Jean-Paul Calderone authored 3 years ago and Florian Sesser committed 3 years ago

This causes NixOS to generate the systemd timer unit for us and saves us
having to explain a lot of subtle systemd features.

It does pin execution to midnight on Monday but scaling to handle load spikes
is Let's Encrypt's problem, I guess.

Add ssh.nix to monitoring systems

See merge request privatestorage/PrivateStorageio!142

Monitoring: Set admin PW

See merge request privatestorage/PrivateStorageio!123

Fix deployment key whitespace

Closes #77

See merge request privatestorage/PrivateStorageio!138

This makes it easier to test outside of GitLab and it also means we don't
depend on whatever wacko shell settings we inherit from GitLab.

Use a new variable which actually holds a path

Closes #76

See merge request privatestorage/PrivateStorageio!136

Remove group and other permissions from the deploy key

Closes #75

See merge request privatestorage/PrivateStorageio!134

Propagate morph success/failure out of update-deployment

Closes #74

See merge request privatestorage/PrivateStorageio!132

Burn in some SSH host key knowledge

Closes #71

See merge request privatestorage/PrivateStorageio!130

Bounded NIX_PATH

Closes #72

See merge request privatestorage/PrivateStorageio!131

We can't point it at a Nix expression that evaluates to our desired version of
nixpkgs because certain consumers want it to be a filesystem path instead.

This is what we wanted and much more directly.  It also avoids the gradual
lengthening of the path by always setting the path to nixpkgs-2105 instead of
some derivative of whatever the path was last time.

This avoids a prompt at deploy time and the possibility of an MitM attack
against TOFU.

Various manually-tested fixes for the updater

Closes #70

See merge request privatestorage/PrivateStorageio!128

Use the GitLab-defined `CI_ENVIRONMENT_NAME`

Closes #69

See merge request privatestorage/PrivateStorageio!126

`name` does not exist.  I think the `environment` section of the configuration
tricked me.

Stop trying to hit a specific directory with mktemp

Closes #68

See merge request privatestorage/PrivateStorageio!124

Just use the configured temporary directory in the environment.  This is less
great but it's still okay because:

* It's our system
* The deploy key has limited capabilities

This commit does not change the semantics, only the looks.

Add GSuite SSO to Grafana

See merge request privatestorage/PrivateStorageio!120

At least it's easy to turn on

This is used in constructing the Google OAuth2 login callback URL and has to
match what's configured in Google - also helps if it is actually the address
of the server.

This should let it work for both enabled and disabled configurations