Merge pull request 'flora-6: remove' (#234) from remove-flora-6-sad-face into main
Reviewed-on: #234 Reviewed-by: teutat3s <teutat3s@noreply.git.pub.solar>
This commit is contained in:
commit
2e5a7bea4b
|
@ -63,12 +63,6 @@ Example NixOS snippet for WireGuard client config
|
|||
#endpoint = "138.201.80.102:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
{ # flora-6.pub.solar
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
allowedIPs = [ "10.7.6.2/32" "fd00:fae:fae:fae:fae:2::/96" ];
|
||||
endpoint = "80.71.153.210:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
{ # metronom.pub.solar
|
||||
publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
|
||||
allowedIPs = [ "10.7.6.3/32" "fd00:fae:fae:fae:fae:3::/96" ];
|
||||
|
|
|
@ -13,12 +13,6 @@ For nachtigall.pub.solar:
|
|||
deploy --targets '.#nachtigall' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
|
||||
```
|
||||
|
||||
For flora-6.pub.solar:
|
||||
|
||||
```
|
||||
deploy --targets '.#flora-6' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
|
||||
```
|
||||
|
||||
For metronom.pub.solar (aarch64-linux):
|
||||
|
||||
```
|
||||
|
|
27
docs/dns.md
27
docs/dns.md
|
@ -1,18 +1,10 @@
|
|||
# Changing DNS entries
|
||||
|
||||
Our current DNS provider is [namecheap](https://www.namecheap.com/).
|
||||
We use [Terraform](https://www.terraform.io) to declaratively manage our pub.solar DNS records.
|
||||
We use [OpenTofu](https://opentofu.org) to declaratively manage our pub.solar DNS records.
|
||||
|
||||
### Initial setup
|
||||
|
||||
Skip this step if you already have a `triton` profile setup.
|
||||
|
||||
```
|
||||
triton profile create
|
||||
```
|
||||
|
||||
Please follow https://docs.greenbaum.cloud/en/devops/triton-cli.html for the details.
|
||||
|
||||
You will need to setup the following [namecheap API credentials](https://www.namecheap.com/support/api/intro),
|
||||
look for "namecheap API key" in the pub.solar Keepass database.
|
||||
|
||||
|
@ -28,13 +20,15 @@ You will probably also need to add your external IP to the [API allow list](http
|
|||
dig -4 ip @dns.toys
|
||||
```
|
||||
|
||||
Now, change into the terraform directory and initialize the terraform providers.
|
||||
Now, change into the terraform directory and initialize the terraform providers. To decrypt existing state,
|
||||
search for "terraform state passphrase" in the pub.solar Keepass database.
|
||||
|
||||
```
|
||||
cd terraform
|
||||
export TRITON_KEY_ID=$(cat ~/.config/triton/profiles.d/lev-1-pub_solar.json | jq --raw-output .keyId)
|
||||
export TF_VAR_state_passphrase=$(secret-tool lookup pub.solar terraform-state-passphrase-dns)
|
||||
|
||||
terraform init
|
||||
alias tofu="terraform-backend-git --access-logs --tf tofu git terraform"
|
||||
tofu init
|
||||
```
|
||||
|
||||
Make your changes, e.g. in `dns.tf`.
|
||||
|
@ -46,20 +40,21 @@ $EDITOR dns.tf
|
|||
Plan your changes using:
|
||||
|
||||
```
|
||||
terraform plan -out pub-solar-infra.plan
|
||||
tofu plan -out pub-solar-infra.plan
|
||||
```
|
||||
|
||||
After verification, apply your changes with:
|
||||
|
||||
```
|
||||
terraform apply "pub-solar-infra.plan"
|
||||
tofu apply "pub-solar-infra.plan"
|
||||
```
|
||||
|
||||
### Useful links
|
||||
|
||||
We use the Manta remote backend to save the terraform state for collaboration.
|
||||
We use terraform-backend-git remote backend with opentofu state encryption for collaboration.
|
||||
|
||||
- https://www.terraform.io/language/v1.2.x/settings/backends/manta
|
||||
- https://github.com/plumber-cd/terraform-backend-git
|
||||
- https://opentofu.org/docs/language/state/encryption
|
||||
|
||||
Namecheap Terraform provider docs:
|
||||
|
||||
|
|
|
@ -1,19 +0,0 @@
|
|||
# Drone CI
|
||||
|
||||
We currently use two CI systems, [drone CI](https://drone.io), reachable via
|
||||
https://ci.pub.solar and [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/),
|
||||
which UI is integrated into https://git.pub.solar, for example
|
||||
https://git.pub.solar/pub-solar/infra/actions.
