diff --git a/machines/prattle/default.nix b/machines/prattle/default.nix index 5430c07..d9e68d5 100644 --- a/machines/prattle/default.nix +++ b/machines/prattle/default.nix @@ -111,6 +111,9 @@ owner = "garage"; group = "garage"; }; + atticd-env = { + file = ../../secrets/atticd-env.age; + }; }; programs.nh = { @@ -321,7 +324,10 @@ # spindle's HTTP port, reachable only over Tailscale (terebithia fronts the # public spindle.dunkirk.sh and reverse-proxies here). Not in the global # allowedTCPPorts, so the default-deny firewall blocks it on the LAN. - networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 6555 ]; + networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ + 6555 + 8091 # atticd (Nix binary cache), tailnet-only + ]; # microVM host prerequisite: the vsock transport for the spindle's in-guest agent. boot.kernelModules = [ "vhost_vsock" ]; @@ -702,6 +708,19 @@ }; }; + # ── Attic (Nix binary cache) ────────────────────────────────────────── + # Tailnet-only cache so CI and both servers reuse custom-built packages + # (knot, herald, the tangled bits) instead of recompiling them every deploy. + # SQLite + local storage under /var/lib/atticd on the SSD root; the tailnet + # provides transport encryption, so it binds plain HTTP and 8091 is opened + # only on tailscale0 (same pattern as spindle). The RS256 signing secret + # lives in the agenix env file. + services.atticd = { + enable = true; + environmentFile = config.age.secrets.atticd-env.path; + settings.listen = "[::]:8091"; + }; + boot.zfs.forceImportRoot = false; boot.loader.systemd-boot.enable = true; diff --git a/secrets/atticd-env.age b/secrets/atticd-env.age new file mode 100644 index 0000000..9fea2ca --- /dev/null +++ b/secrets/atticd-env.age @@ -0,0 +1,107 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1yc2EgRHFjRzBRCnI1TXlCbHVz +TTkzZGRyUDM2SDFIUTRGNGowWmhSQ3VBa2JhRno3TDNJK2NJTE5qMXJ1dDgzZXNz +akJ4S1V5eTMKSDcweDFxVUh6NjM2WVZXajlrR1hDalcxcFljeDlRdDRBNlkySk1j +dmxvajI3eFhKOU1YY0VoQWxTRGEyTDhiRgpSK3B6TDZ1M08vSlZIMGhyMm9zcmsv +ZElzUVRqQi9xL3hPaUROQklHdDNYaE5tR2lFR2Q5andRVHE5eXZWRi90CjgrdjJX +QnBCRWcwLy9rTmpHMXNwc0czYXRZUE5UbmZsWkNnYTJKRkRFeXBHeWJhQ1pRdmZH +aDdVNWxlMG5XWmEKQlNLYVV2aWozYTl3d0ZIT1dNdkhaKzI2N1JjZ1J2WmJMek15 +UTFsNXIyZWJTSStIeEE1dlRFYk1uZis2d0pwQQpSdUtpWDJlZU0yVXYyS1hiQUxZ +dVZDQVR4Qlh4dzZ2aXAyNGYrOG14N1Zrb3RJZ0laZjRWT3UzM1VxY1I2NzkzCmsx +K0JCbDkreXpueUFudGVvVWZnRVZ3ZHRSaHRlemtXc3JHN0p6MGYxVCtlTDlNVXlY +cmp5cVpZNHlVUmNLeEsKWnl0WmZlZFd3Ym9xaTFRZmZqc2gwdm5oMW1wR2RqVXAr +NEthRFhnZXl6ZXlQWjArLzZ2UUJva1ZGU2dLTmVaRwoKLS0tIFlSMmFvOXJkVlM1 +OFpmMTN1aVA2RlZqMlNxRFVZNjg2WFVpVzdSdXQwbUkKdkn2huH8rX9rzClGVI5S +g1TkYcIVsKODo7RbZfZY+tOrymqb6dYFlCAMrRTdXCR3b6XuwdtKPm6RR6FRvDpc +jI8MsNXfRmKeWZqicgzRoB0zsCtV2m0J+kKX+FP/shIBjk6hsQpONCycCCwXeBHs +XlZYkdRCxKSkO1XtNMz1Q3l4m7iQVOFRmJQDuLb1iQH38xSHml6PCfDw2Z0jquq5 +/IuqINkXDVVNzRPO3Y39jDnpzs6byYuY4qrohqBGXgcgPPgPBD8JNlCvklEkkYPN +liQnvbtuZb9hscdKuQtzFUDTlf8Q7bILaAnlxrwhEDI4CjeGPEEQd4bti8g7RIly +t1pTQk+MFpwrbYkMFOIknd/syF8fmOctCjVFRxm+Z/zi1smEBEHewTDtg2VjqC4n +7iB3isydg0vq2Gj3dj3H3Q1rBgRB/JJLKYpYnvok4tcwLZi/ZUlzZTogvgMMizf/ +1/86VRZaHcdzN0HwoBVXMYwpjqs1WYc4I17yG87qWKNQQwfVYwkFhRcKcAZ/pVIc +HZKT7KITjQT8NKy2j0wLyOz1R2GlJWHglc9IxCtoZxSgrgpEIx272vw3tPG6/Y9t +PP3yry5EJt8jzDUpylkPUPLCQeDL2Un82xhi9V4XDbyfGe+LLE7D9+3aj25KymoJ +4Btvo8pqwDfrb7Y0KshKNJMQ1Stf3m0W5EMGfKWXR1ohEimIL2kqatPjTaxUrTbI +y8p2uXy5/YRHUyj2RtKTgQNBh5r6m0SeFZaom+WJwipryaplz164BtWBR+i4RAk5 +swFvv2zVHEVtgT+An1xiV5POp/mYbxwB0K16HYwYulWzr3uBSND85kf5q7k829Ro +CqCx7wqwRZnjhPOkiwboTaIWh5fy9wa7hLRHKRGhBpocrFLj5z93g7mSLS6qyglj +yxHnZBE2rNteYQNAI2EbYAgvcFAkxU6Wz290DlcLUjsUuPHYL2RYKQN3LFUurgp8 +C0cc+saDf26ARgFBl+EknFA/diAhdBFFI8ak1Lv5PkEbpkvz8ebKAUshFPJJA/OS +Mpq4t+thPb+TrUQpD7r+CeFK3v5EhNO4yI/vEDjqkdj46S1l2cdlAK5pHGZjBVxJ +RzRY0SZ/EOEq5fqdKoC9LvvuOrDuo2fuNYOS3BdjjXmEFJZAIZOvmaLERyGiSqiV +6++z2xuJ6oAtqhkgdCs/bIdWIJzlWOlMkR44PKeJe7eJN//HpIp8YPqc+O/Tyjda +RtPSTXD1+ZGbutgMuyVRzg4xuUK+dloQhllj95HfFM2qailL0GhiHaEeL1XF6733 +Qw9vyACK7X7Z3HG9Ov70h2cEcjretWtJTYuGMixjs+gdEHPh+xHmENzIkePkJdEr +U031uYw7OITEMUBIdX6NXD9F8Z508uYns8MfIZc8MDcb4kxN1whLXfoUrK6ICHzM +TGiWGaOn06OcaYcS7xYmMHSuA8PGxV3lxW+PTU3Neg4WGpnUWpwINSqnFaRl45fh +TOEbK8zRUXj4Jnyn+t1P6Z/BW4/rAcpv6tG1MlXYoY5Kjn/zn39ngd/DEm6LxhER +CsK8j7YuBNVmHm1SPIcKm2yekHyau7TYSAYV/bN5SHxM3mk9xmBX9dWGND6iISBp +1s6juQvjWAfReKN2IjN0+4MqJGESjLKw20DNMbjWmqYyd8Px4099l/uVGwMZuKc0 +5I4YGTcAhhvZCiZJYM/vy8hm71OnLu0kA6Gd8Y7SRCnSI3Pd20jAhjnt6TBDfmxh +iEgb8taG3dodVI1G6SE4pTJ3ovuBaFhDrgeHoJTTKMmgabgcH6Fz7KvenNcyQBFk +x2czZip7klgvlBFst+adULkAcCp8GyQE5aAdzWZ8/H600hKhPvmLAaWS24Z6hdcj +B7nWokAnXxd5Wx3khenCFj21EEkOoRVr05v+p0LiRy+jAazZABXeWP1kAg5qCNto +0GOIzHcI7q2GFrYodTNLO+aBAkYx7aLj+GElvQu/m6MofVyxCtO2wPy+KoK5gPci +ssWUHO8F8XThg/m5uYS73BgAoayjFzA+50XK0vbZb+bWVJmMI9UknpuF1oFpZTK/ +j0iWvUIjkdFZLC4g5pHmc3G9oBUBbJl/7oY8QakwJsopsa15kRo1WmLe3gOsb56s +B9xBTnJyYRa2FSX0zBhULUXbGQdpd7QgbqJ8mXivAiOPMN4O8nRI8/+OtH0aSRjT +AEIAx9wS3L49O5cZQdEnsr0frxbR9bYZMF3O8xszyjjPmSJBNHRG4ovmUY59Bwcy +y6onIhFA+MH7lxrpK78fMtAwB37MIv6JizStNaLTDihp4ZTKChBG00ldlGPW/dOf +UDYOVuwMEVz3+BdQ/orm7j8bH3LfXgequY4VhLO2K3eqszF5qPwX5P21Q9lKGPET +9om6Qyc0PYB7OM9w4tm8kxMt9PnA8WbVaS3EbPDb+Jcfle8m3gIQk1298E4dpYxT +KlsX1LAp0CU+CL7mfC+PscN/I1RizvPWmXI5+KON0Rwh5JhQSYeFUhELk/yunkJY +8HFnL6ZROM0ZJRJxnwZVd9Jt53opFEs0UX5UAqVt2r7bWNSyHriXURNnSifXafFA +Tg0hRY/FYLVCnL7RXQNNll3YSODLLGTabmL3MS100gSqYSSuqZPaW6gPJesZbui2 +YBjGWPvbh2hKwUUZWRFRNFIvTaKKI0zToHi+A8lNMJIDYG1Z3HYzaM6drE5ZoeiY +WwOYU89li9iQoclh92t1kwzoCwMf/dz+V0Me0myEm30cRz2exm6Gwc75M58DkJCD +uA8gT+2rHT+r2QCWWSbj5fwkhZNTK26uKP1QUNGdd3rrKhVKroaEaOYrytC2W20n +WmViRJN2353A+hI8Uo0+cVVQ5fp5WN3Xsz4eddqiIBv10IZ+rL5HY9PBgh+2/Isr +2YlR8COc/cBPGBJR9UD5jIkdba22ghJpiDlCWMEqTkXeBTxJJc6x5O/VjsRSla0S +1mrODk6fUcEZT/L77xmY4GIrNzegFUGOMUTrIUMa81BZjL0+x594r7Gi6JDFp9C2 +xTJ0D6wrlNOT+1DdUcTkufqow7Fe+F6HjQGMh5w0r9MxsVndXvYrGU+vgmGjsdQs +hzzibYVl9MvnZ+3FynYniu5bCpklyuu7fPIsHSOppu3RFvZDNLHT1wu1aCYwsY6G +NtER11KeQ4ib3vgSsvQr/jckFpYlQVLuw+BmbgwWtcCAX+mMkTYDpBSD7mL4FZfk +dz+MK+QpcCkZPFlOwF3xHgMH0jUGsGH5AR2tBg63sE1SZk8Pqdxe/1lysDDX/b+d +zrlv+igopsGLa7Cp215ZFgt0Ihpny9pCur9r72V/EOgrvbaigxc5E2RSluhYs83e +alhyD7wUD8JVACiOyAnGKgC1rPP+kaxqB6dV24RJvUjYHZKosfRRXytj01bX9AkI +iMJQ2HV3L274iHIcMQXVyKYcVbOd7UZPScXK3HxAIZkEnZ2fTc7wmbr5rjIANhq6 +UKLMd22t3+s2KIOC65wWmHA+WcAos4zJbGh9k1MNelWOlpLXowg++3dd5uLN4rDV +8A8F2zG+1Mmlv7vaVCzf6QUJ2ARhgCnmZdsSeXQMxpzZQkPuaVzTM+WS4Z2dtfDx +/k6gAAz7halSRLTkz/GULjR5+MZh3PzKw4RvP9NEJtb4YI275Mr/a5YZ8GmSPtWj +nkRFCxIM3ggNPdNB71pO3fxZj/DCf7vnKrdXdUJ9l4efiLvQRpUC9WYnhzXRRzWe +xzTzg0t3WzZPMOwOaPEXBYDI0fDdYZH5LonIbUHjYKMlnec97z+IgkVKLR+plfTx +wSdSyfv3ka1Nl5xAMczCjRftM1FF7gf3epWCQqn+ojQKo8NYtZ5HhheCw1DPIber +6KvdNzZvBeoaFCNuet69HogfYnrD7tr5dIu35zAU/YUc8J8hiZkja+dUMkrd5ncK +UptgXe1/VooI4TDdwO+oFAH5uKnLd356+dpkmLQqUEV9a+B5E5XGNYAFkCHHnUvz +gF5DYASjIZ1a0ipeUB+kMkx51U4sxGLeXl/38+P+7Lx/9ncIY1VLoRCiKKjSvuYw +zQp20B/Tcheqm5CyYopTXqQMfXyd+9i8CJH1CJLq0kd4rqRspcjoOVo0yuvSQnGa +Jdm8AyroX1ojZ9qNR4v+T9DXeCSkYPEkUTWtf1Tw0Jfh+aBvyoO6A5H5GO/s43lG +7uvSRXFbrKa5xXsTqQExUJE4P+sC8GQspPygUdL69TZIZ+nZjEJMOurxd5yidt1X +xLSPS3hvIc03wFh+QqL+sbIMGJQUxeFIcFFOSofJBY34o97xGKCk4+iBSCeRJ41J +e1gaSBjIAKh/3XyBZ8EMaZMpe+d0SB9CCvKegCFEc9gWJL39MOHC0CzeWtMXdRCv +BGfS8xqGb6y6d1zjSQ5iY2VkSmOYJK6arb1o2ICOQ27oS5VZV2d7LdPqIjCQI6bo +j8U/dPk6FSG3MZYsxm7URLA14ujd2MREr5TRUDSSANza5dalQd8IZrTQHgsjrxK0 +dOk1ZQDS6crD2A6WvOUdE1FzWFTn2trw/7vKKF+UbO82K9RTAV1AaiynpbDAAPsg +W7RLcjrJ8odj6hTLeZRNUSYM/dm4pKJOp2nqDrwZb88K97pTBD/9IOrAuIfldF2h +sQUywNS5KmPE34KNcNAkvlhiBl3S5bWcPrjCpd43JA02zMwpdxkOavttR8vMJ65V +HHLh++yVzszSBfB7OAtElIjb7PGmx/7HXeUGore2/os0OVQczWF5uXmRDZeG/nuv +sEBDgmSSs16GNGDTJORB+d5eshW2RQPhDEnE84aBZ69fA2E5f/tDkv2XYNQd3D5r +mp9CvDon9BzX8wjGWhDv0PkgB3Ovcc/CtDmDQ7bNHYbcstHdlAd6ejWcnnJZmPgq +xpacpVzflk58lIpaXK0QDxGgJ4jjKUY6ji20xIwmAzLyLBJI8lrnWD02vHP5I7Or +mO5Lq6FdQHnmcQ9HM7T5Ul8pvuq5wXnzu9F7L1EZcRe6LiAnoyPfrasy/hHiwt5N +LWq49SRXEzpldbC3H+HXOeGhIX13UmB7aISQJpzME/DYL7fAyJMyNGOKBzZYnwq0 +Je49EK7Ih+aBxmjD+SNnMBm4O0KsfARa0KBDdXQ5MXMKbqaRBCWF4Sc1gk4yEDd2 +XN2vgfg7D8WwuCoaEitnBW7+Dxh7FH7cQWDylvZUi0Z+C0C/9XP3hhJ0tA+PXsJW +RTD/oIn+aHxWvol1IJE+6oaCDoMHQYoyGWgsEByUDAy3bNudoqKbQYXCFJa90pCx +W5o90il2NAZ3R+K4V92iOY03o86pw7EoMSedzZfAgAUgq0ENUg3Y1Oqn8xCJNeKc +2WKSTzq36AaU3ciNhGRCnCMxZ9JTXKT1WHaWRyOdNa7Tzcb8OBhfI1ZFR4WEzz6N +pPdLZoB9iEProzZkujzR/XnPBlG9H2N+bBshErYquBVNzQr3mhxkxg7IIAt5Hnzh +MeOoW7cOXPNBAaq1wDlIxlMA6iKsuMHfC0xITIT7sNaCwDch4+zFxPapiinfeb/Q +t4bGs34gyQbJXvMl3cjYuJD7IgThIuwn13AJ1SBvbg7z6DRnU6P+QN1spn0vYlGO +OsmGaneeADP6RdMzwk+ya8E0I/ZcpwnxdRa/K9Xp/hOiTHMTdR3afksaE247BJtq +PS7gVaADVs7b1+61rlBNSPAPleOMhAyxRto+MFo62uth6X0y3w5GJdbhgXJJ2xwl +A9O1HY4XlAfWZsyVZOcfdGvAOFOQMCGvnhhiQ3+GSPGp/R+bLNxh5Syx539QqbhU +81lw2D0cDPfddoogCWo5pIUmEziCfXfoCFlTsWrkv6vt+fNo0jyVMpXd9ctAozsc +Ex+Uf5kBLLn0BeHNprLX +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 9fe0892..3530795 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -105,4 +105,7 @@ in "garage-env.age".publicKeys = [ kierank ]; + "atticd-env.age".publicKeys = [ + kierank + ]; }