remove obsolete infra
This commit is contained in:
parent
cd63ec45b8
commit
c1e09364bb
22 changed files with 0 additions and 1012 deletions
35
.sops.yaml
35
.sops.yaml
|
|
@ -1,45 +1,10 @@
|
||||||
keys:
|
keys:
|
||||||
- &admin_oxa DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
- &admin_oxa DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
||||||
- &cirrus age1qm70jkg7us4ft4x3nh7kwxlul022kteescjj83ywvjhysj6nsq5sw7l6p8
|
|
||||||
- &dishwasher age18t2dc53m7a53996fwcmuanwjtxxvvgkntpmdvd3q42pnkch6rajqnm4up8
|
|
||||||
- &nextcloud age1ds7zgenz9a664jqx5308m6q5mgtavzmelg239xsj8mdh64pmqa9qtkffmk
|
|
||||||
- &toaster age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
|
- &toaster age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
|
||||||
- &music age1aj7mgq8jxv0n5rnpqtgu4l56ymqyq86qacn3jp7ve2emk0eheuaqgm4rtt
|
|
||||||
- &news age1dwem3slsm04jpmje2ru5n7fujkmz2kvhdat5htx2xnc2yqtyefeqchwx7f
|
|
||||||
creation_rules:
|
creation_rules:
|
||||||
- path_regex: secrets/cirrus/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *admin_oxa
|
|
||||||
age:
|
|
||||||
- *cirrus
|
|
||||||
- path_regex: secrets/dishwasher/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *admin_oxa
|
|
||||||
age:
|
|
||||||
- *dishwasher
|
|
||||||
- path_regex: secrets/nextcloud/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *admin_oxa
|
|
||||||
age:
|
|
||||||
- *nextcloud
|
|
||||||
- path_regex: secrets/toaster/[^/]+\.yaml$
|
- path_regex: secrets/toaster/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- pgp:
|
- pgp:
|
||||||
- *admin_oxa
|
- *admin_oxa
|
||||||
age:
|
age:
|
||||||
- *toaster
|
- *toaster
|
||||||
- path_regex: secrets/music/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *admin_oxa
|
|
||||||
age:
|
|
||||||
- *music
|
|
||||||
- path_regex: secrets/news/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *admin_oxa
|
|
||||||
age:
|
|
||||||
- *news
|
|
||||||
|
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
||||||
|
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
# Use the GRUB 2 boot loader.
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
boot.loader.grub.efiSupport = true;
|
|
||||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
|
||||||
|
|
||||||
zramSwap = { enable = true; algorithm = "zstd"; };
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "cirrus"; # Define your hostname.
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network = {
|
|
||||||
enable = true;
|
|
||||||
networks."uplink" = {
|
|
||||||
matchConfig = { Name = "enp1s0"; };
|
|
||||||
networkConfig = {
|
|
||||||
Address = "95.216.166.21/32";
|
|
||||||
DNS = "9.9.9.9";
|
|
||||||
};
|
|
||||||
routes = [
|
|
||||||
{
|
|
||||||
routeConfig = {
|
|
||||||
Gateway = "172.31.1.1";
|
|
||||||
GatewayOnLink = true;
|
|
||||||
Destination = "0.0.0.0/0";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
# Set your time zone.
|
|
||||||
time.timeZone = "Europe/Amsterdam";
|
|
||||||
|
|
||||||
# Select internationalisation properties.
|
|
||||||
i18n.defaultLocale = "en_US.UTF-8";
|
|
||||||
# Open ports in the firewall.
|
|
||||||
networking.firewall.enable = true;
|
|
||||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
|
||||||
# Or disable the firewall altogether.
|
|
||||||
|
|
||||||
# Copy the NixOS configuration file and link it from the resulting system
|
|
||||||
# (/run/current-system/configuration.nix). This is useful in case you
|
|
||||||
# accidentally delete configuration.nix.
|
|
||||||
# system.copySystemConfiguration = true;
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "22.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./configuration.nix
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./nextcloud-proxy.nix
|
|
||||||
./secrets.nix
|
|
||||||
./wireguard-server.nix
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,39 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[
|
|
||||||
(modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{
|
|
||||||
device = "/dev/disk/by-uuid/627952eb-107a-43c3-8223-bfea9af92837";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{
|
|
||||||
device = "/dev/disk/by-uuid/5CA6-CCE4";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault false;
|
|
||||||
networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
|
|
||||||
|
|
||||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
|
|
@ -1,46 +0,0 @@
|
||||||
{ pkgs, config, ... }: {
|
|
||||||
services.nginx = {
|
|
||||||
# reverse-proxy irc traffic on 7000
|
|
||||||
streamConfig = ''
|
|
||||||
upstream soju {
|
|
||||||
server 127.0.0.1:6667;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 7000 ssl;
|
|
||||||
listen [::]:7000 ssl;
|
|
||||||
|
|
||||||
ssl_certificate /var/lib/acme/mrbouncy.oxapentane.com/fullchain.pem;
|
|
||||||
ssl_certificate_key /var/lib/acme/mrbouncy.oxapentane.com/key.pem;
|
|
||||||
ssl_trusted_certificate /var/lib/acme/mrbouncy.oxapentane.com/chain.pem;
|
|
||||||
|
|
||||||
proxy_pass soju;
|
|
||||||
}
|
|
||||||
'';
|
|
||||||
# just here to get the cert for irc reverse proxy
|
|
||||||
virtualHosts = {
|
|
||||||
"mrbouncy.oxapentane.com" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
locations = {
|
|
||||||
"/" = {
|
|
||||||
# no content for now, here just for no-boilerplate cert
|
|
||||||
return = "204";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.soju = {
|
|
||||||
hostName = "mrbouncy.oxapentane.com";
|
|
||||||
listen = [ "irc+insecure://127.0.0.1:6667" ];
|
|
||||||
enable = true;
|
|
||||||
enableMessageLogging = true;
|
|
||||||
acceptProxyIP = [ "localhost" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.systemPackages = [ pkgs.soju ]; # expose soju mgmt commands
