From dcf8bc40359054bbeb0ff96db22933e5be40cf0d Mon Sep 17 00:00:00 2001 From: clerie Date: Tue, 2 May 2023 19:42:46 +0200 Subject: [PATCH] modules/monitoring: migrate monitoring vpn secrets to age --- bin/add-secret.sh | 15 +++++++++++++++ hosts/backup-4/secrets/wg-monitoring.age | 10 ++++++++++ hosts/carbon/secrets/wg-monitoring.age | 9 +++++++++ hosts/clerie-backup/secrets/wg-monitoring.age | 10 ++++++++++ hosts/dn42-il-gw1/secrets/wg-monitoring.age | 10 ++++++++++ hosts/dn42-il-gw5/secrets/wg-monitoring.age | Bin 0 -> 456 bytes hosts/dn42-il-gw6/secrets/wg-monitoring.age | 9 +++++++++ hosts/gatekeeper/secrets/wg-monitoring.age | 10 ++++++++++ hosts/hydra-1/secrets/wg-monitoring.age | 12 ++++++++++++ hosts/hydra-2/secrets/wg-monitoring.age | Bin 0 -> 454 bytes hosts/minecraft-2/secrets/wg-monitoring.age | Bin 0 -> 493 bytes hosts/monitoring-3/prometheus.nix | 2 +- hosts/monitoring-3/secrets/wg-monitoring.age | Bin 0 -> 491 bytes hosts/nonat/secrets/wg-monitoring.age | 13 +++++++++++++ hosts/osmium/secrets/wg-monitoring.age | 10 ++++++++++ hosts/palladium/secrets/wg-monitoring.age | 10 ++++++++++ hosts/porter/secrets/wg-monitoring.age | Bin 0 -> 404 bytes hosts/storage-2/secrets/wg-monitoring.age | 9 +++++++++ hosts/web-2/secrets/wg-monitoring.age | 9 +++++++++ 19 files changed, 137 insertions(+), 1 deletion(-) create mode 100755 bin/add-secret.sh create mode 100644 hosts/backup-4/secrets/wg-monitoring.age create mode 100644 hosts/carbon/secrets/wg-monitoring.age create mode 100644 hosts/clerie-backup/secrets/wg-monitoring.age create mode 100644 hosts/dn42-il-gw1/secrets/wg-monitoring.age create mode 100644 hosts/dn42-il-gw5/secrets/wg-monitoring.age create mode 100644 hosts/dn42-il-gw6/secrets/wg-monitoring.age create mode 100644 hosts/gatekeeper/secrets/wg-monitoring.age create mode 100644 hosts/hydra-1/secrets/wg-monitoring.age create mode 100644 hosts/hydra-2/secrets/wg-monitoring.age create mode 100644 hosts/minecraft-2/secrets/wg-monitoring.age create mode 100644 hosts/monitoring-3/secrets/wg-monitoring.age create mode 100644 hosts/nonat/secrets/wg-monitoring.age create mode 100644 hosts/osmium/secrets/wg-monitoring.age create mode 100644 hosts/palladium/secrets/wg-monitoring.age create mode 100644 hosts/porter/secrets/wg-monitoring.age create mode 100644 hosts/storage-2/secrets/wg-monitoring.age create mode 100644 hosts/web-2/secrets/wg-monitoring.age diff --git a/bin/add-secret.sh b/bin/add-secret.sh new file mode 100755 index 0000000..31d2991 --- /dev/null +++ b/bin/add-secret.