let keys = import common/ssh-keys.nix; commonKeys = { # WARNING: `keys.users.*` are *lists*, so you need concatenate them, don't put them into lists! # Otherwise, agenix will be confused! global = keys.users.raito; lix = keys.users.hexchen ++ keys.users.jade; floral = keys.users.delroth; }; secrets = with keys; { floral = { hydra-postgres-key = [ machines.build-coord ]; hydra-s3-credentials = [ machines.build-coord ]; hydra-signing-priv = [ machines.build-coord ]; hydra-ssh-key-priv = [ machines.build-coord ]; netbox-environment = [ machines.meta01 ]; mimir-environment = [ machines.meta01 ]; mimir-webhook-url = [ machines.meta01 ]; grafana-oauth-secret = [ machines.meta01 ]; loki-environment = [ machines.meta01 ]; gerrit-prometheus-bearer-token = [ machines.gerrit01 machines.meta01 ]; pyroscope-secrets = [ machines.meta01 ]; tempo-environment = [ machines.meta01 ]; buildbot-worker-password = [ machines.buildbot ]; buildbot-oauth-secret = [ machines.buildbot ]; buildbot-workers = [ machines.buildbot ]; # Private SSH key to Gerrit # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHx52RUPWzTa2rBA96xcnGjjzAboNN/hm6gW+Q6JiSos buildbot-service-key = [ machines.buildbot ]; # Signing key for Buildbot's specific cache buildbot-signing-key = [ machines.buildbot ]; buildbot-remote-builder-key = [ machines.buildbot ]; # These are the same password, but nginx wants it in htpasswd format metrics-push-htpasswd = [ machines.meta01 ]; # Yes, even Lix machines are included in this monitoring infrastructure. metrics-push-password = builtins.attrValues machines; ows-deploy-key = [ machines.gerrit01 ]; s3-channel-staging-keys = [ machines.gerrit01 ]; s3-channel-keys = [ machines.gerrit01 ]; postgres-ca-priv = [ machines.bagel-box ]; postgres-tls-priv = [ machines.bagel-box ]; newsletter-secrets = [ machines.public01 ]; s3-revproxy-api-keys = [ machines.public01 ]; stateless-uptime-kuma-password = [ machines.public01 ]; }; lix = { buildbot-worker-password = [ machines.buildbot-lix ]; buildbot-oauth-secret = [ machines.buildbot-lix ]; buildbot-workers = [ machines.buildbot-lix ]; # Private SSH key to Gerrit # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHx52RUPWzTa2rBA96xcnGjjzAboNN/hm6gW+Q6JiSos buildbot-service-key = [ machines.buildbot-lix ]; # Signing key for Buildbot's specific cache buildbot-signing-key = [ machines.buildbot-lix ]; buildbot-remote-builder-key = [ machines.buildbot-lix ]; }; }; mkSecretListFor = tenant: map (secretName: { name = "secrets/${tenant}/${secretName}.age"; value.publicKeys = secrets.${tenant}."${secretName}" ++ commonKeys.global ++ commonKeys.${tenant}; }) (builtins.attrNames secrets.${tenant}); in builtins.listToAttrs ( (mkSecretListFor "floral") ++ (mkSecretListFor "lix") )