diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix index 6356e88..a33e7b3 100644 --- a/nix/modules/caddy-base/default.nix +++ b/nix/modules/caddy-base/default.nix @@ -4,6 +4,7 @@ let plugins = [ "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" + "github.com/caddy-dns/rfc2136@v1.0.0" ]; hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; }; diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index e4c1b0a..bec542b 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -19,6 +19,17 @@ insecure true } + acme_dns rfc2136 { + key_name "test" + key_alg "hmac-sha256" + key "" + server "dns1.local:53" + } + + tls { + dns_challenge_override_domain "nilstrieb.dev" + } + servers { metrics } diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix index 815eed0..7d1c858 100644 --- a/nix/modules/dns/default.nix +++ b/nix/modules/dns/default.nix @@ -1,6 +1,12 @@ -{ pkgs, lib, networkingConfig, ... }: +{ pkgs, lib, networkingConfig, config, ... }: let metricsPort = 9433; in { + age.secrets.knot_dns_rfc2136_key_config = { + file = + ../../secrets/knot_dns_rfc2136_key_config.age; + owner = "knot"; + }; + # get the package for the debugging tools environment.systemPackages = with pkgs; [ knot-dns ]; @@ -21,12 +27,25 @@ let metricsPort = 9433; in services.knot = { enable = true; + keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ]; settingsFile = pkgs.writeTextFile { name = "knot.conf"; text = '' server: listen: 0.0.0.0@53 listen: ::@53 + + key: + - id: rfc2136-update + algorithm: hmac-sha256 + secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds= + + acl: + - id: update_acl + address: 10.0.0.0/24 + key: rfc2136-update + action: update + update-type: [TXT] zone: - domain: noratrieb.dev @@ -35,6 +54,7 @@ let metricsPort = 9433; in - domain: nilstrieb.dev storage: /var/lib/knot/zones/ file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }} + acl: update_acl log: - target: syslog any: info diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index c753f0f..808e0b1 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -54,6 +54,9 @@ let ns1 = dns1; ns2 = dns2; + # --- ACME setup for caddy + _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ]; + # --- website stuff blog = vps1; www = vps1; diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index af72302..adb5d54 100644 Binary files a/nix/secrets/backup_s3_secret.age and b/nix/secrets/backup_s3_secret.age differ diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index fb3f1f4..d231b80 100644 Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index 83a4bc9..21dbaca 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw -PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM ---- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic -|HLXZ'v2" ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08 +vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs +--- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY +j9KyȰ0*ÜbɿY0I3v+D"*/g`o#ص \ No newline at end of file diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age index 81b84bd..a1a6080 100644 Binary files a/nix/secrets/does_it_build_private_key.age and b/nix/secrets/does_it_build_private_key.age differ diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index ae631cc..609822d 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k -qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk ---- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY -".O J76~ԥSH-40 [vAD=^Ty"@A@,P|q!؊M \ No newline at end of file +-> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw +M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E +--- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys +G6?U'ry@b $MZ`@kv]6_۟Nق $!mVkgA]yW,d';Ȧ핒 ܎ \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index 7f33bee..ce127e4 100644 --- a/nix/secrets/garage_secrets.age +++ b/nix/secrets/garage_secrets.age @@ -1,13 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM -nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE --> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI -KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug --> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw -kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI --> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs -KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM --> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8 -9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y ---- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk -UsI lNdL^q/PD\%s4GCϺքag|-f+,|vpj].L=U_?bG&Yw|f~4qR*Lx$ڋYPrEN,jWz#K@̧#7"&Ξ=GxN.nO7c}fczT \ No newline at end of file +-> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY +aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY +-> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ +Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14 +-> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4 +SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0 +-> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo +GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw +-> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U +rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA +--- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88 +ru^+=$!1 +rF-NHr+2z>Fiw`ˬ024(3 իH=ay$tV|H I d2_` dr?PM bش%qho"ߗlzs;r{XuE n)'!VZ֘܌u \ No newline at end of file diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index 5dd7134..d009691 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,13 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU -e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg --> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4 -QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ --> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk -LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE --> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo -yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA --> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs -acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8 ---- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI -{đq.