From 94db95787b89920bde2e9d1cea8cf9dc1f327c08 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 6 Sep 2026 12:38:48 -0600 Subject: [PATCH 1/2] chore: adding warp secrets --- secrets/secrets.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 597850b..db1e0ef 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -21,14 +21,16 @@ www_aws_secret_access_key: ENC[AES256_GCM,data:x7YarHj9pKPiYHM04xkaU+fACjoOmM7ea cloudflare_zone_id: ENC[AES256_GCM,data:6RjS806r2iMX9dfWBJeLIG54jRu3DhylNP7QOmrOVWc=,iv:picCNDWPduEMzqcm3gh7oRaGEs+4n2E/P91EGC/3iDs=,tag:9G/KG68JLu/rxI+fLpQQ7Q==,type:str] cloudflare_api_token: ENC[AES256_GCM,data:z5WDjwxFZ7VaufG17WciwbbOVQlaZP+OSGOkRCTJQJAPxZCv8pHc6Q==,iv:jiUky+4sIka3Kkw4JcteY2eoj8uzSwsMAREamseJ/Vo=,tag:ChGagBsNZKUVka6rlcB/FQ==,type:str] grafana_alerts_token: ENC[AES256_GCM,data:DHykbs4ifLhkmbrh9DdBO0oyjEGCjdxoaWa6juRyWQIWbtNkedYgWQ8LorZ6HQ==,iv:/dvVgkKmSp5sY/UlH+mPpF5v7HRDjgG1ok3tAW81niY=,tag:UaZyqVrWQW997/6jxqjD/A==,type:str] -chart_updater_github_app_private_key: ENC[AES256_GCM,data:CV7MpqKba+ULKxRlgXhTBN20m1jFrxcqDWq/QSi6/UbRrYqNwn0yL/1D2NMNDnbsOT/YH8dvr2IEGsd+2nl9x7Rc5RCjd6diviiXUCXt+WYnfjcRpruJ9JhfLnjRY0EnOrmM7aGR6DYk13SGg8sxTTAYt4TRHB8CV2hgAE9sEAztFwv0fizKXIPb9IVUOGNOO/bYquTbI3QnE1anubfZ3fb30iUOhWlt5WqtF37v+cy9CZQpUw9nYVloC/IoMfBp0ciBvkCaYKHt5WIlxbPY7+QxEIzZvR8+svdHGzlO4D2xZusN2Q2FRtYdeTNXUZU9jqqvjfOPRJUZgzZ5ivLVaMEQuhm8fuZfmYTd1rO6PKvEqIZeuYaFww/CnfQurYakSINsvgGzhzb317qdQuv9gicsn9W+tTS8imoBLBiExMDZaS35/R0QzJyDGk/ABtepy106VtyXtsTKbBnXmydcC7duqMHnzumgWSoGjHsjta+/YuF4xY3iGLb80BLzwP8af3vC3DmWuBOAZW+WvLe/dsEEa9xUO19riSj/sZfZIgB1zroVNAai0JgpKv3RkSUM+Tsd4SHrOYpfTC343FSQYUoSjMHBCt7CwRldds96TG9q3z76MIuYyC2buoZCGxk9bQxDKODSYpsHdp0iv80lXgnISaX5MgSWSKl/6cuugAz0DB/RP/Kf6kIJAdWf33sc5Ov/HNufb9ep5QhT0SQ6Q0vttXfAzZbz8+S8ymFUHP9AXQdfu2hJpNnUrjnGAlfSTBwPi8kCQ3vQTR2QQmJFLrRTNyfVCcn1DqZfPhSRf/FqXt8UDJe3W1sj9WE1THw45wOvxJwfbjw8bgEEtVMQFMJL00auszt5LQPXF+vd0rCegcKQBrnn+JHxrRtSaJMl2T+WCD6QO7tR+Z7ePnezwXGf7bT95/PBgEvMWWXzXCiPMQiw3ZeDfpfVHSikhb85hc6UA3Plkhisbf/2tN32UH0DirtvPrh3ztDYBQMARWfzUtvpqCy2iBLC61o5AaVhmy24qNgyBcG1AfNBMfHlS6/sboK95fcFsvSBGjyzex6UvCcwcxpUfE8u1ofPrqgPXhcA3WTtNgADW3MdLFie3TO9A9xTT9Bt8/kFR15A/EVp7WmEABvAEfCXTz5oxXw1aHTE8SQhxpinCoORqpV9wF8gNyI3PGcQTVu8VOOT/1OCqPHOpO62rDU4VLoK5RgHSq0UCxoX+SYHL1oh6XdiaE+S5NTcXjwABxvqczO/bmLn4BCfmmwTiF5rs0pVdKqaPrdF61rUSG5cC8i3z6W9/p3Oegu1G+Fcvx0OmEZ0gR4eCDvOyBFnM1ggaC2UWadHN5HfQXDoELQiJGy5xXqU01z3F3MSI+t93JmU0dVaXYSy+PtcnZvkylCGUKWxw04NBAd+n6e4fqY7BDRzakG9h7IPHv1Sil1s0yXev13IIzhpgUjC56KhpRrVVOGJtOUVtHF+VTWjMiLppDfOuC6aclTvg3ueRYp3V/Zhx3CrzPKX4V1YuoNWfhIdGEuyi6GRwKNV5vbOSsDHnt6IsRC50hwkCKRiYQeAglzFWY7UxTfDKAsYDK7R0RZgn1XfuoXUlOAyj2UL98M3mnhDHB+DIy9s7Q9Rv3phjDM/q8OeqDw/tQkBdwt2Wu5zdZ2URjpLe0b/DGjdafcEl/jgjKO4Rfw33kzIX6AAiv9IQksozXbWvDTK54x7Sf+Q911hJBbGRqYl0vX39iRUEB6Mj/D2K6IaQUA+yA78Y21cpum0rL4N7p459xIJJIjqIXMx1WhMQt7WnW2xtg2FXxjPI1zSjgxh6q4Kj/IWcOLvPNQu11lOyBQ2p7aqAYLp4BcIWurfjbwjBuHoZAi7r5kHsaj3+FXjcWw4X5PtNZRVnL73LvpFMuoRH5/ztSSCeI0pW79gR5f6x62hLnfZPzRHPVdCEG2Y8Jy4E5P8tdMRfBqcgnIH//MCd8re9aCgL+xV8HSM8tW+hv3okYFDKJ1eWBti/ZtRbMRmHeolFXMFG+mqGLD1XLn4nCEyOKuGNIbDRlMDZEx7CIopB4JhNXAYtSTM8hAS49JGvGhXatnv3Qtyj3Sp66Ein79G+3cGt4EHrTiEV0Qy6/SkViEUPEv8bL17CvZvKClDaPvDbkZWMfUJhRYgeOIF90c8aWKb2b0L7q0QKn9l9fGLcu8v685Z3FDB+xlJXq2gYmLiijtc5i85uN4MnK1NypeyBpEqAVg=,iv:rHIlw8HFt1kfB7QOquldanTFxyBl0WqQjk2bcz0uvjw=,tag:qQUrUAJsCeznddRNILw4VA==,type:str] +chart_updater_github_app_private_key: ENC[AES256_GCM,data:b69qf4/43bmB+49zUKLT5cfpcJfOop09QycZSl779scbgs1xMlYYzV825q2E3yGHuJAzFY1+Mf/Xl3Lf2BgGdZ8H60Cg87SnIRFjsFSyLpq3/pCYwtrL+LBf5v5PxdsLITUbh/SqOO0YQNDbbfREMbeHvZFv05kAAWy5mfM8CT7n3uIscV87YNN+bRVubPjGKjGQcACHqTUV8r8Mb2buExCJYxeg3IOEjzMiPGniEfsiQqnfCsGVYWiqirGasF/24Tp6nt2REgvMjQFX+Eem5aGhUB8Lsgvydy8N2wTarTYBQK/v7/iOUngoQGcWDTZAztOX3xu6/R0ubrZBYjbNnKc2pHxPcR58Nh0bKjHtMQRtq+AsdbPsGPO4X0EOGJGjPrMY3oQ3zizgFdvy+T7yykkxBIPNhkrWg1PKHFmvZte75+5v2u/4vE4KU3wOa/HChditJKx1cYznnKAv2H1bNdwCn7Fymx5Ud0ehZqoLIOuzqHD8/fQ3TWbrr3kAE49x/eG+XQu128ogxbcI1mPIx+VYu9Ew98g4fLLByUs7FmYLSOSh2gZzfsA3oU+PrB6/KF0iF440IgHciR5xcxJEJxa4xpazjSQNrH0GBo5+mnOJI7+FzoJQbjUdUYBwlbSQLjnZzCaun00sKTIRoL2aaYwTBb2qAqCqBc94oQczg2Kj2EB3AaA1wJqBkDnnqxSc+XuHe+XBueSPL8oYB1c1V8frilftbA9fNBTh8rsB80WGvD37tBTQosqLVVEIcOht0SGSdpwz+hzhgKKNTLwJ1npx43Z2oBadQHuRWVGNQ6iajqw872bo+AwUbwpv97M2Xou6D3imaYvsFdg2fiw3Fp3H+iJwKdpmjy7kJYAlYQSfwqzHiowzmxSv7Sm+Jt05/EEvAUQ67ECsRRro1WX3MRYpXBbemL6gea9Wn4vsYhPdz5lx3EMSLBM5jYIEDTo5wswwd6sP9xZmWuHh/4EzJdb1MCQLRJKc19EPZcenNpaoxsqb4pyarTPy+/jPvLM4kOPJp7P5CvfgGLB+DiNwnqBjXj2QbkbPSc7h+o6pL6bP5QI5Tc9tut3K6hr9OqtqU7gJc/VhMWQEtjpbjnaN/3WS44jRKmM3wbmzQSQHQ2YaESoxG1qBtmkTi94TUY85QAH+3VEI6DUfWglMOm2IRMZ1Q8raFDjGPmyfitubh5XjggZJCW+ZHUNFBPIpnmXECH4TDm5SNzvdNH/S6twG2NxluZPAg4Si92t8Mlw36sRFLv153GLGR0Z+0Cm2Tq26oyMlj2eA36Q4Gs3Rpjx+KVe9ZV/4EN3BbPNZnxRzX+fdoGga9VlY9LYnWvoyAuNjZjQI/4e1dwtMDX/cLJrw88/CqbV7atr0F+eQnQedMi/+3hsPLk0EC9OtY45F+D8cb4tdegTb6qA9qb/WeSwDcKOWVf8MhEIikinBK0GFgiZb5If/6dx3QlouKCKslXksUceSo2hVrGYe88eiEVJmnzf1RO66UOFVy9wef6p7sJwK8gWyZGkryXrlff0xcXXTyffwIRAWMZ4avALiQ3kHfcIkES6b64vvkbjY5gzJ4DwptR/b6QuDHhJoUsW2g+dTI6i0B2Hr438785aqY9zHYElT3HSyPTvC42UMTHWI5VSWRsqh39CQH5SFUWljXn/tWWMQk8E/huC2S7BCfnV40N5/zcYf6EzIJzVttL5RDXJD5r0+coWrVC26E1yVq6Y+wxo7tBKIrbV8JuHsRDb6eVicu7WkHW0awkEwY+AZz/PAD7+/la17PU7HVsOK98dWNXNsKpibUJUAMX2FDOIw52F7im+wDP3bsNg39PBy0SW6no/6b7WdQ/NnNvK/n1hs1rn3VjpFbZVjqhCasJ1vJxt7friZxa2V9+ISJB/dggmC/1gAhr31ze4mq/kout/gItH+MIwRLMqC1Sxjjkc7T2dSfmLDJuX0ZJMTgkoRwfK4+zglejJgycmcdAilMH7R9/njWhBaT7hM5L1ObgGIPlsSzBBU/GFJtVIdAqXAX6svngEBN03Iubq+i1y90XUlT+pR7kjAwg3jWp+pZWj6CJ5R7FLJa6hdWXq6z7GhCqbP3QfkgojULxnC4VQvdL3wSa3lm+l4/Gvg6oHtugzkM+QitDqiYCexIvj2oDwZpsON47aqOUOvhBzSnL7YuB5Bdb/mJpEvKAk297Vb2E+9D8nhFM8IWGocmJzc1OY1pY9j3+PttJBTA9yIRw==,iv:nQLiNXrGvA0OWAwCbK28ROO89G5P0iSCEoleiO2t43Q=,tag:bw5SUpp2F27lvhpkhER2nA==,type:str] +hero_host_config_warp_client_id: ENC[AES256_GCM,data:Cex0qIJNi7it39l09KKDFpuMnBKmclSBI64e2iUxlcbO6SOvU9wq,iv:RgUcLYVf7pb1xs2nOQFWvFYxpJyR7jZKhQ6FFDm6eBw=,tag:Nm+7bXBtCJ045YF+J+93qQ==,type:str] +hero_host_config_warp_client_secret: ENC[AES256_GCM,data:yDuZ1luBLS9TmVOi87Qeo+JJqwyinkzBo/4wqeyf9injCmNWfiJGtqLwpMCZey1xC3bw7MQI,iv:n3SwdPG+W6le11MCsr3qghofFu3Af++oSuHC+SVc5Qs=,tag:LrB9xxkmii7n0QNZe4SI/A==,type:str] sops: kms: - arn: arn:aws:kms:us-west-2:332355796717:key/0a45c0f6-71dc-4d54-ab33-9df4de1a9e91 - aws_profile: "" created_at: "2026-06-19T04:16:52Z" enc: AQICAHj1IggLFhM4nJnKEvmbEpk5E9RxZZoxpZYUW0taoyrz1AF/kg94UKFDzajWL4wI8KwkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmVOJEF56prSE5mcxAgEQgDt27+5rh3R0yvgpohI7YEEeZqxAJQiRdIomE22ohFcv2WGRfPXvbh43PlSwUAekZwmkLMM440d0Pu8zcA== - lastmodified: "2026-08-28T16:19:07Z" - mac: ENC[AES256_GCM,data:Yk3ybYzzstQKIcjJ4HbXX9f4/jKIEK2MFQBpWXOakxaq0ks4MUEenG6kReVSW3BVBxWUx7p1bMRZCKXdWqEgbPtnhre/Q2m6dEtcaUFz+jOIrGaPh+uY/fnNI4Y3Riop4uWt+CE26g2DBhz2hHpBslin1nrK8qe0FFe10RHwCzo=,iv:/eCJMebA31rSJ6UcA6ZvbNHZ557KsckK49mh4hx+KVg=,tag:5/ksHm5Qe/eV3UbznV7yrg==,type:str] + aws_profile: "" + lastmodified: "2026-09-06T18:38:42Z" + mac: ENC[AES256_GCM,data:j06FfXjWO0tbuuU9h4QnU8ljyyHlJvqRHSonFjsubzbarwW1ZHYDKBTYLDKICWMUYR1JcILNegIbi1+umgf2kgf14hjcRs/nkD8eNuWYJzYe+Epzj0twmAQd9cx+Wk7Hd2EnrBLhOJfTtv+fXAcYVcxOXGlVpc+4WZuUkRwvi+E=,iv:VDi1tL+DzWW+MI2bjvhyT7kQFZn8S0O/nBYlXSXGsQo=,tag:/UT2nMq5dAZ5ftE3XC4RbA==,type:str] unencrypted_suffix: _unencrypted version: 3.13.3 From b0e7b7c3484ebd6ba0335debc49c887e01912c43 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sun, 6 Sep 2026 12:42:12 -0600 Subject: [PATCH 2/2] feat: distribute Hero WARP enrollment secrets --- main.tf | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/main.tf b/main.tf index a322677..b3fccc8 100644 --- a/main.tf +++ b/main.tf @@ -49,11 +49,11 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "sops", "tfstate", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "s3-backend", "sops", "tfstate", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] - "tfroot-twilio" = ["opentofu", "s3-backend", "sms", "sops", "twilio"] + "tfroot-twilio" = ["opentofu", "s3-backend", "sops", "twilio"] "www" = ["css", "html", "pwa", "s3", "static-site"] } # Public repositories remain on the relaxed profile only until their initial @@ -156,6 +156,16 @@ locals { value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] repositories = setsubtract(local.active_github_repositories, toset(["channel-project", "hero-host-config"])) } + "hero_host_config_warp_client_id" = { + name = "HERO_HOST_CONFIG_WARP_CLIENT_ID" + value = data.sops_file.secret_vars.data["hero_host_config_warp_client_id"] + repositories = ["hero-host-config"] + } + "hero_host_config_warp_client_secret" = { + name = "HERO_HOST_CONFIG_WARP_CLIENT_SECRET" + value = data.sops_file.secret_vars.data["hero_host_config_warp_client_secret"] + repositories = ["hero-host-config"] + } "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY" value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"]