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 7000 ];
|
|
||||||
}
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
{ config, pkgs, ... }: {
|
|
||||||
security.acme = {
|
|
||||||
defaults.email = "acme@oxapentane.com";
|
|
||||||
acceptTerms = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
|
|
||||||
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts = {
|
|
||||||
"nc.oxapentane.com" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
extraConfig = ''
|
|
||||||
client_max_body_size 512M;
|
|
||||||
'';
|
|
||||||
locations = {
|
|
||||||
"/" = {
|
|
||||||
proxyPass = "http://10.34.45.100:8080";
|
|
||||||
};
|
|
||||||
"/well-known/carddav" = {
|
|
||||||
return = "301 $scheme://$host/remote.php/dav";
|
|
||||||
};
|
|
||||||
"/well-known/caldav" = {
|
|
||||||
return = "301 $scheme://$host/remote.php/dav";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
"music.oxapentane.com" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
extraConfig = ''
|
|
||||||
client_max_body_size 32M;
|
|
||||||
'';
|
|
||||||
locations = {
|
|
||||||
"/" = {
|
|
||||||
proxyPass = "http://10.34.45.101:4533";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
"news.oxapentane.com" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
extraConfig = ''
|
|
||||||
client_max_body_size 32M;
|
|
||||||
'';
|
|
||||||
locations = {
|
|
||||||
"/" = {
|
|
||||||
proxyPass = "http://10.34.45.102:8080";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{ config, ... }:
|
|
||||||
{
|
|
||||||
sops.defaultSopsFile = ../../secrets/cirrus/secrets.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
|
|
||||||
sops.secrets = {
|
|
||||||
"wg/oxalab-seckey" = {
|
|
||||||
owner = config.users.users.systemd-network.name;
|
|
||||||
};
|
|
||||||
"wg/oxaproxy-seckey" = {
|
|
||||||
owner = config.users.users.systemd-network.name;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,123 +0,0 @@
|
||||||
{ config, ... }:
|
|
||||||
{
|
|
||||||
networking.firewall = {
|
|
||||||
allowedUDPPorts = [
|
|
||||||
# wireguards
|
|
||||||
51820
|
|
||||||
51821
|
|
||||||
34197
|
|
||||||
];
|
|
||||||
allowedTCPPorts = [
|
|
||||||
# port forward ssh to music
|
|
||||||
2020
|
|
||||||
];
|
|
||||||
# port-forward ssh to the music machine
|
|
||||||
extraCommands = ''
|
|
||||||
iptables -t nat -I PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22
|
|
||||||
iptables -t nat -I PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197
|
|
||||||
iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE
|
|
||||||
'';
|
|
||||||
extraStopCommands = ''
|
|
||||||
iptables -t nat -D PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22 || true
|
|
||||||
iptables -t nat -D PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197 || true
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
networking.wireguard.enable = true;
|
|
||||||
|
|
||||||
systemd.network = {
|
|
||||||
# oxalab
|
|
||||||
netdevs."oxalab" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Kind = "wireguard";
|
|
||||||
Name = "oxalab";
|
|
||||||
Description = "oxa's enterprise network";
|
|
||||||
};
|
|
||||||
wireguardConfig = {
|
|
||||||
PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
|
|
||||||
ListenPort = 51820;
|
|
||||||
# own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=
|
|
||||||
};
|
|
||||||
wireguardPeers = [
|
|
||||||
{
|
|
||||||
# microwave
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc=";
|
|
||||||
AllowedIPs = [ "10.66.66.10/32" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{
|
|
||||||
# Dishwasher
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "AdWUBbyeRkxdP9HUu25PpISoxbgQ8oeCw3BmV93xtAw=";
|
|
||||||
AllowedIPs = [ "10.66.66.100/32" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
networks."oxalab" = {
|
|
||||||
matchConfig.Name = "oxalab";
|
|
||||||
networkConfig = {
|
|
||||||
Address = "10.66.66.1/24";
|
|
||||||
IPForward = "ipv4";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
# oxaproxy
|
|
||||||
netdevs."oxaproxy" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Kind = "wireguard";
|
|
||||||
Name = "oxaproxy";
|
|
||||||
Description = "oxa's enterprise reverse-proxy network";
|
|
||||||
};
|
|
||||||
wireguardConfig = {
|
|
||||||
PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
|
|
||||||
#own pubkey 0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=
|
|
||||||
ListenPort = 51821;
|
|
||||||
};
|
|
||||||
wireguardPeers = [
|
|
||||||
# nextcloud
|
|
||||||
{
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=";
|
|
||||||
AllowedIPs = [ "10.34.45.100/32" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
# music
|
|
||||||
{
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=";
|
|
||||||
AllowedIPs = [ "10.34.45.101/32" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
# news
|
|
||||||
{
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=";
|
|
||||||
AllowedIPs = [ "10.34.45.102/32" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "6rwSThPEfTyYvMVSnHNcNPRntCHEQFyscF2SodI8A34=";
|
|
||||||
AllowedIPs = [ "10.34.45.111/32" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
networks."oxaproxy" = {
|
|
||||||
matchConfig.Name = "oxaproxy";
|
|
||||||
networkConfig = {
|
|
||||||
Address = "10.34.45.1/24";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,88 +0,0 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
||||||
|
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
# Use the systemd-boot EFI boot loader.
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "dishwasher"; # Define your hostname.
