Compare commits
44 commits
main
...
update/git
Author | SHA1 | Date | |
---|---|---|---|
Benjamin Bädorf | 1874463c4e | ||
Benjamin Bädorf | a7d684e1f8 | ||
teutat3s | 997561f817 | ||
teutat3s | 0e3b602809 | ||
teutat3s | 440b38f896 | ||
teutat3s | 8051531d77 | ||
teutat3s | 54ea93ced4 | ||
teutat3s | 9732e4edf1 | ||
teutat3s | 7a7ff7b1df | ||
teutat3s | 90b182e499 | ||
b12f | 72c84bb1e6 | ||
Akshay Mankar | 7454d5fc5f | ||
teutat3s | f375843f43 | ||
teutat3s | 291edb6b52 | ||
teutat3s | cda684ae32 | ||
teutat3s | 6a6abc79c2 | ||
teutat3s | de8dcbe9a2 | ||
teutat3s | e9819fdec7 | ||
teutat3s | 645b10f2b9 | ||
teutat3s | f2c5739c97 | ||
Benjamin Bädorf | b1710c4013 | ||
Benjamin Bädorf | f12f42827f | ||
Benjamin Bädorf | 8453b8c584 | ||
teutat3s | 9ca8387d12 | ||
teutat3s | 492b8695a3 | ||
teutat3s | 9fb726b2d7 | ||
Benjamin Bädorf | 161acca3a7 | ||
Benjamin Bädorf | 86cb6522ed | ||
Benjamin Bädorf | 2b03c98cf2 | ||
teutat3s | 756845c187 | ||
teutat3s | 7655260456 | ||
Hendrik Sokolowski | b3f4727354 | ||
teutat3s | c345cb8af4 | ||
teutat3s | 8fb95ce9dc | ||
Hendrik Sokolowski | cb829d0972 | ||
teutat3s | ca22046f75 | ||
teutat3s | 24c699698f | ||
teutat3s | 1f2ba895a0 | ||
teutat3s | a795bf4429 | ||
Benjamin Bädorf | 1f2d56e0c9 | ||
teutat3s | 90bca8d0ba | ||
teutat3s | 97d88096e8 | ||
teutat3s | f0c12e38ee | ||
teutat3s | 0e6df4e33b |
|
@ -42,7 +42,7 @@ steps:
|
||||||
from_secret: private_ssh_key
|
from_secret: private_ssh_key
|
||||||
MANTA_USER: pub_solar
|
MANTA_USER: pub_solar
|
||||||
MANTA_URL: https://eu-central.manta.greenbaum.cloud
|
MANTA_URL: https://eu-central.manta.greenbaum.cloud
|
||||||
MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
|
MANTA_KEY_ID: "59:9f:5a:6f:c4:e2:3b:32:7f:13:1f:de:b7:59:80:85"
|
||||||
commands:
|
commands:
|
||||||
- export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
|
- export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
|
||||||
- echo env var TARGET_DIR is set to $$TARGET_DIR
|
- echo env var TARGET_DIR is set to $$TARGET_DIR
|
||||||
|
@ -126,7 +126,7 @@ steps:
|
||||||
from_secret: iso_web_ssh_port
|
from_secret: iso_web_ssh_port
|
||||||
key:
|
key:
|
||||||
from_secret: iso_web_ssh_key
|
from_secret: iso_web_ssh_key
|
||||||
target: /srv/os/download
|
target: /srv/www/os/download
|
||||||
source:
|
source:
|
||||||
- /var/nix/iso-cache/*.iso
|
- /var/nix/iso-cache/*.iso
|
||||||
- /var/nix/iso-cache/*.iso.sha256
|
- /var/nix/iso-cache/*.iso.sha256
|
||||||
|
@ -148,6 +148,6 @@ volumes:
|
||||||
|
|
||||||
---
|
---
|
||||||
kind: signature
|
kind: signature
|
||||||
hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e
|
hmac: 67d75675e20adcbdeff528915795d39b7b80575be92c08ec332ffdc63437aa61
|
||||||
|
|
||||||
...
|
...
