pinpox/infra
1
0
Fork 0
forked from pub-solar/infra
Code Pull requests Activity

Merge pull request 'feat: format with nixpkgs-fmt' (#103) from feat/nixpkgs-fmt into main

Browse source 
Reviewed-on: pub-solar/infra#103
Reviewed-by: Akshay Mankar <axeman@noreply.git.pub.solar>
This commit is contained in:
teutat3s 2024-01-28 23:19:13 +00:00
parent 0c5a42cb67 3c7a434b0d
commit 9e80c52965
Signed by: pub.solar gitea
GPG key ID: F0332B04B7054873
44 changed files with 564 additions and 553 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.git-blame-ignore-revs Normal file
View file

@ -0,0 +1,2 @@
# Apply treewide formatting with nixpkgs-fmt
815033c764660e1468b1564a02570bad0f84f77a

3
flake.nix
View file

@ -80,7 +80,8 @@
flake =
let
username = "barkeeper";
in {
in
{
inherit username;
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;

11
hosts/flora-6/apps/caddy.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}:
{
systemd.tmpfiles.rules = [

17
hosts/flora-6/apps/drone.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
age.secrets.drone-secrets = {
file = "${flake.self}/secrets/drone-secrets.age";
@ -31,10 +30,12 @@
"d '/var/lib/drone-db' 0750 drone drone - -"
];
systemd.services."docker-network-drone" = let
systemd.services."docker-network-drone" =
let
docker = config.virtualisation.oci-containers.backend;
dockerBin = "${pkgs.${docker}}/bin/${docker}";
in {
in
{
serviceConfig.Type = "oneshot";
before = [ "docker-drone-server.service" ];
script = ''

11
hosts/flora-6/apps/forgejo-actions-runner.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
age.secrets.forgejo-actions-runner-token = {
file = "${flake.self}/secrets/forgejo-actions-runner-token.age";

11
hosts/flora-6/apps/grafana.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
age.secrets.grafana-admin-password = {
file = "${flake.self}/secrets/grafana-admin-password.age";

11
hosts/flora-6/apps/loki.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
# source: https://gist.github.com/rickhull/895b0cb38fdd537c1078a858cf15d63e
# https://grafana.com/docs/loki/latest/configure/examples/#1-local-configuration-exampleyaml

11
hosts/flora-6/apps/prometheus.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
age.secrets.nachtigall-metrics-prometheus-basic-auth-password = {
file = "${flake.self}/secrets/nachtigall-metrics-prometheus-basic-auth-password.age";

17
hosts/flora-6/configuration.nix
View file

@ -1,12 +1,13 @@
{
config,
lib,
pkgs,
flake,
...
}: let
{ config
, lib
, pkgs
, flake
, ...
}:
let
psCfg = config.pub-solar;
in {
in
{
config = {
# Override nix.conf for more agressive garbage collection
nix.extraOptions = lib.mkForce ''

3
hosts/flora-6/default.nix
View file

@ -2,7 +2,8 @@
{
imports =
[ # Include the results of the hardware scan.
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./configuration.nix
./triton-vmtools.nix

11
hosts/flora-6/hardware-configuration.nix
View file

@ -1,12 +1,11 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
{ config
, lib
, pkgs
, modulesPath
, ...
}: {
imports = [ ];

7
hosts/flora-6/triton-vmtools.nix
View file

@ -1,7 +1,6 @@
{
pkgs,
flake,
...
{ pkgs
, flake
, ...
}: {
environment.systemPackages = with pkgs; [
flake.inputs.triton-vmtools.packages.${pkgs.system}.default

11
hosts/nachtigall/apps/collabora.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
self,
...
{ config
, lib
, pkgs
, self
, ...
}: {
services.nginx.virtualHosts."collabora.pub.solar" = {
enableACME = true;

6
hosts/nachtigall/apps/coturn.nix
View file

@ -21,7 +21,8 @@
let
externalIPv4s = lib.strings.concatMapStringsSep "\n" ({ address, ... }: "external-ip=${address}") config.networking.interfaces.enp35s0.ipv4.addresses;
externalIPv6s = lib.strings.concatMapStringsSep "\n" ({ address, ... }: "external-ip=${address}") config.networking.interfaces.enp35s0.ipv6.addresses;
in ''
in
''
${externalIPv4s}
${externalIPv6s}
@ -64,7 +65,8 @@
};
networking.firewall = {
interfaces.enp35s0 = let
interfaces.enp35s0 =
let
range = with config.services.coturn; [{
from = min-port;
to = max-port;

