+1

hosts/box/default.nix

reviewed

··· 19 19 ../profiles/wallabag 20 20 ../profiles/finance 21 21 # ../profiles/archivebox 22 22 + ../profiles/woodpecker-agent 22 23 ]; 23 24 24 25 # For some reason this doesn't work in the profile, but does over here??

+6 -3

hosts/profiles/woodpecker-agent/default.nix

reviewed

··· 1 1 + { pkgs, config, self, ... }: 1 2 { 2 2 - 3 3 users.users.woodpecker-runner = { 4 4 isSystemUser = true; 5 5 group = "woodpecker-runner"; 6 6 }; 7 7 users.groups.woodpecker-runner = { }; 8 8 # Allow the exec runner to write to build with nix 9 9 - nix.allowedUsers = [ "woodpecker-runner" ]; 9 9 + nix.settings.allowed-users = [ "woodpecker-runner" ]; 10 10 + 11 11 + age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner"; 12 12 + age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; 10 13 11 14 systemd.services.woodpecker-runner-exec = { 12 15 enable = true; ··· 55 58 "/nix/" 56 59 ]; 57 60 EnvironmentFile = [ 58 58 - # /run/agenix/woodpecker-agent-secret 61 61 + /run/agenix/woodpecker-agent-secret 59 62 ]; 60 63 ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent"; 61 64 User = "woodpecker-runner";

+1 -1

secrets/secrets.nix

reviewed

··· 25 25 "telegram-matrix-env.age".publicKeys = [ lituus ]; 26 26 27 27 "wallabag.age".publicKeys = [ mossnet ]; 28 28 - "woodpecker-agent-secret.age".publicKeys = [ lituus helix ]; 28 28 + "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ]; 29 29 "woodpecker-client-id.age".publicKeys = [ helix ]; 30 30 "woodpecker-client-secret.age".publicKeys = [ helix ]; 31 31 "gitea-dbpass.age".publicKeys = [ helix ];

+9

secrets/woodpecker-agent-secret.age

reviewed

··· 1 1 + age-encryption.org/v1 2 2 + -> ssh-ed25519 K2vF/Q SYAkEEvz6aqkzh8r+TgvnwfQNJ3pLxGUcYmHK3DaNhM 3 3 + ayICZI0Ctmw1AtIReiXx5KXUSz8qZtkRZQx9eNS0z1g 4 4 + -> ssh-ed25519 kgCrKA Ii00pfHYObHJbBJziVQLUR43s61t0JOTT0YZJ9OaqE0 5 5 + NUJddte8zIZhrVtSeTU9iq9UW955ANlA6JZm8MQf+P8 6 6 + -> QrEy[-grease yS' ]r: PIx`w:SK 7 7 + uaB9Bdjdf3Sy5fL1qQNsfYZhoCRG51MPDfw75A 8 8 + --- 8jiDkupjnxMlSfXvJQGK4pVFDTuqNbsvHGsqLzDHjQ0 9 9 + e�T�8�p�`� ��G��ǁt����4���ѯ��2Z��/� +f��xb�TI���n�ϝ��#�R�5��T���9 ���4=�Y�d�\a��I