flora-6/gitea: Move towards docker containers

Add public SSH key to hakkonaut user

.drone.yml

@@ -42,7 +42,7 @@ steps:
         from_secret: private_ssh_key
       MANTA_USER: pub_solar
       MANTA_URL: https://eu-central.manta.greenbaum.cloud
-      MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
+      MANTA_KEY_ID: "59:9f:5a:6f:c4:e2:3b:32:7f:13:1f:de:b7:59:80:85"
     commands:
       - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
       - echo env var TARGET_DIR is set to $$TARGET_DIR
@@ -126,7 +126,7 @@ steps:
         from_secret: iso_web_ssh_port
       key:
         from_secret: iso_web_ssh_key
-      target: /srv/os/download
+      target: /srv/www/os/download
       source:
         - /var/nix/iso-cache/*.iso
         - /var/nix/iso-cache/*.iso.sha256
@@ -148,6 +148,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e
+hmac: 67d75675e20adcbdeff528915795d39b7b80575be92c08ec332ffdc63437aa61
 
 ...

flake.lock

@@ -120,6 +120,31 @@
         "type": "github"
       }
     },
+    "devshell_2": {
+      "inputs": {
+        "flake-utils": [
+          "keycloak-theme-pub-solar",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "keycloak-theme-pub-solar",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1667210711,
+        "narHash": "sha256-IoErjXZAkzYWHEpQqwu/DeRNJGFdR7X2OGbkhMqMrpw=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "96a9dd12b8a447840cc246e17a47b81a4268bba7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "digga": {
       "inputs": {
         "blank": "blank",
@@ -254,6 +279,36 @@
         "type": "github"
       }
     },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home": {
       "inputs": {
         "nixpkgs": [
@@ -276,6 +331,29 @@
         "type": "github"
       }
     },
+    "keycloak-theme-pub-solar": {
+      "inputs": {
+        "devshell": "devshell_2",
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "nixos"
+        ]
+      },
+      "locked": {
+        "lastModified": 1669645736,
+        "narHash": "sha256-u1yK1fyh1UEX3BITfk6ROenWbP3aznZRplwCE+FVtHE=",
+        "ref": "main",
+        "rev": "b488fe24a27bf76e0b777202bf13a68660121305",
+        "revCount": 17,
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
+      }
+    },
     "latest": {
       "locked": {
         "lastModified": 1657265485,
@@ -345,11 +423,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1674868155,
-        "narHash": "sha256-eFNm2h6fNbgD7ZpO4MHikCB5pSnCJ7DTmwPisjetmwc=",
+        "lastModified": 1674781052,
+        "narHash": "sha256-nseKFXRvmZ+BDAeWQtsiad+5MnvI/M2Ak9iAWzooWBw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ce20e9ebe1903ea2ba1ab006ec63093020c761cb",
+        "rev": "cc4bb87f5457ba06af9ae57ee4328a49ce674b1b",
         "type": "github"
       },
       "original": {
@@ -445,12 +523,38 @@
         "digga": "digga",
         "flake-compat": "flake-compat_3",
         "home": "home",
+        "keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
         "latest": "latest_2",
         "naersk": "naersk",
         "nixos": "nixos",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "nur": "nur"
+        "nur": "nur",
+        "triton-vmtools": "triton-vmtools"
+      }
+    },
+    "triton-vmtools": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": [
+          "nixos"
+        ]
+      },
+      "locked": {
+        "dir": "vmtools",
+        "lastModified": 1669648111,
+        "narHash": "sha256-EKh7iM4fCyZ7L6+HmGn3QkZ1HuG9zMEkziOH3K13SbY=",
+        "ref": "main",
+        "rev": "d78c4afe040440437949ce581ae0dcdc5893553c",
+        "revCount": 28,
+        "type": "git",
+        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
+      },
+      "original": {
+        "dir": "vmtools",
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
       }
     },
     "utils": {

flake.nix

@@ -37,6 +37,12 @@
     nixos-hardware.url = "github:nixos/nixos-hardware";
 
