udpate posgresql

2026-08-23 14:14:22 -05:00
parent 0572b247f1
commit 59d3a63432
4 changed files with 67 additions and 16 deletions
@@ -69,6 +69,7 @@
              enableTCPIP = true;
              dataDir = opts.dataDir;
              settings.port = opts.port;
+              settings.password_encryption = "scram-sh-256";
              identMap = ''
                postgres roy postgres
              '';
@@ -79,12 +80,16 @@
                local all all peer

                # Dev can be connected to via the LAN or Local
-                ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)}
+                ${lib.concatStringsSep " " (
+                  map (db: "host ${db}_dev ${db}_devuser all scram-sh-256\n") opts.databases
+                )}
                # Prod can be connected via local machine
                ${lib.concatStringsSep " " (
-                  map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases
+                  map (db: "host ${db} ${db}_produser 127.0.0.1/32 scram-sh-256\n") opts.databases
+                )}
+                ${lib.concatStringsSep " " (
+                  map (db: "host ${db} ${db}_produser ::1/128 scram-sh-256\n") opts.databases
                )}
-                ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)}
              '';
            };

@@ -144,7 +144,10 @@
    dataDir = "/var/lib/postgresql";
    port = 5432;
    credentialsFile = config.sops.secrets."postgresql-credentials".path;
-    databases = [ "rdblog" ];
+    databases = [
+      "rdblog"
+      "gitea"
+    ];
  };

