Gleipnir/nixos-systems
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
nixos-systems/secrets/minio.env

32 lines
6.7 KiB
Bash
Raw Normal View History

Enable cross-origin requests from minio to label studio This allows streaming of audio files directly to label studio
2025-10-03 14:15:16 +00:00
MINIO_API_CORS_ALLOW_ORIGIN=ENC[AES256_GCM,data:/HVxXrwM8lJsk+eziOaBdh1byZSNj5EOPJbM8Xfkfbugw6OLoFGGug==,iv:lUtJCJs7zVp7d772m0/AZ1gO9CD8u8GsNW9lPZ6QV/E=,tag:R7Zw5hid6lUXvHke2RcpKw==,type:str]
Switch reverse proxy to also handle s3 API Without this we only get the console but can't actually access the S3-compatible portion of the API
2025-10-01 20:30:11 +00:00
MINIO_BROWSER_REDIRECT_URL=ENC[AES256_GCM,data:/rWgtcfGiTmxusUsWnKdSMmKPG6jX6sXIe2ly4SY5GwC2HCLKXY=,iv:txc22SaNq/sHl8xFE+4osbnL2riCM+ZArzqIq+1qni4=,tag:9+PYGeK4GvvGWb04dCUgKQ==,type:str]
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
MINIO_ROOT_USER=ENC[AES256_GCM,data:FWHZVWGWMY4NEd/lp6FNuy1VQ38SnIR288q3oZ7mrvb0AXc2,iv:hI4kZM/JlOK6qGE4Xi29Vrjaudk53b0v/wOd9EKgx6k=,tag:H8gopq1obn5Y0fPNreFU8w==,type:str]
MINIO_ROOT_PASSWORD=ENC[AES256_GCM,data:c+TiLy6KE7MpMQ2DXgPB41BIJqwpHsj/k8QbdUOP3KVQ2gET,iv:e2BJMKjUeKeWOlWL8yg/gTijmf7a0OF0Hu75tUQ8/K4=,tag:jENZIAh3wi3/SQDPv8Gi/A==,type:str]
MINIO_IDENTITY_OPENID_CONFIG_URL=ENC[AES256_GCM,data:0jgUN5XUzbpl+doSbVSnMXpoJtJy4CXvTJ864bCksTTHKciGcWMIDoK/xBDjcjPQ9Ny3M6RyOhouLOp7Zz4SIVKbqJQj5eGHKTBu2LSlnZx4gg==,iv:QJQDfqWYcupF14qE4mXmE2L13njpjgh5SSDbcS+gxto=,tag:QP5RVKF3JTDwPblBfPIElA==,type:str]
MINIO_IDENTITY_OPENID_CLIENT_ID=ENC[AES256_GCM,data:2dDnsk5pr/YZVLO6MeO+N1mOdFMUZaYhtNUtBM4bg51ysIEwRWEIZA==,iv:oWeGcXVxrZ5wqdCp5/BAdm4DlWZOf9kH6FhjE3wpZew=,tag:f3J5EH+RgXAA2TmO+UArCg==,type:str]
MINIO_IDENTITY_OPENID_CLIENT_SECRET=ENC[AES256_GCM,data:20wnwfCA+eeMyQl4kZbTqYjixIsAQ9qjNLZXqJaOuI75CrhU/T/DZ+sR8O+yLCB6twyShbvYLPz/uLjyh7V5b+ypkS+Ql4o9uZ2h1xHhtk9MwkyJkTF3SnEDI9ehUvgmkWvPy7SB/q48W5U22Ujx3MwLcDM8Kh7+5PLF3GQDi2M=,iv:p6JXHkjNxuLPRaxS91rspwlLNxxPPBHlT/AXxK3fsVg=,tag:goWn/hsSQzx5QHaBPG8vdg==,type:str]
MINIO_IDENTITY_OPENID_DISPLAY_NAME=ENC[AES256_GCM,data:VeWvfk89zYiaoPD6Cm299luW,iv:R99ylbdgizL0CFWtKaPisOQiWkHfpmEI4ge4Yg+XZzw=,tag:VhbSv3f09bKQFHGp1Q8jtw==,type:str]
Add proper Authentik scopes to minio OIDC config See https://integrations.goauthentik.io/infrastructure/minio/ for details that I was following
2025-10-01 19:33:51 +00:00
MINIO_IDENTITY_OPENID_SCOPES=ENC[AES256_GCM,data:Me2Iz+YwceOkka7chUUyozVLoruSCRDMSTs=,iv:nt8c5CxXpy/k0e2BxerveicqyQP43a3Wt7D0PqsAa/M=,tag:EK9tClqfuEsdIGbJ0WRe2Q==,type:str]
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKdUJ6Q2xSc0hxQlpqR3pX\nU0ExZG9YTFJ3WTY5SUhVU2kxQi9KaGJYekRvCmc1NzAvbjlmRkoxbEZFc01zdmZH\nL2wzTUx2RmtHRlVUWjVYb1JlMXlVUzAKLS0tIDFDdDVzOHVVRHRZNm0rY3E4NVE4\nckdVa09VRjFlQndSbktiVlJmTWNKb0kKei948QJ8owvlASul09oGbEUlZ0LcFfDD\nEp7vTnubt9z45zvbY8ZgRJmT/gHZFSF8Q+Jfmba6InBqUXeGKAvkgg==\n-----END AGE ENCRYPTED FILE-----\n
