From 87bb031ed00b7993a29d74aee2e89875c5444caf Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Sun, 25 Dec 2022 22:31:18 +0100 Subject: Migrate prod cluster secrets to new format --- cluster/prod/app/drone-ci/secrets.toml | 47 ++++++++++++++++++++++ .../app/drone-ci/secrets/drone-ci/cookie_secret | 1 - .../app/drone-ci/secrets/drone-ci/db_enc_secret | 1 - .../app/drone-ci/secrets/drone-ci/oauth_client_id | 1 - .../drone-ci/secrets/drone-ci/oauth_client_secret | 1 - .../prod/app/drone-ci/secrets/drone-ci/rpc_secret | 1 - cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak | 1 - .../app/drone-ci/secrets/drone-ci/s3_db_bucket | 1 - cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk | 1 - .../drone-ci/secrets/drone-ci/s3_storage_bucket | 1 - 10 files changed, 47 insertions(+), 9 deletions(-) create mode 100644 cluster/prod/app/drone-ci/secrets.toml delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk delete mode 100644 cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket (limited to 'cluster/prod/app/drone-ci') diff --git a/cluster/prod/app/drone-ci/secrets.toml b/cluster/prod/app/drone-ci/secrets.toml new file mode 100644 index 0000000..5bd98d0 --- /dev/null +++ b/cluster/prod/app/drone-ci/secrets.toml @@ -0,0 +1,47 @@ +# Drone's secrets + +[secrets."drone-ci/rpc_secret"] +type = 'command' +rotate = true +command = 'openssl rand -hex 16' + +[secrets."drone-ci/cookie_secret"] +type = 'command' +rotate = true +command = 'openssl rand -hex 16' + +[secrets."drone-ci/db_enc_secret"] +type = 'command' +command = 'openssl rand -hex 16' + + +# Oauth config for gitea + +[secrets."drone-ci/oauth_client_secret"] +type = 'user' +description = 'OAuth client secret (for gitea)' + +[secrets."drone-ci/oauth_client_id"] +type = 'user' +description = 'OAuth client ID (on Gitea)' + + +# S3 config for Git LFS storage + +[secrets."drone-ci/s3_db_bucket"] +type = 'constant' +value = 'drone-db' + +[secrets."drone-ci/s3_sk"] +type = 'user' +description = 'S3 (garage) secret key for Drone' + +[secrets."drone-ci/s3_ak"] +type = 'user' +description = 'S3 (garage) access key for Drone' + +[secrets."drone-ci/s3_storage_bucket"] +type = 'constant' +value = 'drone-storage' + + diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret deleted file mode 100644 index 04c819e..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret +++ /dev/null @@ -1 +0,0 @@ -CMD openssl rand -hex 16 diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret deleted file mode 100644 index 3f9e696..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret +++ /dev/null @@ -1 +0,0 @@ -CMD_ONCE openssl rand -hex 16 diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id b/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id deleted file mode 100644 index c801b28..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id +++ /dev/null @@ -1 +0,0 @@ -USER OAuth client ID (on Gitea) diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret deleted file mode 100644 index b79b688..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret +++ /dev/null @@ -1 +0,0 @@ -USER OAuth client secret (for gitea) diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret deleted file mode 100644 index 04c819e..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret +++ /dev/null @@ -1 +0,0 @@ -CMD openssl rand -hex 16 diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak deleted file mode 100644 index 3a8e4a2..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak +++ /dev/null @@ -1 +0,0 @@ -USER S3 (garage) access key for Drone diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket deleted file mode 100644 index c36f17d..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket +++ /dev/null @@ -1 +0,0 @@ -CONST drone-db diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk deleted file mode 100644 index 46fd9fa..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk +++ /dev/null @@ -1 +0,0 @@ -USER S3 (garage) secret key for Drone diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket deleted file mode 100644 index ca2702c..0000000 --- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket +++ /dev/null @@ -1 +0,0 @@ -CONST drone-storage -- cgit v1.2.3 From 3b7437619162551f281aa4c60621152f37a66b39 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Sun, 25 Dec 2022 22:50:20 +0100 Subject: update drone secrets for rotation --- cluster/prod/app/drone-ci/secrets.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'cluster/prod/app/drone-ci') diff --git a/cluster/prod/app/drone-ci/secrets.toml b/cluster/prod/app/drone-ci/secrets.toml index 5bd98d0..ac07926 100644 --- a/cluster/prod/app/drone-ci/secrets.toml +++ b/cluster/prod/app/drone-ci/secrets.toml @@ -2,8 +2,8 @@ [secrets."drone-ci/rpc_secret"] type = 'command' -rotate = true command = 'openssl rand -hex 16' +# don't rotate, it would break all runners [secrets."drone-ci/cookie_secret"] type = 'command' @@ -13,6 +13,7 @@ command = 'openssl rand -hex 16' [secrets."drone-ci/db_enc_secret"] type = 'command' command = 'openssl rand -hex 16' +# don't rotate, it is used to encrypt data which we would lose if we change this # Oauth config for gitea -- cgit v1.2.3