From 87bb031ed00b7993a29d74aee2e89875c5444caf Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Sun, 25 Dec 2022 22:31:18 +0100 Subject: Migrate prod cluster secrets to new format --- cluster/prod/app/plume/secrets.toml | 29 ++++++++++++++++++++++ .../plume/secrets/plume/backup_aws_access_key_id | 1 - .../secrets/plume/backup_aws_secret_access_key | 1 - .../app/plume/secrets/plume/backup_restic_password | 1 - .../plume/secrets/plume/backup_restic_repository | 1 - cluster/prod/app/plume/secrets/plume/pgsql_pw | 1 - cluster/prod/app/plume/secrets/plume/secret_key | 1 - 7 files changed, 29 insertions(+), 6 deletions(-) create mode 100644 cluster/prod/app/plume/secrets.toml delete mode 100644 cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id delete mode 100644 cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key delete mode 100644 cluster/prod/app/plume/secrets/plume/backup_restic_password delete mode 100644 cluster/prod/app/plume/secrets/plume/backup_restic_repository delete mode 100644 cluster/prod/app/plume/secrets/plume/pgsql_pw delete mode 100644 cluster/prod/app/plume/secrets/plume/secret_key (limited to 'cluster/prod/app/plume') diff --git a/cluster/prod/app/plume/secrets.toml b/cluster/prod/app/plume/secrets.toml new file mode 100644 index 0000000..a445979 --- /dev/null +++ b/cluster/prod/app/plume/secrets.toml @@ -0,0 +1,29 @@ +[service_user."plume"] +password_secret = "plume/pgsql_pw" + + +[secrets."plume/secret_key"] +type = 'command' +rotate = true +command = 'openssl rand -base64 32' + + +# Plume backup + +[secrets."plume/backup_restic_repository"] +type = 'user' +description = 'Restic repository' +example = 's3:https://s3.garage.tld' + +[secrets."plume/backup_restic_password"] +type = 'user' +description = 'Restic password to encrypt backups' + +[secrets."plume/backup_aws_secret_access_key"] +type = 'user' +description = 'Backup AWS secret access key' + +[secrets."plume/backup_aws_access_key_id"] +type = 'user' +description = 'Backup AWS access key ID' + diff --git a/cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id b/cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id deleted file mode 100644 index 9235e53..0000000 --- a/cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id +++ /dev/null @@ -1 +0,0 @@ -USER Backup AWS access key ID diff --git a/cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key b/cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key deleted file mode 100644 index f34677e..0000000 --- a/cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key +++ /dev/null @@ -1 +0,0 @@ -USER Backup AWS secret access key diff --git a/cluster/prod/app/plume/secrets/plume/backup_restic_password b/cluster/prod/app/plume/secrets/plume/backup_restic_password deleted file mode 100644 index fbaa5fa..0000000 --- a/cluster/prod/app/plume/secrets/plume/backup_restic_password +++ /dev/null @@ -1 +0,0 @@ -USER Restic password to encrypt backups diff --git a/cluster/prod/app/plume/secrets/plume/backup_restic_repository b/cluster/prod/app/plume/secrets/plume/backup_restic_repository deleted file mode 100644 index 3f6cb93..0000000 --- a/cluster/prod/app/plume/secrets/plume/backup_restic_repository +++ /dev/null @@ -1 +0,0 @@ -USER Restic repository, eg. s3:https://s3.garage.tld diff --git a/cluster/prod/app/plume/secrets/plume/pgsql_pw b/cluster/prod/app/plume/secrets/plume/pgsql_pw deleted file mode 100644 index 0f831bb..0000000 --- a/cluster/prod/app/plume/secrets/plume/pgsql_pw +++ /dev/null @@ -1 +0,0 @@ -SERVICE_PASSWORD plume diff --git a/cluster/prod/app/plume/secrets/plume/secret_key b/cluster/prod/app/plume/secrets/plume/secret_key deleted file mode 100644 index 978be54..0000000 --- a/cluster/prod/app/plume/secrets/plume/secret_key +++ /dev/null @@ -1 +0,0 @@ -CMD openssl rand -base64 32 -- cgit v1.2.3 From 8cee3b0043eda68d982e5359a0d009c83cbb85c4 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Sun, 25 Dec 2022 22:45:05 +0100 Subject: Update prod secret files --- cluster/prod/app/plume/secrets.toml | 19 ------------------- 1 file changed, 19 deletions(-) (limited to 'cluster/prod/app/plume') diff --git a/cluster/prod/app/plume/secrets.toml b/cluster/prod/app/plume/secrets.toml index a445979..4d68a5c 100644 --- a/cluster/prod/app/plume/secrets.toml +++ b/cluster/prod/app/plume/secrets.toml @@ -8,22 +8,3 @@ rotate = true command = 'openssl rand -base64 32' -# Plume backup - -[secrets."plume/backup_restic_repository"] -type = 'user' -description = 'Restic repository' -example = 's3:https://s3.garage.tld' - -[secrets."plume/backup_restic_password"] -type = 'user' -description = 'Restic password to encrypt backups' - -[secrets."plume/backup_aws_secret_access_key"] -type = 'user' -description = 'Backup AWS secret access key' - -[secrets."plume/backup_aws_access_key_id"] -type = 'user' -description = 'Backup AWS access key ID' - -- cgit v1.2.3