Syncing goliath configs

.sops.yaml

@@ -21,4 +21,14 @@ creation_rules:
   - pgp:
     - *kat
     age:
-    - *yukari
+    - *yukari
+- path_regex: cluster/cluster.tfvars.sops$
+  shamir_threshold: 1
+  key_groups:
+  - pgp:
+    - *kat
+- path_regex: tf/tf.tfvars.sops$
+  shamir_threshold: 1
+  key_groups:
+  - pgp:
+    - *kat

cluster/.envrc

@@ -0,0 +1,2 @@
+sops -d ./cluster.tfvars.sops > cluster.tfvars
+export TF_CLI_ARGS="--var-file=cluster.tfvars"

cluster/.gitignore

@@ -0,0 +1 @@
+cluster.tfvars

cluster/authentik.tf

@@ -0,0 +1,75 @@
+variable "authentik_postgresql_password" {
+    type = string
+}
+
+variable "authentik_secret_key" {
+    type = string
+}
+
+resource "helm_release" "authentik" {
+    depends_on = [
+        helm_release.local_path_provisioner
+    ]
+
+    name = "authentik"
+    repository = "https://charts.goauthentik.io"
+    chart = "authentik"
+    create_namespace = true
+    namespace = "authentik"
+
+    timeout = var.helm_timeout
+    cleanup_on_fail = true
+    force_update = true
+
+    values = [
+        yamlencode({
+            authentik = {
+                secret_key = var.authentik_secret_key
+                error_reporting = {
+                    enabled = true
+                }
+                postgresql = {
+                    password = var.authentik_postgresql_password
+                }
+            }
+            redis = {
+                enabled = true 
+                master = {
+                    persistence = {
+                        enabled = true
+                        storageClass = "local-path"
+                        accessModes = [
+                            "ReadWriteOnce"
+                        ]
+                    }
+                }
+            }
+            postgresql = {
+                enabled = true
+                password = var.authentik_postgresql_password
+                postgresqlPassword = var.authentik_postgresql_password
+                persistence = {
+                    enabled = true
+                    storageClass = "local-path"
+                    accessModes = [
+                        "ReadWriteOnce"
+                    ]
+                }
+            }
+            ingress = {
+                enabled = true
+                hosts = [
+                    {
+                        host = "auth.inskip.me"
+                        paths = [
+                            {
+                                path = "/"
+                                pathType = "Prefix"
+                            }
+                        ]
+                    }
+                ]
+            }
+        })
+    ]
+}

cluster/backend.tf

@@ -0,0 +1,10 @@
+terraform {
+  backend "remote" {
+    hostname = "app.terraform.io"
+    organization = "kittywitch"
+
+    workspaces {
+      name = "infrastructure-cluster"
+    }
+  }
+}

cluster/local-path-provisioner.tf

@@ -1,5 +1,5 @@
 resource "helm_release" "local_path_provisioner" {
-    name = "local-path-provisioner"
+    name = "local-path-storage"
     repository = "${path.module}/lpp/deploy/chart"
     chart = "local-path-provisioner"
     create_namespace = true
@@ -8,4 +8,10 @@ resource "helm_release" "local_path_provisioner" {
     timeout = var.helm_timeout
     cleanup_on_fail = true
     force_update = true
+
+    values = [yamlencode({
+        storageClass = {
+            defaultClass = true
+        }
+    })]
 }

cluster/pihole-deployment.tf

@@ -131,8 +131,8 @@ resource "kubernetes_deployment" "pihole" {
             initial_delay_seconds = 60
             period_seconds = 15
           }
-        }
         */
+        }
 
         container {
           image = "ghcr.io/tailscale/tailscale:latest"

cluster/postgres.tf

@@ -1,49 +0,0 @@
-variable "postgres_password" {
-    type = string
-}
-
-resource "kubernetes_namespace" "postgres_namespace" {
-    metadata { 
-        name = "postgresql"
-    }
-}
-
-resource "kubernetes_secret" "postgres_auth_secret" {
-    depends_on = [
-        kubernetes_namespace.postgres_namespace
-    ]
-
-    metadata {
-        name = "postgres-auth-secret"
-        namespace = "postgresql"
-    }
-    data = {
-        postgres-password = var.postgres_password
-    }
-    type = "Opaque"
-}
-
-resource "helm_release" "postgresql" {
-    depends_on = [
-        kubernetes_namespace.postgres_namespace,
-        kubernetes_secret.postgres_auth_secret
-    ]
-
-    name = "postgresql"
-    repository = "https://charts.bitnami.com/bitnami"
-    chart = "postgresql"
-    namespace = "postgresql"
-
-    timeout = var.helm_timeout
-    cleanup_on_fail = true
-    force_update = true
-
-    set {
-        name = "global.storageClass"
-        value = "local-path"
-    }
-    set {
-        name = "global.postgresql.existingSecret"
-        value = "postgres-auth-secret"
-    }
-}

