secrets: migrate to agenix

It is finally time to graduate to an actually secure, stateless
solution.
This commit is contained in:
Bruno BELANYI 2021-09-24 18:52:26 +02:00
parent abf526ae3c
commit 8664781da7
28 changed files with 203 additions and 0 deletions

View file

@ -1,3 +1,5 @@
* filter=git-crypt diff=git-crypt
.gitattributes !filter !diff
/default.nix !filter !diff
/secrets.nix !filter !diff
*.age !filter !diff

10
secrets/acme/dns-key.age Normal file
View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg 0bz3W8QcGaulxy+kDmM717jTthQpFOCwV9HkenFJEyo
NKeh1/JkX4WAWbOjUeKLMbsyCevnDf3a70FfYUav26c
-> ssh-ed25519 jPowng Q59ybJMMteOSB6hZ5m6UPP0N2p8jrDSu5vBYwPgGcRw
j420on2jSsfMsv4MDtiOTMIFjaXV7sIsrS+g4iab+68
-> z}.q-grease s2W<qM_Z t
n1Yfs/gmNsl/n9HtuKBIIT8iwIjYca2yxlh7Q1XAT1B+RZ8oGjW8yCPj1unbDGZL
e5BfLO3zgkEZnQ
--- FSgNKEdDeeTjCx9jN9UtOFl58mC/Lbu1PAYRGK0CZW4
U€¿+æ©jïÝ{gø`GŽ›ÆàˆQk]šóïdÐ6å˜úy5T²$Äñs~Ùh‰Ä£òÔ<C3B2>Fº¢ç%°vöÌm<C38C>

View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg YlDuj9wwBKSHHvQOhfti1ah95vxDV3bLE+GElBkyTB0
KsMyd3L4GaQa0eDQps+bJXj+cpy0zUNvFXU8NAmtThI
-> ssh-ed25519 jPowng JB4UtNyZab4ab4Pep3acyMjwCbluuEPuI6YOQ/045Fo
P9qnrPDGpHJL1TyNqYdNfqkd21Yjn/5mlovorWy60j4
-> _6l|s-grease M ]2qMsa'w P] j0EE
W3CToUTg
--- 8aWYUi33mEIKFcFbphlDZumnBu9Xbj+j18dQbElx1v8
3$m(ø<>äÂTK±î·”eAZâ>dn:-­Òí‚¥ˆÅh.(<28>¶U²!rìx D3ô‡4Ø93~È»f{üƒšL¸Î þÆ£ÃØ>Þß^vl—¡Î-=„í¯ä£<C3A4>ÉU'â»(#;¤ªHñÆ@M%|ʦ

View file

@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg dgS4bezgtDi44R1A8am+J6zh80kUVYTo1heaxJCtzX4
F3w/62xwtqYa40NU7OvF9pnZzYz/5hACAGJfMA4e2zw
-> ssh-ed25519 jPowng lx81CK3yeNp9RjHCUFJeKYZlRzxBmXuADVBvRc13zCI
P7e75t8xU+ZkYmeQ8mmMfyZZsRdG1J8yrvSUkiWzkFQ
-> *z4/`-grease S/)a{e sFd";=
--- 15FVhqRTkoPFEeETRRyFQhsv4Fn19Ozlax0u8Zy9mNA
õ#+¥àÎvøSÈ4èá}<7D>§Rì%ίF4fnDœ˜J¹¤Z¸A¥Û™,_

