Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

set age key dir to be in persist dir

Browse Source
This commit is contained in:
Nathan
2024-11-18 15:24:15 -06:00
parent 359bc6769d
commit af730c5b20
7 changed files with 102 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
system-config/services/containers/gitlab/default.nix
View File

@@ -7,34 +7,20 @@
config = lib.mkIf config.sysconfig.opts.virtualization.gitlab.enable {
sops.secrets."gitlab/db_pass" = {
owner = "sshd";
};
sops.secrets."gitlab/root_pass" = {
owner = "sshd";
};
sops.secrets."gitlab/secrets/secret" = {
owner = "sshd";
};
sops.secrets."gitlab/secrets/otp" = {
owner = "sshd";
};
sops.secrets."gitlab/secrets/db" = {
owner = "sshd";
};
sops.secrets."gitlab/secrets/jws" = {
owner = "sshd";
};
sops.secrets."gitlab/oidc/id" = {
owner = "sshd";
};
sops.secrets."gitlab/oidc/secret" = {
owner = "sshd";
sops.secrets = {
"gitlab/db_pass" = {};
"gitlab/root_pass" = {};
"gitlab/secrets/secret" = {};
"gitlab/secrets/otp" = {};
"gitlab/secrets/db" = {};
"gitlab/secrets/jws" = {};
"gitlab/oidc/id" = {};
"gitlab/oidc/secret" = {};
};
containers.gitlab = {
autoStart = false;
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.16";
@@ -43,51 +29,49 @@
hostPath = "/ssd1/Gitlab/data";
isReadOnly = false;
};
"/etc/gitlab/dbpass" = {
hostPath = config.sops.secrets."gitlab/db_pass".path;
isReadOnly = false;
};
"/etc/gitlab/rootpass" = {
hostPath = config.sops.secrets."gitlab/root_pass".path;
isReadOnly = false;
};
"/etc/gitlab/db" = {
hostPath = config.sops.secrets."gitlab/secrets/db".path;
isReadOnly = false;
};
"/etc/gitlab/secret" = {
hostPath = config.sops.secrets."gitlab/secrets/secret".path;
isReadOnly = false;
};
"/etc/gitlab/jws" = {
hostPath = config.sops.secrets."gitlab/secrets/jws".path;
isReadOnly = false;
};
"/etc/gitlab/otp" = {
hostPath = config.sops.secrets."gitlab/secrets/otp".path;
isReadOnly = false;
};
"/etc/gitlab/oidc-id" = {
hostPath = config.sops.secrets."gitlab/oidc/id".path;
isReadOnly = false;
};
"/etc/gitlab/oidc-secret" = {
hostPath = config.sops.secrets."gitlab/oidc/secret".path;
isReadOnly = false;
};
};
extraFlags = [
"--load-credential=dbpass:${config.sops.secrets."gitlab/db_pass".path}"
"--load-credential=rootpass:${config.sops.secrets."gitlab/root_pass".path}"
"--load-credential=secret:${config.sops.secrets."gitlab/secrets/secret".path}"
"--load-credential=otp:${config.sops.secrets."gitlab/secrets/otp".path}"
"--load-credential=db:${config.sops.secrets."gitlab/secrets/db".path}"
"--load-credential=jws:${config.sops.secrets."gitlab/secrets/jws".path}"
"--load-credential=oidc_id:${config.sops.secrets."gitlab/oidc/id".path}"
"--load-credential=oidc_secret:${config.sops.secrets."gitlab/oidc/secret".path}"
];
config = {
systemd.tmpfiles.rules = [
"z /etc/gitlab/dbpass - gitlab gitlab"
"z /etc/gitlab/rootpass - gitlab gitlab"
"z /etc/gitlab/db - gitlab gitlab"
"z /etc/gitlab/secret - gitlab gitlab"
"z /etc/gitlab/jws - gitlab gitlab"
"z /etc/gitlab/otp - gitlab gitlab"
"z /etc/gitlab/oidc-id - gitlab gitlab"
"z /etc/gitlab/oidc-secret - gitlab gitlab"
];
systemd.services.secrets_setup = {
wantedBy = [ "gitlab.service" ];
serviceConfig = {
LoadCredential = [
"dbpass"
"rootpass"
"secret"
"db"
"otp"
"jws"
"oidc_id"
"oidc_secret"
];
};
script = ''
cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/gitlab/dbpass
cat ''${CREDENTIALS_DIRECTORY}/rootpass > /etc/gitlab/rootpass
cat ''${CREDENTIALS_DIRECTORY}/secret > /etc/gitlab/secret
cat ''${CREDENTIALS_DIRECTORY}/db > /etc/gitlab/db
cat ''${CREDENTIALS_DIRECTORY}/otp > /etc/gitlab/otp
cat ''${CREDENTIALS_DIRECTORY}/jws > /etc/gitlab/jws
cat ''${CREDENTIALS_DIRECTORY}/oidc_id > /etc/gitlab/oidc-id
cat ''${CREDENTIALS_DIRECTORY}/oidc_secret > /etc/gitlab/oidc-secret
chown gitlab:gitlab /etc/gitlab/*
'';
};
services.gitlab = {
enable = true;
@@ -162,7 +146,7 @@
systemd.services.gitlab-backup.environment.BACKUP = "dump";
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
networking.firewall.allowedTCPPorts = [ 22 80 ];
system.stateVersion = "24.05";
};