palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: palo:f97ab14238248ee17072741394ffdd24654198f4
Branches Tags
palo:main
palo:feature/bugwarrior3
palo:update
palo:refactor/component/ssh
palo:orbi-ssh-unlock-works
..
compare: palo:bc7375024d221abc577f7ce5da058b1108edd0b7
Branches Tags
palo:main
palo:feature/bugwarrior3
palo:update
palo:refactor/component/ssh
palo:orbi-ssh-unlock-works

No commits in common. "f97ab14238248ee17072741394ffdd24654198f4" and "bc7375024d221abc577f7ce5da058b1108edd0b7" have entirely different histories.
f97ab14238 ... bc7375024d

7 changed files with 22 additions and 129 deletions
Show stats Expand all files Collapse all files

9
components/network/sshd/known-hosts-manual.nix
View file

@ -15,18 +15,11 @@ in
services.openssh.knownHosts = {
orbi = {
hostNames = [
"git.ingolf-wagner.de"
"95.216.66.212"
];
publicKey = publicKey "orbi";
};
forgejo = {
hostNames = [
"[git.ingolf-wagner.de]:2222"
];
publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQVomwXedtY4ZAKA1Bcsz6Ud2Ys3mjjGJXLcWQLceXKmmAQfOWqqLrTddhrLjmZImS3HTexGK7iNmYYCd/lG+7j1rMebmk3cddH6qr/4WB5SSexbLV4/vlk18kia6O+52ybrMzejwcfr9qNEg+bkrmc4btsWcT/w21vRyOzsmRRnk+S54prLGtiCypFqwGYnyr6HPXO3lqCLHIR/XurcFvh/aM/RGusWh889TXA39FezDcV6OZisZTTC4BBoUAS8r6XJnrIahZJmfEHp/FbKJV0pShCCQXtpkUBu7g6B2T+8u91fY4kc8O293XhaxjTBfkZH2lGodppGG12vAQSeznppbzlT82uTx80jyt7Hw/IAjn9j8D+iKC7fA9qawVz+p1UtqHQd43+8gOSiHILOUMhVxp7ZrfhYmaiOKrkR4+Juc9P2UsqrAvxS1WaYT4KaEZfze7/DCdK0h2SSY2jgCU9sNeJG6M4s/pPj+iI/O+AagHfBZ+bF2y+OKEZOW4J+OpqnEY3lANdxsMsD9PwBpAVAn9FAJzAy+gfXINu0wqGhtA3qWM0QVjcSXsfQJQ2XrbMPd9+pvOl1Ej5SSbjXYcPt9dXWl+L69dbU5qb8WRGl2ZxloUaRcOrOkmhybwI/61LfaGzLslnNn8ARjJgzu9xSipT5D4cZ1FgB9ezqC73Q==";
};
};
};

4
flake.lock
View file

@ -1034,12 +1034,12 @@
"rev": "24639d955322eac0efc8a2418c4dd9aa181f8c91",
"revCount": 79,
"type": "git",
"url": "ssh://forgejo@git.ingolf-wagner.de:2222/palo/nixos-private-parts.git"
"url": "ssh://forgejo@git.ingolf-wagner.de/palo/nixos-private-parts.git"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://forgejo@git.ingolf-wagner.de:2222/palo/nixos-private-parts.git"
"url": "ssh://forgejo@git.ingolf-wagner.de/palo/nixos-private-parts.git"
}
},
"retiolum": {

2
flake.nix
View file

@ -33,7 +33,7 @@
permown.url = "github:mrVanDalo/module.permown";
polygon-art.url = "git+https://git.ingolf-wagner.de/palo/polygon-art.git";
private-parts.inputs.nixpkgs.follows = "nixpkgs"; # only private input
private-parts.url = "git+ssh://forgejo@git.ingolf-wagner.de:2222/palo/nixos-private-parts.git?ref=main";
private-parts.url = "git+ssh://forgejo@git.ingolf-wagner.de/palo/nixos-private-parts.git?ref=main";
#private-parts.url = "git+file:///home/palo/dev/nixos/nixos-private-parts";
retiolum.url = "github:Mic92/retiolum";
srvos.url = "github:nix-community/srvos";

12
machines/orbi/hardware-configuration/disko-config.nix
View file

@ -137,18 +137,6 @@ in
#"com.sun:auto-snapshot:monthly" = toString true;
};
};
"forgejo" = {
type = "zfs_fs";
mountpoint = "/var/lib/nixos-containers/forgejo";
options = {
mountpoint = "legacy";
compression = "lz4";
"com.sun:auto-snapshot:hourly" = toString true;
"com.sun:auto-snapshot:daily" = toString true;
#"com.sun:auto-snapshot:weekly" = toString true;
#"com.sun:auto-snapshot:monthly" = toString true;
};
};
"taskchampion" = {
type = "zfs_fs";
mountpoint = config.services.taskchampion-sync-server.dataDir;

