78 lines
3 KiB
Nix
78 lines
3 KiB
Nix
let
|
||
keys = import common/ssh-keys.nix;
|
||
|
||
commonKeys = {
|
||
# WARNING: `keys.users.*` are *lists*, so you need concatenate them, don't put them into lists!
|
||
# Otherwise, agenix will be confused!
|
||
global = keys.users.raito;
|
||
lix = keys.users.hexchen ++ keys.users.jade;
|
||
floral = keys.users.delroth;
|
||
};
|
||
|
||
secrets = with keys; {
|
||
floral = {
|
||
hydra-postgres-key = [ machines.build-coord ];
|
||
hydra-s3-credentials = [ machines.build-coord ];
|
||
hydra-signing-priv = [ machines.build-coord ];
|
||
hydra-ssh-key-priv = [ machines.build-coord ];
|
||
|
||
netbox-environment = [ machines.meta01 ];
|
||
mimir-environment = [ machines.meta01 ];
|
||
mimir-webhook-url = [ machines.meta01 ];
|
||
grafana-oauth-secret = [ machines.meta01 ];
|
||
loki-environment = [ machines.meta01 ];
|
||
gerrit-prometheus-bearer-token = [ machines.gerrit01 machines.meta01 ];
|
||
pyroscope-secrets = [ machines.meta01 ];
|
||
tempo-environment = [ machines.meta01 ];
|
||
|
||
buildbot-worker-password = [ machines.buildbot ];
|
||
buildbot-oauth-secret = [ machines.buildbot ];
|
||
buildbot-workers = [ machines.buildbot ];
|
||
# Private SSH key to Gerrit
|
||
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHx52RUPWzTa2rBA96xcnGjjzAboNN/hm6gW+Q6JiSos
|
||
buildbot-service-key = [ machines.buildbot ];
|
||
# Signing key for Buildbot's specific cache
|
||
buildbot-signing-key = [ machines.buildbot ];
|
||
buildbot-remote-builder-key = [ machines.buildbot ];
|
||
|
||
# These are the same password, but nginx wants it in htpasswd format
|
||
metrics-push-htpasswd = [ machines.meta01 ];
|
||
# Yes, even Lix machines are included in this monitoring infrastructure.
|
||
metrics-push-password = builtins.attrValues machines;
|
||
|
||
ows-deploy-key = [ machines.gerrit01 ];
|
||
s3-channel-staging-keys = [ machines.gerrit01 ];
|
||
s3-channel-keys = [ machines.gerrit01 ];
|
||
|
||
postgres-ca-priv = [ machines.bagel-box ];
|
||
postgres-tls-priv = [ machines.bagel-box ];
|
||
rabbitmq-password = [ machines.bagel-box ];
|
||
|
||
newsletter-secrets = [ machines.public01 ];
|
||
s3-revproxy-api-keys = [ machines.public01 ];
|
||
stateless-uptime-kuma-password = [ machines.public01 ];
|
||
};
|
||
|
||
lix = {
|
||
buildbot-worker-password = [ machines.buildbot-lix ];
|
||
buildbot-oauth-secret = [ machines.buildbot-lix ];
|
||
buildbot-workers = [ machines.buildbot-lix ];
|
||
# Private SSH key to Gerrit
|
||
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHx52RUPWzTa2rBA96xcnGjjzAboNN/hm6gW+Q6JiSos
|
||
buildbot-service-key = [ machines.buildbot-lix ];
|
||
# Signing key for Buildbot's specific cache
|
||
buildbot-signing-key = [ machines.buildbot-lix ];
|
||
buildbot-remote-builder-key = [ machines.buildbot-lix ];
|
||
};
|
||
};
|
||
|
||
mkSecretListFor = tenant:
|
||
map (secretName: {
|
||
name = "secrets/${tenant}/${secretName}.age";
|
||
value.publicKeys = secrets.${tenant}."${secretName}" ++ commonKeys.global ++ commonKeys.${tenant};
|
||
}) (builtins.attrNames secrets.${tenant});
|
||
in
|
||
builtins.listToAttrs (
|
||
(mkSecretListFor "floral") ++ (mkSecretListFor "lix")
|
||
)
|