clara/nix-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactoring and cleaning up

Browse source
This commit is contained in:
CDaut 2025-10-31 21:29:30 +01:00
parent 7113bb629a
commit 8df968546d
Signed by: clara
GPG key ID: 223391B52FAD4463
15 changed files with 169 additions and 161 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.sops.yaml
View file

@ -11,13 +11,14 @@ keys:
- &paperless age1zj3tzzcpyq5s66phlrf2g203am7vl6vxg2jlpr8vy6u385xljapqt0d2fr - &paperless age1zj3tzzcpyq5s66phlrf2g203am7vl6vxg2jlpr8vy6u385xljapqt0d2fr
- &vikunja age1h7yq7n8gcw35apr7jn8r66dwss4hfcdv0sf4ankfxquyavlrqukqhr0lrc - &vikunja age1h7yq7n8gcw35apr7jn8r66dwss4hfcdv0sf4ankfxquyavlrqukqhr0lrc
- &nginx age1ypq3n3e7gnwqddq5dgkdsfm0wqagrm5pl5tkunzp44lcezsllumqsjz0hz - &nginx age1ypq3n3e7gnwqddq5dgkdsfm0wqagrm5pl5tkunzp44lcezsllumqsjz0hz
- &wg-server age15ydstgk0fmmgy2ugmqufyqhqsqypd2mvy89enzwczz0m8ar2kvzqlcdsm8
creation_rules: creation_rules:
- path_regex: secrets\/all\/* - path_regex: secrets\/all\/*
key_groups: key_groups:
- pgp: [*clara] - pgp: [*clara]
age: [*wireguard, *mcserver, *zammad, *forgejo, *mastodon, *paperless, *vikunja, *nginx] age: [*wireguard, *mcserver, *zammad, *forgejo, *mastodon, *paperless, *vikunja, *nginx, *wg-server]
- path_regex: secrets\/wireguard\/* - path_regex: secrets\/wireguard\/cube.yaml
key_groups: key_groups:
- pgp: [*clara] - pgp: [*clara]
age: [*wireguard] age: [*wireguard]

6
configs/containers/forgejo_container.nix → configs/containers/cube/forgejo_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "192.168.178.37"; targetHost = "192.168.178.37";
targetPort = 22; targetPort = 22;
targetUser = "root"; targetUser = "root";
tags = [ "cube" ];
}; };
networking.hostName = "forgejo"; networking.hostName = "forgejo";
networking.interfaces.wgbr.ipv4.addresses = [ networking.interfaces.wgbr.ipv4.addresses = [
@ -13,7 +14,8 @@
} }
]; ];
imports = [ imports = [
../container_config.nix ../../container_config.nix
../services/forgejo.nix ../../services/forgejo.nix
]; ];
} }

5
configs/containers/mastodon_container.nix → configs/containers/cube/mastodon_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "192.168.178.81"; targetHost = "192.168.178.81";
targetPort = 22; targetPort = 22;
targetUser = "root"; targetUser = "root";
tags = [ "cube" ];
}; };
networking.hostName = "mastodon"; networking.hostName = "mastodon";
networking.interfaces.wgbr.ipv4.addresses = [ networking.interfaces.wgbr.ipv4.addresses = [
@ -13,7 +14,7 @@
} }
]; ];
imports = [ imports = [
../container_config.nix ../../container_config.nix
../services/mastodon.nix ../../services/mastodon.nix
]; ];
} }

5
configs/containers/vikunja_container.nix → configs/containers/cube/vikunja_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "192.168.178.107"; targetHost = "192.168.178.107";
targetPort = 22; targetPort = 22;
targetUser = "root"; targetUser = "root";
tags = [ "cube" ];
}; };
networking.hostName = "paperless"; networking.hostName = "paperless";
networking.interfaces.wgbr.ipv4.addresses = [ networking.interfaces.wgbr.ipv4.addresses = [
@ -13,7 +14,7 @@
} }
]; ];
imports = [ imports = [
../container_config.nix ../../container_config.nix
../services/vikunja.nix ../../services/vikunja.nix
]; ];
} }

5
configs/containers/wg_container.nix → configs/containers/cube/wg_container.nix
View file

@ -3,10 +3,11 @@
targetHost = "192.168.178.123"; targetHost = "192.168.178.123";
targetPort = 22; targetPort = 22;
targetUser = "root"; targetUser = "root";
tags = [ "cube" ];
}; };
networking.hostName = "wireguard"; networking.hostName = "wireguard";
imports = [ imports = [
../container_config.nix ../../container_config.nix
../services/wireguard.nix ../../services/wireguard.nix
]; ];
} }

