titaniumtown/server-config
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

age-secrets: add git-crypt-key-nixos (pre-unify cutover)

Browse Source 
Additive. The new unified nixos repo (projects/nixos/) uses a fresh git-crypt
key so we can retire the two per-repo keys later. Deploying this change alone
makes /run/agenix/git-crypt-key-nixos available on muffin; the nixos CI's
git-crypt unlock step can then succeed once the new repo lands on Gitea.
This commit is contained in:
primary
2026-04-18 01:19:17 -04:00
parent 4bc5d57fa6
commit 96a0162b4e
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
modules/age-secrets.nix
View File

@@ -168,6 +168,15 @@
group = "gitea-runner"; group = "gitea-runner";
}; };
# Git-crypt symmetric key for the new unified nixos repo (Phase 5 of the unify migration).
# Added additively here so muffin can decrypt nixos's secrets once Phase 6 cuts CI over.
git-crypt-key-nixos = {
file = ../secrets/git-crypt-key-nixos.age;
mode = "0400";
owner = "gitea-runner";
group = "gitea-runner";
};
# Gitea Actions runner registration token # Gitea Actions runner registration token
gitea-runner-token = { gitea-runner-token = {
file = ../secrets/gitea-runner-token.age; file = ../secrets/gitea-runner-token.age;

BIN
secrets/git-crypt-key-nixos.age Normal file
View File

Binary file not shown.