|
||||||
|
|
112
flake.lock
112
flake.lock
|
@ -120,6 +120,31 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"devshell_2": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": [
|
||||||
|
"keycloak-theme-pub-solar",
|
||||||
|
"flake-utils"
|
||||||
|
],
|
||||||
|
"nixpkgs": [
|
||||||
|
"keycloak-theme-pub-solar",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1667210711,
|
||||||
|
"narHash": "sha256-IoErjXZAkzYWHEpQqwu/DeRNJGFdR7X2OGbkhMqMrpw=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "devshell",
|
||||||
|
"rev": "96a9dd12b8a447840cc246e17a47b81a4268bba7",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "devshell",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"digga": {
|
"digga": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"blank": "blank",
|
"blank": "blank",
|
||||||
|
@ -254,6 +279,36 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"flake-utils_3": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1667395993,
|
||||||
|
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_4": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1653893745,
|
||||||
|
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"home": {
|
"home": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
|
@ -276,6 +331,29 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"keycloak-theme-pub-solar": {
|
||||||
|
"inputs": {
|
||||||
|
"devshell": "devshell_2",
|
||||||
|
"flake-utils": "flake-utils_3",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixos"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1669645736,
|
||||||
|
"narHash": "sha256-u1yK1fyh1UEX3BITfk6ROenWbP3aznZRplwCE+FVtHE=",
|
||||||
|
"ref": "main",
|
||||||
|
"rev": "b488fe24a27bf76e0b777202bf13a68660121305",
|
||||||
|
"revCount": 17,
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.pub.solar/pub-solar/keycloak-theme"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"ref": "main",
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.pub.solar/pub-solar/keycloak-theme"
|
||||||
|
}
|
||||||
|
},
|
||||||
"latest": {
|
"latest": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1657265485,
|
"lastModified": 1657265485,
|
||||||
|
@ -345,11 +423,11 @@
|
||||||
},
|
},
|
||||||
"nixos": {
|
"nixos": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1674868155,
|
"lastModified": 1674781052,
|
||||||
"narHash": "sha256-eFNm2h6fNbgD7ZpO4MHikCB5pSnCJ7DTmwPisjetmwc=",
|
"narHash": "sha256-nseKFXRvmZ+BDAeWQtsiad+5MnvI/M2Ak9iAWzooWBw=",
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "ce20e9ebe1903ea2ba1ab006ec63093020c761cb",
|
"rev": "cc4bb87f5457ba06af9ae57ee4328a49ce674b1b",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -445,12 +523,38 @@
|
||||||
"digga": "digga",
|
"digga": "digga",
|
||||||
"flake-compat": "flake-compat_3",
|
"flake-compat": "flake-compat_3",
|
||||||
"home": "home",
|
"home": "home",
|
||||||
|
"keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
|
||||||
"latest": "latest_2",
|
"latest": "latest_2",
|
||||||
"naersk": "naersk",
|
"naersk": "naersk",
|
||||||
"nixos": "nixos",
|
"nixos": "nixos",
|
||||||
"nixos-generators": "nixos-generators",
|
"nixos-generators": "nixos-generators",
|
||||||
"nixos-hardware": "nixos-hardware",
|
"nixos-hardware": "nixos-hardware",
|
||||||
"nur": "nur"
|
"nur": "nur",
|
||||||
|
"triton-vmtools": "triton-vmtools"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"triton-vmtools": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_4",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixos"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"dir": "vmtools",
|
||||||
|
"lastModified": 1669648111,
|
||||||
|
"narHash": "sha256-EKh7iM4fCyZ7L6+HmGn3QkZ1HuG9zMEkziOH3K13SbY=",
|
||||||
|
"ref": "main",
|
||||||
|
"rev": "d78c4afe040440437949ce581ae0dcdc5893553c",
|
||||||
|
"revCount": 28,
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"dir": "vmtools",
|
||||||
|
"ref": "main",
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"utils": {
|
"utils": {
|
||||||
|
|
16
flake.nix
16
flake.nix
|
@ -37,6 +37,12 @@
|
||||||
nixos-hardware.url = "github:nixos/nixos-hardware";
|
nixos-hardware.url = "github:nixos/nixos-hardware";
|
||||||
|
|
||||||
nixos-generators.url = "github:nix-community/nixos-generators";
|
nixos-generators.url = "github:nix-community/nixos-generators";
|
||||||
|
|
||||||
|
triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
|
||||||
|
triton-vmtools.inputs.nixpkgs.follows = "nixos";
|
||||||
|
|
||||||
|
keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
|
||||||
|
keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = {
|
outputs = {
|
||||||
|
@ -48,6 +54,8 @@
|
||||||
nur,
|
nur,
|
||||||
agenix,
|
agenix,
|
||||||
deploy,
|
deploy,
|
||||||
|
triton-vmtools,
|
||||||
|
keycloak-theme-pub-solar,
|
||||||
...
|
...
