This repository has no description
orange: define secret generator in container, reference key outside
author
lassulus
date
(Mar 17, 2024, 6:34 AM CET)
commit
c0f8be75
c0f8be756f62fed1a610f91748a371d1b800dd43
parent
ed9c5937
ed9c59371d5fbb1c065f539dd1b223cc9b2c4bc0
+18
-2
+7
2configs/orange-host.nix
+7
2configs/orange-host.nix
···
21
21
proxyPass = "http://orange.r";
22
22
};
23
23
};
24
+
clanCore.secrets.orange-container = {
25
+
secrets."orange.sync.key" = { };
26
+
generator.script = ";";
27
+
generator.prompt = ''
28
+
copy or reference the secret key from the container into here, so we can actually start/sync the container
29
+
'';
30
+
};
24
31
}
+11
-2
machines/orange/config.nix
+11
-2
machines/orange/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
imports = [
4
4
../../2configs
···
19
19
20
20
krebs.sync-containers3.inContainer = {
21
21
enable = true;
22
-
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQWzKuXrwQopBc1mzb2VpljmwAs7Y8bRl9a8hBXLC+l";
22
+
pubkey = builtins.readFile ./facts/orange.sync.pub;
23
+
};
24
+
clanCore.secrets.orange-container = {
25
+
secrets."orange.sync.key" = { };
26
+
facts."orange.sync.pub" = { };
27
+
generator.path = with pkgs; [ coreutils openssh ];
28
+
generator.script = ''
29
+
ssh-keygen -t ed25519 -N "" -f "$secrets"/orange.sync.key
30
+
mv "$secrets"/orange.sync.key "$facts"/orange.sync.pub
31
+
'';
23
32
};
24
33
}