diff --git a/.gitignore b/.gitignore index 9b42106..ccd010a 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,5 @@ .direnv/ + +kube-manifests/secrets/*.yaml +!kube-manifests/secrets/*.enc.yaml +!kube-manifests/secrets/.sops.yaml diff --git a/flake.lock b/flake.lock index 56947c9..4e2ccba 100644 --- a/flake.lock +++ b/flake.lock @@ -8,11 +8,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1754433428, - "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=", + "lastModified": 1762618334, + "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=", "owner": "ryantm", "repo": "agenix", - "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d", + "rev": "fcdea223397448d35d9b31f798479227e80183f6", "type": "github" }, "original": { @@ -48,11 +48,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1756770412, - "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=", + "lastModified": 1768135262, + "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "4524271976b625a4a605beefd893f270620fd751", + "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac", "type": "github" }, "original": { @@ -100,11 +100,11 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1754788789, - "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", + "lastModified": 1765674936, + "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=", "owner": "nix-community", "repo": "nixpkgs.lib", - "rev": "a73b9c743612e4244d865a2fdee11865283c04e6", + "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85", "type": "github" }, "original": { @@ -115,11 +115,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1757068644, - "narHash": "sha256-NOrUtIhTkIIumj1E/Rsv1J37Yi3xGStISEo8tZm3KW4=", + "lastModified": 1769018530, + "narHash": "sha256-MJ27Cy2NtBEV5tsK+YraYr2g851f3Fl1LpNHDzDX15c=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8eb28adfa3dc4de28e792e3bf49fcf9007ca8ac9", + "rev": "88d3861acdd3d2f0e361767018218e51810df8a1", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index d7b35a1..f74565a 100644 --- a/flake.nix +++ b/flake.nix @@ -15,6 +15,16 @@ flake-parts, agenix, }: + let + hostsDir = ./hosts; + hostNames = builtins.attrNames ( + nixpkgs.lib.filterAttrs ( + name: type: + type == "directory" + && builtins.pathExists (hostsDir + "/${name}/configuration.nix") + ) (builtins.readDir hostsDir) + ); + in flake-parts.lib.mkFlake {inherit inputs;} { systems = [ "aarch64-darwin" @@ -22,29 +32,17 @@ ]; flake = { - nixosConfigurations = { - rowhammer = nixpkgs.lib.nixosSystem { + nixosConfigurations = nixpkgs.lib.genAttrs hostNames ( + name: + nixpkgs.lib.nixosSystem { system = "x86_64-linux"; + specialArgs = { inherit agenix; }; modules = [ - (import ./hosts/rowhammer/configuration.nix) + (hostsDir + "/${name}/configuration.nix") agenix.nixosModules.default ]; - }; - vesuvius = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - modules = [ - (import ./hosts/vesuvius/configuration.nix) - agenix.nixosModules.default - ]; - }; - zerocool = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - modules = [ - (import ./hosts/zerocool/configuration.nix) - agenix.nixosModules.default - ]; - }; - }; + } + ); }; perSystem = { @@ -62,8 +60,9 @@ NIX_SSHOPTS="-o ForwardAgent=yes -J acidburn.vtluug.org" \ ${pkgs.nixos-rebuild}/bin/nixos-rebuild switch \ - --fast --flake ".#$TARGET_HOST_NAME" \ - --use-remote-sudo \ + --flake ".#$TARGET_HOST_NAME" \ + --no-reexec \ + --sudo \ --target-host "papatux@$TARGET_HOST_ADDRESS" \ --build-host "papatux@$TARGET_HOST_ADDRESS" ''; diff --git a/hosts/bastille/arista/config b/hosts/bastille/arista/config new file mode 100644 index 0000000..34b25de --- /dev/null +++ b/hosts/bastille/arista/config @@ -0,0 +1,289 @@ +! Command: show running-config +! device: pahoehoe (DCS-7050QX-32, EOS-4.24.11M-2GB) +! +! boot system flash:/EOS-2GB-4.24.11M.swi +! +transceiver qsfp default-mode 4x10G +! +service routing protocols model ribd +! +hostname pahoehoe +dns domain vtluug.org +! +spanning-tree mode mstp +! +service unsupported-transceiver wiprolabs f5047577 +! +enable password 5 +no aaa root +! +username papatux privilege 15 secret 5 +! +interface Port-Channel1 +! +interface Port-Channel2 +! +interface Port-Channel3 +! +interface Port-Channel4 +! +interface Port-Channel5 +! +interface Port-Channel6 +! +interface Port-Channel7 +! +interface Port-Channel8 +! +interface Port-Channel9 +! +interface Port-Channel10 +! +interface Port-Channel11 +! +interface Port-Channel12 +! +interface Ethernet1/1 + speed forced 10000full + channel-group 1 mode active +! +interface Ethernet1/2 + speed forced 10000full + channel-group 1 mode active +! +interface Ethernet1/3 + speed forced 10000full + channel-group 2 mode active +! +interface Ethernet1/4 + speed forced 10000full + channel-group 2 mode active +! +interface Ethernet2/1 +! +interface Ethernet2/2 +! +interface Ethernet2/3 +! +interface Ethernet2/4 +! +interface Ethernet3/1 + channel-group 3 mode active +! +interface Ethernet3/2 + channel-group 3 mode active +! +interface Ethernet3/3 + channel-group 4 mode active +! +interface Ethernet3/4 + channel-group 4 mode active +! +interface Ethernet4/1 +! +interface Ethernet4/2 +! +interface Ethernet4/3 +! +interface Ethernet4/4 +! +interface Ethernet5/1 + channel-group 5 mode active +! +interface Ethernet5/2 + channel-group 5 mode active +! +interface Ethernet5/3 + channel-group 6 mode active +! +interface Ethernet5/4 + channel-group 6 mode active +! +interface Ethernet6/1 +! +interface Ethernet6/2 +! +interface Ethernet6/3 +! +interface Ethernet6/4 +! +interface Ethernet7/1 +! +interface Ethernet7/2 +! +interface Ethernet7/3 +! +interface Ethernet7/4 +! +interface Ethernet8/1 +! +interface Ethernet8/2 +! +interface Ethernet8/3 +! +interface Ethernet8/4 +! +interface Ethernet9/1 +! +interface Ethernet9/2 +! +interface Ethernet9/3 +! +interface Ethernet9/4 +! +interface Ethernet10/1 +! +interface Ethernet10/2 +! +interface Ethernet10/3 +! +interface Ethernet10/4 +! +interface Ethernet11/1 +! +interface Ethernet11/2 +! +interface Ethernet11/3 +! +interface Ethernet11/4 +! +interface Ethernet12/1 +! +interface Ethernet12/2 +! +interface Ethernet12/3 +! +interface Ethernet12/4 +! +interface Ethernet13/1 +! +interface Ethernet13/2 +! +interface Ethernet13/3 +! +interface Ethernet13/4 +! +interface Ethernet14/1 +! +interface Ethernet14/2 +! +interface Ethernet14/3 +! +interface Ethernet14/4 +! +interface Ethernet15/1 +! +interface Ethernet15/2 +! +interface Ethernet15/3 +! +interface Ethernet15/4 +! +interface Ethernet16/1 +! +interface Ethernet16/2 +! +interface Ethernet16/3 +! +interface Ethernet16/4 +! +interface Ethernet17/1 +! +interface Ethernet17/2 +! +interface Ethernet17/3 +! +interface Ethernet17/4 +! +interface Ethernet18/1 +! +interface Ethernet18/2 +! +interface Ethernet18/3 +! +interface Ethernet18/4 +! +interface Ethernet19/1 + channel-group 7 mode active +! +interface Ethernet19/2 + channel-group 7 mode active +! +interface Ethernet19/3 + channel-group 8 mode active +! +interface Ethernet19/4 + channel-group 8 mode active +! +interface Ethernet20/1 +! +interface Ethernet20/2 +! +interface Ethernet20/3 +! +interface Ethernet20/4 +! +interface Ethernet21/1 + channel-group 9 mode active +! +interface Ethernet21/2 + channel-group 9 mode active +! +interface Ethernet21/3 + channel-group 10 mode active +! +interface Ethernet21/4 + channel-group 10 mode active +! +interface Ethernet22/1 +! +interface Ethernet22/2 +! +interface Ethernet22/3 +! +interface Ethernet22/4 +! +interface Ethernet23/1 + channel-group 11 mode active +! +interface Ethernet23/2 + channel-group 11 mode active +! +interface Ethernet23/3 + channel-group 12 mode active +! +interface Ethernet23/4 + channel-group 12 mode active +! +interface Ethernet24/1 +! +interface Ethernet24/2 +! +interface Ethernet24/3 +! +interface Ethernet24/4 +! +interface Ethernet25 +! +interface Ethernet26 +! +interface Ethernet27 +! +interface Ethernet28 +! +interface Ethernet29 +! +interface Ethernet30 +! +interface Ethernet31 +! +interface Ethernet32 +! +interface Management1 + ip address 10.98.0.197/24 +! +no ip routing +! +ip route 0.0.0.0/0 10.98.0.1 +! +end \ No newline at end of file diff --git a/hosts/bastille/arista/readme.md b/hosts/bastille/arista/readme.md new file mode 100644 index 0000000..fe673fa --- /dev/null +++ b/hosts/bastille/arista/readme.md @@ -0,0 +1,13 @@ +# Pahoehoe 7050QX-32 + +``` +Pāhoehoe (pronounced "pah-hoy-hoy") is a type of low-viscocity basaltic lava with a smooth, shiny, billowy, or ropy surface. +``` + +Pahoehoe acts as the cluster's backend network, supplying the blades with two bonded 10G SFP+ connections, and Vesuvius with a 40G QSFP+ link. + +It is statically routed. + +## Management + +`ssh papatux@10.98.0.197` \ No newline at end of file diff --git a/hosts/bastille/blade-names.nix b/hosts/bastille/blade-names.nix index f656f2d..b4027d9 100644 --- a/hosts/bastille/blade-names.nix +++ b/hosts/bastille/blade-names.nix @@ -1,16 +1,70 @@ -# keep-sorted start -[ - "backbiter" - "damocles" - "durendal" - "eyelander" - "excalibur" - "gram" - "gryffindor" - "kusanagi" - "narsil" - "oathbringer" - "riptide" - "sting" -] -# keep-sorted end +{ + backbiter = { + frontendMAC = "40:f2:e9:c6:65:5f"; + frontendIP4 = "10.98.0.25"; + backendIP4 = "10.98.3.2"; + }; + damocles = { + frontendMAC = "40:f2:e9:c6:67:db"; + frontendIP4 = "10.98.0.26"; + backendIP4 = "10.98.3.3"; + }; + durendal = { + frontendMAC = "40:f2:e9:c6:68:95"; + frontendIP4 = "10.98.0.27"; + backendIP4 = "10.98.3.4"; + }; + excalibur = { + frontendMAC = "40:f2:e9:c6:69:67"; + frontendIP4 = "10.98.0.29"; + backendIP4 = "10.98.3.5"; + }; + eyelander = { + frontendMAC = "40:f2:e9:c6:69:43"; + frontendIP4 = "10.98.0.28"; + backendIP4 = "10.98.3.6"; + }; + gram = { + frontendMAC = "40:f2:e9:c6:74:59"; + frontendIP4 = "10.98.0.30"; + backendIP4 = "10.98.3.7"; + }; + gryffindor = { + frontendMAC = "40:f2:e9:c6:74:d7"; + frontendIP4 = "10.98.0.31"; + backendIP4 = "10.98.3.8"; + }; + kusanagi = { + frontendMAC = "40:f2:e9:c6:75:97"; + frontendIP4 = "10.98.0.32"; + backendIP4 = "10.98.3.9"; + }; + narsil = { + frontendMAC = "40:f2:e9:c6:75:9d"; + frontendIP4 = "10.98.0.33"; + backendIP4 = "10.98.3.10"; + }; + oathbringer = { + frontendMAC = "40:f2:e9:c6:75:f1"; + frontendIP4 = "10.98.0.34"; + backendIP4 = "10.98.3.11"; + }; + + # TODO: prospit's a special case and won't remain here forever + + prospit = { + frontendMAC = "d8:9e:f3:3e:f9:41"; + frontendIP4 = "10.98.0.24"; + backendIP4 = "10.98.3.12"; + }; + riptide = { + frontendMAC = "40:f2:e9:c6:76:21"; + frontendIP4 = "10.98.0.35"; + backendIP4 = "10.98.3.13"; + }; + sting = { + frontendMAC = "40:f2:e9:c6:77:23"; + frontendIP4 = "10.98.0.36"; + backendIP4 = "10.98.3.14"; + }; +} diff --git a/hosts/bastille/blade.nix b/hosts/bastille/blade.nix new file mode 100644 index 0000000..0aa175e --- /dev/null +++ b/hosts/bastille/blade.nix @@ -0,0 +1,49 @@ +{ modulesPath, pkgs, lib, ... }: { + imports = [ + ./eno1-imm-disable.nix + ./network.nix + ./unseal-hostkey.nix + (import ../common/k3s.nix { + inherit lib; + serverAddr = "10.98.3.1"; + flannelIface = "bond0"; + }) + ../common/nix.nix + ../common/sshd.nix + ../common/users-local.nix + (modulesPath + "/installer/netboot/netboot-minimal.nix") + ]; + + # Get NFS working (not idea why it's not default in NixOS) + boot.initrd = { + supportedFilesystems = [ "nfs" ]; + kernelModules = [ "nfs" ]; + }; + + # Get hostname from DHCP request + networking.hostName = ""; + + # Open kubernetes' ports for flannel and API server + networking.firewall = { + allowedTCPPorts = [ + 6443 + 10250 + ]; + allowedUDPPorts = [ + 8472 + ]; + }; + + + # when making the ISO, the initialHashedPassword is set to "" for some reason + # we already set a hashed password, so null this + users.users.root.initialHashedPassword = lib.mkForce null; + + environment.systemPackages = with pkgs; [ + fastfetch + git + nfs-utils + ]; + + system.stateVersion = "25.11"; +} diff --git a/hosts/bastille/cisco/readme.md b/hosts/bastille/cisco/readme.md new file mode 100644 index 0000000..5242a87 --- /dev/null +++ b/hosts/bastille/cisco/readme.md @@ -0,0 +1,22 @@ +# Magma (ws-c3750g-48ts) + +Magma serves as the north/south traffic switch for bastille. By convention, the top half is for management interfaces, and the bottom half is for host frontend connections. + +## Management + +There is a serial console. + +Configured, you can also manage it over SSH using the command + +``` +ssh \ + -o KexAlgorithms=+diffie-hellman-group1-sha1 \ + -o HostKeyAlgorithms=+ssh-rsa \ + -o Ciphers=+aes128-cbc \ + papatux@10.98.0.192 +``` +or over HTTP at the same address. + +# TODO + +It currently has one VLAN. Ideally the top and bottom halves would be split into MGMT/LAN. \ No newline at end of file diff --git a/hosts/bastille/cisco/startup-config b/hosts/bastille/cisco/startup-config index e70d491..9c8b9fb 100644 --- a/hosts/bastille/cisco/startup-config +++ b/hosts/bastille/cisco/startup-config @@ -3,7 +3,7 @@ version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec -no service password-encryption +service password-encryption ! hostname Magma ! @@ -12,18 +12,46 @@ boot-end-marker ! enable secret 5 ! +username papatux privilege 15 secret 5 ! ! no aaa new-model switch 1 provision ws-c3750g-48ts system mtu routing 1500 -ip routing +ip domain-name magma.vtluug.org ! ! ! ! +crypto pki trustpoint TP-self-signed-267366656 + enrollment selfsigned + subject-name cn=IOS-Self-Signed-Certificate-267366656 + revocation-check none + rsakeypair TP-self-signed-267366656 ! ! +crypto pki certificate chain TP-self-signed-267366656 + certificate self-signed 01 + 3082023C 308201A5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 + 30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274 + 69666963 6174652D 32363733 