|
||||||
} @ inputs:
|
} @ inputs:
|
||||||
digga.lib.mkFlake
|
digga.lib.mkFlake
|
||||||
|
@ -145,6 +153,7 @@
|
||||||
};
|
};
|
||||||
users = {
|
users = {
|
||||||
pub-solar = {suites, ...}: {imports = suites.base;};
|
pub-solar = {suites, ...}: {imports = suites.base;};
|
||||||
|
barkeeper = {suites, ...}: {imports = suites.base;};
|
||||||
}; # digga.lib.importers.rakeLeaves ./users/hm;
|
}; # digga.lib.importers.rakeLeaves ./users/hm;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -152,6 +161,11 @@
|
||||||
|
|
||||||
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
|
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
|
||||||
|
|
||||||
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {};
|
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
|
||||||
|
flora-6 = {
|
||||||
|
sshUser = "barkeeper";
|
||||||
|
hostname = "flora-6.pub.solar";
|
||||||
|
};
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
86
hosts/flora-6/caddy.nix
Normal file
86
hosts/flora-6/caddy.nix
Normal file
|
@ -0,0 +1,86 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
self,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
services.caddy = {
|
||||||
|
enable = lib.mkForce true;
|
||||||
|
group = "hakkonaut";
|
||||||
|
email = "admins@pub.solar";
|
||||||
|
globalConfig = lib.mkForce "";
|
||||||
|
virtualHosts = {
|
||||||
|
"pub.solar" = {
|
||||||
|
logFormat = lib.mkForce ''
|
||||||
|
output discard
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
# PubSolarOS images
|
||||||
|
handle /os/download/* {
|
||||||
|
root * /srv/www
|
||||||
|
file_server /os/download/* browse
|
||||||
|
}
|
||||||
|
# serve base domain pub.solar for mastodon.pub.solar
|
||||||
|
# https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
|
||||||
|
handle /.well-known/host-meta {
|
||||||
|
redir https://mastodon.pub.solar{uri}
|
||||||
|
}
|
||||||
|
# pub.solar website
|
||||||
|
handle {
|
||||||
|
root * /srv/www/pub.solar
|
||||||
|
try_files {path}.html {path}
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
# minimal error handling, respond with status code and text
|
||||||
|
handle_errors {
|
||||||
|
respond "{http.error.status_code} {http.error.status_text}"
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"www.pub.solar" = {
|
||||||
|
logFormat = lib.mkForce ''
|
||||||
|
output discard
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
redir https://pub.solar{uri}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"auth.pub.solar" = {
|
||||||
|
logFormat = lib.mkForce ''
|
||||||
|
output discard
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
redir / /realms/pub.solar/account temporary
|
||||||
|
reverse_proxy :8080
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"git.pub.solar" = {
|
||||||
|
logFormat = lib.mkForce ''
|
||||||
|
output discard
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
redir /user/login /user/oauth2/keycloak temporary
|
||||||
|
reverse_proxy :3000
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"ci.pub.solar" = {
|
||||||
|
logFormat = lib.mkForce ''
|
||||||
|
output discard
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
reverse_proxy :4000
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"obs-portal.pub.solar" = {
|
||||||
|
logFormat = lib.mkForce ''
|
||||||
|
output discard
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [80 443];
|
||||||
|
}
|
5
hosts/flora-6/default.nix
Normal file
5
hosts/flora-6/default.nix
Normal file
|
@ -0,0 +1,5 @@
|
||||||
|
{...}: {
|
||||||
|
imports = [
|
||||||
|
./flora-6.nix
|
||||||
|
];
|
||||||
|
}
|
107
hosts/flora-6/drone.nix
Normal file
107
hosts/flora-6/drone.nix
Normal file
|
@ -0,0 +1,107 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
self,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
age.secrets.drone-secrets = {
|
||||||
|
file = "${self}/secrets/drone-secrets.age";
|
||||||
|
mode = "600";
|
||||||
|
owner = "drone";
|
||||||
|
};
|
||||||
|
age.secrets.drone-db-secrets = {
|
||||||
|
file = "${self}/secrets/drone-db-secrets.age";
|
||||||
|
mode = "600";
|
||||||
|
owner = "drone";
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.drone = {
|
||||||
|
description = "Drone Service";
|
||||||
|
home = "/var/lib/drone";
|
||||||
|
useDefaultShell = true;
|
||||||
|
uid = 994;
|
||||||
|
group = "drone";
|
||||||
|
isSystemUser = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
users.groups.drone = {};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d '/var/lib/drone-db' 0750 drone drone - -"
|
||||||
|
];
|
||||||
|
|
||||||
|
system.activationScripts.mkDroneNet = let
|
||||||
|
docker = config.virtualisation.oci-containers.backend;
|
||||||
|
dockerBin = "${pkgs.${docker}}/bin/${docker}";
|
||||||
|
in ''
|
||||||
|
${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
|
||||||
|
'';
|
||||||
|
|
||||||
|
virtualisation = {
|
||||||
|
docker = {
|
||||||
|
enable = true; # sadly podman is not supported rightnow
|
||||||
|
};
|
||||||
|
|
||||||
|
oci-containers = {
|
||||||
|
backend = "docker";
|
||||||
|
containers."drone-db" = {
|
||||||
|
image = "postgres:14";
|
||||||
|
autoStart = true;
|
||||||
|
user = "994";
|
||||||
|
volumes = [
|
||||||
|
"/var/lib/drone-db:/var/lib/postgresql/data"
|
||||||
|
];
|
||||||
|
extraOptions = [
|
||||||
|
"--network=drone-net"
|
||||||
|
];
|
||||||
|
environmentFiles = [
|
||||||
|
config.age.secrets.drone-db-secrets.path
|
||||||
|
];
|
||||||
|
};
|
||||||
|
containers."drone-server" = {
|
||||||
|