|
||||
|
||||
### Signing the `.drone.yml` file
|
||||
|
||||
Login to https://ci.pub.solar by clicking on the user icon in the bottom left.
|
||||
After logging in, you can view your personal API token by clicking on the same
|
||||
icon. If you're using the nix [development-shell](./development-shell.md), the
|
||||
`drone` command will already be installed.
|
||||
|
||||
```
|
||||
export DRONE_TOKEN=<your-drone-api-token>
|
||||
|
||||
drone --token $DRONE_TOKEN sign --save pub-solar/os
|
||||
```
|
57
flake.lock
57
flake.lock
|
@ -234,21 +234,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"locked": {
|
||||
"lastModified": 1653893745,
|
||||
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
@ -364,22 +349,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-2205": {
|
||||
"locked": {
|
||||
"lastModified": 1685573264,
|
||||
"narHash": "sha256-Zffu01pONhs/pqH07cjlF10NnMDLok8ix5Uk4rhOnZQ=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "380be19fbd2d9079f677978361792cb25e8a3635",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-22.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1722555339,
|
||||
|
@ -406,9 +375,7 @@
|
|||
"nix-darwin": "nix-darwin",
|
||||
"nixos-flake": "nixos-flake",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-2205": "nixpkgs-2205",
|
||||
"simple-nixos-mailserver": "simple-nixos-mailserver",
|
||||
"triton-vmtools": "triton-vmtools",
|
||||
"unstable": "unstable"
|
||||
}
|
||||
},
|
||||
|
@ -514,30 +481,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"triton-vmtools": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_3",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"dir": "vmtools",
|
||||
"lastModified": 1698443513,
|
||||
"narHash": "sha256-wX2JIJ3JmJn6MAurdyjwZU+FZjLCwBArMrVSeeCb/ZU=",
|
||||
"ref": "main",
|
||||
"rev": "0d039dcf06afb8cbddd7ac54bae4d0d185f3e88e",
|
||||
"revCount": 85,
|
||||
"type": "git",
|
||||
"url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
|
||||
},
|
||||
"original": {
|
||||
"dir": "vmtools",
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
|
||||
}
|
||||
},
|
||||
"unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1724224976,
|
||||
|
|
12
flake.nix
12
flake.nix
|
@ -4,8 +4,6 @@
|
|||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
|
||||
unstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
|
||||
nixpkgs-2205.url = "github:nixos/nixpkgs/nixos-22.05";
|
||||
|
||||
nix-darwin.url = "github:lnl7/nix-darwin/master";
|
||||
nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
|
@ -29,9 +27,6 @@
|
|||
keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
|
||||
keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
|
||||
triton-vmtools.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
element-themes.url = "github:aaronraimist/element-themes/master";
|
||||
element-themes.flake = false;
|
||||
|
||||
|
@ -116,7 +111,8 @@
|
|||
shfmt
|
||||
treefmt
|
||||
nixos-generators
|
||||
inputs.nixpkgs-2205.legacyPackages.${system}.terraform
|
||||
inputs.unstable.legacyPackages.${system}.opentofu
|
||||
terraform-backend-git
|
||||
terraform-ls
|
||||
jq
|
||||
];
|
||||
|
@ -150,10 +146,6 @@
|
|||
hostname = "nachtigall.wg.pub.solar";
|
||||
sshUser = username;
|
||||
};
|
||||
flora-6 = {
|
||||
hostname = "flora-6.wg.pub.solar";
|
||||
sshUser = username;
|
||||
};
|
||||
metronom = {
|
||||
hostname = "metronom.wg.pub.solar";
|
||||
sshUser = username;
|
||||
|
|
|
@ -24,13 +24,15 @@ in
|
|||
privateKeyFile = config.age.secrets.wg-private-key.path;
|
||||
peers = flake.self.logins.admins.wireguardDevices ++ [
|
||||
{
|
||||
# flora-6.pub.solar
|
||||
endpoint = "80.71.153.210:51820";
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
# trinkgenossin.pub.solar
|
||||
publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
|
||||
allowedIPs = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
"10.7.6.5/32"
|
||||
"fd00:fae:fae:fae:fae:5::/96"
