Merge pull request 'updated version of secretmgr' (#5) from new-secretmgr into main

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/nixcfg/pulls/5

25 files changed, 81 insertions, 54 deletions

diff --git a/cluster/prod/app/matrix/config/synapse/homeserver.yaml b/cluster/prod/app/matrix/config/synapse/homeserver.yaml
index b4b7c67..48ae431 100644
--- a/cluster/prod/app/matrix/config/synapse/homeserver.yaml
+++ b/cluster/prod/app/matrix/config/synapse/homeserver.yaml
@@ -1,22 +1,6 @@
 # vim:ft=yaml
 
 server_name: "deuxfleurs.fr"
-# PEM encoded X509 certificate for TLS.
-# You can replace the self-signed certificate that synapse
-# autogenerates on launch with your own SSL certificate + key pair
-# if you like.  Any required intermediary certificates can be
-# appended after the primary certificate in hierarchical order.
-tls_certificate_path: "/etc/matrix-synapse/homeserver.tls.crt"
-
-# PEM encoded private key for TLS
-tls_private_key_path: "/etc/matrix-synapse/homeserver.tls.key"
-
-# PEM dh parameters for ephemeral keys
-tls_dh_params_path: "/etc/matrix-synapse/homeserver.tls.dh"
-
-# Don't bind to the https port
-no_tls: True
-
 
 ## Server ##
 
diff --git a/cluster/prod/app/matrix/deploy/im.hcl b/cluster/prod/app/matrix/deploy/im.hcl
index bd28feb..339fea7 100644
--- a/cluster/prod/app/matrix/deploy/im.hcl
+++ b/cluster/prod/app/matrix/deploy/im.hcl
@@ -55,21 +55,6 @@ job "matrix" {
 
