Compare commits

...

44 commits

Author SHA1 Message Date
Benjamin Bädorf 1874463c4e
flora-6/gitea: Move towards docker containers
Some checks failed
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is failing
2023-01-29 21:51:29 +01:00
Benjamin Bädorf a7d684e1f8
Add b12fs keys to infra secrets
All checks were successful
continuous-integration/drone/push Build is passing
2023-01-29 20:00:40 +01:00
teutat3s 997561f817
caddy: add to hakkonaut group
All checks were successful
continuous-integration/drone/push Build is passing
Add public SSH key to hakkonaut user
2023-01-29 17:39:34 +01:00
teutat3s 0e3b602809
drone: fix path for ISO upload on flora-6 2023-01-29 17:38:00 +01:00
teutat3s 440b38f896
Merge branch 'infra' of git.pub.solar:pub-solar/os into infra
All checks were successful
continuous-integration/drone/push Build is passing
2023-01-29 00:03:42 +01:00
teutat3s 8051531d77
base-user: userVariables -> variables 2023-01-29 00:00:56 +01:00
teutat3s 54ea93ced4
drone: fix docker runner env vars 2023-01-29 00:00:21 +01:00
teutat3s 9732e4edf1
Apply treefmt 2023-01-28 23:51:33 +01:00
teutat3s 7a7ff7b1df
flora-6: init drone docker runner 2023-01-28 23:50:31 +01:00
teutat3s 90b182e499
Merge branch 'main' into infra 2023-01-28 23:27:21 +01:00
b12f 72c84bb1e6 Merge pull request 'users/barkeeper: Add @axeman's ssh key' (#157) from add-akshay into infra
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #157
2023-01-28 23:16:37 +01:00
Akshay Mankar 7454d5fc5f
users/barkeeper: Add @axeman's ssh key
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2023-01-28 23:14:39 +01:00
teutat3s f375843f43
flora-6: init drone ci 2023-01-28 21:26:13 +01:00
teutat3s 291edb6b52
flora-6: update gitea config
change to new responsible MX
disable signing commits etc.
2023-01-28 15:15:46 +01:00
teutat3s cda684ae32
barkeeper: update password 2023-01-28 15:15:34 +01:00
teutat3s 6a6abc79c2
flora-6: ensure to disable NetworkManager 2023-01-28 15:15:17 +01:00
teutat3s de8dcbe9a2
networking: don't wait for network-online
It failed upon deployment with deploy-rs and caused it to rollback
2023-01-28 15:13:47 +01:00
teutat3s e9819fdec7
Bump flake.lock 2023-01-28 15:13:13 +01:00
teutat3s 645b10f2b9
flora-6: update Caddyfile, add missing pub.solar
config for www and mastodon well-known redirect
2023-01-21 23:22:50 +01:00
teutat3s f2c5739c97
Update flake.lock, remove fork flake input
gitea gpg PR got merged into nixos-unstable in
https://github.com/NixOS/nixpkgs/pull/203183
2023-01-21 23:21:16 +01:00
Benjamin Bädorf b1710c4013
flora6: fix caddy file_server directive name typo 2023-01-07 21:31:51 +01:00
Benjamin Bädorf f12f42827f
flora-6: Serve pub.solar website
Originally authored by @axeman
2023-01-07 21:26:14 +01:00
Benjamin Bädorf 8453b8c584
Add extra hensoko key 2023-01-07 21:23:49 +01:00
teutat3s 9ca8387d12
flora-6: redirect gitea login to keycloak 2022-11-29 00:55:18 +01:00
teutat3s 492b8695a3
Merge remote-tracking branch 'origin/nixos-22-11-racoon' into infra-22.11 2022-11-28 21:53:32 +01:00
teutat3s 9fb726b2d7
flora-6: add obs-portal to caddy
auth: redirect / to pub.solar ID management page
2022-11-28 15:32:21 +01:00
Benjamin Bädorf 161acca3a7
Update keycloak theme 2022-11-28 15:31:29 +01:00
Benjamin Bädorf 86cb6522ed
Update keycloak theme 2022-11-28 15:17:51 +01:00
Benjamin Bädorf 2b03c98cf2
Refactor flora-6 services a bit 2022-11-27 23:31:08 +01:00
teutat3s 756845c187
Bump flake.lock 2022-11-27 22:01:36 +01:00
teutat3s 7655260456
Pull in upstream commits from https://github.com/divnix/digga/pull/490
Improved flake-compat