image = "drone/drone:2";
|
||||||
|
autoStart = true;
|
||||||
|
user = "994";
|
||||||
|
ports = [
|
||||||
|
"4000:80"
|
||||||
|
];
|
||||||
|
dependsOn = ["drone-db"];
|
||||||
|
extraOptions = [
|
||||||
|
"--network=drone-net"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
DRONE_GITEA_SERVER = "https://git.pub.solar";
|
||||||
|
DRONE_SERVER_HOST = "ci.pub.solar";
|
||||||
|
DRONE_SERVER_PROTO = "https";
|
||||||
|
DRONE_DATABASE_DRIVER = "postgres";
|
||||||
|
};
|
||||||
|
environmentFiles = [
|
||||||
|
config.age.secrets.drone-secrets.path
|
||||||
|
];
|
||||||
|
};
|
||||||
|
containers."drone-docker-runner" = {
|
||||||
|
image = "drone/drone-runner-docker:1";
|
||||||
|
autoStart = true;
|
||||||
|
# needs to run as root
|
||||||
|
#user = "994";
|
||||||
|
volumes = [
|
||||||
|
"/var/run/docker.sock:/var/run/docker.sock"
|
||||||
|
];
|
||||||
|
dependsOn = ["drone-db"];
|
||||||
|
extraOptions = [
|
||||||
|
"--network=drone-net"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
DRONE_RPC_HOST = "ci.pub.solar";
|
||||||
|
DRONE_RPC_PROTO = "https";
|
||||||
|
DRONE_RUNNER_CAPACITY = "2";
|
||||||
|
DRONE_RUNNER_NAME = "flora-6-docker-runner";
|
||||||
|
};
|
||||||
|
environmentFiles = [
|
||||||
|
config.age.secrets.drone-secrets.path
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
147
hosts/flora-6/flora-6.nix
Normal file
147
hosts/flora-6/flora-6.nix
Normal file
|
@ -0,0 +1,147 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
latestModulesPath,
|
||||||
|
lib,
|
||||||
|
inputs,
|
||||||
|
pkgs,
|
||||||
|
profiles,
|
||||||
|
self,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
psCfg = config.pub-solar;
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
./triton-vmtools.nix
|
||||||
|
|
||||||
|
./caddy.nix
|
||||||
|
./drone.nix
|
||||||
|
./keycloak.nix
|
||||||
|
./gitea.nix
|
||||||
|
|
||||||
|
profiles.base-user
|
||||||
|
profiles.users.root # make sure to configure ssh keys
|
||||||
|
profiles.users.barkeeper
|
||||||
|
|
||||||
|
"${latestModulesPath}/services/web-apps/keycloak.nix"
|
||||||
|
"${latestModulesPath}/services/misc/gitea.nix"
|
||||||
|
];
|
||||||
|
disabledModules = [
|
||||||
|
"services/web-apps/keycloak.nix"
|
||||||
|
"services/misc/gitea.nix"
|
||||||
|
];
|
||||||
|
|
||||||
|
config = {
|
||||||
|
# # #
|
||||||
|
# # # pub.solar options
|
||||||
|
# # #
|
||||||
|
pub-solar.core = {
|
||||||
|
disk-encryption-active = false;
|
||||||
|
iso-options.enable = true;
|
||||||
|
lite = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Allow sudo without a password for the barkeeper user
|
||||||
|
security.sudo.extraRules = [
|
||||||
|
{
|
||||||
|
users = ["${psCfg.user.name}"];
|
||||||
|
commands = [
|
||||||
|
{
|
||||||
|
command = "ALL";
|
||||||
|
options = ["NOPASSWD"];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
# Machine user for CI pipelines
|
||||||
|
users.users.hakkonaut = {
|
||||||
|
description = "CI and automation user";
|
||||||
|
home = "/var/nix/iso-cache";
|
||||||
|
useDefaultShell = true;
|
||||||
|
uid = 998;
|
||||||
|
group = "hakkonaut";
|
||||||
|
isSystemUser = true;
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
users.groups.hakkonaut = {};
|
||||||
|
|
||||||
|
# # #
|
||||||
|
# # # Triton host specific options
|
||||||
|
# # # DO NOT ALTER below this line, changes might render system unbootable
|
||||||
|
# # #
|
||||||
|
|
||||||
|
# Use the systemd-boot EFI boot loader.
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
# Force getting the hostname from cloud-init
|
||||||
|
networking.hostName = lib.mkDefault "";
|
||||||
|
|
||||||
|
# Set your time zone.
|
||||||
|
time.timeZone = "Europe/Berlin";
|
||||||
|
|
||||||
|
# Select internationalisation properties.
|
||||||
|
console = {
|
||||||
|
font = "Lat2-Terminus16";
|
||||||
|
keyMap = "us";
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile. To search, run:
|
||||||
|
# $ nix search wget
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
git
|
||||||
|
vim
|
||||||
|
wget
|
||||||
|
];
|
||||||
|
|
||||||
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
|
# started in user sessions.
|
||||||
|
# programs.mtr.enable = true;
|
||||||
|
# programs.gnupg.agent = {
|
||||||
|
# enable = true;
|
||||||
|
# enableSSHSupport = true;
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
services.cloud-init.enable = true;
|
||||||
|
services.cloud-init.ext4.enable = true;
|
||||||
|
services.cloud-init.network.enable = true;
|
||||||
|
# use the default NixOS cloud-init config, but add some SmartOS customization to it
|
||||||
|
environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
|
||||||
|
datasource_list: [ SmartOS ]
|
||||||
|
|
||||||
|
# Do not create the centos/ubuntu/debian user
|
||||||
|
users: [ ]
|
||||||
|
|
||||||
|
# mount second disk with label ephemeral0, gets formated by cloud-init
|
||||||
|
# this will fail to get added to /etc/fstab as it's read-only, but should
|
||||||
|
# mount at boot anyway
|
||||||
|
mounts:
|
||||||
|
- [ vdb, /data, auto, "defaults,nofail" ]
|
||||||
|
'';
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
passwordAuthentication = false;
|
||||||
|
permitRootLogin = "no";
|
||||||
|
};
|
||||||
|
|
||||||
|
# We manage the firewall with nix, too
|
||||||
|
# altough triton can also manage firewall rules via the triton fwrule subcommand
|
||||||
|
networking.firewall.enable = true;
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "22.05"; # Did you read the comment?