5
configs/containers/zammad_container.nix → configs/containers/cube/zammad_container.nix
View file

@ -3,6 +3,7 @@
targetHost = "192.168.178.110"; targetHost = "192.168.178.110";
targetPort = 22; targetPort = 22;
targetUser = "root"; targetUser = "root";
tags = [ "cube" ];
}; };
networking.hostName = "zammad"; networking.hostName = "zammad";
networking.interfaces.wgbr.ipv4.addresses = [ networking.interfaces.wgbr.ipv4.addresses = [
@ -12,7 +13,7 @@
} }
]; ];
imports = [ imports = [
../container_config.nix ../../container_config.nix
../services/zammad.nix ../../services/zammad.nix
]; ];
} }

19
configs/containers/mc_container.nix
View file

@ -1,19 +0,0 @@
{ lib, pkgs, config, ... }: {
deployment = {
targetHost = "192.168.178.65";
targetPort = 22;
targetUser = "root";
};
networking.hostName = "mcserver";
networking.interfaces.wgbr.ipv4.addresses = [
{
address = "10.8.1.2";
prefixLength = 24;
}
];
imports = [
../container_config.nix
#../services/minecraft-server.nix
];
}

5
configs/containers/nginx_container.nix → configs/containers/netcup_pve/nginx_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "10.0.0.2"; targetHost = "10.0.0.2";
targetPort = 22; targetPort = 22;
targetUser = "root"; targetUser = "root";
tags = [ "netcup_pve" ];
}; };
networking = { networking = {
hostName = "nginx"; hostName = "nginx";
@ -17,7 +18,7 @@
}; };
}; };
imports = [ imports = [
../container_config.nix ../../container_config.nix
../services/nginx.nix ../../services/nginx.nix
]; ];
} }

14
configs/containers/netcup_pve/wg_server_container.nix Normal file
View file

@ -0,0 +1,14 @@
{ lib, pkgs, config, ... }:
{
deployment = {
targetHost = "10.0.0.3";
targetPort = 22;
targetUser = "root";
tags = [ "netcup_pve" ];
};
networking.hostName = "wireguard";
imports = [
../../container_config.nix
];
}

66
configs/containers/paperless_container.nix
View file

@ -1,66 +0,0 @@
{ lib, pkgs, config, ... }:
let paperless_dir = "/mnt/paperless_dir";
in {
deployment = {
targetHost = "192.168.178.101";
targetPort = 22;
targetUser = "root";
};
networking.hostName = "paperless";
networking.interfaces.wgbr.ipv4.addresses = [
{
address = "10.8.1.7";
prefixLength = 24;
}
];
imports = [
../container_config.nix
../services/paperless.nix
];
# set up secret key
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets = {
smb_uname.sopsFile = ../../secrets/paperless/secrets.yaml;
smb_pass.sopsFile = ../../secrets/paperless/secrets.yaml;
};
templates."cifs-credentials".content = ''
username=${config.sops.placeholder.smb_uname}
password=${config.sops.placeholder.smb_pass}
'';
};
# Mount paperless directory
environment.systemPackages = [ pkgs.cifs-utils ];
systemd.tmpfiles.rules = [
"d ${paperless_dir} 0777 paperless paperless 99999y"
];
fileSystems.${paperless_dir} = {
device = "//10.8.1.5/milo_paperless";
fsType = "cifs";
options =
let
# this line prevents hanging on network split
automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
in
[
"${automount_opts}"
"credentials=${config.sops.templates."cifs-credentials".path}"
"uid=paperless,gid=paperless"
];
};
# Paperless needs the share to be mounted
systemd.user.services."paperless-web.service".requires = [
"mnt-paperless_dir.mount"
];
systemd.user.services."paperless-scheduler.service".requires = [
"mnt-paperless_dir.mount"
];
}