|
||||
];
|
||||
#endpoint = "80.244.242.5:51820";
|
||||
endpoint = "[2a01:239:35d:f500::1]:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
@ -43,25 +43,6 @@
|
|||
];
|
||||
};
|
||||
|
||||
flora-6 = self.nixos-flake.lib.mkLinuxSystem {
|
||||
imports = [
|
||||
self.inputs.agenix.nixosModules.default
|
||||
self.nixosModules.home-manager
|
||||
./flora-6
|
||||
self.nixosModules.overlays
|
||||
self.nixosModules.core
|
||||
self.nixosModules.backups
|
||||
|
||||
self.nixosModules.keycloak
|
||||
self.nixosModules.caddy
|
||||
self.nixosModules.drone
|
||||
self.nixosModules.forgejo-actions-runner
|
||||
self.nixosModules.grafana
|
||||
self.nixosModules.prometheus
|
||||
self.nixosModules.loki
|
||||
];
|
||||
};
|
||||
|
||||
metronom = self.nixos-flake.lib.mkLinuxSystem {
|
||||
imports = [
|
||||
self.inputs.agenix.nixosModules.default
|
||||
|
@ -97,14 +78,19 @@
|
|||
self.inputs.agenix.nixosModules.default
|
||||
self.nixosModules.home-manager
|
||||
./trinkgenossin
|
||||
self.nixosModules.backups
|
||||
self.nixosModules.overlays
|
||||
self.nixosModules.unlock-luks-on-boot
|
||||
self.nixosModules.core
|
||||
self.nixosModules.prometheus-exporters
|
||||
self.nixosModules.promtail
|
||||
|
||||
self.nixosModules.garage
|
||||
self.nixosModules.nginx
|
||||
|
||||
# This module is already using options, and those options are used by the grafana module
|
||||
self.nixosModules.keycloak
|
||||
self.nixosModules.grafana
|
||||
self.nixosModules.prometheus
|
||||
self.nixosModules.loki
|
||||
];
|
||||
};
|
||||
|
||||
|
@ -117,8 +103,8 @@
|
|||
self.nixosModules.overlays
|
||||
self.nixosModules.unlock-luks-on-boot
|
||||
self.nixosModules.core
|
||||
#self.nixosModules.prometheus-exporters
|
||||
#self.nixosModules.promtail
|
||||
self.nixosModules.prometheus-exporters
|
||||
self.nixosModules.promtail
|
||||
|
||||
self.nixosModules.garage
|
||||
self.nixosModules.nginx
|
||||
|
@ -134,8 +120,8 @@
|
|||
self.nixosModules.overlays
|
||||
self.nixosModules.unlock-luks-on-boot
|
||||
self.nixosModules.core
|
||||
#self.nixosModules.prometheus-exporters
|
||||
#self.nixosModules.promtail
|
||||
self.nixosModules.prometheus-exporters
|
||||
self.nixosModules.promtail
|
||||
|
||||
self.nixosModules.garage
|
||||
self.nixosModules.nginx
|
||||
|
|
|
@ -9,7 +9,7 @@
|
|||
|
||||
boot.kernelParams = [
|
||||
"boot.shell_on_fail=1"
|
||||
"ip=dhcp"
|
||||
"ip=5.255.119.132::5.255.119.1:255.255.255.0:delite::off"
|
||||
];
|
||||
|
||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||
|
|
|
@ -24,13 +24,15 @@ in
|
|||
privateKeyFile = config.age.secrets.wg-private-key.path;
|
||||
peers = flake.self.logins.admins.wireguardDevices ++ [
|
||||
{
|
||||
# flora-6.pub.solar
|
||||
endpoint = "80.71.153.210:51820";
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
# trinkgenossin.pub.solar
|
||||
publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
|
||||
allowedIPs = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
"10.7.6.5/32"
|
||||
"fd00:fae:fae:fae:fae:5::/96"
|
||||
];
|
||||
#endpoint = "80.244.242.5:51820";
|
||||
endpoint = "[2a01:239:35d:f500::1]:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
@ -1,72 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
psCfg = config.pub-solar;
|
||||
in
|
||||
{
|
||||
config = {
|
||||
# Override nix.conf for more agressive garbage collection
|
||||
nix.extraOptions = lib.mkForce ''
|
||||
experimental-features = flakes nix-command
|
||||
min-free = 536870912
|
||||
keep-outputs = false
|
||||
keep-derivations = false
|
||||
fallback = true
|
||||
'';
|
||||
|
||||
# # #
|
||||
# # # Triton host specific options
|
||||
# # # DO NOT ALTER below this line, changes might render system unbootable
|
||||
# # #
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Force getting the hostname from cloud-init
|
||||
networking.hostName = lib.mkDefault "";
|
||||
|
||||
# We use cloud-init to configure networking, this option should fix
|