|
||||||
|
};
|
||||||
|
}
|
133
hosts/flora-6/gitea.nix
Normal file
133
hosts/flora-6/gitea.nix
Normal file
|
@ -0,0 +1,133 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
self,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
age.secrets.gitea-database-password = {
|
||||||
|
file = "${self}/secrets/gitea-database-password.age";
|
||||||
|
mode = "600";
|
||||||
|
owner = "gitea";
|
||||||
|
};
|
||||||
|
age.secrets.gitea-mailer-password = {
|
||||||
|
file = "${self}/secrets/gitea-mailer-password.age";
|
||||||
|
mode = "600";
|
||||||
|
owner = "gitea";
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.git = {
|
||||||
|
description = "Gitea SSH Service";
|
||||||
|
home = "/var/lib/gitea/git";
|
||||||
|
useDefaultShell = false;
|
||||||
|
uid = 995;
|
||||||
|
isSystemUser = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation = {
|
||||||
|
docker = {
|
||||||
|
enable = true; # sadly podman is not supported rightnow
|
||||||
|
};
|
||||||
|
|
||||||
|
oci-containers = {
|
||||||
|
backend = "docker";
|
||||||
|
containers."gitea" = {
|
||||||
|
image = "gitea:gitea:1.18.3";
|
||||||
|
autoStart = true;
|
||||||
|
user = "995";
|
||||||
|
ports = [
|
||||||
|
"127.0.0.1:3000:3000"
|
||||||
|
"127.0.0.1:2222:22"
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"/var/lib/gitea:/data"
|
||||||
|
# Secrets go in the app.ini file, the rest wil be done in nix via environment variables
|
||||||
|
"/var/lib/gitea/custom/conf/app.ini:/${config.age.secrets.gitea-secrets-app-ini.path}"
|
||||||
|
"/etc/timezone:/etc/timezone:ro"
|
||||||
|
"/etc/localtime:/etc/localtime:ro"
|
||||||
|
];
|
||||||
|
extraOptions = [
|
||||||
|
"--network=gitea"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
USER_UID = "postgres";
|
||||||
|
USER_GID = "postgres";
|
||||||
|
RUN_MODE = "prod";
|
||||||
|
SSH_DOMAIN = "git.pub.solar";
|
||||||
|
ROOT_URL = "git.pub.solar";
|
||||||
|
DB_TYPE = "postgres";
|
||||||
|
DB_HOST = "gitea-db";
|
||||||
|
DISABLE_REGISTRATION = "true";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
containers."gitea-db" = {
|
||||||
|
image = "postgres:14";
|
||||||
|
autoStart = true;
|
||||||
|
volumes = [
|
||||||
|
"/var/lib/gitea-db:/var/lib/postgresql/data"
|
||||||
|
];
|
||||||
|
extraOptions = [
|
||||||
|
"--network=gitea"
|
||||||
|
];
|
||||||
|
environmentFiles = [
|
||||||
|
config.age.secrets.gitea-db-secrets.path
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# gitea
|
||||||
|
services.gitea = {
|
||||||
|
enable = true;
|
||||||
|
appName = "pub.solar git server";
|
||||||
|
database = {
|
||||||
|
type = "postgres";
|
||||||
|
passwordFile = config.age.secrets.gitea-database-password.path;
|
||||||
|
};
|
||||||
|
domain = "git.pub.solar";
|
||||||
|
httpAddress = "127.0.0.1";
|
||||||
|
httpPort = 3000;
|
||||||
|
lfs.enable = true;
|
||||||
|
mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
|
||||||
|
rootUrl = "https://git.pub.solar";
|
||||||
|
settings = {
|
||||||
|
mailer = {
|
||||||
|
ENABLED = true;
|
||||||
|
MAILER_TYPE = "smtp";
|
||||||
|
HOST = "mx2.greenbaum.cloud:465";
|
||||||
|
FROM = ''"pub.solar git server" <gitea@pub.solar>'';
|
||||||
|
USER = "admins@pub.solar";
|
||||||
|
};
|
||||||
|
# currently broken, gpg core dumps
|
||||||
|
#"repository.signing" = {
|
||||||
|
# SIGNING_KEY = "default";
|
||||||
|
# MERGES = "always";
|
||||||
|
#};
|
||||||
|
openid = {
|
||||||
|
ENABLE_OPENID_SIGNIN = true;
|
||||||
|
ENABLE_OPENID_SIGNUP = true;
|
||||||
|
};
|
||||||
|
# uncomment after initial deployment, first user is admin user
|
||||||
|
# required to setup SSO (oauth openid-connect, keycloak auth provider)
|
||||||
|
service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
|
||||||
|
session.COOKIE_SECURE = lib.mkForce true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Required for gitea server side gpg signatures
|
||||||
|
# configured / setup manually in
|
||||||
|
# /var/lib/gitea/data/home/.gitconfig and
|
||||||
|
# /var/lib/gitea/data/home/.gnupg/
|
||||||
|
programs.gnupg.agent = {
|
||||||
|
enable = true;
|
||||||
|
pinentryFlavor = "curses";
|
||||||
|
};