36363635 36301E17 0D393330 33303130 30303434 + 305A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F + 532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3236 37333636 + 36353630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100 + A0FAA298 228F2339 97C98A75 AF7759D8 CF345A1A B0742157 42126870 6CF917E0 + 7276B900 5B0FCB19 D6147F29 A1C58626 E04D5CF8 FFE2391F 56D046E9 B71B2111 + 9B3D8CA4 79A2E56C 2AE37309 73C7AE0A 2B3D2830 98612657 61D5001D 9083BD42 + 8EECBEEE 90F5DC76 9A41D32D 88E6CDBE 66A390BF 40F3D758 883FAA8E D3FD22FF + 02030100 01A36630 64300F06 03551D13 0101FF04 05300301 01FF3011 0603551D + 11040A30 0882064D 61676D61 2E301F06 03551D23 04183016 801467E3 0883829A + 49F8B82C A4700FAF 43DDC2AC 178E301D 0603551D 0E041604 1467E308 83829A49 + F8B82CA4 700FAF43 DDC2AC17 8E300D06 092A8648 86F70D01 01040500 03818100 + 7325C7E5 5EBD7697 CD3D2178 4D3F625F AC0DA29B 899E224C D5832F49 5C22C7D7 + 4DFD8FC5 050A8822 1C032567 8BE22FF7 7EC1949E E2B4E80E 37D4EE28 E1E34244 + D3678B6A EBF680E5 4C61F935 184E427E 2851090D 4D736DB6 AFC8D3C5 3BCDAF26 + 711CCC20 22B81C96 F65E0E4C CF74E88C 6E5ACB52 81B9DFA1 B86978EE BC4B1D39 + quit +! ! ! spanning-tree mode pvst @@ -31,6 +59,7 @@ spanning-tree extend system-id ! vlan internal allocation policy ascending ! +ip ssh version 2 ! ! ! @@ -38,81 +67,93 @@ interface GigabitEthernet1/0/1 switchport mode access ! interface GigabitEthernet1/0/2 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/3 + switchport mode access ! interface GigabitEthernet1/0/4 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/5 + switchport mode access ! interface GigabitEthernet1/0/6 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/7 + switchport mode access ! interface GigabitEthernet1/0/8 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/9 + switchport mode access ! interface GigabitEthernet1/0/10 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/11 + switchport mode access ! interface GigabitEthernet1/0/12 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/13 + switchport mode access ! interface GigabitEthernet1/0/14 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/15 + switchport mode access ! interface GigabitEthernet1/0/16 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/17 + switchport mode access ! interface GigabitEthernet1/0/18 + switchport mode access ! interface GigabitEthernet1/0/19 + switchport mode access ! interface GigabitEthernet1/0/20 + switchport mode access ! interface GigabitEthernet1/0/21 + switchport mode access ! interface GigabitEthernet1/0/22 + switchport mode access ! interface GigabitEthernet1/0/23 + switchport mode access ! interface GigabitEthernet1/0/24 + switchport mode access ! interface GigabitEthernet1/0/25 + switchport mode access ! interface GigabitEthernet1/0/26 + switchport mode access ! interface GigabitEthernet1/0/27 + switchport mode access ! interface GigabitEthernet1/0/28 + switchport mode access ! interface GigabitEthernet1/0/29 + switchport mode access ! interface GigabitEthernet1/0/30 + switchport mode access ! interface GigabitEthernet1/0/31 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/32 @@ -122,76 +163,68 @@ interface GigabitEthernet1/0/33 switchport mode access ! interface GigabitEthernet1/0/34 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/35 switchport mode access ! interface GigabitEthernet1/0/36 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/37 switchport mode access ! interface GigabitEthernet1/0/38 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/39 switchport mode access ! interface GigabitEthernet1/0/40 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/41 switchport mode access ! interface GigabitEthernet1/0/42 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/43 switchport mode access ! interface GigabitEthernet1/0/44 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/45 switchport mode access ! interface GigabitEthernet1/0/46 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/47 switchport mode access ! interface GigabitEthernet1/0/48 - switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/49 + switchport mode access ! interface GigabitEthernet1/0/50 + switchport mode access ! interface GigabitEthernet1/0/51 + switchport mode access ! interface GigabitEthernet1/0/52 + switchport mode access ! interface Vlan1 - ip address 10.98.1.192 255.255.255.0 secondary - ip address 10.98.2.192 255.255.255.0 secondary - ip address 10.98.0.192 255.255.255.0 -! -interface Vlan10 - ip address 10.98.3.1 255.255.255.0 + ip address 10.98.0.192 255.255.0.0 + no ip route-cache ! +ip default-gateway 10.98.0.1 ip classless -ip route 0.0.0.0 0.0.0.0 10.98.0.1 ip http server ip http secure-server ! @@ -200,6 +233,13 @@ ip http secure-server ! ! line con 0 +line vty 0 4 + exec-timeout 15 0 + login local + transport input ssh line vty 5 15 + exec-timeout 15 0 + login local + transport input ssh ! end diff --git a/hosts/bastille/eno1-imm-disable.nix b/hosts/bastille/eno1-imm-disable.nix new file mode 100644 index 0000000..87c8d6c --- /dev/null +++ b/hosts/bastille/eno1-imm-disable.nix @@ -0,0 +1,30 @@ +{ pkgs, lib, ... }: +let + eno1-imm-disable = pkgs.writeShellApplication { + name = "eno1-imm-disable"; + + runtimeInputs = [ + pkgs.iproute2 + ]; + + text = '' + if grep "Lenovo NeXtScale nx360 M5" /sys/devices/virtual/dmi/id/product_name; then + ip link set down eno1 + fi + ''; + }; +in { + systemd.services."eno1-imm-disable" = { + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + unitConfig = { + Description = "Disable eno1 on Lenovo NeXtScale nodes to avoid issues with using the imm interface"; + }; + + serviceConfig = { + Type = "oneshot"; + ExecStart = "${lib.getExe eno1-imm-disable}"; + }; + }; +} diff --git a/hosts/bastille/network.nix b/hosts/bastille/network.nix new file mode 100644 index 0000000..7d1e09d --- /dev/null +++ b/hosts/bastille/network.nix @@ -0,0 +1,112 @@ +{ lib, pkgs, ... }: +let + blades = import ./blade-names.nix; + + assignedBlades = lib.filterAttrs ( + _: blade: blade.frontendIP4 != null + ) blades; + + macCases = lib.concatStringsSep "\n" ( + lib.mapAttrsToList (name: blade: '' + ${lib.escapeShellArg blade.frontendMAC}) + backend_ip=${lib.escapeShellArg blade.backendIP4} + blade_name=${lib.escapeShellArg name} + break + ;; + '') assignedBlades + ); + + bnx2xFirmware = pkgs.runCommand "bnx2x-firmware" { } '' + mkdir -p $out/lib/firmware/bnx2x + cp ${pkgs.linux-firmware}/lib/firmware/bnx2x/bnx2x-e2-7.13.15.0.fw \ + ${pkgs.linux-firmware}/lib/firmware/bnx2x/bnx2x-e2-7.13.21.0.fw \ + $out/lib/firmware/bnx2x/ + ''; +in +{ + boot.kernelModules = [ "bonding" ]; + hardware.firmware = [ bnx2xFirmware ]; + + # bond(ed) + networking.networkmanager.unmanaged = [ + "interface-name:ens6f0" + "interface-name:ens6f1" + "interface-name:bond0" + ]; + + systemd.services.blade-backend-network = { + description = "Configure this blade's static backend address"; + wantedBy = [ "multi-user.target" ]; + before = [ "k3s.service" ]; + after = [ "network-setup.service" ]; + wants = [ "network-setup.service" ]; + + path = [ + pkgs.coreutils + pkgs.iproute2 + ]; + + script = '' + backend_ip= + blade_name= + + for interface in /sys/class/net/*; do + [ -f "$interface/address" ] || continue + frontend_mac=$(cat "$interface/address") + case "$frontend_mac" in + ${macCases} + esac + done + + if [ -z "$backend_ip" ]; then + echo "No backend address is assigned to a local frontend MAC" >&2 + exit 1 + fi + + echo "Configuring $blade_name with $backend_ip/24 on bond0" + + for interface in ens6f0 ens6f1; do + retries=60 + while [ ! -e "/sys/class/net/$interface" ]; do + if [ "$retries" -eq 0 ]; then + echo "Timed out waiting for $interface" >&2 + exit 1 + fi + retries=$((retries - 1)) + sleep 0.5 + done + done + + if [ ! -e /sys/class/net/bond0 ]; then + ip link add name bond0 type bond \ + mode 802.3ad \ + miimon 100 \ + lacp_rate fast \ + xmit_hash_policy layer3+4 + fi + + for interface in ens6f0 ens6f1; do + ip link set "$interface" down + ip link set "$interface" master bond0 + ip link set "$interface" up + done + + ip link set bond0 up + ip address replace "$backend_ip/24" dev bond0 + ip route replace 10.98.3.0/24 dev bond0 src "$backend_ip" + + printf 'node-ip: %s\n' "$backend_ip" > /run/blade-k3s.yaml + ''; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + }; + + systemd.services.k3s = { + after = [ "blade-backend-network.service" ]; + requires = [ "blade-backend-network.service" ]; + environment.K3S_CONFIG_FILE = "/run/blade-k3s.yaml"; + }; +} diff --git a/hosts/bastille/unseal-hostkey.nix b/hosts/bastille/unseal-hostkey.nix new file mode 100644 index 0000000..8d01bf2 --- /dev/null +++ b/hosts/bastille/unseal-hostkey.nix @@ -0,0 +1,194 @@ +{ lib, pkgs, ... }: +let + blades = import ./blade-names.nix; + bladeHosts = ../../secrets/blade-hosts; + + secretHosts = lib.attrNames ( + lib.filterAttrs ( + name: type: + type == "directory" + && builtins.hasAttr name blades + && builtins.pathExists (bladeHosts + "/${name}/data") + && builtins.pathExists (bladeHosts + "/${name}/ssh-key.sealed") + && builtins.pathExists (bladeHosts + "/${name}/ssh-key.pub") + ) (builtins.readDir bladeHosts) + ); + + macCases = lib.concatMapStringsSep "\n" (name: '' + ${lib.escapeShellArg blades.${name}.frontendMAC}) + blade_name=${lib.escapeShellArg name} + blade_secrets=${bladeHosts + "/${name}"} + break + ;; + '') secretHosts; + + tcsdConfig = pkgs.writeText "blade-tcsd.conf" '' + system_ps_file = /var/lib/tpm/system.data + ''; + + hostKeyPath = "/run/ssh-host-keys/ssh_host_ed25519_key"; + + unsealHostKey = '' + export PATH=${lib.makeBinPath [ + pkgs.coreutils + pkgs.openssh + pkgs.tpm-tools + pkgs.trousers + ]} + + if [ -s ${lib.escapeShellArg hostKeyPath} ]; then + exit 0 + fi + + blade_name= + blade_secrets= + + retries=120 + while [ -z "$blade_secrets" ]; do + for interface in /sys/class/net/*; do + [ -f "$interface/address" ] || continue + frontend_mac=$(cat "$interface/address") + case "$frontend_mac" in + ${macCases} + esac + done + + [ -n "$blade_secrets" ] && break + if [ "$retries" -eq 0 ]; then + break + fi + retries=$((retries - 1)) + sleep 0.25 + done + + if [ -z "$blade_secrets" ]; then + echo "No sealed host key matches a local frontend MAC; generating a temporary host key" >&2 + install -d -m 0700 /run/ssh-host-keys + ssh-keygen -q -t ed25519 -N "" -f ${lib.escapeShellArg hostKeyPath} + chmod 0600 ${lib.escapeShellArg hostKeyPath} + exit 0 + fi + + echo "Unsealing the SSH host key for $blade_name" + + install -d -m 0700 /var/lib/tpm /run/ssh-host-keys + install -m 0600 "$blade_secrets/data" /var/lib/tpm/system.data + + tcsd -f -c ${tcsdConfig} & + tcsd_pid=$! + trap 'kill "$tcsd_pid" 2>/dev/null || true' EXIT + + # tcsd creates its socket asynchronously. Retry the unseal briefly rather + # than racing it during early boot. + unsealed_key=$(mktemp /run/ssh-host-keys/.host-key.XXXXXX) + rm "$unsealed_key" + retries=50 + until tpm_unsealdata -z \ + -i "$blade_secrets/ssh-key.sealed" \ + -o "$unsealed_key"; do + rm -f "$unsealed_key" + if [ "$retries" -eq 0 ]; then + echo "Timed out unsealing $blade_name's SSH host key" >&2 + exit 1 + fi + retries=$((retries - 1)) + sleep 0.1 + done + + chmod 0600 "$unsealed_key" + mv "$unsealed_key" ${lib.escapeShellArg hostKeyPath} + ''; +in +{ + age.identityPaths = lib.mkForce [ hostKeyPath ]; + + services.openssh = { + generateHostKeys = false; + hostKeys = lib.mkForce [ + { + path = hostKeyPath; + type = "ed25519"; + } + ]; + }; + + system.activationScripts = { + agenixInstall.text = lib.mkForce ""; + agenixChown.text = lib.mkForce ""; + }; + + systemd.services.unseal-blade-host-key = { + description = "Unseal this blade's TPM-bound SSH host key"; + requiredBy = [ + "install-blade-secrets.service" + "sshd.service" + ]; + before = [ + "install-blade-secrets.service" + "sshd.service" + ]; + + path = [ + pkgs.coreutils + pkgs.openssh + pkgs.tpm-tools + pkgs.trousers + ]; + + script = unsealHostKey; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + UMask = "0077"; + }; + }; + + systemd.services.install-blade-secrets = { + description = "Install agenix secrets using the TPM-unsealed host identity"; + requiredBy = [ "k3s.service" ]; + requires = [ "unseal-blade-host-key.service" ]; + after = [ "unseal-blade-host-key.service" ]; + before = [ "k3s.service" ]; + + script = '' + install -d -m 0751 /run/agenix + join_token_tmp=$(mktemp /run/agenix/.k3s-join-token.XXXXXX) + node_password_tmp=$(mktemp /run/.k3s-node-password.XXXXXX) + trap 'rm -f "$join_token_tmp" "$node_password_tmp"' EXIT + ${pkgs.age}/bin/age --decrypt \ + -i ${lib.escapeShellArg hostKeyPath} \ + -o "$join_token_tmp" \ + ${../../secrets/k3s-join-token.age} + chmod 0400 "$join_token_tmp" + mv "$join_token_tmp" /run/agenix/k3s-join-token + + blade_secrets= + for interface in /sys/class/net/*; do + [ -f "$interface/address" ] || continue + frontend_mac=$(cat "$interface/address") + case "$frontend_mac" in + ${macCases} + esac + done + + if [ -z "$blade_secrets" ] || [ ! -f "$blade_secrets/k3s-node-password.age" ]; then + echo "No k3s node-password secret matches a local frontend MAC" >&2 + exit 1 + fi + + ${pkgs.age}/bin/age --decrypt \ + -i ${lib.escapeShellArg hostKeyPath} \ + -o "$node_password_tmp" \ + "$blade_secrets/k3s-node-password.age" + install -d -m 0700 /etc/rancher/node + install -m 0600 "$node_password_tmp" /etc/rancher/node/password + ''; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + UMask = "0077"; + }; + }; +} diff --git a/hosts/common/k3s.nix b/hosts/common/k3s.nix new file mode 100644 index 0000000..2f0cb37 --- /dev/null +++ b/hosts/common/k3s.nix @@ -0,0 +1,37 @@ +{ + lib, + role ? "agent", + clusterInit ? false, + serverAddr ? "10.98.3.1", + flannelIface ? "enp1s0f1", +}: +{ + networking.firewall.allowedTCPPorts = [ + 6443 + ]; + + networking.firewall.allowedUDPPorts = [ + 8472 + ]; + + age.secrets."k3s-join-token".file = ../../secrets/k3s-join-token.age; + + services.k3s = { + inherit role clusterInit; + + enable = true; + serverAddr = lib.mkIf (role != "server") "https://${serverAddr}:6443"; + nodeIP = lib.mkIf (role == "server") serverAddr; + tokenFile = "/run/agenix/k3s-join-token"; + + extraFlags = [ + "--flannel-iface=${flannelIface}" + ] ++ lib.optionals (role == "server") [ + "--advertise-address=${serverAddr}" + "--bind-address=${serverAddr}" + "--tls-san=${serverAddr}" + "--write-kubeconfig-mode=0640" + "--write-kubeconfig-group=wheel" + ]; + }; +} diff --git a/hosts/common/nfs.nix b/hosts/common/nfs.nix new file mode 100644 index 0000000..98647c2 --- /dev/null +++ b/hosts/common/nfs.nix @@ -0,0 +1,20 @@ +{ config, pkgs, ... }: +let + mkNfs = {path, options ? [ "vers=4.0" "soft" "nodev" "nosuid" ]}: { + device = "${path}"; + fsType = "nfs"; + inherit options; + }; +in +{ + environment.systemPackages = [ pkgs.nfs-utils ]; + + fileSystems."