Get the rev from the flake.lock file. Shouldn't be an issue for
first time users as the guide instructs users to generate a lock
file. `builtins.file` was used in accordance with nix.dev
reccommendations.

https://nix.dev/anti-patterns/language#reproducibility-referencing-top-level-directory-with

Rm tempfix
2022-11-27 22:01:21 +01:00
Hendrik Sokolowski b3f4727354
Update drone-config 2022-11-27 22:01:21 +01:00
teutat3s c345cb8af4
zsh: fetch plugins using nvfetcher 2022-11-27 22:01:21 +01:00
teutat3s 8fb95ce9dc
neovim: use nvfetcher for custom plugins 2022-11-27 22:01:21 +01:00
Hendrik Sokolowski cb829d0972
Make resume_offset optional 2022-11-27 22:01:21 +01:00
teutat3s ca22046f75
drone: use our custom drone-scp image 2022-11-27 22:01:20 +01:00
teutat3s 24c699698f
Bump flake.lock 2022-11-27 22:01:18 +01:00
teutat3s 1f2ba895a0
Clean some sessionVariables from global scope
Especially some XDG_* env vars polluted other users environment when set

globally
2022-11-27 21:57:34 +01:00
teutat3s a795bf4429
Rename flora6 -> flora-6 2022-11-27 21:56:40 +01:00
Benjamin Bädorf 1f2d56e0c9
Rename flora6 to flora-6
This aligns with the coming changes in hostnames in the terraform
infrastructure.
2022-11-26 02:40:51 +01:00
teutat3s 90bca8d0ba
Merge branch 'main' into infra 2022-10-05 14:45:12 +02:00
teutat3s 97d88096e8
core: disable SSH passwordAuthentication by default 2022-10-05 12:03:46 +02:00
teutat3s f0c12e38ee
Change user.publicKeys to a SSH keys string list 2022-10-05 12:03:42 +02:00
teutat3s 0e6df4e33b
flora6: init host 2022-10-05 12:02:28 +02:00
24 changed files with 783 additions and 23 deletions

View file

@ -42,7 +42,7 @@ steps:
from_secret: private_ssh_key from_secret: private_ssh_key
MANTA_USER: pub_solar MANTA_USER: pub_solar
MANTA_URL: https://eu-central.manta.greenbaum.cloud MANTA_URL: https://eu-central.manta.greenbaum.cloud
MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67" MANTA_KEY_ID: "59:9f:5a:6f:c4:e2:3b:32:7f:13:1f:de:b7:59:80:85"
commands: commands:
- export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}" - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
- echo env var TARGET_DIR is set to $$TARGET_DIR - echo env var TARGET_DIR is set to $$TARGET_DIR
@ -126,7 +126,7 @@ steps:
from_secret: iso_web_ssh_port from_secret: iso_web_ssh_port
key: key:
from_secret: iso_web_ssh_key from_secret: iso_web_ssh_key
target: /srv/os/download target: /srv/www/os/download
source: source:
- /var/nix/iso-cache/*.iso - /var/nix/iso-cache/*.iso
- /var/nix/iso-cache/*.iso.sha256 - /var/nix/iso-cache/*.iso.sha256
@ -148,6 +148,6 @@ volumes:
--- ---
kind: signature kind: signature
hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e hmac: 67d75675e20adcbdeff528915795d39b7b80575be92c08ec332ffdc63437aa61
... ...

