Gleipnir/nixos-systems
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
nixos-systems/secrets/minio.env

30 lines
6.2 KiB
Bash
Raw Normal View History

Enable cross-origin requests from minio to label studio This allows streaming of audio files directly to label studio
2025-10-03 14:15:16 +00:00
MINIO_API_CORS_ALLOW_ORIGIN=ENC[AES256_GCM,data:/HVxXrwM8lJsk+eziOaBdh1byZSNj5EOPJbM8Xfkfbugw6OLoFGGug==,iv:lUtJCJs7zVp7d772m0/AZ1gO9CD8u8GsNW9lPZ6QV/E=,tag:R7Zw5hid6lUXvHke2RcpKw==,type:str]
Switch reverse proxy to also handle s3 API Without this we only get the console but can't actually access the S3-compatible portion of the API
2025-10-01 20:30:11 +00:00
MINIO_BROWSER_REDIRECT_URL=ENC[AES256_GCM,data:/rWgtcfGiTmxusUsWnKdSMmKPG6jX6sXIe2ly4SY5GwC2HCLKXY=,iv:txc22SaNq/sHl8xFE+4osbnL2riCM+ZArzqIq+1qni4=,tag:9+PYGeK4GvvGWb04dCUgKQ==,type:str]
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
MINIO_ROOT_USER=ENC[AES256_GCM,data:FWHZVWGWMY4NEd/lp6FNuy1VQ38SnIR288q3oZ7mrvb0AXc2,iv:hI4kZM/JlOK6qGE4Xi29Vrjaudk53b0v/wOd9EKgx6k=,tag:H8gopq1obn5Y0fPNreFU8w==,type:str]
MINIO_ROOT_PASSWORD=ENC[AES256_GCM,data:c+TiLy6KE7MpMQ2DXgPB41BIJqwpHsj/k8QbdUOP3KVQ2gET,iv:e2BJMKjUeKeWOlWL8yg/gTijmf7a0OF0Hu75tUQ8/K4=,tag:jENZIAh3wi3/SQDPv8Gi/A==,type:str]
MINIO_IDENTITY_OPENID_CONFIG_URL=ENC[AES256_GCM,data:0jgUN5XUzbpl+doSbVSnMXpoJtJy4CXvTJ864bCksTTHKciGcWMIDoK/xBDjcjPQ9Ny3M6RyOhouLOp7Zz4SIVKbqJQj5eGHKTBu2LSlnZx4gg==,iv:QJQDfqWYcupF14qE4mXmE2L13njpjgh5SSDbcS+gxto=,tag:QP5RVKF3JTDwPblBfPIElA==,type:str]
MINIO_IDENTITY_OPENID_CLIENT_ID=ENC[AES256_GCM,data:2dDnsk5pr/YZVLO6MeO+N1mOdFMUZaYhtNUtBM4bg51ysIEwRWEIZA==,iv:oWeGcXVxrZ5wqdCp5/BAdm4DlWZOf9kH6FhjE3wpZew=,tag:f3J5EH+RgXAA2TmO+UArCg==,type:str]
MINIO_IDENTITY_OPENID_CLIENT_SECRET=ENC[AES256_GCM,data:20wnwfCA+eeMyQl4kZbTqYjixIsAQ9qjNLZXqJaOuI75CrhU/T/DZ+sR8O+yLCB6twyShbvYLPz/uLjyh7V5b+ypkS+Ql4o9uZ2h1xHhtk9MwkyJkTF3SnEDI9ehUvgmkWvPy7SB/q48W5U22Ujx3MwLcDM8Kh7+5PLF3GQDi2M=,iv:p6JXHkjNxuLPRaxS91rspwlLNxxPPBHlT/AXxK3fsVg=,tag:goWn/hsSQzx5QHaBPG8vdg==,type:str]
MINIO_IDENTITY_OPENID_DISPLAY_NAME=ENC[AES256_GCM,data:VeWvfk89zYiaoPD6Cm299luW,iv:R99ylbdgizL0CFWtKaPisOQiWkHfpmEI4ge4Yg+XZzw=,tag:VhbSv3f09bKQFHGp1Q8jtw==,type:str]
Add proper Authentik scopes to minio OIDC config See https://integrations.goauthentik.io/infrastructure/minio/ for details that I was following
2025-10-01 19:33:51 +00:00
MINIO_IDENTITY_OPENID_SCOPES=ENC[AES256_GCM,data:Me2Iz+YwceOkka7chUUyozVLoruSCRDMSTs=,iv:nt8c5CxXpy/k0e2BxerveicqyQP43a3Wt7D0PqsAa/M=,tag:EK9tClqfuEsdIGbJ0WRe2Q==,type:str]
Add dev_poweredge key For building nix binary cache