60
configs/services/wg_server.nix Normal file
View file

@ -0,0 +1,60 @@
{ lib, pkgs, config, ... }:
let wg_port = 51820;
in {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = lib.mkDefault true;
"net.ipv6.conf.all.forwarding" = lib.mkDefault true;
};
# set up secret key
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.wg_private_key = {
sopsFile = ../../secrets/wireguard/secrets.yaml;
};
};
networking = {
firewall.allowedUDPPorts = [ wg_port ];
firewall.rejectPackets = true;
firewall.trustedInterfaces = [ "wgbr" "wg0" ];
interfaces.wgbr.ipv4 = {
routes = [ ];
addresses = [
{
address = "10.8.1.1";
prefixLength = 24;
}
];
};
wg-quick.interfaces = {
wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface.
address = [ "10.8.1.1/16" ];
listenPort = wg_port; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# Path to the private key file (see sops).
privateKeyFile = "/run/secrets/wg_private_key";
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
# Public key of the server (not a file path).
publicKey = "AJ1nr0/w8OvsNq5Ju//m4856u7yY0hlPGMEGeZtlhlY=";
# Forward all the traffic via VPN.
allowedIPs = [ "10.8.0.0/16" ];
# Set this to the server IP and port.
endpoint = "202.61.230.52:51820";
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
persistentKeepalive = 25;
}
];
};
};
};
}

2
configs/services/wireguard.nix
View file

@ -10,7 +10,7 @@ in {
sops = { sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.wg_private_key = { secrets.wg_private_key = {
sopsFile = ../../secrets/wireguard/secrets.yaml; sopsFile = ../../secrets/wireguard/cube.yaml;
}; };
}; };

14
flake.nix
View file

@ -12,17 +12,19 @@
specialArgs = { inherit inputs; }; specialArgs = { inherit inputs; };
}; };
wireguard = import ./configs/containers/wg_container.nix; wireguard = import ./configs/containers/cube/wg_container.nix;
zammad = import ./configs/containers/zammad_container.nix; zammad = import ./configs/containers/cube/zammad_container.nix;
forgejo = import ./configs/containers/forgejo_container.nix; forgejo = import ./configs/containers/cube/forgejo_container.nix;
mastodon = import ./configs/containers/mastodon_container.nix; mastodon = import ./configs/containers/cube/mastodon_container.nix;
vikunja = import ./configs/containers/vikunja_container.nix; vikunja = import ./configs/containers/cube/vikunja_container.nix;
nginx = import ./configs/containers/nginx_container.nix; nginx = import ./configs/containers/netcup_pve/nginx_container.nix;
wg_server = import ./configs/containers/netcup_pve/wg_server_container.nix;
}; };
}; };
} }