View file

@ -120,6 +120,31 @@
"type": "github" "type": "github"
} }
}, },
"devshell_2": {
"inputs": {
"flake-utils": [
"keycloak-theme-pub-solar",
"flake-utils"
],
"nixpkgs": [
"keycloak-theme-pub-solar",
"nixpkgs"
]
},
"locked": {
"lastModified": 1667210711,
"narHash": "sha256-IoErjXZAkzYWHEpQqwu/DeRNJGFdR7X2OGbkhMqMrpw=",
"owner": "numtide",
"repo": "devshell",
"rev": "96a9dd12b8a447840cc246e17a47b81a4268bba7",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"digga": { "digga": {
"inputs": { "inputs": {
"blank": "blank", "blank": "blank",
@ -254,6 +279,36 @@
"type": "github" "type": "github"
} }
}, },
"flake-utils_3": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_4": {
"locked": {
"lastModified": 1653893745,
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"home": { "home": {
"inputs": { "inputs": {
"nixpkgs": [ "nixpkgs": [
@ -276,6 +331,29 @@
"type": "github" "type": "github"
} }
}, },
"keycloak-theme-pub-solar": {
"inputs": {
"devshell": "devshell_2",
"flake-utils": "flake-utils_3",
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1669645736,
"narHash": "sha256-u1yK1fyh1UEX3BITfk6ROenWbP3aznZRplwCE+FVtHE=",
"ref": "main",
"rev": "b488fe24a27bf76e0b777202bf13a68660121305",
"revCount": 17,
"type": "git",
"url": "https://git.pub.solar/pub-solar/keycloak-theme"
},
"original": {
"ref": "main",
"type": "git",
"url": "https://git.pub.solar/pub-solar/keycloak-theme"
}
},
"latest": { "latest": {
"locked": { "locked": {
"lastModified": 1657265485, "lastModified": 1657265485,
@ -345,11 +423,11 @@
}, },
"nixos": { "nixos": {
"locked": { "locked": {
"lastModified": 1674868155, "lastModified": 1674781052,
"narHash": "sha256-eFNm2h6fNbgD7ZpO4MHikCB5pSnCJ7DTmwPisjetmwc=", "narHash": "sha256-nseKFXRvmZ+BDAeWQtsiad+5MnvI/M2Ak9iAWzooWBw=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "ce20e9ebe1903ea2ba1ab006ec63093020c761cb", "rev": "cc4bb87f5457ba06af9ae57ee4328a49ce674b1b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -445,12 +523,38 @@
"digga": "digga", "digga": "digga",
"flake-compat": "flake-compat_3", "flake-compat": "flake-compat_3",
"home": "home", "home": "home",
"keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
"latest": "latest_2", "latest": "latest_2",
"naersk": "naersk", "naersk": "naersk",
"nixos": "nixos", "nixos": "nixos",
"nixos-generators": "nixos-generators", "nixos-generators": "nixos-generators",
"nixos-hardware": "nixos-hardware", "nixos-hardware": "nixos-hardware",
"nur": "nur" "nur": "nur",
"triton-vmtools": "triton-vmtools"
}
},
"triton-vmtools": {
"inputs": {
"flake-utils": "flake-utils_4",
"nixpkgs": [
"nixos"
]
},
"locked": {
"dir": "vmtools",
"lastModified": 1669648111,
"narHash": "sha256-EKh7iM4fCyZ7L6+HmGn3QkZ1HuG9zMEkziOH3K13SbY=",
"ref": "main",
"rev": "d78c4afe040440437949ce581ae0dcdc5893553c",
"revCount": 28,
"type": "git",
"url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
},
"original": {
"dir": "vmtools",
"ref": "main",
"type": "git",
"url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
} }
}, },
"utils": { "utils": {

View file

@ -37,6 +37,12 @@
nixos-hardware.url = "github:nixos/nixos-hardware"; nixos-hardware.url = "github:nixos/nixos-hardware";
nixos-generators.url = "github:nix-community/nixos-generators"; nixos-generators.url = "github:nix-community/nixos-generators";
triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
triton-vmtools.inputs.nixpkgs.follows = "nixos";
keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
}; };
outputs = { outputs = {
@ -48,6 +54,8 @@
nur, nur,
agenix, agenix,
deploy, deploy,
triton-vmtools,
keycloak-theme-pub-solar,
... ...
} @ inputs: } @ inputs:
digga.lib.mkFlake digga.lib.mkFlake
@ -145,6 +153,7 @@
}; };
users = { users = {
pub-solar = {suites, ...}: {imports = suites.base;}; pub-solar = {suites, ...}: {imports = suites.base;};
barkeeper = {suites, ...}: {imports = suites.base;};
}; # digga.lib.importers.rakeLeaves ./users/hm; }; # digga.lib.importers.rakeLeaves ./users/hm;
}; };
@ -152,6 +161,11 @@
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations; homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {}; deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
flora-6 = {
sshUser = "barkeeper";
hostname = "flora-6.pub.solar";
};
};
}; };
} }