/nfs/cistern/share" = mkNfs {path = "10.98.0.7:/cistern/nfs/share";}; + fileSystems."/nfs/cistern/files" = mkNfs {path = "10.98.0.7:/cistern/nfs/files";}; + fileSystems."/nfs/cistern/home" = mkNfs { + path = "10.98.0.7:/cistern/nfs/home"; + options = [ "vers=4.0" "soft" "nodev" "nosuid" ]; + }; + fileSystems."/nfs/cistern/libvirt" = mkNfs {path = "10.98.0.7:/cistern/nfs/libvirt";}; + fileSystems."/nfs/cistern/docker/data" = mkNfs {path = "10.98.0.7:/cistern/nfs/docker/data";}; +} \ No newline at end of file diff --git a/hosts/vesuvius/README.md b/hosts/vesuvius/README.md index 66f9fe3..2ab93b2 100644 --- a/hosts/vesuvius/README.md +++ b/hosts/vesuvius/README.md @@ -10,3 +10,13 @@ Giant storage server + future LHCPISCSIPXEIDK thing maybe? ## Storage We currently have one (manually created) RAID-Z2 pool mounted at `/forge` with `8` drives of `12 Tb` each. We have capacity for `48`(!) drives, but still only paper (and tape) caddies. + +``` +# for the nix store +zfs create -o mountpoint=legacy \ + -o compression=zstd \ + -o xattr=sa \ + -o acltype=posixacl \ + -o atime=off \ + forge/nix +``` \ No newline at end of file diff --git a/hosts/vesuvius/caddy.nix b/hosts/vesuvius/caddy.nix new file mode 100644 index 0000000..1543797 --- /dev/null +++ b/hosts/vesuvius/caddy.nix @@ -0,0 +1,236 @@ +{ + config, + pkgs, + lib, + ... +}: +let + gandi-key-path = "/secrets/gandi.env"; +in +{ + age.secrets."gandi.env".file = ../../secrets/vesuvius/gandi.env.age; + + containers.caddy-proxy = { + autoStart = true; + ephemeral = true; + macvlans = [ "eno0" "ens865" ]; + privateNetwork = false; + bindMounts = { + "${gandi-key-path}" = { + hostPath = config.age.secrets."gandi.env".path; + }; + "/var/lib/caddy" = { + hostPath = "/var/lib/caddy"; + isReadOnly = false; + }; + "/files" = { + hostPath = "/nfs/cistern/files"; + isReadOnly = true; + }; + "/users" = { + hostPath = "/nfs/cistern/home"; + isReadOnly = true; + }; + }; + config = + { + config, + lib, + pkgs, + ... + }: + { + networking = { + interfaces.mv-eno0 = { + useDHCP = true; + ipv4.addresses = [ + { + address = "128.173.89.163"; + prefixLength = 24; + } + ]; + ipv6.addresses = [ + { + address = "2607:b400:6:cc80:0:aff:fe62:f"; + prefixLength = 64; + } + ]; + }; + + interfaces.mv-ens865 = { + useDHCP = false; + ipv4.addresses = [ + { + address = "10.98.3.254"; + prefixLength = 24; + } + ]; + }; + + useHostResolvConf = false; + nameservers = [ "10.98.0.1" ]; + dhcpcd.extraConfig = '' + nooption domain_name_servers + ''; + }; + + services.caddy = { + enable = true; + virtualHosts."wiki.vtluug.org".extraConfig = '' + tls { + dns gandi {env.GANDI_AUTH_TOKEN} + } + # wiki.vtluug.org redirects to vtluug.org/wiki + @wikipath path_regexp wikipath ^/(wiki|w)/(.*)$ + redir @wikipath https://vtluug.org/{re.wikipath.1}/{re.wikipath.2} permanent + redir * https://vtluug.org/wiki/Main_page permanent + ''; + virtualHosts."gobblerpedia.org".extraConfig = '' + handle / { + redir * /wiki/Main_page permanent + } + + handle /w/* { + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + handle /w { + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + + handle_path /wiki/* { + rewrite * /w/index.php{uri} + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + handle /wiki { + rewrite * /w/index.php + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + + respond /w/cache/* 403 + ''; + virtualHosts."*.vtluug.org".extraConfig = '' + tls { + dns gandi {env.GANDI_AUTH_TOKEN} + } + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + ''; + virtualHosts."vtluug.org".extraConfig = '' + tls { + dns gandi {env.GANDI_AUTH_TOKEN} + } + # Static files (including user homedirs) {{{ + + # We got a C&D + handle_path /files/2013/hamexam/* { + file_server browse + root * /files/2013/hamexam + @denied not remote_ip 127.0.0.1 ::1 10.0.0.0/8 198.82.0.0/16 128.173.0.0/16 2607:b400::/32 2001:468:c80::/48 + respond @denied 403 + } + + redir /files /files/ 308 + handle_path /files/* { + file_server browse + root * /files + } + + @usertilde path_regexp usertilde ^/users/~(.+?)(/.*)?$ + redir @usertilde /~{re.usertilde.1}{re.usertilde.2} permanent + + @tildedir path_regexp tildedir ^/~([^/]+)$ + redir @tildedir /~{re.tildedir.1}/ 308 + + @userdir path_regexp userdir ^/~([^/]+)(/.*)?$ + handle @userdir { + root * /users/{re.userdir.1}/public_html + rewrite * {re.userdir.2} + file_server browse + } + # }}} + + # LUUG wiki stuff (slightly different vs gobblerpedia) {{{ + # Proxy to internal instance + handle /w/* { + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + + # Displayed path is /wiki, but actual path is /w + # See $wgScriptPath & $wgArticle path in MW config + handle_path /wiki/* { + rewrite * /w/index.php{uri} + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + handle /wiki { + rewrite * /w/index.php + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + + # Deny access to mediawiki cache (shouldn't be enabled anyways) + respond /w/cache/* 403 + # }}} + + # Main site + handle { + reverse_proxy https://10.98.3.1:443 { + transport http { + tls_insecure_skip_verify + } + } + } + ''; + package = pkgs.caddy.withPlugins { + plugins = [ "github.com/caddy-dns/gandi@v1.1.0" ]; + hash = "sha256-5mjD0CY7f5+sRtV1rXysj8PvId2gQaWiXlIaTg2Lv8A="; + }; + globalConfig = '' + ''; + }; + systemd.services.caddy.serviceConfig.EnvironmentFile = [ "${gandi-key-path}" ]; + + networking.firewall = { + allowedTCPPorts = [ + 80 + 443 + ]; + allowedUDPPorts = [ + 80 + 443 + ]; + }; + + system.stateVersion = "26.05"; + }; + }; +} diff --git a/hosts/vesuvius/configuration.nix b/hosts/vesuvius/configuration.nix index 482f77b..fb87195 100644 --- a/hosts/vesuvius/configuration.nix +++ b/hosts/vesuvius/configuration.nix @@ -1,58 +1,39 @@ -{ config, pkgs, ... }: +{ config, pkgs, lib, ... }: { imports = [ ./hardware-configuration.nix + (import ../common/k3s.nix { + inherit lib; + role = "server"; + clusterInit = true; + serverAddr = "10.98.3.1"; + flannelIface = "ens865-shim"; + }) ./nix.nix ./zfs.nix + ./ipa.nix ./netboot.nix + ./nfs-export.nix + (import ./network.nix { inherit config lib pkgs; }) + ./caddy.nix + + ../common/nfs.nix + ../common/tz-locale.nix + ../common/users-local.nix + ../common/sshd.nix + + ../common/whit/dns.nix ]; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "vesuvius"; - - networking.networkmanager.enable = true; - networking.networkmanager.unmanaged = [ "interface-name:enp1s0f1" ]; - - time.timeZone = "America/New_York"; - - i18n.defaultLocale = "en_US.UTF-8"; - - i18n.extraLocaleSettings = { - LC_ADDRESS = "en_US.UTF-8"; - LC_IDENTIFICATION = "en_US.UTF-8"; - LC_MEASUREMENT = "en_US.UTF-8"; - LC_MONETARY = "en_US.UTF-8"; - LC_NAME = "en_US.UTF-8"; - LC_NUMERIC = "en_US.UTF-8"; - LC_PAPER = "en_US.UTF-8"; - LC_TELEPHONE = "en_US.UTF-8"; - LC_TIME = "en_US.UTF-8"; - }; - - users.users.papatux = { - isNormalUser = true; - description = "papatux"; - extraGroups = [ "networkmanager" "wheel" ]; - openssh.authorizedKeys.keys = import ../../papatux-keys.nix; - }; - - security.sudo.wheelNeedsPassword = false; - nixpkgs.config.allowUnfree = true; environment.systemPackages = with pkgs; [ + git neovim ]; - services.openssh.enable = true; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "25.05"; # Did you read the comment? } diff --git a/hosts/vesuvius/ipa.nix b/hosts/vesuvius/ipa.nix index fc011e1..3bbd0df 100644 --- a/hosts/vesuvius/ipa.nix +++ b/hosts/vesuvius/ipa.nix @@ -1,10 +1,16 @@ -# TODO: /etc/krb5.keytab missing, maybe agenix { config, pkgs, ... }: { - age.secrets."krb5.keytab".file = ../../secrets/krb5.keytab.age; - + age.secrets."krb5.keytab" = { + file = ../../secrets/keytabs/vesuvius.keytab.age; + path = "/etc/krb5.keytab"; + owner = "root"; + group = "root"; + mode = "0600"; + }; environment.variables.KRB5_KTNAME = config.age.secrets."krb5.keytab".path; + networking.domain = "vtluug.org"; + security.ipa = { enable = true; @@ -19,4 +25,15 @@ sha256 = "16wv6kfvnm0hcyzr0wjrgmymw3asm84m8r1wbfq09qvqrjycfc6s"; }; }; + security.sudo.extraRules = [ + { + groups = [ "admins" ]; + commands = [ + { + command = "ALL"; + options = ["SETENV" "NOPASSWD"]; + } + ]; + } + ]; } diff --git a/hosts/vesuvius/netboot.nix b/hosts/vesuvius/netboot.nix index 9222a1c..e2695ce 100644 --- a/hosts/vesuvius/netboot.nix +++ b/hosts/vesuvius/netboot.nix @@ -1,80 +1,94 @@ -{ config, pkgs, ... }: +{ + agenix, + config, + lib, + pkgs, + ... +}: let - dom_ip = "10.98.2.1"; - dhcp_iface = "enp1s0f1"; - client_range = "10.98.2.2,10.98.2.100"; + dom_ip = "10.98.0.23"; + tftp_iface = "eno0"; - sub_image = pkgs.nixos { - imports = [ "${pkgs.path}/nixos/modules/installer/netboot/netboot-minimal.nix" ]; + netboot-hostnames = import ../bastille/blade-names.nix; - system.stateVersion = "25.05"; - services.openssh = { - enable = true; - settings.PasswordAuthentication = true; - settings.KbdInteractiveAuthentication = false; - }; + sub_image = lib.nixosSystem { + system = "x86_64-linux"; - users.users.papatux = { - isNormalUser = true; - description = "papatux"; - extraGroups = [ "networkmanager" "wheel" ]; - hashedPassword = "$6$6GnvJWpo8oOWM1tb$GhuldW5iIdS6OuRyq5u1hSSu0VotQCLac7emA.Kui2hWLozR7EIO4Su6PCo5hTRG8iWnAOlGemQVyejIA9l4j/"; - openssh.authorizedKeys.keys = import ../../papatux-keys.nix; - }; + modules = [ + agenix.nixosModules.default + ../bastille/blade.nix + ]; }; - + + blade = sub_image.config.system.build; + ipxe_config = pkgs.writeText "boot.ipxe" '' #!ipxe - kernel http://${dom_ip}:8080/netboot-nixtest/kernel init=/init boot.shell_on_fail - initrd http://${dom_ip}:8080/netboot-nixtest/initrd + kernel http://${dom_ip}:8080/netboot-kernel/bzImage init=${blade.toplevel}/init boot.shell_on_fail + initrd http://${dom_ip}:8080/netboot-initrd/initrd boot ''; webroot = pkgs.linkFarm "netboot" [ - { name = "netboot-nixtest"; path = sub_image.config.system.build.toplevel; } - { name = "boot.ipxe"; path = ipxe_config; } + { + name = "netboot-kernel"; + path = blade.kernel; + } + { + name = "netboot-initrd"; + path = blade.netbootRamdisk; + } + { + name = "boot.ipxe"; + path = ipxe_config; + } ]; # fyi this is cause tftpd in dnsmasq chroots and wouldn't follow external symlinks # like the ones in a linkfarm - tftproot = pkgs.runCommand "tftproot-real" {} '' + tftproot = pkgs.runCommand "tftproot-real" { } '' mkdir -p $out cp ${ipxe_config} $out/boot.ipxe cp ${pkgs.ipxe}/ipxe.efi $out/ipxe.efi ''; in { - networking.interfaces."${dhcp_iface}".ipv4.addresses = [ - { - address = dom_ip; - prefixLength = 24; - } - ]; - services.dnsmasq = { enable = true; - settings.enable-tftp = true; - settings.tftp-root = "${tftproot}"; - settings.dhcp-range = "${client_range},12h"; - settings.dhcp-option = [ "option:router,${dom_ip}" ]; - settings.dhcp-userclass = [ "set:ipxe,iPXE" ]; - settings.dhcp-boot = [ - "tag:!ipxe,ipxe.efi" - "http://${dom_ip}:8080/boot.ipxe" - ]; + resolveLocalQueries = false; + settings = { + port = 0; #Disable DNS + interface = "${tftp_iface}"; + enable-tftp = true; + tftp-root = "${tftproot}"; + }; }; services.nginx = { enable = true; virtualHosts."netboot" = { - listen = [{ port = 8080; addr = "0.0.0.0"; }]; + listen = [ + { + port = 8080; + addr = "0.0.0.0"; + } + ]; locations."/".root = "${webroot}"; }; }; networking.firewall = { - allowedTCPPorts = [ 8080 ]; - allowedUDPPorts = [ 67 69 ]; + allowedTCPPorts = [ + 6443 + 8080 + 10250 + ]; + allowedUDPPorts = [ + 53 + 67 + 69 + 8472 + ]; }; -} \ No newline at end of file +} diff --git a/hosts/vesuvius/network.nix b/hosts/vesuvius/network.nix new file mode 100644 index 0000000..6756f56 --- /dev/null +++ b/hosts/vesuvius/network.nix @@ -0,0 +1,67 @@ +{ + config, + lib, + pkgs, + ipv6_allowed_prefix ? "2607:b400:6:cc80::/64", + ... +}: +{ + networking.hostName = "vesuvius"; + + networking.networkmanager.enable = true; + networking.networkmanager.unmanaged = [ "interface-name:ens865" ]; + + # statically routed k3s backend + networking.interfaces.ens865 = { + useDHCP = false; + }; + networking.macvlans.ens865-shim = { + interface = "ens865"; + mode = "bridge"; + }; + + networking.interfaces.ens865-shim = { + useDHCP = false; + ipv4.addresses = [{ + address = "10.98.3.1"; + prefixLength = 24; + }]; + }; + + # so k3s sets this itself when it initializes, but + # nix then (sometimes) overwrites it on rebuild. so + # here we set it explicitly + boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = 1; + + # Open ports for K3s ingress + networking.firewall = { + allowedTCPPorts = [ + 80 + 443 + ]; + allowedUDPPorts = [ + 80 + 443 + ]; + }; + + + networking.nftables = { + enable = true; + ruleset = '' + table ip6 filter { + chain input { + type filter hook input priority 0; policy drop; + + ct state { established, related } accept; + iifname "lo" accept; + + icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-neighbor-solicit, nd-neighbor-advert } accept; + + ip6 saddr ${ipv6_allowed_prefix} accept comment "Allow IPv6 from LAN"; + ip6 saddr fe80::/64 accept comment "Allow IPv6 from link local"; + } + } + ''; + }; +} diff --git a/hosts/vesuvius/nfs-export.nix b/hosts/vesuvius/nfs-export.nix new file mode 100644 index 0000000..7afb6ea --- /dev/null +++ b/hosts/vesuvius/nfs-export.nix @@ -0,0 +1,34 @@ +{ + services.nfs.server = { + enable = true; + exports = '' + /forge/nfs 10.98.0.0/16(rw,sync,fsid=root,no_subtree_check,root_squash,sec=sys) 2607:b400:0006:cc80::/64(rw,sync,fsid=root,no_subtree_check,root_squash,sec=sys) + /forge/nfs/kube-volumes 10.98.3.0/24(rw,sync,no_root_squash,insecure,no_subtree_check) + ''; + + # fixed rpc.statd port; for firewall + lockdPort = 4001; + mountdPort = 4002; + statdPort = 4000; + }; + systemd.services."rpc-svcgssd".enable = false; + + networking.firewall = { + enable = true; + # for NFSv3; view with `rpcinfo -p` + allowedTCPPorts = [ + 111 + 2049 + 4000 + 4001 + 4002 + ]; + allowedUDPPorts = [ + 111 + 2049 + 4000 + 4001 + 4002 + ]; + }; +} diff --git a/hosts/vesuvius/zfs.nix b/hosts/vesuvius/zfs.nix index df075c4..dfc4afe 100644 --- a/hosts/vesuvius/zfs.nix +++ b/hosts/vesuvius/zfs.nix @@ -13,5 +13,13 @@ fileSystems."