CCCHH/nix-infra
CCCHH/nix-infra
2
3
Fork 2
Code Issues 1 Pull requests 1 Wiki Activity

Introduce sops and sops-nix for secret management

Browse source 
Use the GPG keys used for the password-store noc directory for the admin
keys.
Switch the git hosts secret management from colmena to sops-nix.

https://github.com/getsops/sops
https://github.com/Mic92/sops-nix
This commit is contained in:
June 2024-05-25 16:47:34 +02:00
commit 88e3da11a6
Signed by: june
SSH key fingerprint: SHA256:o9EAq4Y9N9K0pBQeBTqhSDrND5E7oB+60ZNx0U1yPe0
7 changed files with 341 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
config/hosts/git/forgejo.nix
View file

@ -14,7 +14,7 @@
enable = true;
package = pkgs-unstable.forgejo;
database.type = "postgres";
mailerPasswordFile = "/secrets/forgejo-git-smtp-password.secret";
mailerPasswordFile = "/run/secrets/forgejo_git_smtp_password";
settings = {
DEFAULT = {
@ -77,14 +77,10 @@
};
};
deployment.keys = {
"forgejo-git-smtp-password.secret" = {
keyCommand = [ "pass" "noc/vm-secrets/chaosknoten/git/smtp_password" ];
destDir = "/secrets";
user = "forgejo";
group = "forgejo";
permissions = "0640";
uploadAt = "pre-activation";
};
sops.secrets."forgejo_git_smtp_password" = {
mode = "0440";
owner = "forgejo";
group = "forgejo";
restartUnits = [ "forgejo.service" ];
};
}