This repository has no description
services radio: remove redundant redirect, add secret generators
author
lassulus
date
(Mar 17, 2024, 11:33 AM CET)
commit
671fe212
671fe2124664d39d650c9140f86f81207551a59a
parent
2aed474b
2aed474b29fa7d0fd0bf54a002c98c42e307b290
+16
-10
+11
-1
machines/radio/config.nix
+11
-1
machines/radio/config.nix
···
18
18
19
19
krebs.sync-containers3.inContainer = {
20
20
enable = true;
21
-
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt";
21
+
pubkey = builtins.readFile ./facts/radio.sync.pub;
22
+
};
23
+
24
+
clanCore.secrets.radio-container = {
25
+
secrets."radio.sync.key" = { };
26
+
facts."radio.sync.pub" = { };
27
+
generator.path = with pkgs; [ coreutils openssh ];
28
+
generator.script = ''
29
+
ssh-keygen -t ed25519 -N "" -f "$secrets"/radio.sync.key
30
+
mv "$secrets"/radio.sync.key "$facts"/radio.sync.pub
31
+
'';
22
32
};
23
33
}
+5
-9
2configs/services/radio/container-host.nix
+5
-9
2configs/services/radio/container-host.nix
···
17
17
isReadOnly = false;
18
18
};
19
19
};
20
-
krebs.iptables.tables.filter.INPUT.rules = [
21
-
{ predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
22
-
];
23
-
krebs.htgen.radio-redirect = {
24
-
port = 8000;
25
-
scriptFile = pkgs.writers.writeDash "redir" ''
26
-
printf 'HTTP/1.1 301 Moved Permanently\r\n'
27
-
printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
28
-
printf '\r\n'
20
+
clanCore.secrets.radio-container = {
21
+
secrets."radio.sync.key" = { };
22
+
generator.script = ";";
23
+
generator.prompt = ''
24
+
copy or reference the secret key from the container into here, so we can actually start/sync the container
29
25
'';
30
26
};
31
27
}