/forge" = { device = "forge"; fsType = "zfs"; + neededForBoot = true; + }; + + fileSystems."/nix" = { + device = "/forge/nix"; + fsType = "none"; + options = [ "bind" ]; + depends = [ "/forge" ]; }; } diff --git a/kube-manifests/config/coredns-config.yaml b/kube-manifests/config/coredns-config.yaml new file mode 100644 index 0000000..f624091 --- /dev/null +++ b/kube-manifests/config/coredns-config.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: coredns-custom + namespace: kube-system +data: + my-custom.server: | + bastille.vtluug.org:53 { + forward . 10.98.0.1 + } + whit.vtluug.org:53 { + forward . 10.98.0.1 + } diff --git a/kube-manifests/config/forge-nfs-storage.yaml b/kube-manifests/config/forge-nfs-storage.yaml new file mode 100644 index 0000000..1939321 --- /dev/null +++ b/kube-manifests/config/forge-nfs-storage.yaml @@ -0,0 +1,18 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: forge-nfs-csi +provisioner: nfs.csi.k8s.io +parameters: + server: 10.98.3.1 + share: /kube-volumes + # csi.storage.k8s.io/provisioner-secret is only needed for providing mountOptions in DeleteVolume + # csi.storage.k8s.io/provisioner-secret-name: "mount-options" + # csi.storage.k8s.io/provisioner-secret-namespace: "default" +reclaimPolicy: Delete +volumeBindingMode: Immediate +allowVolumeExpansion: true +mountOptions: + - hard + - nfsvers=4.2 + diff --git a/kube-manifests/secrets/.sops.yaml b/kube-manifests/secrets/.sops.yaml new file mode 100644 index 0000000..ece8dbf --- /dev/null +++ b/kube-manifests/secrets/.sops.yaml @@ -0,0 +1,8 @@ +creation_rules: + - path_regex: '\.yaml$' + age: >- + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHZSyzWJCfFzGlzXHp1Uby6ayc7vUegexMet4ioKj1Cx, + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbh3gdpIuefWXTHmNzQCn7gvTbwTUBJ1DGjOtTgrWj8, + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOen0Hh9uoJlT9ikRmc9dZQfsjMtBc2v7PNIHyf0KSNh, + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyTxPV3S7ms0AJ0tduI3aJP3o2TJCnkirWKaj5i1+DW, + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHBzpC6FBOKNzO6AfdfGna6MLRg0cf+jhr+DgUwQqU1W diff --git a/kube-manifests/secrets/bash.enc.yaml b/kube-manifests/secrets/bash.enc.yaml new file mode 100644 index 0000000..4bca64e --- /dev/null +++ b/kube-manifests/secrets/bash.enc.yaml @@ -0,0 +1,63 @@ +apiVersion: ENC[AES256_GCM,data:yrQ=,iv:JwyPZ+/Y1WvUrEYBxFes31pWi9yQqIRiHvsWqb/PjSo=,tag:1gF6Z0Cc+TG7n5lV0X2pZg==,type:str] +kind: ENC[AES256_GCM,data:VW/YkcJT,iv:MEQFkugRNkevCc9EFf0/eTmClMND/JkbA82Mm/1/Gls=,tag:NyeKZc5vlfjew1Q9p8+ZuQ==,type:str] +metadata: + name: ENC[AES256_GCM,data:orTJJ2iEWzV1lm0F,iv:c3MjZomOu7MarHmXSPYr47aQMTmIarjCfkakfi6xuKQ=,tag:X1VnzkrW/sLisPC5AMAvTw==,type:str] +type: ENC[AES256_GCM,data:eGA0L547,iv:7EcHYlU146YaYt5G4rk6BcDvOpUluH9e+HYFG+nU6TQ=,tag:ZI7h5rSos/Cw0XvwHpCzew==,type:str] +stringData: + pyqdb_secret_key: ENC[AES256_GCM,data:1TuROxnWN0vzXnnDqkDvSg802SVkelMZdSzVrF8A3X4=,iv:lh7n3tI70Zx/X3eydHiM2y/rDpaXvRohEPH2+fEuwbA=,tag:ySdp7mu1YjJXPL1EmQ8DbA==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHZSyzWJCfFzGlzXHp1Uby6ayc7vUegexMet4ioKj1Cx + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFNrd1pqUSBvREF6 + U1ZmL0tkZCtGUzBlaUtHb1Rvd1VPRkpha1AwcjRjQVp2VE1SZEI4CnhVeXlVeVNQ + M1JKVThqQzZGY1NwcnlYK0E0Wi91dzZ4dEkzTitLUFhYdVkKLS0tIEF0OEhNbW1u + K0xNbEJDTDBNTXZBeTJ0YW1FTjVpUHU5eVRHSEpRQVRaNmMK8JHJmjQ4tcKhJ+PQ + tQBkK0hlBzZm0RnChZ3yvf5eXmx9OBVpFbrjzfSFjhBFH9T7nGLHvvtlg2ZRP/EU + WprpWw== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbh3gdpIuefWXTHmNzQCn7gvTbwTUBJ1DGjOtTgrWj8 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNTZXNQdyBxVVBR + WUhoR1Fwc2ZNeVFTalNuSm9vMnFEallIaDNGRFBjVVhQOFIvMTFzCllXL1V1aldE + Z0pkSzdTS0tGZXUrM3hvUmVHY2tsVWJzcVpidFdaelovdHMKLS0tIDBaakdKYU5R + cFRsckxOcE9oUUxNaDU0MlVZcURmNUNLdVdSaXpQTjN6dE0Kmd5bAhyBeQxFUdZi + sJIDf0jYLdepgl/R5mRXUPgGHQe8eoEhSMQnl3mSX8GgqNozhcobAwe98CgfU9ev + b/Pjsw== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOen0Hh9uoJlT9ikRmc9dZQfsjMtBc2v7PNIHyf0KSNh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9TdzZJUSBXVWdB + ZUQxRXJxS3pKTjVSTHJZWmQraG1weVRjMGJJTTZ6THdlT0pUc25vCjl0NDJ2OVV1 + T3NtYmlYTXdseHpzY2tDVkErajdMTHdzb2kyekdkTTFFbmcKLS0tIDBPZm80NTVP + RUM3aHRHdUxTY29VSVRwSnRyRjBkZHhEMkc0bmtHeW44azQKTCbtWVe9lU3fiqH4 + +sxjVhqbfJ5y/ejODtIlrvijh8+rrBZP1rdFc+PeAupAp0/C21pEB46SCtb94ydZ + ES+J1g== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyTxPV3S7ms0AJ0tduI3aJP3o2TJCnkirWKaj5i1+DW + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlPcGY3USBwNUlG + YWNCOUpKczlnL1lndHkyRVFZRFFCTVJKcnlXajhQbGQvbWI2WjJnCkxBTEI1c2JF + RkVXeFY1VjRHL29sUUtHKzRRZTVIckZMb2NnN2lBdlk1a1EKLS0tIGRRc0xsRnRT + dXdSVUpjSXIzVEZzSXk2RHFTTFJpNHdtRjI4bXp1UVpSR1EKrs0v3/KK9HHZQHt0 + 22yFclPHkH5SJosDhresHHNuvAil5/IGI9/SBAbNayaz9c2hxPCQJliGR2Q/iP+J + N/8Q2A== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHBzpC6FBOKNzO6AfdfGna6MLRg0cf+jhr+DgUwQqU1W + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdZWjVDUSBmYkw2 + bFlZSFpVMHh3U0o3OXJUVWxMclNNM2pmNTFEMjZuL01hWUFidDJVCmZBZWRBd09x + V080Q3pteHFYSnJ0RVRmaXB1RTUxLzlIeVE5OGphQUxlNGcKLS0tIFc3aFY3WTRr + L1BpZzhXNUc2ZlZZMGVWMTdDOEtoTGdUcUk0bkhRVVV1blEKMhHzQr2kgnzo7bjV + IM+xwVNb/OdbNKH0NAOULFFbSEiFCBvAWaenIzP2+9INe3tEGbUQEh+JQ4xIIFU3 + Zw8UCA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-17T02:27:29Z" + mac: ENC[AES256_GCM,data:7TL1K9SkdKZjhoAr+vV6kherSZXDIfmz5Yih1l+4PcZ2/tsOULR3cHbNKw9IC4kTmlffBoBPtY0CcK2vxzVClkzVnWiO7JncIDfZ1WsJd3IqH1ZZxidvMm7lH4vyfzZkRRE3q8AVheGuW9+HzqVTqPMXIEaio8g79rxAoMzu84k=,iv:PisrvkdB11g77ZoYbqvN6w9+us4VB2Qr0Ye37GNvDMw=,tag:TRYNXgizr8gy6kYivPADlg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 diff --git a/kube-manifests/secrets/sops-helper.sh b/kube-manifests/secrets/sops-helper.sh new file mode 100755 index 0000000..57c6274 --- /dev/null +++ b/kube-manifests/secrets/sops-helper.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash +set -euo pipefail + +cd "$(dirname "$0")" + + +usage() { + echo "Usage: $0 " + echo "" + echo " encrypt Encrypt .yaml -> .enc.yaml" + echo " decrypt Decrypt .enc.yaml -> .yaml" + echo "" + echo "Example: $0 encrypt wiki" + exit 1 +} + +[[ $# -eq 2 ]] || usage + +ACTION="$1" +NAME="$2" + +case "$ACTION" in + encrypt) + [[ -f "${NAME}.yaml" ]] || { echo "Error: ${NAME}.yaml not found"; exit 1; } + sops --encrypt "${NAME}.yaml" > "${NAME}.enc.yaml" + echo "Encrypted ${NAME}.yaml -> ${NAME}.enc.yaml" + ;; + decrypt) + [[ -f "${NAME}.enc.yaml" ]] || { echo "Error: ${NAME}.enc.yaml not found"; exit 1; } + (umask 077 && sops --decrypt "${NAME}.enc.yaml" > "${NAME}.yaml") + echo "Decrypted ${NAME}.enc.yaml -> ${NAME}.yaml" + ;; + *) + usage + ;; +esac diff --git a/kube-manifests/secrets/wiki.enc.yaml b/kube-manifests/secrets/wiki.enc.yaml new file mode 100644 index 0000000..8060d57 --- /dev/null +++ b/kube-manifests/secrets/wiki.enc.yaml @@ -0,0 +1,70 @@ +apiVersion: ENC[AES256_GCM,data:sHY=,iv:/qaygBt8nladzMk5HK1JduYvnf6SI3vhD7Vgr6NmD00=,tag:lW/OS9FPEX+iNpjV00ZXRg==,type:str] +kind: ENC[AES256_GCM,data:9qbpJtve,iv:yUJxv8c0MDxAQ7ivvYv+ewoEdNe1y4IhqiWnTvz67uo=,tag:/p5K9f1tbBImXLcaOfTiqQ==,type:str] +metadata: + name: ENC[AES256_GCM,data:AS4gkxoO9y4FQQ7P,iv:tLHDFwEs5CRvH4Hdd2UVIjEUD2csJDvYNf02HDMcn9Y=,tag:qo7lZWq3M52/L8jORfz80w==,type:str] +type: ENC[AES256_GCM,data:00C/la7h,iv:HGs3mUcHo6NO9rJzsPUW8ufREd1LtAFR/CjLBuy+fkQ=,tag:PzJGUsBKE17schPghLE2Eg==,type:str] +stringData: + mysql_password: ENC[AES256_GCM,data:fOLZFc+XTNy1IM4pQfsj7pRFL9JYN/KGVzEkTDFQEJY=,iv:u9gs3t9N5tmJ7QXxiuk2cmIuSQbgrUYckF1xpKkzBrg=,tag:F41QcgjQhZoWfGw4G9T2VA==,type:str] + mysql_root_password: ENC[AES256_GCM,data:4NSloZzv+tTxuI51ieweAKZyy8t1TXL4zXlKTCSgZsk=,iv:qCBcAQtQ0ALu+DyXYKtfa7yEIu+dFerM0N4CNbkyaNA=,tag:ZiKsNtlk0HAyKjekRdFE1Q==,type:str] + mw_secret_key: ENC[AES256_GCM,data:Qp7RcUz/xOiaUH+owvOZfNE4MsoOcwazP0IP3hzXwVt/gD/RlwZtZ4CSv6xXDbf6akL8ef5Dt62/MNmXm/Tx3g==,iv:Y5vf7ENyNARgYcmiUO6mTQs8do9lyZNnk92oPz3zlFI=,tag:5L6Mg6QoxDjAZY9eeiXUVg==,type:str] + mw_upgrade_key: ENC[AES256_GCM,data:S4GrlmG3cpJsJSA8yKWbFw==,iv:p1Xy5vqGeXMnchS+yr9tTTJP5Bl96k9yzauMU8D7AAo=,tag:m0aj9h6Wje+tAdbmttzF2Q==,type:str] + smtp_password: ENC[AES256_GCM,data:lyS8O1qbyPucthZruLdP8s+8vsur7uEY81L9K8bfd86PXf0C,iv:BehZTannUEYTbD6xcx+KOLfBiTDIfxMwMPi9LqXJN0g=,tag:jyelAxt70eNP8Ax6VbHShw==,type:str] + odic_google_id: ENC[AES256_GCM,data:JaCpK/2O22vbkOvXJcD47cVihtBAfoKTnUScXIITw7Qu1YdkPwNPwvYUMZEw+PUBO9FrBTPo/9kjP+tlxNYC6BizRoaYRGfK,iv:WDJf0QGIOv4iv6b8Mdi4+/r6JuWFFurIZ+bhvJeaQsE=,tag:nbnK65I8FeQUgFk2/1OA1g==,type:str] + odic_google_secret: ENC[AES256_GCM,data:CRp3Uz3aUHYojSqwT6qEDGEaJJq9Cod+,iv:JL9KNdqQ6GYZRlC/BfWuKellK7bu51/HGSPRR5Uhbfo=,tag:HlB/GDl/z9aYG7m2duYU9g==,type:str] + dex_wiki_secret: ENC[AES256_GCM,data:Se4DSaXkLU9EEmLUk9NgaxvwLhlrIPM2Z6YETWDSyjQ=,iv:sbI8Eoe3xxGA+4mKR8rUwfkIukoBGbkUlQ4FN1+67qk=,tag:QBPSJONop0l+omkL4GzkxA==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHZSyzWJCfFzGlzXHp1Uby6ayc7vUegexMet4ioKj1Cx + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFNrd1pqUSBQTC9a + UGpYVyt4RHEwYTBBNFZtaVU0MDJKQmlraE9EcE5remNCQ2ZxamdzCjV2Mm14YUZF + ZE9SUmN3SUFKQ1YvQmxjR2ljbE1BNlhWNHZWcmloQmJSSlEKLS0tIFN4emZ6S3R3 + RWlmRTQwa3MxR3JmaGNUenhQNGQ0UW9XQ3VmSEwvLzhlUEEKaYGhdgrkgD9uiuB9 + T+PSb4v3SJkNxM7nzerHYxxYPci5YLq8Xod5PKPB+O8M5Rj/HNFa0Xg+icZ8ynUj + D2PW/A== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbh3gdpIuefWXTHmNzQCn7gvTbwTUBJ1DGjOtTgrWj8 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNTZXNQdyBEeFgv + Z2R0NXhLSkpXTzFJZXJ2SkJCeElUVjBMT2x1dTErN0FZRjI2aVZBCjVUdUZFZUdU + eDJrbkpoaDJkbGZFZEYrYTh5cEY2clVEWlNPcUU3NS9LTjgKLS0tIHp6SHhFSlQ3 + S1hzVjI0SkJWcEdnQnp2VytqTXVkcHBYaW5xR1Znb3RoTW8KnqleS1vycfQkj2Oh + AujhvN5m1HlFAyRcc/JKBbBjC8AMTshVorQYkMBeaeu2DQVpM9w8OCwMXQrKF+mG + S8vqEw== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOen0Hh9uoJlT9ikRmc9dZQfsjMtBc2v7PNIHyf0KSNh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9TdzZJUSBtcm9N + Q21QRG1meGMvMEFZd1pHQUNRV2o2NXN3SmtNOEZnQ3IzYVhUK1FrClNlU2ljRXpQ + RjhFWlhXUzdDT3dQUEFNaXhGNW1uQk5DSWU0RnEvRDJZNUUKLS0tIFk5T0JkRnFW + YUpWTEpYeUpDOG5xWFVCOUI0cWw1dFBJblJ4STBobThsSlkKAyf1lbrCxMRYl2DO + GLip3N4KcfWnN5EFgSWqPH3d4qKAVPIBL8Lr61OVDQx0U90b8w4Qwvsq3qinNAey + yShoWw== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyTxPV3S7ms0AJ0tduI3aJP3o2TJCnkirWKaj5i1+DW + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlPcGY3USBJcVF3 + OFBjK3JqL2w3dnI1ZHNjUVlrSHNOM0ZDNlJ5QndudjNEeWdiMEJjCjlabHcxVDNz + Z3o4cEFuT0dCdU1aRWRKc01QbFpVNFNtNytSbnMrRlBBMkEKLS0tIDgwTVc1Wlky + a29ESFZJTVVNWXcvYk9oY2VtVEI1cWlDVWx6MkVYNFdKRHMKjVHBp+weGevvFT1X + xccWRa8UL1LyfqrytCAn0uS2tXRGbmTqShpMJX8BeQma+p09ria4Xu4cUedCq+58 + cjzCUg== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHBzpC6FBOKNzO6AfdfGna6MLRg0cf+jhr+DgUwQqU1W + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdZWjVDUSBwbEYv + TG1RNzRWYm9CM3ZEMEkrN1QvR01zamluOEdQWW9Oa2wvKzd6QUNVCmM0SGVqRitq + MEEvNHRpYWFBa0J0MnFvNHRtNVNnTDFBS0w0dElHY0dtZ1kKLS0tIDd6MFRYbTVO + S004bFk5Mm1Ham9uL0FDTHQwNkZUMER6NUxiZ0tPTXhOL1EK5ImrVb1h0u78XdYZ + t+U1O8C95Xud7/Um19li30swm0iCpi206nuFRQlGv8ipAfvfp6n7m97HkEi6Qu+1 + 62UPpQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-17T02:20:25Z" + mac: ENC[AES256_GCM,data:L+jqSCJAcOB9V3ndbBPC+K/wvsh8uR69qfgEoPUaexVX++0Dw44bJUkOw1zsktHO1lr3prjIZ74A9TojG1jq67nN1rm6NRxNCkm4CvtGOyTIL5IFz3eqkSMSQniQVeL/WGpTR1r8VlPxFRZyDYKxFTvuIwtRB0x0Ujl8sjILlGc=,iv:7i/XSs3ZYTVcvSeHSsr+L0Pd0rumpuaFTYF6cK7KrBY=,tag:lG5MZnylwPGrFs8+nUQT5g==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 diff --git a/kube-manifests/services/bash.yaml b/kube-manifests/services/bash.yaml new file mode 100644 index 0000000..94ee6a0 --- /dev/null +++ b/kube-manifests/services/bash.yaml @@ -0,0 +1,89 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: bash-nfs-pvc + labels: + app: bash +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + storageClassName: forge-nfs-csi +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: bash-deployment + labels: + app: bash +spec: + replicas: 1 + selector: + matchLabels: + app: bash + template: + metadata: + labels: + app: bash + spec: + volumes: + - name: bash-sqlite + persistentVolumeClaim: + claimName: bash-nfs-pvc + containers: + - name: bash + image: ghcr.io/vtluug/pyqdb:latest + ports: + - containerPort: 8080 + env: + - name: pyqdb_secret_key + valueFrom: + secretKeyRef: + name: bash-secrets + key: pyqdb_secret_key + resources: + requests: + memory: 8Gi + cpu: 2 + limits: + memory: 8Gi + cpu: 2 + volumeMounts: + - name: bash-sqlite + mountPath: /app/quotes.db + subPath: quotes.db + readOnly: false +--- +apiVersion: v1 +kind: Service +metadata: + name: bash-service +spec: + selector: + app: bash + type: LoadBalancer + ports: + - name: http + port: 80 + targetPort: 8080 + protocol: TCP +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: bash-ingress +spec: + rules: + - host: "bash.vtluug.org" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: bash-service + port: + number: 80 diff --git a/kube-manifests/services/ephemeral.yaml b/kube-manifests/services/ephemeral.yaml new file mode 100644 index 0000000..72a0205 --- /dev/null +++ b/kube-manifests/services/ephemeral.