86
hosts/flora-6/caddy.nix Normal file
View file

@ -0,0 +1,86 @@
{
config,
lib,
pkgs,
self,
...
}: {
services.caddy = {
enable = lib.mkForce true;
group = "hakkonaut";
email = "admins@pub.solar";
globalConfig = lib.mkForce "";
virtualHosts = {
"pub.solar" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
# PubSolarOS images
handle /os/download/* {
root * /srv/www
file_server /os/download/* browse
}
# serve base domain pub.solar for mastodon.pub.solar
# https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
handle /.well-known/host-meta {
redir https://mastodon.pub.solar{uri}
}
# pub.solar website
handle {
root * /srv/www/pub.solar
try_files {path}.html {path}
file_server
}
# minimal error handling, respond with status code and text
handle_errors {
respond "{http.error.status_code} {http.error.status_text}"
}
'';
};
"www.pub.solar" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
redir https://pub.solar{uri}
'';
};
"auth.pub.solar" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
redir / /realms/pub.solar/account temporary
reverse_proxy :8080
'';
};
"git.pub.solar" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
redir /user/login /user/oauth2/keycloak temporary
reverse_proxy :3000
'';
};
"ci.pub.solar" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
reverse_proxy :4000
'';
};
"obs-portal.pub.solar" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000
'';
};
};
};
networking.firewall.allowedTCPPorts = [80 443];
}

View file

@ -0,0 +1,5 @@
{...}: {
imports = [
./flora-6.nix
];
}

107
hosts/flora-6/drone.nix Normal file
View file

@ -0,0 +1,107 @@
{
config,
lib,
pkgs,
self,
...
}: {
age.secrets.drone-secrets = {
file = "${self}/secrets/drone-secrets.age";
mode = "600";
owner = "drone";
};
age.secrets.drone-db-secrets = {
file = "${self}/secrets/drone-db-secrets.age";
mode = "600";
owner = "drone";
};
users.users.drone = {
description = "Drone Service";
home = "/var/lib/drone";
useDefaultShell = true;
uid = 994;
group = "drone";
isSystemUser = true;
};
users.groups.drone = {};
systemd.tmpfiles.rules = [
"d '/var/lib/drone-db' 0750 drone drone - -"
];
system.activationScripts.mkDroneNet = let
docker = config.virtualisation.oci-containers.backend;
dockerBin = "${pkgs.${docker}}/bin/${docker}";
in ''
${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
'';
virtualisation = {
docker = {
enable = true; # sadly podman is not supported rightnow
};
oci-containers = {
backend = "docker";
containers."drone-db" = {
image = "postgres:14";
autoStart = true;
user = "994";
volumes = [
"/var/lib/drone-db:/var/lib/postgresql/data"
];
extraOptions = [
"--network=drone-net"
];
environmentFiles = [
config.age.secrets.drone-db-secrets.path
];
};
containers."drone-server" = {
image = "drone/drone:2";
autoStart = true;
user = "994";
ports = [
"4000:80"
];
dependsOn = ["drone-db"];
extraOptions = [
"--network=drone-net"
];
environment = {
DRONE_GITEA_SERVER = "https://git.pub.solar";
DRONE_SERVER_HOST = "ci.pub.solar";
DRONE_SERVER_PROTO = "https";
DRONE_DATABASE_DRIVER = "postgres";
};
environmentFiles = [
config.age.secrets.drone-secrets.path
];
};
containers."drone-docker-runner" = {
image = "drone/drone-runner-docker:1";
autoStart = true;
# needs to run as root
#user = "994";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
];
dependsOn = ["drone-db"];
extraOptions = [
"--network=drone-net"
];
environment = {
DRONE_RPC_HOST = "ci.pub.solar";
DRONE_RPC_PROTO = "https";
DRONE_RUNNER_CAPACITY = "2";
DRONE_RUNNER_NAME = "flora-6-docker-runner";
};
environmentFiles = [
config.age.secrets.drone-secrets.path
];
};
};
};
}

