From dd01c2242cd979883bfdc3c1bed341f1bb73cdfc Mon Sep 17 00:00:00 2001 From: servius Date: Mon, 27 Apr 2026 15:32:32 +0530 Subject: [PATCH] feat: Added signing key for shiro --- darwin/kuro/configuration.nix | 1 + darwin/shiro/configuration.nix | 2 ++ darwin/shiro/services/gitea-runner.nix | 1 + modules/nixos/substituters.nix | 1 + secrets/secrets.yaml | 7 +++++-- 5 files changed, 10 insertions(+), 2 deletions(-) diff --git a/darwin/kuro/configuration.nix b/darwin/kuro/configuration.nix index 7d7cab23..71ef7d1c 100644 --- a/darwin/kuro/configuration.nix +++ b/darwin/kuro/configuration.nix @@ -20,6 +20,7 @@ ]; trusted-public-keys = [ "cache.darksailor.dev-1:SE3fTKFjzPJ6A5rrmZcRYlJme6/zSpRI1yVu3366u6k=" # harmonia (tako) cache signing key + "cache.shiro-1:6LdQLhp0+TocABKct7ab9zqsUPTspiH7Y52N5qzPCvs=" # shiro cache signing key "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; download-buffer-size = 524288000; diff --git a/darwin/shiro/configuration.nix b/darwin/shiro/configuration.nix index ff396715..77db0149 100644 --- a/darwin/shiro/configuration.nix +++ b/darwin/shiro/configuration.nix @@ -19,6 +19,7 @@ ]; trusted-public-keys = [ "cache.darksailor.dev-1:SE3fTKFjzPJ6A5rrmZcRYlJme6/zSpRI1yVu3366u6k=" # harmonia (tako) cache signing key + "cache.shiro-1:6LdQLhp0+TocABKct7ab9zqsUPTspiH7Y52N5qzPCvs=" # shiro cache signing key "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; }; @@ -26,6 +27,7 @@ build-users-group = nixbld extra-nix-path = nixpkgs=flake:nixpkgs builders-use-substitutes = true + secret-key-files = ${config.sops.secrets."builder/shiro/cache/private".path} ''; package = pkgs.nixVersions.latest; buildMachines = [ diff --git a/darwin/shiro/services/gitea-runner.nix b/darwin/shiro/services/gitea-runner.nix index 1ea75439..b754c545 100644 --- a/darwin/shiro/services/gitea-runner.nix +++ b/darwin/shiro/services/gitea-runner.nix @@ -97,6 +97,7 @@ in { mode = "0600"; path = "${runnerHome}/.ssh/id_ed25519"; }; + secrets."builder/shiro/cache/private" = {}; templates."GITEA_RUNNER_TOKEN.env" = { owner = null; uid = runnerUid; diff --git a/modules/nixos/substituters.nix b/modules/nixos/substituters.nix index 2f52fa22..c3dd02ec 100644 --- a/modules/nixos/substituters.nix +++ b/modules/nixos/substituters.nix @@ -14,6 +14,7 @@ in { trusted-public-keys = [ "cache.darksailor.dev-1:SE3fTKFjzPJ6A5rrmZcRYlJme6/zSpRI1yVu3366u6k=" # harmonia (tako) cache signing key + "cache.shiro-1:6LdQLhp0+TocABKct7ab9zqsUPTspiH7Y52N5qzPCvs=" # shiro cache signing key "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=" "llama-cpp.cachix.org-1:H75X+w83wUKTIPSO1KWy9ADUrzThyGs8P5tmAbkWhQc=" diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 191c257e..90612ff8 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -78,6 +78,9 @@ builder: tako: cache: private: ENC[AES256_GCM,data:rIoRitjwiq2T4z9eS55ddM6cbzAesmM8bFvw+VPlRBBJApHomz1aNeqixSyFZayNUs2bw3c4MGhMVepfuC5VHZiY9R3HOjPd1v68ID3nkf1dTWVzoH3Z03WiekZt4g==,iv:VNPX+125wsordYUCk08MmJGoUAaDMUbPkqAJF8hQJEc=,tag:gvZsZwNlaa7jlr1gSEwr5w==,type:str] + shiro: + cache: + private: ENC[AES256_GCM,data:VVT9VO+AKfn4Z/T4np4ojQg4biZkutsR7Jka4N+B/YtLH93zK7hU6XIEp3uixM4ylE3M8YIfIvmhdFCs1u48AoRpIO1AtrO7/s8ZwQl1xv263UCdfmoMi/ofHt6ggew+H8yGkxZA,iv:K0dlEEXIwr8ezk1Rn7Meok2DoD7ZKsgNkpsdP4mpBcI=,tag:amud3/EsM+iaypjgO3cU/g==,type:str] zerotier: api_key: ENC[AES256_GCM,data:Hnihh3l4hZGSnDJcQV5eYz7TLD8AzWFAH9AgHAh6YEA=,iv:XO+nZ3pXmC+rDfgBaiapvkL6KnQTL9s6dmi3ZO18VE0=,tag:rb1gmBcMNWpSRP+wmhr86w==,type:str] ryu: @@ -145,7 +148,7 @@ sops: VGZKdHpVeFRpQUxtSEkyaEhLMlBJcGsKLb0DvPNZosPBUuiX6qz1s5IO5INQh8CK ZtXTVClwMSmaUYhdSB2gKFrKVZHXTJZ4oAL5t/BpC0pOHyr+o96T3Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-27T07:54:46Z" - mac: ENC[AES256_GCM,data:hSuqSBBze35dF5xu1Im9P2Out/xnNjm+G6m9a2wdq4mhSsoAFU01zSoXLddQhpNe7Tl5vnl+oqwwZYHDBXLCSUX//lcF0epV03q6OKPBl+rCCQ4m0v/nnRumlzJIoSOuZxlkzZqtrEHfwijNWiXeAI+tODEef7Chy/oIZn0JcQk=,iv:GzpcdtSfBF6aC0BDpiq78Wi9LfKHmBcVWHpHWQ7pTto=,tag:QtV2kz13nEsQE/XVe3B0LQ==,type:str] + lastmodified: "2026-04-27T09:59:30Z" + mac: ENC[AES256_GCM,data:A41qotUaMXcqWrSXwJHhuyZ6uS8NcXN3E1P9A7rTqSOWevqCs3rCA7rhR5xmKPvwkxwcE3rVLvCZKkXQ/g92zXpGFNmkoxY7ST6cL6GXDhqJzcryXU99iWKrcdpMEZnrKXVSQ1mFRhSWi7hMSPAKskoPgEZJzA7teP67NZ/CS6w=,iv:xXc9psJpCFd3xuRQkrKVWlf3zeC5pnVrGL1CQ2r3L/o=,tag:NTH759reueAe0ZCbR3MG1w==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 -- 2.54.0