cluster/tailscale.tf

@@ -1,11 +1,15 @@
-
 variable "tailscale_api_key" {
     type = string
 }
 
+variable "tailnet" {
+    type = string
+}
+
+
 provider "tailscale" {
     api_key = var.tailscale_api_key
-    tailnet = "inskip.me"
+    tailnet = var.tailnet
 }
 
 resource "tailscale_tailnet_key" "cluster_reusable" {

flake.lock

@@ -3,11 +3,11 @@
     "arcexprs": {
       "flake": false,
       "locked": {
-        "lastModified": 1682009296,
+        "lastModified": 1686151686,
-        "narHash": "sha256-7KboTstta5M1fk0aGAj3WaFOTIKQXrg52Ck4WGT8CsE=",
+        "narHash": "sha256-/YY+9A2Wgq9+IJHHsXQ5k6V1xVyKhvO50yWmbdp4f1E=",
         "owner": "arcnmx",
         "repo": "nixexprs",
-        "rev": "e8bbb166d899d6fb0777317a390c5abfa20286da",
+        "rev": "4899d9c123fc2c6570ce755344e08bf007a35ce8",
         "type": "github"
       },
       "original": {
@@ -24,11 +24,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1682009832,
+        "lastModified": 1686307493,
-        "narHash": "sha256-QdNOeFE7sI+0ddqVfn9vQDCUs7OdxhJ7evo9sdyP82Y=",
+        "narHash": "sha256-R4VEFnDn7nRmNxAu1LwNbjns5DPM8IBsvnrWmZ8ymPs=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "a1ee4d333b092bc055655fb06229eb3013755812",
+        "rev": "7c16d31383a90e0e72ace0c35d2d66a18f90fb4f",
         "type": "github"
       },
       "original": {
@@ -51,11 +51,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1682063650,
+        "lastModified": 1686747123,
-        "narHash": "sha256-VaDHh2z6xlnTHaONlNVHP7qEMcK5rZ8Js3sT6mKb2XY=",
+        "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "c2ea4e642dc50fd44b537e9860ec95867af30d39",
+        "rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
         "type": "github"
       },
       "original": {
@@ -102,11 +102,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1682273416,
+        "lastModified": 1686922395,
-        "narHash": "sha256-YvRc5TOyf92Fcvt6cYfsqxfjqalAUME3Klv4IbdhkBE=",
+        "narHash": "sha256-ysevinohPxdKp0RXyhDRsz1/vh1eXazg4AWp0n5X/U4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a5a294a622a7d3a837aaa145334e4d813c1bc5b1",
+        "rev": "9ba7b3990eb1f4782ea3f5fe7ac4f3c88dd7a32c",
         "type": "github"
       },
       "original": {
@@ -149,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1681591833,
+        "lastModified": 1686740472,
-        "narHash": "sha256-lW+xOELafAs29yw56FG4MzNOFkh8VHC/X/tRs1wsGn8=",
+        "narHash": "sha256-b668DY2qGdBCUwIkk6Z32bcpCsUISQJrEEvhtn1gGgY=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "68ec961c51f48768f72d2bbdb396ce65a316677e",
+        "rev": "e11c61073b777e025993c5ef63ddbf776a9cca15",
         "type": "github"
       },
       "original": {
@@ -164,11 +164,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1680876084,
+        "lastModified": 1686838567,
-        "narHash": "sha256-eP9yxP0wc7XuVaODugh+ajgbFGaile2O1ihxiLxOuvU=",
+        "narHash": "sha256-aqKCUD126dRlVSKV6vWuDCitfjFrZlkwNuvj5LtjRRU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3006d2860a6ed5e01b0c3e7ffb730e9b293116e2",
+        "rev": "429f232fe1dc398c5afea19a51aad6931ee0fb89",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1682181988,