147
hosts/flora-6/flora-6.nix Normal file
View file

@ -0,0 +1,147 @@
{
config,
latestModulesPath,
lib,
inputs,
pkgs,
profiles,
self,
...
}: let
psCfg = config.pub-solar;
in {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./triton-vmtools.nix
./caddy.nix
./drone.nix
./keycloak.nix
./gitea.nix
profiles.base-user
profiles.users.root # make sure to configure ssh keys
profiles.users.barkeeper
"${latestModulesPath}/services/web-apps/keycloak.nix"
"${latestModulesPath}/services/misc/gitea.nix"
];
disabledModules = [
"services/web-apps/keycloak.nix"
"services/misc/gitea.nix"
];
config = {
# # #
# # # pub.solar options
# # #
pub-solar.core = {
disk-encryption-active = false;
iso-options.enable = true;
lite = true;
};
# Allow sudo without a password for the barkeeper user
security.sudo.extraRules = [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
# Machine user for CI pipelines
users.users.hakkonaut = {
description = "CI and automation user";
home = "/var/nix/iso-cache";
useDefaultShell = true;
uid = 998;
group = "hakkonaut";
isSystemUser = true;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
];
};
users.groups.hakkonaut = {};
# # #
# # # Triton host specific options
# # # DO NOT ALTER below this line, changes might render system unbootable
# # #
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Force getting the hostname from cloud-init
networking.hostName = lib.mkDefault "";
# Set your time zone.
time.timeZone = "Europe/Berlin";
# Select internationalisation properties.
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
git
vim
wget
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# List services that you want to enable:
services.cloud-init.enable = true;
services.cloud-init.ext4.enable = true;
services.cloud-init.network.enable = true;
# use the default NixOS cloud-init config, but add some SmartOS customization to it
environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
datasource_list: [ SmartOS ]
# Do not create the centos/ubuntu/debian user
users: [ ]
# mount second disk with label ephemeral0, gets formated by cloud-init
# this will fail to get added to /etc/fstab as it's read-only, but should
# mount at boot anyway
mounts:
- [ vdb, /data, auto, "defaults,nofail" ]
'';
# Enable the OpenSSH daemon.
services.openssh = {
enable = true;
passwordAuthentication = false;
permitRootLogin = "no";
};
# We manage the firewall with nix, too
# altough triton can also manage firewall rules via the triton fwrule subcommand
networking.firewall.enable = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.05"; # Did you read the comment?
};
}

