Added hetzner server configs

2026-07-11 20:28:51 +02:00
parent 0457d618e1
commit c5f771bd53
51 changed files with 1800 additions and 309 deletions
@@ -0,0 +1,11 @@
+keys:
+  - &admin age1yd59qp5km4cxt99rlfjehnsucrjn9lmj0su4h3avhf6vrtjvnyjqstldl5
+  - &local age15rhqdpwejyf3r6ww70qgv6hqmkpsqraakn26kc49wlauhaceaeqsmuwrdd
+  - &server age1xekdrkjfu82hkxltydm72tllzgayyvfavvudeks3xjuujm5wt5hq6g55v0
+creation_rules:
+  - path_regex: secrets/.*\.yaml
+    key_groups:
+      - age:
+          - *admin
+          - *local
+          - *server
@@ -0,0 +1,26 @@
+# Secrets
+
+This directory contains encrypted secrets managed with sops-nix.
+
+## Setup
+
+1. Generate an age key on the target machine:
+   ```
+   mkdir -p /etc/age
+   age-keygen -o /etc/age/keys.txt
+   ```
+
+2. Add the public key to `.sops.yaml`
+
+3. Create/edit secrets:
+   ```
+   sops secrets/mail-accounts.yaml
+   sops secrets/env.yaml
+   ```
+
+## Files
+
+- `env.yaml` - Environment variables (WG_HOST, PASSWORD_HASH, etc.)
+- `mail-accounts.yaml` - Mail server account credentials
+- `wireguard-keys.yaml` - WireGuard private keys
+- `ssh-keys.yaml` - SSH private keys (mail.private, etc.)
@@ -0,0 +1,37 @@
+coredns_ksk_key: ENC[AES256_GCM,data:mPjyv74ujSVnbJ6cjFdO7XtkThDv4clF+K+d485njvvx7IBrC4t+DMMtJxqL7qad8Cf4g/vx3cO0dsB8UbsbuyVAEPpgmGnqTJ+Ec4zbP73g7u4W/HcgT+ZcGY2fzuz/K7uETRN852KfE6RIKkTZkOfBfo1YsOglpRTiSQMh4Jnso9Nihdh7hfbQQ0yXjhQMhGFTUGYR4AQM3ZUFkjY2hN0Ys34Tbwg4HnHwcmWMnwGj7Ab29HU/UP//AAb1rlUNcde6MuWAGlObj6P/poxjeVyWL7lfAveAEqZiHyUDUE2939cCROT1TLZ+f3t2hinK4bzTfp3n9fxhVt4LG7WnDDms97+7M9rI2dVSxDnDTAElyU8NGlYmDcUOOzeTBccxnVegUuRNHMhT2Hrut3K+TGgpTdDNA93PXNB/cCodvNDWtZGrZuRtANZPVMTe7E/3fiw6urrxR59G,iv:fByY/Z4kzxAFXobtrV8Y59IdqzN4W/HsvEPGOhBGI+E=,tag:FoB4jrxsLXNKnhFykX6F/g==,type:str]
+coredns_ksk_private: ENC[AES256_GCM,data:yaVhVVR1QHXshePY2x9qbOJszl3tj3ne71W7TP+JG2gF1BiU+EBp8QJNQBcj58sFwun88RPIUK5OUgJ/n9dyEWOCf3jfDO4yRD7XLqJVp3tf15Ou2FytHd7hg52id+1gJxSRmhxHWw5of1v9Jo6cocET6tnVnygsPmxJEufoW3DyFZrPscba7rsJhpjJNINEcvgcD44ySy47gisA2s1oIgXp/UJmoZ/H6IXm9/HL66bvfl0ubZ0rxa0Rlg==,iv:pXl8ppb1Pxl5mRBY2sa595ChSAD/zdbKK+H4xeeMG+I=,tag:ez8xqxXfzf3U15YHbaxUZg==,type:str]
+coredns_zsk_key: ENC[AES256_GCM,data:AdGcUU1qjdRSlI1j6LJGsrqXgUqMfHJGETaVJETPN8+JEjdHvLXCpuiqnJE20hqXDi6gIrBaUQMruJG2KfSZTfxSPoqIYoAlbBQBpTsGwpFazWIsggMJNlqUYKSnBr4QsBTj6A/IZYR4KzcJX+vo7pL0nLz+bpH1/o6ry7lghqt7sIjS9Nx1CKW6WpMPePjBViGp8i5jQWijsUCj+DRjQatycBKhpQWCqlYqn+CM99/QWjy/qXWFmgBiiFjQ8lT1AjOIIL0Icger06ReWCl2387xB/JqHbtsq65WOLuJiyxBBw02wOQz09UaKsDsoM59w3SINKqK+YyCkonHXycLuMAuE7tasHVRPEdWsr6os18cystLQO8qp1oVSGtUSVM07TkM8OowMlOmN44veIkgON4s8pN7S9V9N46N0BSC6w7A3u2VqCfAgPLUjPWNieIfir8P3p+gQSPWuw==,iv:Kvc8N+fp2rVd1TTsZHbk67fL2nOlGhqDE+TvH+aU0VE=,tag:1wkgkV1gqddhkkOs1NoztA==,type:str]