||||
# systemd-networkd-wait-online timeouts
|
||||
#systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
|
||||
systemd.network.wait-online.ignoredInterfaces = [
|
||||
"docker0"
|
||||
"wg-ssh"
|
||||
];
|
||||
|
||||
# List services that you want to enable:
|
||||
services.cloud-init.enable = true;
|
||||
services.cloud-init.ext4.enable = true;
|
||||
services.cloud-init.network.enable = true;
|
||||
# use the default NixOS cloud-init config, but add some SmartOS customization to it
|
||||
environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
|
||||
datasource_list: [ SmartOS ]
|
||||
|
||||
# Do not create the centos/ubuntu/debian user
|
||||
users: [ ]
|
||||
|
||||
# mount second disk with label ephemeral0, gets formated by cloud-init
|
||||
# this will fail to get added to /etc/fstab as it's read-only, but should
|
||||
# mount at boot anyway
|
||||
mounts:
|
||||
- [ vdb, /data, auto, "defaults,nofail" ]
|
||||
'';
|
||||
|
||||
# We manage the firewall with nix, too
|
||||
# altough triton can also manage firewall rules via the triton fwrule subcommand
|
||||
networking.firewall.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
};
|
||||
}
|
|
@ -1,11 +0,0 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./configuration.nix
|
||||
./triton-vmtools.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
}
|
|
@ -1,52 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ ];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ahci"
|
||||
"virtio_pci"
|
||||
"xhci_pci"
|
||||
"sr_mod"
|
||||
"virtio_blk"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/nixos";
|
||||
autoResize = true;
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/boot";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/data" = {
|
||||
device = "/dev/disk/by-label/ephemeral0";
|
||||
fsType = "ext4";
|
||||
options = [
|
||||
"defaults"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
networking.networkmanager.enable = lib.mkForce false;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
|
@ -1,6 +0,0 @@
|
|||
{ pkgs, flake, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
flake.inputs.triton-vmtools.packages.${pkgs.system}.default
|
||||
];
|
||||
}
|
|
@ -1,91 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking.firewall.allowedUDPPorts = [ 51820 ];
|
||||
|
||||
age.secrets.wg-private-key.file = "${flake.self}/secrets/flora6-wg-private-key.age";
|
||||
|
||||
networking.wireguard.interfaces = {
|
||||
wg-ssh = {
|
||||
listenPort = 51820;
|
||||
mtu = 1300;
|
||||
ips = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
];
|
||||
privateKeyFile = config.age.secrets.wg-private-key.path;
|
||||
peers = flake.self.logins.admins.wireguardDevices ++ [
|
||||
{
|
||||
# nachtigall.pub.solar
|
||||
endpoint = "138.201.80.102:51820";
|
||||
publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
|
||||
allowedIPs = [
|
||||
"10.7.6.1/32"
|
||||
"fd00:fae:fae:fae:fae:1::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# metronom.pub.solar
|
||||
endpoint = "49.13.236.167:51820";
|
||||
publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
|
||||
allowedIPs = [
|
||||
"10.7.6.3/32"
|
||||
"fd00:fae:fae:fae:fae:3::/96"
|
||||
];
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
{
|
||||
# tankstelle.pub.solar
|
||||
endpoint = "80.244.242.5:51820";
|
||||
publicKey = "iRTlY1lB7nPXf2eXzX8ZZDkfMmXyGjff5/joccbP8Cg=";
|
||||
allowedIPs = [
|
||||
"10.7.6.4/32"
|
||||
"fd00:fae:fae:fae:fae:4::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# trinkgenossin.pub.solar
|
||||
endpoint = "85.215.152.22:51820";
|
||||
publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
|
||||
allowedIPs = [
|
||||
"10.7.6.5/32"
|
||||
"fd00:fae:fae:fae:fae:5::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# delite.pub.solar
|
||||
endpoint = "5.255.119.132:51820";
|
||||
publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
|
||||
