palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

made s3 buckets work

Browse source
This commit is contained in:
Ingolf Wagner 2024-01-07 00:27:29 +01:00
parent de8a334588
commit cea37fb8ca
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
13 changed files with 76 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
flake.lock
View file

@ -1308,11 +1308,11 @@
"secrets": {
"flake": false,
"locked": {
"lastModified": 1703323989,
"narHash": "sha256-YC2itrHIVrg1TazWnsuZ51BBYD3HJMFKONgh9RWn5Qk=",
"lastModified": 1704582381,
"narHash": "sha256-GC56ZF7qAtRqxF/SchmlVN86mA4BMwRFRz411utqUvc=",
"ref": "main",
"rev": "23c91088d677f3f1e7d21bb1a8afd4f729d1e030",
"revCount": 61,
"rev": "cd333595c000cd2b1cbce7b2a6027fd6c3f07769",
"revCount": 62,
"type": "git",
"url": "ssh://gitea@git.ingolf-wagner.de/palo/nixos-secrets.git"
},

1
nixos/components/network/nginx.nix
View file

@ -48,6 +48,7 @@ with lib;
locations."/" = {
root = pkgs.landingpage.override {
jsonConfig = [
{ title = config.networking.hostName; }
{ title = "System Links"; }
{
text = "Syncthings";

1
nixos/components/network/tinc/private.nix
View file

@ -40,6 +40,7 @@ let
"loki.chungus" = hosts.chungus;
"prometheus.chungus" = hosts.chungus;
"s3.chungus" = hosts.chungus;
"minio.chungus" = hosts.chungus;
"sync.chungus" = hosts.chungus;
"tdarr.chungus" = hosts.chungus;
"trilium.chungus" = hosts.chungus;

4
nixos/homes/common/packages.nix
View file

@ -13,6 +13,10 @@ with lib;
units
parallel
wget
curl
];
}
(mkIf config.gui.enable {

10
nixos/machines/chungus/services-s3.nix
View file

@ -3,11 +3,21 @@
services.minio = {
enable = true;
region = "home";
rootCredentialsFile = config.sops.secrets.minioRootCredentials.path;
};
sops.secrets.minioRootCredentials = { };
services.nginx = {
enable = true;
virtualHosts."s3.${config.networking.hostName}.private" = {
locations."/" = {
recommendedProxySettings = true;
proxyWebsockets = true;
proxyPass = "http://localhost:9000";
};
};
virtualHosts."minio.${config.networking.hostName}.private" = {
locations."/" = {
recommendedProxySettings = true;
proxyWebsockets = true;

0
terranix/terranix.org/.gitignore → terraform/terranix.org/.gitignore vendored
View file

18
terraform/terranix.org/targets/namecheap/__backend.tf Normal file
View file

@ -0,0 +1,18 @@
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
backend "s3" {
bucket = "terraform-state-terranix-website"
encrypt = false
endpoint = "http://s3.chungus.private"
force_path_style = true
iam_endpoint = "http://s3.chungus.private"
key = "namecheap/terraform.tfstate"
region = "home"
skip_credentials_validation = true
skip_metadata_api_check = true
skip_region_validation = true
skip_requesting_account_id = true
skip_s3_checksum = true
sts_endpoint = "http://s3.chunugs.private"
}
}

0
terranix/terranix.org/targets/namecheap/__provider.tf → terraform/terranix.org/targets/namecheap/__provider.tf
View file

0
terranix/terranix.org/targets/namecheap/main.tf → terraform/terranix.org/targets/namecheap/main.tf
View file

10
terranix/terranix.org/targets/namecheap/terragrunt.hcl → terraform/terranix.org/targets/namecheap/terragrunt.hcl
View file

@ -1,4 +1,8 @@
include {
path = find_in_parent_folders()
}
inputs = {
namecheap_user = run_cmd("--terragrunt-quiet", "pass", "show", "development/namecheap.com/username")
namecheap_api_key = run_cmd("--terragrunt-quiet", "pass", "show", "development/namecheap.com/api-key")
@ -11,7 +15,7 @@ generate "provider" {
terraform {
required_providers {
namecheap = {
source = "namecheap/namecheap"
source = "namecheap/namecheap"
version = ">= 2.0.0"
}
}
@ -24,7 +28,7 @@ provider "namecheap" {
api_key = var.namecheap_api_key
}
variable "namecheap_user" { }
variable "namecheap_api_key" { }
variable "namecheap_user" {}
variable "namecheap_api_key" {}
EOF
}

