From 7873806218f3ca06ad599cf1693848db6599415c Mon Sep 17 00:00:00 2001
From: Griffin Smith <grfn@gws.fyi>
Date: Thu, 20 Jan 2022 09:28:01 -0500
Subject: refactor(grfn/mugwump): Move buildkite secrets into age

Use agenix for the buildkite ssh key and agent token on mugwump, instead
of storing stuff in /etc/secrets

Change-Id: I56951587b949fc0854e56f5c4e33b601e9cd964e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5027
Reviewed-by: grfn <grfn@gws.fyi>
Autosubmit: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI
---
 users/grfn/secrets/buildkite-ssh-key.age      | Bin 0 -> 3853 bytes
 users/grfn/secrets/buildkite-token.age        |  12 ++++++++++++
 users/grfn/secrets/secrets.nix                |   2 ++
 users/grfn/system/system/machines/mugwump.nix |  18 ++++++++++++++++--
 4 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 users/grfn/secrets/buildkite-ssh-key.age
 create mode 100644 users/grfn/secrets/buildkite-token.age

(limited to 'users')

diff --git a/users/grfn/secrets/buildkite-ssh-key.age b/users/grfn/secrets/buildkite-ssh-key.age
new file mode 100644
index 000000000000..0ae5aa5502f7
Binary files /dev/null and b/users/grfn/secrets/buildkite-ssh-key.age differ
diff --git a/users/grfn/secrets/buildkite-token.age b/users/grfn/secrets/buildkite-token.age
new file mode 100644
index 000000000000..9e9e370f1bec
--- /dev/null
+++ b/users/grfn/secrets/buildkite-token.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 CpJBgQ tz7tudrJYQw2Ftnk7iNbSd/De2UJ0GAafFJjPwUo8xM
+bUBNO94Pjf79FErPxv92XnpXWFEgethREU+/U+xjWBc
+-> ssh-ed25519 LfBFbQ yPjXk6XlJoGyVaCWMcPzfNXzb1cBNZhjYy+wsQtMhTI
+qk6hZMl1oeKLniGb/bKIxSb6ocVRCQsmQPcwxnlYfno
+-> \'q-grease
+nYvpKokvFbVXfATzlQ7SPQa9Gw99E84SPRFdR7ey+HSCB705Q9uYwBpr9hjpiIod
+9PJIi88ENWf9/XAmm2d7daE+YPRYhln4U6w
+--- EuyCLA6GvtbGI+EoC1z2dbpfyxo4ebXX1nY+9rsgUVY
+�[����h��Ω�Ъ�`1�?NC���@���u��Bl�8*Ո�s���Z~P�А��?8�
+
+�O��~�{G}�0q.��A���W��
\ No newline at end of file
diff --git a/users/grfn/secrets/secrets.nix b/users/grfn/secrets/secrets.nix
index 557f2a70f1ef..986ad181b87c 100644
--- a/users/grfn/secrets/secrets.nix
+++ b/users/grfn/secrets/secrets.nix
@@ -8,4 +8,6 @@ in
   "bbbg.age".publicKeys = [ grfn mugwump bbbg ];
   "cloudflare.age".publicKeys = [ grfn mugwump ];
   "ddclient-password.age".publicKeys = [ grfn mugwump ];
+  "buildkite-ssh-key.age".publicKeys = [ grfn mugwump ];
+  "buildkite-token.age".publicKeys = [ grfn mugwump ];
 }
diff --git a/users/grfn/system/system/machines/mugwump.nix b/users/grfn/system/system/machines/mugwump.nix
index a9f876972539..7de6555878d9 100644
--- a/users/grfn/system/system/machines/mugwump.nix
+++ b/users/grfn/system/system/machines/mugwump.nix
@@ -72,6 +72,18 @@ with lib;
     bbbg.file = secret "bbbg";
     cloudflare.file = secret "cloudflare";
     ddclient-password.file = secret "ddclient-password";
+
+    buildkite-ssh-key = {
+      file = secret "buildkite-ssh-key";
+      group = "keys";
+      mode = "0440";
+    };
+
+    buildkite-token = {
+      file = secret "buildkite-token";
+      group = "keys";
+      mode = "0440";
+    };
   };
 
   services.depot.auto-deploy = {
@@ -142,6 +154,8 @@ with lib;
     quiet = true;
   };
 
+  systemd.services.ddclient.serviceConfig.DynamicUser = lib.mkForce false;
+
   security.acme.certs."metrics.gws.fyi" = {
     dnsProvider = "cloudflare";
     credentialsFile = "/run/agenix/cloudflare";
@@ -247,8 +261,8 @@ with lib;
     value = {
       inherit name;
       enable = true;
-      tokenPath = "/etc/secrets/buildkite-agent-token";
-      privateSshKeyPath = "/etc/secrets/buildkite-ssh-key";
+      tokenPath = "/run/agenix/buildkite-agent-token";
+      privateSshKeyPath = "/run/agenix/buildkite-ssh-key";
       runtimePackages = with pkgs; [
         docker
         nix
-- 
cgit 1.4.1