     nixos-generators.url = "github:nix-community/nixos-generators";
+
+    triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
+    triton-vmtools.inputs.nixpkgs.follows = "nixos";
+
+    keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
+    keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
   };
 
   outputs = {
@@ -48,6 +54,8 @@
     nur,
     agenix,
     deploy,
+    triton-vmtools,
+    keycloak-theme-pub-solar,
     ...
   } @ inputs:
     digga.lib.mkFlake
@@ -145,6 +153,7 @@
         };
         users = {
           pub-solar = {suites, ...}: {imports = suites.base;};
+          barkeeper = {suites, ...}: {imports = suites.base;};
         }; # digga.lib.importers.rakeLeaves ./users/hm;
       };
 
@@ -152,6 +161,11 @@
 
       homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
 
-      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {};
+      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
+        flora-6 = {
+          sshUser = "barkeeper";
+          hostname = "flora-6.pub.solar";
+        };
+      };
     };
 }

hosts/flora-6/caddy.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  self,
+  ...
+}: {
+  services.caddy = {
+    enable = lib.mkForce true;
+    group = "hakkonaut";
+    email = "admins@pub.solar";
+    globalConfig = lib.mkForce "";
+    virtualHosts = {
+      "pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          # PubSolarOS images
+          handle /os/download/* {
+            root * /srv/www
+            file_server /os/download/* browse
+          }
+          # serve base domain pub.solar for mastodon.pub.solar
+          # https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
+          handle /.well-known/host-meta {
+            redir https://mastodon.pub.solar{uri}
+          }
+          # pub.solar website
+          handle {
+            root * /srv/www/pub.solar
+            try_files {path}.html {path}
+            file_server
+          }
+          # minimal error handling, respond with status code and text
+          handle_errors {
+            respond "{http.error.status_code} {http.error.status_text}"
+          }
+        '';
+      };
+      "www.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          redir https://pub.solar{uri}
+        '';
+      };
+      "auth.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          redir / /realms/pub.solar/account temporary
+          reverse_proxy :8080
+        '';
+      };
+      "git.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          redir /user/login /user/oauth2/keycloak temporary
+          reverse_proxy :3000
+        '';
+      };
+      "ci.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          reverse_proxy :4000
+        '';
+      };
+      "obs-portal.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000
+        '';
+      };
+    };
+  };
+  networking.firewall.allowedTCPPorts = [80 443];
+}

