about summary refs log tree commit diff
path: root/users/grfn/system
diff options
context:
space:
mode:
authorGriffin Smith <grfn@gws.fyi>2022-01-20T14·28-0500
committergrfn <grfn@gws.fyi>2022-01-20T14·32+0000
commit7873806218f3ca06ad599cf1693848db6599415c (patch)
tree502c9adf3fed7ef197dca2112eadbf7bd56df321 /users/grfn/system
parent8b63e0f8ce92328c6809490dcce9432d724a80fb (diff)
refactor(grfn/mugwump): Move buildkite secrets into age r/3647
Use agenix for the buildkite ssh key and agent token on mugwump, instead
of storing stuff in /etc/secrets

Change-Id: I56951587b949fc0854e56f5c4e33b601e9cd964e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5027
Reviewed-by: grfn <grfn@gws.fyi>
Autosubmit: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI
Diffstat (limited to 'users/grfn/system')
-rw-r--r--users/grfn/system/system/machines/mugwump.nix18
1 files changed, 16 insertions, 2 deletions
diff --git a/users/grfn/system/system/machines/mugwump.nix b/users/grfn/system/system/machines/mugwump.nix
index a9f876972539..7de6555878d9 100644
--- a/users/grfn/system/system/machines/mugwump.nix
+++ b/users/grfn/system/system/machines/mugwump.nix
@@ -72,6 +72,18 @@ with lib;
     bbbg.file = secret "bbbg";
     cloudflare.file = secret "cloudflare";
     ddclient-password.file = secret "ddclient-password";
+
+    buildkite-ssh-key = {
+      file = secret "buildkite-ssh-key";
+      group = "keys";
+      mode = "0440";
+    };
+
+    buildkite-token = {
+      file = secret "buildkite-token";
+      group = "keys";
+      mode = "0440";
+    };
   };
 
   services.depot.auto-deploy = {
@@ -142,6 +154,8 @@ with lib;
     quiet = true;
   };
 
+  systemd.services.ddclient.serviceConfig.DynamicUser = lib.mkForce false;
+
   security.acme.certs."metrics.gws.fyi" = {
     dnsProvider = "cloudflare";
     credentialsFile = "/run/agenix/cloudflare";
@@ -247,8 +261,8 @@ with lib;
     value = {
       inherit name;
       enable = true;
-      tokenPath = "/etc/secrets/buildkite-agent-token";
-      privateSshKeyPath = "/etc/secrets/buildkite-ssh-key";
+      tokenPath = "/run/agenix/buildkite-agent-token";
+      privateSshKeyPath = "/run/agenix/buildkite-ssh-key";
       runtimePackages = with pkgs; [
         docker
         nix