atagen/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

current

Browse source 
linted
This commit is contained in:
atagen 2025-02-02 16:57:31 +11:00
parent 4e99a0e323
commit 7485de646a
95 changed files with 2743 additions and 2282 deletions
Download patch file Download diff file Expand all files Collapse all files

49
system/servers/rhizome-vps/configuration.nix
View file

@ -2,30 +2,33 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running `nixos-help`).
{
config,
pkgs,
lib,
...
}: {
}:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
];
nix.settings.experimental-features = ["nix-command" "flakes"];
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.extraOptions = ''
keep-outputs = true
keep-derivations = true
'';
environment.pathsToLink = ["/share/zsh"];
environment.pathsToLink = [ "/share/zsh" ];
programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh;
users.users.felix = {
isSystemUser = true;
group = "www";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
};
users.users.spore = {
@ -34,14 +37,18 @@
createHome = true;
useDefaultShell = true;
group = "www";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9VRcCnmjCyV7DpCm8ir3+xPTbyMDBJhgSkhpmdFL5d spore@server.rhizome.tf"
];
};
users.groups.www = {
members = ["acme" "felix" "spore"];
members = [
"acme"
"felix"
"spore"
];
};
boot.loader.grub.enable = true;
@ -54,7 +61,7 @@
users.users.rhizome = {
isNormalUser = true;
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSQC8VgKLzoU5BSynJJuC8BFqAEN8JlSIzsZ2Vg9rfXHM7T4vbWtnxSCSbNw3CEnZCfrdDQTeRum7Uq+gvrcHWd9Aj+rVmubTdud70ybW7T7SlGv3b5TYBhMNbrAz0JIJjLnFMy3/pWids1v6mKW3i7k6Kbq8fSt7jva5Yg5x1jtkUUwvjSZjPg/E/Zl0hAcnx8fWe4foFTcYYsUbfEpp6bxdN2QuVmb17UKnLrMz6JTj88Jd2uYZkeKxGOwk+uwrd0WArY8JIiRi1NcPA3I42aAQfZKxCUY/xmVyRlF+l6K8caD4CZlysms9aXQzBhmPPDIY87AwyRlVK5JsRbaMEBMsffX2xk8DdV+2+9RbztgeXOoYk7WjJX1/+WcxY3RGn8QsUfrGALmrQTRGXgYRbtM/ZJq1m9aP6IvVQeKE1NOpKguXpmokB7JsyKPcWk/PCMVYyXM/qYspc6hRPJgGWiJsayj7myO6X5Ssl9uQnHpNNyrQNY+cx3/boBu2J1sM= bolt@quiver"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDW/YjnlHiEf2bV0RapVl+jWEtsNYrbXsaJJhXUkAaf61rsTZ2jpda7FmOVGjyJiOkTNYANoT83YhGxvKt3Ukcx5xG0JhcrilEGKfOR43/QLlXetCh4aFed//CXYNQo8obDovx9A8YamzfZWJo0nhshEAt1aDvNGlyPgHZI3r5vYNB6OpMlaSnr873i5hp6S9dxURoF0FjpdZwTWk5DiYUoZCezs6TfG6PzHbSsB88o4AUNZ6O+h1KD0lITSXH/v/M1zG8fkUzfZHFQoZ6VaIMhIVwLmbybvyb630IIfhx6KUoCWzCRlKBjVOGsQ1xZWEnjPgHB6atX5eNc/L8/bdyZOJ4aE2wSdVNMyriYuiyc3t/RwSvcRpfmzaxWUImDpjH3mxCrDymrZIQQTrNuC6o5O3mz3NCZRcFUZmuZXeYphyrzuNgAfsvHKMd8Fu+PdddSPCHkgYEIRuGD4flaujM8eUHZYqKkpmmiMwKk6jupBscN+1uwBqGQbaR0InXR+4c= custard"
@ -65,17 +72,17 @@
isSystemUser = true;
createHome = true;
group = "ci";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
};
users.users.ci-agent = {
isSystemUser = true;
createHome = true;
group = "ci";
extraGroups = ["docker"];
extraGroups = [ "docker" ];
};
users.groups.ci = {};
users.groups.ci = { };
virtualisation = {
docker.enable = true;
@ -137,7 +144,7 @@
};
systemd.services.woodpecker-server = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "woodpecker CI/CD server";
serviceConfig = {
Environment = [
@ -161,7 +168,7 @@
};
systemd.services.woodpecker-agent = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "woodpecker CI/CD agent";
serviceConfig = {
Environment = [
@ -175,7 +182,7 @@
};
systemd.services.felix = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
description = "gilles on testing";
serviceConfig = {
ExecStart = ''${lib.getExe pkgs.docker} run --network host -v /var/lib/acme/rhizome.tf:/var/lib/acme/rhizome.tf --env-file /var/www/felix_env git.rhizome.tf/rhizome/gilles:latest'';
@ -250,8 +257,18 @@
permitRootLogin = "no";
};
networking.firewall.allowedTCPPorts = [22 80 443 5539 5559 6660];
networking.firewall.allowedUDPPorts = [443 6660];
networking.firewall.allowedTCPPorts = [
22
80
443
5539
5559
6660
];
networking.firewall.allowedUDPPorts = [
443
6660
];
security.acme = {
acceptTerms = true;

58
system/servers/rhizome-vps/flake.nix
View file

@ -21,33 +21,33 @@
};
};
outputs = {
self,
nixpkgs,
home-manager,
nix-index-database,
...
} @ inputs: let
inherit (self) outputs;
forAllSystems = nixpkgs.lib.genAttrs [
"x86_64-linux"
];
in rec {
nixosConfigurations = {
"filament" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {inherit inputs outputs;};
modules = [
./configuration.nix
nix-index-database.nixosModules.nix-index
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.extraSpecialArgs = {inherit inputs outputs;};
home-manager.users.rhizome.imports = [./rhizome.nix];
} # hm
]; # modules
}; # filament
};
}; # rec
outputs =
{
self,
nixpkgs,
home-manager,
nix-index-database,
...
}@inputs:
let
inherit (self) outputs;
in
rec {
nixosConfigurations = {
"filament" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs outputs; };
modules = [
./configuration.nix
nix-index-database.nixosModules.nix-index
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.extraSpecialArgs = { inherit inputs outputs; };
home-manager.users.rhizome.imports = [ ./rhizome.nix ];
} # hm
]; # modules
}; # filament
};
}; # rec
}

24
system/servers/rhizome-vps/hardware-configuration.nix
View file

@ -2,25 +2,29 @@
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [];
}:
{
imports = [ ];
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"];
boot.initrd.kernelModules = [];
boot.kernelModules = [];
boot.extraModulePackages = [];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"sr_mod"
"virtio_blk"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/f4889546-f71c-4e3c-ab47-e183a72dc52e";
fsType = "ext4";
};
swapDevices = [];
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's

7
system/servers/rhizome-vps/rhizome.nix
View file

@ -1,11 +1,8 @@
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
}:
{
home.packages = with pkgs; [
lazygit
alejandra