m3ta-chiron
f1481dc256
- port registry: atrocore = 3058 - oci-container atrocore: Gitea-registry image, 127.0.0.1:3058:80, web network, static ip 10.89.0.16, db alias to host pg, env-file from agenix, named volume for instance data, registry login via token secret - agenix secrets: atrocore-env (ATRO_DB_*) + atrocore-registry-token, age-encrypted to AZ-PRM-1 + user, non-interactive creation - host postgres 17: idempotent atrocore-db-init oneshot (psql peer, secret only at runtime), pg_hba 10.89.0.0/24 scram-sha-256, atrocore in 03:10 backup list - traefik: pim.l.az-gruppe.com -> localhost:3058 (ionos, websecure)
98 lines
2.9 KiB
Nix
98 lines
2.9 KiB
Nix
{lib, ...}: let
|
|
ntfyGrafanaWebhookSecret = ../../secrets/ntfy-grafana-webhook.age;
|
|
litellmPrometheusBearerSecret = ../../secrets/litellm-prometheus-bearer.age;
|
|
in {
|
|
age = {
|
|
secrets =
|
|
{
|
|
atrocore-env = {
|
|
file = ../../secrets/atrocore-env.age;
|
|
};
|
|
atrocore-registry-token = {
|
|
file = ../../secrets/atrocore-registry-token.age;
|
|
};
|
|
azion-env = {
|
|
file = ../../secrets/azion-env.age;
|
|
};
|
|
grafana-admin-pw = {
|
|
file = ../../secrets/grafana-admin-pw.age;
|
|
owner = "grafana";
|
|
};
|
|
grafana-db-password = {
|
|
file = ../../secrets/grafana-db-password.age;
|
|
owner = "grafana";
|
|
};
|
|
grafana-secret-key = {
|
|
file = ../../secrets/grafana-secret-key.age;
|
|
owner = "grafana";
|
|
};
|
|
monitoring-loki-htpasswd = {
|
|
file = ../../secrets/monitoring-loki-htpasswd.age;
|
|
owner = "traefik";
|
|
mode = "0400";
|
|
};
|
|
netbox-secret-key = {
|
|
file = ../../secrets/netbox-secret-key.age;
|
|
owner = "netbox";
|
|
mode = "0400";
|
|
};
|
|
netbox-api-token-pepper = {
|
|
file = ../../secrets/netbox-api-token-pepper.age;
|
|
owner = "netbox";
|
|
mode = "0400";
|
|
};
|
|
traefik-env = {
|
|
file = ../../secrets/traefik-env.age;
|
|
};
|
|
kestra-config = {
|
|
file = ../../secrets/kestra-config.age;
|
|
mode = "644";
|
|
};
|
|
kestra-env = {file = ../../secrets/kestra-env.age;};
|
|
kestra-secrets = {file = ../../secrets/kestra-secrets.age;};
|
|
n8n-env = {
|
|
file = ../../secrets/n8n-env-prm.age;
|
|
};
|
|
n8n-runner-auth-token = {
|
|
file = ../../secrets/n8n-runner-auth-token-prm.age;
|
|
};
|
|
pgadmin-pw = {
|
|
file = ../../secrets/pgadmin-pw.age;
|
|
owner = "pgadmin";
|
|
};
|
|
pg-cert = {
|
|
file = ../../secrets/server.crt.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0644";
|
|
};
|
|
pg-key = {
|
|
file = ../../secrets/server.key.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0600";
|
|
};
|
|
phishboard-env = {
|
|
file = ../../secrets/phishboard-env.age;
|
|
};
|
|
smb-autoablage = {
|
|
file = ../../secrets/smb-autoablage.age;
|
|
};
|
|
}
|
|
// lib.optionalAttrs (builtins.pathExists ntfyGrafanaWebhookSecret) {
|
|
ntfy-grafana-webhook = {
|
|
file = ntfyGrafanaWebhookSecret;
|
|
mode = "0400";
|
|
};
|
|
}
|
|
// lib.optionalAttrs (builtins.pathExists litellmPrometheusBearerSecret) {
|
|
litellm-prometheus-bearer = {
|
|
file = litellmPrometheusBearerSecret;
|
|
owner = "prometheus";
|
|
group = "prometheus";
|
|
mode = "0400";
|
|
};
|
|
};
|
|
};
|
|
}
|