Temp repo for Bagel-baking infrastructure
Raito Bezarius
c9aa82ba49
We can now derive an infinite amount of subCAs as long as we do not violate extensions constraints. Additionally, we can build Vault policies specific to the PKI endpoint without encoding the mountpoints. Additionally, we can build Vault roles specific to the PKI endpoint without encoding the mountpoints. This adds an example of deep-derivation. Signed-off-by: Raito Bezarius <masterancpp@gmail.com> |
||
|---|---|---|
| common | ||
| dashboards | ||
| hosts | ||
| lib | ||
| overlays | ||
| pki | ||
| secrets | ||
| services | ||
| terraform | ||
| .editorconfig | ||
| .envrc | ||
| .gitignore | ||
| default.nix | ||
| flake.lock | ||
| flake.nix | ||
| LICENSE | ||
| README.md | ||
| secrets.nix | ||
Infrastructure for the donut shaped thing that is absolutely not a donut.
Quick start
Build the infrastructure
$ colmena build --on @localboot
Notice that @localboot is load-bearing as we have some machines that cannot be deployed with vanilla Colmena. Fixing this is welcome.
Recommended deploy process
$ colmena apply dry-activate $machine # Verify that the nvd log is reasonable.
$ colmena apply $machine
Recommended upgrade process
$ nix flake update
$ colmena apply dry-activate --on @localboot # Verify that the nvd log is reasonable. Run it twice to get only NVD logs shown.
$ colmena apply --on @localboot
Troubleshooting
I failed to deploy gerrit01
Our Gerrit source build is known to have some hiccups sometimes, we are always interested in build logs, feel free to attach information in a new issue so we can make it more reliable.