hosts/flora-6/default.nix

@@ -0,0 +1,5 @@
+{...}: {
+  imports = [
+    ./flora-6.nix
+  ];
+}

hosts/flora-6/drone.nix

@@ -0,0 +1,107 @@
+{
+  config,
+  lib,
+  pkgs,
+  self,
+  ...
+}: {
+  age.secrets.drone-secrets = {
+    file = "${self}/secrets/drone-secrets.age";
+    mode = "600";
+    owner = "drone";
+  };
+  age.secrets.drone-db-secrets = {
+    file = "${self}/secrets/drone-db-secrets.age";
+    mode = "600";
+    owner = "drone";
+  };
+
+  users.users.drone = {
+    description = "Drone Service";
+    home = "/var/lib/drone";
+    useDefaultShell = true;
+    uid = 994;
+    group = "drone";
+    isSystemUser = true;
+  };
+
+  users.groups.drone = {};
+
+  systemd.tmpfiles.rules = [
+    "d '/var/lib/drone-db' 0750 drone drone - -"
+  ];
+
+  system.activationScripts.mkDroneNet = let
+    docker = config.virtualisation.oci-containers.backend;
+    dockerBin = "${pkgs.${docker}}/bin/${docker}";
+  in ''
+    ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
+  '';
+
+  virtualisation = {
+    docker = {
+      enable = true; # sadly podman is not supported rightnow
+    };
+
+    oci-containers = {
+      backend = "docker";
+      containers."drone-db" = {
+        image = "postgres:14";
+        autoStart = true;
+        user = "994";
+        volumes = [
+          "/var/lib/drone-db:/var/lib/postgresql/data"
+        ];
+        extraOptions = [
+          "--network=drone-net"
+        ];
+        environmentFiles = [
+          config.age.secrets.drone-db-secrets.path
+        ];
+      };
+      containers."drone-server" = {
+        image = "drone/drone:2";
+        autoStart = true;
+        user = "994";
+        ports = [
+          "4000:80"
+        ];
+        dependsOn = ["drone-db"];
+        extraOptions = [
+          "--network=drone-net"
+        ];
+        environment = {
+          DRONE_GITEA_SERVER = "https://git.pub.solar";
+          DRONE_SERVER_HOST = "ci.pub.solar";
+          DRONE_SERVER_PROTO = "https";
+          DRONE_DATABASE_DRIVER = "postgres";
+        };
+        environmentFiles = [
+          config.age.secrets.drone-secrets.path
+        ];
+      };
+      containers."drone-docker-runner" = {
+        image = "drone/drone-runner-docker:1";
+        autoStart = true;
+        # needs to run as root
+        #user = "994";
+        volumes = [
+          "/var/run/docker.sock:/var/run/docker.sock"
+        ];
+        dependsOn = ["drone-db"];
+        extraOptions = [
+          "--network=drone-net"
+        ];
+        environment = {
+          DRONE_RPC_HOST = "ci.pub.solar";
+          DRONE_RPC_PROTO = "https";
+          DRONE_RUNNER_CAPACITY = "2";
+          DRONE_RUNNER_NAME = "flora-6-docker-runner";
+        };
+        environmentFiles = [
+          config.age.secrets.drone-secrets.path
+        ];
+      };
+    };
+  };
+}

hosts/flora-6/flora-6.nix

@@ -0,0 +1,147 @@
+{
+  config,
+  latestModulesPath,
+  lib,
+  inputs,
+  pkgs,
+  profiles,
+  self,
+  ...
+}: let
+  psCfg = config.pub-solar;
+in {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./triton-vmtools.nix
+
+    ./caddy.nix
+    ./drone.nix
+    ./keycloak.nix
+    ./gitea.nix
+
+    profiles.base-user
+    profiles.users.root # make sure to configure ssh keys
+    profiles.users.barkeeper
+
+    "${latestModulesPath}/services/web-apps/keycloak.nix"
+    "${latestModulesPath}/services/misc/gitea.nix"
+  ];
+  disabledModules = [
+    "services/web-apps/keycloak.nix"
+    "services/misc/gitea.nix"
+  ];
+
+  config = {
+    # # #
+    # # # pub.solar options
+    # # #
+    pub-solar.core = {
+      disk-encryption-active = false;
+      iso-options.enable = true;
+      lite = true;
+    };
+
+    # Allow sudo without a password for the barkeeper user
+    security.sudo.extraRules = [
+      {
+        users = ["${psCfg.user.name}"];
+        commands = [
+          {
+            command = "ALL";
+            options = ["NOPASSWD"];
+          }
+        ];
+      }
+    ];
+
+    # Machine user for CI pipelines
+    users.users.hakkonaut = {
+      description = "CI and automation user";
+      home = "/var/nix/iso-cache";
+      useDefaultShell = true;
+      uid = 998;
+      group = "hakkonaut";
+      isSystemUser = true;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
+      ];
+    };
+
+    users.groups.hakkonaut = {};
+
+    # # #
+    # # # Triton host specific options
+    # # # DO NOT ALTER below this line, changes might render system unbootable
+    # # #
+
+    # Use the systemd-boot EFI boot loader.
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # Force getting the hostname from cloud-init
+    networking.hostName = lib.mkDefault "";
+
+    # Set your time zone.
+    time.timeZone = "Europe/Berlin";
+
+    # Select internationalisation properties.
+    console = {
+      font = "Lat2-Terminus16";
+      keyMap = "us";
+    };
+
+    # List packages installed in system profile. To search, run:
+    # $ nix search wget
+    environment.systemPackages = with pkgs; [
+      git
+      vim
+      wget
+    ];
+
+    # Some programs need SUID wrappers, can be configured further or are
+    # started in user sessions.
+    # programs.mtr.enable = true;
+    # programs.gnupg.agent = {
+    #   enable = true;
+    #   enableSSHSupport = true;
+    # };
+
+    # List services that you want to enable:
+    services.cloud-init.enable = true;
+    services.cloud-init.ext4.enable = true;
+    services.cloud-init.network.enable = true;
+    # use the default NixOS cloud-init config, but add some SmartOS customization to it
+    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
+      datasource_list: [ SmartOS ]
+
+      # Do not create the centos/ubuntu/debian user
+      users: [ ]
+
+      # mount second disk with label ephemeral0, gets formated by cloud-init
+      # this will fail to get added to /etc/fstab as it's read-only, but should
+      # mount at boot anyway
+      mounts:
+      - [ vdb, /data, auto, "defaults,nofail" ]
+    '';
+
+    # Enable the OpenSSH daemon.
+    services.openssh = {
+      enable = true;
+      passwordAuthentication = false;
+      permitRootLogin = "no";
+    };
+
+    # We manage the firewall with nix, too
+    # altough triton can also manage firewall rules via the triton fwrule subcommand
+    networking.firewall.enable = true;
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "22.05"; # Did you read the comment?
+  };
+}

