Dustin Frisch
c1c96f2624
|
2 weeks ago | |
---|---|---|
client | 2 weeks ago | |
contrib | 2 weeks ago | |
machines | 2 weeks ago | |
shared | 2 weeks ago | |
.gitignore | 3 weeks ago | |
README.md | 2 weeks ago | |
TODO.md | 2 weeks ago | |
clients.nix | 2 weeks ago | |
flake.lock | 2 weeks ago | |
flake.nix | 3 weeks ago | |
installer.nix | 3 weeks ago | |
sops-config.nix | 3 weeks ago |
README.md
Deploy
Everything (all servers, all clients)
colmena apply switch
All Clients
colmena apply switch --on@client
Append --on=HOSTNAME
or --on=@TAG
to target specific hosts.
Building disk image
You can build a ready to use disk image containing the whole system using the following command:
nix build .#images.<MACHINE_NAME>
Secret management
Secrets are encrypted using sops. Sops encrypts the secrets for all administrators and the target machines using the secret.
Prepare your system
You must derive an age key from your SSH key:
mkdir -p ~/.config/sops/age
read -s SSH_TO_AGE_PASSPHRASE
export SSH_TO_AGE_PASSPHRASE
ssh-to-age -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt
unset SSH_TO_AGE_PASSPHRASE
Edit/show secrets
Secrets are stored in secrets.yaml
or in files in the secrets
folder.
To show or edit their content, use the sops
command. I.e.:
sops machines/nfs/secrets.yaml
Update encryption after fresh deployment
The target machines ues the SSH host key of the target system to decryt the secrets required for that machine.
Therefore the host keys spcified in sops-config.nix
must be kept in sync with the actual host keys.
These keys change after a fresh installation (a re-deployment, a changed disk, a lost filesystem).
After the keys have been updates, the contrib/updatekeys.sh
script must be executed.