|
||||||
|
# Required to make gpg work without a graphical environment?
|
||||||
|
# otherwise generating a new gpg key fails with this error:
|
||||||
|
# gpg: agent_genkey failed: No pinentry
|
||||||
|
# see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
|
||||||
|
environment.variables = {
|
||||||
|
GPG_TTY = "$(tty)";
|
||||||
|
};
|
||||||
|
}
|
44
hosts/flora-6/hardware-configuration.nix
Normal file
44
hosts/flora-6/hardware-configuration.nix
Normal file
|
@ -0,0 +1,44 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
modulesPath,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
|
||||||
|
boot.initrd.kernelModules = [];
|
||||||
|
boot.kernelModules = [];
|
||||||
|
boot.extraModulePackages = [];
|
||||||
|
|
||||||
|
fileSystems."/" = {
|
||||||
|
device = "/dev/disk/by-label/nixos";
|
||||||
|
autoResize = true;
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" = {
|
||||||
|
device = "/dev/disk/by-label/boot";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/data" = {
|
||||||
|
device = "/dev/disk/by-label/ephemeral0";
|
||||||
|
fsType = "ext4";
|
||||||
|
options = [
|
||||||
|
"defaults"
|
||||||
|
"nofail"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [];
|
||||||
|
|
||||||
|
networking.useDHCP = lib.mkDefault false;
|
||||||
|
networking.networkmanager.enable = lib.mkForce false;
|
||||||
|
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
29
hosts/flora-6/keycloak.nix
Normal file
29
hosts/flora-6/keycloak.nix
Normal file
|
@ -0,0 +1,29 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
inputs,
|
||||||
|
pkgs,
|
||||||
|
self,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
age.secrets.keycloak-database-password = {
|
||||||
|
file = "${self}/secrets/keycloak-database-password.age";
|
||||||
|
mode = "700";
|
||||||
|
#owner = "keycloak";
|
||||||
|
};
|
||||||
|
|
||||||
|
# keycloak
|
||||||
|
services.keycloak = {
|
||||||
|
enable = true;
|
||||||
|
database.passwordFile = config.age.secrets.keycloak-database-password.path;
|
||||||
|
settings = {
|
||||||
|
hostname = "auth.pub.solar";
|
||||||
|
http-host = "127.0.0.1";
|
||||||
|
http-port = 8080;
|
||||||
|
proxy = "edge";
|
||||||
|
};
|
||||||
|
themes = {
|
||||||
|
"pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
9
hosts/flora-6/triton-vmtools.nix
Normal file
9
hosts/flora-6/triton-vmtools.nix
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
inputs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
inputs.triton-vmtools.packages.${pkgs.system}.default
|
||||||
|
];
|
||||||
|
}
|
|
@ -32,6 +32,11 @@ in {
|
||||||
];
|
];
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
|
ack
|
||||||
|
bat
|
||||||
|
exa
|
||||||
|
fd
|
||||||
|
neovim
|
||||||
screen
|
screen
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -18,6 +18,8 @@ channels: final: prev: {
|
||||||
tdesktop
|
tdesktop
|
||||||
arduino
|
arduino
|
||||||
arduino-cli
|
arduino-cli
|
||||||
|
keycloak
|
||||||
|
gitea
|
||||||
;
|
;
|
||||||
|
|
||||||
haskellPackages =
|
haskellPackages =
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
self: with self; let
|
self:
|
||||||
|
with self; let
|
||||||
looking-glass-client = self.looking-glass-client.overrideAttrs (old: {
|
looking-glass-client = self.looking-glass-client.overrideAttrs (old: {
|
||||||
meta.platforms = ["x86_64-linux" "aarch64-linux"];
|
meta.platforms = ["x86_64-linux" "aarch64-linux"];
|
||||||
});
|
});
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
self: with self; let
|
self:
|
||||||
|
with self; let
|
||||||
websocket-client = python39.pkgs.buildPythonPackage rec {
|
websocket-client = python39.pkgs.buildPythonPackage rec {
|
||||||
pname = "websocket-client";
|
pname = "websocket-client";
|
||||||
version = "1.2.1";