       # --- secrets ---
       template {
-        data = "{{ key \"secrets/chat/synapse/homeserver.tls.crt\" }}"
-        destination = "secrets/conf/homeserver.tls.crt"
-      }
-
-      template {
-        data = "{{ key \"secrets/chat/synapse/homeserver.tls.dh\" }}"
-        destination = "secrets/conf/homeserver.tls.dh"
-      }
-
-      template {
-        data = "{{ key \"secrets/chat/synapse/homeserver.tls.key\" }}"
-        destination = "secrets/conf/homeserver.tls.key"
-      }
-
-      template {
         data = "{{ key \"secrets/chat/synapse/homeserver.signing.key\" }}"
         destination = "secrets/conf/homeserver.signing.key"
       }
diff --git a/cluster/prod/app/matrix/secrets.toml b/cluster/prod/app/matrix/secrets.toml
new file mode 100644
index 0000000..8cd1572
--- /dev/null
+++ b/cluster/prod/app/matrix/secrets.toml
@@ -0,0 +1,81 @@
+[service_users."matrix"]
+description = 'Matrix service user'
+dn_secret = 'chat/synapse/ldap_binddn'
+password_secret = 'chat/synapse/ldap_bindpw'
+
+
+# Postgresql DB
+
+[secrets."chat/synapse/postgres_db"]
+type = 'user'
+description = 'Synapse PostgrSQL database name'
+example = 'synapse'
+
+[secrets."chat/synapse/postgres_user"]
+type = 'service_username'
+service = 'matrix'
+
+[secrets."chat/synapse/postgres_pwd"]
+type = 'service_password'
+service = 'matrix'
+
+
+# S3 access
+
+[secrets."chat/synapse/s3_access_key"]
+type = 'user'
+description = 'S3 access key ID for Matrix bucket'
+
+[secrets."chat/synapse/s3_secret_key"]
+type = 'user'
+description = 'S3 secret access key for Matrix bucket'
+
+
+# Keys & stuff
+
+[secrets."chat/synapse/homeserver.signing.key"]
+type = 'user'
+description = 'Synapse homeserver ed25519 signing key'
+
+[secrets."chat/synapse/registration_shared_secret"]
+type = 'command'
+rotate = true
+command = 'head -c 32 /dev/urandom | base64'
+
+
+# ===== OLD STUFF, KEPT FOR REFERENCE ====
+
+# ----------- COTURN -----------
+
+# [secrets."chat/coturn/static-auth"]
+# type = 'user'
+# description = 'coturn static-auth (what is this?)'
+# 
+# [secrets."chat/coturn/static_auth_secret_zinzdev"]
+# type = 'user'
+# description = "Serveur coturn (TURN/STUN) d'Adrien, c'est un jeton d'identification."
+
+
+# ----------- EASYBRIDGE -----------
+
+# [service_users."easybridge"]
+# description = 'Easybridge service user'
+# password_secret = 'chat/easybridge/db_pass'
+# username_secret = 'chat/easybridge/db_user'
+# 
+# 
+# [secrets."chat/easybridge/as_token"]
+# type = 'command'
+# rotate = true
+# command = 'openssl rand -hex 32'
+# 
+# [secrets."chat/easybridge/web_session_key"]
+# type = 'command'
+# rotate = true
+# command = 'openssl rand -hex 32'
+# 
+# [secrets."chat/easybridge/hs_token"]
+# type = 'command'
+# rotate = true
+# command = 'openssl rand -hex 32'
+# 
diff --git a/cluster/prod/app/matrix/secrets/chat/coturn/static-auth b/cluster/prod/app/matrix/secrets/chat/coturn/static-auth
deleted file mode 100644
index 43628ef..0000000
--- a/cluster/prod/app/matrix/secrets/chat/coturn/static-auth
+++ /dev/null
@@ -1 +0,0 @@
-USER coturn static-auth (what is this?)
diff --git a/cluster/prod/app/matrix/secrets/chat/coturn/static_auth_secret_zinzdev b/cluster/prod/app/matrix/secrets/chat/coturn/static_auth_secret_zinzdev
deleted file mode 100644
index c61486d..0000000
--- a/cluster/prod/app/matrix/secrets/chat/coturn/static_auth_secret_zinzdev
+++ /dev/null
@@ -1 +0,0 @@
-USER Serveur coturn (TURN/STUN) d'Adrien, c'est un jeton d'identification.
\ No newline at end of file
diff --git a/cluster/prod/app/matrix/secrets/chat/easybridge/as_token b/cluster/prod/app/matrix/secrets/chat/easybridge/as_token
deleted file mode 100644
index 5fa4e3c..0000000
--- a/cluster/prod/app/matrix/secrets/chat/easybridge/as_token
+++ /dev/null
@@ -1 +0,0 @@
-CMD openssl rand -hex 32
diff --git a/cluster/prod/app/matrix/secrets/chat/easybridge/db_pass b/cluster/prod/app/matrix/secrets/chat/easybridge/db_pass
deleted file mode 100644
index 7e1f94b..0000000
--- a/cluster/prod/app/matrix/secrets/chat/easybridge/db_pass
+++ /dev/null
@@ -1 +0,0 @@
-SERVICE_PASSWORD easybridge
diff --git a/cluster/prod/app/matrix/secrets/chat/easybridge/db_user b/cluster/prod/app/matrix/secrets/chat/easybridge/db_user
deleted file mode 100644
index 436267c..0000000
--- a/cluster/prod/app/matrix/secrets/chat/easybridge/db_user
+++ /dev/null
@@ -1 +0,0 @@
-CONST easybridge
diff --git a/cluster/prod/app/matrix/secrets/chat/easybridge/hs_token b/cluster/prod/app/matrix/secrets/chat/easybridge/hs_token
deleted file mode 100644
index 5fa4e3c..0000000
--- a/cluster/prod/app/matrix/secrets/chat/easybridge/hs_token
+++ /dev/null
@@ -1 +0,0 @@
-CMD openssl rand -hex 32
