SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-03-22 17:49:07 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

comin: Add git-push-tokens for future use in a post-deployment-script

Browse source
This commit is contained in:
SebastianStork 2026-03-06 18:48:07 +01:00
parent 6a3d7af09e
commit eb021286a5
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
4 changed files with 23 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hosts/srv-core/secrets.json
View file

@ -30,6 +30,9 @@
"grafana": {
"admin-password": "ENC[AES256_GCM,data:MNdjh+025bi5wtP77aKSGzcx8NgfY+YppH4qu/o=,iv:Hv8IF0n0A5+Hs6FQ7tXkdFbPN0ArdZD3vmrdovc0/Yg=,tag:8y0NsLQ+9k+mWnHbHzZvGg==,type:str]"
},
"git": {
"push-token": "ENC[AES256_GCM,data:VEpbgf7EPI4rWV6ywmCdTz1J1nBK3vefg58pxd6uBaJgVS7kbhKAyWizw/WRUaW3YplHvS05I/dErUKlklZBZ3QgEKItnpSM/J8fjEJnb48U7bPtRFjqTStOmgUG,iv:X+wv6csKraZDEgD3GdhbvR7KnBx6uftDS1e4rX7fAZQ=,tag:WmGU2/N/3CXFxSGbeYFwhA==,type:str]"
},
"sops": {
"age": [
{
@ -41,9 +44,9 @@
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXOVRQU1R4VlBhdEFUdnR6\nZFNuNldaSkxJL3ptOVVscjRBNkQ4dFBmQUVBCmZrQmFMV0hWbTBQcm1FS3JrR0ZC\nbktvT04xczd6VkdCUWk2NnVVZHNFWkUKLS0tIGUwOHJSMHVsNTEyZEU2VWJFNGVy\nMVFDVThrRGQwZEtPeFYzZUVQYi80ZjAKUd/XzyzqMkMowvyeCnQDbOGJDKbuAUQb\nFClQuiH5iSQQrVPw7SHBNgdqbcdtC+hZ4tpPaV/wWtlpcqpr5mBJSA==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2026-03-01T13:14:08Z",
"mac": "ENC[AES256_GCM,data:GywNeQDso210CV1rEY1LCwUu5ZDdjyP/W+QOJ5GJhLnLiF3BjivS4J9VbOANduhepnRLLHFKW0+zdzPJJl3ltBFpAuoDigEPF5PbXOT6R7oiEW3kkgD5LP79789ijkeGqGf2DUN0J04OFkcTnTy2tAd2O3kSnhi/EbIMvw7zjUY=,iv:TqXETQOQuuQCJ2+tvPeXHY08BGbhQ4fsu+RqX1EiPHY=,tag:qfaYvY/iuu0Ou9AxhJUnRQ==,type:str]",
"lastmodified": "2026-03-06T17:32:42Z",
"mac": "ENC[AES256_GCM,data:racxzbcs0cZ0dmkN5/Vo4SyjUaTyu2G/e60l2jN8A2SiJOLkPCwhlpJ347J01P/4RF/Pf6nnq5w2t/HLja7EAZtUw1kn+qCwI/79Eu8EBMdTvUfGmjNCB5CU+0oih4idUbSqP6UVgTT3GFQ4BaqksKQUC+e7gvsCzX55Z0vHsbU=,iv:gCW5W33sE+HH6fcvCqkwQBGMeQpiNgx388vvFas8YyY=,tag:GWwOS04FrbKrgq6YE77QTA==,type:str]",
"unencrypted_suffix": "_unencrypted",
"version": "3.11.0"
"version": "3.12.1"
}
}