+        "lastModified": 1686776226,
-        "narHash": "sha256-CYWhlNi16cjGzMby9h57gpYE59quBcsHPXiFgX4Sw5k=",
+        "narHash": "sha256-o6WbKvENj98QJz9Mco6T6SZGrjPewMDAFyKg0Lp8avU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6c43a3495a11e261e5f41e5d7eda2d71dae1b2fe",
+        "rev": "0d2cf7fe5fa05d5271a15a8933414ee0a1570648",
         "type": "github"
       },
       "original": {
@@ -195,16 +195,16 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1682173319,
+        "lastModified": 1686885751,
-        "narHash": "sha256-tPhOpJJ+wrWIusvGgIB2+x6ILfDkEgQMX0BTtM5vd/4=",
+        "narHash": "sha256-KcbYp2KuKbXgNaYVziwKUc6AKRhgJ1G8Qq5gjAbQ3uw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ee7ec1c71adc47d2e3c2d5eb0d6b8fbbd42a8d1c",
+        "rev": "aa4b53f79d961a7cbba0b24f791401a34c18011a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-22.11",
+        "ref": "release-23.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -212,11 +212,11 @@
     "pypi-deps-db": {
       "flake": false,
       "locked": {
-        "lastModified": 1682242634,
+        "lastModified": 1685526402,
-        "narHash": "sha256-tfadLvdK3CahWIf90V3XpFZqdpOvDxeORk+XAkTn4cU=",
+        "narHash": "sha256-V0SXx0dWlUBL3E/wHWTszrkK2dOnuYYnBc7n6e0+NQU=",
         "owner": "DavHau",
         "repo": "pypi-deps-db",
-        "rev": "9832a8f9d545d59b1bf6e06e28ea9f0a65b6a01c",
+        "rev": "ba35683c35218acb5258b69a9916994979dc73a9",
         "type": "github"
       },
       "original": {
@@ -278,11 +278,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1682218555,
+        "lastModified": 1686902322,
-        "narHash": "sha256-kojMklCNBnPe8KtRvJvBtFGU/gPAqRKYpZEqyehHfn4=",
+        "narHash": "sha256-Vogj2MsipA+Uzr0M3d8300JeKQDHhPy6NEuTQXVdWu0=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "8a95e6f8cd160a05c2b560e66f702432a53b59ac",
+        "rev": "1e2bae54870a06aa9364f8d33a5b9a0869d792fc",
         "type": "github"
       },
       "original": {
@@ -317,11 +317,11 @@
     },
     "std": {
       "locked": {
-        "lastModified": 1682196479,
+        "lastModified": 1685917625,
-        "narHash": "sha256-YChXEQO0zKauEi3+fpzPZovCaQEc4QeI00sP3IUtU14=",
+        "narHash": "sha256-2manVKofCZrCToVDnDYNvtYUFBYOM5JhdDoNGVY4fq4=",
         "owner": "chessai",
         "repo": "nix-std",
-        "rev": "2acf4573376f8d6170aee46efe0a669f5d78a642",
+        "rev": "e20af8822b5739434b875643bfc61fe0195ea2fb",
         "type": "github"
       },
       "original": {
@@ -373,11 +373,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1681202837,
+        "lastModified": 1685518550,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1681581389,
+        "lastModified": 1686480427,
-        "narHash": "sha256-+ygySqlQy0ejwE1aOF6i6Tiu63V0jxXik0aLlvmqioo=",
+        "narHash": "sha256-cs2cg+x21jM3e7gOX9zYRh/19i8DFInBDLtUWMEAdvA=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "f3b6f6b04728416c64fc5ef52199fd9b9843c47d",
+        "rev": "c192f97d59acb878fd1f2f6f362c8632d1e8426e",
         "type": "github"
       },
       "original": {

