refs privatestorageops#416, PrivateStorageio#115

This reverts commit c8a13555.

Sadly, Borg says this is not a good idea: https://borgbackup.readthedocs.io/en/stable/faq.html#can-i-backup-from-multiple-servers-into-a-single-repository

Spoiler:  This won't work, Borg does not guarantee consistency with
parallel writers to the same repo as I now found out.

It's not really a key, and not really public, but not secret either.
This way, the tests can run.

... and fix that option the other commit introduced

If I understand the behavior current Prometheus and Grafana
correctly, this should remove the port number from the
paymentserver labels in Prometheus TDSB.

Older versions of nixpkgs allowed you to specify multiple keys by having
newline separated keys in your string. However, this worked essentially by
accident, and is now explictly disallowed.

I noticed this because I had configured multiple keys for the local grid.  This
isn't currently impacting my ability to work, but it seems like a worthwhile
improvement anyway. This will be necessary (for example) if/when multiple people are
given root access to our storage nodes.

So perhaps it is impossible for anyone to approach the payment server from
these other domains now.

Mostly though I want to force CI to run because whetstone is not currently
showing the pipeline status for this MR...

Florian Sesser authored 3 years ago and Jean-Paul Calderone committed 3 years ago

... just because I like to be consistent.

Florian Sesser authored 3 years ago and Jean-Paul Calderone committed 3 years ago

... to make private.storage the default above privatestorage.io.
Before this the privatestorage.io could be seen in the TLS cert.

For some reason this had eluded my earlier grepping.

The VirtualBox documentation says this is the network to use for host-only
networking.

Copy everything from how the issuer does it.

As per our discussion in PrivateStorage sync meeting today.

The Blackbox exporter can be used to check whether some services do answer;
We'll use it for our HTTPS endpoints.
Especially handy is it's checking for TLS cert expiry.

Epiphany: Systemd reads more than a single environment file. This
lets me improve the file naming much.