move hydra to kabtop

modules/services/server/default.nix

@@ -17,6 +17,7 @@
   ./nextcloud.nix
   ./matrix.nix
   ./coturn.nix
+  ./hydra.nix
 #  ./ollama.nix
 ]
 

modules/services/server/hydra.nix

@@ -0,0 +1,82 @@
+{ lib, config, pkgs, ... }:
+
+{
+    services = {
+      hydra = {
+        enable = true;
+        hydraURL = "https://hydra.ci.kabtop.de";
+        listenHost = "127.0.0.1";
+        notificationSender = "hydra@kabtop.de";
+        useSubstitutes = true;
+        minimumDiskFree = 8;
+      };
+      nix-serve = {
+          enable = true;
+          port = 5001;
+          bindAddress = "127.0.0.1";
+          secretKeyFile = config.age.secrets."keys/nixsign".path;
+      };
+      nginx = {
+        enable = true;
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+        recommendedGzipSettings = true;
+        recommendedOptimisation = true;
+        virtualHosts = {
+          "ci.kabtop.de" = {
+            enableACME = true;
+            forceSSL = true;
+            default = true;
+            locations."/".return = "503";
+          };
+          "hydra.ci.kabtop.de" = {
+            enableACME = true;
+            forceSSL = true;
+            locations."/" = {
+              proxyPass = "http://localhost:3000";
+              extraConfig = ''
+                proxy_set_header X-Forwarded-Port 443;
+              '';
+            };
+          };
+          "cache.ci.kabtop.de" = {
+            enableACME = true;
+            forceSSL = true;
+            locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+          };
+        };
+      };
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "webmaster@kabtop.de";
+        webroot = "/var/lib/acme/acme-challenge";
+        #server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      };
+    };
+    
+    nix = {
+      settings = {
+        trusted-users = [
+          "hydra"
+        ];
+        allowed-uris = [
+	  "github:"
+	  "https://github.com/"
+  	  "git+ssh://github.com/"
+  	];
+      };
+
+      extraOptions = ''
+        secret-key-files = ${config.age.secrets."keys/nixsign".path}
+      '';
+    };
+    
+    age.secrets."keys/nixsign" = {
+      file = ../../../secrets/keys/nixservepriv.age;
+      owner = "hydra";
+    };
+
+}