10
secrets/drone/gitea.age Normal file
View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg vLLu1kbzyGxr5sU/Dl4xf0uGO+gVsvODiqEJU21lwyI
LbJO4Go+8G7/UtFWjv+x7Nqhn7n+kge/oHP8dGCBnM8
-> ssh-ed25519 jPowng obxX4ojPwp/DaerFzVbK5hUnshebh/chriT3a7uqYEw
x9jpbBefJZHz8o1lEkr48XhT7sVAM5tq3tZ8M91CDDo
-> eZ.G`B3W-grease 6k|.\v
D0u3P4oCpPNnueqZAAYn71xEUGWlavwLTrEXJ+2tdYOX6BwwFReOlMZWIA+FikmZ
8Pg7dHnbYPWc33jMjv3UnNsxCGUsDw9C9NkI5vfZSLvUxQ
--- Cea09ivsGZeoWif7xbdrvfoGsoiD+tRh7HQsOL75cqE
tFa˜|GÐ, ìoå6Öù$ë×ý…U«"âwiß¹ªÈS½Ó¿î×ghµ6^Ð*=¬¦©[¬g1%çVuäápû©-™ï{`ÑPÅ(?&¼QV#îKeåX•4dß÷KÞ:šxt‰0LsbÆ6Þœßü Ð[¡ #E[¬í•¹ì>Ë)|cwÅëÑqŸÊö+cÄõ¶þÕw1$ÓÌý×Ò^I(wGÕ¡ç9>jIâ(yÌ!@O«ƉkE¼z]áí«Pk

9
secrets/drone/secret.age Normal file
View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg 1+cLlzctgcM0FnVDwMPOAqBkvMcDBRg8SvCw4djI93Y
oV2XI4f1AvM9P591kZZ6NgJXa+SDtqGzCSgc4psOmxM
-> ssh-ed25519 jPowng Ufjfh1p350XxRPg95+/DHdmnl4lC0bbzUUlaxd1Bmxc
/RHwFDSn2ov+60r1uHUigrsn99+GmmKmlk4h4T2gbA0
-> *Lc$@-grease
pzVJAHy1qRq3jUrnFV0DDO7/hwV1US4Ogf0RsrVfX0xzbr73uJ003YjieVB25LqN
--- ME7/iVevyiguyhXugbkVFGzJV0yDccyKNlWbEZa/FmY
YžŠXjb2uþnd;i0íýX]…§é0þL„PÔT~óú ƒÙ^kc”$D×ÚÛr¹úu³¶fr€e¸¸þ<C2B8>+p•¨<E280A2><C2A8>&ãw®öϨ

Binary file not shown.

Binary file not shown.

9
secrets/lohr/secret.age Normal file
View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg HCVbkI26JjkBgm1L2cpunVui0PfHLNfnx6VczErF3A4
3jEHfT6wUqNNFZFaVeiNBUhSKZmuKclPmubDMsda5O8
-> ssh-ed25519 jPowng SyClv9kGtjRKSXdig27tiqp66wD1T8QsHeOD2JQl4QA
8zdtfSJEh5/bfu5tb6M8Jgy5CZPiWD8TLQDpzp6cTr0
-> 3r2-grease
Lg/G911eZjeZTw5xhqje26vDfJkcSro+gKQ5SUboxLMnaibNi1qTeRLR
--- Q5/fikhVPoK+NFujTso5V7cty4k/dQlzFlz5z9DkzYk
øt/ŒWAMuˆ"Þêð´<>ó-!@ ¨E1¯”<C2AF> äR[eŽhÖû3 ëŒÉÐScoÝBt1TýØb¨äÀ3möP×Tc¤feP

9
secrets/matrix/mail.age Normal file
View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg lmu3MinmydRHD0A/YVRRtopermfoBC8M8cTHfVanY1s
ygrtpZZJ7aeQTblNazpoP7DdifmDxHsE3DFJsIrWX5M
-> ssh-ed25519 jPowng X0cihOc+fBtmtrkEivIHQngdYIobezXEF1x+pHqNzAw
/+sw9x1NWY0anZhDMpAywBPrR0F4XCHaF9e8j/Yo/kI
-> 32;%1s-grease
JafjuSZty6a4NSO/y4y5wHWL8Mw
--- dwCl66vdpsL0MR5NWWvg3JUnQ2QZQBeW0Dj0l5tvOKY
oi,`ÓÜ#uÄwW%PoubÚ­cy8<79>ó ƒÃÉ><¿F‰Ååq…ÂKÃÇk0Çk/<2F>hÀ¥Ÿ5势ÝF+ýu‡ •e<06>¾Ÿ²óôbãè>1QŠ2®ñwn˜WbÖB˜âî<C3A2>iŸ^xurâ†- /llùÒÀÀ-ã=°7;jã0»I×%Fi¼<69>í€ø™A;Y†ìUd]KÅI0(½ ”øAg£Ðóž^†uG:äpkJŸ:q<>¢šWSaLw¯¿Ô!ïM³4ã L/ùZŇ®¢D¶-XéUb»vÊbPó0ÇÅfÂ9êú<08> †âJ`ÃX°ôÐOÅ!s{ÙÄQAšc€c;ÏÃÑ4öMíچݹ lxH&ïéöé{é}ÁäÛzZ¦œ9ûÊXžÜ“g‰]Vϱ•0gt¡¿…žw·

