From 59d3a63432e03dd9326601ade96b25c40aba1348 Mon Sep 17 00:00:00 2001 From: Roy Dumblauskas Date: Sun, 23 Aug 2026 14:14:22 -0500 Subject: [PATCH] udpate posgresql --- homelab-services/postgresql-db/flake.nix | 11 ++++-- nixos/configuration.nix | 5 ++- nixos/secrets/psql.yaml | 24 ++++++------- nixos/secrets/seaweed.yaml | 43 ++++++++++++++++++++++++ 4 files changed, 67 insertions(+), 16 deletions(-) create mode 100644 nixos/secrets/seaweed.yaml diff --git a/homelab-services/postgresql-db/flake.nix b/homelab-services/postgresql-db/flake.nix index 1107525..8e4dfdc 100644 --- a/homelab-services/postgresql-db/flake.nix +++ b/homelab-services/postgresql-db/flake.nix @@ -69,6 +69,7 @@ enableTCPIP = true; dataDir = opts.dataDir; settings.port = opts.port; + settings.password_encryption = "scram-sh-256"; identMap = '' postgres roy postgres ''; @@ -79,12 +80,16 @@ local all all peer # Dev can be connected to via the LAN or Local - ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)} + ${lib.concatStringsSep " " ( + map (db: "host ${db}_dev ${db}_devuser all scram-sh-256\n") opts.databases + )} # Prod can be connected via local machine ${lib.concatStringsSep " " ( - map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases + map (db: "host ${db} ${db}_produser 127.0.0.1/32 scram-sh-256\n") opts.databases + )} + ${lib.concatStringsSep " " ( + map (db: "host ${db} ${db}_produser ::1/128 scram-sh-256\n") opts.databases )} - ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)} ''; }; diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 63dd283..332fff1 100755 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -144,7 +144,10 @@ dataDir = "/var/lib/postgresql"; port = 5432; credentialsFile = config.sops.secrets."postgresql-credentials".path; - databases = [ "rdblog" ]; + databases = [ + "rdblog" + "gitea" + ]; }; # ================================ # diff --git a/nixos/secrets/psql.yaml b/nixos/secrets/psql.yaml index 1803c7f..aa87332 100644 --- a/nixos/secrets/psql.yaml +++ b/nixos/secrets/psql.yaml @@ -1,8 +1,7 @@ -credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str] +credentials: ENC[AES256_GCM,data:DAUjS1wPVY0zNCL1OsCFLYVUwsEQk3rFeY/xj/Ny4vd1Q2019kjLqRFVGPdxISYCyogJPTT1inBu1JpuXfDHkKBB+HG4Ta5WNhVitI+FeLsTd9TQEEy+DlrdtKF+1DMOcraxBOqZvuo7P/+bEzqEl6QTMR/TfG5jBw1/6g==,iv:QCmuSh6c1177plXDKSK8NfiwC5DyZFLwsNsI2u1Wxz8=,tag:fGKQsiRAGDYs18btFFjT0A==,type:str] sops: age: - - recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQ2hETnI2VUVJZkdiaFRB dVc2Q0VYd0llTUlSanhGV0l5dHBRcm9RLzAwCmVEL2VDbXNSUjJUNU1WclFGeGRZ @@ -10,8 +9,8 @@ sops: QVFGY25pWUxvNWdweDcwdHpXLzlMTG8KN8+srufAv+gc79Ev73K+deoXvg9lWQXW 8QbDd42PcLAdQ3YflEL5MjOSPnzCupKWs4vHwC+0OI+w7zKRtW1txQ== -----END AGE ENCRYPTED FILE----- - - recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj - enc: | + recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRkhhWkxBUk44RlZXTWRR a3JjSjJ4eGU1UnNRVVJSN1JxRndvMDIrZzFNCmNlSWc4SmUzUzJreGppQXNaemx3 @@ -19,8 +18,8 @@ sops: dGFLOWRFYVNYcmYwdkcrbHRPd0hIa2sKDh/AWTkl3rAGLkyfTCOELs+dsMIx1Rz1 Rurt1p33dIeXanJEO6oXR+9CSEegM9pRGtgSBvVv8gI3rkcmcIJtUQ== -----END AGE ENCRYPTED FILE----- - - recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml - enc: | + recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdzVJUDlIN1M4U2tiN3Rp cms5T0hTVE4rOHUvNW12dk5ldVoyU2Zha0VVCmtRZzl2VmFZQjBYOVM0dXpVZ0xa @@ -28,8 +27,8 @@ sops: UU5meTlHdWMrZW9NbzI5aFU5Z0xSSkkKT+scXfmdFgMCxSyVpC6qbzVbKg9vuTz/ qXCDu/lXSBMAtszGbCQNhEt8RUDpM23Bdyu9rooGQCCxe0SuvDzgSw== -----END AGE ENCRYPTED FILE----- - - recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 - enc: | + recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ajc3cVNjMERqWThsNndD WGI2UWJ6TUJaNnp2Rks2ZXFhRE5BUG9DT25vCmFoMHFpWTRXRStkTW9pM2Jjb3FV @@ -37,7 +36,8 @@ sops: ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD 1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-20T04:59:28Z" - mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str] + recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 + lastmodified: "2026-08-23T18:51:08Z" + mac: ENC[AES256_GCM,data:snU9+KYMyX3+2pB9qqqlYTFAHMeNvKTzkKR2um6y/hpRMHmVVRqKjxPWS4G2zfPaEwJeEblfJMzt69a6IrnoW2wD2usrrE7uoWSMkO3a/iN2cFlcdSHQ8wWfzMoBl26d4a7Bs4xOIn4ynvA4UwGM3PbjSMUwsi5qteKDBwwkGcg=,iv:UHqCHEYdBe92dgon+8x5Zg9xmMOsi2coxwkQOV6Q/3o=,tag:fpoL/F/XedlT+jw2pQb3Ig==,type:str] unencrypted_suffix: _unencrypted - version: 3.12.1 + version: 3.13.3 diff --git a/nixos/secrets/seaweed.yaml b/nixos/secrets/seaweed.yaml new file mode 100644 index 0000000..e446525 --- /dev/null +++ b/nixos/secrets/seaweed.yaml @@ -0,0 +1,43 @@ +seaweedCredentials: ENC[AES256_GCM,data:/piXMLqpb9GkvSxnKFkHMQVWsPk2uYNKu8sjPodbwRPlbGcKzZYcJ4wUwg==,iv:mLJBVCGv/VM6Mh7gktplTcd94obWRnCjgKqNH4jGCQM=,tag:tVC+v+k2ZAv7ap/yscXDNA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRmswMVMxVkRsa0N6V0NM + Qy9VUmtyZC9BbGw2SXZUSDBURUtkYVU5aWtzClJJZy8xTEg4b0hjSTFSM3hBOC9U + cW9Kd24yeUNmRS9LNWl4SkJ1aVZSOTgKLS0tIGc3ck9ZbkZaMWtsdVcwY05JVWxJ + ZXphenAyUVc2eXZDd1cxZVptTjMvOHMKGHJchsnOU0YIThRzzjFpaiYh3rLaZMM2 + Cr1ChgypHvrYQFcbM9gm1N5tfB24jdwtfnqHIhT5upwf0v7QfLgGNA== + -----END AGE ENCRYPTED FILE----- + recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZWJXa3BEb3BRU01ueWxH + a2F6MjR6YnU5bmJYYkM5eDNDUzBoRUR3dDM0CmZ6endhRy9tWHVBbDRQdzdTRVdC + RkEySnRKa0pmVGlKdmhIOHE4SWhvRlkKLS0tIHpVeE1DUEh6UWtxdzQ5VU1oKzFG + a1NSWVk4NHhGZFNNRCtoazl5NDU0cncKY1bzev4i6eYaES6KvjQV0hcCn0i438Q/ + tUhstFuDD1CwYAU7JoLxjTk+/XClY2DU7EEmWFOTNBhmoSmix1oapw== + -----END AGE ENCRYPTED FILE----- + recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0emRuVDR3TXJPRU1wYVNH + eThCWjVucWdUYTJDVjE2RVl1ZXVKMkJOYWkwCnFLcy9aQ0Nnbk84TVhZdVlsM0JO + Z1pyQ1FBY0NIT2M2WWR0S2lLd0RjUHMKLS0tIG9VRUxpU2FKc0g1c2hWZ3dXWk5E + cGdqZnQ3NlNHQVlUOU9Bc2Y1MU8yUjQKK8fAyg9lcaGLOvofCfgx8k8d3ACK3chB + Ly5ANzayidycn0FBvTHIqbvQ7y/sL266G378XUzzlV+k0wU8m27VNQ== + -----END AGE ENCRYPTED FILE----- + recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDR0pObEZaRUpWNndDOWND + T1Z0YllKbUJucjNHcUdTMXQ2UE5ZOUVpcFZ3CmR2ZlA2eXVKb214RnhmdnBZcFd5 + TFNyT3BLbFJBQVlMMUl2RENaT29tYjgKLS0tIGJ5TklXY3ZCYittd1FWd3JJdTh5 + ZUdyK1pHSm96bFlwQXR6NkZsZnZTdlkKGy/Tj+yldqPM5Q86V8oKQoOe3C18VBZ3 + YD4ad9KB3IJ0PG9GFCq5iN90bZBkY/1XeNPZzsOvkZKhAyIj9QLNMw== + -----END AGE ENCRYPTED FILE----- + recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 + lastmodified: "2026-08-19T02:32:09Z" + mac: ENC[AES256_GCM,data:3iCi9UB5INgZsIHtVhF+YjjIe/QrB86xR/pidWxt0Qj/m4vyR7fIP4uDFF/RjKQ2PtZ0tab0h3ALsWAMaRdnl/AvSJ0jROw2ZQtfAbL6pin6kZYsuBiDlXCDCBkBXVLdzH0vt0Tv31x+nDc3zTGOKB3JSPg6d5cFfidt3c38Tdw=,iv:t+67QNsIvQAGHkpMYiu6v/NRU2Xwt8Wvrk8/GLXZ7hI=,tag:y0vIrJYaOsYYHELWsiU18A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3