jet/noisebridge-wiki
jet/noisebridge-wiki
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: init
Some checks failed
CI / check (push) Has been cancelled
Details
CI / deploy (push) Has been cancelled
Details

Browse source
This commit is contained in:
Jet 2026-03-17 04:07:14 -07:00
commit 8cfede9f57
No known key found for this signature in database
28 changed files with 2129 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
secrets/secrets.nix Normal file
View file

@ -0,0 +1,28 @@
let
# Admin public keys (for encrypting secrets locally)
superq = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA_REPLACE_WITH_SUPERQ_KEY";
jet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA_REPLACE_WITH_JET_KEY";
admins = [ superq jet ];
# Host keys (generated after provisioning, replace with real keys)
wiki = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA_REPLACE_WITH_WIKI_HOST_KEY";
wiki-replica = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA_REPLACE_WITH_REPLICA_HOST_KEY";
allHosts = [ wiki wiki-replica ];
primaryOnly = [ wiki ];
in
{
# Shared secrets (both hosts)
"tailscale-auth.age".publicKeys = admins ++ allHosts;
"mysql-mediawiki.age".publicKeys = admins ++ allHosts;
"mysql-replication.age".publicKeys = admins ++ allHosts;
"mediawiki-secret-key.age".publicKeys = admins ++ allHosts;
# Primary-only secrets
"grafana-admin.age".publicKeys = admins ++ primaryOnly;
"prometheus-auth.age".publicKeys = admins ++ primaryOnly;
"b2-credentials.age".publicKeys = admins ++ primaryOnly;
"discord-webhook.age".publicKeys = admins ++ primaryOnly;
"mediawiki-recaptcha.age".publicKeys = admins ++ primaryOnly;
}