diff --git a/README.md b/README.md index 3324e5c..8648de6 100644 --- a/README.md +++ b/README.md @@ -86,11 +86,6 @@ models: gpu: "0.2" # fraction of a gpu to use ``` -### Secrets - -You may supply your encrypted deployment's secrets in `values..yaml`. -This is set up to encrypt values with sops+age; if you maintain those, see [CONTRIBUTING.md](CONTRIBUTING.md#secrets). - ### Manual installation steps Some steps need to be done manually the first time this is deployed, since the relevant configuration can't be set automatically. diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index 6c44e4e..ccdf9b5 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -23,31 +23,9 @@ Without nix, run it manually once (it is idempotent). ## Common tasks -Run `just` (or `just --list`) to see everything. Tooling recipes are in the ### Manual installation steps -justfile (e.g. `just lint`), whereas specialized recipes (e.g. `just sops::edit `) are in just modules under `tools/just`. +Run `just` (or `just --list`) to see everything. Tooling recipes are in the justfile (e.g. `just lint`), +whereas specialized recipes (e.g. `just helm::template`) are in just modules under `tools/just`. ## pre-commit Pre-commit hooks are set up via `prek` and run some `just` recipes. - -## Secrets - -Shared-deployment values files (`values.*.yaml`) are encrypted with -[sops](https://github.com/getsops/sops) and [age](https://github.com/FiloSottile/age); -`tools/config/.sops.yaml` controls which keys can decrypt them and which fields are encrypted. - -One-time setup: - -1. Create an encrypted age key file: `just sops::keygen .age` -2. Ask someone already listed in `tools/config/.sops.yaml` to add your public key and - re-encrypt (`just sops::updatekeys`). -3. Tell `just`/sops where your key is: copy `example.env` to `.env` (gitignored, - auto-loaded by `just`) and set `SOPS_AGE_KEY_FILE` to your key's path. - -To work with encrypted files, list recipes by running `just sops`. - -> [!NOTE] -> -> If you wish to run sops/age directly without using just, -> make sure to export `SOPS_AGE_KEY_FILE` and point sops to -> the config using `--config tools/config/..sops.yaml`. diff --git a/example.env b/example.env deleted file mode 100644 index 8175830..0000000 --- a/example.env +++ /dev/null @@ -1 +0,0 @@ -SOPS_AGE_KEY_FILE=$HOME/.config/sops/my-encrypted-key.agekey.age diff --git a/justfile b/justfile index ec63748..7a3daa7 100644 --- a/justfile +++ b/justfile @@ -10,9 +10,6 @@ go_modules := "scripts/init otlp-openmeter-bridge" # Manage nix environment. [group('modules')] mod nix "./tools/just/nix.just" -# Manage secrets with sops+age. -[group('modules')] -mod sops "./tools/just/sops.just" # Manage the helm chart. [group('modules')] mod helm "./tools/just/helm.just" @@ -60,8 +57,9 @@ build *args: # Clean up generated files. [group('general')] +[confirm("Delete everything in:\n" + output_dir + "?\n [y/n]")] clean: helm::clean - rm -r "{{output_dir}}"/* + rm -fr "{{output_dir}}"/* # Test the Go modules. [group('general')] @@ -74,9 +72,7 @@ test *args: # Deploy Helm chart. [group('chart')] deploy namespace release values_file: - just sops::run exec-file \ - "{{values_file}}" \ - 'helm upgrade --install -n "{{namespace}}" "{{release}}" . --values "{}"' + helm upgrade --install -n "{{namespace}}" "{{release}}" . --values "{{values_file}}" # Errors if the repository contains unformatted files. [private] @@ -87,4 +83,4 @@ check-format *args: # Check for secret leaks. [private] check-leaks *args: - gitleaks git --config ./tools/config/gitleaks_extend.toml {{args}} + gitleaks git {{args}} diff --git a/tools/config/gitleaks_extend.toml b/tools/config/gitleaks_extend.toml deleted file mode 100644 index cca017b..0000000 --- a/tools/config/gitleaks_extend.toml +++ /dev/null @@ -1,17 +0,0 @@ -# Additional gitleaks detection rules for sops. - -# Extends default config. -[extend] -useDefault = true - -[[rules]] -id = "sops-plaintext-secret" -description = "Sensitive key with a plaintext (non-ENC[]) value; should be SOPS-encrypted" -regex = '''(?i)([\w-]*(client[_-]?id|client[_-]?secret|password|passwd|token|secret|api[_-]?key|access[_-]?key|private[_-]?key))\s*:\s*(\S.