the forgejo patches no longer apply.
The dedicated repository (nix-forgejo) solves this by not overriding the
existing forgejo derivation from nixpkgs but rather having its own.
Additionally, nix-forgejo pins and uses a "known good" nixpkgs revision
itself, unless `pkgs` is passed on import.
So if issues should arise after a flake bump, we can use that revision
by modifying our import statement, or we can rollback the nix-forgejo
revision itself.
Moving forgejo out of tree also makes iterating on it a lot easier and
opens a lot of other possibilities :)
Username and vhost creation are out of band and manual.
$ cd /var/lib/rabbitmq
$ sudo -u rabbitmq rabbitmqctl create_user ofborg $pwd
$ sudo -u rabbitmq rabbitmqctl set_permissions ofborg '.*' '.*' '.*'
Here's a simple way to reproduce that setup on the RabbitMQ server.
Doing better will require the Vault server which will come soon anyway.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Status & checks RPC & event queue.
The status & checks is set by the rest of OfBorg, the web service needs
to be exposed.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This pipes events from Gerrit into the whole AMQP broker and enable all
the system to react to VCS changes.
We need a filter to transform raw Gerrit events into ofBorg specific
events that we will continue to send in the system.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Via a fork of the Linux Foundation, called OpenBao.
The module supports high availability but we only have one node for now.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Introduce a data-only module to perform abstraction on the deployment,
we use it for WAN for now.
The usecase is service discovery for simple cases.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Now, we won't pile a bunch of failed streaming attempts and this will
automatically push to git.
Credentials are left to be done for the push to actually work.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
We are running into too many out of disk space situations with OWS on
the main disk.
This way, we can reuse the Gerrit disk for all that data, which
hopefully, is quite shared with Gerrit.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
