format the repo files
This commit is contained in:
@@ -9,11 +9,10 @@
|
||||
# └─ default.nix *
|
||||
# └─ ...
|
||||
#
|
||||
|
||||
[
|
||||
./microvm.nix
|
||||
# ./hydra.nix
|
||||
# ./hydra.nix
|
||||
]
|
||||
|
||||
# picom, polybar and sxhkd are pulled from desktop module
|
||||
# redshift temporarely disables
|
||||
|
||||
|
||||
@@ -1,60 +1,63 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
virtualisation = {
|
||||
podman ={
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
containers.containersConf.settings = {
|
||||
# podman seems to not work with systemd-resolved
|
||||
containers.dns_servers = [ "192.168.101.1" ];
|
||||
#containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
virtualisation = {
|
||||
podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
containers.containersConf.settings = {
|
||||
# podman seems to not work with systemd-resolved
|
||||
containers.dns_servers = ["192.168.101.1"];
|
||||
#containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.gitea-actions-runner.instances = {
|
||||
homerunner = {
|
||||
enable = true;
|
||||
url = "https://git.kabtop.de";
|
||||
name = "Homerunner";
|
||||
tokenFile = config.age.secrets."services/gitea/homerunner-token".path;
|
||||
labels = [
|
||||
"home"
|
||||
"debian-latest:docker://node:18-bullseye"
|
||||
"ubuntu-latest:docker://node:16-bullseye"
|
||||
"ubuntu-22.04:docker://node:16-bullseye"
|
||||
"ubuntu-20.04:docker://node:16-bullseye"
|
||||
"ubuntu-18.04:docker://node:16-buster"
|
||||
"native:host"
|
||||
];
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
];
|
||||
settings = {
|
||||
# container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
|
||||
# the default network that also respects our dns server settings
|
||||
container.network = "host";
|
||||
container.privileged = false;
|
||||
# container.valid_volumes = [
|
||||
# "/nix"
|
||||
# "${storeDeps}/bin"
|
||||
# "${storeDeps}/etc/ssl"
|
||||
# ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.gitea-actions-runner.instances = {
|
||||
homerunner = {
|
||||
enable = true;
|
||||
url = "https://git.kabtop.de";
|
||||
name = "Homerunner";
|
||||
tokenFile = config.age.secrets."services/gitea/homerunner-token".path;
|
||||
labels = [
|
||||
"home"
|
||||
"debian-latest:docker://node:18-bullseye"
|
||||
"ubuntu-latest:docker://node:16-bullseye"
|
||||
"ubuntu-22.04:docker://node:16-bullseye"
|
||||
"ubuntu-20.04:docker://node:16-bullseye"
|
||||
"ubuntu-18.04:docker://node:16-buster"
|
||||
"native:host"
|
||||
];
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
];
|
||||
settings = {
|
||||
# container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
|
||||
# the default network that also respects our dns server settings
|
||||
container.network = "host";
|
||||
container.privileged = false;
|
||||
# container.valid_volumes = [
|
||||
# "/nix"
|
||||
# "${storeDeps}/bin"
|
||||
# "${storeDeps}/etc/ssl"
|
||||
# ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets."services/gitea/homerunner-token" = {
|
||||
file = ../../../secrets/services/gitea/homerunner-token.age;
|
||||
owner = "gitea-runner";
|
||||
};
|
||||
age.secrets."services/gitea/homerunner-token" = {
|
||||
file = ../../../secrets/services/gitea/homerunner-token.age;
|
||||
owner = "gitea-runner";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,91 +1,92 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services = {
|
||||
hydra = {
|
||||
enable = true;
|
||||
hydraURL = "https://hydra.home.opel-online.de";
|
||||
listenHost = "127.0.0.1";
|
||||
notificationSender = "hydra@localhost";
|
||||
useSubstitutes = true;
|
||||
minimumDiskFree = 30;
|
||||
};
|
||||
nix-serve = {
|
||||
enable = true;
|
||||
port = 5001;
|
||||
bindAddress = "127.0.0.1";
|
||||
secretKeyFile = config.age.secrets."keys/nixsign".path;
|
||||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
virtualHosts = {
|
||||
"home.opel-online.de" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
default = true;
|
||||
locations."/".return = "503";
|
||||
};
|
||||
"hydra.home.opel-online.de" = {
|
||||
useACMEHost = "home.opel-online.de";
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
'';
|
||||
};
|
||||
};
|
||||
"cache.home.opel-online.de" = {
|
||||
useACMEHost = "home.opel-online.de";
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
|
||||
};
|
||||
};
|
||||
};
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
services = {
|
||||
hydra = {
|
||||
enable = true;
|
||||
hydraURL = "https://hydra.home.opel-online.de";
|
||||
listenHost = "127.0.0.1";
|
||||
notificationSender = "hydra@localhost";
|
||||
useSubstitutes = true;
|
||||
minimumDiskFree = 30;
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = "webmaster@opel-online.de";
|
||||
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
dnsResolver = "9.9.9.9:53";
|
||||
};
|
||||
certs = {
|
||||
nix-serve = {
|
||||
enable = true;
|
||||
port = 5001;
|
||||
bindAddress = "127.0.0.1";
|
||||
secretKeyFile = config.age.secrets."keys/nixsign".path;
|
||||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
virtualHosts = {
|
||||
"home.opel-online.de" = {
|
||||
domain = "*.home.opel-online.de";
|
||||
dnsProvider = "netcup";
|
