Torjus Håkestad
0700033c0a
Replace sops-nix secrets with OpenBao vault secrets across all hosts. Hardcode root password hash, add extractKey option to vault-secrets module, update Terraform with secrets/policies for all hosts, and create AppRole provisioning playbook. Hosts migrated: ha1, monitoring01, ns1, ns2, http-proxy, nix-cache01 Wave 1 hosts (nats1, jelly01, pgdb1) get AppRole policies only. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
19 lines
443 B
Nix
19 lines
443 B
Nix
{ pkgs, config, ... }:
|
|
{
|
|
vault.secrets.cache-secret = {
|
|
secretPath = "hosts/nix-cache01/cache-secret";
|
|
extractKey = "key";
|
|
outputDir = "/run/secrets/cache-secret";
|
|
services = [ "harmonia" ];
|
|
};
|
|
|
|
services.harmonia = {
|
|
enable = true;
|
|
package = pkgs.unstable.harmonia;
|
|
signKeyPaths = [ "/run/secrets/cache-secret" ];
|
|
};
|
|
systemd.services.harmonia = {
|
|
environment.RUST_LOG = "info,actix_web=debug";
|
|
};
|
|
}
|