Skip to content

Commit e59fef1

Browse files
committed
monster: Fix auto-upgrade failing to fetch private ossystems-tools
1 parent 4b2dd09 commit e59fef1

3 files changed

Lines changed: 13 additions & 2 deletions

File tree

hosts/features/required/openssh.nix

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
}];
2020
};
2121

22+
programs.ssh.knownHosts."github.com".publicKey =
23+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
24+
2225
# Passwordless sudo when SSH'ing with keys
2326
security.pam.sshAgentAuth.enable = true;
2427
}

hosts/monster/github-runner.nix

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,15 @@ in
3333
sops = {
3434
defaultSopsFile = ../../secrets/monster.yaml;
3535
secrets.github-app-runner-private-key = { };
36+
secrets.ossystems-tools-deploy-key.mode = "0400";
3637
};
3738

39+
programs.ssh.extraConfig = ''
40+
Match host github.com user root
41+
IdentityFile ${config.sops.secrets.ossystems-tools-deploy-key.path}
42+
IdentitiesOnly yes
43+
'';
44+
3845
nix.settings = {
3946
trusted-users = runners;
4047
allowed-users = runners;

secrets/monster.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
github-app-runner-private-key: ENC[AES256_GCM,data:wZ9wDikQVRNbrDSzOTvLjkrGm2S5Lws3eR/rD3npNbXnhaD9yzZhUW0jFusaJDHkZM66klisltFptdErIbJl6/GisqwrJRU0BJdrjLOn75xykt/Er2upAkG+DzeIBXpa1E7UqIhQeZW7pdxmVuHvUfvVm9rPnrUBDA8oj1lneRQZ1dQoJZLQJ1z3hNgPsmDxFS8VWL3kLjZX6jNuawZj5sVpc9TsCpffR9TF3XoWR3bDhBni3ig+PLXg9zgd95Ezfa+PeWsLKUbCG9SmCs6Psh8AixnAosxvto9KPa2WH3Mn7+ayZtKk2IWr9y7gKdYLD+PxuHhZIUkSVrj6L4ljEE5uk4KSShzMCwj4IVw+bBm13HBrwqwLAp2Q2KLPdhQPP0orkySzfmAqNjGZXP6oHaVzzn8CC7jZD8100hMtS7twGyNYlThwqZVhXB4akkiA0ql8wYYKwOKwAAyenqpAKb9YduLdfCxkwEGfWdOvDIdc6W6PO55K18ybpX8k5P8XLwxWhI+azwSSnB5wMIUI56WP8w3QJKcNwUUdMGmGqjjrfz7YTbAB7P9Gy5IC8pkEUESWpxDo5l7AaPifXr7FMke/mkJDRxhxdc3d+BmOup4B56AWNcZt7La6r7Cg0KUAE7/3CdVjwyiRocA+HUwXxwCCDMOTC9MsYC4fYSlR3TUVhiY7gQcXXGCmRoFbSFysH+K/TXV0dEdEup8RgHBiqsASHl63fx7ov5zuPgmAkNLjxC1pNg1OpZPGL0k2LpQQy8r4kZ52+6LNBpN2rrfOkMccdhsKVTibRa+7lOGS1uGf9oKxOOkqmJWInfsEwdQ6z8HZtOnv1qAMuT1tDL760q3c6acQiWOsc+vsRu6m/Z6dRg8oR5b4IKSWUblvcYk28fS/i1abRdwHCaw3zW6MtkB8hCCx2yX219zUy8cLMvaITHpAf3SES+0+jktZwBRCh78douVBr+XXM1Ag7NvEyLEWzDKKzqrr6qtzQ97Yq18RYRjzMzrr2tsvx4OxeDl1Zf5Xh9islLy2ilxLDq7pl2tOzQ8s3F51xsIul1TnFlWye/308TZL1EvnMtsBoHix2lh50K+He5To846PIw9Q2w6PQA3rbCDc75dZNw0BpRPt430jGKoBAovYePLO9jTbsp7LSWtVTngrEGNxPCHiL9G7zEzNC50ZiFDv+lmh5nIytxC8AF5/utJbY+3NY76u3LPwijDawt0G7BpnMb+P0+2WVD1foPsiwQfIjgOtO1IU4rVYReoEbeR5y+gW6LWypMBW8r6g6YZAX/ypo2yTUfFLdoReSDkl+fJi3O+T/Yms/+EuANCsKtM8XenF0m45LrXC4G/c+M1rNdsuIG9/ic4KyNSbFAvHOdhHuTeiH3xpoyl2CRVEeLOKdhoFnoZbiTb56qiUoyf2qeBF5F5X1Yg5STYKFIy75O5dfs+GjDFyL4Fblsg6PO0C2mlB4YU4EjxR+W3uWnLA7PT5jiMBZKZSxCsHAAA36VI7Nt+/rwt+SDrV/wSv4SXGEHe0RcD951MBwgfqD6FP4ucBq0IBy6j4IP806XsfoMnhJ31doexltwUt7iT8kHXRinJL/5R5flc0f+S/5sV08gp5APsCBiKjrX4hFaWXc/P4Yrl1Wsk518SDF1uKEDw4PA3r3rKFZYbvEDCzCeK5hwy11dFd8c4wkL9HT4PlIItcUo2U5sDul5Hw77h0thfGYn6d3VoIsUssk7FVzBL+yDk4nD1wyYHeA7SN255ERZVAFbRA1VEYhA3NCgz/lxI3W0lbW+NsU+lo9hwwlMUYyC11Sce9ORX+/WDyWt+yrVU+ZxzyiSoB+KD48Reu2XKxuQoD6ydieWFvxjZxPKH1KpdntJNNjZ0M54QupSQgJ1x4TWt+8Zp3u+l0wFP8y6Yd6JHkG1qjdYtYe0lFYq1n20jqdIL9xBX98DXrx3aGBxgCrLWZ1mJiReyl8CbyF/OuARvdfkYbDg9TPQz8+jEgrkdl7Vuwxp837/6jnFd63pzfjIYANCWU88F8xHlT/EyTXrZ2ETpT6wCwJlS76mA0uOpCfCPte9mBHJYu/Vxu1vr5hkJZjHpCNQTg15hclT2mKSrp4TBl3k09gUMVZMmUn9BBbEt0sryw8WAngAEew9Iqu/3lkczMdOjm0GGuzn2A4gnTaZrqaT6z+zREZ1RU1yTZMR0SEw3A3Aax5+QBxFpgfqVbGxLvQvZWE/urCGwwHQ==,iv:E+1MB2DKD3HLkja3edO8tlFqE2hNabsZY+NIKa4mvSc=,tag:qJpF1UII7N64iXSXxyh8Tg==,type:str]
2+
ossystems-tools-deploy-key: ENC[AES256_GCM,data:I4VpaJkxR32r/snNeqMnsrIeJMM8Wq9FlB0xz7bHg59JdMA/2/kwIqem8NHF58oyBV2xsQiEPYxrL/hsEfiVhpQ5fKX8HNFn7OecIJ7McNkvsvim0qZ+t97HGmpb1kEKHljO5p0fS6F3OT87cF+VLvkUZX2hJUzLjBkq+AKW19ju8UaMdZ3h0lspXi84oDx3LuKUkL1VwR8OkaEGty01hDf8AMhQoNMwxKa5P1r+xserWl9f3DFZRUZQUDdJhhgu2ZJ2MhMqgC3v2yAyEtr1kx/PCA0ZI+3BnO7NImqkoURDVoXnbHDKO599fR0Z8SQ15xQDa0Rfh/qu0Y5xgaF2j5N8R4Y2wpelbsk6PwcMW0IlsjwqTQFWXe2Gxnc7t7W36CIm3jIwSEME9Jv6LXSCsZlGw4vl0ZdPYEWiFuOSu3x45qFdoUqAMejyunnW1hySl8GzbXaVuEYeLK2p3mjDtLLlF86lBM2yn+X7tYqsdYhJmZuF8PCdwwCJTgD94MRxTePk/eIDlGQ2ZkstdS2K,iv:Jf/myFTYVrXR4bglCEP0wL1+ob/49PRuWAA+n7Wnius=,tag:3xmobdxCC54FN8R2D+bIDQ==,type:str]
23
sops:
34
age:
45
- enc: |
@@ -19,7 +20,7 @@ sops:
1920
6tPKNC4bylq+F/No0clc5WyKhIZIrPI6n0bFuwUMvUEeI1I+C9zwQg==
2021
-----END AGE ENCRYPTED FILE-----
2122
recipient: age1c2xa8fmslcl4k6mc3gcn7kpc7z6x58fqseuy8g2qdgv9r3w3j3qqlmj3l7
22-
lastmodified: "2026-06-17T12:53:53Z"
23-
mac: ENC[AES256_GCM,data:joa8CoMYSnbe/niIU3gZoOnXQBVoJvA3nncZJ7wV3yRY0nHrZmXvdx+EhIWURpjhq8h4macgKctH7a0DgScQQDeI+f06WgRUO0NX8neEJWgL/y33op/Nbr8KHUnjzdm2PIr6K+EhQxEvhTbAG+eNDeWPHd75QYEQAhLkBPeUmGw=,iv:P/7mKg+ezdODJHmtiyHFXNirZ9Ft8YUOnMqdppHKX+Q=,tag:tc4q6ZJyGnWzaCOHEv+GGw==,type:str]
23+
lastmodified: "2026-06-17T18:47:10Z"
24+
mac: ENC[AES256_GCM,data:8cMg6cWH0FKKvoPWD/RoYszllTmfj+G8bRySQ7g+uWhew6mBgSOxBEMDKb88N/MPUdhImLyPJoh4Z018yguv7YWDKYy4y0UDXBhFrnv9C/2XQTPr5LguKRmmUpJLjU5HJ/MHAS7ovSgAg/ZMu1P7TDCJtjwTz6S7gMoRU4z6T3Q=,iv:zXxW0oPYLRDC111DzVAOWOJXswPMtcZTkKN5cLvECIw=,tag:wRJTdOzShIt5jXtVOsH4UA==,type:str]
2425
unencrypted_suffix: _unencrypted
2526
version: 3.13.1

0 commit comments

Comments
 (0)