||||
environmentFile = config.age.secrets."services/acme/opel-online".path;
|
||||
webroot = null;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
default = true;
|
||||
locations."/".return = "503";
|
||||
};
|
||||
"hydra.home.opel-online.de" = {
|
||||
useACMEHost = "home.opel-online.de";
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
'';
|
||||
};
|
||||
};
|
||||
"cache.home.opel-online.de" = {
|
||||
useACMEHost = "home.opel-online.de";
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
trusted-users = [
|
||||
"hydra"
|
||||
];
|
||||
allowed-uris = "http:// https://";
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = "webmaster@opel-online.de";
|
||||
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
dnsResolver = "9.9.9.9:53";
|
||||
};
|
||||
certs = {
|
||||
"home.opel-online.de" = {
|
||||
domain = "*.home.opel-online.de";
|
||||
dnsProvider = "netcup";
|
||||
environmentFile = config.age.secrets."services/acme/opel-online".path;
|
||||
webroot = null;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
extraOptions = ''
|
||||
secret-key-files = ${config.age.secrets."keys/nixsign".path}
|
||||
'';
|
||||
};
|
||||
|
||||
age.secrets."keys/nixsign" = {
|
||||
file = ../../../secrets/keys/nixservepriv.age;
|
||||
owner = "hydra";
|
||||
};
|
||||
age.secrets."services/acme/opel-online" = {
|
||||
file = ../../../secrets/services/acme/opel-online.age;
|
||||
owner = "acme";
|
||||
nix = {
|
||||
settings = {
|
||||
trusted-users = [
|
||||
"hydra"
|
||||
];
|
||||
allowed-uris = "http:// https://";
|
||||
};
|
||||
|
||||
extraOptions = ''
|
||||
secret-key-files = ${config.age.secrets."keys/nixsign".path}
|
||||
'';
|
||||
};
|
||||
|
||||
age.secrets."keys/nixsign" = {
|
||||
file = ../../../secrets/keys/nixservepriv.age;
|
||||
owner = "hydra";
|
||||
};
|
||||
age.secrets."services/acme/opel-online" = {
|
||||
file = ../../../secrets/services/acme/opel-online.age;
|
||||
owner = "acme";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,48 +1,55 @@
|
||||
{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
|
||||
let
|
||||
name = "gitea-runner";
|
||||
in
|
||||
{
|
||||
config,
|
||||
microvm,
|
||||
lib,
|
||||
pkgs,
|
||||
user,
|
||||
agenix,
|
||||
impermanence,
|
||||
...
|
||||
}: let
|
||||
name = "gitea-runner";
|
||||
in {
|
||||
microvm = {
|
||||
autostart = [
|
||||
name
|
||||
];
|
||||
vms = {
|
||||
${name} = {
|
||||
|
||||
inherit pkgs;
|
||||
|
||||
config = {
|
||||
imports =
|
||||
[ agenix.nixosModules.default ] ++
|
||||
[ impermanence.nixosModules.impermanence ] ++
|
||||
[( ./gitea_runner.nix )];
|
||||
imports =
|
||||
[agenix.nixosModules.default]
|
||||
++ [impermanence.nixosModules.impermanence]
|
||||
++ [(./gitea_runner.nix)];
|
||||
|
||||
networking = {
|
||||
hostName = "${name}";
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedUDPPorts = [ ];
|
||||
allowedTCPPorts = [ ];
|
||||
allowedUDPPorts = [];
|
||||
allowedTCPPorts = [];
|
||||
};
|
||||
};
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks = {
|
||||
"10-lan" = {
|
||||
matchConfig.Name = "*";
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
};
|
||||
enable = true;
|
||||
networks = {
|
||||
"10-lan" = {
|
||||
matchConfig.Name = "*";
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.${user} = { # System User
|
||||
users.users.${user} = {
|
||||
# System User
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
extraGroups = ["wheel"];
|
||||
uid = 2000;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
|
||||
@@ -56,30 +63,32 @@ in
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
hostKeys = [
|
||||
{
|
||||
{
|
||||
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}
|
||||
{
|
||||
}
|
||||
{
|
||||
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
||||
type = "rsa";
|
||||
bits = 4096;
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/persist".neededForBoot = lib.mkForce true;
|
||||
|
||||
environment = {
|
||||
systemPackages = with pkgs; [ # Default packages install system-wide
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
systemPackages = with pkgs; [
|
||||
# Default packages install system-wide
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
];
|
||||
persistence."/persist" = {
|
||||
directories = [
|
||||
@@ -100,27 +109,30 @@ in
|
||||
vcpu = 4;
|
||||
mem = 4096;
|
||||
interfaces = [
|
||||
{
|
||||
type = "macvtap";
|
||||
id = "vm-${name}";
|
||||
mac = "04:00:00:00:00:01";
|
||||
macvtap = {
|
||||
{
|
||||
type = "macvtap";
|
||||
id = "vm-${name}";
|
||||
mac = "04:00:00:00:00:01";
|
||||
macvtap = {
|
||||
link = "ens18";
|
||||
mode = "bridge";
|
||||
};
|
||||
} ];
|
||||
shares = [{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
{
|
||||
source = "/etc/vm-persist/${name}";
|
||||
mountPoint = "/persist";
|
||||
tag = "persist";
|
||||
proto = "virtiofs";
|
||||
}];
|
||||
};
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
{
|
||||
source = "/etc/vm-persist/${name}";
|
||||
mountPoint = "/persist";
|
||||
tag = "persist";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
];
|
||||
#writableStoreOverlay = "/nix/.rw-store";
|
||||
#storeOnDisk = true;
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user