diff --git a/non-critical-infra/hosts/staging-hydra/hydra.nix b/non-critical-infra/hosts/staging-hydra/hydra.nix index 3c5be205..961d51a5 100644 --- a/non-critical-infra/hosts/staging-hydra/hydra.nix +++ b/non-critical-infra/hosts/staging-hydra/hydra.nix @@ -39,6 +39,11 @@ in format = "binary"; owner = config.systemd.services.hydra-queue-runner.serviceConfig.User; }; + signing-key-2 = { + sopsFile = ../../secrets/signing-key-2.staging-hydra; + format = "binary"; + owner = config.systemd.services.hydra-queue-runner.serviceConfig.User; + }; hydra-aws-credentials = { sopsFile = ../../secrets/hydra-aws-credentials.staging-hydra; format = "binary"; @@ -64,7 +69,7 @@ in extraConfig = '' max_servers 30 - store_uri = s3://nix-cache-staging?secret-key=${config.sops.secrets.signing-key.path}&ls-compression=br&log-compression=br + store_uri = s3://nix-cache-staging?secret-key=${config.sops.secrets.signing-key.path}&secret-key=${config.sops.secrets.signing-key-2.path}&ls-compression=br&log-compression=br server_store_uri = https://cache-staging.nixos.org?local-nar-cache=${narCache} binary_cache_public_uri = https://cache-staging.nixos.org diff --git a/non-critical-infra/secrets/signing-key-2.staging-hydra b/non-critical-infra/secrets/signing-key-2.staging-hydra new file mode 100644 index 00000000..1efea99b --- /dev/null +++ b/non-critical-infra/secrets/signing-key-2.staging-hydra @@ -0,0 +1,35 @@ +{ + "data": "ENC[AES256_GCM,data:+OyGSbJB66gkadKm4yxQJIxLyMTSx5iKrmkgj8RxSfPRE0VpMdWfbo8BSD2tR2zeXkAb7jFLpwzArWDtUe2JB5icSkVBZsSHdD/L+1nmDeh2A/MHRqLXg4ewuD2OyI5z/hrZ59mTQg9E9TAV2mLSBuD0jjM4QvAh30RlxluY1/I=,iv:UOm2+DnUO87vVKe/GK5ZVenLjmZ+YoCxP+PoDyu4EE8=,tag:YuVaVIzXLyqEPg3bK6Uhqg==,type:str]", + "sops": { + "age": [ + { + "recipient": "age1xj4dl6xdl5ztmetp9axa0epjj922hu6a2gut3rrs5rdc5xv85yjsq5ggpx", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVTdVYXJrYUpqRDE1OUlD\nRkV3VTFLQzZMbGFuNVZpbnp2blV1blJKVTNVCmxvZ0RxUlpST29kaE02UUhYOC9z\ndzA3SVlodTdnSmRQdU9WNUdmZ2YzZTAKLS0tIDZ5N0VGdW5GYjFoY3hYc1dFTU50\nNytHZTRhKzRYSDE1dmxUajBlcm5VQ1kKZu1azUS0YQH2NwbrkyGxzxP2h+9dfTmo\nTB1/kiqXVVjNiJBaGQUoWQ5jYgvB446MV0DnoMbveQGgts1G94vSuA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHblVDaThSVDI3bWxhT1Aw\nSXdLRzRQdzRwRUlGdEVPMTBOSnowYmlIVjNnCmxySVFyL2FjaVZCVzNNY3J3Z0xC\nTHJvanBtb0dCTmY1L0VkaW5odk5HN1UKLS0tIFlMOTVSL1YyQTFGN24zd05LUXlH\nbGt2S2pnZjNjQW9NU0hSVFJUSDZBa2MK/THSW5Lsan7K76XIxjbog7vT0VDe4dzM\nYKSWKuClmVihU2Pp6+He+bVa6/y9e9aVLtpZAm68jup6PMVYP1znbg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlN29QMDdNZUJSaExNbllh\nd3JlM1MrbFEwSm01bytscGhSa2FYRjhrclFrCllWdi94RFR3WU5uUWlOVFdoU0hy\nL2ZaemRsampqUjIrVWc5eDFkL2RZcVkKLS0tIDRkUCtpTGFvVTZXTkJma0VOS1BB\nRzFLVk1GQ29KejBuQkpNZDZrT2FNa1EKKEIBflHfRwkGt8bs+sLO3f5ORCrJayMX\ngfJTfhDdiM60+HbB717UsmROvv0gaWdNXZziohF2s7lv1IUgTxKDCQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMTVBK00rV0RpRmR1RHVk\nZkVUbG1WYWhWcXhLMkE4RVpPMUc1QUprODFFCnZwcUV1cnJwRjMzdnliZklPbm13\ncTd1L3hLQlYvUUN6bmJoSTROYzR3eWcKLS0tIEd0cy9GaHNCRjNhK1c4cVQvR1I3\nclF4eHJoRGtDeXdLVFVQQWg0U2QwUXcKr+1kGWmxZgy/2OyuB1p8OsfTHCqN6gE6\nzBPjOHFaSkNlR5Tj4LyWD3p0SPruLN6gv6J4C4nSTvx8540yWSYgxw==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtS2tGd0pzcWJBL2Fzb1FC\naExIMnZRSWRpNThwQk51SGdpVE9TeFMrM1VZCjN0bVZiQkxSZW5wSlVKdVU3WkRU\nU2dMV25zVk9pVVVpQ24rRnd2SU1PdG8KLS0tIHZVay84aVQyaWtxQXY1U2JEWnRm\nVlVSRDJVL0FaL2JzMElxdDJ6cDd4L0EKdDbZeubhEBpcmBGQaUdnh1mxZ7uacyOn\nnpUb3NE+8MEVC3NCqRZblsqjbaQQneXvKCRFrSGLR0IP34ciqaQ8tw==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZEJkazdXODJ0aDQ5d09m\nZHRtVGZaeUJoMmxHWHlvQThNQlpTUXF1ZEZNCkRRUG8weXR5Vm16NzlGM1V0MUZD\nUUFZMFYzYWRvOEliZzdTNlkxbk94d1kKLS0tIEJDdFJYUHM3Y1F6dmRwV0FGOGtj\ncWtmZ3BXNURvZ25nU2N5RXVCSGdtcEEKIojh950vtjxU1/muCzoPhAeO6ISpVogR\nWNBTg2+6w8w8P8Ds4XyEVfYeTI2cAcOpNMuWiCuQslk8UIoRlNx8sQ==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-08-08T17:05:25Z", + "mac": "ENC[AES256_GCM,data:rlFOHtGSBfgl68CjQKmlBEJT5IwInTD1WhJrBr3qiFuvOv8S1o1OMYRKHejU6qKxOfTagR2j0koSDbvM2+hGb0S/HRWCl4/tQNLMrCmwxES0a1oADcwpclgE5KtjUIKsYHOxhKSnuFBWiT17jHKz3Tsx7VboSj8cpHof+Xby5rY=,iv:mQGoOMUFj3NGI7JI0RB+Cs0FYEglZSGJJDDTYyOPhDc=,tag:Xytm/xhrn8AaQhxDLX6Gxw==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.10.2" + } +}