Add new staging server key for sops
2026-02-18 05:06:57 +00:00
sops_age__list_0__map_recipient=age1wxlwx75hfxer4trvfzad7cwdn2hhu4we50p32vpy3qvdct7t656q3pp04x
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZM3VlMWZxZkRJbVBQR1Ru\nZ2RyWW9FclMwb1ZxTjI0NUJJaEVNR0N6NmprCnFCUXU2MU8yY0ZCS0pDNzRzQkpq\nc0ZiY3p6K1YyTWNpeGhHSTNVS2h6SUkKLS0tIGxYR2VpLzBIeERLK29UcGN3UXFh\nWmVPNlBlWThrU3pvSERRa2ZCSC9KdGcKuEJE5qbf19JL5Qwo6oT+tqqR8ywZHFaS\n74MTrJeSBMmjFYwgdG688O8oBmpQygQ55zv4/oYG1jJZ1GMB/eQq/A==\n-----END AGE ENCRYPTED FILE-----\n
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_age__list_1__map_recipient=age1x704pjnueguchkl54ly8w4w26ltys5900v7xnl7w3zlgasus09jszz45t8
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYkV3dzMxN1N6dmVRd24w\nUklyYktPRTFFOXcxcXJ5Wjk2SjcyWDZZWndBCld0OWFvZUJjclhPMDRmSWNxYmtH\nOWpGR2JsaTRSa1RvYUdLSHowL1ExbWsKLS0tIEZaZTJMR2dYdENoV2RNRDhkcjEv\namcvZGYrR3ZUaWxUWUJDNzd4UnV5TlEK8Vi10+kp7ngqUgLTBFdb2rctfVUTWZXy\nRgVMm6HJM35VPQQU0Pykd3ksqPj2w0su3axVCBMijOAt4spYWMQbHw==\n-----END AGE ENCRYPTED FILE-----\n
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_age__list_2__map_recipient=age15y4k929zaj9fdg3vd40pa40tgvrgv9mn22xfummn5zxfmkcw5d0st6prjx
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjRmhQNWFDblQ4NC9DN1o1\nbVdHdlVDVE1kYnhDWUJ0S20wSXRQWWhDNUhjCkN0OGxjSEhJWVdCUlhaMmJoNlRv\nM3hqSmNnMTFzNGFiNVlGU3FwK0lyYzgKLS0tIGVsaExrMDFYdlNyRmpLNis1TmU4\nR29XR1hGdUJXSmhzWVFxWG1JaFgyYUUKe7vVs0BHH51IWzbObT7z1NDzAa4sVRsh\no5BFvxMN5ldPln1IECUWfh+Oo0OZv+pOUnZK6EjQW2tpNtWg/jHvIQ==\n-----END AGE ENCRYPTED FILE-----\n
Add dev_poweredge key For building nix binary cache
2025-12-15 18:47:41 +00:00
sops_age__list_3__map_recipient=age1q5syuyx3n255vllv6elfj72yk5mhxnk9pqawzyy4gzkzmpw3gpjqz9ujx2
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmU0YvSUpVaUJvOU53ZVNS\nTGIwdWpvbUFhRHM3QlRJeUJjcFlMR1BFZWxJCmpsN0ZvMjBLOVVQaVNQNEJFK1Fr\nUEV3N0x6ZndpVVpCYjRPalhpeXNkZjAKLS0tIHAyTzlZSCtmRHpnWFBSajFjZUpB\nVDlSWDZNQmpLNGF1V05Xc3VPOW9NZHcKp1tXI1KTxjq7AQUGZe0Ws9GLwle+mO7O\nAB5uk8Tp5updX8sLpXDD/uZ2P9SvcA713tcr+QRHPGTcdCSSHLkYzA==\n-----END AGE ENCRYPTED FILE-----\n
Update host key for corp server
2026-01-13 04:48:16 +00:00
sops_age__list_4__map_recipient=age1rqa4qvkk7s26pgj09d269t84vprdrh0jhyl75xq5zyhp9cdssq2qc8hut8
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_5__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb0ttR05sZjlxQ09BQk5v\nWWtmVlNQRStQeVVFZUg4MUV0RTZZQlg5d1MwCk1rY1BtWWtJTk1RVlh2N2pTclZG\nQmtETWZPQmdYbjZJZThaWmQyNlROR2sKLS0tIDdlSEpkZXk5clQrWmlQYTRKZ25T\nSTAxZUhWbStZRVMxVXlvZUl4OEI3K3MKxNe6E41GBPYIWMas0ou1Vuz4Bi4UQOZq\nVD57b4LvE5WQANYyeVnBQb38sVizY4DoMbJksBys05vU4wKaOA+11w==\n-----END AGE ENCRYPTED FILE-----\n
WIP getting legacy-sexcore back up At this point I was able to successfully nixos-anywhere the system and SSH back in afterwards. That's progress worth keeping.