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ephemeral-chat-deployment + labels: + app: ephemeral-chat +spec: + replicas: 1 + selector: + matchLabels: + app: ephemeral-chat + template: + metadata: + labels: + app: ephemeral-chat + spec: + containers: + - name: ephemeral + image: ghcr.io/mikhail729/ephemeral:0.2.2 + ports: + - containerPort: 80 + env: + - name: PORT + value: "80" + resources: + requests: + memory: 64Mi + cpu: 0.5 + limits: + memory: 64Mi + cpu: 0.5 +--- +apiVersion: v1 +kind: Service +metadata: + name: ephemeral-chat-service +spec: + selector: + app: ephemeral-chat + type: LoadBalancer + ports: + - name: http + port: 80 + protocol: TCP +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ephemeral-chat-ingress +spec: + rules: + - host: "ephemeral.vtluug.org" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: ephemeral-chat-service + port: + number: 80 diff --git a/kube-manifests/services/search-4get.yaml b/kube-manifests/services/search-4get.yaml new file mode 100644 index 0000000..ea054a5 --- /dev/null +++ b/kube-manifests/services/search-4get.yaml @@ -0,0 +1,113 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: search-4get-nfs-pvc + labels: + app: search-4get +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 16Mi + storageClassName: forge-nfs-csi +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: search-4get-deployment + labels: + app: search-4get +spec: + replicas: 1 + selector: + matchLabels: + app: search-4get + template: + metadata: + labels: + app: search-4get + spec: + nodeSelector: + kubernetes.io/hostname: "vesuvius" + volumes: + - name: search-4get-banner + persistentVolumeClaim: + claimName: search-4get-nfs-pvc + initContainers: + - name: search-4get-banner-loader + image: alpine:3 + command: + - "sh" + - "-c" + - wget -O /banner/go-hokies.jpg https://search.vtluug.org/banner/go-hokies.jpg + volumeMounts: + - name: search-4get-banner + mountPath: /banner + containers: + - name: search-4get + image: luuul/4get:latest + ports: + - containerPort: 80 + env: + - name: FOURGET_PROTO + value: "http" + - name: FOURGET_SERVER_NAME + value: "search.vtluug.org" + - name: FOURGET_SERVER_SHORT_DESCRIPTION + value: "Virginia Tech Linux & Unix User's Group" + - name: FOURGET_SERVER_LONG_DESCRIPTION + value: "Virginia Tech Linux & Unix User's Group" + resources: + requests: + memory: 1Gi + cpu: 2 + limits: + memory: 1Gi + cpu: 2 + volumeMounts: + - name: search-4get-banner + mountPath: /var/www/html/4get/banner + readOnly: false + # make opensearch hallucinate that we're connecting thru https + # otherwise, it'll add the search engine as http://[host], which + # inevitably resolves to http://search.vtluug.org:443, which obviously + # just doesn't work + lifecycle: + postStart: + exec: + command: + - "/bin/sh" + - "-c" + - sed -i '2i\$_SERVER[\"HTTPS\"] = \"on\";' opensearch.php +--- +apiVersion: v1 +kind: Service +metadata: + name: search-4get-service +spec: + selector: + app: search-4get + type: LoadBalancer + ports: + - name: http + port: 80 + protocol: TCP +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: search-4get-ingress +spec: + rules: + - host: "search.vtluug.org" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: search-4get-service + port: + number: 80 diff --git a/kube-manifests/services/vtluug-site.yaml b/kube-manifests/services/vtluug-site.yaml new file mode 100644 index 0000000..8af576a --- /dev/null +++ b/kube-manifests/services/vtluug-site.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: vtluug-site + labels: + app: vtluug-site +spec: + replicas: 1 + selector: + matchLabels: + app: vtluug-site + template: + metadata: + labels: + app: vtluug-site + spec: + containers: + - name: site + image: ghcr.io/vtluug/site:latest + ports: + - containerPort: 80 + env: + - name: PORT + value: "80" + resources: + requests: + memory: 64Mi + cpu: 0.5 + limits: + memory: 64Mi + cpu: 0.5 +--- +apiVersion: v1 +kind: Service +metadata: + name: vtluug-site-service +spec: + selector: + app: vtluug-site + type: LoadBalancer + ports: + - name: http + port: 80 + protocol: TCP +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: vtluug-site-ingress +spec: + rules: + - host: "vtluug.org" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: vtluug-site-service + port: + number: 80 diff --git a/kube-manifests/services/wiki.yaml b/kube-manifests/services/wiki.yaml new file mode 100644 index 0000000..f6845a5 --- /dev/null +++ b/kube-manifests/services/wiki.yaml @@ -0,0 +1,461 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: wiki-images-nfs-pvc + labels: + app: wiki +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + storageClassName: forge-nfs-csi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: wiki-db-nfs-pvc + labels: + app: wiki +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + storageClassName: forge-nfs-csi +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: wiki-db-deployment + labels: + app: wiki-db +spec: + replicas: 1 + selector: + matchLabels: + app: wiki-db + template: + metadata: + labels: + app: wiki-db + spec: + volumes: + - name: wiki-db-data + persistentVolumeClaim: + claimName: wiki-db-nfs-pvc + securityContext: + runAsUser: 999 + runAsGroup: 999 + containers: + - name: mariadb + image: mariadb:12.2.2 + ports: + - containerPort: 3306 + env: + - name: MYSQL_DATABASE + value: "mw" + - name: MYSQL_USER + value: "mw_user" + - name: MYSQL_PASSWORD + valueFrom: + secretKeyRef: + name: wiki-secrets + key: mysql_password + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: wiki-secrets + key: mysql_root_password + resources: + requests: + memory: 1Gi + cpu: 1 + limits: + memory: 1Gi + cpu: 1 + volumeMounts: + - name: wiki-db-data + mountPath: /var/lib/mysql + readOnly: false +--- +apiVersion: v1 +kind: Service +metadata: + name: wiki-db-service +spec: + selector: + app: wiki-db + ports: + - name: mysql + port: 3306 + targetPort: 3306 + protocol: TCP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: wiki-deployment + labels: + app: wiki +spec: + replicas: 1 + selector: + matchLabels: + app: wiki + template: + metadata: + labels: + app: wiki + spec: + volumes: + - name: wiki-images + persistentVolumeClaim: + claimName: wiki-images-nfs-pvc + - name: wiki-localsettings + configMap: + name: wiki-config + - name: wiki-localsettings-vtluug + configMap: + name: wiki-config-vtluug + - name: wiki-localsettings-gobblerpedia + configMap: + name: wiki-config-gobblerpedia + containers: + - name: mediawiki + image: vtluug/mediawiki-vtluug:1.1 + command: ['/bin/sh', '-c', 'sleep 7 && php /var/www/html/w/maintenance/update.php --quick ; apache2-foreground'] + ports: + - containerPort: 80 + env: + - name: MYSQL_PASSWORD + valueFrom: + secretKeyRef: + name: wiki-secrets + key: mysql_password + - name: MW_SECRET_KEY + valueFrom: + secretKeyRef: + name: wiki-secrets + key: mw_secret_key + - name: MW_UPGRADE_KEY + valueFrom: + secretKeyRef: + name: wiki-secrets + key: mw_upgrade_key + - name: SMTP_PASSWORD + valueFrom: + secretKeyRef: + name: wiki-secrets + key: smtp_password + - name: ODIC_GOOGLE_ID + valueFrom: + secretKeyRef: + name: wiki-secrets + key: odic_google_id + - name: ODIC_GOOGLE_SECRET + valueFrom: + secretKeyRef: + name: wiki-secrets + key: odic_google_secret + - name: DEX_WIKI_SECRET + valueFrom: + secretKeyRef: + name: wiki-secrets + key: dex_wiki_secret + resources: + requests: + memory: 2Gi + cpu: 2 + limits: + memory: 2Gi + cpu: 2 + volumeMounts: + - name: wiki-images + mountPath: /var/www/html/w/images + readOnly: false + - name: wiki-localsettings + mountPath: /var/www/html/w/LocalSettings.php + subPath: LocalSettings.php + readOnly: true + - name: wiki-localsettings-vtluug + mountPath: /var/www/html/w/LocalSettings_vtluug.php + subPath: LocalSettings_vtluug.php + readOnly: true + - name: wiki-localsettings-gobblerpedia + mountPath: /var/www/html/w/LocalSettings_gobblerpedia.php + subPath: LocalSettings_gobblerpedia.php + readOnly: true +--- +apiVersion: v1 +kind: Service +metadata: + name: wiki-service +spec: + selector: + app: wiki + type: LoadBalancer + ports: + - name: http + port: 80 + targetPort: 80 + protocol: TCP +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: wiki-ingress +spec: + rules: + - host: "vtluug.org" + http: + paths: + - pathType: Prefix + path: "/w" + backend: + service: + name: wiki-service + port: + number: 80 + - host: "gobblerpedia.org" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: wiki-service + port: + number: 80 + - host: "wiki.vtluug.org" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: wiki-service + port: + number: 80 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: wiki-config +data: + LocalSettings.php: | + 'acidburn.vtluug.org', + 'IDHost' => 'vtluug.org', + 'port' => 25, + 'auth' => true, + 'username' => 'wiki-email', + 'password' => getenv('SMTP_PASSWORD') + ); + + $wgEnableEmail = true; + $wgEnableUserEmail = true; + $wgEmergencyContact = 'wiki-admin@vtluug.org'; + $wgPasswordSender = 'wiki-admin@vtluug.org'; + $wgEnotifUserTalk = false; + $wgEnotifWatchlist = false; + $wgEmailAuthentication = true; + + $wgScriptPath = '/w'; + $wgArticlePath = "/wiki/$1"; + $wgUsePathInfo = true; + + $wgResourceBasePath = $wgScriptPath; + + $wgMainCacheType = CACHE_NONE; + $wgMemCachedServers = []; + + $wgEnableUploads = true; + $wgUploadPath = "{$wgScriptPath}/images/{$wgDBprefix}"; + $wgUploadDirectory = "{$IP}/images/{$wgDBprefix}"; + $wgUseImageMagick = true; + $wgImageMagickConvertCommand = '/usr/bin/convert'; + $wgFileExtensions[] = 'svg'; + $wgSVGConverter = 'rsvg'; + + $wgUseInstantCommons = true; + $wgPingback = true; + + $wgShellLocale = 'C.UTF-8'; + + $wgCacheDirectory = "{$IP}/cache/{$wgDBprefix}"; + + $wgLanguageCode = 'en'; + + $wgSecretKey = getenv('MW_SECRET_KEY'); + $wgUpgradeKey = getenv('MW_UPGRADE_KEY'); + + $wgAuthenticationTokenVersion = '1'; + + $wgNoFollowLinks = false; + + $wgDiff3 = '/usr/bin/diff3'; + + # Extensions + wfLoadExtension('AbuseFilter'); + $wgGroupPermissions['sysop']['abusefilter-modify'] = true; + $wgGroupPermissions['*']['abusefilter-log-detail'] = true; + $wgGroupPermissions['*']['abusefilter-view'] = true; + $wgGroupPermissions['*']['abusefilter-log'] = true; + $wgGroupPermissions['sysop']['abusefilter-private'] = true; + $wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true; + $wgGroupPermissions['sysop']['abusefilter-revert'] = true; + $wgAbuseFilterEmergencyDisableThreshold = array('default' => 1.00); + + wfLoadExtension('AntiSpoof'); + + $wgUseAjax = true; + wfLoadExtension('CategoryTree'); + + wfLoadExtension('Cite'); + + wfLoadExtension('Interwiki'); + $wgGroupPermissions['sysop']['interwiki'] = true; + + wfLoadExtension('Maps'); + require_once('extensions/Maps/Maps_Settings.php'); + $GLOBALS['egMapsEnableCoordinateFunction'] = false; + $GLOBALS['egMapsDefaultService'] = 'leaflet'; + + wfLoadExtension('MobileFrontend'); + $wgMFAutodetectMobileView = true; + wfLoadSkin('MinervaNeue'); + $wgMFDefaultSkinClass = 'SkinMinerva'; + wfLoadExtension('GeoData'); + $wgMFNearby = true; + + wfLoadExtension('Nuke'); + + wfLoadExtension('PluggableAuth'); + wfLoadExtension('OpenIDConnect'); + $wgPluggableAuth_EnableLocalLogin = true; + $wgPluggableAuth_ButtonLabelMessage = 'VTLUUG SSO'; + $wgOpenIDConnect_UseEmailNameAsUserName = true; + $wgOpenIDConnect_Config['https://id.vtluug.org'] = [ + 'clientID' => 'vtluug-wiki', + 'clientsecret' => getenv('DEX_WIKI_SECRET'), + 'name' => 'VTLUUG SSO', + 'scope' => ['openid', 'profile', 'email'], + 'preferred_username' => 'name' + ]; + + wfLoadExtension('ParserFunctions'); + $wgPFEnableStringFunctions = true; + + wfLoadExtension('Renameuser'); + + $wgGroupPermissions['sysop']['rollback'] = true; + + wfLoadExtension('UserMerge'); + $wgGroupPermissions['sysop']['usermerge'] = true; + $wgUserMergeProtectedGroups = array(); + + # Skins + wfLoadSkin('Vector'); + $wgDefaultSkin = 'vector'; + + # Load wiki specific settings + require_once("LocalSettings_{$wgDBprefix}.php"); + + # Debugging + $wgDBerrorLog = 'php://stderr'; +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: wiki-config-vtluug +data: + LocalSettings_vtluug.php: | + getenv('ODIC_GOOGLE_ID'), + 'clientsecret' => getenv('ODIC_GOOGLE_SECRET'), + 'name' => 'Google SSO', + 'scope' => ['openid', 'profile', 'email'] + ]; + + $wgRightsPage = 'Linux_and_Unix_Users_Group_at_Virginia_Tech_Wiki:License'; + $wgRightsUrl = 'http://creativecommons.org/licenses/by-sa/3.0/us/'; + $wgRightsText = 'Attribution-Share Alike 3.0 United States'; + $wgRightsIcon = "{$wgUploadPath}/cc-by-sa.png"; +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: wiki-config-gobblerpedia +data: + LocalSettings_gobblerpedia.php: | + getenv('ODIC_GOOGLE_ID'), + 'clientsecret' => getenv('ODIC_GOOGLE_SECRET'), + 'name' => 'Google SSO', + 'scope' => ['openid', 'profile', 'email'] + ]; + + wfLoadExtension('Scribunto'); + $wgScribuntoDefaultEngine = 'luastandalone'; + + $wgRightsPage = ''; + $wgRightsUrl = 'http://creativecommons.org/licenses/by-sa/3.0/us/'; + $wgRightsText = 'Attribution-ShareAlike 3.0 United States'; + $wgRightsIcon = "{$wgResourceBasePath}/images/cc-by-sa-88x31.png"; diff --git a/papatux-keys.nix b/papatux-keys.nix index 226988f..b565f7b 100644 --- a/papatux-keys.nix +++ b/papatux-keys.nix @@ -1,5 +1,6 @@ [ "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN+Xl9xdmuWyDZaNb1haR7dLnWenrwHVPgAQBM06kbWpAAAABHNzaDo= ssh: rsk@yubikey" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbh3gdpIuefWXTHmNzQCn7gvTbwTUBJ1DGjOtTgrWj8 rsk@oldcountry" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOen0Hh9uoJlT9ikRmc9dZQfsjMtBc2v7PNIHyf0KSNh mikhail@licas.dev" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyTxPV3S7ms0AJ0tduI3aJP3o2TJCnkirWKaj5i1+DW clj c@pyrope.net" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHBzpC6FBOKNzO6AfdfGna6MLRg0cf+jhr+DgUwQqU1W timelord" diff --git a/secrets/blade-hosts/backbiter/data b/secrets/blade-hosts/backbiter/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/backbiter/data differ diff --git a/secrets/blade-hosts/backbiter/k3s-node-password.age b/secrets/blade-hosts/backbiter/k3s-node-password.age new file mode 100644 index 0000000..21bf926 --- /dev/null +++ b/secrets/blade-hosts/backbiter/k3s-node-password.