Skip to content

Commit 41ef68f

Browse files
joshp123joshp123
committed
bake clawdinator secrets into AMI build
1 parent 1190603 commit 41ef68f

File tree

5 files changed

+164
-127
lines changed

5 files changed

+164
-127
lines changed

‎.github/workflows/image-build.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,23 @@ jobs:
3434
printf '%s' "${CLAWDINATOR_AGE_KEY}" > nix/keys/clawdinator.agekey
3535
chmod 600 nix/keys/clawdinator.agekey
3636
37+
- name: Fetch age secrets
38+
env:
39+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
40+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
41+
AWS_REGION: ${{ secrets.AWS_REGION }}
42+
S3_BUCKET: ${{ secrets.S3_BUCKET }}
43+
run: |
44+
mkdir -p nix/age-secrets
45+
aws s3 sync "s3://${S3_BUCKET}/age-secrets" nix/age-secrets
46+
for file in \
47+
nix/age-secrets/clawdinator-github-app.pem.age \
48+
nix/age-secrets/clawdinator-discord-token.age \
49+
nix/age-secrets/clawdinator-anthropic-api-key.age
50+
do
51+
test -f "$file"
52+
done
53+
3754
- name: Build image
3855
run: scripts/build-image.sh
3956

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ infra/opentofu/aws/*.auto.tfvars
1616
# Secrets
1717
*.env
1818
nix/keys/*.agekey
19+
nix/age-secrets/
1920

2021
# Nix build outputs
2122
result

‎nix/hosts/clawdinator-1-common.nix‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
{ lib, config, ... }:
2+
let
3+
secretsPath = config.clawdinator.secretsPath;
4+
in
5+
{
6+
options.clawdinator.secretsPath = lib.mkOption {
7+
type = lib.types.str;
8+
description = "Path to encrypted age secrets for CLAWDINATOR.";
9+
};
10+
11+
config = {
12+
age.identityPaths = [ "/etc/agenix/keys/clawdinator.agekey" ];
13+
age.secrets."clawdinator-github-app.pem" = {
14+
file = "${secretsPath}/clawdinator-github-app.pem.age";
15+
owner = "clawdinator";
16+
group = "clawdinator";
17+
};
18+
age.secrets."clawdinator-anthropic-api-key" = {
19+
file = "${secretsPath}/clawdinator-anthropic-api-key.age";
20+
owner = "clawdinator";
21+
group = "clawdinator";
22+
};
23+
age.secrets."clawdinator-discord-token" = {
24+
file = "${secretsPath}/clawdinator-discord-token.age";
25+
owner = "clawdinator";
26+
group = "clawdinator";
27+
};
28+
29+
services.clawdinator = {
30+
enable = true;
31+
instanceName = "CLAWDINATOR-1";
32+
memoryDir = "/memory";
33+
memoryEfs = {
34+
enable = true;
35+
fileSystemId = "fs-0e7920726c2965a88";
36+
region = "eu-central-1";
37+
mountPoint = "/memory";