2026-01-04 17:21:22 +00:00
sops_age__list_5__map_recipient=age1yfs6d0vac45rnx3q54u52tjk5vnfsqnghaj95kmkl7fd5du3ee8qgse385
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_6__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZ2pIbkwxa2pVOVN4RkNq\nbDdBb1lPL0ViWWRSWTlNREp6ZWo0alJFWHlvClJsYnNPclNxbGt3KzdlZVVxRjhV\ncWZRdkIzNHV6NVkwTWZWaU5NTkNzWGsKLS0tIC82MjZIcEtTSWFRdTdPZEpuSWR3\nTzZGMHBmV2Zuc2VGd1dYMzc0N3BjRmMKNfB/OUtTjTLZJxFMg35U/dk+aitUvTJN\nBvVNJ/URmN5+/lS9Ha9jGYkOpWMS7m9JsznNoMuPbqCU9GPtAwzPvg==\n-----END AGE ENCRYPTED FILE-----\n
Add dev_poweredge key For building nix binary cache
2025-12-15 18:47:41 +00:00
sops_age__list_6__map_recipient=age1t3ryfktuhr3cysf49m9q2n8fkjf9ajjjnhztxw9hz8paxgk4lpcq065jge
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_7__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvNnlRS1Fjc1dOUzFJNDJp\nQ0hDRzZTVmRJLzNldGRGY0hVeWRKM3RjU2pFCnpqWVhIOHdUMWNsYkNPQ1dMdnd6\nOVhOWEljVVlMK2ZNV2pYTm5VNkN1L1EKLS0tIG9kVU5sYnRzbzgwQklpYWJiR3NI\nbkxaNkRaWTNVcGFnWThiaC96cDU2cFEKn+uSnMdA+fjs+C4eAVjfwOy4l6k7csEu\nyeLcn9pYaRlrU4OlAcdYnFqRNOEoBkNq2FJp86x2KRdK0qNwjq1REQ==\n-----END AGE ENCRYPTED FILE-----\n
Re-wipe nocix-amd-legacy-sexcore again, update secrets (again)
2026-01-05 03:31:47 +00:00
sops_age__list_7__map_recipient=age167q6r28ws6wrpjwxnt4ap2fgs6d9cyvrdhzl2wflr2tnsw5xapxq36n2ec
Update staging server key after rebuild
2026-02-18 15:24:52 +00:00
sops_age__list_8__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvbmE3VGpaaFhVWGp4Tjgx\nNzd2ODJkbkFBTUVkbWxQcDdERGdxRFVJVHlrCi9uUEIyNG5nVkJqS2hIanlvWEo4\nempIcmY1eDU0dGZ6RGxuRUswR2pWNzgKLS0tIDNqc3FFc3laN3lUMjIrSHA0OHlI\nZ29kb1hqR3ZxSUkxcitOQnd4Nkh4VDQKxoZvEwd1HSZInFHBhHW2cXX5+zEDBL4m\ntgEij693WTaOslQXe+tj9WndCCA4Azm49i3XZbyvyI/OEBTnEKa3xg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_8__map_recipient=age1924evks66k9g6c4zcnn2ghjcxpe0fzw2y9j253xredkwqnw9p5qqjcvjqt
Enable cross-origin requests from minio to label studio This allows streaming of audio files directly to label studio
2025-10-03 14:15:16 +00:00
sops_lastmodified=2025-10-01T22:26:38Z
sops_mac=ENC[AES256_GCM,data:GnQZaOsewLlHBfBCgnbs82PDs0Lw9xTxrQfC5kNBUBzUOf5ESY5kgbmTXepnCYSKWFhCKEYNrGBzpmJGuRnzIw/wxPMK01roDZb2mzZzdmdB7ccb46JKWUj5xg5+7hsyMbYgo1QNLvE/sh6ujndyQ6/lBdq649vBq6GnmleysyY=,iv:qJYtTxYyB2ZcAygh0KBM7aUdOMueGTk+rR3BA7ZNaSk=,tag:H6mB54b34rVFmZAnn0Ga8w==,type:str]
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_unencrypted_suffix=_unencrypted
sops_version=3.10.2
Reference in a new issue Copy permalink