+coredns_zsk_private: ENC[AES256_GCM,data:BZxC5iYY8wh6kXbXpNheVrvBh6TB0968ivw06sJ1driytCt3RK6ZtNcr7PMxjxbKCdZKllLIdCABJDrj8eQCLLLMRspYVXLWquJvLHCCGqteY+Ha4b5bdsUO64I+HkDGagZSj7mIsaD7+aGOI2FN4bFhd364qGc1hGACePBUWlUi8AHSQY9KgadXBX2+ud6BIsoyoEN8AhjNK6zSADZYeA3JMJ1HTP1MbAB6owbmQMieunMHwudi6fi6eQ==,iv:lSjLOF6u1gLUv2IQ6rqG9nNCkFa6Yruknx0Lc+E6vzY=,tag:QQv1+47UtX+ZxrYwsrHLSg==,type:str]
+sops:
+    age:
+        - recipient: age1yd59qp5km4cxt99rlfjehnsucrjn9lmj0su4h3avhf6vrtjvnyjqstldl5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUVZKYWFmSU5xbWo2N0Qy
+            c0VPeVIxQ1lNMTB5VkI4dVdsTXlkSEo3azN3CjJtR0lqclZOUjFkVjFWSDM2SGF1
+            OWNKcFNFSGpzd3A3MUZyS09CUWUyMlEKLS0tIG5VdmU1b0YwdWxUTXBzaGR2d2tR
+            UjI1K1pYaC9pTnNNcldXQ3B3endUTDgKHISJEvZrn6VO/voH2ORzeJbpVjpX8MxP
+            qGJ+G7sMM8trCOpkR3wjqSaZVU1hric+0R5oHiMKDLcb3hGN9mgJFA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15rhqdpwejyf3r6ww70qgv6hqmkpsqraakn26kc49wlauhaceaeqsmuwrdd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RzlaWXU3ZVo0Y0JiV0xk
+            RlBYR3RHdklSdVhoY0UzYmFxeGl3YkFITW5BCmhITk9DMjRmekFyd0hQbnRCWEY5
+            NFRlUkdRT2lyZzdxbFJxelAyY1ZLYm8KLS0tIEdWc0lOQWU1ZFdHQjVIeTFVdGpH
+            WWxTeW96TC9UWTRMOXdkNVNzd1Rra0kKzkam9SYaIbkSOE+g2FIzIV7nyDHHt+gk
+            Uvhb6dvKW3omRYlh5ln7xDRcHiX83rz/TfPh2GdtXs/J0Oxkeo7drg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1xekdrkjfu82hkxltydm72tllzgayyvfavvudeks3xjuujm5wt5hq6g55v0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWTc0ZUJrL0dmallFb2Nv
+            TVR0VU9ZdGpzK3FNdjlaR1pmc3RucGZLcXhrClhmWHNjQk5kZ1ZBT2xYek9JM0x1
+            M0krWE8yUVVZMmVCbk83TGhMSUoyVWsKLS0tIDRocWI3L1ZVMmppSU1rUytDTDJz
+            dm5SYXc0VTdWSE1hQ2JtczdUenF1RUkKNfLtmhzZBFqGJKT4MMMVdKG/MmqNqUgF
+            DFPkw2uLlPTW1Wws37ac9u53G7AfcE1zRHiIzGYz9O2Cqc+xKjRpDQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-10T13:18:54Z"
+    mac: ENC[AES256_GCM,data:La/qXs87taoMI4KT3Mnb/MMyVshP3c+sgS5jzSZSGhsT02pOsE3AvG8UFlgcz2gZvD0aTsm3P54B3bHjq61OCcYOKAcS9dJjqDwC91utRf3CL+1hezIJUUjXNMUMTwVbRmNPuP6gZMKsdqztkAqvCxRwqXQWkC10ds2IfzKCQD4=,iv:e/LTO8wzKDw2DP4b/HdSTakcz7lPkLGqcdeU6N5dDDA=,tag:ASw3jQj7mrcVrOdhjlbwng==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2