infra
/
tf
2
0
Fork 0
Code Pull Requests Activity

notes on onboarding new people

This commit is contained in:
Jan Koppe 2024-01-25 19:38:03 +01:00
parent f4eba46876
commit 429cbbf5ec
Signed by: thunfisch
GPG Key ID: BE935B0735A2129B
2 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
README.md
View File

@ -51,13 +51,13 @@ Check, double-check and triple-check the changes that Terraform wants to apply.
This project uses [pre-commit](https://pre-commit.com/) to automatically run some checks before commiting changes. Run `pre-commit install` to install the git hook. Now, pre-commit will run automatically before every commit, hopefully preventing you from commiting stupid things. This project uses [pre-commit](https://pre-commit.com/) to automatically run some checks before commiting changes. Run `pre-commit install` to install the git hook. Now, pre-commit will run automatically before every commit, hopefully preventing you from commiting stupid things.
### Secrets ## Secrets
Secrets are encrypted using [sops](https://github.com/getsops/sops) and [age](https://github.com/FiloSottile/age). The public keys for the age encryption are stored in the repository, so that anyone can encrypt secrets for the repository. Your private key is stored in your password manager and is only available to you. Secrets are encrypted using [sops](https://github.com/getsops/sops) and [age](https://github.com/FiloSottile/age). The public keys for the age encryption are stored in the repository, so that anyone can encrypt secrets for the repository. Your private key is stored in your password manager and is only available to you.
If you want to roll out changes to the actual infrastructure, you need to be able to decrypt the secrets. To do so, your private key needs to be used as a recipient for the age encryption by someone that previously had access to the secrets. If you don't have access to the secrets, ask someone who does. If you don't know who that is, you probably shouldn't be rolling out changes to the infrastructure. If you want to roll out changes to the actual infrastructure, you need to be able to decrypt the secrets. To do so, your private key needs to be used as a recipient for the age encryption by someone that previously had access to the secrets. If you don't have access to the secrets, ask someone who does. If you don't know who that is, you probably shouldn't be rolling out changes to the infrastructure.
#### Decrypting Secrets ### Decrypting Secrets
To be able to decrypt secrets, sops needs to know where your private key is stored. This is done by setting the `SOPS_AGE_KEY_FILE` environment variable to the path of your private key or passing it directly by setting the `SOPS_AGE_KEY` environment variable. To be able to decrypt secrets, sops needs to know where your private key is stored. This is done by setting the `SOPS_AGE_KEY_FILE` environment variable to the path of your private key or passing it directly by setting the `SOPS_AGE_KEY` environment variable.
@ -69,7 +69,7 @@ sops --decrypt stuff.enc.yaml > stuff.yaml
Terraform is using the [carlpett/sops](https://registry.terraform.io/providers/carlpett/sops/latest/docs) provider to decrypt secrets. This provider is configured to use these environment variables, so you don't need to do anything else. Terraform is using the [carlpett/sops](https://registry.terraform.io/providers/carlpett/sops/latest/docs) provider to decrypt secrets. This provider is configured to use these environment variables, so you don't need to do anything else.
#### Encrypting Secrets ### Encrypting Secrets
To encrypt secrets, you need to have the public keys of the recipients. These are stored in the repository, so you can just use them. The public keys are stored in the `sops-age-recipients.txt` file. To encrypt a secret, load the public keys from this file to your `SOPS_AGE_RECIPIENTS` environment variable and then use sops to encrypt the secret. To encrypt secrets, you need to have the public keys of the recipients. These are stored in the repository, so you can just use them. The public keys are stored in the `sops-age-recipients.txt` file. To encrypt a secret, load the public keys from this file to your `SOPS_AGE_RECIPIENTS` environment variable and then use sops to encrypt the secret.
@ -78,6 +78,20 @@ export SOPS_AGE_RECIPIENTS="$(cat sops-age-recipients.txt)"
sops --encrypt stuff.yaml > stuff.enc.yaml sops --encrypt stuff.yaml > stuff.enc.yaml
``` ```