  # ================================ #
@@ -1,8 +1,7 @@
-credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str]
+credentials: ENC[AES256_GCM,data:DAUjS1wPVY0zNCL1OsCFLYVUwsEQk3rFeY/xj/Ny4vd1Q2019kjLqRFVGPdxISYCyogJPTT1inBu1JpuXfDHkKBB+HG4Ta5WNhVitI+FeLsTd9TQEEy+DlrdtKF+1DMOcraxBOqZvuo7P/+bEzqEl6QTMR/TfG5jBw1/6g==,iv:QCmuSh6c1177plXDKSK8NfiwC5DyZFLwsNsI2u1Wxz8=,tag:fGKQsiRAGDYs18btFFjT0A==,type:str]
 sops:
    age:
-        - recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-          enc: |
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQ2hETnI2VUVJZkdiaFRB
            dVc2Q0VYd0llTUlSanhGV0l5dHBRcm9RLzAwCmVEL2VDbXNSUjJUNU1WclFGeGRZ
@@ -10,8 +9,8 @@ sops:
            QVFGY25pWUxvNWdweDcwdHpXLzlMTG8KN8+srufAv+gc79Ev73K+deoXvg9lWQXW
            8QbDd42PcLAdQ3YflEL5MjOSPnzCupKWs4vHwC+0OI+w7zKRtW1txQ==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-          enc: |
+          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRkhhWkxBUk44RlZXTWRR
            a3JjSjJ4eGU1UnNRVVJSN1JxRndvMDIrZzFNCmNlSWc4SmUzUzJreGppQXNaemx3
@@ -19,8 +18,8 @@ sops:
            dGFLOWRFYVNYcmYwdkcrbHRPd0hIa2sKDh/AWTkl3rAGLkyfTCOELs+dsMIx1Rz1
            Rurt1p33dIeXanJEO6oXR+9CSEegM9pRGtgSBvVv8gI3rkcmcIJtUQ==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
-          enc: |
+          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdzVJUDlIN1M4U2tiN3Rp
            cms5T0hTVE4rOHUvNW12dk5ldVoyU2Zha0VVCmtRZzl2VmFZQjBYOVM0dXpVZ0xa
@@ -28,8 +27,8 @@ sops:
            UU5meTlHdWMrZW9NbzI5aFU5Z0xSSkkKT+scXfmdFgMCxSyVpC6qbzVbKg9vuTz/
            qXCDu/lXSBMAtszGbCQNhEt8RUDpM23Bdyu9rooGQCCxe0SuvDzgSw==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-          enc: |
+          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ajc3cVNjMERqWThsNndD
            WGI2UWJ6TUJaNnp2Rks2ZXFhRE5BUG9DT25vCmFoMHFpWTRXRStkTW9pM2Jjb3FV
@@ -37,7 +36,8 @@ sops:
            ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD
            1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-20T04:59:28Z"
-    mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str]
+          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    lastmodified: "2026-08-23T18:51:08Z"
+    mac: ENC[AES256_GCM,data:snU9+KYMyX3+2pB9qqqlYTFAHMeNvKTzkKR2um6y/hpRMHmVVRqKjxPWS4G2zfPaEwJeEblfJMzt69a6IrnoW2wD2usrrE7uoWSMkO3a/iN2cFlcdSHQ8wWfzMoBl26d4a7Bs4xOIn4ynvA4UwGM3PbjSMUwsi5qteKDBwwkGcg=,iv:UHqCHEYdBe92dgon+8x5Zg9xmMOsi2coxwkQOV6Q/3o=,tag:fpoL/F/XedlT+jw2pQb3Ig==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.3
@@ -0,0 +1,43 @@
+seaweedCredentials: ENC[AES256_GCM,data:/piXMLqpb9GkvSxnKFkHMQVWsPk2uYNKu8sjPodbwRPlbGcKzZYcJ4wUwg==,iv:mLJBVCGv/VM6Mh7gktplTcd94obWRnCjgKqNH4jGCQM=,tag:tVC+v+k2ZAv7ap/yscXDNA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRmswMVMxVkRsa0N6V0NM
+            Qy9VUmtyZC9BbGw2SXZUSDBURUtkYVU5aWtzClJJZy8xTEg4b0hjSTFSM3hBOC9U
+            cW9Kd24yeUNmRS9LNWl4SkJ1aVZSOTgKLS0tIGc3ck9ZbkZaMWtsdVcwY05JVWxJ
+            ZXphenAyUVc2eXZDd1cxZVptTjMvOHMKGHJchsnOU0YIThRzzjFpaiYh3rLaZMM2
+            Cr1ChgypHvrYQFcbM9gm1N5tfB24jdwtfnqHIhT5upwf0v7QfLgGNA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZWJXa3BEb3BRU01ueWxH
+            a2F6MjR6YnU5bmJYYkM5eDNDUzBoRUR3dDM0CmZ6endhRy9tWHVBbDRQdzdTRVdC
+            RkEySnRKa0pmVGlKdmhIOHE4SWhvRlkKLS0tIHpVeE1DUEh6UWtxdzQ5VU1oKzFG
+            a1NSWVk4NHhGZFNNRCtoazl5NDU0cncKY1bzev4i6eYaES6KvjQV0hcCn0i438Q/
+            tUhstFuDD1CwYAU7JoLxjTk+/XClY2DU7EEmWFOTNBhmoSmix1oapw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0emRuVDR3TXJPRU1wYVNH
+            eThCWjVucWdUYTJDVjE2RVl1ZXVKMkJOYWkwCnFLcy9aQ0Nnbk84TVhZdVlsM0JO
+            Z1pyQ1FBY0NIT2M2WWR0S2lLd0RjUHMKLS0tIG9VRUxpU2FKc0g1c2hWZ3dXWk5E
+            cGdqZnQ3NlNHQVlUOU9Bc2Y1MU8yUjQKK8fAyg9lcaGLOvofCfgx8k8d3ACK3chB
+            Ly5ANzayidycn0FBvTHIqbvQ7y/sL266G378XUzzlV+k0wU8m27VNQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDR0pObEZaRUpWNndDOWND
+            T1Z0YllKbUJucjNHcUdTMXQ2UE5ZOUVpcFZ3CmR2ZlA2eXVKb214RnhmdnBZcFd5
+            TFNyT3BLbFJBQVlMMUl2RENaT29tYjgKLS0tIGJ5TklXY3ZCYittd1FWd3JJdTh5
+            ZUdyK1pHSm96bFlwQXR6NkZsZnZTdlkKGy/Tj+yldqPM5Q86V8oKQoOe3C18VBZ3
+            YD4ad9KB3IJ0PG9GFCq5iN90bZBkY/1XeNPZzsOvkZKhAyIj9QLNMw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    lastmodified: "2026-08-19T02:32:09Z"
+    mac: ENC[AES256_GCM,data:3iCi9UB5INgZsIHtVhF+YjjIe/QrB86xR/pidWxt0Qj/m4vyR7fIP4uDFF/RjKQ2PtZ0tab0h3ALsWAMaRdnl/AvSJ0jROw2ZQtfAbL6pin6kZYsuBiDlXCDCBkBXVLdzH0vt0Tv31x+nDc3zTGOKB3JSPg6d5cFfidt3c38Tdw=,iv:t+67QNsIvQAGHkpMYiu6v/NRU2Xwt8Wvrk8/GLXZ7hI=,tag:y0vIrJYaOsYYHELWsiU18A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3