|
|
||||||
useNetworkd = true;
|
|
||||||
firewall.enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
time.timeZone = "Europe/Amsterdam";
|
|
||||||
|
|
||||||
# fix wait-online target
|
|
||||||
systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
|
|
||||||
"" # clear old command
|
|
||||||
"${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
|
|
||||||
];
|
|
||||||
|
|
||||||
systemd.network = {
|
|
||||||
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
networks."ether" = {
|
|
||||||
matchConfig = {
|
|
||||||
Name = "enp53s0";
|
|
||||||
};
|
|
||||||
networkConfig = {
|
|
||||||
DHCP = "yes";
|
|
||||||
LinkLocalAddressing = "ipv6";
|
|
||||||
IPv6AcceptRA = "yes";
|
|
||||||
};
|
|
||||||
dhcpV6Config = {
|
|
||||||
WithoutRA = "solicit";
|
|
||||||
};
|
|
||||||
ipv6AcceptRAConfig = {
|
|
||||||
DHCPv6Client = "yes";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
networks."aer" = {
|
|
||||||
matchConfig.Name = "wlan0";
|
|
||||||
networkConfig = {
|
|
||||||
DHCP = "yes";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.resolved = {
|
|
||||||
enable = true;
|
|
||||||
fallbackDns = [
|
|
||||||
"8.8.8.8"
|
|
||||||
"2001:4860:4860::8844"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
i18n = {
|
|
||||||
defaultLocale = "en_US.UTF-8";
|
|
||||||
supportedLocales = [ "all" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Copy the NixOS configuration file and link it from the resulting system
|
|
||||||
# (/run/current-system/configuration.nix). This is useful in case you
|
|
||||||
# accidentally delete configuration.nix.
|
|
||||||
# system.copySystemConfiguration = true;
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "22.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./configuration.nix
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./secrets.nix
|
|
||||||
./oxalab.nix
|
|
||||||
./mcvm-network.nix
|
|
||||||
./microvms.nix
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,112 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[
|
|
||||||
(modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" "r8169" ];
|
|
||||||
boot.initrd.kernelModules = [ "r8169" ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" "r8169" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{
|
|
||||||
device = "rpool/nixos";
|
|
||||||
fsType = "zfs";
|
|
||||||
options = [ "zfsutil" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/nix" =
|
|
||||||
{
|
|
||||||
device = "rpool/nixos/nix";
|
|
||||||
fsType = "zfs";
|
|
||||||
options = [ "zfsutil" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/home" =
|
|
||||||
{
|
|
||||||
device = "rpool/userdata/home";
|
|
||||||
fsType = "zfs";
|
|
||||||
options = [ "zfsutil" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/var/lib" =
|
|
||||||
{
|
|
||||||
device = "rpool/userdata/var-lib";
|
|
||||||
fsType = "zfs";
|
|
||||||
options = [ "zfsutil" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{
|
|
||||||
device = "/dev/disk/by-uuid/A8AA-1CC4";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "X-mount.mkdir" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[{
|
|
||||||
device = "/dev/disk/by-partuuid/f9712640-96a5-46e1-b07d-53b0cba19057";
|
|
||||||
randomEncryption = true;
|
|
||||||
}];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
networking.interfaces.enp53s0.useDHCP = lib.mkDefault true;
|
|
||||||
networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
# hostId for zfs
|
|
||||||
networking.hostId = "7da4f1e6";
|
|
||||||
|
|
||||||
# extra zfs settings
|
|
||||||
boot = {
|
|
||||||
loader = {
|
|
||||||
efi.canTouchEfiVariables = true;