忳U َcO)|¥,+^]?PĻ$3m4Ǧ|c).R6@r] \ No newline at end of file +-> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8 +A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0 +-> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8 +CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc +-> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY +aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM +-> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk +2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8 +-> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4 +sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk +--- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc +uM?C0Z& rSgWp8{*6yqð% \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 53e26d0..eecd4fc 100644 Binary files a/nix/secrets/grafana_admin_password.age and b/nix/secrets/grafana_admin_password.age differ diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index fec59be..0465eba 100644 Binary files a/nix/secrets/hugochat_db_password.age and b/nix/secrets/hugochat_db_password.age differ diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age index 08c97e4..cecada9 100644 --- a/nix/secrets/immich_secrets.age +++ b/nix/secrets/immich_secrets.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY -0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0 ---- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg -*clHxAh5H(dU'nҘ;M.Vx}" f 9f~Jv9 \ No newline at end of file +-> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo +nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA +--- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao +x ll w\vS-!V]}g΃[>e;n0n!;L ++ \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 3633642..19d8d77 100644 --- a/nix/secrets/killua_env.age +++ b/nix/secrets/killua_env.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg mMvnBUGVS8d0di+drDXo7mws4Uz5T+nZmQY9uUpKfQ8 -rea2peORLvRF6qYtGKFnylyEdnV0NTc6QO3xSgp/y1I ---- xyeBOfVq3hwyckUma5LWOU9cWHzg/XY2f8T/0Vc+njk -G6kN0 !Um[rHꟉt}׊X'yqLbEY:n NHnHݰ'W|3z{٢'N&M`# \ No newline at end of file +-> ssh-ed25519 qM6TYg w8lK7Dhc3CzenrzJTI32uTNgXVyBUKJf7F1xGG6AV2Q +wBlK8pbH1M0NBeAFjwLyyuOKT2jk+o1BwjkQPNc9pvY +--- 5hl/tchAPOurJ+fDLDB5/l/MuqrSTjV2Pnhc1Dy7Uhk +a.A hUwq<.dzXМ&;ⶸ9ۻͮc:z`D XLʳh\Yǝ'U^+^3k5t4 \ No newline at end of file diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age new file mode 100644 index 0000000..48f95c0 Binary files /dev/null and b/nix/secrets/knot_dns_rfc2136_key_config.age differ diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age new file mode 100644 index 0000000..fc3744f --- /dev/null +++ b/nix/secrets/knot_dns_rfc2136_key_envvar.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw +l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE +-> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU +nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY +-> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws +uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk +-> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI +7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI +-> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs +rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ +--- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4 +$Jk#_Fr"B}~P@.e܅YSL;Pz &0DiKJ^:Oc'+ \ No newline at end of file diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index 3b49086..1c85165 100644 Binary files a/nix/secrets/loki_env.age and b/nix/secrets/loki_env.age differ diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age index c046394..05d0b31 100644 --- a/nix/secrets/minio_env_file.age +++ b/nix/secrets/minio_env_file.age @@ -1,7 +1,8 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg OO4FC/zdYJPzw8ujHG66sX2ShWSrWfCKRj1z9FYOwyU -84DDDS2TPxxoGxxaj4WLJN6zZfVIH7m1xC1mRMMzBaM --> ssh-ed25519 XzACZQ YydvMTzqlr24U79p1vCZ0DIB1DmLNxp/kLptb5WtmCI -KaJ0zuNwVsYr0pLRB2MJIix22xTdujqspFPISU3Q9EU ---- TzKmJkMsYD2ZS7LJw9qdVRsBeoxMPQjOyovIoopesMI -S p+rGF "19,kVKЪ鍆ShnhyldFX+ d; ssh-ed25519 qM6TYg sx4kKW1m2RrcVkyxDMdDgh5jcwfrRDAFYa0EJBZKFnI +WPbchNFC7tTqC4DrIw7hUZSNNxE64kkXZdXB6/VFhj4 +-> ssh-ed25519 XzACZQ GXDgzIGU4X6/oOr5hcI7SoorcowGPJHx/0X2+gj+Sk0 +NATuZ7IZ0QwM9/GtaYdLXjBs6X0enhpVgWvGVpyqOO0 +--- xMESjwLO7fJhwd0HnYzypoh3s6YRx86vSdXovvSBoHg +9I{֝ʼؐZd{YrXB= +l] Hܴ`lRΙRw8Qi4*t#͂ƚmȟ+6hS&VἙ';J0] = \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 234ac01..f9a3b40 100644 Binary files a/nix/secrets/openolat_db_password.age and b/nix/secrets/openolat_db_password.age differ diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age index 1da8fb8..45894df 100644 Binary files a/nix/secrets/paperless_env.age and b/nix/secrets/paperless_env.age differ diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index 637f942..cea6275 100644 Binary files a/nix/secrets/pyroscope_s3_secret.age and b/nix/secrets/pyroscope_s3_secret.age differ diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index 5ffafb6..9422a04 