58 lines
2.4 KiB
Markdown
58 lines
2.4 KiB
Markdown
---
|
|
title: "SOPS: New Host"
|
|
summary: How to Setup SOPS for a New Host
|
|
---
|
|
|
|
# SOPS: New Host
|
|
|
|
The following outlines the steps to take for setting up [SOPS](../concepts-and-configurations/sops.md) for a new host (`myservice`).
|
|
Every host needs a SOPS configuration as every host should be set up to run ansible-pull.
|
|
|
|
1. Create a new age key for ansible-pull for the host:
|
|
```
|
|
age-keygen
|
|
```
|
|
2. Add the public key part to the [`.sops.yaml`](https://git.hamburg.ccc.de/CCCHH/ansible-infra/src/branch/main/.sops.yaml) under:
|
|
```yaml
|
|
keys:
|
|
# ...
|
|
hosts:
|
|
chaosknoten:
|
|
age: &host_chaosknoten_age_keys
|
|
# ...
|
|
- &host_myservice_ansible_pull_age_key <age public key here>
|
|
```
|
|
You can use the existing configuration as guidance.
|
|
For VMs not on Chaosknoten, choose the appropriate section.
|
|
3. Add a new creation rule for the hosts `host_vars` file to the [`.sops.yaml`](https://git.hamburg.ccc.de/CCCHH/ansible-infra/src/branch/main/.sops.yaml).
|
|
It should most likely hold all admin keys plus the host entry you just added and look something like this:
|
|
```yaml
|
|
creation_rules:
|
|
# ...
|
|
## host vars
|
|
# chaosknoten hosts
|
|
# ...
|
|
- path_regex: "inventories/chaosknoten/host_vars/myservice\\.sops\\..+"
|
|
key_groups:
|
|
- pgp:
|
|
*admin_gpg_keys
|
|
age:
|
|
- *host_myservice_ansible_pull_age_key
|
|
```
|
|
You can use existing creation rules as a reference.
|
|
For VMs not on Chaosknoten, choose the appropriate section.
|
|
4. Re-encrypt for the newly added key (mainly `group_vars/all.sops.yaml`):
|
|
```bash
|
|
find inventories -name "*.sops.*" | xargs sops updatekeys --yes
|
|
```
|
|
If GPG yells at you, follow the instructions in [infra-secrets](https://git.hamburg.ccc.de/CCCHH/infra-secrets).
|
|
5. Create a SOPS secrets file in the `host_vars` subdirectory of the relevant inventory. The name of the file should be of the format `<hostname>.sops.yaml` to get picked up by the vars plugin and to match the previously created creation rule.
|
|
For this example the following command accomplishes this:
|
|
```
|
|
sops inventories/chaosknoten/host_vars/myservice.sops.yaml
|
|
```
|
|
- With the editor now open, delete the example content and add the previously generated age private key like this:
|
|
```yaml
|
|
ansible_pull__age_private_key: <age private key here>
|
|
```
|
|
Note that SOPS only encrypts the values, not the keys.
|