|
|
||||||
systemd-boot.enable = true;
|
|
||||||
};
|
|
||||||
supportedFilesystems = [ "zfs" ];
|
|
||||||
kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
|
|
||||||
kernelParams = [ "nohibernate" ];
|
|
||||||
zfs.devNodes = "/dev/";
|
|
||||||
plymouth.enable = false;
|
|
||||||
tmp.useTmpfs = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
# remote unlock
|
|
||||||
boot.initrd.network = {
|
|
||||||
enable = true;
|
|
||||||
ssh = {
|
|
||||||
enable = true;
|
|
||||||
port = 2222;
|
|
||||||
hostKeys = [ "/etc/initrd-ssh/key" ];
|
|
||||||
authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 34" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.zfs = {
|
|
||||||
trim.enable = true;
|
|
||||||
autoScrub = {
|
|
||||||
enable = true;
|
|
||||||
pools = [ "rpool" ];
|
|
||||||
};
|
|
||||||
autoSnapshot.enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
# update the microcode
|
|
||||||
hardware.cpu.intel.updateMicrocode = true;
|
|
||||||
nixpkgs.config.allowUnfree = true;
|
|
||||||
hardware.enableAllFirmware = true;
|
|
||||||
|
|
||||||
services.logind.lidSwitch = "ignore";
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
|
||||||
}
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
{ ... }:
|
|
||||||
{
|
|
||||||
systemd.network = {
|
|
||||||
netdevs."microvm-bridge".netdevConfig = {
|
|
||||||
Kind = "bridge";
|
|
||||||
Name = "microvm-bridge";
|
|
||||||
};
|
|
||||||
|
|
||||||
networks."0-microvm-bridge" = {
|
|
||||||
matchConfig.Name = "microvm-bridge";
|
|
||||||
networkConfig = {
|
|
||||||
DHCPServer = false;
|
|
||||||
IPv6SendRA = true;
|
|
||||||
};
|
|
||||||
addresses = [
|
|
||||||
{
|
|
||||||
addressConfig.Address = "10.99.99.1/24";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addressConfig.Address = "fd12:3456:789a::1/64";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
ipv6Prefixes = [{
|
|
||||||
ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64";
|
|
||||||
}];
|
|
||||||
# networkConfig = {
|
|
||||||
# Address = "10.99.99.1/24";
|
|
||||||
# IPForward = "ipv4";
|
|
||||||
# };
|
|
||||||
# routes = [{
|
|
||||||
# routeConfig = {
|
|
||||||
# GatewayOnLink = true;
|
|
||||||
# };}];
|
|
||||||
# IPForward = "ipv4";
|
|
||||||
# DHCPServer = true;
|
|
||||||
# IPv6SendRA = true;
|
|
||||||
# addresses = [{
|
|
||||||
# addressConfig.Address = "10.99.99.1/24";
|
|
||||||
# }];
|
|
||||||
};
|
|
||||||
|
|
||||||
networks."1-microvm-bridge" = {
|
|
||||||
matchConfig.Name = "vm-*";
|
|
||||||
networkConfig.Bridge = "microvm-bridge";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.nat = {
|
|
||||||
enable = true;
|
|
||||||
enableIPv6 = true;
|
|
||||||
externalInterface = "enp53s0";
|
|
||||||
internalInterfaces = [ "microvm-bridge" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{ inputs, ... }: {
|
|
||||||
microvm.vms = {
|
|
||||||
nextcloud = {
|
|
||||||
flake = inputs.self;
|
|
||||||
updateFlake = "github:oxapentane/nix-config/master";
|
|
||||||
};
|
|
||||||
music = {
|
|
||||||
flake = inputs.self;
|
|
||||||
updateFlake = "github:oxapentane/nix-config/master";
|
|
||||||
};
|
|
||||||
news = {
|
|
||||||
flake = inputs.self;
|
|
||||||
updateFlake = "github:oxapentane/nix-config/master";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
{ config, ... }:
|
|
||||||
{
|
|
||||||
networking.wireguard.enable = true;
|
|
||||||
systemd.network = {
|
|
||||||
netdevs."oxalab" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Kind = "wireguard";
|
|
||||||
Name = "oxalab";
|
|
||||||
Description = "oxa's enterprise network";
|
|
||||||
};
|
|
