From 496d8994287f27f93f08ac847e430a6f2dfc94bd Mon Sep 17 00:00:00 2001
From: Vincent Ambo <mail@tazj.in>
Date: Thu, 9 Dec 2021 16:53:22 +0300
Subject: feat(ops/secrets): Configure secrets for gerrit-queue

Adds a systemd EnvironmentFile secret that contains the Gerrit
username & password for gerrit-queue.

Change-Id: I25acf87764c26774045138402b8a417b6813ee8f
---
 ops/machines/whitby/default.nix | 6 ++++++
 ops/secrets/gerrit-queue.age    | 9 +++++++++
 ops/secrets/secrets.nix         | 1 +
 3 files changed, 16 insertions(+)
 create mode 100644 ops/secrets/gerrit-queue.age

(limited to 'ops')

diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index 78945a7417..82b3bc37cf 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -40,6 +40,7 @@ in {
     "${depot.path}/ops/modules/www/tvl.fyi.nix"
     "${depot.path}/ops/modules/www/tvl.su.nix"
     "${depot.path}/ops/modules/www/wigglydonke.rs.nix"
+    "${depot.third_party.agenix.src}/modules/age.nix"
     "${pkgs.path}/nixos/modules/services/web-apps/gerrit.nix"
   ];
 
@@ -201,6 +202,11 @@ in {
     challengeResponseAuthentication = false;
   };
 
+  # Configure secrets for services that need them.
+  age.secrets = {
+    gerrit-queue.file = depot.path.origSrc + "/ops/secrets/gerrit-queue.age";
+  };
+
   # Automatically collect garbage from the Nix store.
   services.depot.automatic-gc = {
     enable = true;
diff --git a/ops/secrets/gerrit-queue.age b/ops/secrets/gerrit-queue.age
new file mode 100644
index 0000000000..c4b102ffd5
--- /dev/null
+++ b/ops/secrets/gerrit-queue.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 dcsaLw XuDxJkTX3Tq8PRoHq29hYz/Qcz2uvud00BW5F8QvA0w
+zxl5HgqvDoB5WwB5NDCcuq0/hD2hDP0vIEJ6rs8hM9Y
+-> ssh-ed25519 OkGqLg K5Hsabm/iPD9tgNre6p6kbMnlnxmXi1ogG2+BdWX/BQ
+QCmy7rhSmkdmj50twwlqrtp7t0nfhRPVlC7Z79P64hY
+-> b-grease ouC0Z%'v Sx lOZ]`8 H
+XQjxJlepFUehbRQ
+--- NAKvcgfnmSJDWoG37cUVJ/uOcsYsie4QDeqKsVrSEME
+aq���8��P�Է�����4*����0?��A
��K��I|x�^:�^`�[�e&}����y6o�A��4
�W�y�/P�����=;���d
���N>��U��4[~uΘA>k}��/8i���FU�ݢ)�oQ��f�b�!���)��j�~����5	�[y��`�i�J��
\ No newline at end of file
diff --git a/ops/secrets/secrets.nix b/ops/secrets/secrets.nix
index 1cf2b5e44a..390c91129b 100644
--- a/ops/secrets/secrets.nix
+++ b/ops/secrets/secrets.nix
@@ -9,4 +9,5 @@ let
   default.publicKeys = tazjin ++ [ whitby ];
 in {
   "besadii.age" = default;
+  "gerrit-queue.age" = default;
 }
-- 
cgit 1.4.1