hosts/flora-6/gitea.nix

@@ -0,0 +1,133 @@
+{
+  config,
+  lib,
+  pkgs,
+  self,
+  ...
+}: {
+  age.secrets.gitea-database-password = {
+    file = "${self}/secrets/gitea-database-password.age";
+    mode = "600";
+    owner = "gitea";
+  };
+  age.secrets.gitea-mailer-password = {
+    file = "${self}/secrets/gitea-mailer-password.age";
+    mode = "600";
+    owner = "gitea";
+  };
+
+  users.users.git = {
+    description = "Gitea SSH Service";
+    home = "/var/lib/gitea/git";
+    useDefaultShell = false;
+    uid = 995;
+    isSystemUser = true;
+  };
+
+  virtualisation = {
+    docker = {
+      enable = true; # sadly podman is not supported rightnow
+    };
+
+    oci-containers = {
+      backend = "docker";
+      containers."gitea" = {
+        image = "gitea:gitea:1.18.3";
+        autoStart = true;
+        user = "995";
+        ports = [
+          "127.0.0.1:3000:3000"
+          "127.0.0.1:2222:22"
+        ];
+        volumes = [
+          "/var/lib/gitea:/data"
+          # Secrets go in the app.ini file, the rest wil be done in nix via environment variables
+          "/var/lib/gitea/custom/conf/app.ini:/${config.age.secrets.gitea-secrets-app-ini.path}"
+          "/etc/timezone:/etc/timezone:ro"
+          "/etc/localtime:/etc/localtime:ro"
+        ];
+        extraOptions = [
+          "--network=gitea"
+        ];
+        environment = {
+          USER_UID = "postgres";
+          USER_GID = "postgres";
+          RUN_MODE = "prod";
+          SSH_DOMAIN = "git.pub.solar";
+          ROOT_URL = "git.pub.solar";
+          DB_TYPE = "postgres";
+          DB_HOST = "gitea-db";
+          DISABLE_REGISTRATION = "true";
+        };
+      };
+
+      containers."gitea-db" = {
+        image = "postgres:14";
+        autoStart = true;
+        volumes = [
+          "/var/lib/gitea-db:/var/lib/postgresql/data"
+        ];
+        extraOptions = [
+          "--network=gitea"
+        ];
+        environmentFiles = [
+          config.age.secrets.gitea-db-secrets.path
+        ];
+      };
+    };
+  };
+
+  # gitea
+  services.gitea = {
+    enable = true;
+    appName = "pub.solar git server";
+    database = {
+      type = "postgres";
+      passwordFile = config.age.secrets.gitea-database-password.path;
+    };
+    domain = "git.pub.solar";
+    httpAddress = "127.0.0.1";
+    httpPort = 3000;
+    lfs.enable = true;
+    mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
+    rootUrl = "https://git.pub.solar";
+    settings = {
+      mailer = {
+        ENABLED = true;
+        MAILER_TYPE = "smtp";
+        HOST = "mx2.greenbaum.cloud:465";
+        FROM = ''"pub.solar git server" <gitea@pub.solar>'';
+        USER = "admins@pub.solar";
+      };
+      # currently broken, gpg core dumps
+      #"repository.signing" = {
+      #  SIGNING_KEY = "default";
+      #  MERGES = "always";
+      #};
+      openid = {
+        ENABLE_OPENID_SIGNIN = true;
+        ENABLE_OPENID_SIGNUP = true;
+      };
+      # uncomment after initial deployment, first user is admin user
+      # required to setup SSO (oauth openid-connect, keycloak auth provider)
+      service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+      session.COOKIE_SECURE = lib.mkForce true;
+    };
+  };
+
+  # Required for gitea server side gpg signatures
+  # configured / setup manually in
+  # /var/lib/gitea/data/home/.gitconfig and
+  # /var/lib/gitea/data/home/.gnupg/
+  programs.gnupg.agent = {
+    enable = true;
+    pinentryFlavor = "curses";
+  };
+  # Required to make gpg work without a graphical environment?
+  # otherwise generating a new gpg key fails with this error:
+  # gpg: agent_genkey failed: No pinentry
+  # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
+  environment.variables = {
+    GPG_TTY = "$(tty)";
+  };
+}

