atagen/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

current

Browse source 
linted
This commit is contained in:
atagen 2025-02-02 16:57:31 +11:00
parent 4e99a0e323
commit 7485de646a
95 changed files with 2743 additions and 2282 deletions
Download patch file Download diff file Expand all files Collapse all files

78
system/servers/atagen-vps/reflector.nix
View file

@ -2,11 +2,11 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{
lib,
config,
pkgs,
...
}: let
}:
let
wekan-compose = pkgs.fetchurl {
url = "https://github.com/wekan/wekan/raw/v6.68/docker-compose.yml";
sha256 = "sha256-gLZ8bZZ8ZMo1NGz3ooIgXRH6JuMoEMp+to7lfqAvc6E=";
@ -18,18 +18,15 @@
# sed -i 's/80:8080/7897:8080/g' $out
# sed -i 's/ROOT_URL=.*/ROOT_URL=https:\/\/reflector\.beam\/kanban\//' $out
# '';
wekan-rhizome = pkgs.runCommand "wekan-rhizome" {} ''
wekan-rhizome = pkgs.runCommand "wekan-rhizome" { } ''
cp ${wekan-compose} $out
sed -i '/localtime/d' $out
sed -i '/timezone/d' $out
sed -i 's/80:8080/7897:8080/g' $out
sed -i 's/ROOT_URL=.*/ROOT_URL=https:\/\/board\.rhizome\.tf\//' $out
'';
foswiki-compose = pkgs.fetchurl {
url = "https://raw.githubusercontent.com/timlegge/docker-foswiki/master/docker-compose.1-simple.yml";
sha256 = "sha256-XqGWGTZ/URKsIdDEEpBQUK7xoIdZ164lRhHEiWdnKpM=";
};
in {
in
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
@ -41,7 +38,10 @@ in {
# "nix-community"
# ];
nix.settings.experimental-features = ["flakes" "nix-command"];
nix.settings.experimental-features = [
"flakes"
"nix-command"
];
# systemd.services.NetworkManager-wait-online.enable = false;
# Use the GRUB 2 boot loader.
@ -58,8 +58,8 @@ in {
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.sunshine = {
isNormalUser = true;
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
packages = with pkgs; [];
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
packages = with pkgs; [ ];
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSQC8VgKLzoU5BSynJJuC8BFqAEN8JlSIzsZ2Vg9rfXHM7T4vbWtnxSCSbNw3CEnZCfrdDQTeRum7Uq+gvrcHWd9Aj+rVmubTdud70ybW7T7SlGv3b5TYBhMNbrAz0JIJjLnFMy3/pWids1v6mKW3i7k6Kbq8fSt7jva5Yg5x1jtkUUwvjSZjPg/E/Zl0hAcnx8fWe4foFTcYYsUbfEpp6bxdN2QuVmb17UKnLrMz6JTj88Jd2uYZkeKxGOwk+uwrd0WArY8JIiRi1NcPA3I42aAQfZKxCUY/xmVyRlF+l6K8caD4CZlysms9aXQzBhmPPDIY87AwyRlVK5JsRbaMEBMsffX2xk8DdV+2+9RbztgeXOoYk7WjJX1/+WcxY3RGn8QsUfrGALmrQTRGXgYRbtM/ZJq1m9aP6IvVQeKE1NOpKguXpmokB7JsyKPcWk/PCMVYyXM/qYspc6hRPJgGWiJsayj7myO6X5Ssl9uQnHpNNyrQNY+cx3/boBu2J1sM= bolt@quiver"
];
@ -113,7 +113,11 @@ in {
enable = true;
serverUrl = "https://net.atagen.co";
dns = {
nameservers = ["103.1.206.179" "168.138.8.38" "168.138.12.137"];
nameservers = [
"103.1.206.179"
"168.138.8.38"
"168.138.12.137"
];
magicDns = true;
};
};
@ -147,27 +151,33 @@ in {
isSystemUser = true;
createHome = true;
group = "ci";
extraGroups = ["docker" "wheel"];
extraGroups = [
"docker"
"wheel"
];
};
users.groups.ci = {};
users.groups.ci = { };
users.users.ci-agent = {
isSystemUser = true;
createHome = true;
group = "ci";
extraGroups = ["docker" "wheel"];
extraGroups = [
"docker"
"wheel"
];
};
users.groups.ci = {};
users.groups.ci = { };
users.users.dufs = {
isSystemUser = true;
createHome = true;
group = "dufs";
};
users.groups.dufs = {};
users.groups.dufs = { };
systemd.services.woodpecker-server = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "woodpecker CI/CD server";
serviceConfig = {
Environment = [
@ -191,7 +201,7 @@ in {
};
systemd.services.woodpecker-agent = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "woodpecker CI/CD agent";
serviceConfig = {
Environment = [
@ -218,9 +228,12 @@ in {
# };
systemd.services.wekan-rhizome = {
wantedBy = ["multi-user.target"];
after = ["network.target" "docker.service"];
requires = ["docker.service"];
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"docker.service"
];
requires = [ "docker.service" ];
description = "wekan kanban board for rhizomers";
serviceConfig = {
Restart = "always";
@ -231,8 +244,8 @@ in {
};
systemd.services.dufs = {
wantedBy = ["multi-user.target"];
after = ["network.target"];
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
description = "dufs webdav server";
serviceConfig = {
User = "dufs";
@ -258,7 +271,7 @@ in {
enable = true;
virtualHosts = {
"atagen.co" = {
serverAliases = ["www.atagen.co"];
serverAliases = [ "www.atagen.co" ];
extraConfig = ''
respond "i live.. again"
'';
@ -318,10 +331,19 @@ in {
networking.firewall = {
enable = true;
trustedInterfaces = ["tailscale0"];
trustedInterfaces = [ "tailscale0" ];
checkReversePath = "loose";
allowedTCPPorts = [80 443 6660];
allowedUDPPorts = [80 443 41641 6660];
allowedTCPPorts = [
80
443
6660
];
allowedUDPPorts = [
80
443
41641
6660
];
};
# Copy the NixOS configuration file and link it from the resulting system