|
version = "1.2.1";
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
self: with self; let
|
self:
|
||||||
|
with self; let
|
||||||
uhk-agent-bin = stdenv.mkDerivation rec {
|
uhk-agent-bin = stdenv.mkDerivation rec {
|
||||||
pname = "uhk-agent-bin";
|
pname = "uhk-agent-bin";
|
||||||
version = "1.5.14";
|
version = "1.5.14";
|
||||||
|
|
|
@ -7,6 +7,13 @@
|
||||||
psCfg = config.pub-solar;
|
psCfg = config.pub-solar;
|
||||||
wlroots = psCfg.graphical.wayland;
|
wlroots = psCfg.graphical.wayland;
|
||||||
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
|
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
|
||||||
|
globalVariables = {
|
||||||
|
EDITOR = "/run/current-system/sw/bin/nvim";
|
||||||
|
VISUAL = "/run/current-system/sw/bin/nvim";
|
||||||
|
|
||||||
|
# Make sure virsh runs without root
|
||||||
|
LIBVIRT_DEFAULT_URI = "qemu:///system";
|
||||||
|
};
|
||||||
variables = {
|
variables = {
|
||||||
XDG_CONFIG_HOME = xdg.configHome;
|
XDG_CONFIG_HOME = xdg.configHome;
|
||||||
XDG_CACHE_HOME = xdg.cacheHome;
|
XDG_CACHE_HOME = xdg.cacheHome;
|
||||||
|
@ -25,11 +32,8 @@
|
||||||
then "pixman"
|
then "pixman"
|
||||||
else "gles2";
|
else "gles2";
|
||||||
|
|
||||||
EDITOR = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
|
|
||||||
VISUAL = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
|
|
||||||
|
|
||||||
# fix "xdg-open fork-bomb" your preferred browser from here
|
# fix "xdg-open fork-bomb" your preferred browser from here
|
||||||
BROWSER = "${pkgs.firefox-wayland}/bin/firefox";
|
BROWSER = "firefox";
|
||||||
|
|
||||||
# node
|
# node
|
||||||
NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history";
|
NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history";
|
||||||
|
@ -41,9 +45,6 @@
|
||||||
NPM_CONFIG_CACHE = "${xdg.configHome}/npm";
|
NPM_CONFIG_CACHE = "${xdg.configHome}/npm";
|
||||||
# TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm";
|
# TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm";
|
||||||
|
|
||||||
# Make sure virsh runs without root
|
|
||||||
LIBVIRT_DEFAULT_URI = "qemu:///system";
|
|
||||||
|
|
||||||
# wine
|
# wine
|
||||||
WINEPREFIX = "${xdg.dataHome}/wineprefixes/default";
|
WINEPREFIX = "${xdg.dataHome}/wineprefixes/default";
|
||||||
|
|
||||||
|
@ -100,5 +101,5 @@ in {
|
||||||
systemd.user.sessionVariables = variablesWithMeta;
|
systemd.user.sessionVariables = variablesWithMeta;
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.variables = variablesWithMeta;
|
environment.variables = globalVariables;
|
||||||
}
|
}
|
||||||
|
|
BIN
secrets/drone-db-secrets.age
Normal file
BIN
secrets/drone-db-secrets.age
Normal file
Binary file not shown.
12
secrets/drone-secrets.age
Normal file
12
secrets/drone-secrets.age
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 Y0ZZaw 42VrEEM/4WcKKp5NZfycnkhsrkSUGGrjwrIPz9O8LhY
|
||||||
|
CrkgGDCypRzevuT5YQBZxXwdJnvlkOH1xgxgRFf2wH8
|
||||||
|
-> ssh-ed25519 BVsyTA hUQDxkdOQxsOrB/afZWXUWSgNXfDy0W3nl13aXSmvyA
|
||||||
|
cf5WfwKKOabBR7qqYblpplSxZqvFmxKCPys8Zz6ZVnU
|
||||||
|
-> #-grease B PYdk)b5 D\, z&3Vyw9u
|
||||||
|
kJnYpRA6aL4bQQA4ihI5bFl41vIzG2gOaKCJzjxnqK9DndETSoSkhWk4AX0uT0NQ
|
||||||
|
tw
|
||||||
|
--- QloJDsaDcj08NIy5j8hPMFhHZ4DyZFDR+CNtBUSbhQ0
|
||||||
|
ͼ¨Š()¯çÛµkMÀs·JÊ-d‚»láÈföžhj¤6yÕè—º4[<5B>É}»`Nµ)¸á
*Æ×H-˜œÔä²c¨³m’PEdZ²|´ÄFñF4ƒò<>´ƒÞ½<C2AD>0ä@·š7¢„;Oûwã=èÔ÷Rº:JA¦‰3ÃØOýbã0{“Ìs–ó›G6OËʯ1yd¼…e
ðÿ,÷NÀîVÎ"y4Í8Pª º_hw?¸¦ÓtüãZ"»W~Å5śˈª"ÔÝ#à4,OA¶e
|
||||||
|
#<23>]»sŒ.|ˆag¨ˆ÷K†QΨM¢¤ž/ác
|
||||||
|
ÞîäwÂÀ¼pêp=”èÏz\È›ÉÖôH«ðâ”Wñô¯Ÿv¬î¤Ó%zhL¹ˆå7··›ìB‚¡Á.F `+ÿ;e²$z¥Ýçï¡Š•qÉ<07>™qzÑS6Ä8eC£Ê=ãŒÙ#à|YŽ]÷‡ ònV”éçJ"êV†©æ+›Uï
|
BIN
secrets/gitea-database-password.age
Normal file
BIN
secrets/gitea-database-password.age
Normal file
Binary file not shown.