View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg ociW6AZww4nfW0Dw0DB0WNgQbJ3MNkHPPZlA0z+o/mI
THAz89pjyrkxJB9tPQGgEwZrZX9OudWMnyzr0JiwzTA
-> ssh-ed25519 jPowng 1werbtuWK0DUFxq9mAWp/QzMHC1B8UfadutvK6+j9XE
YmAwYo3X00gMB9AyQfOsR82CUPAtxfuzCzP4OyYFxjc
-> 8g-grease N9DR4 .U<
--- Cwh2hPrM2RzRroJRw3XrP1khcpL0leTXfJ+T7WG57To
¡Â±jÏ°LæDFºðÔ xux<75>ý1
U/âàoÚGgoãË)Çê÷*Þï/Ç”dÈ"L#RõÄhW Íû«

Binary file not shown.

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg OdLtFHbHbc28rUn47vgsVvXxFNg9nF+9y9R6XOK390Y
yQQYUPQGjN2+xrSqqBYa7/zS618KrVjX5Amw2MFuSLg
-> ssh-ed25519 jPowng NwUjiLtiXVi6XFmht5l1CxEs3gm0oN4vHYwDZyda7Q4
di6znVjNRO6QdqteVNkeot5Ko2NwWLe6v+zVR3f+o10
-> 4Vx%\(-grease ^^Z>EC91 R 2BJ d48Wip*s
yPiBgChRF31XgxccQFLO3MzRL7+5s29sfRoF3W1yUX6Bu59MpxD4D+n/jhLcxSH/
CxW7KaiOctNmPm5tWh6qjmgQ+V4bcAji5vo4FKs40l56cfyueEJj+Q
--- WUGF28zqK9E1AlOeeCtSHxFg6ikRy85gOoLtBd4m0y0
.|…rr>©†ðìì1ÅÆ2SÉž.×hw<12>w qºš%i˜øé *U^­)Öè'qžµO2ÓœümòQÝ7˜¯m`

Binary file not shown.

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg zhpo89xef68JoeOFWzhdFshrj2BXXUCFPMLVJzv6EyE
fmJxJi5rmyai9qGwDo7iHg4BrObGre96KCpl+g91O6I
-> ssh-ed25519 jPowng INA6EZdy4J1p3QY5mfVOQXiLdOjIDaZR+CZMP+GfkXM
8Nf5soaxY5SEzeJca5kaJkx7ByOvc4NkJVetB7wpEmo
-> xjK'w-grease
f5v0cvlt4JbHlAwDOob86qOInWdlN/oohTg
--- NTGv4rr+MhJ/YeZhVHOjoS1V+zCHFf2itJYfK36R+wE
š×—®JÚ dő oŞę'YFUź@
r7”ă“_N$‰˙Ź–č‡>‚ˇę]hq»-¨FŰ°qX˙?Î| Ę

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg tZwn2usN6K62oS4vBa6boh9zEp/+cS4chP8boXG6SH4
Fr3kV8gUDoiDqMxPYWsHyww8umYhQEKhqbVBiVw5NeI
-> ssh-ed25519 jPowng wRbJl4G85obH/GluQBBsXE7MOvooEui65eqHfurvuQs
KqVZMBSyHhkayEdwI6ocmA4qhHY9zYJvg1CEKM1SOa0
-> 2E"/OFW-grease o Qp3HFe^
bGhCNicPqt7txqxUiEWXCFs1OuQLqOqHmjHSqYQv919dqYep/xBXzi/aRf3dsdvh
TCJCTvZG31Qxvikp
--- xKJGbdVp+Z5h0vCBleSF2zYYYd2S5i0y4szNqjRwrDY
Tª /N¯<4E>¨¹i7m4#³MhiñP¹šÒÞ›Á¥-ÏgI÷ñ±%@E†(iÿ7·ý©ýYg¦k±´"+㸠Àª(þ]o¨¸ý†ð<E280A0>@báÊÞ§+Ï[Y"ÿÌBóóCR[ >-Ë.4d…¤b9v

View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg 8rcBI7fYHuA3jO6EzJNFaAj2niIApKDt1HQEv61AKTs
ANxkIX/CeI7t7Zqp6wmjt/D194Z+xpeiidb+qvYzoQU
-> ssh-ed25519 jPowng oruewwTM9X/HjjcmOPcQVdp02rQBlgJPdzvlAffs3T0
MrO0kaNhjgOkNHuz3NrIMWXNrXOHH9dT/Fk6hoQNKyY
-> COK%H7-grease
6yfI90QurOKlM+kgpW8KZ/iBzDYD9yhNmjG1LQ
--- uArz8eHg8sLO0sdlkM6cELFh+FHiI5BrM0+iXJxxiDo
¿vývû´ÊNÊbæ@Ÿ¡Â<C2A1>FÛMMíYËÆíÌ&‰’/%¤¹Ñm¨®ØtÁÖ“ªd†h„­|¡ðŒß©8¼Ž Ú½¨9®<11>Cã¯/Å

49
secrets/secrets.nix Normal file
View file

@ -0,0 +1,49 @@
let
# FIXME: read them from directories
ambroisie = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIVd6Oh08iUNb1vTULbxGpevnh++wxsWW9wqhaDryIq ambroisie@agenix";
users = [ ambroisie ];
porthos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICGzznQ3LSmBYHx6fXthgMDiTcU5i/Nvj020SbmhzAFb root@porthos";
machines = [ porthos ];
all = users ++ machines;
in
{
"acme/dns-key.age".publicKeys = all;
"backup/password.age".publicKeys = all;
"backup/credentials.age".publicKeys = all;
"drone/gitea.age".publicKeys = all;
"drone/secret.age".publicKeys = all;
"drone/ssh/private-key.age".publicKeys = all;
"lohr/secret.age".publicKeys = all;
"matrix/mail.age".publicKeys = all;
"matrix/secret.age".publicKeys = all;
"miniflux/credentials.age".publicKeys = all;
"monitoring/password.age".publicKeys = all;
"nextcloud/password.age".publicKeys = all;
"paperless/password.age".publicKeys = all;
"paperless/secret-key.age".publicKeys = all;
"podgrab/password.age".publicKeys = all;
"sso/auth-key.age".publicKeys = all;
"sso/ambroisie/password-hash.age".publicKeys = all;
"sso/ambroisie/totp-secret.age".publicKeys = all;
"transmission/credentials.age".publicKeys = all;
"users/ambroisie/hashed-password.age".publicKeys = all;
"users/root/hashed-password.age".publicKeys = all;
"wireguard/aramis/private-key.age".publicKeys = all;
"wireguard/porthos/private-key.age".publicKeys = all;
"wireguard/richelieu/private-key.age".publicKeys = all;
}

Binary file not shown.

Binary file not shown.

BIN
secrets/sso/auth-key.age Normal file

Binary file not shown.

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg mP2H3PWJN6Pv3q6C2wci3KnXjtFAIiuGy0YH0sGIy2g
f43QqyUQfTYznszub47kgc2Mz95zVScTDkwnG3INi9U
-> ssh-ed25519 jPowng fENbu7+FZ1mnQQHQCLm1spLHmsQGlRoJResUJtGzYkY
hX+AqCkLCca6m/aKtGCThi7/mCCz/TZQNJNOlOmlqyA
-> J<-grease
n7+CPRr4oazWnE7yzpJN2ZAI4QrGsAerloP4wNeebjQDx8+IxJq1JE0g3Yi0RxzN
chDccuSPLYk45Ov+SD/qqqFZlQ
--- p81HYw3LFj+qz2kiZsDcevM4ZBfvN743P9Jdi7J9XkM
¢ìÛ±S·7 <EFBFBD>ý£÷ÜãV»»Bðßâø±³ˆ¶ïO‰lEt˜Á…šqý</Ç—Ø©9²ã(ØP†$Wƒ0h;÷‰±àJy¯feø >·_D,PºVFp\æ"AM}èg?<3F>ÿ<EFBFBD>Ý/\²Ä;ùy ¬Óš(<28>ÑSñKË