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +set -euo pipefail + +cd $(git rev-parse --show-toplevel) + +host=$1 +secret=$2 + +mkdir -p hosts/${host}/secrets + +nix run github:ryantm/agenix -- -e hosts/${host}/secrets/new + +mv hosts/${host}/secrets/new hosts/${host}/secrets/${secret}.age + diff --git a/hosts/backup-4/secrets/wg-monitoring.age b/hosts/backup-4/secrets/wg-monitoring.age new file mode 100644 index 0000000..03a511c --- /dev/null +++ b/hosts/backup-4/secrets/wg-monitoring.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w NS7or54RThBygIkXukAmaMBerb3XzBl9MWxhhXSOHTs +B9+EuN080AMUEdm/KRVcR/sqlw0uC8/lO4VFuTkfECk +-> ssh-ed25519 eelCFw KF1iYVpI/owY2K2entqcm4KaOztBC1Y+9/qK11s3Z0Y +IS3ABKW5+NEDW9bJ2KAb64WiIkHoMibyWtyuF3sF3eI +-> D,/q5iN-grease +LBaWGpsSun/TqNuM8OnhBu6/+u4NrwgrSe7iMkER7yrA/j4RKDfzHC17P9l701xN +OWFhKaA1qsxwe2Pk+3cN9Tp7SklE/hY9ADIvA1Jqqa1uVhYonrpZFEUXPVbnEEs +--- JYxwomGwWYbjcoqV5u3ReD/2kaZ7XQmxc7aUEZOGcCk +A,Jiy8K@ڨ0]_MM౉w7ު!Ϲ2ѬԛJޯlQt=p$ \ No newline at end of file diff --git a/hosts/carbon/secrets/wg-monitoring.age b/hosts/carbon/secrets/wg-monitoring.age new file mode 100644 index 0000000..5299c29 --- /dev/null +++ b/hosts/carbon/secrets/wg-monitoring.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w IkxlO8D2o7SoBGyg9/edvw97sAqj9e1nUtQk9ci8tws +t3mju7vCMEQcOs21Q56U53hTYyplMlj8L89oVVcgifQ +-> ssh-ed25519 5EcjHQ W1oWURPqGGfSwDZbIfqKVBBL+fMdLh1KnW3mMqALWmA +RbuAx/Sgj4wmuzijnjtS2Mai3n0T+89qSv2v5pxDfVw +-> w)}-grease $do +nc2bWeMeBxc3hd4XkX/k+isQudb0VZBD +--- 3Smsch2WrfWCMaeQffV+52LBY11YTtUa9K40DWrsAzY +כuInm)nO' q̨r R{T=+ïjc? Hw]dBa \ No newline at end of file diff --git a/hosts/clerie-backup/secrets/wg-monitoring.age b/hosts/clerie-backup/secrets/wg-monitoring.age new file mode 100644 index 0000000..24f963f --- /dev/null +++ b/hosts/clerie-backup/secrets/wg-monitoring.