These are my notes on how to set up GPG with the private key stored on the hardware Yubikey. This will reduce the chances of your GPG private key from being stolen, and also allow you to protect other secrets such as SSH private keys.
It's just some notes and a partial worklog for now, but I may turn it into a full blog post later.
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: nginx-conf | |
| data: | |
| nginx.conf: | | |
| user nginx; | |
| worker_processes 3; | |
| error_log /var/log/nginx/error.log; | |
| events { |
| version: '2.1' | |
| services: | |
| php: | |
| tty: true | |
| build: | |
| context: . | |
| dockerfile: tests/Docker/Dockerfile-PHP | |
| args: | |
| version: cli | |
| volumes: |
| #!/bin/sh | |
| # Copyright 2020 Paul Morgan | |
| # License: GPLv2 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) | |
| set -x | |
| set -e | |
| # | |
| # Docker build calls this script to harden the image during build. | |
| # | |
| # NOTE: To build on CircleCI, you must take care to keep the `find` | |
| # command out of the /proc filesystem to avoid errors like: |
| [Unit] | |
| Description=MongoDB Database Service | |
| Wants=network.target | |
| After=network.target | |
| [Service] | |
| Type=forking | |
| PIDFile=/var/run/mongodb/mongod.pid | |
| ExecStart=/usr/local/bin/mongod --config /etc/mongod.conf | |
| ExecReload=/bin/kill -HUP $MAINPID |