9
hosts/vps-ns/secrets.json
View file

@ -7,6 +7,9 @@
"api-key": "ENC[AES256_GCM,data:oqnAPVfLU8CG64+TsRijZ/2Wzy11bt3PvoEqbpWZbcXIE2aM0oZtUUtCxt0DiWp8Uyta6AO40V8+EGkzeqL4O6VLxU4=,iv:KaEwSmoG5zYxsWjUxwqbfe77Iiv03IAnFaIjQ5YoYkc=,tag:ilzXSYElARjnWkOcBKZBdA==,type:str]",
"secret-api-key": "ENC[AES256_GCM,data:dGOAsu3kPJmDwhddZGgrY8KrDJeS7PiEPjEVh/h8BgSygRKLInow/7PIaHcy8gIlsGFvU2CYORY7Vmf3QCxYbRTkdIQ=,iv:otDnIv0B1h1H6usJqSNVqv9UUcmx9r5Cn18Q6DFwBME=,tag:O2O3V33TmalVuL6y4V9ufw==,type:str]"
},
"git": {
"push-token": "ENC[AES256_GCM,data:czn22goPG/e8I7/BVVtmcRNQDXT7ELr7BNlNCPoFdGbxQwBqeVSocB+rDPRW26nZgm2r10Q1WkzxqXRlRz8qtgXzPT9C7DYFoE+cS0nrHIqq/hVFWWBFhUZJ41qG,iv:OiHnk023rJuYLx3UygPdzGlXnZRTj9WCfkQd3IauGDU=,tag:SJv01tjeOKzAfSgxI62F4w==,type:str]"
},
"sops": {
"age": [
{
@ -18,9 +21,9 @@
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVmV4dkZEaWVDNHMxUFdr\nYnhuVWpReXBNSEhhZkltQTE4bEpzSlBzL0VJCk15UFlwa0haWTZNaE1DVzVZVFBI\nd0QzcUptYmQ3dmhhdjhFV0xDSWdmMGMKLS0tIFhWamx6SXJleFFSVUFkRmw2VFZy\nOVVhNm9NSE0yRGFMQjNrM1B6cDVxSXMKrhAkDcWqutgSmQI5O+5i8fcwuTh2/XKr\nljK/Vn8EvGr8qEUeHzOBI1b5VtgngJkVJyfM9G/Q0lZvQF7ZZ5YCgQ==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2026-03-01T13:43:41Z",
"mac": "ENC[AES256_GCM,data:9EQHy+GkONH/opiCrf9pafzZwRJ2xKwEPHO2YDDJD/1jw8IGvxg2GBt16QzP0PMczzASiLawOBbm2NsUmdz1bCkhABanj2+NQyIzX1xu5gqVKSmNb4BRUPY9M98atFl+2fzaeksC7t/BIizbGnehjRYQ5wFCsxNpCTw4G/Afzyk=,iv:dPIcQD6SPl821dUoezzW6cq7RlWGuJYbRCP4gcUvdpw=,tag:rBBJaxhWQ+fWbF3CMdpI+g==,type:str]",
"lastmodified": "2026-03-06T17:33:30Z",
"mac": "ENC[AES256_GCM,data:T/DxRmJ2tFobfSLhrN/PetxRv+66oLvjJuEqhcjT8Te88Pov+S+OqJ3tJnoHwhlQQLz3O+lnwEKD+HJTZYdl5SYsZwawGwrw5VJVnXIoeh7UqRNF6VqZNWY3ucJSJAh8NnnqflSRxjpyuYTOt5e25vLjsNIDyzwlGDS62+IbHZs=,iv:ANUah06mpDpx5/6xptlgW2zS/ZLKVo7zbjZnOVSVnuE=,tag:IsG5cxXUSUDRms4aSTd29A==,type:str]",
"unencrypted_suffix": "_unencrypted",
"version": "3.11.0"
"version": "3.12.1"
}
}

