dtoro
8ef17dba3d
The IONOS netbird VPS held two credentials in plaintext that were the last
holdouts from the homelab's sops+age secrets pattern:
- /root/turn-pass.txt (coturn long-term-credential password)
- PKCEAuthorizationFlow.ProviderConfig.ClientSecret inline in
/opt/management.json (Authentik OIDC client secret)
This commit moves both into sops-encrypted YAML in the repo and adds a render
command that recreates the VPS config files from templates + decrypted secrets:
* secrets/turn-shared-secret.yaml — encrypted `password: <coturn pwd>`
* secrets/netbird-authentik-oidc.yaml — encrypted `client_secret: <...>`
Both recipients = hubris + apps + republic-laptop (same 3 as hello.yaml).
* vps/turnserver.conf.tmpl + vps/management.json.tmpl — templates with
{{TURN_PASSWORD}} + {{AUTHENTIK_CLIENT_SECRET}} placeholders.
* bin/homelab new subcommand `render-vps-configs`:
- Decrypts both secrets locally (works on any recipient).
- Substitutes placeholders into templates.
- Diffs against current VPS state via ssh, prompts, applies atomically
(write `.new` then mv), restarts coturn + netbird-mgmt.
- --dry-run + -y flags. Hops through hubris when not running on hubris
itself, since VPS sshd is locked to hubris's pubkey.
* inventory.yaml adds the VPS as `kind: external` (new kind; reserved for
ssh-managed hosts that aren't homelab clients themselves — no age key,
no /opt/homelab-context). hosts/netbird-vps.yaml regenerated.
* SHARED_SECRETS list includes both new secrets so re-keys on enrollment
changes pick them up automatically.
After this lands + the 5-min sync propagates to hubris, run from hubris PVE
shell (or any client; hubris just skips the extra ssh hop):
homelab render-vps-configs --dry-run # see plan, no changes
homelab render-vps-configs -y # apply + restart services
Once verified working, the plaintext `/root/turn-pass.txt` should be deleted
on the VPS (the rendered /etc/turnserver.conf no longer needs it as a
reference).
24 lines
509 B
Cheetah
24 lines
509 B
Cheetah
# coturn for netbird symmetric-NAT peers — rendered from this template by
|
|
# `homelab render-vps-configs`. DO NOT edit /etc/turnserver.conf on the VPS
|
|
# directly; that file is recreated from this template on each render.
|
|
listening-port=3478
|
|
listening-ip=0.0.0.0
|
|
relay-ip=82.165.190.79
|
|
external-ip=82.165.190.79
|
|
|
|
min-port=49152
|
|
max-port=49999
|
|
|
|
fingerprint
|
|
lt-cred-mech
|
|
realm=netbird.hubris.network
|
|
user=netbird:{{TURN_PASSWORD}}
|
|
|
|
no-stun
|
|
no-multicast-peers
|
|
no-cli
|
|
no-loopback-peers
|
|
no-tlsv1
|
|
no-tlsv1_1
|
|
no-udp
|