federez/nix
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add some secrets & asyncnomi key to sysadmin

Browse source
This commit is contained in:
asyncnomi 2025-06-22 01:15:31 +02:00
parent 9b61f7e9b5
commit 1ce8f529ee
4 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
npins/sources.json
View file

@ -42,8 +42,8 @@
"nixpkgs": { "nixpkgs": {
"type": "Channel", "type": "Channel",
"name": "nixos-unstable-small", "name": "nixos-unstable-small",
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre819016.618b6dbfc210/nixexprs.tar.xz", "url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre819403.86c02c145a0b/nixexprs.tar.xz",
"hash": "0iykh9dp93av07qjabiqmslc372jki3jzqpfy54nsy04702nz4b9" "hash": "1m8yiq7jaz24lbfdkch8m22lr8m1jkxkh9d1p4j1svm18f1nilyx"
}, },
"nixpkgs-24.11": { "nixpkgs-24.11": {
"type": "Channel", "type": "Channel",

11
profiles/gitlab.nix
View file

@ -12,6 +12,9 @@ in
gitlab-otp-secret = ../secrets/gitlab-otp-secret.age; gitlab-otp-secret = ../secrets/gitlab-otp-secret.age;
gitlab-db-secret = ../secrets/gitlab-db-secret.age; gitlab-db-secret = ../secrets/gitlab-db-secret.age;
gitlab-jws-secret = ../secrets/gitlab-jws-secret.age; gitlab-jws-secret = ../secrets/gitlab-jws-secret.age;
gitlab-arpk-secret = ../secrets/gitlab-arpk-secret.age;
gitlab-ardk-secret = ../secrets/gitlab-ardk-secret.age;
gitlab-ars-secret = ../secrets/gitlab-ars-secret.age;
gitlab-db-password = ../secrets/gitlab-db-password.age; gitlab-db-password = ../secrets/gitlab-db-password.age;
gitlab-initial-root-password = ../secrets/gitlab-initial-root-password.age; gitlab-initial-root-password = ../secrets/gitlab-initial-root-password.age;
gitlab-ldap-password = ../secrets/gitlab-ldap-password.age; gitlab-ldap-password = ../secrets/gitlab-ldap-password.age;
@ -33,6 +36,9 @@ in
otpFile = secrets.gitlab-otp-secret.path; otpFile = secrets.gitlab-otp-secret.path;
dbFile = secrets.gitlab-db-secret.path; dbFile = secrets.gitlab-db-secret.path;
jwsFile = secrets.gitlab-jws-secret.path; jwsFile = secrets.gitlab-jws-secret.path;
activeRecordPrimaryKeyFile = secrets.gitlab-arpk-secret.path;
activeRecordDeterministicKeyFile = secrets.gitlab-ardk-secret.path;
activeRecordSaltFile = secrets.gitlab-ars-secret.path;
}; };
extraConfig.ldap = { extraConfig.ldap = {
enabled = true; enabled = true;
@ -55,6 +61,11 @@ in
}; };
}; };
services.postgresql = {
enable = true;
package = pkgs.postgresql_16;
};
services.nginx = { services.nginx = {
enable = true; enable = true;
recommendedProxySettings = true; recommendedProxySettings = true;

1
profiles/sysadmin.nix
View file

@ -4,6 +4,7 @@
../pubkeys/bensmrs.keys ../pubkeys/bensmrs.keys
../pubkeys/tomate.keys ../pubkeys/tomate.keys
../pubkeys/jeltz.keys ../pubkeys/jeltz.keys
../pubkeys/asyncnomi.keys
]; ];
backups.directories = [ "/root" ]; backups.directories = [ "/root" ];

3
secrets/secrets.nix
View file

@ -66,6 +66,9 @@ in
"gitlab-otp-secret.age".publicKeys = [ aragon ] ++ gitlab-admins; "gitlab-otp-secret.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-db-secret.age".publicKeys = [ aragon ] ++ gitlab-admins; "gitlab-db-secret.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-jws-secret.age".publicKeys = [ aragon ] ++ gitlab-admins; "gitlab-jws-secret.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-arpk-secret.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-ardk-secret.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-ars-secret.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-db-password.age".publicKeys = [ aragon ] ++ gitlab-admins; "gitlab-db-password.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-initial-root-password.age".publicKeys = [ aragon ] ++ gitlab-admins; "gitlab-initial-root-password.age".publicKeys = [ aragon ] ++ gitlab-admins;
"gitlab-ldap-password.age".publicKeys = [ aragon ] ++ gitlab-admins; "gitlab-ldap-password.age".publicKeys = [ aragon ] ++ gitlab-admins;