2025-12-15 18:47:41 +00:00
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZHlSUE55dGJtTVEzZHZn\ndUczTHo0eWlhTG5uMEhrS1JxdktTZnZ5SUdjClhrL3hER0hZZ1VpemR2U25ZSHlW\naVVmaW1SbjllQlE0Yzlnam9rVFFiUUkKLS0tIEk3WkcweUdzWWpaQWN2U3Z5STdH\nbTFaVTlDUW9CWVBWQ3VIeGpqTEZNd0kKu8QcqYpnJPiOA779cSYm6/qp840Ol8gM\nVkahS9U5dVZqtagAARrDjeFwAJ1HRlhGQFqv/BAdrHGnal0cBT8+kQ==\n-----END AGE ENCRYPTED FILE-----\n
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_age__list_0__map_recipient=age1fnkhk9rv7r8gh84vxnhvndk4fgh20qcj4hvnfhdpumcydl6m6vrse50lrz
Add dev_poweredge key For building nix binary cache
2025-12-15 18:47:41 +00:00
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENUR6Zys5Q3B4emdQZ29H\nNm9QbHdMKy8wdVpyOFR4SXhmTG1RUHdEaXhjCnJ0NTF5c1EwdEw5TE4ycWE2SzZr\nYXg2S1BGckJ1dUU2ZVF0M3NFYWQwNHMKLS0tIHU1UjVrbFpzU213dkpENDVpOE0r\nL2Y0Q09LRjd6TUdhc3pDY0F0Vm4zWUUKiW9jFweEyVik+n5VcmFXiPJvjWl075FR\nXk/ipbXvOKLZF9Veusqb++/u384OkSb7PC0rWzJH2+H8likCKlOXNQ==\n-----END AGE ENCRYPTED FILE-----\n
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_age__list_1__map_recipient=age1x704pjnueguchkl54ly8w4w26ltys5900v7xnl7w3zlgasus09jszz45t8
Add dev_poweredge key For building nix binary cache
2025-12-15 18:47:41 +00:00
sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWeHhEc2hsQnkrN0lXV05r\nUm4rZEJOd2gvV0JNYlcrNWJEUXZlYzVnYzM0Cmh4ZXhlMjRwaXhhQ0lSOS8wM2VG\nQ3BoTWh4a053QkQ3ZW51Slg3SThpZm8KLS0tIFRiSktwNko3WVhNZkE1VjRoK3gy\najBMU2NNVGwvVzFlbXlTblZvRHYzWE0KtMgbQELkRuk+UkssMBQ8jtyp+nJsCdpS\n72Lt1yyQQf4jnC11hEvLoiCDs05szFzVwwEnuUWMIvs//Gq7sZIT9w==\n-----END AGE ENCRYPTED FILE-----\n
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_age__list_2__map_recipient=age15y4k929zaj9fdg3vd40pa40tgvrgv9mn22xfummn5zxfmkcw5d0st6prjx
Add dev_poweredge key For building nix binary cache
2025-12-15 18:47:41 +00:00
sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZM0JUUG1XOFhaQklYT2xT\ncnkrVStkRVFQdlpxZjlWK2k1TVFoTEJSazFjCmpMd3dwcFRZZlNuejZGUHAzQTVm\nTmdmRHlkWDhRNitVSDRIaytqeWlKZkkKLS0tIHdObFlLM3JNUW5kRkg5THIrbkJ0\nTTBWM3BwTUJRcDVReUVobWNUQkU4WUEKd9/D7NhlFR3QO9WWd0kMHmQEGVjZPlLO\nmcfVaoYhh4cN2+fE2WW4529i0OjNHUCO7N2NW6LSn30JRoHo3fgR5g==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_3__map_recipient=age1q5syuyx3n255vllv6elfj72yk5mhxnk9pqawzyy4gzkzmpw3gpjqz9ujx2
sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaaDFCMnJEYWVMRG9zK2to\nWC9TS0Q5VFZHYVNFdmU4WnhYemhjK0xSLzBrCkk3RjZoR1I0a3dzdEl3NFNvWHdY\nSXIvZzFKSURaUC94Q2NNOXZTVzFxSk0KLS0tIE9oN3FkdUpCUzF6YURveElhdkdv\nakNidDY3SVpBYW95cEMyNUU1bU5aUkkKoNO8SNCttxqJlp6oON0WOy0jFTmdHS9c\n7jiNFZsDBTyAjdb2X+Tnk6svNxVM7wv1/Binkho31x7nZg3it5w0yw==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_4__map_recipient=age1ck44jqpuz3zlthquvuh7wsemrjrgfzhn462sk7rlfetwxpgy0uqs79xn2h
