From ebc21a4add2145b6a3e680fc5ebc7c9ac451cc91 Mon Sep 17 00:00:00 2001 From: ltadeu6 Date: Mon, 25 May 2026 17:00:03 -0300 Subject: [PATCH] Add Cloudflare API token helpers --- AGENTS.md | 10 ++++++ hosts/Nixos/configuration.nix | 39 ++++++++++++++++++++++++ secrets/cloudflare_dns_api_token.age | Bin 0 -> 376 bytes secrets/cloudflare_worker_api_token.age | Bin 0 -> 376 bytes secrets/secrets.nix | 3 +- 5 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 secrets/cloudflare_dns_api_token.age create mode 100644 secrets/cloudflare_worker_api_token.age diff --git a/AGENTS.md b/AGENTS.md index 1942fcd..7131cae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -560,6 +560,8 @@ Estado atual: - `secrets/matrix_android_firebase_service_account.age` - `secrets/matrix_android_google_services.age` - `secrets/matrix_android_commander_credentials.age` +- `secrets/cloudflare_worker_api_token.age` +- `secrets/cloudflare_dns_api_token.age` - `secrets/minecraft_rcon_password.age` - `secrets/wireguard_private_key.age` @@ -593,6 +595,14 @@ Estado atual: - O helper `matrix-android-secrets [project-dir]` cria symlinks desses tres arquivos para `/run/agenix`; por default usa o diretorio atual. - Nao migre `local.properties`, debug keystores, `.gradle`, `.wrangler` ou caches locais do `matrix-android` para este repo sem um motivo explicito. +### Cloudflare + +- `secrets/cloudflare_worker_api_token.age` contem um token para deploy de Workers no account local. +- `secrets/cloudflare_dns_api_token.age` contem um token para DNS/Zone Read. +- `cloudflare-worker-env ` exporta `CLOUDFLARE_API_TOKEN` apenas para o comando filho usando o token de Workers. +- `cloudflare-dns-env ` exporta `CLOUDFLARE_API_TOKEN` apenas para o comando filho usando o token de DNS. +- O token bootstrap usado para criar outros tokens e temporario; nao mantenha `cloudflare_bootstrap_api_token.age` no repo depois de revogar o token na Cloudflare. + ## Dependencias implicitas e pontos de atencao Itens que um agente deve verificar antes de mexer: diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix index 77fc2d1..fd912ec 100644 --- a/hosts/Nixos/configuration.nix +++ b/hosts/Nixos/configuration.nix @@ -77,6 +77,27 @@ let link_secret /run/agenix/matrix_android_google_services "$project_dir/app/google-services.json" link_secret /run/agenix/matrix_android_commander_credentials "$project_dir/.mc/credentials.json" ''; + cloudflareEnv = name: secret: pkgs.writeShellScriptBin name '' + set -eu + + secret_path=/run/agenix/${secret} + if [ ! -r "$secret_path" ]; then + echo "Missing readable Cloudflare token: $secret_path" >&2 + exit 1 + fi + + export CLOUDFLARE_API_TOKEN="$(${pkgs.coreutils}/bin/cat "$secret_path")" + + if [ "$#" -eq 0 ]; then + echo "Cloudflare API token environment is ready." + exit 0 + fi + + exec "$@" + ''; + cloudflareWorkerEnv = + cloudflareEnv "cloudflare-worker-env" "cloudflare_worker_api_token"; + cloudflareDnsEnv = cloudflareEnv "cloudflare-dns-env" "cloudflare_dns_api_token"; haAirConditioner = "climate.ar"; haLaundryDryingToggle = "input_boolean.secar_roupas"; haClimateAction = action: data: { @@ -297,6 +318,22 @@ in { mode = "0400"; }; } // lib.optionalAttrs + (builtins.pathExists ../../secrets/cloudflare_worker_api_token.age) { + cloudflare_worker_api_token = { + file = ../../secrets/cloudflare_worker_api_token.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs + (builtins.pathExists ../../secrets/cloudflare_dns_api_token.age) { + cloudflare_dns_api_token = { + file = ../../secrets/cloudflare_dns_api_token.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs (builtins.pathExists ../../secrets/minecraft_rcon_password.age) { minecraft_rcon_password.file = ../../secrets/minecraft_rcon_password.age; @@ -1499,6 +1536,8 @@ in { fishPlugins.z androidSigningEnv matrixAndroidSecrets + cloudflareWorkerEnv + cloudflareDnsEnv ]; # environment.loginShellInit = '' diff --git a/secrets/cloudflare_dns_api_token.age b/secrets/cloudflare_dns_api_token.age new file mode 100644 index 0000000000000000000000000000000000000000..bae587781e66410003c243825467d3b6a7567db5 GIT binary patch literal 376 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?20CiZb@K zG;s+kOYsOZuE;LVGj{R{F3BqharMx4&92Pz&U7(~3d}QbcI0wQNeVYGHZnE!&NWFX z$u!C+%*gWh4=OD2aQDe^4oGt~E!H=VsxmeAb;MztNls!>m3gL9YEY(Iicg4fV0l`3 zMOaFyVOgemcAll1pSf9}vsu1-mVqOeN2FJBVwPE9M!1=eXMVZ1S8=|3kbk+ekw=Dh zMu~oYpr4m(sijGAWx6YuuCA_vcTQnxNlvi0M@X@@p@&;YVy0J_MPyh`p;L%auCb+C zVsc)xM_N^(X^9D!-r9{AZZgVutYPqbs;}J#snu@@r9x^oG9Q7Ja@?D=q{W z?fSXrRqxeL7H5OpP9J4F`mFIo{iOt@^QD<-DqMMLEVF-4Q{gnPw(jFdWYGQ}^_~>~ DZ=#3! literal 0 HcmV?d00001 diff --git a/secrets/cloudflare_worker_api_token.age b/secrets/cloudflare_worker_api_token.age new file mode 100644 index 0000000000000000000000000000000000000000..cdd3f98894536d772fa85e4cc58f573b67bb4d59 GIT binary patch literal 376 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?00$&vlOS zjxaJX_bboLF7`8yNVY8XHp}u)4X~`r%FfIzOH3;W)h|vfPv^?ePV)&V&q}E<4GOj_ z$#BXqFf0rY@h}aEjL0-E&4~=l_cbm}^D_^2NycHDL8P}?c#xl=VPQalTb6l&NqL1| zSb0>rleUScg??IMrgmYrX<$j9YehPjONe85YO%R%xVDjVRYXxzM!08sh>5vJZiaq| zNq)FRpmtbla;j0NkwG?>uCA_vTaJOgb4IX5NN7k{N@{RYgpq|$g}Gynzd@D1OHfg% zagv{*cS(l6p}q;1a*^tZZA_06?r+^B;&_|$$T9QBEK>{H=Qc#IvGvHV>0bJ1w$QG{ zyMA!@?R}umU|u0tu(*IL`4RV@b=SL}E54ui&FIc{A!nx3TKqcy=ifV;6>wLv`e+aU Dc~FL` literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index cd93163..c3ae664 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -16,7 +16,8 @@ in { "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; - "secrets/cloudflare_bootstrap_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/cloudflare_worker_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/cloudflare_dns_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];