38+
};
39+
repoSeeds = [
40+
{
41+
name = "clawdbot";
42+
url = "https://github.com/clawdbot/clawdbot.git";
43+
}
44+
{
45+
name = "nix-clawdbot";
46+
url = "https://github.com/clawdbot/nix-clawdbot.git";
47+
}
48+
{
49+
name = "clawdinators";
50+
url = "https://github.com/clawdbot/clawdinators.git";
51+
}
52+
{
53+
name = "clawdhub";
54+
url = "https://github.com/clawdbot/clawdhub.git";
55+
}
56+
{
57+
name = "nix-steipete-tools";
58+
url = "https://github.com/clawdbot/nix-steipete-tools.git";
59+
}
60+
];
61+
62+
config = {
63+
gateway.mode = "local";
64+
agent.workspace = "/var/lib/clawd/workspace";
65+
agent.maxConcurrent = 4;
66+
agent.skipBootstrap = true;
67+
logging = {
68+
level = "info";
69+
file = "/var/lib/clawd/logs/clawdbot.log";
70+
};
71+
session.sendPolicy = {
72+
default = "allow";
73+
rules = [
74+
{
75+
action = "deny";
76+
match.keyPrefix = "agent:main:discord:channel:1458138963067011176";
77+
}
78+
{
79+
action = "deny";
80+
match.keyPrefix = "agent:main:discord:channel:1458141495701012561";
81+
}
82+
];
83+
};
84+
routing.queue = {
85+
mode = "interrupt";
86+
bySurface = {
87+
discord = "queue";
88+
telegram = "interrupt";
89+
whatsapp = "interrupt";
90+
webchat = "queue";
91+
};
92+
};
93+
identity.name = "CLAWDINATOR-1";
94+
skills.allowBundled = [ "github" "clawdhub" ];
95+
discord = {
96+
enabled = true;
97+
dm.enabled = false;
98+
guilds = {
99+
"1456350064065904867" = {
100+
requireMention = false;
101+
channels = {
102+
# #clawdinators-test
103+
"1458426982579830908" = {
104+
allow = true;
105+
requireMention = false;
106+
autoReply = true;
107+
};
108+
# #clawdributors-test (lurk only; replies denied via sendPolicy)
109+
"1458138963067011176" = {
110+
allow = true;
111+
requireMention = false;
112+
};
113+
# #clawdributors (lurk only; replies denied via sendPolicy)
114+
"1458141495701012561" = {
115+
allow = true;
116+
requireMention = false;
117+
};
118+
};
119+
};
120+
};
121+
};
122+
};
123+
124+
anthropicApiKeyFile = "/run/agenix/clawdinator-anthropic-api-key";
125+
discordTokenFile = "/run/agenix/clawdinator-discord-token";
126+
127+
githubApp = {
128+
enable = true;
129+
appId = "2607181";
130+
installationId = "102951645";
131+
privateKeyFile = "/run/agenix/clawdinator-github-app.pem";
132+
schedule = "hourly";
133+
};
134+
135+
selfUpdate.enable = true;
136+
selfUpdate.flakePath = "/var/lib/clawd/repo";
137+
selfUpdate.flakeHost = "clawdinator-1";
138+
};
139+
};
140+
}

‎nix/hosts/clawdinator-1-image.nix‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
imports = [
44
(modulesPath + "/virtualisation/ec2-data.nix")
55
(modulesPath + "/virtualisation/amazon-init.nix")
6+
../modules/clawdinator.nix
7+
./clawdinator-1-common.nix
68
];
79

810
networking.hostName = "clawdinator-1";
@@ -27,4 +29,6 @@
2729
users.users.root.openssh.authorizedKeys.keys = [
2830
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOLItFT3SVm5r7gELrfRRJxh6V2sf/BIx7HKXt6oVWpB"
2931
];
32+
33+
clawdinator.secretsPath = ../age-secrets;
3034
}

‎nix/hosts/clawdinator-1.nix‎

Lines changed: 2 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
imports = [
44
(modulesPath + "/virtualisation/amazon-image.nix")
55
../modules/clawdinator.nix
6+
./clawdinator-1-common.nix
67
];
78

89
networking.hostName = "clawdinator-1";
@@ -20,131 +21,5 @@
2021

2122
networking.firewall.allowedTCPPorts = [ 22 18789 ];
2223

23-
age.identityPaths = [ "/etc/agenix/keys/clawdinator.agekey" ];
24-
age.secrets."clawdinator-github-app.pem" = {
25-
file = "/var/lib/clawd/nix-secrets/clawdinator-github-app.pem.age";
26-
owner = "clawdinator";
27-
group = "clawdinator";
28-
};
29-
age.secrets."clawdinator-anthropic-api-key" = {
30-
file = "/var/lib/clawd/nix-secrets/clawdinator-anthropic-api-key.age";
31-
owner = "clawdinator";
32-
group = "clawdinator";
33-
};
34-
age.secrets."clawdinator-discord-token" = {
35-
file = "/var/lib/clawd/nix-secrets/clawdinator-discord-token.age";
36-
owner = "clawdinator";
37-
group = "clawdinator";
38-
};
39-
40-
services.clawdinator = {
41-
enable = true;
42-
instanceName = "CLAWDINATOR-1";
43-
memoryDir = "/memory";
44-
memoryEfs = {
45-
enable = true;
46-
fileSystemId = "fs-0e7920726c2965a88";
47-
region = "eu-central-1";
48-
mountPoint = "/memory";
49-
};
50-
repoSeeds = [
51-
{
52-
name = "clawdbot";
53-
url = "https://github.com/clawdbot/clawdbot.git";
54-
}
55-
{
56-
name = "nix-clawdbot";
57-
url = "https://github.com/clawdbot/nix-clawdbot.git";
58-
}
59-
{
60-
name = "clawdinators";
61-
url = "https://github.com/clawdbot/clawdinators.git";
62-
}
63-
{
64-
name = "clawdhub";
65-
url = "https://github.com/clawdbot/clawdhub.git";
66-
}
67-
{
68-
name = "nix-steipete-tools";
69-
url = "https://github.com/clawdbot/nix-steipete-tools.git";
70-
}
71-
];
72-
73-
config = {
74-
gateway.mode = "local";
75-
agent.workspace = "/var/lib/clawd/workspace";
76-
agent.maxConcurrent = 4;
77-
agent.skipBootstrap = true;
78-
logging = {
79-
level = "info";
80-
file = "/var/lib/clawd/logs/clawdbot.log";
81-
};
82-
session.sendPolicy = {
83-
default = "allow";
84-
rules = [
85-
{
86-
action = "deny";
87-
match.keyPrefix = "agent:main:discord:channel:1458138963067011176";
88-
}
89-
{
90-
action = "deny";
91-
match.keyPrefix = "agent:main:discord:channel:1458141495701012561";
92-
}
93-
];
94-
};
95-
routing.queue = {
96-
mode = "interrupt";
97-
bySurface = {
98-
discord = "queue";
99-
telegram = "interrupt";
100-
whatsapp = "interrupt";
101-
webchat = "queue";
102-
};
103-
};
104-
identity.name = "CLAWDINATOR-1";
105-
skills.allowBundled = [ "github" "clawdhub" ];
106-
discord = {
107-
enabled = true;
108-
dm.enabled = false;
109-
guilds = {
110-
"1456350064065904867" = {
111-
requireMention = false;
112-
channels = {
113-
# #clawdinators-test
114-
"1458426982579830908" = {
115-
allow = true;
116-
requireMention = false;
117-
autoReply = true;
118-
};
119-
# #clawdributors-test (lurk only; replies denied via sendPolicy)
120-
"1458138963067011176" = {
121-
allow = true;
122-
requireMention = false;
123-
};
124-
# #clawdributors (lurk only; replies denied via sendPolicy)
125-
"1458141495701012561" = {
126-
allow = true;
127-
requireMention = false;
128-
};
129-
};
130-
};
131-
};
132-
};
133-
};
134-
135-
anthropicApiKeyFile = "/run/agenix/clawdinator-anthropic-api-key";
136-
discordTokenFile = "/run/agenix/clawdinator-discord-token";
137-
138-
githubApp = {
139-
enable = true;
140-
appId = "2607181";
141-
installationId = "102951645";
142-
privateKeyFile = "/run/agenix/clawdinator-github-app.pem";
143-
schedule = "hourly";
144-
};
145-
146-
selfUpdate.enable = true;
147-
selfUpdate.flakePath = "/var/lib/clawd/repo";
148-
selfUpdate.flakeHost = "clawdinator-1";
149-
};
24+
clawdinator.secretsPath = "/var/lib/clawd/nix-secrets";
15025
}

0 commit comments

Comments
 (0)