49
system/servers/rhizome-vps/configuration.nix
View file

@ -2,30 +2,33 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running `nixos-help`).
{
config,
pkgs,
lib,
...
}: {
}:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
];
nix.settings.experimental-features = ["nix-command" "flakes"];
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.extraOptions = ''
keep-outputs = true
keep-derivations = true
'';
environment.pathsToLink = ["/share/zsh"];
environment.pathsToLink = [ "/share/zsh" ];
programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh;
users.users.felix = {
isSystemUser = true;
group = "www";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
};
users.users.spore = {
@ -34,14 +37,18 @@
createHome = true;
useDefaultShell = true;
group = "www";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9VRcCnmjCyV7DpCm8ir3+xPTbyMDBJhgSkhpmdFL5d spore@server.rhizome.tf"
];
};
users.groups.www = {
members = ["acme" "felix" "spore"];
members = [
"acme"
"felix"
"spore"
];
};
boot.loader.grub.enable = true;
@ -54,7 +61,7 @@
users.users.rhizome = {
isNormalUser = true;
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSQC8VgKLzoU5BSynJJuC8BFqAEN8JlSIzsZ2Vg9rfXHM7T4vbWtnxSCSbNw3CEnZCfrdDQTeRum7Uq+gvrcHWd9Aj+rVmubTdud70ybW7T7SlGv3b5TYBhMNbrAz0JIJjLnFMy3/pWids1v6mKW3i7k6Kbq8fSt7jva5Yg5x1jtkUUwvjSZjPg/E/Zl0hAcnx8fWe4foFTcYYsUbfEpp6bxdN2QuVmb17UKnLrMz6JTj88Jd2uYZkeKxGOwk+uwrd0WArY8JIiRi1NcPA3I42aAQfZKxCUY/xmVyRlF+l6K8caD4CZlysms9aXQzBhmPPDIY87AwyRlVK5JsRbaMEBMsffX2xk8DdV+2+9RbztgeXOoYk7WjJX1/+WcxY3RGn8QsUfrGALmrQTRGXgYRbtM/ZJq1m9aP6IvVQeKE1NOpKguXpmokB7JsyKPcWk/PCMVYyXM/qYspc6hRPJgGWiJsayj7myO6X5Ssl9uQnHpNNyrQNY+cx3/boBu2J1sM= bolt@quiver"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDW/YjnlHiEf2bV0RapVl+jWEtsNYrbXsaJJhXUkAaf61rsTZ2jpda7FmOVGjyJiOkTNYANoT83YhGxvKt3Ukcx5xG0JhcrilEGKfOR43/QLlXetCh4aFed//CXYNQo8obDovx9A8YamzfZWJo0nhshEAt1aDvNGlyPgHZI3r5vYNB6OpMlaSnr873i5hp6S9dxURoF0FjpdZwTWk5DiYUoZCezs6TfG6PzHbSsB88o4AUNZ6O+h1KD0lITSXH/v/M1zG8fkUzfZHFQoZ6VaIMhIVwLmbybvyb630IIfhx6KUoCWzCRlKBjVOGsQ1xZWEnjPgHB6atX5eNc/L8/bdyZOJ4aE2wSdVNMyriYuiyc3t/RwSvcRpfmzaxWUImDpjH3mxCrDymrZIQQTrNuC6o5O3mz3NCZRcFUZmuZXeYphyrzuNgAfsvHKMd8Fu+PdddSPCHkgYEIRuGD4flaujM8eUHZYqKkpmmiMwKk6jupBscN+1uwBqGQbaR0InXR+4c= custard"
@ -65,17 +72,17 @@
isSystemUser = true;
createHome = true;
group = "ci";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
};
users.users.ci-agent = {
isSystemUser = true;
createHome = true;
group = "ci";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
};
users.groups.ci = {};
users.groups.ci = { };
virtualisation = {
docker.enable = true;
@ -137,7 +144,7 @@
};
systemd.services.woodpecker-server = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "woodpecker CI/CD server";
