v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Projects Releases Packages Activity Actions

Merge remote-tracking branch 'refs/remotes/origin/main'

Browse source
This commit is contained in:
Vivian 2023-11-16 20:31:20 +01:00
commit 1b7017b3e9
22 changed files with 222 additions and 347 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nixos/hosts/olympus/default.nix
View file

@ -53,7 +53,6 @@
exposes = {
www.domain = "0x76.dev";
flux.domain = "flux.0x76.dev";
o2p.domain = "o2p.0x76.dev";
internal.domain = "internal.xirion.net";
blog.domain = "blog.xirion.net";
};
@ -61,9 +60,15 @@
"dex" = {
ip = "10.42.42.11";
mac = "AE:66:7B:FA:15:72";
exposes.dex = {
domain = "dex.0x76.dev";
port = 5556;
exposes = {
dex = {
domain = "dex.0x76.dev";
port = 5556;
};
o2p_proxy = {
domain = "o2p.0x76.dev";
port = 8484;
};
};
};
"WoolooTV" = {
@ -151,7 +156,14 @@
ip = "10.42.42.25";
mac = "1E:ED:97:2C:C3:9D";
};
# 10.42.42.26
"grist" = {
ip = "10.42.42.26";
mac = "B2:AA:AB:5D:2F:22";
exposes.grist = {
domain = "grist.0x76.dev";
port = 8484;
};
};
"bookwyrm" = {
ip = "10.42.42.27";
mac = "9E:8A:6C:39:27:DE";

153
nixos/hosts/olympus/dex/configuration.nix
View file

@ -9,8 +9,7 @@ let
db_name = "dex";
inherit (config.meta.exposes.dex) port;
metricsPort = 5558;
in
{
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -23,91 +22,85 @@ in
networking.firewall.allowedTCPPorts = [ port metricsPort ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
ensureDatabases = [ db_name ];
ensureUsers = [{
name = db_user;
ensurePermissions = {
"DATABASE ${db_name}" = "ALL PRIVILEGES";
"schema public" = "ALL";
};
}];
};
vault-secrets.secrets.dex = { };
vault-secrets.secrets.oauth2_proxy = { };
services.dex = {
enable = true;
settings = {
issuer = "https://dex.0x76.dev";
storage = {
type = "postgres";
config = {
host = "/var/run/postgresql";
user = db_user;
database = db_name;
};
};
web.http = "0.0.0.0:${toString port}";
telemetry.http = "0.0.0.0:${toString metricsPort}";
services = {
connectors = [{
type = "gitea";
id = "gitea";
name = "Gitea";
config = {
clientID = "$GITEA_CLIENT_ID";
clientSecret = "$GITEA_CLIENT_SECRET";
redirectURI = "https://dex.0x76.dev/callback";
baseURL = "https://git.0x76.dev";
postgresql = {
enable = true;
package = pkgs.postgresql_15;
ensureDatabases = [ db_name ];
ensureUsers = [{
name = db_user;
ensurePermissions = {
"DATABASE ${db_name}" = "ALL PRIVILEGES";
"schema public" = "ALL";
};
}];
staticClients = [
{
id = "outline";
name = "Outline";
redirectURIs = [ "https://outline.0x76.dev/auth/oidc.callback" ];
secretEnv = "OUTLINE_CLIENT_SECRET";
}
{
id = "grafana";
name = "Grafana";
redirectURIs = [ "https://grafana.0x76.dev/login/generic_oauth" ];
secretEnv = "GRAFANA_CLIENT_SECRET";
}
{
id = "hedgedoc";
name = "Hedgedoc";
redirectURIs = [ "https://md.0x76.dev/auth/oauth2/callback" ];
secretEnv = "HEDGEDOC_CLIENT_SECRET";
}
{
id = "flux";
name = "Weave Gitops Flux Dashboard";
redirectURIs = [ "https://flux.0x76.dev/oauth2/callback" ];
secretEnv = "FLUX_CLIENT_SECRET";
}
{
id = "oauth2-proxy";
name = "OAuth2 Proxy";
redirectURIs = [ "https://o2p.0x76.dev/oauth2/callback" ];
secretEnv = "O2P_CLIENT_SECRET";
}
];
};
environmentFile = "${vs.dex}/environment";
};
dex = {
enable = true;
settings = {
issuer = "https://dex.0x76.dev";
storage = {
type = "postgres";
config = {
host = "/var/run/postgresql";
user = db_user;
database = db_name;
};
};
web.http = "0.0.0.0:${toString port}";
telemetry.http = "0.0.0.0:${toString metricsPort}";
connectors = [{
type = "gitea";
id = "gitea";
name = "Gitea";
config = {
clientID = "$GITEA_CLIENT_ID";
clientSecret = "$GITEA_CLIENT_SECRET";
redirectURI = "https://dex.0x76.dev/callback";
baseURL = "https://git.0x76.dev";
};
}];
services.oauth2_proxy = {
enable = false;
provider = "oidc";
redirectURL = "https://o2p.0x76.dev/oauth2/callback";
cookie.secure = false;
httpAddress = "0.0.0.0:4180";
keyFile = "";
staticClients = [
{
id = "outline";
name = "Outline";
redirectURIs = [ "https://outline.0x76.dev/auth/oidc.callback" ];
secretEnv = "OUTLINE_CLIENT_SECRET";
}
{
id = "grafana";
name = "Grafana";
redirectURIs = [ "https://grafana.0x76.dev/login/generic_oauth" ];
secretEnv = "GRAFANA_CLIENT_SECRET";
}
{
id = "hedgedoc";
name = "Hedgedoc";
redirectURIs = [ "https://md.0x76.dev/auth/oauth2/callback" ];
secretEnv = "HEDGEDOC_CLIENT_SECRET";
}
{
id = "flux";
name = "Weave Gitops Flux Dashboard";
redirectURIs = [ "https://flux.0x76.dev/oauth2/callback" ];
secretEnv = "FLUX_CLIENT_SECRET";
}
{
id = "grist";
name = "grist";
redirectURIs = [ "https://grist.0x76.dev/oauth2/callback" ];
secretEnv = "GRIST_CLIENT_SECRET";
}
];
};
environmentFile = "${vs.dex}/environment";
};
};
}