diff --git a/cluster/prod/app/matrix/secrets/chat/easybridge/web_session_key b/cluster/prod/app/matrix/secrets/chat/easybridge/web_session_key
deleted file mode 100644
index 614bed7..0000000
--- a/cluster/prod/app/matrix/secrets/chat/easybridge/web_session_key
+++ /dev/null
@@ -1,2 +0,0 @@
-CMD openssl rand -hex 32
-
diff --git a/cluster/prod/app/matrix/secrets/chat/fb2mx/as_token b/cluster/prod/app/matrix/secrets/chat/fb2mx/as_token
deleted file mode 100644
index 5fa4e3c..0000000
--- a/cluster/prod/app/matrix/secrets/chat/fb2mx/as_token
+++ /dev/null
@@ -1 +0,0 @@
-CMD openssl rand -hex 32
diff --git a/cluster/prod/app/matrix/secrets/chat/fb2mx/db_url b/cluster/prod/app/matrix/secrets/chat/fb2mx/db_url
deleted file mode 100644
index f06e265..0000000
--- a/cluster/prod/app/matrix/secrets/chat/fb2mx/db_url
+++ /dev/null
@@ -1 +0,0 @@
-USER fb2mx database URL, format: postgres://username:password@hostname/dbname
diff --git a/cluster/prod/app/matrix/secrets/chat/fb2mx/hs_token b/cluster/prod/app/matrix/secrets/chat/fb2mx/hs_token
deleted file mode 100644
index 5fa4e3c..0000000
--- a/cluster/prod/app/matrix/secrets/chat/fb2mx/hs_token
+++ /dev/null
@@ -1 +0,0 @@
-CMD openssl rand -hex 32
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.signing.key b/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.signing.key
deleted file mode 100644
index 099bd18..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.signing.key
+++ /dev/null
@@ -1 +0,0 @@
-USER Synapse homeserver ed25519 signing key
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.crt b/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.crt
deleted file mode 100644
index b696093..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.crt
+++ /dev/null
@@ -1 +0,0 @@
-SSL_CERT synapse im.deuxfleurs.fr
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.dh b/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.dh
deleted file mode 100644
index 0231fed..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.dh
+++ /dev/null
@@ -1 +0,0 @@
-USER_LONG DH parameters for matrix ssl key? how does this work?
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.key b/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.key
deleted file mode 100644
index feee544..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/homeserver.tls.key
+++ /dev/null
@@ -1 +0,0 @@
-SSL_KEY synapse im.deuxfleurs.fr
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/ldap_binddn b/cluster/prod/app/matrix/secrets/chat/synapse/ldap_binddn
deleted file mode 100644
index 2631bef..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/ldap_binddn
+++ /dev/null
@@ -1 +0,0 @@
-SERVICE_DN matrix Matrix chat server
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/ldap_bindpw b/cluster/prod/app/matrix/secrets/chat/synapse/ldap_bindpw
deleted file mode 100644
index ba07446..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/ldap_bindpw
+++ /dev/null
@@ -1 +0,0 @@
-SERVICE_PASSWORD matrix
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/postgres_db b/cluster/prod/app/matrix/secrets/chat/synapse/postgres_db
deleted file mode 100644
index 74eefa7..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/postgres_db
+++ /dev/null
@@ -1 +0,0 @@
-CONST synapse
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/postgres_pwd b/cluster/prod/app/matrix/secrets/chat/synapse/postgres_pwd
deleted file mode 100644
index ba07446..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/postgres_pwd
+++ /dev/null
@@ -1 +0,0 @@
-SERVICE_PASSWORD matrix
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/postgres_user b/cluster/prod/app/matrix/secrets/chat/synapse/postgres_user
deleted file mode 100644
index b08e86a..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/postgres_user
+++ /dev/null
@@ -1 +0,0 @@
-CONST matrix
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/registration_shared_secret b/cluster/prod/app/matrix/secrets/chat/synapse/registration_shared_secret
deleted file mode 100644
index b82f191..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/registration_shared_secret
+++ /dev/null
@@ -1 +0,0 @@
-CMD head -c 32 /dev/urandom | base64
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/s3_access_key b/cluster/prod/app/matrix/secrets/chat/synapse/s3_access_key
deleted file mode 100644
index ab09a8e..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/s3_access_key
+++ /dev/null
@@ -1 +0,0 @@
-USER matrix
diff --git a/cluster/prod/app/matrix/secrets/chat/synapse/s3_secret_key b/cluster/prod/app/matrix/secrets/chat/synapse/s3_secret_key
deleted file mode 100644
index ab09a8e..0000000
--- a/cluster/prod/app/matrix/secrets/chat/synapse/s3_secret_key
+++ /dev/null
@@ -1 +0,0 @@
-USER matrix