RGBCube/ncc
1
Fork 0
mirror of https://github.com/RGBCube/ncc synced 2025-07-29 02:57:44 +00:00
Code Issues Activity

matrix: store signing key

Browse source
This commit is contained in:
RGBCube 2025-06-12 04:22:10 +03:00
parent 43386cc144
commit 8de5fb909b
Signed by: RGBCube
SSH key fingerprint: SHA256:CzqbPcfwt+GxFYNnFVCqoN5Itn4YFrshg1TrnACpA5M
5 changed files with 29 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hosts/best/matrix/default.nix
View file

@ -1,3 +1,6 @@
# TODO: FIXME: We are not handling backups properly.
# The `e2e_one_time_keys_json` table should not be backed up.
{ self, config, lib, ... }: let
inherit (config.networking) domain;
inherit (lib) const enabled genAttrs merge;
@ -29,8 +32,12 @@ in {
(self + /modules/postgresql.nix)
];
secrets.matrixKey = {
file = ./key.age;
owner = "matrix-synapse";
};
secrets.matrixSecret = {
file = ./password.secret.age;
file = ./secret.age;
owner = "matrix-synapse";
};
@ -75,10 +82,10 @@ in {
# Trusting Matrix.org.
suppress_key_server_warning = true;
};
# Sets registration_shared_secret.
extraConfigFiles = [ config.secrets.matrixSecret.path ];
signing_key_path = config.secrets.matrixKey.path;
registration_shared_secret_path = config.secrets.matrixSecret.path;
};
settings.listeners = [{
inherit port;

BIN
hosts/best/matrix/key.age Normal file
View file

Binary file not shown.

BIN
hosts/best/matrix/password.secret.age
View file

Binary file not shown.

7
hosts/best/matrix/secret.age Normal file
View file

@ -0,0 +1,7 @@
age-encryption.org/v1
-> ssh-ed25519 8y3T6w sUQRJW9xDK6GmZLtl4MK48DZIh2t8a/KWPkzrMK34mY
gVmL1Bn+kcT6ReAO2oxYSpGL5URQnqEOqDUxWgpHsrM
-> ssh-ed25519 CzqbPQ GticSm2nWNiADVwuxH+aeJeQVlAWz9hy9VsTMkCw/yg
KaQ2pnVAblIftzqBOvcxHhXcBOivax0em2EOLXFH2Q8
--- ukxPhzbewA/HQQlDqlavsGQ9uDXp55M0ZFMcDJT4TWc
Σð „6½ÄþZKxÔ>Åñ­' ‹z¡ ¾„ãk$ˆ›J$ïBX3:KÞ¶cš¡å]©·¨ °Z±×vOjõ·½çÓ¨>Îé¨7’à{R=t¯a*e)ú/Û_Í{"úmœ

21
secrets.nix
View file

@ -9,26 +9,27 @@ in {
"hosts/best/garage/environment.age".publicKeys = [ best ] ++ admins;
"hosts/best/grafana/password.age".publicKeys = [ best ] ++ admins;
"hosts/best/grafana/password.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/caches.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/credentials.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/secrets.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/token.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/caches.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/credentials.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/secrets.age".publicKeys = [ best ] ++ admins;
"hosts/best/hercules/token.age".publicKeys = [ best ] ++ admins;
"hosts/best/matrix/password.secret.age".publicKeys = [ best ] ++ admins;
"hosts/best/matrix/key.age".publicKeys = [ best ] ++ admins;
"hosts/best/matrix/secret.age".publicKeys = [ best ] ++ admins;
"hosts/best/nextcloud/password.age".publicKeys = [ best ] ++ admins;
"hosts/best/nextcloud/password.age".publicKeys = [ best ] ++ admins;
"hosts/best/plausible/key.age".publicKeys = [ best ] ++ admins;
"hosts/best/plausible/key.age".publicKeys = [ best ] ++ admins;
# disk
"hosts/disk/id.age".publicKeys = [ disk ] ++ admins;
"hosts/disk/password.age".publicKeys = [ disk ] ++ admins;
# nine
"hosts/nine/id.age".publicKeys = [ nine ] ++ admins;
"hosts/nine/password.age".publicKeys = [ nine ] ++ admins;
"hosts/nine/id.age".publicKeys = [ nine ] ++ admins;
"hosts/nine/password.age".publicKeys = [ nine ] ++ admins;
"hosts/nine/github2forgejo/environment.age".publicKeys = [ nine ] ++ admins;