119
secrets/all/secrets.yaml
View file

@ -4,96 +4,105 @@ sops:
- recipient: age12d8mxwnt0a7gl4uu0uwdqaxuqdf5j7zm50qy5qrhj0kd4ny7luaqv7rj4e - recipient: age12d8mxwnt0a7gl4uu0uwdqaxuqdf5j7zm50qy5qrhj0kd4ny7luaqv7rj4e
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwaWFLVVVrallkZEJGZkJm YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLZ1huS29WQldXeTI0YjhS
bFBaNzkrRkU4MFVJZUxiSGZWdldSVGJLV2tNCnhod0g5emhQdExiMjhmb3Jxa2c0 NHB0TStqZ2Q0UTZRdnIyR0U5N1dld3VDRVN3CmxsMGxwY2tKWEVGRkVPdk9MWHdj
bStqbnN2UnE3S1RIbi9iU21ITWZ4NlUKLS0tIGVrYjFVbGNOUmFvSXFBQzNraW1T cHc1UG1kbUZHQ2VGU2xqejI1WEEzVzQKLS0tIFdxdm9wdit0UGVQSkxmQUxlTnNV
bWdvTG90S1pvVHJ0NUFqd2FCemp5Sm8KuNksM73Cd9Z+ecMGpIAhJieozze37ThN T2hwdHdvZXVDTzNZRGt3YWlqUCtOcEEK9uRwxAGZxS3dEUtmwOf8buol0K3sY14X
u8dLFFdnv2MWKqOvK99yNcUCvkKOY5VN2hCT+vfqt/9pek76eUaDog== g64a7jWbtWsgltDbchs5WabpjQOPnvd5HP9fCc7rivtMQ1dzg2sJ6Q==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age1jlt47gkctq7vfrykqlyg9um5mypy872pvtfql7kkpvhnemlex4mq89a3a8 - recipient: age1jlt47gkctq7vfrykqlyg9um5mypy872pvtfql7kkpvhnemlex4mq89a3a8
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFbitVenBHYWswWlpKb3NG YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaXVKMVNBUEl4RTVXanE5
SG5VVERDQkc2Um1GV1ZkN0xzeW1iWlpYR3pBClIvNWRqOFA1SjJPNENqWjVRaXZR QzlFNDdiM3VrOHhTTWR2dTFDSEc5ZGxOMTJnCng2K3dZb1hrODJqTEJyTXZ3NW9z
R3ZmSzJxcGhyNEN5eGk4SDdnTnFFcHMKLS0tIFA0cThkTGtxdjUvVjJKVGY2aU1n U3d2TXpWUWM0bTZYZmdyQ1ZCYjFnZEEKLS0tIFFpSUR4alR0QnJkV2haR1BUQW9q
WENOM0cxRmF2TlBmRXFqU3phU2tDSDAKOiT/zbpRRmiQstLAJw1Mip4eoZ/OuCAW d3U4MXhBOEo3OUs5RlhFQlJrMG5KT1kKm20+DM0YUnfpz/b4vnQk8URUBGb8IE/A
qeK7wczzwZOnAcfUOdgjjOBFy9prU/AdcfH0I3THASgrIG8xrmHSKg== yuADRQnLaX+bZbn3NWfthXtNJk44odwcnVBXRXg95wSpPy4P8/ZUig==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age14ukkn4plvnjacvjux929qwpeynxk4cfxw285vlwddqakm43kfyysfdg02c - recipient: age14ukkn4plvnjacvjux929qwpeynxk4cfxw285vlwddqakm43kfyysfdg02c
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHc0RiYkN1eFpCaTFlVmpW YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNytGbUZ3VGp3NXM3N09l
TEtyRUh1Ty8zTlZOMmVDTkFVOEJVTHhmTEJjCjhsdjZKQ210am1acEQyZ3pleVJ1 ZnQ3SWppUXd1bkMrdzVlckRuUkdEalgra3hjCkZtbTVaaUZhTU44RXYzYldhNmtZ
ZlN5dWdqampvaWl2SnVsRFRFRGw5Vk0KLS0tIE1PV3RGMVZoMitDME00S1M4alZz VWx2Yno1NWwzSTR4Y29tR0twTGJvZ2MKLS0tIGpRZGZSbkhDY0x4bjNQZmhUd0M1
TEw1K2ZKaDBMQlhBcjRoSFc3Zk5MRjgKoktTEbB/HEKlcNiS8jYQ5GqqhoL6K2/J WW9Uclh5YVZPaEdKdG8wSFlIU3Fnc0kKuK47ES0P0haKTIRwHzop57DGntpbsOZu
sMW42vi1a4Dk/+dRAMsmVjhSZiROhSA+1XaMByLBCHOVSdFEcdNgGw== eNBd19cpMgerEE0Xfj7Z6iey9IkY3RtszMZafWamZAnJQXpF/KA3ig==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age1vd33efsea2509hm0dwmhkuu7mm2kgw6tsss6lmzsqfg7gat06qyqys3qfh - recipient: age1vd33efsea2509hm0dwmhkuu7mm2kgw6tsss6lmzsqfg7gat06qyqys3qfh
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUFNuekl6cnBrb0h3cytV YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQm5zQ2RmTWRzSFI4OWJw
V3Z4dnBuOGZ3SE5CNEp3V2Facisvb0tLUERnCjhuSU9MTnhnYThJQ0dIUzRmNzY5 QU54SmFiZzlSRllvd2RTOXIwWnRyU1FPZnpRClJNMk1CRExhZk5VcHlBeWhDTmNp
S1gzaTMxQUhoTXFTU0NXdThPT25Tck0KLS0tIE1uNVJaaHl4V0RmQWR0TzZ1SW0w UjVmbytNTlVVVW1Vc0VTSVZZYTRodmsKLS0tIFF5TktPNGI0ZHlMdTVrYTVoT1pi
ckZMdVlkWHEvL0RPL3pyeStPNmtiMk0KbIhfCRvpRv+vVrqVfLpjEKdSs68GJ2NE d0pPV0oyYTRNZlRpZFBZSjVQMkxEemcK/N/a2myjrrv8L7CpxDrBhsiSU+hUMs/h
gbdqKRlnyPe+uZNpZmgP2sNH9QdJvGpvrnxQPZ4j/s7aIFhvHSYY1g== +DKVgFQX8vRuwsAJw+Y8X5T+I8fIj6rvPn5nb6OSJ/BDdDTHwYXE8Q==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age19efecaur72d92g452zpe4uxjtwev2ktjtaezascxg9l2p8544s8s05d93r - recipient: age19efecaur72d92g452zpe4uxjtwev2ktjtaezascxg9l2p8544s8s05d93r
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5Q3JoZ2lPN2s4L0MrcGtn YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaXRCYWZ6WkM1NEdjb0N1
MjM5ZjdMRzRKVXU5azdmY2kzOTMzUkYzeFdFCk5qbDFGQUtReDNDWUhKWjRaZzQx UFNJYXRPSGpXbWh5TmtQSHJZWlBKMHhEdlFNCkVjaWtSMFlqZFdxbVJTZm90V0k2
NEZqWTkvd29sY2NJSTRWcDJBTC8rd1UKLS0tIGFPS1g2OEdmYmZvRE9jZC9oNG9X RVBhNlJqT29GcW9NdDlOWkxuRzdmNmcKLS0tIDVIb25FVlVqRzdQMGhJcFhkckVt
andaVldXZS9Jc3FOTWdvbUhVVUtONU0KThDBMfftZBn7WeoIBx5CTv/hJtjvbXLA eWJNem1ubmUrbm9iSktGd2IvRmw2Y2cKfxGQ/dQsdNOkUZk+XPmdcdy3bWy3LU3G
+6KmZSoG3VPMzqdOy61s8RbZqwKMzeWl1ydHIvKcyvo2BmJSAZ/6CA== vwo5yU9WKYmRy4Ag/pPPlhG4g+/x1nGVxTL2n5yTx7r9yIGMLeDGRw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age1zj3tzzcpyq5s66phlrf2g203am7vl6vxg2jlpr8vy6u385xljapqt0d2fr - recipient: age1zj3tzzcpyq5s66phlrf2g203am7vl6vxg2jlpr8vy6u385xljapqt0d2fr
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRWMxSzR4eUJnMFpBOGRJ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnTnEwWWw5amg5TXdhNTZF
RzRIczZxbUdjUHRoUU4zYytwcUlMZWE4Q1JZCklWNXh6WSthdXdZTHVoWHJjTlYr YnBqTDIyWDdGd3Z3Y0wxdUFUdDVrT3RVaWw4CjBqSEgrd0ZKZ0libnFTUTZleVpo
Um5UMlM0TVBoTTEyaXlyYjVpbXVPYXcKLS0tIGVWRjhaZC9DaGgzOStaaU85ODlW cjlHL1BvenI1NVlGY0dCSTNiRERvZlEKLS0tIEhGWnlRcXFxUWRHQlpHUEp0QmZY
Zm5ZSDd3MGpFVmtZL0c0WWV1M0ZKT2cKOm+HUuHskz6RsQVsVW+OcRr90yBqeNa3 WHlsblZ3VE9UbSt1KytsWTQ4MFRpUTQKMw5z74qSTlq6EQCXbv630mr4M0jBPBF9