10
secrets/gitea-mailer-password.age
Normal file
10
secrets/gitea-mailer-password.age
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 Y0ZZaw YmqgCC6jO8dbKdRtOcwMJmFVH5fXvb5aRQbNwhEMCR4
|
||||||
|
ZbvRe+jdAmZzsJ719ClYjKOPb2fdM48Q/U+pDb9X69Y
|
||||||
|
-> ssh-ed25519 BVsyTA YATHo0THjUnU4xBE/UpW1lvuXlL8x2d8i9K98OGCaxU
|
||||||
|
01u0QrGjXiPwTy8eMf0X0o6uv+0DJD7EWejzekLjVbI
|
||||||
|
-> e@>+!e-grease ]2Kg}7m u2DZ:
|
||||||
|
3GCB1HAwQBuQ81UJGa9XwnNx7+Fqz+939SZ93yTT7c5ri5qXiGvSJ/ILgrAVerkI
|
||||||
|
7QzVT5vUiucVCbrVp72ZHAWdOwlVXNQtvFdY
|
||||||
|
--- MkgkToekZHF+bxtIJA8vnbyAj1E6VSrqbnJ1rWUFc/E
|
||||||
|
¶.,K“<>óôgܾÂcø¤¯Â‘¬~.‘L—kˆ¢åEä525«t1øÅåuûÙ
|
BIN
secrets/keycloak-database-password.age
Normal file
BIN
secrets/keycloak-database-password.age
Normal file
Binary file not shown.
|
@ -1,8 +1,15 @@
|
||||||
let
|
let
|
||||||
# set ssh public keys here for your system and user
|
# set ssh public keys here for your system and user
|
||||||
system = "";
|
b12f-main = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg=";
|
||||||
user = "";
|
b12f-backup = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw=";
|
||||||
allKeys = [system user];
|
teutat3s = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
|
||||||
|
flora-6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@pub-solar-infra-vm-1";
|
||||||
|
allKeys = [flora-6 teutat3s b12f-main b12f-backup];
|
||||||
|
deployKeys = [flora-6 teutat3s b12f-main b12f-backup];
|
||||||
in {
|
in {
|
||||||
"secret.age".publicKeys = allKeys;
|
"gitea-database-password.age".publicKeys = deployKeys;
|
||||||
|
"gitea-mailer-password.age".publicKeys = deployKeys;
|
||||||
|
"keycloak-database-password.age".publicKeys = deployKeys;
|
||||||
|
"drone-secrets.age".publicKeys = deployKeys;
|
||||||
|
"drone-db-secrets.age".publicKeys = deployKeys;
|
||||||
}
|
}
|
||||||
|
|
42
users/barkeeper/default.nix
Normal file
42
users/barkeeper/default.nix
Normal file
|
@ -0,0 +1,42 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
hmUsers,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
psCfg = config.pub-solar;
|
||||||
|
in {
|
||||||
|
config = {
|
||||||
|
home-manager.users = {inherit (hmUsers) barkeeper;};
|
||||||
|
|
||||||
|
pub-solar = {
|
||||||
|
# These are your personal settings
|
||||||
|
# The only required settings are `name` and `password`,
|
||||||
|
# The rest is used for programs like git
|
||||||
|
user = {
|
||||||
|
name = "barkeeper";
|
||||||
|
description = "pub.solar infra user";
|
||||||
|
password = "$6$MCJ28kLwfNl9SNDq$Oh9eT6Sn6z4xGrQsLlIBI7cvJzX3P5As59OSZ.hoeBWc79Un2YdwH/hRIC.4ZDOuwQp0lHI82dNn/xeTaCn631";
|
||||||
|
fullName = "pub.solar infra barkeeper";
|
||||||
|
email = "admins@pub.solar";
|
||||||
|
gpgKeyId = "";
|
||||||
|
publicKeys = [
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmiF8ndGhnx2YAWbPDq14fftAwcJ0xnjJIVTotI12OO4SPX/SwH5Yp8C8Kf002qN9FbFmaONzq3s8TYpej13JubhfsQywNuFKZuZvJeHzmOwxsANW86RVrWT0WZmYx9a/a1TF9rPQpibDVt60wX8yLdExaJc5F1SvIIuyz1kxYpz36wItfR6hcwoLGh1emFCmfCpebJmp3hsrMDTTtTW/YNhyeSZW74ckyvZyjCYtRCJ8uF0ZmOSKRdillv4Ztg8MsUubGn+vaMl6V6x/QuDuehEPoM/3wBx9o22nf+QVbk7S1PC8EdT/K5vskn4/pfR7mDCyQOq1hB4w4Oyn0dsfX pi@ssrtc"
|
||||||
|
|
||||||
|
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg= @b12f Yubi Main"
|
||||||
|
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw= @b12f Yubi Backup"
|
||||||
|
|
||||||
|
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
|
||||||
|
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
|
||||||
|
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKa5elEXgBc2luVBOHVWZisJgt0epFQOercPi0tZzPU root@cloud.pub.solar"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU axeman@tuxnix"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue