Skip to content

Commit abde6ab

Browse files
Erethonbalsoft
Erethon
authored and
balsoft
committed
infra: Init production settings with secrets
1 parent b729072 commit abde6ab

File tree

8 files changed

+150
-0
lines changed

8 files changed

+150
-0
lines changed

‎infra/production.nix‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
config,
3+
pkgs,
4+
...
5+
}:
6+
let
7+
sectracker = import ../. { inherit pkgs; };
8+
in
9+
{
10+
imports = [
11+
sectracker.module
12+
./configuration.nix
13+
];
14+
networking.hostName = "sectracker";
15+
16+
fileSystems."/" = {
17+
device = "/dev/disk/by-partlabel/disk-main-root";
18+
fsType = "ext4";
19+
};
20+
fileSystems."/boot" = {
21+
device = "/dev/disk/by-partlabel/disk-main-ESP";
22+
fsType = "vfat";
23+
};
24+
25+
systemd.network.networks."10-wan" = {
26+
matchConfig.MACAddress = "96:00:04:64:8e:77";
27+
address = [
28+
"91.99.31.214/32"
29+
"2a01:4f8:1c1b:6921::1/64"
30+
];
31+
routes = [
32+
# create default routes for both IPv6 and IPv4
33+
{ Gateway = "fe80::1"; }
34+
# or when the gateway is not on the same network
35+
{
36+
Gateway = "172.31.1.1";
37+
GatewayOnLink = true;
38+
}
39+
];
40+
# make the routes on this interface a dependency for network-online.target
41+
linkConfig.RequiredForOnline = "routable";
42+
};
43+
44+
nixpkgs.overlays = sectracker.overlays;
45+
services = {
46+
nginx = {
47+
enable = true;
48+
recommendedTlsSettings = true;
49+
recommendedProxySettings = true;
50+
recommendedGzipSettings = true;
51+
recommendedOptimisation = true;
52+
};
53+
postgresql = {
54+
enableJIT = true;
55+
settings = {
56+
# Derived using PGTune for an 8 core, 16GB RAM host
57+
max_connections = 200;
58+
shared_buffers = "4GB";
59+
effective_cache_size = "12GB";
60+
maintenance_work_mem = "1GB";
61+
checkpoint_completion_target = "0.9";
62+
wal_buffers = "16MB";
63+
default_statistics_target = "100";
64+
random_page_cost = "1.1";
65+
effective_io_concurrency = "200";
66+
work_mem = "5242kB";
67+
huge_pages = "off";
68+
min_wal_size = "1GB";
69+
max_wal_size = "4GB";
70+
max_worker_processes = "8";
71+
max_parallel_workers_per_gather = "4";
72+
max_parallel_workers = "8";
73+
max_parallel_maintenance_workers = "4";
74+
};
75+
authentication = ''
76+
local all all trust
77+
'';
78+
};
79+
};
80+
security.acme.acceptTerms = true;
81+
security.acme.defaults.email = "[email protected]";
82+
networking.firewall.allowedTCPPorts = [
83+
80
84+
443
85+
];
86+
services.web-security-tracker = {
87+
enable = true;
88+
production = true;
89+
domain = "tracker.security.nixos.org";
90+
env = {
91+
SYNC_GITHUB_STATE_AT_STARTUP = true;
92+
# set to `true` when going live
93+
GH_ISSUES_PING_MAINTAINERS = false;
94+
GH_ORGANIZATION = "nixos";
95+
GH_ISSUES_REPO = "nixpkgs";
96+
GH_SECURITY_TEAM = "security";
97+
GH_COMMITTERS_TEAM = "nixpkgs-committers";
98+
GH_ISSUES_COMMITTERS_ONLY = true;
99+
};
100+
101+
secrets = {
102+
SECRET_KEY = config.age.secrets.django-secret-key.path;
103+
GH_CLIENT_ID = config.age.secrets.gh-client.path;
104+
GH_SECRET = config.age.secrets.gh-secret.path;
105+
GH_WEBHOOK_SECRET = config.age.secrets.gh-webhook-secret.path;
106+
GH_APP_PRIVATE_KEY = config.age.secrets.gh-app-private-key.path;
107+
GH_APP_INSTALLATION_ID = config.age.secrets.gh-app-installation-id.path;
108+
};
109+
maxJobProcessors = 1;
110+
};
111+
112+
age.secrets = {
113+
django-secret-key.file = ./secrets/django-secret-key.age;
114+
gh-client.file = ./secrets/gh-client.age;
115+
gh-secret.file = ./secrets/gh-secret.age;
116+
gh-webhook-secret.file = ./secrets/gh-webhook-secret.age;
117+
gh-app-private-key.file = ./secrets/nixpkgs-security-tracker.private-key.pem.age;
118+
gh-app-installation-id.file = ./secrets/gh-app-installation-id.age;
119+
};
120+
121+
nix.optimise.automatic = true;
122+
}

