infrastructure/misc.yml at master - infrastructure - git.dotya.ml

mirror/infrastructure

mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2025-01-18 08:06:16 +01:00

Kristian Klausen 27553ab31a

Remove the WG private keys from the vault and store them only on the servers

With the support for network.wireguard.* credentials[1] in systemd
v256[2], we can now easily avoid storing the credentials centrally in
our ansible vault, which is preferable as it makes the private keys less
exposed. It may also make fine-grained access easier in the future[3] as
there is no longer a vault file for each server.

All the keys have been rotated and the new private keys are only stored
on the servers.

[1] https://github.com/systemd/systemd/pull/30826
[2] https://github.com/systemd/systemd/releases/tag/v256
[3] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/64

2024-12-15 17:08:21 +01:00

8 lines

226 B

YAML

Raw Permalink Blame History

 filesystem: btrfs
 memcached_socket: "/run/memcached/archwiki.sock"
 wireguard_address: 10.0.0.22
 wireguard_public_key: +HOjbJivvyeww7Mvej5IOZghZ000AAGxy1qN1eZZajo=
 nginx_extra_modules:
   - name: geoip2
 nginx_enable_http3: true