31
terraform/terranix.org/targets/terragrunt.hcl Normal file
View file

@ -0,0 +1,31 @@
remote_state {
backend = "s3"
generate = {
path = "__backend.tf"
if_exists = "overwrite"
}
config = {
bucket = "terraform-state-terranix-website"
key = "${path_relative_to_include()}/terraform.tfstate"
region = "home"
encrypt = false
endpoint = "http://s3.chungus.private"
iam_endpoint = "http://s3.chungus.private"
sts_endpoint = "http://s3.chunugs.private"
force_path_style = true
enable_lock_table_ssencryption = false
skip_s3_checksum = true
skip_bucket_public_access_blocking = true
skip_bucket_enforced_tls = true
skip_credentials_validation = true
skip_bucket_root_access = true # use only if the AWS account root user should not have access to the remote state bucket for some reason
skip_bucket_versioning = true # use only if the object store does not support versioning
skip_bucket_ssencryption = true # use only if non-encrypted Terraform State is required and/or the object store does not support server-side encryption
skip_metadata_api_check = true
skip_region_validation = true
skip_requesting_account_id = true
}
}

48
terranix/dummy_server/config.nix
View file

@ -1,48 +0,0 @@
{ pkgs, lib, ... }:
let
hcloud-modules = pkgs.fetchgit {
url = "https://github.com/mrVanDalo/terranix-hcloud.git";
rev = "5fa359a482892cd973dcc6ecfc607f4709f24495";
sha256 = "0smgmdiklj98y71fmcdjsqjq8l41i66hs8msc7k4m9dpkphqk86p";
};
#nixosInfect = pkgs.fetchgit {
# "url" = "https://github.com/elitak/nixos-infect.git";
# rev = "928f9e5e1d63e77a91f2ca57ffa2be1fef3078ec";
#sha256 = "0rs84c549l863vbnnqgnx7v6m2zlq0wz46jbhm4v1l1a25d966s1";
#};
in
{
imports = [ (toString hcloud-modules) ];
# configure admin ssh keys
users.admins.palo.publicKey =
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw== cardno:000611343142";
users.admins.terranix.publicKey = "${lib.fileContents ./sshkey.pub}";
# configure provisioning private Key to be used when running provisioning on the machines
provisioner.privateKeyFile = toString ./sshkey;
hcloud.nixserver = {
playground = {
enable = true;
channel = "nixos-20.09";
provisioners = [
#{
# file.source = "${nixosInfect}/nixos-infect";
# file.destination = "/root/nixos-infect";
#}
{
file.source = "${toString ./../../images/translate-setup}";
file.destination = "/root/translate-setup";
}
];
configurationFile = pkgs.writeText "configuration.nix" ''
{ pkgs, lib, config, ... }:
{ environment.systemPackages = [ pkgs.git ]; }
'';
};
};
}

48
terranix/dummy_server/shell.nix
View file

@ -1,48 +0,0 @@
{ pkgs ? import <nixpkgs> { } }:
let
terranix = pkgs.callPackage
(pkgs.fetchgit {
url = "https://github.com/mrVanDalo/terranix.git";
rev = "2.3.0";
sha256 = "030067h3gjc02llaa7rx5iml0ikvw6szadm0nrss2sqzshsfimm4";
})
{ };
terraform = pkgs.writers.writeBashBin "terraform" ''
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
${pkgs.terraform_0_12}/bin/terraform "$@"
'';
in
pkgs.mkShell {
buildInputs = [
terranix
terraform
(pkgs.writers.writeBashBin "prepare" ''
set -e
set -o pipefail
${pkgs.openssh}/bin/ssh-keygen -P "" -f ${toString ./.}/sshkey
'')
(pkgs.writers.writeBashBin "build" ''
set -e
set -o pipefail
${terranix}/bin/terranix | ${pkgs.jq}/bin/jq '.' > config.tf.json
${terraform}/bin/terraform init
${terraform}/bin/terraform apply
'')
(pkgs.writers.writeBashBin "cleanup" ''
${terraform}/bin/terraform destroy
rm ${toString ./.}/config.tf.json
rm ${toString ./.}/sshkey
rm ${toString ./.}/sshkey.pub
rm ${toString ./.}/terraform.tfstate*
'')
];
}