NGI Infra Documentation

Hosts

• makemake

  A Hetzner physical node in Falkenstein, Germany.

Rebuilding makemake

Applying patches automatically

By default, a GitHub action deploys makemake automatically on every push to the main branch. No manual actions are required from our side.

Using makemake as a remote build machine

If you're a participant of Summer of Nix, you can use makemake as a remote build machine. Read the tutorial on setting up distributed builds for details.

To get access to makemake, follow the instructions in users.nix and open a pull request.

Secret management

We use sops-nix to manage secrets. In order to access the secrets they must be encrypted with your public key and you must have the matching private key available in your system. SOPS must also be installed and configured (provided by the devshell).

Viewing and editing secrets

By default on Linux, SOPS expects the private keys to be in $XDG_CONFIG_HOME/sops/age/keys.txt or $HOME/.config/sops/age/keys.txt. You can generate an age key using age-keygen or convert an SSH key with ssh-to-age to one compatible with age. Once you've setup your key, you can run sops -d <file-to-decrypt> to view an encrypted file or sops <file-to-edit> to edit a file.

Encrypting secrets for a new key

To add a new person or a key, edit .sops.yaml, add the name of the person and their age public key under .humans. Additionally, you need to add their names to any files you want them to have access. This is done in .sops.yaml under the creation_rules section.

This is an example diff of what this might look like:

diff --git a/.sops.yaml b/.sops.yaml
index 68dbb5b..849002e 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -2,6 +2,7 @@
   .humans:
+    - &anewuser      age1ve389y20udzc4ndx709u67dcjcclc3durqhadxs9w0ven56mncxsha5668
     - &erethon       age187upwqdte7t0hkyec22jhac357m9y4fkcdvpg9sj5q9mekjupfnqg9a077
     - &lorenzleutgeb age1c0g6s6daxy79dlm9uqczwlkh0hvjpghw5h8zzljc3vs275rvvqus30hv9l
   .machines:
     - &makemake      age1ewus3xraznqv6xc2ptua2qjqrjyhfd8uugu08wjduushj3uhgqwsqd6vkk

@@ -9,6 +10,7 @@ creation_rules:
   - path_regex: makemake/secrets
     key_groups:
       - age:
+        - *anewuser
         - *erethon
         - *lorenzleutgeb
         - *makemake

Remember to keep entries ordered alphabetically!

Once that's done, you need to re-encrypt the secrets with their key (grep path_regex .sops.yaml to help find all encrypted files):

sops updatekeys <files-you-want-to-update>