serviceConfig = {
Environment = [
@ -161,7 +168,7 @@
};
systemd.services.woodpecker-agent = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "woodpecker CI/CD agent";
serviceConfig = {
Environment = [
@ -175,7 +182,7 @@
};
systemd.services.felix = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "gilles on testing";
serviceConfig = {
ExecStart = ''${lib.getExe pkgs.docker} run --network host -v /var/lib/acme/rhizome.tf:/var/lib/acme/rhizome.tf --env-file /var/www/felix_env git.rhizome.tf/rhizome/gilles:latest'';
@ -250,8 +257,18 @@
permitRootLogin = "no";
};
networking.firewall.allowedTCPPorts = [22 80 443 5539 5559 6660];
networking.firewall.allowedUDPPorts = [443 6660];
networking.firewall.allowedTCPPorts = [
22
80
443
5539
5559
6660
];
networking.firewall.allowedUDPPorts = [
443
6660
];
security.acme = {
acceptTerms = true;

58
system/servers/rhizome-vps/flake.nix
View file

@ -21,33 +21,33 @@
};
};
outputs = {
self,
nixpkgs,
home-manager,
nix-index-database,
...
} @ inputs: let
inherit (self) outputs;
forAllSystems = nixpkgs.lib.genAttrs [
"x86_64-linux"
];
in rec {
nixosConfigurations = {
"filament" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {inherit inputs outputs;};
modules = [
./configuration.nix
nix-index-database.nixosModules.nix-index
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.extraSpecialArgs = {inherit inputs outputs;};
home-manager.users.rhizome.imports = [./rhizome.nix];
} # hm
]; # modules
}; # filament
};
}; # rec
outputs =
{
self,
nixpkgs,
home-manager,
nix-index-database,
...
}@inputs:
let
inherit (self) outputs;
in
rec {
nixosConfigurations = {
"filament" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs outputs; };
modules = [
./configuration.nix
nix-index-database.nixosModules.nix-index
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.extraSpecialArgs = { inherit inputs outputs; };
home-manager.users.rhizome.imports = [ ./rhizome.nix ];
} # hm
]; # modules
}; # filament
};
}; # rec
}

24
system/servers/rhizome-vps/hardware-configuration.nix
View file

@ -2,25 +2,29 @@
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [];
}:
{
imports = [ ];
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"];
boot.initrd.kernelModules = [];
boot.kernelModules = [];
boot.extraModulePackages = [];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"sr_mod"
"virtio_blk"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/f4889546-f71c-4e3c-ab47-e183a72dc52e";
fsType = "ext4";
};
swapDevices = [];
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's

7
system/servers/rhizome-vps/rhizome.nix
View file

@ -1,11 +1,8 @@
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
}:
{
home.packages = with pkgs; [
lazygit
alejandra