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 TtYzEQ 1peqMu3+ojQcMPGyjp+UWn2ywJRVZNrQxNOJUqSzLDU +ZZGqRvyp4tpHYFKPWMdri3WmRrAZJA+ZPhGKmapW1Do +--- hVFriSP5AM0XFgdGzohi15mQr7lDf+AinXWnw420srs +o^4G͘Jpz`g'"+!m5Y/0b{Z,c(-v"b/4Q2N8B \ No newline at end of file diff --git a/secrets/blade-hosts/backbiter/ssh-key.pub b/secrets/blade-hosts/backbiter/ssh-key.pub new file mode 100644 index 0000000..9a9a86f --- /dev/null +++ b/secrets/blade-hosts/backbiter/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0gfTT0htiRipP8kD4/IM88mEPoqUHYrMstE/CohYnE backbiter host key diff --git a/secrets/blade-hosts/backbiter/ssh-key.sealed b/secrets/blade-hosts/backbiter/ssh-key.sealed new file mode 100644 index 0000000..271fa16 --- /dev/null +++ b/secrets/blade-hosts/backbiter/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAKU0Omq+ +tdZu/VmxgyQoqEG7BitHnCK0/KUY92ZMHIWMhqp/eH4D0CjqXLRhNIQ/RV4JTXZo +mj4KhcXJ9/sU16lTug1SRjWzEzyT42MimuuJdblu2Zwna4EpO3f+PH63WAkQUqrb +e7zrtAY19wg1N0ua3A6kVoZZ/gaj7gUbl2adq5DVk5mkHWc4Hs4r0J+fFiYM3WSy +On9XUHuC7g4hUMxyu7aPhLoCuhjy4vKRm/a2CB5OBEEefqxoK101hQiS0vUfiDGU +BGAQnyXBePXKRbQQmmhUzCB/VbZdf5dlNjOX7Qa/sgl2N/3CU0p2sDRtft2DNxoc +qB1HC1XKV53vC30AAAEAmmyAwkDbE8SSPjirBtUuvpiDrUnUlRRxCStpQ/4hE+s3 +ilopmlrDGKGOkJ6sWxnFsQMogr5RqLBv2+85IEBZmchUPT+zz3Ak274TyqgIMWmz +kJ8nit/R8mMm6+glfHWHs/Z3an9rAswCV/gpVyXQyEqUvQ/l1FCYzx7bJZ6eG0Wr +0JynMZf3kjtnUvDRXSdxTb/IUhmFcSzjx+7OLC82ktaWVE3SWvhEEvwBWL2fiO1m +QLsRJJEGpALTR3hKNeawew+X1LaTytDulj8zzyOOrdOLJBqPswmttIZ4w6rjWRzC +R3HOQWiMjFM7lRH8etF7lT8xMw9cjbJDPo+2doBZUg== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEABVS3nBzz+OpK7ebD9W3WFiQWrK7X3T/uVy2ICDyddn6KswWr ++hFildmt4UYW4SWyQFE9/d5+bi/X8E6pXXn4D9nwG5DnKu6YMP+4p77S30lS+BM6 +lCUa6QNradZChz1AL3qTIethAS9DYgo/b2EwqSlQq1voVdKwiguedkMXo9HF+yut +mLw8ttnlqDYVYyERieSRLyHe5ZzHz7LbCY3Wn4ObJYa8FcdiG4cDzNh/t+6KaBOs +r+nrtmqrjP12/i8hSxSswWD3PJMlbUn6+8hxFWravmAd3OywLScmMX9WDhs8U1mC +rOgcBt5DP6XkAU3PVAu1FfKLaCJtGb2nEpBvVw== +-----ENC DAT----- +Ply8NGAu/SC55OIjvLNTdWiCci2eoG+LxGiaHMAOKPGOzLVRklBPN4Vp3AORnpID +MAAkrTdIjBtVL4Uza0slHV6x3dQXFc6DfW58Lj7IHUbfQURvlDIRl+HqJKN2Q+o0 +s3Jxk7gPyU8li4YN3DW8Vc7BIz0W5GZIpt/1mMvxD+iMXYHcEwNzdSvOKb7gM7Fc +dO0nUCzlbhnxFYbyVnc2MHYiQ6Mdd7Oge3+usI9jVG2q2LN4AlCziXeGFZGV5fqK +zJA+eJfbD1PfebGcExJSay3m9Tru6dyQRC50avp8XlEoWztM0PV21DAzD3aNfWl6 +O+ddaKfhBUT2yxIXsthHHRwfBU8PxcUFD3j/oNQ/b8iUgr+Z/BeUB4iTg8cQrPaF +UNR0lXlrPmEgTa2a7SosJijISGRLlyXCELegOmcAl8ayQtuPJ9I0whSA76//fzXI +Z6RBBdkfCLPe3cKa91PBjB4a4BPYg34sRqZYtzD5LHXQo7tKUvxlQN/v+wZSq35a +hY7jqetHIGjHdYkUSUlnMvxSUE2rccwtn5wHn8jEgu0= +-----END TSS----- diff --git a/secrets/blade-hosts/damocles/data b/secrets/blade-hosts/damocles/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/damocles/data differ diff --git a/secrets/blade-hosts/damocles/k3s-node-password.age b/secrets/blade-hosts/damocles/k3s-node-password.age new file mode 100644 index 0000000..c33879b Binary files /dev/null and b/secrets/blade-hosts/damocles/k3s-node-password.age differ diff --git a/secrets/blade-hosts/damocles/ssh-key.pub b/secrets/blade-hosts/damocles/ssh-key.pub new file mode 100644 index 0000000..db324ad --- /dev/null +++ b/secrets/blade-hosts/damocles/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL32lMYzyDe03AEkTZmivP9TicaPQ4HNmky489Ids44j damocles host key diff --git a/secrets/blade-hosts/damocles/ssh-key.sealed b/secrets/blade-hosts/damocles/ssh-key.sealed new file mode 100644 index 0000000..cd69445 --- /dev/null +++ b/secrets/blade-hosts/damocles/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAKC0ZzT5 +TJYwAJSNUfF53PcQIwVR+7OarhfoWxwhtxUfDYPrrCa7Kh+VkGpLpvkcur3gcK0d +myZbpSMx1O1jAR6oalr3lsvjcl+XcD4xJKhJCe6lbbm1jaS/yRrGvT+a64WXfkaZ +52kA6jf9Iq7CkSXF6o6JJ+bh/9ugRWttcDsAKEwD88XeVqQBRGoTvEa8KfOOVwjF +rfYyaV6Af6O1ix6QP5qVXpytKmVKLtKDZ+/a+U20q82+VNScXKPnVgagbuegK/X2 +laYZhJo+NSMnlrv6U4vJr85agEO2TVXmd80hjMehmHKh5GRLOC0S0gM67PLUU7iI +12wzUDG/YvhzresAAAEALVHNE+WKEApCT7wp5KG59SpEUCThBhMmOhE+scXVRmRB +V9mJX4ZQLH7XNrXtcvduXgAalxV+1FJWnPwBmXsyGNMnoQfhHHDmJZPgV1/9BNMH +sPpiCFofKo395h6Goc2UPGR63yHhFJStX8GawlN9hCszBxdFGjHZfbQkFgZDw297 +RtqZPH5PfglLUD2WeO0tcPPqGHS67krYxz2mrcD6oRO/MgLf71OMM+OIwl4mAx5V +p8uCYL9ztfmLqGH91qrKlJ8XBumthauDlPD6xX4QFSHd7fv1rj4pkdvBHKgH0fZ8 +Tq/I1DjQLvL/RNwfnlAT5xvm5i8L0UdnPBaO0JOyHw== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAmYQZQ7KpyHbTb+JYMJvMgl06mSL8c1dCT8gcITjNShqOK/uR +9SrKWzQcHov5KuX+h6TYsWiNpW1jGg7rdv2aOtcn8QVg9xZVHpSsyqgFT+ShDDnI +5G0FsFiSrRb299kiu11Fk2bGZjGN/+HHm5MRpfWLewLdgqkWbrIxE9ED6v0Iawrk +u+54YWdri+mhsBNtP26HVZtZ+ts5iUBqMKErcrBrbWPIk9Pn06irxYLouZYLT11l +Yd4fuo3CJYDTVXi8FTnq4YW54srmtnWD8Xv4SJuGj2yKI+G3H27qExezOqZWIPMG +HpCYRM2yP4oBLDb97DMGH7Jt9lMW0MuR/Frq/A== +-----ENC DAT----- +znbNhCjo930oHcblgrhNLUb1kZlkO+rEaQBSm045QSrKYVobpZ+Eb7DFNm1A94A6 +ylZBp+Luetzu6ZlhGi4lnL9LLjvgM3YgxqgroePMfoU6BD0obU5xXu5FQfNwckMq +Nhsbei5ECM+wxiuamwYdyS4jAcYQuAovEoqU6MYuZKlxLZj9xG7VSDsisKj13XgQ +z6mVR9t49NaXbz3St0cPJz1IO+71QZYogL/GHcKhKYoWKTJJmxpyYsQs40208VkM +nNuZTudijEkGbpXzVtppHKEit+vkFS7vFIQGgxXdL4PvbqH0sc7L3wtMGlMXle1f +nM0jYgPBtD1x1jsv1LiIlwiMnAFXFn7h1mtJ1TIgXMupLmkLclOc7InguF3z7uH0 ++Rnpt3iCiWXJ47+mHDDuZBJ/jGMP0Twu4OmrBkkq1dPWyA9b/+l8Hzp/C+FCIITA +U0i+2qwdjY9P7YCZeVaPWms82YQXe3O2GvE0FJjDRbbwekUjsukWf4O2mEypKRYk +IEPsAF6qA4vTaFp5jsuqlOLTacgcZPAM4UegrpOc/Uw= +-----END TSS----- diff --git a/secrets/blade-hosts/durendal/data b/secrets/blade-hosts/durendal/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/durendal/data differ diff --git a/secrets/blade-hosts/durendal/k3s-node-password.age b/secrets/blade-hosts/durendal/k3s-node-password.age new file mode 100644 index 0000000..7ecfc6b Binary files /dev/null and b/secrets/blade-hosts/durendal/k3s-node-password.age differ diff --git a/secrets/blade-hosts/durendal/ssh-key.pub b/secrets/blade-hosts/durendal/ssh-key.pub new file mode 100644 index 0000000..ec7d538 --- /dev/null +++ b/secrets/blade-hosts/durendal/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZXE6fhzzswWKOL6bMWd0+5EGuYhK/gwwgosCmGdh1U durendal host key diff --git a/secrets/blade-hosts/durendal/ssh-key.sealed b/secrets/blade-hosts/durendal/ssh-key.sealed new file mode 100644 index 0000000..6c9967a --- /dev/null +++ b/secrets/blade-hosts/durendal/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAMW9tre9 +iVwtxwS3sWEzbasuR8cdzNVvRYZSamKsZFUq0KSC1nJan1r7icxSSpFahcnrlKmJ +kFO3EQ6TTaoZo39WE0vY+WN+FP5kFSHjcZ2ufEGTXxTMWD8rrxGmhn6/e2s5KDec +rpU5S7vD8gPTsM0VCM1J+ZO6HIylWsmzAOOTsOruzYzjpHXkV61tMa2hY9slA8+S +ZaxDgo4/nLwEUS1GsYRIyWinHhMw6lGT2VFkqXQjUm7QqITGGIJBGwp9WRbJLXZZ +/RkkIUvSrHXp5LiYXdMhC+Jbm6nL73N0CEy3esur41hsto6jBjlTa0KeU+ZNh6oO +H5S4eaHBnJ5/CesAAAEAUpFieGrYUE8j/vyzmCNxQT3BKEU/6HyiyrjLqvvUjRCO +5V3ljyjB4Gk6U8vRKJqM45Fa8AHfCTMwF6mI3SWsxOmtJS14zs/XbT7Jk/esSZDc +OYge/k98zpkbE3SFFgxz8F70tsEi8oGu270TZnIcUHHPpiFPqZhFvep0QKrzNvIn +y04dt1MNCuuEsYWsyqrCgdJQRnGitYlAKBh+Wd1FEhNKstyUhGL/sbo6wtR4Zr/m +xzzqN3oY4m/HPqBwTdE+TlY7IAuW71jJH206cW41yIjUL4mzlxuhNVypxBq7AFlV +/dIgyCCUQlAcjeVtpba6s4x/f57DxaRSJy5a3vsZeA== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAmLCr2YGXRwWaM+x64ILKXkgE8BT0XoCChandOfJQJGXaU9Cy +57zAoAIRYl4ioxRZdtKPiKEcinojQVKNSMTfydWY3LPvpqqo3n9JGqER6jzEkkVI +xupeLPW6obu2omamb/Hn4b7oqppwfSJW5eZ6qpCdEc3mfi7CFLWppXkSJ/0XmaJ6 +y2l75vl7f/Jg1aSQEN++8upnuz4SsymuVjh390ps8iO9UBmX+sbhiUgOp7O36+km +4abvGr8POsP/j08EOppvjmZll1DBPbXqOLMBDQiJVLfO97T5FRPwcKcchpzpfn7z +bFJe7QFfhUVNBN6IUOY7yv2+3Xx/mnCORcOBbQ== +-----ENC DAT----- +N2xY6ozuRdcEDzX95KvkyZZ7iw71xNJLopYilRzyg+MxCNtzaat2YVizCNFSfs6i +0WTiuzO2RcEaUpe8TsxbbTJb9tvY/l8CfNKgoBRNnyRz570XTZonkhM9J72MnLqz +uOpRR87HVVl96QUCGCiLawLdjuTxAPeUs8CTykRkcebKl9WaiqYO+MIhp8XUgSzd +I9feMqBCKJJhO3N2RpG/HdNNeAyQyKFBIPgefmIYiH5Vu11vb5Dkq6na2LzpcVbT +/VLz0gLtvX43Wwcoes53kYAkZbGVMB04P5LZZJVmkwjFGUeQILuguHgI333qX4de +IhJZQHIoiTEF5NgGtQWN5LV1NadGYhZ/0ARjH0iq0XPKZLFbiDAjRrcDnNPr8u+/ +9l9Z0BGbaw4QHBd+rHhyASF/yVvjYK6l8t2X3I0mKVXCl1KQdqGdN1L8kPdvRTzM +1dAr7aNGyAJOcPgHYcv1e5VGZ0qJzww7sj6l66XB877skb571hJfrGp+tbbB9dmo +SlvfBoNYbwr5hXuCAi86VIeUaatedzI0iFz90Gsl+uU= +-----END TSS----- diff --git a/secrets/blade-hosts/excalibur/data b/secrets/blade-hosts/excalibur/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/excalibur/data differ diff --git a/secrets/blade-hosts/excalibur/k3s-node-password.age b/secrets/blade-hosts/excalibur/k3s-node-password.age new file mode 100644 index 0000000..88edb68 --- /dev/null +++ b/secrets/blade-hosts/excalibur/k3s-node-password.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 PR7Uqw r5SRJVGmz+nJIA+rdfX4pnqMXJG4FktopGHJoA6UuFA +y24DSD2h6azOcXBwSY9ohzaY3eBiAvot5so5TlFLdJ8 +--- ZgaY6UeWpSy6RBNPUv9PVvZkkImJYAaZaTesg+mdP6I +;>DgtƔu}T Ρɖ,Sv sd t*$\Z˒j}PXn* \ No newline at end of file diff --git a/secrets/blade-hosts/excalibur/ssh-key.pub b/secrets/blade-hosts/excalibur/ssh-key.pub new file mode 100644 index 0000000..3f70e10 --- /dev/null +++ b/secrets/blade-hosts/excalibur/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8U2YHuRDBTGAx8d/bF/PB1bzDi+0EEBnL/3Gs34dnt excalibur host key diff --git a/secrets/blade-hosts/excalibur/ssh-key.sealed b/secrets/blade-hosts/excalibur/ssh-key.sealed new file mode 100644 index 0000000..4ceb371 --- /dev/null +++ b/secrets/blade-hosts/excalibur/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAK/c05xH +1Y697ee84yEpWspnEZPzPtyahUiirJ8uAE0j1t2WTJxFxm3Rwi5hgYLMVEe/DbKC +EcsCXgGFkHpva8Scv7z8sJlL73eN901Xmtb9yz6jqUJv008lr+/UGSi9BUWglz9M +K7zO6qDoie8CrKdHd1egv01JnJGi5cF/lbcJjLFwByimCCyeisUmSzjqoobc2dsB +vNxxyd/udlZLgcdxMOLZntk8OYZ47c+pz8eZuGmBCWPg8XS2oxXKzRWOJC33rJVP +lwblfvOMbzQTHzKLODOtdpT4Z5LN1CIZWkWW/eOiZsVTyhkJboJ6zCoiI5iFEbOP +1u7azEDl8TsEldcAAAEAdg28yIe60IZm/5+M7SCdaZUkd9QAF4Ep245n4B5glamx +PH4PRsBT7ABa3L/sjD3VAmL16/ncFZmW8W8iH2Nj7qlnRvHPQ6gLYSoW38SOdPfa +R3o4NwsdUj6zamEyttZc8SWb8acbH4IQhESnDvZD807VS06q/HwOm46+cdxwbN86 +BrNsQLDwBtzaWig0xh0nDLd7+N9aMj2KeeV286iIT0WHqmSDe7jx3FdV1KdFxRjL +6yiaftQ0+M34Met0qJ1+7YNBPxa4AbX0qq3xZecazlHMAJ8ElbYzj5Hra+RtT2Bn +ArzDlf4fEAiBNnqb1vKIH7dygX59dFy0SWHN7migsQ== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAcivoPE7HJG9x18m6Ee8f6C03cgnIjdfKlrya1vxqft2DnSQq +0RlFhHW9qf1fCSvPFwBuNMu0Yb296MeKFUCSnYjF/efxmhY4RW53DwzX4ZO7ZG3T +kyZYEJj4PdGWfoaYfSswj2UZu18EQoiDK6+D/+2G8S92rg75HartzcmxoMloKUe5 +e/ZzXHVReUusiszk5JDFccREH9OvzleQ7fFU0Wq1ETblEOpN+tlqh949D1joBJ1O +V4HKwTDdNPwx1toLIf5RWgcjHHa7GDmxfHE3ObvvgcHYahEDPPolpbPiaTEWztPq +qsZXVTsCSpJh0QToUJLk/2k8eaathMpWWWdQMw== +-----ENC DAT----- +G8BzAJmA1IG2OtSOPCrQAlzfpxOt55JSgFJ5Aoj7DNGsa5F4sPJ6zDyTKRc6wkg4 +5cKpYXLJVUNUKJ1Lkey+FxXkN7c5GbPQiJnQ/LSZRQ+vCBDaCQBbSWdgbzxxrKbR +nToAbC9NCoraUjPhyvWjmL3Ct9TozVw/aE2HJKI4zxde8ukv9E48hmg2m6gioFKl +BSAdo3IspXOyVHhKYQ+zTziH7fsLeq0AJiMsiLpI69KdqJB1Udyu2smOaqH4bLc0 +VNrMf2av9S05KYM7dMia+zKYGbrAjqSSwJ6J9kBS2fU3hZdMIajbClxqNPYQI+iN +8yXmXc9iYWG6/ghERpCTSbWIefkgAVXNVoBm/7DqtTLUcBCwmdmM1XHpU5N5PGkh +t5KMWNWGT5U2hYxf+agiQhemPxPTwF17oDn4JBwlYkoNyEDvgI/+ROH3YlMmGMj3 +Neer14MeBbQd/T575bor5k27ecOgPzKexnaRc1ezxqTe0QYh9MLW12HTzGekL8Lm +BRY9Q4h4YpdsxKS71O79yoeJbZQVzOmhSF093zs2WGk= +-----END TSS----- diff --git a/secrets/blade-hosts/eyelander/data b/secrets/blade-hosts/eyelander/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/eyelander/data differ diff --git a/secrets/blade-hosts/eyelander/k3s-node-password.age b/secrets/blade-hosts/eyelander/k3s-node-password.age new file mode 100644 index 0000000..890bd11 --- /dev/null +++ b/secrets/blade-hosts/eyelander/k3s-node-password.age @@ -0,0 +1,8 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJlVU5VUSAydGRa +bVlVL3RSU3lxYlNYL0Y4MnpTWFV2dnpvYUU1VlJtbjFzdW9YZXpjCmxaeEFpTzF2 +Y2I4d2tka1R0RGF3YXVUS0VRZHZyeTNXc1VqUWxPT1JtVmsKLS0tIFJ4cEpNdFlU +dkltRDFmc1FwK2ZsV01hMk5SZVA2MGF5TkUvQW1yc1VkYWcKwsEow+7U0U8ZVxhg +H+T4MF9df4oq3F7qLieU9FJMRdK5a/AghJ15t03dHoBGF0aOD01WujjmKyw0+uUV +y/ewkCdunnMLvKgonU6v5/mcVo/GPkunqttDJdRqXz5oKcY7QA== +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/blade-hosts/eyelander/ssh-key.pub b/secrets/blade-hosts/eyelander/ssh-key.pub new file mode 100644 index 0000000..e38ab0e --- /dev/null +++ b/secrets/blade-hosts/eyelander/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTeMkC8h0ldLsj6gbEOPuiuHYMJCxlheA3VlhUTY5bi eyelander host key diff --git a/secrets/blade-hosts/eyelander/ssh-key.sealed b/secrets/blade-hosts/eyelander/ssh-key.sealed new file mode 100644 index 0000000..600d855 --- /dev/null +++ b/secrets/blade-hosts/eyelander/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABANmRgWQv +wMiq0PoS4v6XQPhJkDVy4mj6Pgg8ICXALNOIKejlxBCXKFsqEyagaj/8KQs2IPvP +MT1MUJ3MEvletEvc/mb5GUGdiwVeVf6134y02RRK6MaJYioNjdSPSQIxCDJdyA3a +PZqoZrE/D62pMWmOHVW4chWes6SMAVSdVM15Vu/Wu3n0eZ2j2+qSjxc1+jAXEQY+ +rY8XhMs3mKDWLO8HY7ratYi4wxa0z47fKuDMhHUh+EDSzJPBDgloRujYBEuBIJFX +3iCqJtdLU7llnN7jwxlQ9IMcN4V5Xvtq7ib7iqE1f54RUQosTmMJTV1Bz4wz+ngd +4NLNvVU6ODrbgV0AAAEAO21p7fyrq3/nCfbwALuI7yTBNPuPlnaWB6bNNQFP9I3w +7yf8O6KRboh0Mtt89Cyezw5L32ASq0goO/wByMkcX6UgS0A+MKxhGRSaSfBrBTcQ +pk0cD1BzIrEQgffSZPQl7wpi9TU8TCcoJlCv1xBgVKzrUu7CZEHupVi+DaoqUhTx +EdM5CDdNMT6yCnpq6acm0ZZ6mb6+ANrxHuQ1G52K3pQYKTn9DxSlEPsmW8QlUz7H +ivicw677WXw4086s6O6xp/sT4NuQbfShUCwPyadI6GNZwewwmpn94J4k0WwKMq+X +p9FM/5kDbFU9+lgF5Mja+rNtsXzTBli1fn81nAMaeA== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAHJznQzzTXw7Yj1sKH0nV+ckQY9sbtdkII+6wJ+Fbngt3CmC6 +UE3qyo2LogEpLFug76R+D5X9q5jdeBkthK7W66ZFNzwADmYgiJXzuErWJ4CC18dn +DOX7st5FlPNRnuYOSq6rS89UvbSbWHq/h2SZzXIfyyvXxPgiR8tKQoZT8J2+Q3WR +xHpgTEMiaUtF6kfIos4/ZRUcpwWyZSXbQR+avqWhbcstrqV5LgQlxRQK3k9kC9LZ +O8Kau8lqfaehn2WWKYVD5PH+AQ35vxD4XI2cxlJpoJyggviPb2WNwZFcsY1kJNfK +7xsUaILEO7tuP6t4rthbO6G40thB7rl51kTzBg== +-----ENC DAT----- +HU+81Lnj6d+HTkJq+r+57ZvH2o98wyUwSOg8bSvLcBDTpOQiocJIgOdh4JstIqn3 +jzhP+g3NUH0/jM4XoP9BRjcJe5ReXQmq9d13k4Oe/mgmrPp0c0E4K2upMVSLhSFx +kapXWvgVzS1J+OlN2TfmoQZtpjRYjembqNRE1/q91hsrULex/r4kBW78sJHCmsdZ +f5vCHFy0bdz6eb4R8zZkpQ81Y7FGfJbpvMundckSFpVG09H1veG6dGpKOYUP/zNL +07eXRizHfOsSzjOMhe9sq2LU+p3LXbhNVuXdByX83ihtOSNx1PK4CuH29upZmw0n +kROlkB7CxdOZHkDfSKFJvCihjOhvSw5jllrAfupx95Ov/kPrYzaUpCIiJa/9AxCP +REMEXGUf62KNftF7Uu1oBbfzDG91QU0a3ziX1V1dcCxg0PTu9taWVssE87ZxDq30 +lUjiMRdSgLsAiUbbe5X+YeTHo//pNs9zDpH0oiOL25imyTyPPg34ROmMygDdatlo +MiLhRq5VLV+Pkp2+93ODLplri8syoPxg+RA/23OqwKg= +-----END TSS----- diff --git a/secrets/blade-hosts/gram/data b/secrets/blade-hosts/gram/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/gram/data differ diff --git a/secrets/blade-hosts/gram/k3s-node-password.age b/secrets/blade-hosts/gram/k3s-node-password.age new file mode 100644 index 0000000..630f31a --- /dev/null +++ b/secrets/blade-hosts/gram/k3s-node-password.