allowedIPs = [
|
||||
"10.7.6.6/32"
|
||||
"fd00:fae:fae:fae:fae:6::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# blue-shell.pub.solar
|
||||
endpoint = "194.13.83.205:51820";
|
||||
publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
|
||||
allowedIPs = [
|
||||
"10.7.6.7/32"
|
||||
"fd00:fae:fae:fae:fae:7::/96"
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh.listenAddresses = [
|
||||
{
|
||||
addr = "10.7.6.2";
|
||||
port = 22;
|
||||
}
|
||||
{
|
||||
addr = "[fd00:fae:fae:fae:fae:2::]";
|
||||
port = 22;
|
||||
}
|
||||
];
|
||||
}
|
|
@ -19,15 +19,6 @@
|
|||
];
|
||||
privateKeyFile = config.age.secrets.wg-private-key.path;
|
||||
peers = flake.self.logins.admins.wireguardDevices ++ [
|
||||
{
|
||||
# flora-6.pub.solar
|
||||
endpoint = "80.71.153.210:51820";
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
allowedIPs = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# nachtigall.pub.solar
|
||||
endpoint = "138.201.80.102:51820";
|
||||
|
@ -37,6 +28,17 @@
|
|||
"fd00:fae:fae:fae:fae:1::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# trinkgenossin.pub.solar
|
||||
publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
|
||||
allowedIPs = [
|
||||
"10.7.6.5/32"
|
||||
"fd00:fae:fae:fae:fae:5::/96"
|
||||
];
|
||||
#endpoint = "80.244.242.5:51820";
|
||||
endpoint = "[2a01:239:35d:f500::1]:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
@ -19,15 +19,6 @@
|
|||
];
|
||||
privateKeyFile = config.age.secrets.wg-private-key.path;
|
||||
peers = flake.self.logins.admins.wireguardDevices ++ [
|
||||
{
|
||||
# flora-6.pub.solar
|
||||
endpoint = "80.71.153.210:51820";
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
allowedIPs = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# tankstelle.pub.solar
|
||||
endpoint = "80.244.242.5:51820";
|
||||
|
@ -37,6 +28,17 @@
|
|||
"fd00:fae:fae:fae:fae:4::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# trinkgenossin.pub.solar
|
||||
publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
|
||||
allowedIPs = [
|
||||
"10.7.6.5/32"
|
||||
"fd00:fae:fae:fae:fae:5::/96"
|
||||
];
|
||||
#endpoint = "80.244.242.5:51820";
|
||||
endpoint = "[2a01:239:35d:f500::1]:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
@ -29,13 +29,15 @@
|
|||
];
|
||||
}
|
||||
{
|
||||
# flora-6.pub.solar
|
||||
endpoint = "80.71.153.210:51820";
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
# trinkgenossin.pub.solar
|
||||
publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
|
||||
allowedIPs = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
"10.7.6.5/32"
|
||||
"fd00:fae:fae:fae:fae:5::/96"
|
||||
];
|
||||
#endpoint = "80.244.242.5:51820";
|
||||
endpoint = "[2a01:239:35d:f500::1]:51820";
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
@ -24,12 +24,49 @@ in
|
|||
privateKeyFile = config.age.secrets.wg-private-key.path;
|
||||
peers = flake.self.logins.admins.wireguardDevices ++ [
|
||||
{
|
||||
# flora-6.pub.solar
|
||||
endpoint = "80.71.153.210:51820";
|
||||
publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
|
||||
# nachtigall.pub.solar
|
||||
endpoint = "138.201.80.102:51820";
|
||||
publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
|
||||
allowedIPs = [
|
||||
"10.7.6.2/32"
|
||||
"fd00:fae:fae:fae:fae:2::/96"
|
||||
"10.7.6.1/32"
|
||||
"fd00:fae:fae:fae:fae:1::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# metronom.pub.solar
|
||||
endpoint = "49.13.236.167:51820";
|
||||
publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
|
||||
allowedIPs = [
|
||||
"10.7.6.3/32"
|
||||
"fd00:fae:fae:fae:fae:3::/96"
|
||||
];
|
||||
persistentKeepalive = 15;
|
||||
}
|
||||
{
|
||||
# tankstelle.pub.solar
|
||||
endpoint = "80.244.242.5:51820";
|
||||
publicKey = "iRTlY1lB7nPXf2eXzX8ZZDkfMmXyGjff5/joccbP8Cg=";
|
||||
allowedIPs = [
|
||||
"10.7.6.4/32"
|
||||
"fd00:fae:fae:fae:fae:4::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# delite.pub.solar