2
nixos/hosts/olympus/eevee/hardware.nix
View file

@ -1,4 +1,4 @@
{ pkgs, config, ... }: {
{ pkgs, ... }: {
hardware = {
enableAllFirmware = true;
nvidia = {

58
nixos/hosts/olympus/grist/configuration.nix Normal file
View file

@ -0,0 +1,58 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
let vs = config.vault-secrets.secrets;
in {
imports = [ ];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.11"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ 8484 ];
environment.systemPackages = with pkgs; [ sqlite ];
virtualisation = {
podman.enable = true;
oci-containers.backend = "podman";
oci-containers.containers.grist = {
image =
"gristlabs/grist:latest"; # Switch to versioned release as soon as OIDC hits stable
environment = {
APP_HOME_URL = "https://grist.0x76.dev";
GRIST_SUPPORT_ANON = "false";
GRIST_FORCE_LOGIN = "true";
GRIST_SINGLE_ORG = "xirion";
GRIST_ORG_IN_PATH = "false";
GRIST_DEFAULT_EMAIL = "v@0x76.dev"; # Defines admin user
GRIST_HIDE_UI_ELEMENTS =
"helpCenter,billing,templates,multiSite,multiAccounts";
GRIST_TELEMETRY_LEVEL = "off";
GRIST_WIDGET_LIST_URL =
"https://github.com/gristlabs/grist-widget/releases/download/latest/manifest.json";
# No Python 2
PYTHON_VERSION = "3";
PYTHON_VERSION_ON_CREATION = "3";
# Beta OIDC support
GRIST_OIDC_IDP_ISSUER = "https://dex.0x76.dev";
};
environmentFiles = [ "${vs.grist}/environment" ];
ports = [ "8484:8484" ];
volumes = [ "/var/lib/grist:/persist" ];
};
};
vault-secrets.secrets.grist = {
quoteEnvironmentValues = false; # Needed for docker
services = [ "podman-grist" ];
};
}