hosts/flora-6/hardware-configuration.nix

@@ -0,0 +1,44 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [];
+
+  boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
+  fileSystems."/data" = {
+    device = "/dev/disk/by-label/ephemeral0";
+    fsType = "ext4";
+    options = [
+      "defaults"
+      "nofail"
+    ];
+  };
+
+  swapDevices = [];
+
+  networking.useDHCP = lib.mkDefault false;
+  networking.networkmanager.enable = lib.mkForce false;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/flora-6/keycloak.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  inputs,
+  pkgs,
+  self,
+  ...
+}: {
+  age.secrets.keycloak-database-password = {
+    file = "${self}/secrets/keycloak-database-password.age";
+    mode = "700";
+    #owner = "keycloak";
+  };
+
+  # keycloak
+  services.keycloak = {
+    enable = true;
+    database.passwordFile = config.age.secrets.keycloak-database-password.path;
+    settings = {
+      hostname = "auth.pub.solar";
+      http-host = "127.0.0.1";
+      http-port = 8080;
+      proxy = "edge";
+    };
+    themes = {
+      "pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
+    };
+  };
+}

hosts/flora-6/triton-vmtools.nix

@@ -0,0 +1,9 @@
+{
+  pkgs,
+  inputs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    inputs.triton-vmtools.packages.${pkgs.system}.default
+  ];
+}

modules/terminal-life/default.nix

@@ -32,6 +32,11 @@ in {
     ];
 
     environment.systemPackages = with pkgs; [
+      ack
+      bat
+      exa
+      fd
+      neovim
       screen
     ];
 

overlays/overrides.nix

@@ -18,6 +18,8 @@ channels: final: prev: {
     tdesktop
     arduino
     arduino-cli
+    keycloak
+    gitea
     ;
 
   haskellPackages =

pkgs/lgcl.nix

@@ -1,4 +1,5 @@
-self: with self; let
+self:
+with self; let
   looking-glass-client = self.looking-glass-client.overrideAttrs (old: {
     meta.platforms = ["x86_64-linux" "aarch64-linux"];
   });

pkgs/mopidy-jellyfin.nix

@@ -1,4 +1,5 @@
-self: with self; let
+self:
+with self; let
   websocket-client = python39.pkgs.buildPythonPackage rec {
     pname = "websocket-client";
     version = "1.2.1";