133
hosts/flora-6/gitea.nix Normal file
View file

@ -0,0 +1,133 @@
{
config,
lib,
pkgs,
self,
...
}: {
age.secrets.gitea-database-password = {
file = "${self}/secrets/gitea-database-password.age";
mode = "600";
owner = "gitea";
};
age.secrets.gitea-mailer-password = {
file = "${self}/secrets/gitea-mailer-password.age";
mode = "600";
owner = "gitea";
};
users.users.git = {
description = "Gitea SSH Service";
home = "/var/lib/gitea/git";
useDefaultShell = false;
uid = 995;
isSystemUser = true;
};
virtualisation = {
docker = {
enable = true; # sadly podman is not supported rightnow
};
oci-containers = {
backend = "docker";
containers."gitea" = {
image = "gitea:gitea:1.18.3";
autoStart = true;
user = "995";
ports = [
"127.0.0.1:3000:3000"
"127.0.0.1:2222:22"
];
volumes = [
"/var/lib/gitea:/data"
# Secrets go in the app.ini file, the rest wil be done in nix via environment variables
"/var/lib/gitea/custom/conf/app.ini:/${config.age.secrets.gitea-secrets-app-ini.path}"
"/etc/timezone:/etc/timezone:ro"
"/etc/localtime:/etc/localtime:ro"
];
extraOptions = [
"--network=gitea"
];
environment = {
USER_UID = "postgres";
USER_GID = "postgres";
RUN_MODE = "prod";
SSH_DOMAIN = "git.pub.solar";
ROOT_URL = "git.pub.solar";
DB_TYPE = "postgres";
DB_HOST = "gitea-db";
DISABLE_REGISTRATION = "true";
};
};
containers."gitea-db" = {
image = "postgres:14";
autoStart = true;
volumes = [
"/var/lib/gitea-db:/var/lib/postgresql/data"
];
extraOptions = [
"--network=gitea"
];
environmentFiles = [
config.age.secrets.gitea-db-secrets.path
];
};
};
};
# gitea
services.gitea = {
enable = true;
appName = "pub.solar git server";
database = {
type = "postgres";
passwordFile = config.age.secrets.gitea-database-password.path;
};
domain = "git.pub.solar";
httpAddress = "127.0.0.1";
httpPort = 3000;
lfs.enable = true;
mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
rootUrl = "https://git.pub.solar";
settings = {
mailer = {
ENABLED = true;
MAILER_TYPE = "smtp";
HOST = "mx2.greenbaum.cloud:465";
FROM = ''"pub.solar git server" <gitea@pub.solar>'';
USER = "admins@pub.solar";
};
# currently broken, gpg core dumps
#"repository.signing" = {
# SIGNING_KEY = "default";
# MERGES = "always";
#};
openid = {
ENABLE_OPENID_SIGNIN = true;
ENABLE_OPENID_SIGNUP = true;
};
# uncomment after initial deployment, first user is admin user
# required to setup SSO (oauth openid-connect, keycloak auth provider)
service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
session.COOKIE_SECURE = lib.mkForce true;
};
};
# Required for gitea server side gpg signatures
# configured / setup manually in
# /var/lib/gitea/data/home/.gitconfig and
# /var/lib/gitea/data/home/.gnupg/
programs.gnupg.agent = {
enable = true;
pinentryFlavor = "curses";
};
# Required to make gpg work without a graphical environment?
# otherwise generating a new gpg key fails with this error:
# gpg: agent_genkey failed: No pinentry
# see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
environment.variables = {
GPG_TTY = "$(tty)";
};
}

View file

@ -0,0 +1,44 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [];
boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
boot.initrd.kernelModules = [];
boot.kernelModules = [];
boot.extraModulePackages = [];
fileSystems."/" = {
device = "/dev/disk/by-label/nixos";
autoResize = true;
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-label/boot";
fsType = "vfat";
};
fileSystems."/data" = {
device = "/dev/disk/by-label/ephemeral0";
fsType = "ext4";
options = [
"defaults"
"nofail"
];
};
swapDevices = [];
networking.useDHCP = lib.mkDefault false;
networking.networkmanager.enable = lib.mkForce false;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

View file

@ -0,0 +1,29 @@
{
config,
lib,
inputs,
pkgs,
self,
...
}: {
age.secrets.keycloak-database-password = {
file = "${self}/secrets/keycloak-database-password.age";
mode = "700";
#owner = "keycloak";
};
# keycloak
services.keycloak = {
enable = true;
database.passwordFile = config.age.secrets.keycloak-database-password.path;
settings = {
hostname = "auth.pub.solar";
http-host = "127.0.0.1";
http-port = 8080;
proxy = "edge";
};
themes = {
"pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
};
};
}

View file

@ -0,0 +1,9 @@
{
pkgs,
inputs,
...
}: {
environment.systemPackages = with pkgs; [
inputs.triton-vmtools.packages.${pkgs.system}.default
];
}

View file

@ -32,6 +32,11 @@ in {
]; ];
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
ack
bat
exa
fd
neovim
screen screen
]; ];

View file

@ -18,6 +18,8 @@ channels: final: prev: {
tdesktop tdesktop
arduino arduino
arduino-cli arduino-cli
keycloak
gitea
; ;
haskellPackages = haskellPackages =

View file

@ -1,4 +1,5 @@
self: with self; let self:
with self; let
looking-glass-client = self.looking-glass-client.overrideAttrs (old: { looking-glass-client = self.looking-glass-client.overrideAttrs (old: {
meta.platforms = ["x86_64-linux" "aarch64-linux"]; meta.platforms = ["x86_64-linux" "aarch64-linux"];
}); });

View file

@ -1,4 +1,5 @@
self: with self; let self:
with self; let
websocket-client = python39.pkgs.buildPythonPackage rec { websocket-client = python39.pkgs.buildPythonPackage rec {
pname = "websocket-client"; pname = "websocket-client";
version = "1.2.1"; version = "1.2.1";