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 5X1Isg Fzd7f2DxQyFndntuZPYS3a3yRKQMiazxXrKT3hzW8Wg +w/I4jv1o4Ghguf5RT3Vt/h6dULT9ZNoajs4WW7ynd7c +--- aSFFsNdnMcdTdrGwNe47WnZmjqKhPuqd1WeCCp8u3v4 +1{"~F[]@p+6gy:sW 7cr+`.t9uڙFz+!ZjKOph \ No newline at end of file diff --git a/secrets/blade-hosts/gram/ssh-key.pub b/secrets/blade-hosts/gram/ssh-key.pub new file mode 100644 index 0000000..fafbfd4 --- /dev/null +++ b/secrets/blade-hosts/gram/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIElJZbUbIZ3NPMaFxIjyAli8ovw5qLzi2UpjdsbT3lWs gram host key diff --git a/secrets/blade-hosts/gram/ssh-key.sealed b/secrets/blade-hosts/gram/ssh-key.sealed new file mode 100644 index 0000000..f594e43 --- /dev/null +++ b/secrets/blade-hosts/gram/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAMCkPzJs +RQehOsXLUIIXe7vUwNRy/1bJd6+86lvq61jENxdFSnK15cSHVQ/yDl6fcBKtBcJl +yqbWlXIXZKhx0QN9qPLk+jkKoDLfWWQUSh2L9J94jAFaPANj2MJy2aON+qC5dyTj +ADDXgks5jxyebuh+rqHRlx8zDFQ26ROHLa1GhflgMa0inrYJOdpraKee0j9uzpsw +L3ZEDZ96tvk3tMJCcR6SF0a590ui8lmz5riyT7nN6U8UsHkIP1H96qYy5ywo0Zg7 +SZpqfTF/i2G1G4nIo4x09oq5/RPtrhT2mNCxA9fGebsj0hdEbAi7+k1Xu/6ViL0d +o6OZsm9nwGcvjKEAAAEAGBV8T4TvivQO4bGkZ2jRLJ5DtZHsLgb8P1vz3vtL2HA7 +xazlEEVdL1eYaZw+x27OiI6G9ZPIUR3pye0HZDZjCMKPGYQmgdgn+TiZFOyAUaMp +PWCUp7ui7wEQLA6qBMx1j9vi+9GKFteqx7y8R+xv0FE3ejelOvZcWo/J0O9e5RF8 +xD09nQzyPS4CvjIaCvTOopvYmlmnB2A2rpM75PVkmyZ4FvhzyNNme4RopYQHv8lo +dOfDw+GQglFbbKZ0bod2ZQ+V/pmVLovxs3/Mrka6+zRnB/tgTyiS2gscmSODm1b/ ++faw+B7HeuBN9J7bjAgNyFMeo8iucE4d71PfMahOzA== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAWLfx/biQgMs/1MqszK9pUo6Glk5nGiJjexKGMsCf/lkUyAlk +a5is4OD/5awos7KtI2eOaJCCofQJJ8obfrok/n8X1bQ3ahRtjITe0WTajMPZNRAK +VAMRXpyHPdRLJjc39qLsrJXhuZ+Wth3YdAdRe/w8NAZY1G+DonBZopYV3Icu3p7E +wwPPbdG0c3RfUFf/bcQlP4dKw9tJnj69oaxPfsoHL7ZMyU1M75wl7xN91c4zaY8J +Si/v7ijI6pvx4q1fZfTP+eW3sYKkJu3YvDm+MGOArxtL1p/tf8lQCjXO6SzQKWIS +h8bXWKrzRG4efWNLOmxki90w+zCjGMR/Ek7YWg== +-----ENC DAT----- +aJchiyjcDemBFCa2XWiQZDZlMNV5zwkshRNgIiZHU93l9PJULe4COvElMzm2sQPq +dDnyjEpUMAtSbyB8Cx60DRIGxCZxeddqcApoqOXtRE0nEpe6IM6rhLY5VhqAKkyN +u29m6RTw2zeJjolvPibZ1Bvb8ihKpL8vPcT9uEx21g2XMfgsmlII08dtXMOOUI3m +t0LDBaAxqps6Xky+NA6zmILWeRO2F98Ic/wSwJCA1mPVGldWmEP7rqZp1r+zVko6 +08rLs1XYDmZksOAdqts7G/HjTLKt9TF3Ck88O04aoJcthH6cDuVLNRbqNJaYNM8S +R2KMLZUo68zqTD9ClfrXGnkPSOZ4kGudYa7/iImOI0NHlR0gNL6C0scGe1TUscSd +VQxqybNtIqQBbmIzM3gStSxbQs67+WKGGhnV+bOpq2iPxc/iy/YmASEIHp8Dh+fi +Vk0PJL5Ruaqr/iR5k+ToVi68LrNqSQBVIggxPd9G7xAphhBLa7JLhK8v4KK8M/qF +UZZ8MZ8EigaMzT4xOJmjdw== +-----END TSS----- diff --git a/secrets/blade-hosts/gryffindor/data b/secrets/blade-hosts/gryffindor/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/gryffindor/data differ diff --git a/secrets/blade-hosts/gryffindor/k3s-node-password.age b/secrets/blade-hosts/gryffindor/k3s-node-password.age new file mode 100644 index 0000000..8a97a51 --- /dev/null +++ b/secrets/blade-hosts/gryffindor/k3s-node-password.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 G/v1Ww cZr7pzk+4YpuOQPEi0Ikcqa5BuLXV4pha7aJ7VnqOm8 +gfTTEhIEftjpD/FMv6tZ0FhUGIqk4pj2MBQJUj5vkgY +--- yFKB7L3e+4zjFEvxTDJxb+6XhyK0IH48q5r9skVFJYg +I6ᎅ?gpv +qu +![Tg+ԭ ;h`?ͅ$afȒȆ~ʣ \ No newline at end of file diff --git a/secrets/blade-hosts/gryffindor/ssh-key.pub b/secrets/blade-hosts/gryffindor/ssh-key.pub new file mode 100644 index 0000000..d73030d --- /dev/null +++ b/secrets/blade-hosts/gryffindor/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQtyGqx03N/FOl5eZ/WOQUbigTMUpAdzH6syM4CgRBF gryffindor host key diff --git a/secrets/blade-hosts/gryffindor/ssh-key.sealed b/secrets/blade-hosts/gryffindor/ssh-key.sealed new file mode 100644 index 0000000..1d6f054 --- /dev/null +++ b/secrets/blade-hosts/gryffindor/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAJyLEyt8 +ftYwDm1NUjj0BGNr5CzlqGBp7jHUfnhemM9xhc1Ivr7QOU9stAl5Dkr4LKQiZo/i +q6lDk/Y5ySBEQrit+g+diul69ra+6cb5Qn4VtaK+IQpaURXcMu2+xXL8W8B0iQ+u +VO4gk6lnYaA9IBeH8iZA7fA1QX7PpnfmceZUlxPFcmQYTQdEBzYEBmDnT2h1QscC +u+MnOdLlvyatOFfwcltqH1pmcC5LMckja8tUWn74Fck0vKjThLCNC6NI8VRiG9wY +U57PcJu5P/FuxX4kUIlOFEtRCmOtQC/S3UnkrL4nxijqglNx2+misYJuVLa98x1l +Soq8FFpo5EOgRTcAAAEAPJsVFQ4cHTU6h80Uf0qx8B/zLPqAzZrFHC+N8InRGb6w +vwZsjK1Z8nyOy9r7kiqTUB89PyANLuuuPsGy6gcXXJuIAlBZjLXmZtBE3truNA7+ +lBnMOeyjWIM7wlm7LtVcEA/6l92rs7eC/uQaY7mKDkZuj3hhU7m5SOAY/jZysng8 +KDe7zhoRtz3z25qiSDls79+OGGIm/n+IeTVB5MkZ233HRh565GMKHZUdq72pyV2B +VmssLfoO6JR0NmwNg+zdigfkzwK8E+kfkXM2UBomjg/5BSfX2nKB74i7TvkuU+7K +fGgSKombul5H8AQFi2SgDnIagWePF+4lJWkcEJl0Ag== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAg8ftVW8BgoRZm7VQHuenRnTklRDsUwXnYx9eH26Uiu6GZipN +VTeebSpvv5t0G6dD0ASUb/WQbEQsI+CpxgOmuLVbNw5X9VG7P7K+MQztVDQXy2A1 +p7T6Z68xrw5nOWQQWaW9e+Vmq634zHARm6bVXcdz9l+evY/OKKzdcG+q1crMc3+q +lydjji23jRhFKrt083MuDGENKgce0pd5h1cNG1Qg7kR7DOIFH/xYhgNszZPMDLCS +X+MOkgS3tLWVXEvLl/EjIEZNQ196AamfwlaJvZptt0eOuTiVnXHRSOQUencEWbH0 +sFAyWChpNwv+5JxlZJ0HfPSbO4lAKyBBPqK8HQ== +-----ENC DAT----- +JFH6TmGxBOuS4AGlawyzY0iNmWS9PY3GVt28FfYCbQyvFRBRrkVaXznoxlQeJIQo +BWtcFsfiH350Tgni8Lhu/xfU8qAdUJ2VLW+tIV01+3B7TXnY3JREalA6K8wFWYeI +jThnftY6bj0XZWZ9O0dwFuPBQ80Mt5mINMHIhCRSocRZihTfRimVyMj3i95xHxOu +CtcvbpUzrlzom0tErqs7xxf5lq2sagSMIFSlVEAWKLjsVHOkUYrgtoEyuNS0JZQV +s3EIThgvqDzWK0Ij54mihyOI2qBaTHZqzI2/GVIENqRTxovM3JPs4WPAkzpb8oJY +ks/Q+nZS+DTS8mJhW/CDDN/8NnmwbQDfOXYlxVY1fK3v0V7P6NCF1BlT0iEA3wpp +zhk9z1oGtyskvfllkHFFKrO/yz24Z5VOxBgmzvZm0S+k43TOhHaEE2DzGpm1GVb/ +sm1cNdlvMMZ3XN1dbLZhfVSarBkU1UDGzyQrjweXpI9ZQGh6CieYZauEXh9hd+Vl +cPzeo7SP56+Q8SERepYQqewSY5WmhSLJciMFTkeRlUs= +-----END TSS----- diff --git a/secrets/blade-hosts/kusanagi/data b/secrets/blade-hosts/kusanagi/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/kusanagi/data differ diff --git a/secrets/blade-hosts/kusanagi/k3s-node-password.age b/secrets/blade-hosts/kusanagi/k3s-node-password.age new file mode 100644 index 0000000..bf89eb2 --- /dev/null +++ b/secrets/blade-hosts/kusanagi/k3s-node-password.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 qDlIUQ +BdlrHeE5B92WRBHCXQ8EVhrYvISH8J6fX8bw8MFpEI +JSc3HKEYX88uwy7XbOtFw8EHDmKLWZvQjHq4HK/Iv9M +--- HKy1cIKX6ypj736srOMi4MfL8OgjZGZa1PTIxf1KmKQ +GrV/~_8q%X}Frw?Yy3 +bbI8kWnEZ"~86.skY(:_ \ No newline at end of file diff --git a/secrets/blade-hosts/kusanagi/ssh-key.pub b/secrets/blade-hosts/kusanagi/ssh-key.pub new file mode 100644 index 0000000..58c9fc6 --- /dev/null +++ b/secrets/blade-hosts/kusanagi/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxvL/dhDeuKKanBmpmyFWjFkRQAUrv6MLiNPGrH7njM kusanagi host key diff --git a/secrets/blade-hosts/kusanagi/ssh-key.sealed b/secrets/blade-hosts/kusanagi/ssh-key.sealed new file mode 100644 index 0000000..82101b3 --- /dev/null +++ b/secrets/blade-hosts/kusanagi/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABANLtkz7l +HwZvuo44CD7w/AD8HES90+BtLWDMACduFxtr9HYWLh9EZIc+pdrU2NaRAk9XvEWi +T2G74mio8ANHmn1/bwP85mGxBS6p1SuuIhpJztdW1r+Rj0c+9eejltkydX1m8G/r +mRSyRB85IYsVmS77fdIiEQWXgfpCJ7Z9bPQP2X6pDFwY7IFAEFpWxZxnowlIdX84 +AfYrOwU9a+OAtdB7XrmfzuMS+JBvGWJpZicuUyBx6iQpoSvQbIu6YNOK6FIFX21z +wfDcUjm0X9MtF1yHLkzIkKWRjKyTI72hK8nnk0FyXNHwPFwLFJSDACFsWd08MtGq +CcHN1YhssIzrpecAAAEALA+NdV8f1ncjMzPzRDbQ60Sg7gMZZm2psRXzdroXw6u0 +3E+Mt0uJxDw/WZMPf5tKd4lqyW3XJK6lmoroU4xH7eoNyMmzMV8DTZYZh5qFPXj5 +55qaoMOoVTZ28RK/omlLEE94CC484E+zehz+0QCih0zZ0ib7pMGLvGwHyYBd9EVW +CWCXVWB7YT9JICw+Wtus5r8+ARFWy9wleA8Dz97AfAi9C0xRvlYJ6uo2w8QRp8QR +WxspULGOx1QhWUnSszf2dNJJh8GvwRWtXv/dGWGLuXymvze2BweCx7U55LIExbZV +O9PTNe4nE7LGzi5XMrzcaiZrZROjNlFlJp1D5rT8gQ== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAnJ7wyjfrbyziQIXDmUa1Tf5EsnwGsCdbsugeq5iqJjl5tbmC +KrMpNYChQ7rbZyEx0ajalJG1AewsUUQDtc5q9BU18qIpia3r5VIc4JhDXEhE658j +AWutGhSnj8V0fj7mx182uzrdJaiSQElAICNszWyx7G7XovxuOzHhZsj0d49EPwsM +2sREGyaRpk4rTM3rUx85soSIi4N1vPAupRGkG76qIoKXV8Y62gScT2Fh6O1kvgbW +slrWT11RRi9pwGN+b6Ir1xnvOFTGMUAEUpEUSxTd6RKzbvEqS5HotiLQG4QhQ1Z2 +XGgWFWMINTYEJJe9evVLRM/15ZncYgmXObSpCQ== +-----ENC DAT----- +ZJm61kRemPs+zYMU8pQnNDcbjQMcdgIIunsrsJ2AKgCZryYyZ9ojaSdYtEvziVmi +DY4cKht+2HSCYVAcCwhJwVI15mevgtguPX7TW69ic98BXEIEO7rNdAdif5zjI3w4 +FA4/jJktgqmYMr3LXcNi0rRUKvtoOouTLf4Gg2vW3h5/ZeK5YuSG+3Qu1NSIodI4 +Bb+aDDngI3y2qUGVWvIkf8SsJRR8kudjA0I59GV+eIstE6b1MqlMXZj7FK1+XemC +JCoBmebC9kFr0k2kCfFBp0uyqLeeZ3wUE4r2eoNg15crC1j1s61CFwxnJeSanIug +XCMtQq39MIlQrDD95/zai0GglbORf/bQkgEDP4T2xRKKE54yWlbVxGHg1K+WGOLf +8NXzT4vgjec2NG0nl1HsWoDPDhmRUOoc0ig/yeyBICh19U3I9QgnVBcuvu4gDwEv +k/epLTU7ZFREZUdpNz5yS0woy/oYSOPacGosbTU7ynMd7566zLmTIsjQM7iBgfom +CJCpNc+5gU1hsFszxaUOrkaI+7h6s2Yr3VzP0vhG8dk= +-----END TSS----- diff --git a/secrets/blade-hosts/narsil/data b/secrets/blade-hosts/narsil/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/narsil/data differ diff --git a/secrets/blade-hosts/narsil/k3s-node-password.age b/secrets/blade-hosts/narsil/k3s-node-password.age new file mode 100644 index 0000000..4520748 Binary files /dev/null and b/secrets/blade-hosts/narsil/k3s-node-password.age differ diff --git a/secrets/blade-hosts/narsil/ssh-key.pub b/secrets/blade-hosts/narsil/ssh-key.pub new file mode 100644 index 0000000..f2efc70 --- /dev/null +++ b/secrets/blade-hosts/narsil/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVI2ZfEf91h4Yf1fq6zP8TGQWMawhVS5KNpCAMw3KJp narsil host key diff --git a/secrets/blade-hosts/narsil/ssh-key.sealed b/secrets/blade-hosts/narsil/ssh-key.sealed new file mode 100644 index 0000000..e3060f5 --- /dev/null +++ b/secrets/blade-hosts/narsil/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAP0v5ml8 +ymtuqJlJ8jCpCNROVGDsLNCjsN8bW2F054OoFgoqQEqE1kIFzgGj7PmkaE93fZ3r +xmONKkzrMv/nBBUWfGNkWpy7htU6qHlrFyBVum7A/nXZi6cZtil3cfsMhpx0FYwS +2zpY+8CNGsB6ePbpu9PJKWHLrGELnlCZkuuNWtwCBSBrx1Sgs6lh96ONpUEpubA/ +w2+7sLS3/JPCya4ErM32NCo4l20Q2uWQxFHThlLXuW9LKn/TKbQoiIQbm5Qmayay +tGvS4CrYBbNbl7dIM4upMApeJdDmlF1sevBLnMdYrLAQFOGwAXnddGlrCBtdz5FP +A+8Yl6PYKBZRr2UAAAEAiNINjOsRGEJS1dRqRFoXYN5qHWEPrhwis9SeqiDljLh0 +7Pw1x+/xbPlmttw5uGZJR7/ly/OOoXuGdWxmOPBJglnZrAjlPnPO6VblX5YsMGTF +52PAWLtLNPcb+1cSXXgNvA3OpcVI0VKaBqUTayHMvHCWBvuPoESETP02XSqN8R3B +ap6sYBe10VAT2dYBO3BiDIuIJHslgE7+Q6g7s3hWXa9VHk/d2C9CcQdL7Q8GvFEH +J06p40glFx8Dct+MdW4hP46EZwBzhnA/rm5wbCJziXDte+wJiuH34O6kmS5+lChY +oA0beLDe/IGhMyggeZKThfVT0x3PTgBeIAKYt2Wrfw== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEA+v2VguFaIanIZ5rgu2WEW3BW+MkC4hkxQTXHiX0PDZOUamil +QwtWuQYuGDMjPdq0CdykxFb3ffwU1pQ7YS7VI+lBANTgin/fhmLFqBkOeb5H0U5D +VNgiBZGxrjkplAbIJRib+oWDHeVgRwm0nDGDavJZ9IXBJm1rEm/wcTWGxcUOw5AF +dVjVuqWYelGAQdP982VfmCKKVDep7uHNDK8LttySp6IGL9lZnUkvL5rsVziqdTb9 +5BKG8Nxg1U7jIaNZGskuqrk3+/5TjutThnmnViNSOD08Gq+MnyZe8Y8LiNrX5qtb +vnMfotwVLF7dagNfOUHIM6Hi5ssdByFpKlAj+w== +-----ENC DAT----- +M261e6zOZZ/+LPBTrZSyVw6hKgTvBF/JUovFtAXdLX1N/2Y3+Vx0oO0f+RLKPVt7 +pTtUz415U9w7RjC0I7HS9dMjyYOuG+C1AbCI1BFsU/6uvS+H7PHbwYrcDnTQhQ6h +YX+rOT4qHFfJ30l3VLlIVANt8d0hRoRR+Dne2uL+Cps0x+sfCz/xibhpSVICHBL/ +4Wnli3oZ2s4t83yYleq14y388Z/KjBb2et5TYwIlNfSH0L15vS912Q1AxTFUMyF8 +ykFWsUPHBgoK5cYDq2ydGtuLglx47C7iSB+EfEbxI/BUOJVG89di4r9RoFKn6NCw +X/7kAPFBJ9WFEWDIQSKmvuYxIJWpGeds/b4JeJ9Rfbn3yFoo1C5b42IBZ/cMQtxO +gNcp9KW5kXZ4Gtb7wfpe8nfgzLZcr4/C2uE5RSXzEofI354fkTq2zf9YW4eippQ1 +bhja3k8CiA/V+gRGzW+BPu73UYuJBzrk7gBpaQI0QCT27ghaxEt0AgyTepWbPlUp +vPRYoqtGvzeLflnWtnctR3oS7C4W02MZxkISkvyD8bo= +-----END TSS----- diff --git a/secrets/blade-hosts/oathbringer/data b/secrets/blade-hosts/oathbringer/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/oathbringer/data differ diff --git a/secrets/blade-hosts/oathbringer/k3s-node-password.age b/secrets/blade-hosts/oathbringer/k3s-node-password.age new file mode 100644 index 0000000..15fd18f --- /dev/null +++ b/secrets/blade-hosts/oathbringer/k3s-node-password.