|
||||
endpoint = "5.255.119.132:51820";
|
||||
publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
|
||||
allowedIPs = [
|
||||
"10.7.6.6/32"
|
||||
"fd00:fae:fae:fae:fae:6::/96"
|
||||
];
|
||||
}
|
||||
{
|
||||
# blue-shell.pub.solar
|
||||
endpoint = "194.13.83.205:51820";
|
||||
publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
|
||||
allowedIPs = [
|
||||
"10.7.6.7/32"
|
||||
"fd00:fae:fae:fae:fae:7::/96"
|
||||
];
|
||||
}
|
||||
];
|
||||
|
|
|
@ -2,6 +2,5 @@
|
|||
# Used for restic backups to droppie, a server run by @b12f
|
||||
"root@droppie" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQSephFJU0NMbVbhwvVJ2/m6jcPYo1IsWCsoarqKin root@droppie";
|
||||
|
||||
# robot user on flora-6
|
||||
"hakkonaut@flora-6" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6";
|
||||
"hakkonaut" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut";
|
||||
}
|
||||
|
|
|
@ -31,13 +31,17 @@
|
|||
|
||||
networking.hosts = {
|
||||
"10.7.6.1" = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"10.7.6.2" = [ "flora-6.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"10.7.6.3" = [ "metronom.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"10.7.6.4" = [ "tankstelle.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"10.7.6.5" = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"10.7.6.6" = [ "delite.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"10.7.6.7" = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:1::" = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:2::" = [ "flora-6.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:3::" = [ "metronom.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:4::" = [ "tankstelle.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:5::" = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:6::" = [ "delite.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
"fd00:fae:fae:fae:fae:7::" = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
|
|
|
@ -1,114 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
{
|
||||
age.secrets.drone-secrets = {
|
||||
file = "${flake.self}/secrets/drone-secrets.age";
|
||||
mode = "600";
|
||||
owner = "drone";
|
||||
};
|
||||
age.secrets.drone-db-secrets = {
|
||||
file = "${flake.self}/secrets/drone-db-secrets.age";
|
||||
mode = "600";
|
||||
owner = "drone";
|
||||
};
|
||||
|
||||
users.users.drone = {
|
||||
description = "Drone Service";
|
||||
home = "/var/lib/drone";
|
||||
useDefaultShell = true;
|
||||
uid = 994;
|
||||
group = "drone";
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
users.groups.drone = { };
|
||||
|
||||
systemd.tmpfiles.rules = [ "d '/var/lib/drone-db' 0750 drone drone - -" ];
|
||||
|
||||
services.caddy.virtualHosts."ci.${config.pub-solar-os.networking.domain}" = {
|
||||
logFormat = lib.mkForce ''
|
||||
output discard
|
||||
'';
|
||||
extraConfig = ''
|
||||
reverse_proxy :4000
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services."docker-network-drone" =
|
||||
let
|
||||
docker = config.virtualisation.oci-containers.backend;
|
||||
dockerBin = "${pkgs.${docker}}/bin/${docker}";
|
||||
in
|
||||
{
|
||||
serviceConfig.Type = "oneshot";
|
||||
before = [ "docker-drone-server.service" ];
|
||||
script = ''
|
||||
${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
|
||||
'';
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker = {
|
||||
enable = true; # sadly podman is not supported rightnow
|
||||
extraOptions = ''
|
||||
--data-root /data/docker
|
||||
'';
|
||||
};
|
||||
|
||||
oci-containers = {
|
||||
backend = "docker";
|
||||
containers."drone-db" = {
|
||||
image = "postgres:14";
|
||||
autoStart = true;
|
||||
user = "994";
|
||||
volumes = [ "/var/lib/drone-db:/var/lib/postgresql/data" ];
|
||||
extraOptions = [ "--network=drone-net" ];
|
||||
environmentFiles = [ config.age.secrets.drone-db-secrets.path ];
|
||||
};
|
||||
containers."drone-server" = {
|
||||
image = "drone/drone:2";
