Torjus Håkestad
0700033c0a
Replace sops-nix secrets with OpenBao vault secrets across all hosts. Hardcode root password hash, add extractKey option to vault-secrets module, update Terraform with secrets/policies for all hosts, and create AppRole provisioning playbook. Hosts migrated: ha1, monitoring01, ns1, ns2, http-proxy, nix-cache01 Wave 1 hosts (nats1, jelly01, pgdb1) get AppRole policies only. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
20 lines
435 B
Nix
20 lines
435 B
Nix
{ config, ... }:
|
|
{
|
|
vault.secrets.pve-exporter = {
|
|
secretPath = "hosts/monitoring01/pve-exporter";
|
|
extractKey = "config";
|
|
outputDir = "/run/secrets/pve_exporter";
|
|
mode = "0444";
|
|
services = [ "prometheus-pve-exporter" ];
|
|
};
|
|
|
|
services.prometheus.exporters.pve = {
|
|
enable = true;
|
|
configFile = "/run/secrets/pve_exporter";
|
|
collectors = {
|
|
cluster = false;
|
|
replication = false;
|
|
};
|
|
};
|
|
}
|