View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg vOaL2ZKsFEjX9mzQvw8Je7x2Dq8cMhrZEyBTXpH4QnE
HXO4fbWdJsbsRmGq0IYzq8/szObxzpsGfQNNTJ4vNzg
-> ssh-ed25519 jPowng WPxg0pP6O3ZS4dPc1WcDvzig22Fylk3mR/W9STaWbW4
GuhFwt7M5Lc38q2LC/0eul0yP60UxmWwi9I8ToHv7bE
-> :;V8\-grease ZC#7~eR# P<'e?vI3 9R
lZlb44QiAaIxd0SYiRNT/QRnxxUt7npbksg
--- 9xv4lt8IcGR8jP0UcKYYnTuh1Ix/pqXgDmevkTH9j1A
Ï]ºcÓ3óxí wÿ'ã ` <0B>ùhçÒ=X¨í·¢Çg3ÆÆÄ]~ËôÞqÙ.XnÄa*€±W:<3A>¸±,â©z®vyzñI¦æ }ÂDO=`êw“ñõ¹ˆ7:™ù“ÐRx•5$¨Ö6:ö¨´"õ,HM„<4D>"_ëÞòMÛMƒœˆBJe‰ùFá

Binary file not shown.

View file

@ -1 +1,2 @@
/default.nix filter diff
public-key.txt filter diff

Binary file not shown.

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg +WwRpd2MzycutQFXyLsr2+GzSgF67Z6UuvyqYZaLd3w
sppt8HzaZP3yxnvnhzjl18Trnz8g3VyXJ6CaVBWd7jA
-> ssh-ed25519 jPowng wanoqGB7T8bim/WZ4IAYViFQoGzaIZSgeoTr3YKpeTY
ihDAdGa1XVW/qQz40V1v7a7iK7tu0EHMa7ayIogpcRw
-> l-grease |PIcZ NIr >0;*
4o8o0bevQZ6uDSx1WxxlDCURbFCM+yK1XPdrb9aztCSvG2a+ne78E42l5rBcoH7I
m51A8uWS4nSj36N/76v6K4kelxKzWUg
--- O6cGbTAVbDcdmPHf7UzfZiyiRtu1yfL4sBI+CkJA1qw
ýqýŐ$ň`żw'čS“X¸]Ąá÷ř®úî…?¤6Đ/ĆN(Bžň N«a” HŽ7żí•I<E280A2>ú÷Ŕoz‡/4:sK",7J

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg rYhrpoTaFjLBGtbCXxEK7jZa+KnriEV/kWViIEjmuQs
jHMSjxKIIqjUnpAcEo3JgsieI1iiA5/gKEx8+QFhDgY
-> ssh-ed25519 jPowng 6sQQFvSbWdjgDYSKmJ/CBG+BTzxFghX4SaJ4GyACKWc
OABJuh+Ta8q+G0onF/9bz3xxv4zTlHYlF4AjC5P6Y6I
-> xwW|#D`-grease $xYH C m8lBk9
OBqgvLNIurE0qNaSB7dO2/6dQkVXeLgf/3l9gGlRJ6ynhqwmbXOUa0vyj+OBz27O
uI97+0y1TFAs3HN0Y8nj8LrwsafbDENu99JuVow2OuLKeSqc7sxOQQ
--- 9filSHStPTJJGDLY7AWzIXu/6tK4X0okT522sc4OJTc
M{イ顗仭$ケ:Nル災[ンカャ2xy8&腴_{RワLX<4C>W√€<E2889A>サxム*Pr`セUイp<EFBDB2>Jノ枇鵲#藝ヤ<E8979D><EFBFBD> s