|
||||
autoStart = true;
|
||||
user = "994";
|
||||
ports = [ "127.0.0.1:4000:80" ];
|
||||
dependsOn = [ "drone-db" ];
|
||||
extraOptions = [
|
||||
"--network=drone-net"
|
||||
"--pull=always"
|
||||
"--add-host=nachtigall.${config.pub-solar-os.networking.domain}:10.7.6.1"
|
||||
];
|
||||
environment = {
|
||||
DRONE_GITEA_SERVER = "https://git.${config.pub-solar-os.networking.domain}";
|
||||
DRONE_SERVER_HOST = "ci.${config.pub-solar-os.networking.domain}";
|
||||
DRONE_SERVER_PROTO = "https";
|
||||
DRONE_DATABASE_DRIVER = "postgres";
|
||||
};
|
||||
environmentFiles = [ config.age.secrets.drone-secrets.path ];
|
||||
};
|
||||
containers."drone-docker-runner" = {
|
||||
image = "drone/drone-runner-docker:1";
|
||||
autoStart = true;
|
||||
# needs to run as root
|
||||
#user = "994";
|
||||
volumes = [ "/var/run/docker.sock:/var/run/docker.sock" ];
|
||||
dependsOn = [ "drone-db" ];
|
||||
extraOptions = [
|
||||
"--network=drone-net"
|
||||
"--pull=always"
|
||||
"--add-host=nachtigall.${config.pub-solar-os.networking.domain}:10.7.6.1"
|
||||
];
|
||||
environment = {
|
||||
DRONE_RPC_HOST = "ci.${config.pub-solar-os.networking.domain}";
|
||||
DRONE_RPC_PROTO = "https";
|
||||
DRONE_RUNNER_CAPACITY = "2";
|
||||
DRONE_RUNNER_NAME = "flora-6-docker-runner";
|
||||
};
|
||||
environmentFiles = [ config.age.secrets.drone-secrets.path ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
|
@ -1,67 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
{
|
||||
age.secrets.forgejo-actions-runner-token = {
|
||||
file = "${flake.self}/secrets/forgejo-actions-runner-token.age";
|
||||
mode = "440";
|
||||
};
|
||||
|
||||
# Trust docker bridge interface traffic
|
||||
# Needed for the docker runner to communicate with the act_runner cache
|
||||
networking.firewall.trustedInterfaces = [ "br-+" ];
|
||||
|
||||
users.users.gitea-runner = {
|
||||
home = "/var/lib/gitea-runner/flora-6";
|
||||
useDefaultShell = true;
|
||||
group = "gitea-runner";
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
users.groups.gitea-runner = { };
|
||||
|
||||
systemd.services."gitea-runner-flora\\x2d6".serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '/data/gitea-actions-runner' 0750 gitea-runner gitea-runner - -"
|
||||
"d '/var/lib/gitea-runner' 0750 gitea-runner gitea-runner - -"
|
||||
];
|
||||
|
||||
# forgejo actions runner
|
||||
# https://forgejo.org/docs/latest/admin/actions/
|
||||
# https://docs.gitea.com/usage/actions/quickstart
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-runner;
|
||||
instances."flora-6" = {
|
||||
enable = true;
|
||||
name = config.networking.hostName;
|
||||
url = "https://git.pub.solar";
|
||||
tokenFile = config.age.secrets.forgejo-actions-runner-token.path;
|
||||
settings = {
|
||||
cache = {
|
||||
enabled = true;
|
||||
dir = "/data/gitea-actions-runner/actcache";
|
||||
host = "";
|
||||
port = 0;
|
||||
external_server = "";
|
||||
};
|
||||
};
|
||||
labels = [
|
||||
# provide a debian 12 bookworm base with Node.js for actions
|
||||
"debian-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
|
||||
# fake the ubuntu name, commonly used in actions examples
|
||||
"ubuntu-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
|
||||
# alpine with Node.js
|
||||
"alpine-latest:docker://node:20-alpine"
|
||||
# nix flakes enabled image with Node.js
|
||||
"nix-flakes:docker://git.pub.solar/pub-solar/nix-flakes-node:latest"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
|
@ -40,13 +40,10 @@
|
|||
};
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."grafana.${config.pub-solar-os.networking.domain}" = {
|
||||
logFormat = lib.mkForce ''
|
||||
output discard
|
||||
'';
|
||||
extraConfig = ''
|
||||
reverse_proxy :${toString config.services.grafana.settings.server.http_port}
|
||||
'';
|
||||
services.nginx.virtualHosts."grafana.${config.pub-solar-os.networking.domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