||||||
wireguardConfig = {
|
|
||||||
PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
|
|
||||||
};
|
|
||||||
wireguardPeers = [
|
|
||||||
{
|
|
||||||
# cirrus
|
|
||||||
wireguardPeerConfig = {
|
|
||||||
PublicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
|
|
||||||
AllowedIPs = [ "10.66.66.0/24" ];
|
|
||||||
Endpoint = [ "95.216.166.21:51820" ];
|
|
||||||
PersistentKeepalive = 25;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
networks."oxalab" = {
|
|
||||||
matchConfig.Name = "oxalab";
|
|
||||||
networkConfig = {
|
|
||||||
Address = "10.66.66.100/24";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
{ config, ... }:
|
|
||||||
{
|
|
||||||
sops.defaultSopsFile = ../../secrets/dishwasher/secrets.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
|
|
||||||
sops.secrets = {
|
|
||||||
"wg/oxalab-seckey" = {
|
|
||||||
owner = config.users.users.systemd-network.name;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
];
|
|
||||||
# Use the GRUB 2 boot loader.
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
boot.loader.grub.efiSupport = true;
|
|
||||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
|
||||||
|
|
||||||
zramSwap = { enable = true; algorithm = "zstd"; };
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "noctilucent"; # Define your hostname.
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network = {
|
|
||||||
enable = true;
|
|
||||||
networks."uplink" = {
|
|
||||||
matchConfig = { Name = "enp1s0"; };
|
|
||||||
networkConfig = {
|
|
||||||
Address = "91.107.193.99/32";
|
|
||||||
DNS = "9.9.9.9";
|
|
||||||
};
|
|
||||||
routes = [
|
|
||||||
{
|
|
||||||
routeConfig = {
|
|
||||||
Gateway = "172.31.1.1";
|
|
||||||
GatewayOnLink = true;
|
|
||||||
Destination = "0.0.0.0/0";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
time.timeZone = "Europe/Amsterdam";
|
|
||||||
|
|
||||||
i18n.defaultLocale = "en_US.UTF-8";
|
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
{ modulesPath, lib, ... }:
|
|
||||||
{
|
|
||||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
|
||||||
boot.loader.grub.device = "/dev/sda";
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
|
||||||
boot.initrd.kernelModules = [ "nvme" ];
|
|
||||||
|
|
||||||
fileSystems."/" = {
|
|
||||||
device = "/dev/disk/by-uuid/e9356185-9812-4873-8822-13c8aef59948";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
fileSystems."/boot" = {
|
|
||||||
device = "dev/disk/by-uuid/6F78-D438";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault false;
|
|
||||||
networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
|
|
||||||
}
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
wg:
|
|
||||||
oxalab-seckey: ENC[AES256_GCM,data:XOBmfM82l686jvqjiqy+VdIollpaX+h1j609j+70CE7thA3CJki2W0neDC0=,iv:6/lsg7r/GHasNWV8lOheEMpoW5HWuRgHtdlGEqK0Dbo=,tag:I1PJC99omIfygb9T1cN1hg==,type:str]
|
|
||||||
oxaproxy-seckey: ENC[AES256_GCM,data:CpFezqXTvt8kpfgkGOY8B0PAMpllSME6UnQ6LsboBJIchbJdeDh7kNOWM5I=,iv:nDHeXMgljendSFprl61Eg5U0YYNP8DAhX10QCyjDDm0=,tag:0FatosVdGl93op5fZl41nA==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1qm70jkg7us4ft4x3nh7kwxlul022kteescjj83ywvjhysj6nsq5sw7l6p8
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtM0Z0M3JWR0s0RDVmbjlV
|
|
||||||
RDJ5OU8zVXh5RW4wbmM1TmNhWVBjK0lxVWswCmhyRHlKQUxNNXpFSmlhNUVpclo3
|
|
||||||
UHhDSWhNUXdwamJRaVhTelI2cldGd0UKLS0tIEpsUStSSmliWVMzVkNhRVVQOExT
|
|
||||||
dkFwVkVHR3hsMUlpRzY4Wm5LYXZlYzgKZC8dlewbtxo0KIQWQ6sy2Kv/qRgNJY3H
|
|
||||||
XGfb11bFdmmfiTY98KsfuhY9nRQRUlRMfjc7pHztUk2hVMEIN8WkXg==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2022-06-19T20:06:54Z"
|
|
||||||
