diff options
| -rw-r--r-- | .makeshiftci/1.json | 8 | ||||
| -rw-r--r-- | .makeshiftci/2.json | 8 | ||||
| -rw-r--r-- | aphrodite/devops/msci.nix | 6 | ||||
| -rwxr-xr-x | deploy.sh | 23 | ||||
| -rw-r--r-- | secrets.yaml | 11 | ||||
| -rwxr-xr-x | ssh_setup.sh | 8 | ||||
| -rwxr-xr-x | update.sh | 17 |
7 files changed, 72 insertions, 9 deletions
diff --git a/.makeshiftci/1.json b/.makeshiftci/1.json new file mode 100644 index 0000000..8be3bbb --- /dev/null +++ b/.makeshiftci/1.json @@ -0,0 +1,8 @@ +{ + "name": "update flake.nix", + "image": "nixos:latest", + "secrets": { + "SECRET_SSH": "/run/secrets/msci/sshkey" + }, + "run": ["./update.sh"] +} diff --git a/.makeshiftci/2.json b/.makeshiftci/2.json new file mode 100644 index 0000000..ea25ac8 --- /dev/null +++ b/.makeshiftci/2.json @@ -0,0 +1,8 @@ +{ + "name": "deploy", + "image": "nixos:latest", + "secrets": { + "SECRET_SSH": "/run/secrets/msci/sshkey" + }, + "run": ["./deploy.sh"] +} diff --git a/aphrodite/devops/msci.nix b/aphrodite/devops/msci.nix index 489a986..fd69784 100644 --- a/aphrodite/devops/msci.nix +++ b/aphrodite/devops/msci.nix @@ -2,9 +2,9 @@ buildDomain = "build.${config.customOps.domain.fqdn}"; in { sops.secrets = { - "msci/taur/sshkey" = {}; - "msci/taur/gpgkey" = {}; - "msci/taur/gpgpwd" = {}; + "msci/sshkey" = {}; + "msci/gpgkey" = {}; + "msci/gpgpwd" = {}; }; makeshiftci = { enable = true; diff --git a/deploy.sh b/deploy.sh new file mode 100755 index 0000000..2db441c --- /dev/null +++ b/deploy.sh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash + +set -e + +./ssh_setup.sh + +echo "updating adonis" + +ssh root@adonis.toufy.me -C <<EOF + git -C /etc/nixos pull + nixos-rebuild dry-activate --flake /etc/nixos --upgrade + nixos-rebuild switch --flake /etc/nixos --upgrade + nix-collect-garbage -d +EOF + +echo "updating aphrodite" + +ssh root@aphrodite.toufy.me -C <<EOF + git -C /etc/nixos pull + nixos-rebuild dry-activate --flake /etc/nixos --upgrade + nixos-rebuild switch --flake /etc/nixos --upgrade + nix-collect-garbage -d +EOF diff --git a/secrets.yaml b/secrets.yaml index 2d12e12..4b04d04 100644 --- a/secrets.yaml +++ b/secrets.yaml @@ -5,10 +5,9 @@ mailserver: searx: ENC[AES256_GCM,data:n451XLvOi2D2YvL0/+ko+HyXWEU7uuVlivkFsKxIzq1EWqMVEhFgEAt1k8W15AdgLY1xo455fUbL6/W1uSFO8w==,iv:QfX7s4l4QuZ8/85Q/+0OWezDGqOKXdY7B5M6wq/5tAM=,tag:ppZXewIAN0IdRMgrIIKTmg==,type:str] gitolite-sshkey: ENC[AES256_GCM,data:eAjtnbhPkRN0tvVkQiYJkxhqZxjxLniv4DQokHtJzoCpxuqzfetSLXYk//p0Me9Irt6N1UJQ9xygtO9z+v5fz/sjTJAOg5yqGHwNEeLGdJdJfP8hBBI/5g4G4lNELh6hXeqy8a5lQRXmSi5nf3pQ8va8jDTr+qE5SsKB0ypQmS2fK2T8UyobYWRAy6XKfOd15QfheqWwYaiKAh8jp2VQyixcRkE9IPOE5bHwnzYvhVOZESwq4sogXeCaOOq7IjFfVZ6i5CFjJelL4sU8Og13XJYe0KnB8Q3aFXDroLkImW/GEL1ISGHOFZRMX1Wmx2IJzCpWLrnhRHFGDksfPDfI9CBB5+DfoyvFE0bQDISi/72R1g5wu29H5gtiGYhgtedCIhoQ+YVjswZ0xD3Oi071InRrm6qtPY2PilLorlMsSZ3sV6sunZ8TijwJzcWLK8b4jd7hztMNSEyCgxJGOG78//NcI+8amE7Hq4GH4THFgX+eG8RL9QU3lnJ33Km9agAlqnd6+MJXWmAi75tHugMz,iv:5G1gNkhLeDmo3t3SRYHOAcHhTJZS2aZTR7zeoXOimQ8=,tag:XBnh4Q2IAQyour5ddD05/g==,type:str] msci: - taur: - sshkey: ENC[AES256_GCM,data:iqyKTDoOfbdbEpPB5Yh0K/kz4DSHj0Gutrtdvvtj/MzCLKLWFi2fqf/W78YWjdooaliUMcbnYOVzn/6Uy9mRK1vL8Tx7qUBtqxOBMDFirdJe/6FmuFldYq62Jm6GWtvtB1gG2cmk+ZXhi39BPAJ7k9PWRI4nMKMdY81kVYR6cPSOnoUXkBfXAE5lX/XxT0jKiEgUTE6HGQ/o1HongtK3mfDvUfNPdJrAqKIJF/zsxEFRQKDpelGA8Oymr+x7cALmkNteZb5mV+XVSVeiHw45ejEUulNW+XYNcW82FjmIycM4XZ94SyO+5ucRpa0rRlFa2veqcN8FWiHOT/om9LQo8AQ3vMxj3fqquI9AHHrfEMbnsa3P502rzWdyU9f0KH8TCde/Ki6ZtPap6B0IaOBz+fNY8Vv0dRNs+ZclitYKTNkpDI50CZl17LwSNIBFQH+6ZWzPQo0XNIxyLZ8rQS7PZrQZJHSPNF1OivNEwhuUM7JKHK/LG1U2XTqkdTMljKX2uNLSSfNGxXZZPo7BiJYU,iv:rpSJDwJnfKqpXCWv3GvAnuteF0B0ZxssO36OkE2k5V0=,tag:zC/2tTxFI/4UvQMfooU/Ng==,type:str] - gpgkey: ENC[AES256_GCM,data:v/CqXy5jkSuJHDvgT5Daolw9En+jLbBuJTsa7C1GvZhU5VKNhhr05TVTuotYqbcoAkXTeTpEwWWWku8DSo8i+sHovqJ5081r6I0q0uSrvz8ESS9KeYNaxwOGVRgLCYeJmoSp8m4q+CcKWEuMiyPhI8UAF1AjtouO/G3sR0KYPbIiPateO/NiAjmwX6iilcnctlj5LN7gO4srBTHO+NVXZSgkFh2zm4pWZGqC0jrbV91a+tZyMGZaJ9v6mqeb+umBBIFTg/KvM0zg5NA4e8sWc8MYZaDyJdw+7iYn0m6KmjkOKuluNCBgyKp03vGS4AjKtGZwfr6W22pu6hvNDlUxXhtDBmyqbGhfYMMHSdA1H6vky1WU+xue195eoa6cggykKTUepxDdo+LCU+l8qE9/7BD683ouDAn2ao+9icQQ2q5Bi9ZJg1oLiTD+IpB1plECZKjyaoxtv4w5/u/ytgnr/AZPbmrjUgkbupXMJxP6JaVsAFQhTgZDr+/wz6z6mJ0BUZImbH5gBGEoeIKhLQuNwrvIxBROTvCtSBdMlZ6bQ13MTBDo/SNrY08310qnXgqD95WCETJG7JIgoMI4W0of+FtKAogDe9izsFVxoCDCoJW5kH2ZucNLtiJ1y1N0/bQNAp+hO9pynM0jCu1oeLzGOgbAzVK7xZg6NtUjUInoSXJgBmn9ely0s/kse9den1BULz/sD3/5S1kr7kvLix3Pyr9i/jSpH57dj7XE7yZZJGCbI84DPpUQwKjjQTdlFWcEUXe7H9YQ3/Pgn5DfS1YpOP2eVyT2M2ChDjXNiPTHez6cJ1STJiJ1bUnHUXgHhixWG01kr4Ya4Ku2vDEndL0Wpjg6K3Yn8Ehv3EpUuTlJ73RLMkDm7UxP7l6NDxPsBCjNsj0HsCS2KuFkzqjDnqA3fd2XZyIK+zXyBLSHVeCBuzkPOxrNHrmxongAhrbv00oh78nkgoMtfa5ZZUJ+eWyRnuZc/gEiwitKh2i+XfewWi/jLwnvZwtVlb5/EF9oBxi8cc6HPKLOimZIFIFsqJSfxg==,iv:Wn+dVURWl8p4J+wu8eoYqNbBBN7GvUYu7Q5dsRZ6fmo=,tag:BhIx7Txo+yYBvQPV2vJfmQ==,type:str] - gpgpwd: ENC[AES256_GCM,data:5tFH+DDpE0gv9+7Pm6LMfqf58qU3PH36D4s+gb1TcGN1xnICVsT8y0PMmTaiAyOMaQ==,iv:5njC3GuA3qZiPv0dMRylS3sQ1QNXeDEUeoVlGdmpLVU=,tag:2B05LT4R1z8XABchVuAl1g==,type:str] + sshkey: ENC[AES256_GCM,data:b4xHoTnmkCYghRylcV2U63Sh/l7sM2YQ76GgHFxHp2HKxo3slRQkgEe6GSgEXD0vYHGoXDCBo7x4Vhvf58nvKOOveHtg+l4w+ypFQ+5DRIl4gLnHBEyIMFm3IXlwKnSV+qAxODKFWkbv9yIatWpJa2K8uXJ5+VbQ2tdDoWi4C51cuhDA7mRydxT4xcKdOFN6ajufFIeYeu867Pr8qUy53j8rYCsBaCIphtv/UW7r1noWKz7P8tt6pU+hpht7BrKu6sUq6lDG7GHnlQjp7Ypj7OQhm1isHHp/5uSabcJ+nkW6MOw39QUDgUEdtka1KN1FTdLaYnzr4OYXKmbvBATEgamgVwYVEbPWgc/0aIDgzn9hQhRII3x/VsoWKB4+TnMaUgvbRJ1ZU9FztMqeX4+gzvXta7ANwzESUvS8ce/kwMKbEAPvbc11YcAYdnxZEoPZ1qVQ3W72WZM6jBd45aDH8wOUxhVAJnw7pPx0xLqb68lFnT+tS2yavHRTUFovdCO3fBu6hl5P2pRe5S2kmkVG,iv:MvmVhJPFMegABugWuXUS3iNU5R26ZaaQARdXeye5Bzs=,tag:59ZGDZSQ+3RovxsgngQy7A==,type:str] + gpgkey: ENC[AES256_GCM,data:9H3NfqjWiH7N1W6/4jQcfH8ML69V3Pt+8M1KyLvo2ITvX892x/ymvHS6df8JQ2NGzoPia/oZ9cFiDhku8mCX8rcH5o2Dn7CefEMeXpr5MpiZQj83Kz02a5VowbJcEx71ByIdosQl6y1qWFSomjv4xpdlJ1qI7eY168crjkBn/O/P12zDBC+rw6qiGWRsIKufHn+kLcVaw/Z5n0Gt0H2OvtKioyAcZGn1LIWWyzRCIe3UHUtI/6X4AKGuKDGr6kJQfe0xfSRIc1lancjpcvlHIIpJ5QCdbr2jj4Mx26tfgEHidCNAZQH0tckQUvnQGlrGo2eQwAG7CF1W0c1LAXq9N26yhvZRkrAfbGb1nOLJ8njYJR1UEre40TnPcP7sPn8j1z1XvBmPSF5fsTXL9+qvbvT2PBBrXrP6408oHHVLFUm9g50hoYVvf4ZxVXG65pxpN+wyB03vQTvPT/O27Y1ZWfanODWfdUfcSgkYMLS/AysnUmT3Mzbzn1WHBfvwLF1nNY1vC0tRdgfpvXs9XxT/YVPK5WvM1MDSfPvLDyR0BpwfM045bt24ieWU+zSNL9rb16A+F6sjj9JVvEEaRoxV+vP5kGmCx7+jr780RI6GGHXlPn1l1LNnRL3htycSxB6/XBi1sAcM01Ft4b6mOYnCHpFXRLpT82YlL0VqM2ysGDSiC3ROxktowcY5gc1ncvRldn1SpeTKlDTiNwWYDx2YcZrIZICNaSumZRavPiE3hIQiPlGixbj3LvknzV8HwaFXXFO7/50s5E7KFcMbpKEA2sRQVGggyy1gt8YKaW+twk+TKMRoVTqHHSmiPja1HIHbL/qfWx3zABoADeLL5d197yZmm8tzmZd3kbxSg4INtiBYcVqumoTKjcsDM0FkubisLVmUgiDJA1LztH2t/Q8XWipi+JFSmau27n+1g7o3Ev9JLAaVhVz/CXqJkyKXPTolHOO6BNQ2aKHc4yV6IkeXHFUHaq7SX/qApPchW+YPikkdbaSguBQ5j0hpoguj+0VZc02IxMVNUlhHcT0ivNHbtg==,iv:WIiNQzwBB5NShl3kmES0klcsvx5hDk1y/o1TMCscb8E=,tag:U41TaRxxrWgnK3FJfMEXsw==,type:str] + gpgpwd: ENC[AES256_GCM,data:Mawtj2lOmKRk1jUtSWUb+oFoHTC/dXPkEi3iYiqaNoAms7GSKOPMikdzg0WUBtvTmQ==,iv:qZg4PBCv8Q6YtRygTsnLu/D9VzK4nVRgPET7qbII4xc=,tag:Ux6syzVGySLIwPcfJtDriA==,type:str] sops: age: - enc: | @@ -38,7 +37,7 @@ sops: AjeKUiRMROq4PMJYmWXDjToBlvdOFq9oYNl+1mNlcQTMbEkCoqIfrw== -----END AGE ENCRYPTED FILE----- recipient: age1ra6vn99y233pxrlpcwpuwl7vc8ma5y4ucg5jlkfylh6kudsxzehqznqmet - lastmodified: "2026-05-22T14:07:49Z" - mac: ENC[AES256_GCM,data:Y3Ty0e96p6+225JIPvtpCEsEcFgCJCt+CwFdFHimhAKCfBEHRKretpU3xTQCvkC45J/Aq9trRCbGKLJq69hqweo548Rc2S12LFYWucTm+lvDyI+8pWxiw5EeOAkEegzDfm1SmBVCGhlsoc/KqRiiRzq9iWLQIsrA9EHESyJrWoQ=,iv:JbwSxx1g29tgGFUPQxC5P71Y66vfnCLCkFk2FXl1/Vg=,tag:ftYbwwNzuxouiLSD2TapXg==,type:str] + lastmodified: "2026-06-22T21:20:27Z" + mac: ENC[AES256_GCM,data:LdF9oiBmbwnCUeIZOF25h11k/V8t4etJovKHlwMzNgMVbj1ZFxYwCkv8iTjVluYZM4rq1DPcNuDM2guAda08XUiIODoJWtvoHTvvX5pEQ6a0BAspFOJUJ4oFnNmABh1WJ0gUnN85s1QYpqB0r3UtT2ZyeFoYtfmkFW5Ujv2z+yg=,iv:vSKE2jTSvzlbqytD2qtjWBznI7HQBhpCycRQl5/PE3M=,tag:O8AC6W6Jzf1W7svdZUs88A==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 diff --git a/ssh_setup.sh b/ssh_setup.sh new file mode 100755 index 0000000..fdb7172 --- /dev/null +++ b/ssh_setup.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash + +mkdir -p ~/.ssh +chmod -R 755 ~/.ssh +cp "$SECRET_SSH" ~/.ssh/id_ed25519 +chmod 600 ~/.ssh/id_ed25519 +echo "aphrodite.toufy.me adonis.toufy.me" | + xargs ssh-keyscan >~/.ssh/known_hosts diff --git a/update.sh b/update.sh new file mode 100755 index 0000000..da1a763 --- /dev/null +++ b/update.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -e + +./ssh_setup.sh + +git config --global user.email "msci@toufy.me" +git config --global user.name "makeshiftci" + +nix-channel --update + +nix --extra-experimental-features "nix-command flakes" flake update + +git diff --exit-code flake.lock && exit 0 +git add . +git commit -m "update flake.lock" +git push ssh://git@git.toufy.me:servers |