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w t9osbbi1s3J96OhWrTgrNmGHfIWUAqB4aFvmbNqtTG8 +DD+iNLEd6WBvRS8PC0pfiCgNmVR4jNwBZHcaR8a814Y +-> ssh-ed25519 ILP4Ew sisQcIh1A9M3qwl9yD+cSPNM/nnNpII+Xfesj9mwkRM +7h/dPRCYHA88Q7lWvvPvdHf4ppCiEnu9ca6TY0BZLzY +-> {9O-grease a_:E +g5khXWjhnAYGhbvvT8+gbde58hiKZe9UtQfsGUDvnngA+OQulOiV9+tRX+yuzUhb +0z6nyMS0R9kPFsSFg7H03SYbkKaidh54FCYzyRMLld9nHYe6mUE +--- zDunV7ZXq7wNxXOVAdEUJmeGI25kHpsO2S5qNklhHQ4 +G T$;&Nng=RvMSWs/՛nkڌlL&jGER(_VBv^&i:d \ No newline at end of file diff --git a/hosts/dn42-il-gw1/secrets/wg-monitoring.age b/hosts/dn42-il-gw1/secrets/wg-monitoring.age new file mode 100644 index 0000000..52810fc --- /dev/null +++ b/hosts/dn42-il-gw1/secrets/wg-monitoring.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w +AFhSTsqwKkww+OGHnKI+qi0JvrQVe8p+XRVnn1oZk4 +t7nBc4g5guqSsP6XFWYLAXPZEKFJA0tk4GM9XP3uoUo +-> ssh-ed25519 g+l3bg LjbGz8bbxotI4uhVaFzCjaOohfjJbTgPCbQ5UgCVgEI ++7h66Z41OSyvZjJ7ANYFA+ut1FWQXE79WonaXE5HREc +-> OapV-grease jkg)M@ NO4*'ml? lUG]H liUD3iK> +628DJDgpTFp0XP05robVn8j6/3f340BaYvdZIKLKvqXp93GufqwBnfYRIjYDyolA +Kt0M59kSw2DOtaYaOEk/E5BJhdYa+cDBEs8 +--- 0V08Pg4II/yihrNWngXKWXwr6+Lcu9+XijZYupCyzHo +E?aS,&\Bҗ8X]S^BHI-ݫ/F'#;C@o&~i\=ԯ \ No newline at end of file diff --git a/hosts/dn42-il-gw5/secrets/wg-monitoring.age b/hosts/dn42-il-gw5/secrets/wg-monitoring.age new file mode 100644 index 0000000000000000000000000000000000000000..241c0810ed768ea305eaeae47d1759256c760a64 GIT binary patch literal 456 zcmZ9_JCBoa003|oa~Br9+;EBU5(Xy;QlO=+xtLHMM@uc`RcP%XP#%^?DHQ&NnB3qu zaB?x~EhY{QZZ3_h)9GyDaJ$pR=%$IIzc28!d>3^SC#%xUlT~tWmHAkSL+ArI&jZw5 z5Um#8g$1CHB!Fqe)H`17@IlG=E_s@yO~o*9yIFz87zvRn&Q~%A^g?wYrH9y#%!Qs* zkCCdK228PPiC9?^QJ;4?ODL9Bd$S>ILH>Vp8;LFW@PbZg1gNYw<9IftrrWKKHBDAt zH^PS#g%#MP)J+LF+Tt{1t-Fjk>knfDr?||_us-RrdF02jGz#OM0i0SYa;l6#_-~`o zE$U~kmAkNsJ%XwktuAJ#c@$WzxwNx}K~JVdo%Fql*{eh^&U{Bt34P>-18q34M@*Mv zDz6RVvEU_?4%xb2Lnw;E6p4B6%FM9@3{qV?pNsFF?H~V~U;nkc@%8D4S9d?D+MAP? bXBP*1_Mh`xmsh(V_qp%X#}~Wk?UC{qR ssh-ed25519 HwR33w 5r8PAnWrr1maOMNehoMkegIq1RvYcOTVSC6aynbI9Dc +g/q8AoKehfdRK8zuIVfj1TQeu37PQdUUXEPez07d2x0 +-> ssh-ed25519 I+qNDQ r2etKUBWkHA4X6wpnGZbMmkLRQWhZ4JI13mOV3XX3Xk +/FJzTBB29gVH0VAeStXzi4rFZNoc/odYjXyObq/wVuQ +-> !YfpC-grease 4B +4ZoUV7O6DjEEHUXCG8+PcjyDt64X4nfKcnH1xt/45Wc +--- HptZmw/gU1pbkVwRvrTvDSj6Ly5ip5BQrMMyvVDULZ8 +\x!