diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 45b4b3fce1f8efb463137bd4c1874981dcea3a1a..24451781cd1b2e068f29e19b5a0af2d3e5a2405a 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -18,6 +18,6 @@ documentation-preview: url: "https://$CI_PROJECT_NAMESPACE.frama.io/-/$CI_PROJECT_NAME/-/jobs/$CI_JOB_ID/artifacts/documentation/index.html" variables: PUBLIC_URL: "/-/$CI_PROJECT_NAME/-/jobs/$CI_JOB_ID/artifacts/documentation/index.html" - only: - changes: - - docs/**/* + # only: + # changes: + # - docs/* diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000000000000000000000000000000000000..a73478727526ed333010e4651ca3f97f8aa7082e --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,5 @@ +creation_rules: + - pgp: >- + 393E2812E08C8F920C422E6AE43371DE2CA66EB7, + B31F04575C4561F58DE02C9EFC6C2E50B00E9861, + B52F407573A2F1A7CFEDC697EB5FE2B48557243C diff --git a/docs/administration.rst b/docs/administration.rst index cfdfbe246bc62fb15d93ff7abc84e7994adc7815..5d36899c3048a379ea05f3527ca6fbe83bfc7af6 100644 --- a/docs/administration.rst +++ b/docs/administration.rst @@ -82,3 +82,26 @@ publique. Note: le VPN rend votre machine utilisateur accessible depuis le serveur. Il est donc préférable d’avoir un firewall! + +Secrets administratifs +---------------------- + +Divers secrets sont centralisés et chiffrés avec l'outil `sops` dans +le fichier `secrets.yaml` à la racine de dépôt. + +:: + + # Éditer le fichier + sops secrets.yaml + + # Afficher le contenu + sops -d secrets.yaml + + +Les personnes habilitées à lire ces secrets sont référencées dans le fichier +`.sops.yaml`. Pour ajouter ou supprimer une personne il faut mettre à jour la +liste des fingerprint pgp dans ce fichier et lancer la commande: + +:: + + sops updatekeys secrets.yaml diff --git a/secrets.yaml b/secrets.yaml new file mode 100644 index 0000000000000000000000000000000000000000..31339fc50a49635f5175918596722d30aff6eeea --- /dev/null +++ b/secrets.yaml @@ -0,0 +1,72 @@ +kimsufi: + account: ENC[AES256_GCM,data:LWfLd+qwrnPgZI22,iv:Za8dN5eFyYZJgBFHgTxwG1dLZyLby1cHJJCgxNI5+bA=,tag:4fnj0hXFi3MK4cr04xhfrw==,type:str] + email: ENC[AES256_GCM,data:KdSenYSlP9homZ0Vfic/,iv:45OAr29yPSvDrLBZbeWkgRB2UVyz9v2RO23km46H60c=,tag:ySol6B+iB0c6jPeiq6VDdg==,type:str] + password: ENC[AES256_GCM,data:OJRKrW1YRFVHlhwQD1RzqOdUwsL2,iv:G5fj13Fj9LHip8h0pFYU1dXQT8qdwj+WIHFAI/nbfDQ=,tag:uSvHVp9OujzWnLyP6mSOEg==,type:str] +borg: + passphrase: ENC[AES256_GCM,data:N3N2cwrCSIfrbwiTEkyahGWRojv3h5ohT+c=,iv:PuOu8jJhWxS7qgjFyPDUG0YdiWwRm0L5nlS1JKWQLdE=,tag:hJwxxQ6zoGZdsQ4NevMZIA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2021-07-25T16:57:08Z" + mac: ENC[AES256_GCM,data:cnAlHm30Wv0yWQykXKA6znG7ub37+7JxpbFjqSVWxLrufTE/ySzW7gSy+ChAJkiMQASLbwIypb6VgP3wV6onL91aT1hCMQz3xV6yLk4ggZoFOuyG9j2VqpcRSPaiSH8HhxeQzTG9GI1TyrdykzzFB/8LZP2KfQJYDgQRKA2vJrY=,iv:XxiAMy5mnZfkkhYh+syzF/IU3Y2s9HX11giXH3fy/wk=,tag:EJ8hOXSiqekQMkgw+eUdZA==,type:str] + pgp: + - created_at: "2021-07-21T06:37:53Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQEMA1yPYC88Q+H1AQgAj8hDGC3ojfSKjUbKgdqX9mlBJC7pJgcA5oqyeM7e/w/o + a0UwUN5wBhe6zBjgrSp2A0y/Nf9YpgVPhB8uDdcdpHUWrtK1c3ro8Mu8XA69OcL8 + 8fhi+Pm2KAmMJs+mCLOz3sN8luXAgRbhtULCAhtFHaNBI2QFUZRewLizZQWlS3se + i8SA7PL7nYc/5rIuNAZkjIkk0zWPWpLYbZjCj90sakYVvXeXFtXfPX0iyBNnaEux + OTfz2lMA6mDdXTRl3Aagx0LvCEyqUOxapQx74+Y/o2HDqjdKmNB7zsGu3trHiaCz + phCSNTAHLZV44AOszYG2BZ3YSvEGCGS92LEGA1d07dJeAfb8RlbdAIL3e0JqKtEI + FzwKUtzQgz+2cMMIqqxx/5H+ZHH7iAPyC4cNizU9cU8cZAawXX1OjLptiH2/zQhi + j511qZEVEtEuow+bGufxOIgTzMvI+OrRzeQD1m3EHQ== + =zANu + -----END PGP MESSAGE----- + fp: 393E2812E08C8F920C422E6AE43371DE2CA66EB7 + - created_at: "2021-07-21T06:37:53Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMAwzkOLp1pua5AQ/+I6KMXOdaABXlNT/sb2Qs71q45ajA+i91bQ28NDMle8CE + dgtE99gKtMRIlVnkNY5iqbvZYVJ+HDVuUwsRUVmynr7nobTmvYfixiPXNG06EnVd + KbditWwgbcQChw1KSrBV0Mlsw5oulAsZQVqYy+MtlhTDi2kHBYD9S0Z/oILlQ8/8 + cJim9nPchyxOmxt7Cv6YHw86imXkYHrk6PLhnV74S1hNwQ/ayQcTZwY+gPwNHu22 + fc7TlkpzcYEbK2rJEkPoBeHo6bpHnyYlem4ntKYxcg3LL36ATlC7BV9jKmBqSFdv + ijc3zlhcSUP0hfTuPoJJp+DmmsSJ67W49Jyh8jVwCnlCwSBSAdfGSpGYeUgle254 + 1BxFC5F9XKd/WgdiKLvLIRqD3pDOfsFxVo3+VGwL2O+13ccPzR7LZI44btWOEWo/ + kDWWKQQyLG2ueojCJ1l1UsVVw4k/uhitu5uFowHb+UFeaTQfVILHMXYUd8pqkmWG + DXonxhCfixoR47eRc8eBoKMYYljRl9CzrC469ouSnLMz3XaSmJVbL+IHEZtl8NCn + NX5XWe9Zqvkzm68Fx54Sl8hyTLeWQEaK4pF5SNagrbOI80pzqUL1+/My65jz3qnl + Q+mshBndbvfGlXgUiaCs5EXvigPPfJ04Xo+9C5qvMbpvAYQQk9hjjkFvDKP46/rS + XgEcO5wW8pueEvXOnlIWpqn5cV21tqaqgNLMOpMDAwWSvdDlVciRA8kn6uvHStTU + htHBbqbWkE1XGI6mpkvjQT3vfXz+uKEF50iKa+s1hUuFGf6LNdMXR/p5u4NuUXk= + =pUbn + -----END PGP MESSAGE----- + fp: B31F04575C4561F58DE02C9EFC6C2E50B00E9861 + - created_at: "2021-07-21T06:37:53Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMAzWe43Mv0pLRAQ/9Gj6o/7IIBQydSyrJEL/1ANvCBuGWJ8VR3ECYGGRqttQD + EdL7isKnqVS6ivFSBMU42NYfTDA64i7/ChQGqsJwAypcTCANxZ4hWvj5LBbvJn2J + IHtXlGFDBF/c+VkNm5c7No924vhkrjf5NJof5kseqQn0bHwwOhwIgPCFMAuJreCB + FvFOyQS+UpOLz+lLWv8/+P68yv33+Kq/QgpOMEj8neSS7RYi+bsBl0yxrHYMTEOH + x6/wLzV35m2NOsps2joXbU6ouhKylpoHurnwghJugIoEZ5hGJA8gH31mkrZYEkON + wKBERjlKt1Jp3sNf7c3hcL2g7edy8u7j8EWhtZWxl+8bCyIF1TDMUQ7p5ERFefL4 + 7gODrGZbx1m2YnUEjviJUmhetSWaJq9eF6ZRY3tJrTcMwzrLkWWvSSbszongApnb + yd6jOv0cSznJO09c9cDvQY6pmN5g+NVSLri1kStspybYt39P8E7Wm2Y1C+bubcQd + 4X0f2eyjLyvR0IYt9xLiKNacRJn1JMBwbd3u6dqcLk08OWIj0PCyIFmJObV/VFZz + uxMS2abhjE0nSSCqVt9PdJaL9Lxeyy5UNiDVHjqwhVxcqexfwqNrpbVmRayVQhcE + oE3F2GS3O1Z93PFCUfh1MNxiq+x2ck04WnHD70jljLTybI+K2zrMn4lZ335B4jPS + XgEfw8FD7PHbZTt1XYfTfEUZov3LJlwD5s/9WFh/psVMWrUpx/k6tDMx4cS/swDB + rrnGM71osEScFL/up9arKVEbT+XkRuAsezJOMJzwGdPRD8ILgWg6tRy0sqOMm4A= + =Fclq + -----END PGP MESSAGE----- + fp: B52F407573A2F1A7CFEDC697EB5FE2B48557243C + unencrypted_suffix: _unencrypted + version: 3.7.1 diff --git a/shell.nix b/shell.nix index 2988d59e1f4e9cc7beb1d51eaf7deed770739800..b1b3aaed834b58e65b26d788d1f572f9c08eeaf8 100644 --- a/shell.nix +++ b/shell.nix @@ -6,5 +6,6 @@ pkgs.mkShell { buildInputs = with pkgs; [ (python3.withPackages(p: [p.sphinx p.recommonmark p.sphinx_rtd_theme])) niv + sops ]; }