superconfig/machines/neoprism/ at master · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at master

Hermes modules.backup: encrypted repos in per-machine storage box sub-accounts 1d ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

modules.backup: encrypted repos in per-machine storage box sub-accounts Every machine now backs up into its own Hetzner storage box sub-account (isolation: one machine's ssh key can't read or delete another's archives), into ./borg in the sub-account's home. lass.backup.user replaces lass.backup.repo and enables the job; host, port 23 and the box's host key are module defaults, so a machine's backup.nix is only the sub-account. Repos are always encrypted (repokey-blake2). The passphrase comes from a per-machine clan vars generator borgbackup-repokey; it lives in the password store, so passphrase + repo are enough to restore. The borgbackup ssh key generator is unchanged. neoprism moves to a new repo on u550643-sub1 (doInit creates it); the old unencrypted repo u550643@...:/./neoprism is no longer referenced and is removed by hand. Its paths, excludes and hooks are unchanged. The job stays `hetzner`: with fresh repos nothing gains from a rename, and the unit name is used for the postBackup hooks. The timers get a fixed random delay of up to 1h after 03:00, so the machines sharing the box don't all start at once.

1 day ago

modules.backup: per-service backup state, move neoprism paths into their services lass.backup.state.<name> lets every service declare its folders, excludes, pre/post backup hooks and the paths its pre hook writes to next to its definition. The borg job (still `hetzner`, so archive names and pruning continue) and the borgbackup ssh key generator exist only on machines that set lass.backup.repo; neoprism's backup.nix now only points to the storage box. Pre hooks run inside the borg unit as before; each runs on its own with pipefail, all of them run and the job fails if any did (a failing pg_dump used to go unnoticed behind the gzip pipe). Post hooks run in ExecStopPost as root, also after a failed backup. The four bridge dumps are split from the old loop into the bridges' files. The dump subdirs are created by the hooks instead of tmpfiles. hedgedoc's uploads directory is backed up now. The imgur items (hedgedoc image uploads) are backed up now too.

1 day ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

machines.neoprism: add facter.json

2 years ago

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

1 week ago