kat/shell/packages.nix

@@ -17,6 +17,8 @@
     exa
     # sed replacement
     sd
+    # sops
+    sops
     # find replacement
     fd
     # ripgrep / grep replacement

nixos/roles/irc-client.nix

@@ -0,0 +1,12 @@
+_: {
+  services.thelounge = {
+    enable = true;
+    extraConfig = {
+      reverseProxy = true;
+      public = false;
+      fileUpload = {
+        enable = true;
+      };
+    };
+  };
+}

systems/yukari.nix

@@ -15,6 +15,7 @@ _: let
         postgres-server
         matrix-homeserver
         vaultwarden-server
+        irc-client
       ]);
 
     boot = {

tf/.envrc

@@ -0,0 +1,2 @@
+sops -d ./tf.tfvars.sops > tf.tfvars
+export TF_CLI_ARGS="--var-file=tf.tfvars"

tf/.gitignore

@@ -0,0 +1 @@
+tf.tfvars

tf/backend.tf

@@ -0,0 +1,10 @@
+terraform {
+  backend "remote" {
+    hostname = "app.terraform.io"
+    organization = "kittywitch"
+
+    workspaces {
+      name = "infrastructure-tf"
+    }
+  }
+}

tf/tf.tfvars.sops

@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:5NizSWBLOaigdBsgLyFRmjka6EnojDthw8+Z79QXz/Up1b5Mw60RuWV4kJlJpu+Vy7V1rm9xSJrOh4cTQiiStDbeJ+wCUx2ijp3XPvNlJ6V4UXGefbHMV/oC3amhurRcDogDCldELqce8ZObps5Z+A9VuvzsTxb3CdSaf7C544krRr20+JZLpM55CrAJ+o8pbHF2I5GXIlHqoGbLQIOm+Y/iun9Vi4Ut/XDvbGREBOSp6lTC6D/3VbyZ6jaBH7AI2wR486TPbVRT+GLrVB+u7WJaOAMor9rstLqtMrykAuxknXuFSDo1e1AYsTmKkGlo4D/KX+nYcTarksB7gyYLk8PrBIb8JI1OaKL7XAMZUM2RjKljPb3DalN+8+qa9YCO57BVUeudEQuuv7gh4stdbNSTQ/kWfZuImgQNdDItlJ9XabM0UG3SqzQibggeXvA8cehG4ixrC/acLsMxu00MOLHzwqGhWolHvCAmnp0XEG+dEF7//+W3K5knel5HoAoLbgmENghmp1Vp28abFOagU2Hn2asPDIjjZv8MhocyMCUjBK/f1JrDVOVHZRhWIXjGyeWhJPd8+7P1XJeXlGLh2G9Echgpkpt3lnNShQ==,iv:RjDCMMgME6GrPUQ/xqq6N9pynS6mwd0SKydpBctYlZ8=,tag:8ANoqNcJGpj9NRKgfa8cOg==,type:str]",
+	"sops": {
+		"shamir_threshold": 1,
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2023-05-10T15:46:17Z",
+		"mac": "ENC[AES256_GCM,data:VX3ZsDKja639NKEO1DvBDMh/Ho9EMqNQyDlbYo79nVfomMvHvNcSURullNehy1Usmdmk/Hr6wUjuOcira571F5k95xNby6yp/qgWFBSKDFcvduRqu4YqUzB5XvXqmWGHX+Q7d6U6MAA6PirqBgQC4A5U51OfFhPalTuJWY4V8jA=,iv:BsqyLwGgcqjIITuHnYo2jzC8Vk4DgyxkBGD6eaa+TsE=,tag:j67JoaOgQhbtNDk70i1hKA==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2023-05-10T15:43:03Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA82M54yws73UARAApQ2ZwB0usOsmNHzhVKbp0usviukLvU8FXl3HjaH49d0o\nzlY/h/A5isen9oVmTe8fr2h/Et/k7QtOyEQg3a+BDxbSmeHWPENdxxmJzgFdAMx0\n91b/puuIL3RpDRzZD0MxbqGk5A3pZZuoHm1PMYgRW7M+xfHzMlOAREqxC3J+2NGX\nBk9Q6iYGem/h4l660ObWdFkkkdyfGba7vz5hUl1het/DlOA73Hdy/VN5mrc+H+KN\nOtOzBYcBsNkhjWHfoK7G666yLNsADcViKZiLHvmAvAlgQly+dUq9kO4kiQwyFI+V\nLfR+/TY73yOjk+St3MS78K4rm2ywsAPNOKUnQGcSM+Vw7/n+0z22dKmZqJmu749K\noHvhE2pIlCC/6Xt3Ft8bjlKlo+4tQo1Jtb89YQ6G8nnoFr/HvAwk01qziIvD3TTJ\nM4nhQt5pArW5i/V/7oJ7iUqKPgda2O0tl0Tmen6u/sPWU3F9CuN0I+bZae8d53Zs\nPIfSGFTsfP1ChX2mxeGJ3BR6fVskvWr88lJmILtgFEo+BjvfWT6D25rIuId5ZqKQ\ngU4MnC7JK+PH/jykT+6s21v5JXnQ4M6WvSZK1J4bs0wR0yN3JbB7pki0zlh/2a8J\nFnWBB/gCaBgyGK7CHwncM/cn6NyFUAn3r2SFjElpInGHd7dqvl9dXHJ5YzyHWEbS\nXgHDOWzI8EpfVrhIKak6ZrKEJIvhodyP7qIgBexAU4zA4CdvmuuyiqIzlRawN4J8\nRwwFHRibkIe5q3xFa/QrOuBj5pfUqdBLDkJhLHkYH756m/25Fg9kqB2tou14qDU=\n=Mfyl\n-----END PGP MESSAGE-----\n",
+				"fp": "CD8CE78CB0B3BDD4"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}