mac: ENC[AES256_GCM,data:cbgablJmCln1886/QiYWx767ZEMTHlSCIdlK2mtXGveRW0+cOoRopuSii2xalCWDxfX7Q4PYBlb2f47tyAP+1S2gJa1WkI8HR5uAXn1ktVJWs25GStKwKW2oZdfCLKW19059W3r4WaCgx2asdeBW5nzF0wXN7J8Cmc3tO9wQ7W0=,iv:zfiK7LCMOTZEwJmySEjRBgVfU4TkJl7xRG+Jn0ykyTw=,tag:ANA6Dkt8dLA9BUmnQPjwAQ==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2022-06-17T11:46:30Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
wcFMA7zUOKwzpAE7ARAAdBKiWQEPLFxr1zskS2nnr10yA7rKWzKTCx9AIpLk9g8k
|
|
||||||
VkzOz5qGznFkPCp+mBecIb71MnjzyHNM8j83AqqjYAQDOxQwO1tgipVxk4cNab/J
|
|
||||||
cFtdZorqt3klkoDUAbvRl2+qB+93m6V7Hrx6BggDU6Xg+eKM/NIHHhy3LLyssuuO
|
|
||||||
bpkO/jNVfRfP98FzkSY23cqT4tnbjbH2vCY9ZpNoiJrhr/S3shWz44vpk+u+dTc/
|
|
||||||
/0Z4N6zj9Hll3uxf4dxaoafsmX9FcqLvtye1BxK8fAxF+gDudkYbCurdl0ZC036C
|
|
||||||
semcLdTlCJVubLiRcxItpeP81zVgxiwm40i+o57R3QLhjzjpckEd2VYGy7TdQDcY
|
|
||||||
/8DRGHlro/OlJFun2qA+8GJix2VPM1CiJWfKTUb2D4dNp2DrmA+CdY0cWNSegS/K
|
|
||||||
0toMtIWGVFCdWjSVWTS8ETXPexyGykA5meIdjNFpcaA4LJVB0Ixi+DqsdDSWQKK4
|
|
||||||
k/khNSA/iUvWGi31+JaJikQDSVMu5iqLL2/cWI9L4JvgKSppRFjruUfu8HxJ8YW4
|
|
||||||
jFPGxrt5aRHe752PaGU93/B4UirZbkNOAjnP/+MyO4ANy6yrQNq8YUJDOEOwe4Mo
|
|
||||||
bYbrzmyWRlv9WR88RUFnciCKQUyffJ26ekVACWUv9Ka84CpuaJuT1hQLKR3Uy23S
|
|
||||||
5gE0mX8xH4vwSv2qiMpACUCKNT1gk8oxjBad82dhaowCaSQNtQhUaLTp0x3M63Ow
|
|
||||||
8iuuwh9VVygSYJuoO5GmxUXkLROCvQO6ZdSBltFNIT86BOIROL+TAA==
|
|
||||||
=oDss
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.2
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
wg:
|
|
||||||
oxalab-seckey: ENC[AES256_GCM,data:CEUuCAiWBWk/Elxx9B/SerbwYUrQ8Eai0/TGr+yOf6YWBrbOwEJROFrFmrQ=,iv:g5gjJtWYRnxZ9WOwaj0xHV9Zz0E1hFdPZxLhL4ctxnE=,tag:vXkUzWxCI4AnKCauFEyCaA==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age18t2dc53m7a53996fwcmuanwjtxxvvgkntpmdvd3q42pnkch6rajqnm4up8
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOUGJESnVNc09IaTVjVUNa
|
|
||||||
ZElDNlZ5eFZiUHRJSmllYjVIK3Vmc2dvY204CjRwZU16Tmw2cGVDUGNYVGtoVnpw
|
|
||||||
VVBPZnB4S0VXQmZYRTZsUzZWblZtYW8KLS0tICthMjRNQitoYmpmcFhiUjhoSFB2
|
|
||||||
c1l0cE1aaWJqS2QvdGNkTThoQTNud1kKnGyInIU9qq/XAgAP5ZQUdq8s8Ia7ohkw
|
|
||||||
jZsrpUg5NdKwHuk+bq7RC02gZfxIUOU0gwWameIt5VHE1xRm3w2HLQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2022-06-18T09:32:06Z"
|
|
||||||
mac: ENC[AES256_GCM,data:CkFQvw8s16Z6XDDiJKZftxImoVLcTlEQWfebpjy+zkuyps+AU7B7sFQmbTJkmDrjCc/rYYJz+ktrwBRxIApOyYGiG9kW5FxhgViBX+F8cTxbITp/Z2Pv/51/v+x/expF3OO6dTXqZHzlnx9Zl++5RZwvejHfakkHgsABdJlXs+w=,iv:WKIuAK/fuh7uyVxuRVtoum4H+8Ludl12wqy48ni0D7c=,tag:IC7F/sqghYnOgy/xeHTtGw==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2023-07-11T21:04:52Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
wcFMA7zUOKwzpAE7ARAAgZdLnYaPRdOjldK1OjvTJxYR4Kpusz8CMSWgwWxZ1oaL
|
|
||||||
9A6DDpF7A/MH8/vZTyyyBjbe2++nf2+1qHaDQ6kfiLLgJD4+EI+zOGC2nYG+O+Ob
|
|
||||||
vnfEX9bMvRytLxo9Q5TvRlgngTtj07inXAnPLG4nJ1c4GZZJYNQ0QOD6jfvl68cL
|
|
||||||
h5Pp1R2RPVqv/hAVO7LX3B9QLLStXpKEy6ObWxVusydsztRR7qpjV2tHl7fw7iXP
|
|
||||||
ohpiicJGgVLaM2WNCzAsqcWxlqi4iejfXDNia0LwNAUTN+sVv0cWUky76r9tKABJ
|
|
||||||
1epkI6F7h4WcKXF5JBPa7kGjHO1QEG8+RX9zhlpTBfPMjeGJbEt9KLS8im3J4Ztu
|
|
||||||
jAvH0zH1v5W690JfqvLxIaVX5xW7g6FQYWLChos9X4UkAQEFUYftWkodtphN3T3j
|
|
||||||
iLfMkyudMLHY5IGTPD/JJ799ZX1+VNA0eBin11GRmgU77nyD3pTsRYsEtfx4zzRX
|
|
||||||
0p1YXutTyFXLxgdQUcBk1COg/S+UyEEQT8XK3ioiI5ZSIxXjv5UgyvefmO3JHUz/
|
|
||||||
i1X8W2aMuyMPGyjjsv5+ZvQnlC38zUvrBNhg5JJYBEUlPpuCCPgSXpHhibL5dgXd
|
|
||||||
/HuzCzYiSqGDl3mr/eYiQ4aiELpUpB6cd5MESXzxrkEjCpZF2H9EDr3xKPb8EVzS
|
|
||||||
UQG6eL5B6ElqxWEHe+VDn5m23vmgEUICHGBw17mqKLW7CrsNh9M7Lfu+FS+BS9WB
|
|
||||||
H6vxBS17Ry3RZPS2JJ5e+ACq5a6SJIalMkoUn5jfniF7cQ==
|
|
||||||
=Qa6R
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.2
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
wg:
|
|
||||||
oxaproxy-seckey: ENC[AES256_GCM,data:8gBeqbtQ3mA3dKlidBOMfxZJZEkR/aVhawW9MJ8t/uDx+f2ciZIlrl/ggLw=,iv:w+gbINc5ORmPO9QZfeR3nzMa6QE3ISqBsIBywplij3w=,tag:oNecMKIuySepT0LiShJ29w==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1aj7mgq8jxv0n5rnpqtgu4l56ymqyq86qacn3jp7ve2emk0eheuaqgm4rtt
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVN0dMNE9aNE1LSkJ4MUhx
|
|
||||||
R1AreTU3Q0ZydTY5azBTWEVGeHZONVpRU1dnCmZYbytWMHZ3SjB1ZUJOcUViM0du
|
|
||||||
WUtqVHZGeDh1dEpBNkhIdTh5UHJDVk0KLS0tIHFwM3VGdTBta3gvb0lMMGd0cVhn
|
|
||||||
aWxpUlNNamxhbTVWc3lDWUVPV1NJbDQKcMLpYKhJu017OtUFDVzUTxyqd1hY0T0C
|
|
||||||
KZjh9NW7TRZGEqImzxAYkma9naFgpCgktyfrJfxODziC/XCtq2JO3g==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2023-01-24T19:36:01Z"
|
|
||||||
mac: ENC[AES256_GCM,data:SGRS/Xp0bc4omUq2WHKFx5F55rZvh2bo0KmxxZ73srImkF+65GAFeVaWJVxH8ie01N2jYDtVbe6NOfapRvcPFaXEIwJItTcMgUmqPr8fLI9WAzZpAWS1LeaNKkLAOcYHIoCEFgJbxtm3Ngj1NGxlam2/Cbwo1ONNNnulwvWDASo=,iv:ClDkkpsZHn4z9d1cnuN0zgqtxWijqjyhUCPDzrWCW8g=,tag:g65C9RazwWiI1jjap+/TnQ==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2023-01-24T20:36:41Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
wcFMA7zUOKwzpAE7ARAAic0uBG9/9XvP2R/vs9a6vPKfWMOgWbgkj7ET8N4fVucO
|
|
||||||
WDtRNcF018Z+VWfbZ9uJMc/t8yJAz2oNiFzbASJbJH2bFvayGdUxlNGQ9NhpLBqX
|
|
||||||
t84Bfq+J43RmEegvbyozBZbDO/Ux3WAWUIJo+ekgHET/fyvLJkUp7aFs7ieXaehP
|
|
||||||
qV1OpuYZUdz8xAboFwWmNg3pT8z+ISC0S3dfCoHiucVDAD7AHMWYXXC56rxrdgtX
|
|
||||||
m8Q3To3GIspoOt38xvKgfgI4ovN9kxaffF62Ykc+vnOcPcAdslymjJtyKo+/c9W8
|
|
||||||
LFajg7HNMy0ge2MwyTbeAzLN+7Wd775H8tHb8mQCwtzlewuCOGgMBlGDY+3tIt57
|
|
||||||
ygPx48jbfOg62aYEfr4MO16jwHm5NWxlZc3AyGkmVqRDtUCXh99/fwDUvx4DlOLE
|
|
||||||
+R8tHqYpxeUwkVMAHHNaGj0ahZ2+lhgdODqc/OCnc5Y6H992zgjBok3ckBViRyKE
|
|
||||||
4E024JUnJf9AWo/w8BC/az0yy7AIZ3sLzZjRBAzAKgviupoCm7ORYlAIEtZXdII3
|
|
||||||
eYbRBP0+dMjhRgT9mHCpY6TAkfGJ9lcIw49SXwmRZFyTcrbICB+VDvzoQQLwtGGk
|
|
||||||
qEEnBNcx21XlJUd+TZj4seZkwLxapg+H4VSkYqBX7BQFAuAVoITtUghUO8703afS
|
|
||||||
UQEYh5H9/T+AKIeGWsmHAq/TVKvLO4GKL7P7ccQx7AHz0UoNioWPJu2es/D09BhX
|
|
||||||
UbiVhIyxOIUT3Gp7xKEyhw2Q+Zb3YZiZuFc0W52iGrWhuA==
|
|
||||||
=lOeC
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.3
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
oxaproxy-seckey: ENC[AES256_GCM,data:NqyjByJof6wzi4xZqCjpJ02wLAkcsV+vJXqg9DjqQUMOlnrMUJkAdJowPCY=,iv:jy/2oMeTXRiUJNS3nPYUOWOIxualfLzJuBM4jA9XSAM=,tag:RbhH2H0HPWEuHjXgqMwhkQ==,type:str]
|
|
||||||
miniflux-admin: ENC[AES256_GCM,data:D6wOaC6pWS+4PD/KIT1MCPNkV4/mnjO88rSvmIwKkqj2dC641cnP3psfMb1/6QpI/C+pURcgzFaNUuHWoqwqQWq5i6eWTz1Y/wha,iv:FfjaVjlFLzSj9YHamJNAWOv1LA2fz4v5vG7IRU6OIuo=,tag:f3iPWs/1btzAFl2aneetXA==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1dwem3slsm04jpmje2ru5n7fujkmz2kvhdat5htx2xnc2yqtyefeqchwx7f
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArVVk5TUR2OVdxNmJlK3ZW
|
|
||||||
V29rZngvMVdOT044dzZvWllSd3RNMDR3QVFBCjFrM0ZrMDEzRGlZcG55aVd5bG1a
|
|
||||||
SjM3R0tOSXFBWTRQb0FDMkdIeVYvYlkKLS0tIGNUN2hyaXlIQkI3UCtYR1JiSVNa
|
|
||||||
MlprS3o4cWtONEsyeHlKdXRjQTVoSncKBEfl80lMdLNvDUmV7YcLCTMBWjoaa3Ip
|
|
||||||
VA+LJhEShZUIjCcMKRPVmBn/zBRGJHn7SCn/Tm4DNro35RBaMmMDBg==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2023-05-15T14:53:27Z"
|
|
||||||
mac: ENC[AES256_GCM,data:vLlfqFQeV3ppNlpvLjewXnRsa1SHtGK/swhoRFoqyWXFDtFw7+M0Gr7E+7zCBH2r48z8yVm12DhotYGFfYwqM5whwlyrA3NR94OTxQI6Y/aoyKXkSoJS7AlyIkcoCTX4hS1zEcq4BRYR4Oz50LRz+2GFtHsPf4fuD8ne5duBFIU=,iv:HnkYK12rkYHqaWTL27ufbhvMwUzBqk9IY9gQx0I0TEw=,tag:H5pCZJmTuFaKsOepfVGAQw==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2023-05-15T14:55:52Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
wcFMA7zUOKwzpAE7AQ//dP/NacWvkfNSGIg4neAUvvJx1YfC3NuTpAcDZh96vLzN
|
|
||||||
USe2lgEnmSuC3iHLVuMix0sLoHNvobkDP49E2MkhpZuM8iFVnhVXiBE4uy5vB+7L
|
|
||||||
I32cuQT00q4V/BCKDICe0kv2eS0iB+9jVah1H9tpPYYtFe5OEOGCW/uoujjTIR8Z
|
|
||||||
mfAvCmJjR1Ae+iCacPbITPLvgCE/v+sCLU4d8FhG7VBE1PxURU5XH+PjCt3RaqUc
|
|
||||||
h5ex80XAuhGeGnlOwrU7ojpr8sB75KCIFCVE91K/qIRZTqny8UtGRiiXSDNQNqJM
|
|
||||||
eBvUL+60L1EZ6zFMu8mIk2Sbw1gpi338zW0qdSRot0CDQPMgLKWOF1TjsMexeaKa
|
|
||||||
ngsOl04MzXXUvSB4zmT2qL4td72MTOG6+rWl24PpaOCYIVtcJAmUj78DxBST4GP3
|
|
||||||
MMOnWyEpt3x9pH5CnLztVQvWsy2yZ3o/UJCrYrsYhnVyLVZwS9OBLV2ItqzzMhoT
|
|
||||||
v5yUcteKBS32sMcpNg1Qg+MCkt5RXf01VA5LRnG92Wi6G4cQBYII2CLC8CnAFIg9
|
|
||||||
923H7RTwKvkIBGVSdtqyZH73P+KpKgJXEfUj3K40/m7rLChCD6H9d99uqFmZnFpe
|
|
||||||
rF2BKvMHY/pNXpR9yCR27ihCY5TDxfh6qI1++9uCa5z9dxTEoqr+uougQmGnOQfS
|
|
||||||
UQFgmJmpUSlzvzdJsuvAOFL4qkGRwpr/iy1Lb7gsWIs2F/m3fKy94vojVrxJHNdP
|
|
||||||
jX5+SOT+JltE2qVja/Wp3eDYYCJpyoVciIlodWUptkYsUQ==
|
|
||||||
=fLL3
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.3
|
|
||||||
|
|
@ -1,44 +0,0 @@
|
||||||
wg:
|
|
||||||
oxaproxy-seckey: ENC[AES256_GCM,data:aiom4K+5aJx+XH5ufd1fjgYa8YyqdTBiet6XKdzvtVC8ctVvuBfK34vVIXg=,iv:EXqxbNr9bxOvYjrKR59sp+XP8tPhqnBleaWsLSO6igk=,tag:0/oTWYuzna9OGriSg0vIEg==,type:str]
|
|
||||||
nextcloud:
|
|
||||||
adminpass: ENC[AES256_GCM,data:N2lw8ckPuZTlR+7NSCizUajxtXdmdmKFfQY6Rr1WAYw=,iv:xCNnHNyN7Zk/9V07u7HF+j/lD8JkYR1x1pEitNUEckQ=,tag:QD4j6RuAZiYkbe+XVDN0Gw==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1ds7zgenz9a664jqx5308m6q5mgtavzmelg239xsj8mdh64pmqa9qtkffmk
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UUVBZDF4bEk1Zm4yTXhW
|
|
||||||
eDhlQkdVQnRCWTRRVVpJbUNLTWdjT094WmpJCmJkdzB2ZnB6V2FXSHcyZWNsaEFN
|
|
||||||
NDZnaU5kRWxOZ3d4amU2bDZOc1VmUmsKLS0tIGNJTFVsckpkakdwMC9YcWJpSjlG
|
|
||||||
RTJUTm9QMlFDZE4weE9Neno2Z3o5RVUKfb5zgVlTLpWnNkd4anToCB/V43b8q82q
|
|
||||||
c2qcFP7ZDiu/QmLEPS/925oboC0bWjBSRUS+4neQdoteZkoJ6MZKnQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2022-06-26T14:27:14Z"
|
|
||||||
mac: ENC[AES256_GCM,data:eKM6PQc64jj3bJ6GoWiUV5Ze3WEGObiwXjjRn/wYrvdQAEuOJ4LD4sARwXYM2hN0Mv/1f1qos2+C9GHXiL3vaZOggliQFESJ0KOPnE/Nx+X9IqEcC69Fp42yYjqJNCMq31hdNzBYujB8t5cwFvkWke94EuOYnwT0gqVMiTmCcOw=,iv:tdQwi1Sgt0E5qDD8jPEvWQEDk7s9yrVthapATJRd7D0=,tag:plLTlUFVEGLKrt4uYzRL+g==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2022-06-25T15:47:30Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
wcFMA7zUOKwzpAE7ARAAR3jy6ZeiDg2zye68Ri3wz20HdSMi+IZN8sgqDEM4JvcD
|
|
||||||
7iL33aSb2tuEEILsj5xprTNtJwdXOZ7kwtnxc7bDllU5xyq6QFwzGH+uBZ+oUkP6
|
|
||||||
/RWkkoIrRIj6iPbm2rEFCccm0ytya/UuT8E6PPMi1MtmS+icNKVKreUZa8qQSTtm
|
|
||||||
bj3dEY1upLKl8KWjc5BLFSmJBm/ppnEn/AWD9MIccpa7FOPP+PAtG9JpiQQ9yp56
|
|
||||||
H63Rob90ITc1XNJFHdD+QSN1i84Aa363owHOlQWDpD+2KC0P/W3MQJXEEDayZHwU
|
|
||||||
HMx/fC1MZ0GVmuXzam8CUBCXQAQ3jWLoe20f+vuGSo4HzZS+1cHdkUpg4cCRLA39
|
|
||||||
UdHw+D/osU9PJrHhAbrYYVEeOYoIKgml174OgzoheCKPvdzccI7WBmAF4H1mjdgl
|
|
||||||
vJ2g86LblMyekbDtDtdpl3LY/KCdlsC0aUmO7/znmhvhKRLuXejK+jMQ4O/VFwGR
|
|
||||||
IfrQaOyPPIFTOjfLc896+FOLBfY1FFoXFX7+wWVeQtDLbAlxe7cbOPt8vcfP5tIK
|
|
||||||
vQkZqpS+tkggSPyZjtzc4sPKvqEyW4FvIwh4UaKvF7o3pEPTujNq2EwFpnWHRpdy
|
|
||||||
oZa2lMEnPRetzVc8vrmOCisVq5RSXKTc/5Mm1lix6kCYUX4QqyYVudaMXN3/vXfS
|
|
||||||
5gGZdaCHqWiM63pVGoRkgKE5W0HTJG9+bas7V7FPE+oFeu3icYDcKvMkoPsbIUf5
|
|
||||||
NsS8IOthqHIGFAV6NPSR5LvkgqT47j85jaqDw7FyRlIVIuIcn7bYAA==
|
|
||||||
=ULCr
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.2
|
|
||||||
Loading…
Add table
Reference in a new issue