PlgWRJ05uh8XETJVoZTkcbvyw7ZWWJzPzYCus1lWg1W9xVcsJwAn4Q== b7K1jFF5VGXB3ESgjVpaDRW9ug9rfTIAyxhAzFjxHHl3M2/hKkUByA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age1h7yq7n8gcw35apr7jn8r66dwss4hfcdv0sf4ankfxquyavlrqukqhr0lrc - recipient: age1h7yq7n8gcw35apr7jn8r66dwss4hfcdv0sf4ankfxquyavlrqukqhr0lrc
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3bjVmS1BIK2k5UFZBSnlv YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLbllldG5DKyt3MlNjVWNu
UXNmKzBsNU4yUVgrS05ta0c2VloxME9rUEIwCkRYM3ozVDZxallXRDVpMXpXelQ3 dkpJTGppVGlZSDRaSGgvTkR1dVFzVWRwN1JrCis1ejJkek4vaW81OVFJb0lEWk1V
cWMxbzllYXYwQ3BaVWxHTS94czFWUUEKLS0tICtObVczWlVSYlc2a1dib2Z5YVRx ZTlMNzJ0SEc5Um8wQlJuakhQRjMzc2sKLS0tIGZOOGpUcURXTXE2YzhvL0ZFZXdQ
TVl1TFk1bW9mNEN1ZURQdXZpVDNPWmcK2n2SyP1Hu+kQqJ8Qegu67olwBnAd8Bpz Ujc2cnV1K1YrMlU4dytGRDJmK3VDWlEKWZ3a9WShCmviAgbzXOCqLi9LREMMPwSz
2who1jOs6/y7JSuXFTLKTkr60atqpjMwHRJbzL/0/jkij0fyVwmgEw== 8F3dTMaIxgB9ALcDoMng80eFpabU25eBp1zscQ8k4oudSe28mo0Dnw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age1ypq3n3e7gnwqddq5dgkdsfm0wqagrm5pl5tkunzp44lcezsllumqsjz0hz - recipient: age1ypq3n3e7gnwqddq5dgkdsfm0wqagrm5pl5tkunzp44lcezsllumqsjz0hz
enc: | enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTzZGMUQybitqcFpkcmFL YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzL0gyRzZFY0sxRVpLa0t1
dnZXOGZCbTJMazZOM3FObXVSZGdpY0xCcTB3CmhnVDJ0OGxOVU1YZzV2Y05tV01r d0NIR3R5b0d6NUdaL00vZkFFdjBrck5FVVRRCk4waE8ydWkreHZNcS80dGtqVGVh
aDBVcTdaSU5neUNMa3kxTkxiaTd6NTQKLS0tIEJVS2JpT2pQeGNuWTRvYUZCQ1Q1 MjdWZmxOemtRQWlKdDFmVkpHODZqY0kKLS0tIGh2U1FJNW4rbWx0MGRPMkUzSFRn
TWdOc0g3aEZRTTZCUXVVbCttWjNLcUkKUDAOEIGxztVtG+Y7hyZuedPTvCH25Nt2 TEJBaDd4RG91SlZkalo1eU1EQVROR0UKowKLTT/WyFzNnD0rdgCWVEjuZDYIoz4J
ECZpPN+QeMtwQ21eFC9v95RLrY97SV9TD5DgzZim06hgAcQq1ST2gg== 5Il2kJy0OOyYD0ez5Kf0k7wouhAGSlib6jn4OGlrcmSOv6+5JTMK1w==
-----END AGE ENCRYPTED FILE-----
- recipient: age15ydstgk0fmmgy2ugmqufyqhqsqypd2mvy89enzwczz0m8ar2kvzqlcdsm8
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1Q21kMkhnRWZoT1RsdnFl
cHlxdW9EL3dNU0tscUlKdng3d0p2VklVU0c0CjJDM2xScG9TdHhhbWJoUm5ya2lO
TXZFRlZlc3czR3NRQ2VOQ2xFaWxiOTQKLS0tIGdtQkt3b0pnMkpuRTQ4YTRRRDhC
a3BFa3QyU3RJMVBmRHRDVmJUVXZMZEkKm2ARYzkaf4U6StNqfGUIoGJr23gYYc3H
PoSmPPAS9EEmdxPfJ+MwK0Lb7gwCJ0nMwf6CBxzp4dRVhxGbW3+vjg==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-08-08T15:38:19Z" lastmodified: "2025-08-08T15:38:19Z"