pkgs/uhk-agent.nix

@@ -1,4 +1,5 @@
-self: with self; let
+self:
+with self; let
   uhk-agent-bin = stdenv.mkDerivation rec {
     pname = "uhk-agent-bin";
     version = "1.5.14";

profiles/base-user/session-variables.nix

@@ -7,6 +7,13 @@
   psCfg = config.pub-solar;
   wlroots = psCfg.graphical.wayland;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+  globalVariables = {
+    EDITOR = "/run/current-system/sw/bin/nvim";
+    VISUAL = "/run/current-system/sw/bin/nvim";
+
+    # Make sure virsh runs without root
+    LIBVIRT_DEFAULT_URI = "qemu:///system";
+  };
   variables = {
     XDG_CONFIG_HOME = xdg.configHome;
     XDG_CACHE_HOME = xdg.cacheHome;
@@ -25,11 +32,8 @@
       then "pixman"
       else "gles2";
 
-    EDITOR = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
-    VISUAL = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
-
     # fix "xdg-open fork-bomb" your preferred browser from here
-    BROWSER = "${pkgs.firefox-wayland}/bin/firefox";
+    BROWSER = "firefox";
 
     # node
     NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history";
@@ -41,9 +45,6 @@
     NPM_CONFIG_CACHE = "${xdg.configHome}/npm";
     # TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm";
 
-    # Make sure virsh runs without root
-    LIBVIRT_DEFAULT_URI = "qemu:///system";
-
     # wine
     WINEPREFIX = "${xdg.dataHome}/wineprefixes/default";
 
@@ -100,5 +101,5 @@ in {
     systemd.user.sessionVariables = variablesWithMeta;
   };
 
-  environment.variables = variablesWithMeta;
+  environment.variables = globalVariables;
 }

secrets/drone-secrets.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 Y0ZZaw 42VrEEM/4WcKKp5NZfycnkhsrkSUGGrjwrIPz9O8LhY
+CrkgGDCypRzevuT5YQBZxXwdJnvlkOH1xgxgRFf2wH8
+-> ssh-ed25519 BVsyTA hUQDxkdOQxsOrB/afZWXUWSgNXfDy0W3nl13aXSmvyA
+cf5WfwKKOabBR7qqYblpplSxZqvFmxKCPys8Zz6ZVnU
+-> #-grease B PYdk)b5 D\, z&3Vyw9u
+kJnYpRA6aL4bQQA4ihI5bFl41vIzG2gOaKCJzjxnqK9DndETSoSkhWk4AX0uT0NQ
+tw
+--- QloJDsaDcj08NIy5j8hPMFhHZ4DyZFDR+CNtBUSbhQ0
+ͼ¨Š()¯çÛµkMÀs·JÊ-d‚»láÈföžhj¤6yÕè—º4[<5B>É}»`Nµ)¸á
*Æ×H-˜œÔä²c¨³m’PEdZ²|´ÄFñF4ƒò<>´ƒÞ­½<C2AD>0ä@·š7¢„;Oûwã=èÔ÷Rº:JA¦‰3ÃØOýbã0{“Ìs–ó›G6OËʯ1yd¼…e
ðÿ,÷NÀîVÎ"y4Í8Pª º_hw?¸¦Ótüã­Z"»W~Å5śˈª"ÔÝ#à4,OA¶e
+#<23>]»sŒ.|ˆag¨ˆ÷K†QΨM¢¤ž/ác
+ÞîäwÂÀ¼pêp=”èÏz\È›ÉÖôH«ðâ”Wñô¯Ÿ
v¬î¤Ó%zhL¹ˆå7··›ìB‚¡Á.F	`+ÿ;
e²$z¥Ýçï¡Š•qÉ<07>™qzÑS6Ä8eC£Ê=ãŒÙ#à|YŽ]÷‡ ònV”éçJ"êV†©æ+›Uï