*)''' -path = '''\.enc(\.|$)''' -keywords = ["auth", "client", "password", "passwd", "token", "secret", "api", "key", "access", "private"] -secretGroup = 3 - - [rules.allowlist] - regexTarget = "line" - regexes = ['''ENC\['''] diff --git a/tools/config/sops.yaml b/tools/config/sops.yaml deleted file mode 100644 index 9e7c8b2..0000000 --- a/tools/config/sops.yaml +++ /dev/null @@ -1,17 +0,0 @@ -creation_rules: - - path_regex: .*\.(enc|dec)\.yaml$ - encrypted_regex: "^(?i)(.*password|.*token|[a-z-_]*key.*|[a-z-_]*id|[a-z-_]*secret|.*certificate.*)$" - age: - - age1xtmgj4gcsxpxthpazvckce05mnljs3c9dylvy93ndew5egtna99qyx2n6k - - age1d7snnadage3kkrz6w55s4dr5emwrnczvx03mjr2076k8zd7dt4psk6p0e7 - - age1jc90khzlmchdnnv5edsj3c5uz55x02xmnlt3drjmnqq5y02pd4nshftnww - - age16ccgm6y5x6xfw6n93vq4k5qpvjmjzsw7v6lh8hhd2zqwjf982d2s36jnwq - - age1t4x83rk02yqvekuyk3dx6dqq6gqwe4engqrpzkdk0m9gv9zhuazsehhrt5 -stores: - yaml: - indent: 2 -# age1xtmgj4gcsxpxthpazvckce05mnljs3c9dylvy93ndew5egtna99qyx2n6k Ralf Grubenmann -# age1d7snnadage3kkrz6w55s4dr5emwrnczvx03mjr2076k8zd7dt4psk6p0e7 Ralf Grubemann (Laptop) -# age16ccgm6y5x6xfw6n93vq4k5qpvjmjzsw7v6lh8hhd2zqwjf982d2s36jnwq Matthias Meyer -# age1t4x83rk02yqvekuyk3dx6dqq6gqwe4engqrpzkdk0m9gv9zhuazsehhrt5 Cyril Matthey-Doret -# age1jc90khzlmchdnnv5edsj3c5uz55x02xmnlt3drjmnqq5y02pd4nshftnww Gitlab CI diff --git a/tools/just/sops.just b/tools/just/sops.just deleted file mode 100644 index ee4d52e..0000000 --- a/tools/just/sops.just +++ /dev/null @@ -1,77 +0,0 @@ -set positional-arguments -set shell := ["bash", "-cue"] -# Modules don't inherit settings from the root justfile. -set dotenv-load -ENC_SUFFIX := ".enc" -DEC_SUFFIX := ".dec" - -root_dir := `git rev-parse --show-toplevel` -config_file := root_dir / "tools/config/sops.yaml" - -# Default recipe to list all recipes. -[private] -default: - just --list sops - -# Run any sops command. -[no-cd] -run *args: - sops --config "{{config_file}}" "$@" - -# Generate encrypted age key file -keygen key_file: - mkdir -p $(dirname "{{key_file}}") \ - && age-keygen | age -p -e > "{{key_file}}" \ - && chmod 400 "{{key_file}}" - -# Edit an encrypted values file in place. -[no-cd] -edit file: - just sops::run edit "{{file}}" - - -# Encrypt a secrets file ('*.dec.*' -> '*.sops.*', removing the source). -[no-cd] -encrypt file: - #!/usr/bin/env bash - set -eu -o pipefail - - fbase_dec=$(basename "{{file}}") - fbase="${fbase_dec/{{DEC_SUFFIX}}/}" - if [ "$fbase" = "$fbase_dec" ]; then - echo "Can only encrypt files with '{{DEC_SUFFIX}}' suffix." - exit 1 - fi - - fdir=$(dirname "{{file}}") - fext="${fbase##*.}" - fname="${fbase%.*}" - enc_file="${fdir}/${fname}{{ENC_SUFFIX}}.${fext}" - - - just sops::run encrypt "{{file}}" > "$enc_file" && - rm "{{file}}" || { - rm "$enc_file" - exit 1 - } - - -# Decrypt an encrypted file to stdout. -[no-cd] -decrypt file: - just sops::run decrypt "{{file}}" - -# Encrypt all secrets. -encrypt-all: - fd -gu '**/*{{DEC_SUFFIX}}*' "{{root_dir}}" \ - -x just sops::encrypt "{}" - -# Sync keypairs with sops.yaml in all encrypted files. -updatekeys: - fd -gu '**/*{{ENC_SUFFIX}}*' "{{root_dir}}" \ - -x just sops::run updatekeys -y {} - -# Rotate data encryption key in all encrypted files. -rotate: - fd -gu '**/*{{ENC_SUFFIX}}*' "{{root_dir}}" \ - -x just sops::run rotate -i "{}" diff --git a/tools/nix/flake.nix b/tools/nix/flake.nix index 978076e..f07f95f 100644 --- a/tools/nix/flake.nix +++ b/tools/nix/flake.nix @@ -67,10 +67,8 @@ (callPackage ./packages/helmfmt.nix { helmfmt-src = inputs.helmfmt-src; }) ]; devTools = with pkgs; [ - age gitleaks prek - sops zsh ]; goModule = import ./modules/go.nix { inherit pkgs; };