mac: ENC[AES256_GCM,data:IoqrJyCNad4/OFH6y24kYMwnkF3OWfsw77POg00btvw7FoPoaSJ76RySMs6hgWs202bDYSDi44OvbgCVeNPkhe9eyM0gwF0Gf0cE3wirc+qj2qfL9/lMOTZm02WymMglJf6xTcPo3BH00XryR7ptid9+WrB0S2aBVNlcXSBwpzY=,iv:aLI2SyUzWqp/4XFPhogq2vq/u47bs6Gmgc/PRMe+GmM=,tag:jVnW7EkqDRfQluGTiw0olA==,type:str] mac: ENC[AES256_GCM,data:IoqrJyCNad4/OFH6y24kYMwnkF3OWfsw77POg00btvw7FoPoaSJ76RySMs6hgWs202bDYSDi44OvbgCVeNPkhe9eyM0gwF0Gf0cE3wirc+qj2qfL9/lMOTZm02WymMglJf6xTcPo3BH00XryR7ptid9+WrB0S2aBVNlcXSBwpzY=,iv:aLI2SyUzWqp/4XFPhogq2vq/u47bs6Gmgc/PRMe+GmM=,tag:jVnW7EkqDRfQluGTiw0olA==,type:str]
pgp: pgp:
- created_at: "2025-10-30T11:25:33Z" - created_at: "2025-10-31T20:08:22Z"
enc: |- enc: |-
-----BEGIN PGP MESSAGE----- -----BEGIN PGP MESSAGE-----
hQIMAzwtBoBqH5ZOARAAqVknm2mmAFX7nYejdt0rla0inc3/3dnDzVgwoAmMplTH hQIMAzwtBoBqH5ZOARAAuXkdBPigYqSNhd6iO8RNlvz/x0DLIi4DXKBb9cIaYnWU
eI+3Ri43KRz5ohNxKqC4OtalOLdPC4uYo6J+zTY13vkGqJKrryOhdpISv2CABop5 plHRxDTAQIWYi8TRPWc0tsFVn6h2U0TuC/wBYJQJNtCJVfD6YtJAEoiWG84EwnJ+
sHtykv1Qce2mFFn/MBHi6k75E8lyBV5WkTKhKEAi8CFRF53XeQdVk4omBhp5O1q2 CNeCTfgd8Opni93X2buRtGiibwVPJSeBsTFj9cPcdOwoFSHVP2HnIRF/V8RTzSv6
gBO2jo5gR36fHo5xUxeEd1sHGpdYTeKA7YQa2NhuZkL7xoRww1/Olc6oah3wyNX9 PAbbDdl31CoaxMvAxB4RK4zcACoRQjBtg3JnU/JKaisiVpG9hrdP/XxffDcgxlCF
aQHjqYbtbbt9W0VirdHk5FYQb4y1I3HYnbfzOC8e74Ae1ioGwgcS7wLHIChaDPuC oXtNEr/fB/HpE6Rs0NEMJWfd/jBnklywo6tV9PUlmVuALMOlVD7VUP2HL55G0JEu
mKjtk/L+nFW+cLMZFykPN6+OHX2zNoNxgWP0u9RHtVxBPqrZixfMcdAA+5Oyab0h 1X5wcPKHAfQ9MHkJPvc8IhbP582xqza9RZNJV9qFVuteQVVX4eTgFdH1TalpGTwa
7u4KKCBcRYpzW1kKXebLzXn56bpiySWVEjS+6JNUU7y4CgIK7iGYLVZTzkVpC2NA pvWAZEal0VPIF00Bzmvu9LCeG5NXcvKouAy/+qViXtcMO4fcluzZN1mVVbbh56DH
Zva+bje3lEb6Emhu2HBoUtzEzk097BfOeQKCaep5hZHOzh8TombOQRBG1E7gGXDZ Av/21Xnc+pkBKl3O7jBwYozg2PJuNjetRiOcJTaHp5O/LkZCHJrKj1RGaZVmJPyU
HlQCOdCvJR73Xpl9vXBBSNyykUN6wPZtoJhbcRL/TtAA3wV+IhNJ2tNUxj8qaCVb pw3SZe8HvP8MnsgkcPxhBglqiiPDMaHCsUFFwEbas1jjZTkI0AtLTIuNNs6us/j+
Q7zmNOU1OqcSBbXjIPs9zZGizA1mEKPGCwQULuztt7x83y9e1VK+EAs2hd7dc3V/ 5yKe23TJDPUev/mdr5ziwjVy56V50oElwIxsETybgOSYU1ErK1Hee7bdRvOstaVe
va96T17jgcvknhneen2LBgbwbaQLYljnl2nAyPWVlhnXonReN1XwPG9VrSOGsQvS s8tT9X1MI3woYJ6j77pEp0CpLZy6n0q2Qv0on0ZLXsAt3QZhGGguipZh9VXvgT7S
XgHwxNiW3AtttmLDIC4pWfFuL81dHmtuGyUxQrkVVbH6Q7zKGkKyFDAGu5IkvCRj XgH0rGqUFwcL3MG10IL1znHCyjBx415dDVmx6w8TYv82FYsY/Y39BNk50bW1gz4l
5TSuPUAkfITvdi8U2cgBcBfGUsah5hb1S1aFsNrgTxtvchENR/6lJu8/xatIrVE= VfASFvk2QpcU3jzqPzgNeVyBCUZBuQYzsr327LNDM0uobZjrKZICBWLUt5O7sRE=
=xCKw =+lQp
-----END PGP MESSAGE----- -----END PGP MESSAGE-----
fp: 58EF8D71114EF548DEE3320DE6F04916B6EEBD83 fp: 58EF8D71114EF548DEE3320DE6F04916B6EEBD83
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted

0
secrets/wireguard/secrets.yaml → secrets/wireguard/cube.yaml
View file