secrets/gitea-mailer-password.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 Y0ZZaw YmqgCC6jO8dbKdRtOcwMJmFVH5fXvb5aRQbNwhEMCR4
+ZbvRe+jdAmZzsJ719ClYjKOPb2fdM48Q/U+pDb9X69Y
+-> ssh-ed25519 BVsyTA YATHo0THjUnU4xBE/UpW1lvuXlL8x2d8i9K98OGCaxU
+01u0QrGjXiPwTy8eMf0X0o6uv+0DJD7EWejzekLjVbI
+-> e@>+!e-grease ]2Kg}7m u2DZ:
+3GCB1HAwQBuQ81UJGa9XwnNx7+Fqz+939SZ93yTT7c5ri5qXiGvSJ/ILgrAVerkI
+7QzVT5vUiucVCbrVp72ZHAWdOwlVXNQtvFdY
+--- MkgkToekZHF+bxtIJA8vnbyAj1E6VSrqbnJ1rWUFc/E
+¶.,K“<>óôgܾÂcø¤¯Â‘¬~.‘L—kˆ¢åEä525«t1øÅåuûÙ

secrets/secrets.nix

@@ -1,8 +1,15 @@
 let
   # set ssh public keys here for your system and user
-  system = "";
-  user = "";
-  allKeys = [system user];
+  b12f-main = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg=";
+  b12f-backup = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw=";
+  teutat3s = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
+  flora-6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@pub-solar-infra-vm-1";
+  allKeys = [flora-6 teutat3s b12f-main b12f-backup];
+  deployKeys = [flora-6 teutat3s b12f-main b12f-backup];
 in {
-  "secret.age".publicKeys = allKeys;
+  "gitea-database-password.age".publicKeys = deployKeys;
+  "gitea-mailer-password.age".publicKeys = deployKeys;
+  "keycloak-database-password.age".publicKeys = deployKeys;
+  "drone-secrets.age".publicKeys = deployKeys;
+  "drone-db-secrets.age".publicKeys = deployKeys;
 }

users/barkeeper/default.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  hmUsers,
+  pkgs,
+  lib,
+  ...
+}: let
+  psCfg = config.pub-solar;
+in {
+  config = {
+    home-manager.users = {inherit (hmUsers) barkeeper;};
+
+    pub-solar = {
+      # These are your personal settings
+      # The only required settings are `name` and `password`,
+      # The rest is used for programs like git
+      user = {
+        name = "barkeeper";
+        description = "pub.solar infra user";
+        password = "$6$MCJ28kLwfNl9SNDq$Oh9eT6Sn6z4xGrQsLlIBI7cvJzX3P5As59OSZ.hoeBWc79Un2YdwH/hRIC.4ZDOuwQp0lHI82dNn/xeTaCn631";
+        fullName = "pub.solar infra barkeeper";
+        email = "admins@pub.solar";
+        gpgKeyId = "";
+        publicKeys = [
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmiF8ndGhnx2YAWbPDq14fftAwcJ0xnjJIVTotI12OO4SPX/SwH5Yp8C8Kf002qN9FbFmaONzq3s8TYpej13JubhfsQywNuFKZuZvJeHzmOwxsANW86RVrWT0WZmYx9a/a1TF9rPQpibDVt60wX8yLdExaJc5F1SvIIuyz1kxYpz36wItfR6hcwoLGh1emFCmfCpebJmp3hsrMDTTtTW/YNhyeSZW74ckyvZyjCYtRCJ8uF0ZmOSKRdillv4Ztg8MsUubGn+vaMl6V6x/QuDuehEPoM/3wBx9o22nf+QVbk7S1PC8EdT/K5vskn4/pfR7mDCyQOq1hB4w4Oyn0dsfX pi@ssrtc"
+
+          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg= @b12f Yubi Main"
+          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw= @b12f Yubi Backup"
+
+          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
+
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
+
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKa5elEXgBc2luVBOHVWZisJgt0epFQOercPi0tZzPU root@cloud.pub.solar"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU axeman@tuxnix"
+        ];
+      };
+    };
+  };
+}