c8cfdcd88e
Both run on pinix, published only through the pinix Tailnet namespace and Traefik's web-internal entrypoint (unbound local-data + Headscale split DNS for intent./ereader.domain2). Live Intent reads its OpenAI key from the new pinix-only agenix secret. ereaderViewer is a path: flake input for now; the repo split plan moves it into its own repository on cgit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
2.6 KiB
Nix
52 lines
2.6 KiB
Nix
let
|
|
tnix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrZETtzrSfkomL9H31SuyQJ8O39ujMIjsCkbjL4DgxM";
|
|
root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICb7MnxZch2IfxkFhKjGWkAVeAENJFEFaMk91UQTiQBf";
|
|
root2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ6v2CMRHS50Wq5cAqWenwkV8GNONFIDbKpW4ChfptUc";
|
|
users = [ tnix root root2 ];
|
|
|
|
blunix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBKr9V1HzAAFJ+6sjtrrkq8/qM9DFQq2gNUvbIB5Jn2C";
|
|
pinix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTIBiB9JYYtViI1IKK96pH+x3D63BQQgmZstc8jPBNp";
|
|
systems = [ blunix pinix ];
|
|
in
|
|
{
|
|
"dns-challenge.age".publicKeys = users ++ systems;
|
|
"domain.age".publicKeys = users ++ systems;
|
|
"lldapAdmin.age".publicKeys = users ++ systems;
|
|
"bindPW.age".publicKeys = users ++ systems;
|
|
"oidcHeadscale.age".publicKeys = users ++ systems;
|
|
"webdav.age".publicKeys = users ++ systems;
|
|
"go-sendxmpp.age".publicKeys = users ++ systems;
|
|
"oidcForgejo.age".publicKeys = users ++ systems;
|
|
"oidcGTS.age".publicKeys = users ++ systems;
|
|
"oidcGTSEnv.age".publicKeys = users ++ systems;
|
|
"oidcVikunja.age".publicKeys = users ++ systems;
|
|
"oidcAudiobookshelf.age".publicKeys = users ++ systems;
|
|
"oidcQuantum.age".publicKeys = users ++ systems;
|
|
"oidcTrek.age".publicKeys = users ++ systems;
|
|
"oidcOauth2.age".publicKeys = users ++ systems;
|
|
"oauth2Cookie.age".publicKeys = users ++ systems;
|
|
"traefikBasicAuth.age".publicKeys = users ++ systems;
|
|
"traefikDashboardPassword.age".publicKeys = users;
|
|
"mailPW.age".publicKeys = users ++ systems;
|
|
"ipv4.age".publicKeys = users ++ systems;
|
|
"ipv6.age".publicKeys = users ++ systems;
|
|
"motd.age".publicKeys = users ++ systems;
|
|
"wirelessSecretsFile.age".publicKeys = users ++ systems;
|
|
"pinix-wifi.age".publicKeys = users ++ [ pinix ];
|
|
"pinixLldapAdmin.age".publicKeys = users ++ [ pinix ];
|
|
# Reusable key for the main blunix, tnix and pinix nodes. It enrolls them
|
|
# under the single Headscale user `lukas`; the technical pinix-dns node has
|
|
# its own short-lived key and account.
|
|
"pinixHeadscalePreAuthKey.age".publicKeys = users ++ systems;
|
|
"resticPW.age".publicKeys = users ++ systems;
|
|
"headscalePreAuthKey.age".publicKeys = users ++ systems;
|
|
"agentXmpp.age".publicKeys = users ++ systems;
|
|
"builderXmpp.age".publicKeys = users ++ systems;
|
|
"financeXmpp.age".publicKeys = users ++ systems;
|
|
"forgejoToken.age".publicKeys = users ++ systems;
|
|
"agentCalendarPw.age".publicKeys = users ++ systems;
|
|
"icecastPw.age".publicKeys = users ++ systems;
|
|
"openrouterApiKey.age".publicKeys = users ++ systems;
|
|
"liveIntentOpenaiApiKey.age".publicKeys = users ++ [ pinix ];
|
|
"bindAcmeTsig.age".publicKeys = users ++ systems;
|
|
}
|