sops_age__list_5__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTQmRXN1N0L0hhK3VoaDBv\nTWRnTTltUzhlamRycThXZ1FNTW42TzRaM0d3CkFjdkFIR01iN0FHQVdHeTdvV2hM\nd2poUTRnNHllaHBjSlFnMGl6RmphYm8KLS0tIDVLak9XK3ArWTkxenpBVzhWNTB6\nS1BBTVE3a2NuM2MyRFpjWnY0aDFkd0kKKuFnw90QBIZ1n+ZduJnQS1teucpcE1Xf\ne/Gw1MdSXIBrvVwX4rZX7bwK8umaSHa8Hzl9KvKOGXjEXY5Xc2Nprw==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_5__map_recipient=age1z87rm3qrrspv44nsg73ntn9zys5g498lry4t4cy6x9hffapug5cqfprntm
sops_age__list_6__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpS3k5WFNDQ1A1K0FYS2hE\nOERySUFKS0dsNHJ0M1RhT0YrWGt5eElCa0ZRCjJGSzZ5bVNMNmxUeUZvaytIbk1n\nd1NXUEVNSWxEQ3VmUUdJeGlKY3F0UlkKLS0tIDdUYXdmZUgxb0dCUkl5SjNycFlX\nLzMrSVlIdm1nem1YcVl5SHcwSm80cEkKWSKivkJDpPSl7QPb0N782hniyOwGXy8D\n9nQv8o8/PR5Htj9ifwJrl/nKP71GpMoPqUxuhaAsb157oWS4BlgBYg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_6__map_recipient=age1t3ryfktuhr3cysf49m9q2n8fkjf9ajjjnhztxw9hz8paxgk4lpcq065jge
sops_age__list_7__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTjFVTmdiUWZxN3NucEM4\nVDczV0ozUFFiaXFZT1M3QWtza1Bod3gyZmxFCnE5anloSkxwYnRvZmptTXMrTVVV\nOWhXVjkyREJhNXg3NW9BenpSeWdUQm8KLS0tIFp3aFY0amFoZzErYy9NMG1kVFdU\nMFpMRnVmaUtWZWJhM0NHQTdtdlJ3SGMKc4RxlketbcS/3yKuqRHxkcAjb6QJQMdh\nhOpA3PHg7JkhAF1hiIYy+zzngV3EJUHg3fGigdEpSDksyTCIcFzhjw==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_7__map_recipient=age1j90h7hcp4fctr2xwj4zf9cxuelm43wkujvryc9hk6rzzc37rwdmss035w7
Enable cross-origin requests from minio to label studio This allows streaming of audio files directly to label studio
2025-10-03 14:15:16 +00:00
sops_lastmodified=2025-10-01T22:26:38Z
sops_mac=ENC[AES256_GCM,data:GnQZaOsewLlHBfBCgnbs82PDs0Lw9xTxrQfC5kNBUBzUOf5ESY5kgbmTXepnCYSKWFhCKEYNrGBzpmJGuRnzIw/wxPMK01roDZb2mzZzdmdB7ccb46JKWUj5xg5+7hsyMbYgo1QNLvE/sh6ujndyQ6/lBdq649vBq6GnmleysyY=,iv:qJYtTxYyB2ZcAygh0KBM7aUdOMueGTk+rR3BA7ZNaSk=,tag:H6mB54b34rVFmZAnn0Ga8w==,type:str]
Add minio module for S3-compatible object storage Label Studio _really_ prefers using a direct object storage model. Can't say I blame them, it makes sense given they are running Python. I had to bump Authentik to not use its default port so that minio could use its own default port. That seemed safest given that Authentik is always proxied but minio/S3 may _not_ be. I'm just not sure.
2025-10-01 19:25:29 +00:00
sops_unencrypted_suffix=_unencrypted
sops_version=3.10.2
Reference in a new issue Copy permalink