100644 Binary files a/nix/secrets/registry_htpasswd.age and b/nix/secrets/registry_htpasswd.age differ diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index 72fe931..11fe1a4 100644 Binary files a/nix/secrets/registry_s3_key_secret.age and b/nix/secrets/registry_s3_key_secret.age differ diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age index 38f3560..da31522 100644 Binary files a/nix/secrets/restic_backup.age and b/nix/secrets/restic_backup.age differ diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index 0287a9e..ba1bd52 100644 Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index f9fed44..f02c447 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -33,6 +33,8 @@ in "does_it_build_private_key.age".publicKeys = [ vps4 ]; "immich_secrets.age".publicKeys = [ minipc ]; "paperless_env.age".publicKeys = [ minipc ]; + "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ]; + "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 631523c..003343f 100644 Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age index 9adbf22..42f873b 100644 Binary files a/nix/secrets/website_s3_key_write.age and b/nix/secrets/website_s3_key_write.age differ diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index f218338..59f797a 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs -PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo ---- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY -kMQl?N'!.LlLBoDY:_Vctci= 3rKvMfDu \ No newline at end of file +-> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0 +xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ +--- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE + +F0eҍY-{sh]ƬfApB^1e0!3s"j@=rRs(+" \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 536fb4f..64d55f0 100644 Binary files a/nix/secrets/wg_private_dns2.age and b/nix/secrets/wg_private_dns2.age differ diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age index 2fa88e6..1d0e1be 100644 --- a/nix/secrets/wg_private_minipc.age +++ b/nix/secrets/wg_private_minipc.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE -w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw ---- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ -m *Qv"+JQ Ā'PhD>GJ]ĠLݩ N̤ۀ \ No newline at end of file +-> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE +3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM +--- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w +@ +q,YL3)eqaK@]exC +tv-G!}Ji$=* \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index a944270..5dd33e1 100644 Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index 3cf2891..dbdcbd2 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE -NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM ---- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY -ʋ.\Ņiқ~`Q ,W;m pQTY Tz?]T-s4)ZP,6H5bԄ7h \ No newline at end of file +-> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8 +Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I +--- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ +CqC!n ƈ,bA8"MeNьnM[(֡XͤX+~ؓSnKXi8> \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index 5cb419d..f9b5098 100644 Binary files a/nix/secrets/wg_private_vps3.age and b/nix/secrets/wg_private_vps3.age differ diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age index 7915ceb..0674d3a 100644 --- a/nix/secrets/wg_private_vps4.age +++ b/nix/secrets/wg_private_vps4.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 51bcvA jfwnJ0gZN/FeF0krZ/ERWq/eqKBGwANBwea3xCJLeHw -x8ccoxcT8Yn99d6aWzZ667jUjE4dHPfz3ZIg9qG4xe0 ---- H0b14xAs2FTADz89JQx2eOSmAgN3Rs5A2o316xzISwc -@}`͠&9WjWSEH@V˒x[?Uu.~J*7ҷ< \ No newline at end of file +-> ssh-ed25519 51bcvA soCOaoBhsAvjaw29hw6Q9JkrLGbfQEwgszOIl38+CB8 +uj17MiT/crUT+LXF9TEylo131FV1cKQbNXQNWCI1djw +--- MAVo3X1mO0iUC0mEo4wbbDbK19hKxB/zEcfqfR4Bxsw +2}[I,sW/8KDkjzH,(nyߔ8uq.^PrͪCM`)1fy,XOҡ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index d870bc4..5bef662 100644 --- a/nix/secrets/wg_private_vps5.age +++ b/nix/secrets/wg_private_vps5.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc -653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw ---- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg -v_AbL"fR6W6hepKeg,E;`"G xuVB^+k6 \ No newline at end of file +-> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0 +/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE +--- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA +!p%~)6- Hy*e g pXѷӖk وm4bnx6de \ No newline at end of file diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index c9bb838..05e6159 100644 --- a/nix/secrets/widetom_bot_token.age +++ b/nix/secrets/widetom_bot_token.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg -LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8 ---- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc -)nCzLb!P[>jl(9P@{;a#Bq#0+]-M\5{)laWkRCEtc3 \ No newline at end of file +-> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE +DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA +--- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY +~'t/!Fb[k"yfiܨLGg!FqZaA3 +iE`v8<1Fmpx~)gc7R&%U'XDD \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index af313d3..374e672 100644 Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config new file mode 100644 index 0000000..61b3a36 Binary files /dev/null and b/secrets-git-crypt/knot_dns_rfc2136_key_config differ diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar new file mode 100644 index 0000000..5bb8e79 Binary files /dev/null and b/secrets-git-crypt/knot_dns_rfc2136_key_envvar differ