9
machines/orbi/service-forgejo-runner.nix
View file

@ -30,12 +30,12 @@ in
prompt = "please enter your gitea-runner password";
path = with pkgs; [ coreutils ];
script = ''
echo "TOKEN=$prompt_value" > "$secrets"/gitea-runner.token
echo "$prompt_value" > "$secrets"/gitea-runner.token
'';
};
};
systemd.services."gitea-runner-orbi" = {
systemd.services."gitea-runner-${escapeSystemdPath "git.ingolf-wagner.de"}" = {
serviceConfig = {
DynamicUser = lib.mkForce false;
};
@ -43,7 +43,7 @@ in
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
instances."orbi" = {
instances."git.ingolf-wagner.de" = {
enable = true;
settings = {
runner = {
@ -64,8 +64,7 @@ in
];
url = "https://git.ingolf-wagner.de";
tokenFile = config.clan.core.facts.services.gitea-runner.secret."gitea-runner.token".path;
name = "orbi";
name = "fick_deine_mudda";
labels = [
# provide a debian base with nodejs for actions
#"debian-latest:docker://node:18-bullseye"

110
machines/orbi/service-forgejo.nix
View file

@ -2,29 +2,14 @@
config,
lib,
pkgs,
components,
inputs,
...
}:
let
mysqlPort = 3333;
sshPort = 2222;
mysqlPackage = pkgs.mysql;
forgejoPort = 3000;
in
{
healthchecks.http.forgejjo = {
url = "https://git.ingolf-wagner.de/explore/repos";
expectedContent = "palo/nixos-config";
};
healthchecks.closed.public.ports.forgejo = [
mysqlPort
forgejoPort
];
networking.firewall.allowedTCPPorts = [ sshPort ];
networking.firewall.allowedUDPPorts = [ sshPort ];
# todo : make a healthcheck on open ssh port
services.nginx = {
enable = true;
@ -40,89 +25,20 @@ in
};
};
containers.forgejo = {
privateNetwork = false;
autoStart = true;
specialArgs = {
inherit components;
};
config =
{
config,
lib,
components,
...
}:
{
nixpkgs.pkgs = pkgs;
imports = [
"${components}/monitor/container.nix"
inputs.nix-topology.nixosModules.default
];
system.stateVersion = "24.11";
services.logrotate.checkConfig = false; # because uid 3000 does not exist in here
# ssh server (not really needed)
# ------------------------------
#services.openssh = {
# enable = true;
# ports = [ sshPort ];
# settings.X11Forwarding = false;
# settings.PasswordAuthentication = false;
#};
# forgejo
# -------
services.forgejo = {
enable = true;
package = pkgs.forgejo;
database = {
type = "mysql";
port = mysqlPort;
};
settings = {
server.SSH_PORT = sshPort;
server.START_SSH_SERVER = true;
server.HTTP_PORT = forgejoPort;
server.ROOT_URL = "https://git.ingolf-wagner.de/";
server.DOMAIN = "git.ingolf-wagner.de";
DEFAULT.APP_NAME = "git.ingolf-wagner.de";
service.DISABLE_REGISTRATION = true;
session.COOKIE_SECURE = true;
log.LEVEL = "Warn";
other = {
SHOW_FOOTER_VERSION = false;
};
};
};
# MySQL Database
# --------------
services.mysql = {
enable = true;
package = mysqlPackage;
settings.mysqld.port = mysqlPort;
ensureDatabases = [ config.services.forgejo.database.name ];
ensureUsers = [
{
name = config.services.forgejo.database.user;
ensurePermissions = {
"${config.services.forgejo.database.name}.*" = "ALL PRIVILEGES";
};
}
];
};
# Backup Database
# ---------------
services.mysqlBackup = {
enable = false;
databases = config.services.mysql.ensureDatabases;
singleTransaction = true;
};
services.forgejo = {
enable = true;
package = pkgs.forgejo;
settings = {
server.ROOT_URL = "https://git.ingolf-wagner.de/";
server.DOMAIN = "git.ingolf-wagner.de";
DEFAULT.APP_NAME = "git.ingolf-wagner.de";
service.DISABLE_REGISTRATION = true;
session.COOKIE_SECURE = true;
log.LEVEL = "Warn";
other = {
SHOW_FOOTER_VERSION = false;
};
};
};
}

5
machines/orbi/service-photoprism.nix
View file

@ -16,10 +16,7 @@ in
networking.firewall.interfaces.wg0.allowedTCPPorts = [ photoprismPort ];
# networking.firewall.interfaces.wg0.allowedUDPPorts = [ photoprismPort ];
healthchecks.closed.public.ports.photoprism = [
photoprismPort
mysqlPort
];
healthchecks.closed.public.ports.photoprism = [ photoprismPort ];
healthchecks.http.photoprism = {
url = "http://10.100.0.1:2342/library/login";
expectedContent = "AI-Powered Photos App";