View file

@ -1,4 +1,5 @@
self: with self; let self:
with self; let
uhk-agent-bin = stdenv.mkDerivation rec { uhk-agent-bin = stdenv.mkDerivation rec {
pname = "uhk-agent-bin"; pname = "uhk-agent-bin";
version = "1.5.14"; version = "1.5.14";

View file

@ -7,6 +7,13 @@
psCfg = config.pub-solar; psCfg = config.pub-solar;
wlroots = psCfg.graphical.wayland; wlroots = psCfg.graphical.wayland;
xdg = config.home-manager.users."${psCfg.user.name}".xdg; xdg = config.home-manager.users."${psCfg.user.name}".xdg;
globalVariables = {
EDITOR = "/run/current-system/sw/bin/nvim";
VISUAL = "/run/current-system/sw/bin/nvim";
# Make sure virsh runs without root
LIBVIRT_DEFAULT_URI = "qemu:///system";
};
variables = { variables = {
XDG_CONFIG_HOME = xdg.configHome; XDG_CONFIG_HOME = xdg.configHome;
XDG_CACHE_HOME = xdg.cacheHome; XDG_CACHE_HOME = xdg.cacheHome;
@ -25,11 +32,8 @@
then "pixman" then "pixman"
else "gles2"; else "gles2";
EDITOR = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
VISUAL = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
# fix "xdg-open fork-bomb" your preferred browser from here # fix "xdg-open fork-bomb" your preferred browser from here
BROWSER = "${pkgs.firefox-wayland}/bin/firefox"; BROWSER = "firefox";
# node # node
NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history"; NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history";
@ -41,9 +45,6 @@
NPM_CONFIG_CACHE = "${xdg.configHome}/npm"; NPM_CONFIG_CACHE = "${xdg.configHome}/npm";
# TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm"; # TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm";
# Make sure virsh runs without root
LIBVIRT_DEFAULT_URI = "qemu:///system";
# wine # wine
WINEPREFIX = "${xdg.dataHome}/wineprefixes/default"; WINEPREFIX = "${xdg.dataHome}/wineprefixes/default";
@ -100,5 +101,5 @@ in {
systemd.user.sessionVariables = variablesWithMeta; systemd.user.sessionVariables = variablesWithMeta;
}; };
environment.variables = variablesWithMeta; environment.variables = globalVariables;
} }

Binary file not shown.

12
secrets/drone-secrets.age Normal file
View file

@ -0,0 +1,12 @@
age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw 42VrEEM/4WcKKp5NZfycnkhsrkSUGGrjwrIPz9O8LhY
CrkgGDCypRzevuT5YQBZxXwdJnvlkOH1xgxgRFf2wH8
-> ssh-ed25519 BVsyTA hUQDxkdOQxsOrB/afZWXUWSgNXfDy0W3nl13aXSmvyA
cf5WfwKKOabBR7qqYblpplSxZqvFmxKCPys8Zz6ZVnU
-> #-grease B PYdk)b5 D\, z&3Vyw9u
kJnYpRA6aL4bQQA4ihI5bFl41vIzG2gOaKCJzjxnqK9DndETSoSkhWk4AX0uT0NQ
tw
--- QloJDsaDcj08NIy5j8hPMFhHZ4DyZFDR+CNtBUSbhQ0
ͼ¨Š()¯çÛµkMÀs·JÊ-d»láÈföžhj¤6yÕè—º4[<5B>É}»`Nµ)¸á *Æ×H-˜œÔä²c¨³mPEdZ²|´ÄFñF4ƒò<>´ƒÞ­½<C2AD>0ä@·š7¢„;Oûwã=èÔ÷Rº:JA¦‰3ÃØOýbã0{“ÌsóG6OËʯ1yd¼…e ðÿ,÷NÀîVÎ"y4Í8Pª º_hw?¸¦Ótüã­Z"»W~Å5śˈª"ÔÝ#à4,OA¶e
#<23>]»sŒ.|ˆag¨ˆ÷K†QΨM¢¤ž/ác
ÞîäwÂÀ¼pêp=”èÏz\ÈÉÖôH«ðâ”Wñô¯Ÿv¬î¤Ó%zhL¹ˆå7··ìB¡Á.F `+ÿ;e²$z¥Ýçï¡Š•qÉ<07>™qzÑS6Ä8eC£Ê=ãŒÙ#à|YŽ]÷  ònV”éçJ"êV†©æ+

Binary file not shown.

View file

@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw YmqgCC6jO8dbKdRtOcwMJmFVH5fXvb5aRQbNwhEMCR4
ZbvRe+jdAmZzsJ719ClYjKOPb2fdM48Q/U+pDb9X69Y
-> ssh-ed25519 BVsyTA YATHo0THjUnU4xBE/UpW1lvuXlL8x2d8i9K98OGCaxU
01u0QrGjXiPwTy8eMf0X0o6uv+0DJD7EWejzekLjVbI
-> e@>+!e-grease ]2Kg}7m u2DZ:
3GCB1HAwQBuQ81UJGa9XwnNx7+Fqz+939SZ93yTT7c5ri5qXiGvSJ/ILgrAVerkI
7QzVT5vUiucVCbrVp72ZHAWdOwlVXNQtvFdY
--- MkgkToekZHF+bxtIJA8vnbyAj1E6VSrqbnJ1rWUFc/E
¶.,K<>óôgܾÂcø¤¯Â‘¬~.L—kˆ¢åEä525«t1øÅåuûÙ

Binary file not shown.

View file

@ -1,8 +1,15 @@
let let
# set ssh public keys here for your system and user # set ssh public keys here for your system and user
system = ""; b12f-main = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg=";
user = ""; b12f-backup = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw=";
allKeys = [system user]; teutat3s = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
flora-6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@pub-solar-infra-vm-1";
allKeys = [flora-6 teutat3s b12f-main b12f-backup];
deployKeys = [flora-6 teutat3s b12f-main b12f-backup];
in { in {
"secret.age".publicKeys = allKeys; "gitea-database-password.age".publicKeys = deployKeys;
"gitea-mailer-password.age".publicKeys = deployKeys;
"keycloak-database-password.age".publicKeys = deployKeys;
"drone-secrets.age".publicKeys = deployKeys;
"drone-db-secrets.age".publicKeys = deployKeys;
} }

View file

@ -0,0 +1,42 @@
{
config,
hmUsers,
pkgs,
lib,
...
}: let
psCfg = config.pub-solar;
in {
config = {
home-manager.users = {inherit (hmUsers) barkeeper;};
pub-solar = {
# These are your personal settings
# The only required settings are `name` and `password`,
# The rest is used for programs like git
user = {
name = "barkeeper";
description = "pub.solar infra user";
password = "$6$MCJ28kLwfNl9SNDq$Oh9eT6Sn6z4xGrQsLlIBI7cvJzX3P5As59OSZ.hoeBWc79Un2YdwH/hRIC.4ZDOuwQp0lHI82dNn/xeTaCn631";
fullName = "pub.solar infra barkeeper";
email = "admins@pub.solar";
gpgKeyId = "";
publicKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmiF8ndGhnx2YAWbPDq14fftAwcJ0xnjJIVTotI12OO4SPX/SwH5Yp8C8Kf002qN9FbFmaONzq3s8TYpej13JubhfsQywNuFKZuZvJeHzmOwxsANW86RVrWT0WZmYx9a/a1TF9rPQpibDVt60wX8yLdExaJc5F1SvIIuyz1kxYpz36wItfR6hcwoLGh1emFCmfCpebJmp3hsrMDTTtTW/YNhyeSZW74ckyvZyjCYtRCJ8uF0ZmOSKRdillv4Ztg8MsUubGn+vaMl6V6x/QuDuehEPoM/3wBx9o22nf+QVbk7S1PC8EdT/K5vskn4/pfR7mDCyQOq1hB4w4Oyn0dsfX pi@ssrtc"
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg= @b12f Yubi Main"
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw= @b12f Yubi Backup"
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKa5elEXgBc2luVBOHVWZisJgt0epFQOercPi0tZzPU root@cloud.pub.solar"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU axeman@tuxnix"
];
};
};
};
}