*zZy`ƓqmS=yٞjk*Wޥ (,F`t5QǁqX \ No newline at end of file diff --git a/hosts/gatekeeper/secrets/wg-monitoring.age b/hosts/gatekeeper/secrets/wg-monitoring.age new file mode 100644 index 0000000..1447632 --- /dev/null +++ b/hosts/gatekeeper/secrets/wg-monitoring.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w ScSNP64jvvU/1t/fKlXPW9vaPwGvHwy6UEmGRA/h9HY +GV0KnasHBoj+qtTIT9aI0k6A/XgHPFXvmsApPDhAjc0 +-> ssh-ed25519 W4Oy+w 455qbO83X2y2XZR2obj4IItMGkrC/WiRc6B2jp9MOEU +RLT/FkTDWJYHtAhtYAEHaw+CcgITvgBJKLLrN9MpMg0 +-> kN4?-grease sJ p ZV(8^Djl N*7)k~ +0wq67UmJOPjObCWQhRSzUE6kWIhZsmv4zz6lEt71YoH5nFb7TzF1vYVfrqMycht2 +QvzqtKMNAmFu6jv30X2ULBIjLNajtMGeZxLyBIjnbkCscnoWv4c +--- 7Fu5hMch3bfWXWlCwRvhVQCWx444fy/SMQyOwUyidqE +l=·3Y`\ԅR@؊-©K9)XYwǠ-*c] v>P1R~ \ No newline at end of file diff --git a/hosts/hydra-1/secrets/wg-monitoring.age b/hosts/hydra-1/secrets/wg-monitoring.age new file mode 100644 index 0000000..d25c7b5 --- /dev/null +++ b/hosts/hydra-1/secrets/wg-monitoring.age @@ -0,0 +1,12 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w iq9GCoMvjYmB36sb3ObwjSO2eL/wyyxTsIbJ8lye1zE +6PcXowhq3ADvC94MQ0BuFeyiCxmxWwwgEjve2fP3uRc +-> ssh-ed25519 UgSomQ OtaRJDru8abGAMKcmcF0YHPDMnilqZAk9LULZ3eVd3I +3vzkjiqpOz1rIODQdO1QTs7j8JW+f7/9hrlBvb48z+M +-> zXcO;;.{-grease +w1zwccIRbNRBbiXF5p6fVAS1Fm8OUJdq105gfEaGNUgEKSzUzGRlron5JemsebJt +6rLBebjmtxrgLOMvPMbtpX1hQJOrWV6yVJkBOuqlRtVdFPNMrIEWXc5v+VXR8Ccx +XMs +--- v41dXOCQtZwpIdKXoQSB1oblr17HunSpwoRnfPtKkS4 +M%<Ԅ[_W!s +.Ho0w6t?'zo Иh \ No newline at end of file diff --git a/hosts/hydra-2/secrets/wg-monitoring.age b/hosts/hydra-2/secrets/wg-monitoring.age new file mode 100644 index 0000000000000000000000000000000000000000..5ebdc3df698c4240d0bc36493d13eaf64ba95095 GIT binary patch literal 454 zcmZ9`J&%)M003akx`u)x=p{{RPi6^&t)yv%Fref^=~=&HYBzMDRnjDCRhH$#%QR zqVn2mwbtm-Hl0&qwutGj-Xdj892uVHZmW%#ChOp`? zTWdCfpalSy9$Q-2u3aN`V;Y*3925U*FjGRoM8}!JQ-iF8`M^;`ZV4=QTHAD+FY`so zTD_plW*bJz()$!biy5WbN)q`@NYTBKNpv!YS^I_Ex9}Zw7`N75yfr^laZ_$y6RND}a1;vD3?+ zU;IAVKlpy>iud#tr|oWBJjKNW>*c$>-SzXm^Zw+^gR2 z6B>?d^*SSxN7AjfHoqpE7J2o*{1nK_(Q=G_oaI{kc{_t+U*)A%V$yyie6`jlT= zII2`Myke9b@6IVp4Eyzp*^*IOmH;gyn5N5)W$=F80o J7x9br%|9CXs^kCw literal 0 HcmV?d00001 diff --git a/hosts/monitoring-3/prometheus.nix b/hosts/monitoring-3/prometheus.nix index 5573fb6..ccfbdf0 100644 --- a/hosts/monitoring-3/prometheus.nix +++ b/hosts/monitoring-3/prometheus.nix @@ -75,7 +75,7 @@ in { ips = [ "fd00:327:327:327::1/64" ]; listenPort = 54523; peers = monitoringPeers; - privateKeyFile = "/var/src/secrets/wireguard/wg-monitoring"; + privateKeyFile = config.age.secrets.wg-monitoring.path; }; }; diff --git a/hosts/monitoring-3/secrets/wg-monitoring.age b/hosts/monitoring-3/secrets/wg-monitoring.age new file mode 100644 index 0000000000000000000000000000000000000000..b8c8355486965a7dc104d059d1711fd73a1788b9 GIT binary patch literal 491 zcmZ9_J&%)M003ZPZenq8aWe04I@lo4@0(|erCe!2pinr^7>$W8 zCJrWUt}ad*$6GF%7^jQ5!KkaQj&6ReK7ZgrfsgwuFRhY1j8|9VG$0BJ!#g0$=D0s? zLP&97uN<^mCEz48@^>uVZV$Cap0JyIqZ%osWTqJhBVjjLdb;JoAg?k^L5gVvU)kM~K&W z(#R&-EKfwGJ=g3pkGb|*rDLTUF9p{%DS`1)X)u!X#gyXYJ+G_!R#GmSir(Y@ZTU7H zq&~`gu$J#!>hM#Lf}LC06_awnjcWyo5zA2?&V^;V8?lZPkqZ$OoI~-M)d(AvP#SA7 z>E4`5Yb3x%(N`LQF68!v9;^hfo33hX71f9om*tFi+cr5f<)FwWe{UQIQpFEjRnKj1 zP(K>Oz88xgOV`@%B#Z~L6V6zn$B1>MHy2p=?fY?f{_f{jM`!MBaqkYke0Xu;>FMFi zXXhS*2U~B6_oVTA_!B< ssh-ed25519 HwR33w iEMelLHDM8EUtRxTjZakRhyaCgvu0y078c2m30LjlgY +o7v/DLKisYUVOgr/q5R/vdrFwsvibdPyGmDdoYxG9wg +-> ssh-ed25519 wTWpBQ R1dUP4h19a97U2pRtayUWOer6SZr0K4NQ5HwfxlfljU +NwTJQET27YxUZVMr0Eysniqp7R/mhVLjrcv7KyKk7HQ +-> \'G8L\\-grease +IYhz41mhvSiBPNpEd//WIhhxz58Rj5nQrnsyNUcNJ8DJo+u/5XsMX7xsiUpPlqZl +gljbE5k3W79kGV45+gTGbBi6j1kwM98ZPzUx6zF/wdkV+6/UdRvcxdwCBeLMQCpE + +--- 9cL+fMX0BHh+Tdtx6DBoUG/U/dVlwX8YN0CoWIZvU/s +F [*TT;^b&! dXO@KF +%/k/'٭/{ +nCn"Zg/? j \ No newline at end of file diff --git a/hosts/osmium/secrets/wg-monitoring.age b/hosts/osmium/secrets/wg-monitoring.age new file mode 100644 index 0000000..ace88b9 --- /dev/null +++ b/hosts/osmium/secrets/wg-monitoring.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w GdM0PlWSyTELO16TOGV5qVDnpy+wmRVISm8zq4AkL2I +bFPVH0sTvsAoewRyetxxMDq4TXKBbo9kcer4j/+TnEY +-> ssh-ed25519 e95K1g C9JuyI5jzWfFdhN6BNiUeEUHyVTW6hrZzf0fxHWniGk +TBU7VCgk1OKYwc4ol+kcKnAUXae83BePZh2DBoTGz+A +-> "-grease +/GBX/iJRT06Kgz3sXOsc4gqb5ZugnM0qDWBBCsrQ0cWkhswar/wIocSYVilsrM+0 +X8ZhFq0LIN63eCcVcw3bLk4Kvqz/GCF68uk0VOxxSThVZ+rj +--- xW5X/IzB/clE7LZDkvD42EUmKnwEmgDmzPrKR5ni/uE +Ep}:.fG(70T )V|O"w12ukwn֚Nѩ3}͂XCB \ No newline at end of file diff --git a/hosts/palladium/secrets/wg-monitoring.age b/hosts/palladium/secrets/wg-monitoring.age new file mode 100644 index 0000000..0427982 --- /dev/null +++ b/hosts/palladium/secrets/wg-monitoring.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w ctm6hruSuzSBwGGcW9x7qIIFe7z+AGhlO8ICU8cwO3U +9fhK5PdJJn7BpM9Vplrpi1Gcofpzafv30z+O2SuEVR0 +-> ssh-ed25519 RfitmQ fnVZmd42HVD6iBkEzEGn57D4LNMcYfWXeRpnRutjNyY +s1+OrASe6ONf9kVgfBiAuoSd8314h4ek6yoz+mL04Cw +-> nTx'S6-grease 1Dt%/ +mr9/gUTNOMrFAQVmUgVVfXpkKk+aXes6CulorL24APwN9dL1GPEOWdP3v1NEFcR1 +db6L78xilCtNf/jszgpMFYh5ctehauTa +--- EkgK0s3mBI1KvlZIWl5iB+p9xu6of0oL3NEVV+Jcjfc ++0xE~T:֟Tj~cL@wDXDNJ4s׳DSK/V!oU_x: \ No newline at end of file diff --git a/hosts/porter/secrets/wg-monitoring.age b/hosts/porter/secrets/wg-monitoring.age new file mode 100644 index 0000000000000000000000000000000000000000..e8494d017bfadfcab974c303a653f9094435dd72 GIT binary patch literal 404 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUlC=W6=E>{RLE7tZ1 zt28Le@iYibE;S4^5B4c9c8u`1bjr^vHMB6+FDNT?@$?7}_2i0*^mfg%2rf)=v+xQC zj4U({$*|PccFQz&aj~>0(l<2qb9WAR4=gjN$VRsG02J?)f_}_K3>AP1ZkMY0)&PPoC2+V_Dk@hDyeJTW)A{gc)wk jo4%2c?a;1Ey#XBdi#Kr{@HmnBOel(b>zrAW=4=K47+H)o literal 0 HcmV?d00001 diff --git a/hosts/storage-2/secrets/wg-monitoring.age b/hosts/storage-2/secrets/wg-monitoring.age new file mode 100644 index 0000000..a9bcd2b --- /dev/null +++ b/hosts/storage-2/secrets/wg-monitoring.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w 3DdeLEaXCmEsm5U5idLUPb2t25cbd66Cppf0xcF3GEs +V7g2WywINm7qB7WcV/zL490I/7vCqudlnzNXY1Ckzrg +-> ssh-ed25519 pI7EWw HNBoCvxcX9qEJHzjO/8RxPgsy7J1RmqROFKTf/bIcgs +9JSsE7iqZ+1h5YfPPI6v4fth9wdFP8qfU/mNkaTQr6s +-> 9Kh.qZ]-grease +gx3ohTVB+gSV +--- OzhRO0ke2wUPWxBayTpVLE2leygx0pT60PTpcTlVgis +alP$c8GjTGP͉{"Rc0Y=>>퉆f߸i r5vŗ# \ No newline at end of file diff --git a/hosts/web-2/secrets/wg-monitoring.age b/hosts/web-2/secrets/wg-monitoring.age new file mode 100644 index 0000000..ae28b6a --- /dev/null +++ b/hosts/web-2/secrets/wg-monitoring.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 HwR33w ZWn7K/SI1OWS0FslI6Vz+KooVyWXuww4dNa5y0O1+Xo +P723ghoGExFpcMYjdvcZrvT1eOG/pmccI3IO0/UnaAw +-> ssh-ed25519 1nn+0Q IL+SAfWJvd1KPV1z1kAyoLu3o/t6qdCx4cHjplqkaAo +5io07rjFwtbvmgvA2sYn0VsjdtHi0AA1JRwhH5yijpI +-> m2cEFebO-grease )(5.!z\ + +--- 4ILHmhv4fz6NZaWVYAKmFGY4ojpt4WQu3ulxz0R5FCA +(Եnl*Ujˮî:U51rڠ‡A ޴cCN|_X.s[K& \ No newline at end of file