‎infra/secrets.nix‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
let
22
staging = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEHib5Kk39PzPEheOf8fwIyeVbVgSzUiqUN2vSIXHO7N";
3+
prod = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFGpUTeMijmoaw1fJs3Y2CIl/VH+Bc8CLzZxAqyCxIwx";
34
in
45
{
56
"secrets/staging-django-secret-key.age".publicKeys = [ staging ];
@@ -8,4 +9,10 @@ in
89
"secrets/staging-gh-webhook-secret.age".publicKeys = [ staging ];
910
"secrets/staging-gh-app-installation-id.age".publicKeys = [ staging ];
1011
"secrets/staging-nixpkgs-security-tracker.2024-12-09.private-key.pem.age".publicKeys = [ staging ];
12+
"secrets/django-secret-key.age".publicKeys = [ prod ];
13+
"secrets/gh-client.age".publicKeys = [ prod ];
14+
"secrets/gh-secret.age".publicKeys = [ prod ];
15+
"secrets/gh-webhook-secret.age".publicKeys = [ prod ];
16+
"secrets/gh-app-installation-id.age".publicKeys = [ prod ];
17+
"secrets/nixpkgs-security-tracker.private-key.pem.age".publicKeys = [ prod ];
1118
}

‎infra/secrets/django-secret-key.age‎

265 Bytes
Binary file not shown.

‎infra/secrets/gh-app-installation-id.age‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
age-encryption.org/v1
2+
-> ssh-ed25519 wgqcZg FkRfUTy5iz/NxgS2tFmZZyMPGsiTc2rwuIZlnRdIanE
3+
N7Rd/EGfjG+iYL+/w5GcWE8TfayyUGHq+zIbPFJC9UA
4+
--- e9lgS0lXmAIX4pTc+8b3kBXmndaLSB3XzskO6XKksd0
5+
��$xȡ�dg8����c�s����q���ݲ�ֵ��+��

‎infra/secrets/gh-client.age‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
age-encryption.org/v1
2+
-> ssh-ed25519 wgqcZg YdP8zpKhO6bnbL+7X+vI9cnIEVIiJql7L2hP5gmZfmY
3+
/YYQQCq7iMggnQP/ZbnteqC+1FlbwAHceXUkvf7AAuA
4+
--- VwHBQjoJpu25m3EUDaRQdRdujeqgIqm4Td2LynFiHlU
5+
T څ��q[�p���,�@��?p��I����C�u8�����g�͎��0 T

‎infra/secrets/gh-secret.age‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
age-encryption.org/v1
2+
-> ssh-ed25519 wgqcZg a7gN9+6SYgdp593Vc5tQQuWmqv/490aMhDDEaXrfyBs
3+
+hKac44nJc6o8GBxd/V+8M4I+7fEYC3ukQQrTh3+7C8
4+
--- IGf6ZE3vsS04xo9BL3lJw+pqk8pOUZo7o8cHB5rlE+c
5+
�#�v��g���m��F^�c-����`f�J#�C��m��;�m��Q��#����{бֳH�{�}��٥�)

‎infra/secrets/gh-webhook-secret.age‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
age-encryption.org/v1
2+
-> ssh-ed25519 wgqcZg sNuy8bTrDPIoGsLOk3Y8XvV9hv3h5MJZ9yrmmlhLuR8
3+
Cb8qQPqmRXD3o8TPwkvbpllb1bIeLgzwYT+VHl/e1mY
4+
--- YEumK90U9FE1GSi3MivS7a3bHb2DzbpTJDwauOuGMec
5+
S�h��q���Γ
6+
L�����`� ۞�_��� #�I@|2t����^LQ����xZKc�I����G�ֿAo���˧�y�.���z�,�������Z X<+*��H'�r���2

‎infra/secrets/nixpkgs-security-tracker.private-key.pem.age‎

1.84 KB
Binary file not shown.

0 commit comments

Comments
 (0)