11
hosts/nachtigall/apps/forgejo.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
age.secrets.forgejo-database-password = {
file = "${flake.self}/secrets/forgejo-database-password.age";

11
hosts/nachtigall/apps/keycloak.nix
View file

@ -1,9 +1,8 @@
{
flake,
config,
lib,
pkgs,
...
{ flake
, config
, lib
, pkgs
, ...
}: {
age.secrets.keycloak-database-password = {
file = "${flake.self}/secrets/keycloak-database-password.age";

11
hosts/nachtigall/apps/mailman.nix
View file

@ -1,9 +1,8 @@
{
flake,
config,
lib,
pkgs,
...
{ flake
, config
, lib
, pkgs
, ...
}:
{
networking.firewall.allowedTCPPorts = [ 25 ];

3
hosts/nachtigall/apps/matrix/irc.nix
View file

@ -90,7 +90,8 @@
sendConnectionMessages = true;
ssl = true;
};
in {
in
{
"irc.libera.chat" = lib.attrsets.recursiveUpdate commonConfig {
name = "libera";
dynamicChannels.groupId = "+libera.chat:localhost";

3
hosts/nachtigall/apps/matrix/synapse.nix
View file

@ -2,7 +2,8 @@
let
publicDomain = "matrix.pub.solar";
serverDomain = "pub.solar";
in {
in
{
age.secrets."matrix-synapse-signing-key" = {
file = "${flake.self}/secrets/matrix-synapse-signing-key.age";
mode = "400";

17
hosts/nachtigall/apps/mediawiki.nix
View file

@ -1,10 +1,10 @@
{
flake,
config,
lib,
pkgs,
...
}: let
{ flake
, config
, lib
, pkgs
, ...
}:
let
localSettingsPHP = pkgs.writeScript "LocalSettings.php" ''
<?php
# Protect against web entry
@ -154,7 +154,8 @@
uid = 986;
gid = 984;
in {
in
{
age.secrets.mediawiki-database-password = {
file = "${flake.self}/secrets/mediawiki-database-password.age";
path = "/run/mediawiki/database-password";

9
hosts/nachtigall/apps/nextcloud.nix
View file

@ -1,8 +1,7 @@
{
config,
pkgs,
flake,
...
{ config
, pkgs
, flake
, ...
}:
{
age.secrets."nextcloud-secrets" = {

6
hosts/nachtigall/apps/nginx-mastodon.nix
View file

@ -46,10 +46,12 @@ in
least_conn;
'';
servers = builtins.listToAttrs
(map (i: {
(map
(i: {
name = "unix:/run/mastodon-streaming/streaming-${toString i}.socket";
value = { };
}) (lib.range 1 cfg.streamingProcesses));
})
(lib.range 1 cfg.streamingProcesses));
};
};
}

3
hosts/nachtigall/apps/nginx-matrix.nix
View file

@ -128,7 +128,8 @@ in
port = 8448;
addr = "0.0.0.0";
ssl = true;
} {
}
{
port = 8448;
addr = "[::]";
ssl = true;

17
hosts/nachtigall/apps/nginx.nix
View file

@ -1,13 +1,14 @@
{
config,
lib,
pkgs,
self,
...
}: let
{ config
, lib
, pkgs
, self
, ...
}:
let
acmeEmailAddress = "admins@pub.solar";
webserverGroup = "hakkonaut";
in {
in
{
services.nginx = {
enable = true;
group = webserverGroup;

11
hosts/nachtigall/apps/owncast.nix
View file

@ -1,9 +1,8 @@
{
flake,
config,
lib,
pkgs,
...
{ flake
, config
, lib
, pkgs
, ...
}: {
services.nginx.virtualHosts."stream.pub.solar" = {
enableACME = true;

5
hosts/nachtigall/apps/prometheus-exporters.nix
View file

@ -1,6 +1,5 @@
{
config,
...
{ config
, ...
}: {
services.prometheus = {
exporters = {