9
hosts/vps-www/secrets.json
View file

@ -20,6 +20,9 @@
"api-key": "ENC[AES256_GCM,data:KT1vUUnm0d2T9H1YI5SE6xgTVVdmbLFJeL/+otlw0mheH+9svnC19YP9szB/kBLAPLes+2qunpqM02B9tJxGgD30SNc=,iv:wVIkhrCQ7t7lkR0q0OO/XWZbgZYuja53XgUjfy1fTNA=,tag:MJ5tjbIofqcKXDuzD0b1aQ==,type:str]",
"secret-api-key": "ENC[AES256_GCM,data:lmU41AkCVb15sFuMqTZ7qZ978D5BLEYYidsb0yPPjiPPUmnfqBNM5lMVo4k4gt/PcMLcRVv5I6DDqE44zOK7YPf6Fck=,iv:sS7PfE2/CjUekIXGlvEA/N6R5JE7BvgfeXJO5dzv6/8=,tag:rp8FY3hEOyoafmwTdROJ7Q==,type:str]"
},
"git": {
"push-token": "ENC[AES256_GCM,data:bmhIbvUQknj0cQ4HEfbrRgjAC29OJ6d3KWAmu11ArPuXyarxNvm8RI7roD8rgZ94Ta5LS6WNqPhmTEz5KyWDaV0N5aXQ2fqWWqoTOUJe8BNGG557TvVjVENqynBN,iv:HSQJdHckzn48/byk4WbPKppfRv8WNrNzlMbdbGZdJzw=,tag:O3SLtx1EMqsF/sBhZHfZLw==,type:str]"
},
"sops": {
"age": [
{
@ -31,9 +34,9 @@
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvVnphWlNaTUU0QytIdnEv\nQnNzelN4MUMreXZrME5KZStFMDg2V1VFd21rCkk2Uy9ITEF3SjlRVEdMMXlPdHhG\nam1PNnp3emtnMnczeFFSSStJaHF6TkkKLS0tIEJKbFRzbmNqMjk5NXVHZnhlWWZ3\nYng5L1F5YUJGOTg3TTJCK281SG9Id3MKsmH2yj19ig2g+KzBGLD9dWkdvr6TLdSd\nuuDC+frhj7wWrEomOOjIoYtWHXkUtTSAnCEZhrhfyupYhEvlFfWRlw==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2026-02-11T17:18:44Z",
"mac": "ENC[AES256_GCM,data:CVnAf/P0Uj1kzU148d9LodrM7vNSmQ1F7LZQC5WEeAhPl+w1FgizNdzyQo+ZnuDBHkAflwJlB1kSS7Ou5/8mC9pBY1Kc13f4f+vpXNbZEyoUXaVqoESPSFtCdLrV+Fj54xwZEAUPzwvujuf9ud3SIs76vDF8LjTHxJFk3JPX4Ys=,iv:vPmUUwYnhB/jFCN4Fz2Bwh6cbb9MZ8DzVeY5m4Fno1U=,tag:YRozMlFU7DvjBRG/K1qmyA==,type:str]",
"lastmodified": "2026-03-06T17:33:14Z",
"mac": "ENC[AES256_GCM,data:FKOin7fw3EH+isB8niH43mImfn5HrAtUAdaHnW0QWcL4kQ4RhLGjY2rPr3X/3x0MqtphIK9hVh7K9OcwBznUicJ4kxfmV/+VjGdoQtyOsbkqPfJ2KY9FZvP2m7qf01PGE+S25vlh6h9d1gEAR2SdRJukvkIT2FmRfGGmPFVJWdo=,iv:3PSPP6coFZpd6IYnMttn0HCdtFZvmRR/kjjbhgs8XWM=,tag:2zgUzX5llbb6fEcH1YKtyw==,type:str]",
"unencrypted_suffix": "_unencrypted",
"version": "3.11.0"
"version": "3.12.1"
}
}

5
modules/nixos/services/comin.nix
View file

@ -19,6 +19,11 @@ in
};
config = lib.mkIf cfg.enable {
sops.secrets."git/push-token" = { };
systemd.services.comin.serviceConfig.LoadCredential = "git-push-token:${
config.sops.secrets."git/push-token".path
}";
services.comin = {
enable = true;
remotes = lib.singleton {