pvv-nixos-config/.sops.yaml

keys:
  # Users
  - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5

  # Hosts
  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2

creation_rules:
  # Global secrets
  - path_regex: secrets/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_jokum
      - *user_danio
      - *user_felixalb
      - *user_eirikwit
      pgp:
      - *user_oysteikt

  # Host specific secrets
  
  - path_regex: secrets/bekkalokk/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bekkalokk
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt

  - path_regex: secrets/jokum/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_jokum
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt

  - path_regex: secrets/ildkule/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_ildkule
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt
  
  - path_regex: secrets/bicep/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bicep
      - *user_danio
      - *user_felixalb
      pgp:
      - *user_oysteikt
Add sops for secret management 2022-12-07 10:09:17 +01:00			`keys:`
Add host `bekkalokk` `bekkalokk` is a new machine, meant to host web services and eventually miscellaneous services. 2023-01-29 01:51:35 +01:00			`# Users`
Add sops for secret management 2022-12-07 10:09:17 +01:00			`- &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq`
Add host ildkule 2022-12-17 21:51:43 +01:00			`- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6`
Add oysteikt to secrets 2022-12-17 22:53:26 +01:00			`- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC`
add eirikwit to sops 2024-03-16 22:38:16 +01:00			`- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5`
Add host `bekkalokk` `bekkalokk` is a new machine, meant to host web services and eventually miscellaneous services. 2023-01-29 01:51:35 +01:00
			`# Hosts`
update jokum sops secrets 2023-03-26 13:14:55 +02:00			`- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt`
Upgrade ildkule (!36) This PR is made while moving Ildkule from PVE on joshua, to Openstack on stack.it.ntnu.no. - The main monitoring dashboard is moved from https://ildkule.pvv.ntnu.no to https://grafana.pvv.ntnu.no. - A new service is added: uptime-kuma on https://uptime.pvv.ntnu.no. - The (hardware) configuration for ildkule is updated to fit the new virtualization environment, boot loader, network interfaces, etc. - Metrics exporters on other hosts should be updated to allow connections from the new host As this is the first proper server running on openstack, and therefore outside our main IP range, we might discover challenges in our network structure. For example, the database servers usually only allow connections from this range, so Ildkule can no longer access it. This should be explored, documented and/or fixed as we move more services. Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/36 Co-authored-by: Felix Albrigtsen <felix@albrigtsen.it> Co-committed-by: Felix Albrigtsen <felix@albrigtsen.it> 2024-04-21 23:36:25 +02:00			`- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0`
Update keys and re-enable web services 2023-05-21 02:29:14 +02:00			`- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd`
update jokum sops secrets 2023-03-26 13:14:55 +02:00			`- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2`
Add host `bekkalokk` `bekkalokk` is a new machine, meant to host web services and eventually miscellaneous services. 2023-01-29 01:51:35 +01:00
Add sops for secret management 2022-12-07 10:09:17 +01:00			`creation_rules:`
			`# Global secrets`
			`- path_regex: secrets/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
			`- *host_jokum`
sops: reencrypt jokum secrets with felixalb keys 2023-01-21 22:37:56 +01:00			`- *user_danio`
			`- *user_felixalb`
add eirikwit to sops 2024-03-16 22:38:16 +01:00			`- *user_eirikwit`
Add oysteikt to secrets 2022-12-17 22:53:26 +01:00			`pgp:`
			`- *user_oysteikt`
Add host `bekkalokk` `bekkalokk` is a new machine, meant to host web services and eventually miscellaneous services. 2023-01-29 01:51:35 +01:00
Add sops for secret management 2022-12-07 10:09:17 +01:00			`# Host specific secrets`
Add host `bekkalokk` `bekkalokk` is a new machine, meant to host web services and eventually miscellaneous services. 2023-01-29 01:51:35 +01:00
			`- path_regex: secrets/bekkalokk/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
			`- *host_bekkalokk`
			`- *user_danio`
			`- *user_felixalb`
			`pgp:`
			`- *user_oysteikt`

Add sops for secret management 2022-12-07 10:09:17 +01:00			`- path_regex: secrets/jokum/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
			`- *host_jokum`
sops: reencrypt jokum secrets with felixalb keys 2023-01-21 22:37:56 +01:00			`- *user_danio`
			`- *user_felixalb`
Add oysteikt to secrets 2022-12-17 22:53:26 +01:00			`pgp:`
			`- *user_oysteikt`
Add host ildkule 2022-12-17 21:51:43 +01:00
			`- path_regex: secrets/ildkule/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
Add ildkule host keys 2022-12-17 22:49:23 +01:00			`- *host_ildkule`
sops: reencrypt jokum secrets with felixalb keys 2023-01-21 22:37:56 +01:00			`- *user_danio`
			`- *user_felixalb`
Add oysteikt to secrets 2022-12-17 22:53:26 +01:00			`pgp:`
Merge remote-tracking branch 'origin/main' into prometheus-stack 2023-01-14 22:49:21 +01:00			`- *user_oysteikt`
move matrix to bicep 2023-05-07 10:14:09 +02:00
			`- path_regex: secrets/bicep/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
			`- *host_bicep`
			`- *user_danio`
			`- *user_felixalb`
			`pgp:`
			`- *user_oysteikt`