11
hosts/nachtigall/apps/promtail.nix
View file

@ -1,9 +1,8 @@
{
config,
lib,
pkgs,
flake,
...
{ config
, lib
, pkgs
, flake
, ...
}: {
age.secrets.nachtigall-metrics-prometheus-basic-auth-password = {
file = "${flake.self}/secrets/nachtigall-metrics-prometheus-basic-auth-password.age";

11
hosts/nachtigall/apps/searx.nix
View file

@ -1,9 +1,8 @@
{
flake,
config,
lib,
pkgs,
...
{ flake
, config
, lib
, pkgs
, ...
}:
{
age.secrets.searx-environment = {

9
hosts/nachtigall/configuration.nix
View file

@ -1,8 +1,7 @@
{
flake,
config,
pkgs,
...
{ flake
, config
, pkgs
, ...
}: {
# Use GRUB2 as the boot loader.
# We don't use systemd-boot because Hetzner uses BIOS legacy boot.

3
hosts/nachtigall/default.nix
View file

@ -2,7 +2,8 @@
{
imports =
[ # Include the results of the hardware scan.
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./configuration.nix

21
hosts/nachtigall/hardware-configuration.nix
View file

@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "ahci" "nvme" ];
@ -14,32 +15,38 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "root_pool/root";
{
device = "root_pool/root";
fsType = "zfs";
};
fileSystems."/var/lib" =
{ device = "root_pool/data";
{
device = "root_pool/data";
fsType = "zfs";
};
fileSystems."/var/lib/postgresql" =
{ device = "root_pool/data/postgresql";
{
device = "root_pool/data/postgresql";
fsType = "zfs";
};
fileSystems."/var/lib/docker" =
{ device = "root_pool/data/docker";
{
device = "root_pool/data/docker";
fsType = "zfs";
};
fileSystems."/boot1" =
{ device = "/dev/disk/by-uuid/5493-EFF5";
{
device = "/dev/disk/by-uuid/5493-EFF5";
fsType = "vfat";
};
fileSystems."/boot2" =
{ device = "/dev/disk/by-uuid/5494-BA1E";
{
device = "/dev/disk/by-uuid/5494-BA1E";
fsType = "vfat";
};

3
lib/compat/nixos/default.nix
View file

@ -1,4 +1,5 @@
{...}: let
{ ... }:
let
inherit (default.inputs.nixos) lib;
host = configs.${hostname} or configs.PubSolarOS;

6
lib/default.nix
View file

@ -1,9 +1,11 @@
{ self, lib, inputs, ... }: {
# Configuration common to all Linux systems
flake = {
lib = let
lib =
let
callLibs = file: import file { inherit lib; };
in rec {
in
rec {
## Define your own library functions here!
#id = x: x;
## Or in files, containing functions that take {lib}

9
lib/deploy.nix
View file

@ -5,7 +5,8 @@
* Licensed under the MIT license
*/
{ lib, inputs }: let
{ lib, inputs }:
let
# https://github.com/serokell/deploy-rs#overall-usage
system = "x86_64-linux";
pkgs = import inputs.nixpkgs { inherit system; };
@ -16,7 +17,8 @@
(self: super: { deploy-rs = { inherit (pkgs) deploy-rs; lib = super.deploy-rs.lib; }; })
];
};
getFqdn = c: let
getFqdn = c:
let
net = c.config.networking;
fqdn =
if (net ? domain) && (net.domain != null)
@ -24,7 +26,8 @@
else net.hostName;
in
fqdn;
in {
in
{
mkDeployNodes = systemConfigurations: extraConfig:
/*
*

11
modules/nix.nix
View file

@ -1,9 +1,8 @@
{
config,
pkgs,
lib,
flake,
...
{ config
, pkgs
, lib
, flake
, ...
}: {
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
];

7
overlays/default.nix
View file

@ -1,7 +1,6 @@
{
self,
inputs,
...
{ self
, inputs
, ...
}: {
flake = {
nixosModules = rec {

3
secrets/secrets.nix
View file

@ -24,7 +24,8 @@ let
flora6Keys = [
flora-6-host
];
in {
in
{
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBB5XaH02a6+TchnyQED2VwaltPgeFCbildbE2h6nF5e root@nachtigall
"nachtigall-root-ssh-key.age".publicKeys = nachtigallKeys ++ baseKeys;