From 7c7f9d0f6ea2542406de2ea5f4f09106d8ab52c7 Mon Sep 17 00:00:00 2001 From: Miran Bastaja Date: Fri, 2 Aug 2024 22:19:40 +0200 Subject: sagittarius: set up nix comin for automatic deployments --- .sops.yaml | 2 ++ flake.lock | 21 +++++++++++++++++ flake.nix | 5 ++++ hosts/sagittarius/default.nix | 14 +++++++++++- hosts/sagittarius/sops.nix | 10 ++++++++ secrets/forgejo-access-token.yaml | 48 +++++++++++++++++++++++++++++++++++++++ 6 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 hosts/sagittarius/sops.nix create mode 100644 secrets/forgejo-access-token.yaml diff --git a/.sops.yaml b/.sops.yaml index 96f058d..d8d94e5 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -2,6 +2,7 @@ keys: - &admin_miran age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk - &machine_wonderland age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc - &machine_sagittarius age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern + - &machine_underworld age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6 creation_rules: - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ key_groups: @@ -9,3 +10,4 @@ creation_rules: - *admin_miran - *machine_wonderland - *machine_sagittarius + - *machine_underworld diff --git a/flake.lock b/flake.lock index 1203d76..387e0b3 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,25 @@ { "nodes": { + "comin": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1720983633, + "narHash": "sha256-Cx1vCu0CGiqDf2IJNu9qyCVDn83mIswVXVnElq5TAdQ=", + "owner": "nlewo", + "repo": "comin", + "rev": "21c57192f34d5d31a57f59f41a432aaa1eb11412", + "type": "github" + }, + "original": { + "owner": "nlewo", + "repo": "comin", + "type": "github" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -353,6 +373,7 @@ }, "root": { "inputs": { + "comin": "comin", "disko": "disko", "futils": "futils", "home-manager": "home-manager", diff --git a/flake.nix b/flake.nix index 1b92321..8324f07 100644 --- a/flake.nix +++ b/flake.nix @@ -33,6 +33,10 @@ inputs.nixpkgs.follows = "nixpkgs"; inputs.home-manager.follows = "home-manager"; }; + comin = { + url = "github:nlewo/comin"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -69,6 +73,7 @@ home-manager.nixosModules.home-manager sops-nix.nixosModules.sops disko.nixosModules.disko + comin.nixosModules.comin ./share/system/common.nix # This directory has to exist and have a `default.nix` in it, see diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix index 2e45e03..6ce0492 100644 --- a/hosts/sagittarius/default.nix +++ b/hosts/sagittarius/default.nix @@ -1,4 +1,4 @@ -{ ... }: +{ config, ... }: { imports = [ # Include the results of the hardware scan. @@ -6,6 +6,7 @@ ./home.nix ./ssh.nix ./web + ./sops.nix ]; boot.loader.grub.device = "/dev/sda"; @@ -25,6 +26,17 @@ routes = [ { Gateway = "fe80::1"; } ]; }; }; + services.comin = { + enable = true; + remotes = [ + { + name = "origin"; + url = "https://git.sorre.xyz/miranb/nixos-config.git"; + branches.main.name = "main"; + auth.access_token_path = config.sops.secrets."forgejo-access-token/sorre".path; + } + ]; + }; # Select internationalisation properties. i18n.defaultLocale = "en_US.UTF-8"; diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix new file mode 100644 index 0000000..7e13f78 --- /dev/null +++ b/hosts/sagittarius/sops.nix @@ -0,0 +1,10 @@ +{ ... }: +{ + sops = { + age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + defaultSopsFile = ../../secrets/forgejo-access-token.yaml; + secrets = { + "forgejo-access-token/sorre" = { }; + }; + }; +} diff --git a/secrets/forgejo-access-token.yaml b/secrets/forgejo-access-token.yaml new file mode 100644 index 0000000..785a078 --- /dev/null +++ b/secrets/forgejo-access-token.yaml @@ -0,0 +1,48 @@ +sorre: ENC[AES256_GCM,data:5mmOPR2pu5CXnNCpTM07MxOmCgGH6R+FPW2FYjcukiOs4OC+c0BlDw==,iv:o9T0TE8gH2BQvibw1KYkojrqQIFcR6YXoctBn4N9z40=,tag:Sl1uvKyCfuR6p57rxj0Wfg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aXpzSXE3M0wwNUpqaUNI + TXdxRndJOXJ0Q05hTXlIYzJ5MTc4dThhOHg0CjFvYmM0TjFrTlJ5QTcreFVqbVAr + SHNzck1zdHhUaUdDTHFVcnAybXdISkEKLS0tIDNNVjZKa0JiMkJUU2hjajBQeWw5 + Q00xdU9xbk5pSk0va080bW9Icng2ejQK7iitkGTEbe4OROpUjwsg+aunMqAWbaad + BjvMNYW+JKdaJz+ofGb+5oPKhwPZfEgvBdj3cgYjqwHSqiZ1W9eQHg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEU1FvQzF5cEh2bCt1Tjk5 + MVRKV0F1NmV4Q2ZVSmY1WldNSEJ5d0lZZkRjCm45WXJrL2ZZSHk0V0EzbkpCbXJC + c0JKYnFEZGF1dzk4WDVEZURIV1hUejgKLS0tIHF1ZEVaR1lpKzhhVHRId20xUVZ5 + WlI3VjhLN3hPT05BT0xRd0tOdnhYV0EKv3kwDTelMRfq6Qb9U7pqrlMygalK1QhP + 3A8KVYJ7/mJVzfnPgzGU0gyZTuF8SppbRIJojPALfyT9K0XxVfG0cQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZdS9YOEUwbU04Um9NZVJ6 + UjVEdVlsdGdDWWlmUEQvbEI1MzNEdTNlemgwCi8xelU1R2tOZHBKNEpDZjZ3enBV + VFI4dTVuZmtacWRBYm9sNUE3MkJUMWMKLS0tIHhSQms2ZDc5c3Q4c3BtbW9yQ1lr + ODdSckFLdUxsTDlmMHhqWDBCNXV0SVkKfplSalbRQ7Y8yNhIDK3RoIS9V3MaWzfG + BK7MoQfA9uQZ+gsXXLiS7UoujEaiS98QkOYuuecswbje5AMFsdpGxg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzbFltWkdSSFdtYlg3bFBZ + czRWTUFzeEk5OEJxSlllN2p2VjBoOFcvTDBrClJyRUVRNlI1U0pjbnFFVGNGRTdl + YTUrOFE1c2FlWWd6bVpLWS9xY1JDeDgKLS0tIHYwQ09zdnhNMzFBRGE5OWJoOVo1 + dDBPb2Z6dnB0ZVk4TXNVbWlMU3hVZU0K44W0rZaPFfO4PwqbDmpy7liQOxD+9G5G + ge0fhygvbn3ENERvHqXZ5hjJXbklWNwbtjrLFPQx3RVk+U/YBR9rCA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-08-02T20:15:46Z" + mac: ENC[AES256_GCM,data:0bl/O2yDAeeFmMWoZGZtmc/U2lIVn56Cuc+QuqzkXFjTXOEul3LgcerB2fVH7jDuU8t3QuIaFI+amJXv6Xk8ABsCZu9m/MPJA59oKE2QXw22SroYsSm0kwYklPTV4aaUpJqp8Ha1ANsm8jENXB5lqsiMbfr2biKBwBfiIKmdnZs=,iv:4KR3rPHWWBMK49Mht0V7kP/cx+0N65MdH9Fd/cp5Ph8=,tag:iew6qF/zuC5nzH1Zz7G7vQ==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.0 -- cgit v1.3.1