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 GrBmJA vTr4C5qSUdknTmUc/fsmujf/FrFTazQ29ZJF15ZxCx0 +bXeFw4Ldpkj2G81f+SxR4d0nFCaMUo9B4+es3h4nGrs +--- LHgMYsvuKR/GjSamhcAHcW8CP8cSjhZAcAscMaKn8cU +}}+rrQl6=^"(/Bp2HdCmY"17{@7#R G Vmm9 \ No newline at end of file diff --git a/secrets/blade-hosts/oathbringer/ssh-key.pub b/secrets/blade-hosts/oathbringer/ssh-key.pub new file mode 100644 index 0000000..b964925 --- /dev/null +++ b/secrets/blade-hosts/oathbringer/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIACjyeJhbFU3ma10jmx2GsvLavzv7FUA4fjhslPR+kwk oathbringer host key diff --git a/secrets/blade-hosts/oathbringer/ssh-key.sealed b/secrets/blade-hosts/oathbringer/ssh-key.sealed new file mode 100644 index 0000000..7a95bd0 --- /dev/null +++ b/secrets/blade-hosts/oathbringer/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABALhCvTqH +fraJZoE9ICf6AechPaes7bVL6xhIptevE4OL6x7GekdzZArDxNFBeOVombs9SMQN +gDJsiTtRUzdxAeDiiVb2tXyZG4AJrZpPvPxHJmxCpGmXqghvXzrtlzi02mv1G57A +dMnd1RyemW1G9rbzvxo9TmQKkmZ55/pHmy7f/fDN/hCfH+M7ko8GDAWczKSKYJDt +40NcfPDsrqqnUYDgyZEXvExpLSpEHuZp5bnbQhurShPJoKl20rg3j84pE6uMVX+f +HoS/qqBZ4MzFGrLeRXDZPoiUqwFMaeReh7LUWHmHB9F9mPZ6DVYiRD7MQiCS0omv +U0vFvYG2rE/PSi0AAAEAJsY6aLzkOo4VcNofR5498opj9+Qkh5JUtGsq5qQjvBbD +/8HhBxxkWaNxReOsgc7zqbRJSSGug7Xms/f+znTqBmxx1HtKbpXX3wKtxP0+LD9j +mrZeNx4JeZJDL0oJgtvRj+5xApjOwvMS1vK0oaRLnsGCmrqnY19sR8wipmLdahxw +o/5UIWBHQPy38gw2+cT63o7QYudVXvzuhD0I7ODZ9G+XH+qkVcu/5Cwga7o6WeHD +JgZXu1EuHESsAr3pkAwKAI6D6g7SfZ4BiyRO0l4CN6J/Pp6Vdb2a/y6tOmvbHkvf +j0i1N+wAGF5KMM4dVkO9e6xm+RMJ2MQT7F89TdzmkQ== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAF/aBQmuzUdcw8L4sQ3mZmyHYDLHeU8iXl0dc7bF8gJYSYYwc +OY2HYfFsAWBfMqeeEHO8JUfGYSb0JNnYt5aHPWiryK5TyQo/wcnQ2dAtI5EgBlGq +MB6yFr3fij8JCWL6+Q1pDtHQB8Yhz2mAzYcNxnc6LRYyV8Jn5eXr4OhyJeTwTEAP +Trace09UUQWgb43otWxPkPYiVZmT1tOIHHCyLXYJhW7QqNrvvFSu0s3K5sHiuVg5 +g0HiW87OwbQOFh/ifyWudt75dojbl9EDBfOrPp6O1XwtxxBGi3AzubWgRuNRXvSA +Gj0f33f8JOKfexLGmkju/tK/uPc+ibR7Pb/+mA== +-----ENC DAT----- +Qh2cno3DzcDneSdjtMLuRHzqkQ/SLoIY4vtxxXq4xccFp4s50cx7yAba39jMC6RL +Sjr5I77e2im9lo2+DNKJSbrZql37oyimJNvu8hF9ZotWT9LkPBZF/Dd5Vjx8oj6V +E6paSHKooT4wXy5dVhFkJozQpCq+8wDmWiMU4UTgl5HAPtQn164KGtOL59/yMDz1 +Jy53ffke8fSu2Au2tk0uYDdM9t77SW2Wp7Ri+dqspf2nGBpQG+vw4uWbyjeWROE4 +rPdN3e+cRFoRD0ng84HSXD6xrf12yuqjZ4JRF725BkCrrJUkM8Z7PPTHO5dR7UZV +//jZ7sR+Lgx9ckm7XOPOeLU/VYRglYKrD7XP/P0f3fYGjxA87ziHk9CXFrAs8z7J +UdH31Eas6PEDO2ufLyTi7IiKQpxOTWp/SDM5XC6Me6Odq4cuvpEJonJtny1SWwMM +XcYre6vNrOY6u1ZxKsEVaG6AY6De/YovWKEMMscq+X/9ufrbB8Bw7uuPcy8yNgC/ +GshoOierdgeU5Y01SIlzqjrfYzTyyzhftAwlIFe4Kso= +-----END TSS----- diff --git a/secrets/blade-hosts/riptide/data b/secrets/blade-hosts/riptide/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/riptide/data differ diff --git a/secrets/blade-hosts/riptide/k3s-node-password.age b/secrets/blade-hosts/riptide/k3s-node-password.age new file mode 100644 index 0000000..1597102 --- /dev/null +++ b/secrets/blade-hosts/riptide/k3s-node-password.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 GNWiFA BdjX1kwK2Y3yy/EjJQND3WflhjxPsqJqMi33Pk4nHGM +RFCIB/m299j+IBn5A4Y9Bt83eOUJ5XeJ448mzbdTyJQ +--- op7kX8zvnY6qSDnOtCaIOWvpKgAONXiplgo0M2fVxUU + cR(1Gg mt'A~[QLR;Q|Z>hyu N-5x7 S>R \ No newline at end of file diff --git a/secrets/blade-hosts/riptide/ssh-key.pub b/secrets/blade-hosts/riptide/ssh-key.pub new file mode 100644 index 0000000..8a540c5 --- /dev/null +++ b/secrets/blade-hosts/riptide/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRZkEj+3cM3exRKVMGgUctEwzBhKYy0YfhpUlJdLt/k riptide host key diff --git a/secrets/blade-hosts/riptide/ssh-key.sealed b/secrets/blade-hosts/riptide/ssh-key.sealed new file mode 100644 index 0000000..9f68231 --- /dev/null +++ b/secrets/blade-hosts/riptide/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAKx21mWd ++TCxCeO1bYBl0oKOXHlY6j/hHGVfxQC+UiDWEymiBNqIidiVd2x8+zV6ayJz0eua +ymKQE1LpZyWgYCJWQTzcmKBcaqdcB9s+1CXOhdg/wj6X6hb8jsme6XFOGPpOIrSf +jdmuYlLieLuPSHLdHuSqUoC8ui/EJxdZNzZWdxQtfflITmA60puNd2sJQFDDZjOP +wEbtkUfqm9Cb4VX44ub0A3zAsPA4D3JkyCNMMVDbxDusrFANAI8z9mmFqz3DWpaw +lOtHXFQEk2WBF5h38qtVdedNfuU10TJTYSKoPZMrHKnR0M1kQ8gDfyVOqIqec8cm +k2/q5V9808Y9KZEAAAEAYNl7csYg/qWq0bvQxn232SZMbJ8NjyfIMDNhSium+/Us +EpsqvH9hz+vGxRE4hIJr6vpdd6Pko7LWVW365Oa/h85zDc1g/O/p/K1hVDcVK8JM +2JgdDLvq8UxFa2iIQM2omt8qVAtlACb9DsK9OtYFjeEHgR9h6W2Lmqk7rsyIxelw +9pYUUONg7RLdDYzUWAyyh8TJf20LsVLOJNP1HMFM+srMqJ3VFYqiMTRctZjhon8z +yRF9K7efJpTfPfC13CmuriIap/5hDFcZOyYnL5ry+NbKs5cI5dnV0Kt0//A5igsT ++/Q6FaglkdLiNGcc5EdLYfWiJxx12AWE+GEPnpxsoQ== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAM1VjbwLBpx890q2hYG0S7Q2FDyGW74E79JnrxU6FugjSlKvM +We9OvflO4XwTO84bC8tKA2wS7T1UzDqObsLhjc5+sFlnQNTp5JkiRpnlBQH5Zh32 +WjcM2IlqgFX0kPSXtaX1wwYt+dbokGFtKMpnKUy/+m63AMOtV3gJBZf1cJyi9Bgn +HMXyB67URyX8ytWCABFWjbBvN/Eh+QsI3bTwVj255SZb/0M2HjXwVekxu+n5C0C5 +KJiX0kmkPJh/fI84XayR/ySi2Z2peBtcFQYLiwbxzIDuU2oRUzUolc9gRrOuxuwI +loANnFlFx0lTI6uFDpAr9FoKyCEhNDIklIjDtQ== +-----ENC DAT----- +6cxksnDqcm7jP6ikNdpOCNdxGF4XS3wSYdJnAUmEBu92t+kAYAvn3BGz4Bmip7VE +hT1NtKvpgCgXkqwmtzb6F9IJFLFyGUYVegJaXX/JbzrYZfbaQlJwsv27b7rHT8Xq +dm8HWR6jD0muGzHWvDl/4nRxjqK5NIM5BGdLf+N4uL3AkzoMDGTL6dUQtaxr5aFl +gW3+vNihJDkRFjxPDSdMXH4BMvV4EcJLZh3r/dl+TOhf4JLxDfyX9iTJ1gPcPhpt +hptsuJkhm4aygY2jtUzKC3Oebg9AQpdQRmTo4DfLk1/SwhTRPEG2AtQ0PptvAhqm +diVqCCsM4vqASEH48511CoDQ4Ah2LpZwdeW8jBU7XxdORZdorclJUyhjKgR6yKmH +jbesso206FfFl3NnET9u3utMQgg2L0Pd/isUr0/W6TR/foW5FFAtl+mcfYRNZcZ/ +WfJ7H7MkIXz3xgf1O/fZjdtIqH6HoKbC/NcehCqqUD8Ish+RP+F8BIC8236NQYmf +JFjFaD5H4bgh8xQYm/9gxyUqGtR8sU3MsjISrURmvaA= +-----END TSS----- diff --git a/secrets/blade-hosts/sting/data b/secrets/blade-hosts/sting/data new file mode 100644 index 0000000..8fa48a5 Binary files /dev/null and b/secrets/blade-hosts/sting/data differ diff --git a/secrets/blade-hosts/sting/k3s-node-password.age b/secrets/blade-hosts/sting/k3s-node-password.age new file mode 100644 index 0000000..d784566 Binary files /dev/null and b/secrets/blade-hosts/sting/k3s-node-password.age differ diff --git a/secrets/blade-hosts/sting/ssh-key.pub b/secrets/blade-hosts/sting/ssh-key.pub new file mode 100644 index 0000000..67694e6 --- /dev/null +++ b/secrets/blade-hosts/sting/ssh-key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDkqbbxl99jQCHj4P3/C+7MLVHxBMswZ0V7fmHpAv25C sting host key diff --git a/secrets/blade-hosts/sting/ssh-key.sealed b/secrets/blade-hosts/sting/ssh-key.sealed new file mode 100644 index 0000000..622c986 --- /dev/null +++ b/secrets/blade-hosts/sting/ssh-key.sealed @@ -0,0 +1,33 @@ +-----BEGIN TSS----- +-----TSS KEY----- +AQEAAAARAAAABAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAAAAABAMvoBs0I +LWTKOOa7G2r9cmTz7Yi5apgzlD1z94eleoPqOio1R0KtLFC5XNGO6Og7abhcmXEV +euCKbpdcaBx4P18r+MmAF+3ScyGNzqQKXoJksB4WO4bG3T99h/J/qI5G+JCzpN9b +RRvaQrs2wlXTjXPA4FmlYz2c0Ja+JIzUlW9b0uRonvocJ/0+H+ZzC3c63f9UwnAq +8+I7QtTZdLwkIbFEcvoMm6l2+r5MffKXvaA+aLpY0T7zah3V9VLJK3XuTuPfEM1P +2AvFW6cPPmKCIfELuxzbg7f+xYie74sNHs6HqpuU+b51zOYfGc5OTg25HjygquqT +zt2QK2w0whTflncAAAEAv5qt7q7rQkEohvi89Y8ka4pEheWirzVFPY+RGeJJU9n2 +OLwzb+diTJvKvPkVzjKbRYauFYILtQEWhkD3g6kcb7WE7jdeXOOZgN9SnVCTWPvP +HIt2noYpSlFgM+EmsjkhWG7OWT6E9fi1DjsXr5EBIkYWRUBo2sRdabrR4c2Z8t+j +KhATPRlOnyff+KFBibTXrvb4TAsIkD0+/olVOkfU1WFMdabz8tL+ewXlDDpd19U3 +LtXg4Ssvl9U/fftP9qwQKr7o5XTDYr46cPyKEVl7noGFvE/hE+4uzZkRIBhPwDIX +Vzpaxh5K9r2u+SkwxW8Mo6f6TO3tXDzF0ApkjAG51A== +-----ENC KEY----- +Symmetric Key: AES-256-CBC +AQEAAAAAAAAAAAEAPibhB4dGVMKzTUwXnC8vUbqPA/MhzufKfjtrPng218l3zXaW +mU1RSfTojHufm+HBYbIZckv0FUzzBwv/WfZLCt5q4RX9g2kfhkp53/rqmMvukgE0 +8uSOqKZDcogbT+pQXQf3DBYPSAp6kO0BIEVXTbhSehcrEEudon8Iy9zsH1H9hQLn +AsjkFaLcrCV6HWpklBidq4RWvwmFS4icg3Y6J37TEuCuDnlGU8KZepU3C0DgPaCt +6SZGZ2/LOYvvD01Ft906gUPJQtrh2jMMB3wIdODnG2sVlDW8JVE/dJzr97M7ZWeA +oQqctSDCIUF4H6UozO6s+CM9a1NVQ1c+GJs+Cg== +-----ENC DAT----- +gPKiryge4PZzdhqzb1FqfF21pRwxrkrexEhV1mtxhgDa4SeyjFWWJ8qYoQ7yraVq +GqGUkDOE1x2BYcQKuR234rrqxxqEuLKmSUW+qLUv87eNoDiaC4LBv+rRNuQPccbr +tz5QaD50BbhEX4wWOAqlLUs6QMPLzKHRpwEbMTUs9a3A0AzW9DmF5XfGoc8UPdgF +JfDNkPVBqQIFHZfKGJxWW/qEaUTBKgIy8Mdh7pgkZ6+grM8wpPjmwkXOSh4Lz+hS +exxp1JzQWPWGheWqDe+2GIBJ/SYm2ny/reobOrSAW0fYYurxwLHmUAM62iE70rtY +KfYXbyNzIRQz/pav3pNEFjoRLn0vAmpUrdJ2TK0oX9D6EJ83wgP96RnfIl/pCZy1 +rGPZP8kv/iKNTL4nTggQvVIuRHfdNYS5r7d2byISwJ5fcNn7KxyhXhQXvtjSJsjc +1Q+aNU2EsS8dRemulcUl8X0kjNIHfWR9OeYKnnLyhRzwQ2KjLo81U6+O8RD8SRlu +1vlcSG9LK5+4+ZhfCtqcaeqkLWFXGF9dGxhoGo29J7g= +-----END TSS----- diff --git a/secrets/humans/blade-tpm12-owner-passwds.age b/secrets/humans/blade-tpm12-owner-passwds.age new file mode 100644 index 0000000..c88b10f Binary files /dev/null and b/secrets/humans/blade-tpm12-owner-passwds.age differ diff --git a/secrets/k3s-join-token.age b/secrets/k3s-join-token.age new file mode 100644 index 0000000..218a6e6 --- /dev/null +++ b/secrets/k3s-join-token.age @@ -0,0 +1,29 @@ +age-encryption.org/v1 +-> ssh-ed25519 TtYzEQ euUvnyuVR9I+1JgsoOMTS931hUK8gsSjfAKLP4JmJ1k +kuyWsIR84+20q6hSWDw32On8E+zI9XaJu75RG86i05s +-> ssh-ed25519 Oz8m6A S6fFdgkoMXObo6YVci5RDRi3697IjWzGik3mNl2kDjE +vP4UL8CXf83uXC/DixLhyi4lSxO8YN3Cz3C62AIgdzY +-> ssh-ed25519 DRKMhw /pFOV7gp7qBp3Ry+uOzxAVk7+Yc6o/My4804dl+kSTI +n5N2RgOOynuy1nVNX4vOSfAfBvErbLeO7YtdO586cIw +-> ssh-ed25519 PR7Uqw FZEZOuLYmi2vcMAxocET2mQXgDlRPbENr2N+ch87cgE +3IpQ0D9GsNAIpP/Cw2R+NnwwwUeIY+/F/uKyvqd6r1s +-> ssh-ed25519 BeUNUQ bH1UeSONmnomJ5jyKaUUFonSrrIWYP3cVXiq/knBxCM +b279ki9EOPgj1/Fcx0HnxNKK8F0Uv7YYojyi2yLqKcg +-> ssh-ed25519 5X1Isg 8GwxuMA1jfGvfMHen28qY1INQQ59mcNP9GPJuaJD9Sg +aby1GS9LNBAba+1TodqX7Zb1C+rzo4mICvohvpwpjbE +-> ssh-ed25519 G/v1Ww oxM3liZfeW/9/7Y285Zm1w9KGJ7/3lX83eKiasiL3zA +PbSzs0NEeOPQPAyAvF9kM5q3tzvFGQVH1VxRk+okaPI +-> ssh-ed25519 qDlIUQ khMXx7WzfkerwexTQ6/opRva/T+CjcjbdwNFD1UTuEo +8QRvxhSTypbu4jUjwwPgKhL3/0NGIpOyaG2BKGj4PPo +-> ssh-ed25519 8HOJzA rTqrPwhg4tuJF03uFb6TuO7pxqf6IviPOBF97Es0+FE +kSjHY4DiWscML3Gco9UdUC8UcgpSTEJYodtxigkWhik +-> ssh-ed25519 GrBmJA GFBl5Q/GfaC3IRoe7/dhs73kVX3PJ/V6M76QgdtyQ28 +JstjrbfLNHj4uTXaFXajE0y8ZUq+nhN8u/97YAfDuSY +-> ssh-ed25519 GNWiFA GuHSm2/fOyucD4wfyGE+hNvJc95mxIIkdkoTrn41RWM +h0hHlbpmeSMfwNjADrsiRBtRAfcpvD6QHMhYUN56vHw +-> ssh-ed25519 zH/zTA MD7X98ygz6upnQbSRqj8x/VKhvKFn5GQL96iqEcFfF8 +l5zGDsoXlWuCLJkTXf8rg/5iv8+MT9Ar2J9hifz6PH4 +-> ssh-ed25519 aQG9zQ 8YLFTi+j2YLs2oPcyN/4akK/gVE2BS/ccqMIn3I+wB0 +vFp1Mkz+XNX0HO0F+yd6mLtOr12IiXA3IWV3I6SBbPI +--- FL5cPI/sJL58SULxXuVq7zQSE26HY2QE5KLXTx2/upY +]v:F"^]^XʃbaTq8鿻^X%N7̂]#V+2~cnfVj9)0'z19ԎZ \ No newline at end of file diff --git a/secrets/keytabs/vesuvius.keytab.age b/secrets/keytabs/vesuvius.keytab.age new file mode 100644 index 0000000..b20d783 --- /dev/null +++ b/secrets/keytabs/vesuvius.keytab.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 aQG9zQ AwGnHtis2RoMcZHMea4Jbhzm5yYq9uos+1h0WtIVDCM +IAFYorEgHmeGXXfakwa3Fk9UDC5XPJGSkx5PbPRumoo +--- x+eNJlai124x5jAWKQkq2hhDegsZ+GxPlsnoWrd4zv0 +D,|]=V,Aֳ#luy}(bi OFۓwrH_> (zr/)dJ1g3RӂFqx.܃3g*J(oUA dRa߂3@"L-S8_9*V~9yqr_AJЎDR8 4ߩu Ā??Eq \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 177078e..5d86a77 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,7 +1,50 @@ let + damocles = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL32lMYzyDe03AEkTZmivP9TicaPQ4HNmky489Ids44j damocles host key"; + durendal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZXE6fhzzswWKOL6bMWd0+5EGuYhK/gwwgosCmGdh1U durendal host key"; + backbiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0gfTT0htiRipP8kD4/IM88mEPoqUHYrMstE/CohYnE backbiter host key"; + excalibur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8U2YHuRDBTGAx8d/bF/PB1bzDi+0EEBnL/3Gs34dnt excalibur host key"; + eyelander = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTeMkC8h0ldLsj6gbEOPuiuHYMJCxlheA3VlhUTY5bi eyelander host key"; + gram = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIElJZbUbIZ3NPMaFxIjyAli8ovw5qLzi2UpjdsbT3lWs gram host key"; + gryffindor = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQtyGqx03N/FOl5eZ/WOQUbigTMUpAdzH6syM4CgRBF gryffindor host key"; + kusanagi = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxvL/dhDeuKKanBmpmyFWjFkRQAUrv6MLiNPGrH7njM kusanagi host key"; + narsil = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVI2ZfEf91h4Yf1fq6zP8TGQWMawhVS5KNpCAMw3KJp narsil host key"; + oathbringer = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIACjyeJhbFU3ma10jmx2GsvLavzv7FUA4fjhslPR+kwk oathbringer host key"; + riptide = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRZkEj+3cM3exRKVMGgUctEwzBhKYy0YfhpUlJdLt/k riptide host key"; + sting = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDkqbbxl99jQCHj4P3/C+7MLVHxBMswZ0V7fmHpAv25C sting host key"; vesuvius = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHI7ziwxkEbJzvpaZulPFpDW7l0vbGJ+ifHcHJ2fHex"; zerocool = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+60yHIqES3Dr1Upp23QGwzvqELQEeH6e4lTKTV9iUY root@zerocool"; in { - "krb5.keytab.age".publicKeys = [ vesuvius ]; + "humans/blade-tpm12-owner-passwds.age".publicKeys = builtins.filter + (key: builtins.match "ssh-ed25519 .*" key != null) + (import ../papatux-keys.nix); + "k3s-join-token.age".publicKeys = [ + backbiter + damocles + durendal + excalibur + eyelander + gram + gryffindor + kusanagi + narsil + oathbringer + riptide + sting + vesuvius + ]; + "blade-hosts/backbiter/k3s-node-password.age".publicKeys = [ backbiter ]; + "blade-hosts/damocles/k3s-node-password.age".publicKeys = [ damocles ]; + "blade-hosts/durendal/k3s-node-password.age".publicKeys = [ durendal ]; + "blade-hosts/excalibur/k3s-node-password.age".publicKeys = [ excalibur ]; + "blade-hosts/eyelander/k3s-node-password.age".publicKeys = [ eyelander ]; + "blade-hosts/gram/k3s-node-password.age".publicKeys = [ gram ]; + "blade-hosts/gryffindor/k3s-node-password.age".publicKeys = [ gryffindor ]; + "blade-hosts/kusanagi/k3s-node-password.age".publicKeys = [ kusanagi ]; + "blade-hosts/narsil/k3s-node-password.age".publicKeys = [ narsil ]; + "blade-hosts/oathbringer/k3s-node-password.age".publicKeys = [ oathbringer ]; + "blade-hosts/riptide/k3s-node-password.age".publicKeys = [ riptide ]; + "blade-hosts/sting/k3s-node-password.age".publicKeys = [ sting ]; + "keytabs/vesuvius.keytab.age".publicKeys = [ vesuvius ]; "zerocool/wg.priv.age".publicKeys = [ zerocool ]; + "vesuvius/gandi.env.age".publicKeys = [ vesuvius ]; } diff --git a/secrets/vesuvius/gandi.env.age b/secrets/vesuvius/gandi.env.age new file mode 100644 index 0000000..41e0ec9 --- /dev/null +++ b/secrets/vesuvius/gandi.env.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 aQG9zQ jw2KC87a5QeOMwU1pqdW1+KFcC5wklRqd83pAogk2FQ +ejYvXVoBtyNFpB+vvSYJh6ZGHyCdG1dOv/f1wQusN64 +--- LgR65OUy1KkB+4mxvWCVh7AdgLjYDJ4dagAr8YS2VZg +#% +=! 1~.JWVhѶpԷ '50J-J暅Y2v0xAxK!ff¨ј3< \ No newline at end of file