superconfig/machines/neoprism/ at 5765df7999df3e2e7c411dc5ece7eef75287259f · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at 5765df7999df3e2e7c411dc5ece7eef75287259f

Hermes configs.byoidc: init on neoprism (byoidc.lassul.us) 3d ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

machines.neoprism: replace pocket-id with zitadel on id.lassul.us Zitadel 2.71 from nixpkgs as a federated IdP with open self-registration: registration, external IdPs and passkeys allowed in the default login policy, first instance "lassul.us" with admin user lass (lass@lassul.us). The masterkey and the admin's initial password come from the zitadel clan vars generator, the password via an extra steps file so it never hits the store. Postgres via peer auth over the local socket. ensureDatabases/ensureUsers create the database and owner role, so the zitadel role gets no CREATEROLE/CREATEDB (on PG15 CREATEROLE is close to superuser). That needs `init zitadel` + start-from-setup instead of the module's start-from-init, whose init always tries CREATE USER/CREATE DATABASE and fails on the permission check before the "already exists" check. nginx terminates TLS and talks h2c to Zitadel via grpc_pass, as Zitadel's reverse-proxy docs require for its gRPC APIs. Machine identification by hostname, since the default private-IP/GCP-webhook probes don't fit neoprism. The database is pg_dumped by the borg preHook; gatus checks /debug/healthz. Zitadel 2.71 does not work with PostgreSQL 18 (migration 34_add_cache_schema creates unlogged partitioned tables), neoprism runs 15.

3 days ago

configs.byoidc: init on neoprism (byoidc.lassul.us) byoidc lets people sign in with their own OpenID provider; Zitadel will offer it as one generic OIDC IdP. The downstream client "zitadel" gets its secret from a prompt-less clan var, which root-owned is fine for both byoidc (LoadCredential) and zitadel-reconcile (root). Its state (cached upstream clients, signing key) is not backed up: subjects are derived from issuer and upstream sub, a new signing key is picked up through JWKS, and upstream clients are registered again on demand.

3 days ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

machines.neoprism: add facter.json

2 years ago

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

1 week ago