|
||||
};
|
||||
|
||||
services.grafana = {
|
||||
|
@ -69,7 +66,7 @@
|
|||
password = "\$__file{${config.age.secrets.grafana-smtp-password.path}}";
|
||||
from_address = "no-reply@pub.solar";
|
||||
from_name = "grafana.pub.solar";
|
||||
ehlo_identity = "flora-6.pub.solar";
|
||||
ehlo_identity = "grafana.pub.solar";
|
||||
};
|
||||
security = {
|
||||
admin_email = "crew@pub.solar";
|
||||
|
|
|
@ -25,7 +25,7 @@
|
|||
};
|
||||
};
|
||||
replication_factor = 1;
|
||||
path_prefix = "/data/loki";
|
||||
path_prefix = "/var/lib/loki";
|
||||
storage = {
|
||||
filesystem = {
|
||||
chunks_directory = "chunks/";
|
||||
|
@ -108,7 +108,7 @@
|
|||
};
|
||||
clients = [
|
||||
{
|
||||
url = "http://flora-6.wg.pub.solar:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
|
||||
url = "http://trinkgenossin.wg.pub.solar:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
|
||||
}
|
||||
];
|
||||
scrape_configs = [
|
||||
|
@ -118,7 +118,7 @@
|
|||
max_age = "24h";
|
||||
labels = {
|
||||
job = "systemd-journal";
|
||||
host = "flora-6";
|
||||
host = "trinkgenossin";
|
||||
};
|
||||
};
|
||||
relabel_configs = [
|
||||
|
|
|
@ -250,4 +250,10 @@ lib.mapAttrsToList
|
|||
# description =
|
||||
# "alertmanager: number of active silences has changed: {{$value}}";
|
||||
# };
|
||||
|
||||
garage_cluster_healthy = {
|
||||
condition = "cluster_healthy == 0";
|
||||
time = "15m";
|
||||
description = "garage cluster on {{$labels.instance}} is not healthy: {{$labels.result}}!";
|
||||
};
|
||||
})
|
||||
|
|
|
@ -12,15 +12,27 @@
|
|||
owner = "alertmanager";
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
|
||||
logFormat = lib.mkForce ''
|
||||
output discard
|
||||
'';
|
||||
extraConfig = ''
|
||||
bind 10.7.6.2 fd00:fae:fae:fae:fae:2::
|
||||
tls internal
|
||||
reverse_proxy :${toString config.services.prometheus.alertmanager.port}
|
||||
'';
|
||||
security.acme.certs = {
|
||||
"alerts.${config.pub-solar-os.networking.domain}" = {
|
||||
# disable http challenge
|
||||
webroot = null;
|
||||
# enable dns challenge
|
||||
dnsProvider = "namecheap";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
listenAddresses = [
|
||||
"10.7.6.5"
|
||||
"[fd00:fae:fae:fae:fae:5::]"
|
||||
];
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString config.services.prometheus.alertmanager.port}";
|
||||
};
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
|
@ -41,12 +53,6 @@
|
|||
{
|
||||
job_name = "node-exporter";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
labels = {
|
||||
instance = "flora-6";
|
||||
};
|
||||
}
|
||||
{
|
||||
targets = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
|
||||
labels = {
|
||||
|
@ -77,6 +83,22 @@
|
|||
instance = "trinkgenossin";
|
||||
};
|
||||
}
|
||||
{
|
||||
targets = [
|
||||
"delite.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
|
||||
];
|
||||
labels = {
|
||||
instance = "delite";
|
||||
};
|
||||
}
|
||||
{
|
||||
targets = [
|
||||
"blue-shell.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
|
||||
];
|
||||
labels = {
|
||||
instance = "blue-shell";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
|
@ -95,11 +117,22 @@
|
|||
job_name = "garage";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"trinkgenossin.wg.${config.pub-solar-os.networking.domain}:3903"
|
||||
"delite.wg.${config.pub-solar-os.networking.domain}:3903"
|
||||
"blue-shell.wg.${config.pub-solar-os.networking.domain}:3903"
|
||||
];
|
||||
targets = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}:3903" ];
|
||||
labels = {
|
||||
instance = "trinkgenossin";
|
||||
};
|
||||
}
|
||||
{
|
||||
targets = [ "delite.wg.${config.pub-solar-os.networking.domain}:3903" ];
|
||||
labels = {
|
||||
instance = "delite";
|
||||
};
|
||||
}
|
||||
{
|
||||
targets = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}:3903" ];
|
||||
labels = {
|
||||
instance = "blue-shell";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|