#### Modifying Secrets ### Modifying Secrets
To modify secrets, run `sops stuff.enc.yaml` and edit the file with your default `$EDITOR`. When you save the file, sops will automatically decrypt and re-encrypt the file. Alternatively, you can also use `sops --decrypt stuff.enc.yaml > stuff.yaml` to decrypt the file and then edit it. When you're done, use `sops --encrypt stuff.yaml > stuff.enc.yaml` to re-encrypt the file. Make sure to remove the unencrypted file afterwards. To modify secrets, run `sops stuff.enc.yaml` and edit the file with your default `$EDITOR`. When you save the file, sops will automatically decrypt and re-encrypt the file. Alternatively, you can also use `sops --decrypt stuff.enc.yaml > stuff.yaml` to decrypt the file and then edit it. When you're done, use `sops --encrypt stuff.yaml > stuff.enc.yaml` to re-encrypt the file. Make sure to remove the unencrypted file afterwards.
## Onboarding new people
Onboarding new people mostly requires setting up access to the encrypted files and the server. Before onboarding new people, make sure that they are kind of trustworthy and that they know what they are doing. The tools used here and Linux systems in general should not be anything new to them.
### Secrets access
To onboard a new person, you need to add their public age key to the repository. To generate one, the person needs to run `age-keygen -o keys.txt` to generate a new key pair. The `keys.txt` file needs to be placed in the age configuration directory for the used system, e.g. `$XDG_CONFIG_HOME/sops/age/keys.txt`, `$HOME/Library/Application Support/sops/age/keys.txt` or `%AppData%\sops\age\keys.txt`. Then, add the public key to the `sops-age-recipients.txt` file in this repository. Commit the changes and push them to the repository.
Now, some person that already has had access to all the secrets needs to re-encrypt them with the updated sop-age-recipients. To do so, run `sops --rotate --in-place stuff.enc.yaml` for every encrypted file in the repository. Commit the changes and push them to the repository.
### Server access
Server access is done using SSH keys. To onboard a new person, a person that already has access needs to add the new person's public SSH key to the server. The public key needs to be added to the `~/.ssh/authorized_keys` file of the `hausmeister` user on the server. The new person can then log in using their private SSH key.

8
aws_key.enc
View File

@ -1,5 +1,5 @@
{ {
"data": "ENC[AES256_GCM,data:JEWQ5oDpbR+mIJpTdrMBoacpUxnUA8J1EAU+0H/XIJurHGD6lveZ5FJusjAHcFHCKuG4zblKUi2OQ1gsF9Nnabfugvr7s1KnuQgqOIWqrhKzhdlj6llbNSIs2eM1pN2esZ5b8G1aBueobfHQXNuaU76kavG547nE1Q==,iv:mz0kG3Mfv2nWZIr+pfj1q9QZdda1IoL2HXE75HVQQss=,tag:oIISoRuNbil3/smqAw8otQ==,type:str]", "data": "ENC[AES256_GCM,data:htWtizDVB1j6596IgQU066rRFNo4KLTfyu6QRT0EaeyBMxAbaAWhgusPb1avDFdBCljlLG2lDR4DzcvjaGdCX5pOQA76dOW9gpKBCstQQsAnF+QT7oxCl4RSLJNQaxCVt8zGaZkiwGPdm1NQkMXqSKQsQmy13+gnVA==,iv:mz0kG3Mfv2nWZIr+pfj1q9QZdda1IoL2HXE75HVQQss=,tag:JnCTYDEUCC8S9Y07P/HqmA==,type:str]",
"sops": { "sops": {
"kms": null, "kms": null,
"gcp_kms": null, "gcp_kms": null,
@ -8,11 +8,11 @@
"age": [ "age": [
{ {
"recipient": "age1zwv4tl8ws6ke8wseenq4lrwcck3el2wandlgztefz9v4qdlnwu7saw7g8z", "recipient": "age1zwv4tl8ws6ke8wseenq4lrwcck3el2wandlgztefz9v4qdlnwu7saw7g8z",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzOEp1ZDZmSEhDN3hMZDRi\ndXZIVStVbXJVL0hzWmRaNWNoTmVhMURWYkhJCjFXQm13NVY5Rkt5K0FsRHk2cmdx\nVUhQOVc0YXhVQm94Rmt5bnhjSjBTKzQKLS0tIEVsRXk4UTJoYVpCYlRFVFhIVW1l\nMklzSC9kS3BwMGU2SWgxM2ltMWh6RDgKFItY+3CFsLHEjUtmANyoQ+lLA7zfESWy\nkU+z8YNEM5rwECJAdZiqp8/nJalSRfeYYtdzw/7dNxsGGelNgibBKA==\n-----END AGE ENCRYPTED FILE-----\n" "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwelIybmtyeU5waUdhYzJu\nM0pmVFI5bVZDYlB6YUFKS0JDem9WYTMxY2lZCmt5M2pmUEZLZldDV2hNRmNETUVN\nM0RGVEp5cHU5VWpNaUdDK0Jmb0pVdHMKLS0tIHJJWXZxQ0IwQm5qZEpjekNrK3NP\nOS9yQWsxZ2YzZTJIajNhd3NFbC8wNmMKhzTifvzN5C0KOzoxfTY1MOKDaNhyGOds\nivGkhrjzs3mjP446Tk65PTAZJehLj8/+MqbZ3WyQQ5teo/WF2VIzVg==\n-----END AGE ENCRYPTED FILE-----\n"
} }
], ],
"lastmodified": "2024-01-25T17:29:23Z", "lastmodified": "2024-01-25T18:34:11Z",
"mac": "ENC[AES256_GCM,data:/zhb5hGJLQvfn/1Cqu0CW/Fplq50ohWqif9hIqE9vvhAUp/r7nOSE108dEYA2/mo20yagsf5re9K92zGywPIoPYwKF1Uzm3vWuZnXST5erW3kKuSTVVzt9j3265mWx/uZi+5h+pY4/g1i10qKQV2FF8h1uwOnChSQglLbnlEE2k=,iv:Nqc3G7Ze5dAv/HEbrE1TxJsrtjwxs8A8+okceUy7gC0=,tag:i+mvDXkudii/fGaeISYkmA==,type:str]", "mac": "ENC[AES256_GCM,data:l6jipTQU86qdTO3OJ9lIrnU7z7pivtne4oC0n2ClMZu2hs02We73/a0+RQuLsWvdiBIL06n+tVD25Dxsr9LYP9jUTPXknrJw21Jb0QncNdxCklSXJ2my+iscao9DBz73h1W6UxAj3IuIYn6FTyKywbgoc5w4QjXP3++E7e/Ly7s=,iv:8eFn6Gw6KwCt8G7BoZBcg3yFtqK3EeDc7AVfVANqdE0=,tag:4250lR3ndO3qW/LkH/bPYg==,type:str]",
"pgp": null, "pgp": null,
"unencrypted_suffix": "_unencrypted", "unencrypted_suffix": "_unencrypted",
"version": "3.8.1" "version": "3.8.1"