v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Projects Releases Packages Activity Actions

nixfmt
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse source
This commit is contained in:
Vivian 2023-05-04 13:08:10 +02:00
parent 3dfe40e4e2
commit 2c16870d66
53 changed files with 1671 additions and 1559 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nixos/hosts/olympus/bastion/hardware-configuration.nix
View file

@ -6,7 +6,8 @@
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.availableKernelModules =
[ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
@ -16,6 +17,7 @@
fsType = "ext4";
};
swapDevices = [{ device = "/dev/disk/by-uuid/63d90b92-cdde-4795-a3ab-9566ae88f43d"; }];
swapDevices =
[{ device = "/dev/disk/by-uuid/63d90b92-cdde-4795-a3ab-9566ae88f43d"; }];
}

3
nixos/hosts/olympus/dns/configuration.nix
View file

@ -1,5 +1,4 @@
{ pkgs, ... }:
{
{ pkgs, ... }: {
imports = [ ];
# This value determines the NixOS release from which the default

19
nixos/hosts/olympus/gitea/configuration.nix
View file

@ -3,10 +3,8 @@
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ lib, config, pkgs, ... }:
let
vs = config.vault-secrets.secrets;
in
{
let vs = config.vault-secrets.secrets;
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -22,7 +20,8 @@ in
environment.noXlibs = lib.mkForce false;
networking.firewall.allowedTCPPorts = [ config.services.gitea.settings.server.HTTP_PORT ];
networking.firewall.allowedTCPPorts =
[ config.services.gitea.settings.server.HTTP_PORT ];
services.openssh.startWhenNeeded = false;
@ -37,10 +36,8 @@ in
};
system.activationScripts.gitea-theme =
let
target_dir = "${config.services.gitea.stateDir}/custom/public/css/";
in
lib.stringAfter [ "var" ] ''
let target_dir = "${config.services.gitea.stateDir}/custom/public/css/";
in lib.stringAfter [ "var" ] ''
mkdir -p ${target_dir}
ln -sf ${pkgs.v.gitea-agatheme} "${target_dir}/theme-agatheme.css"
'';
@ -54,9 +51,7 @@ in
mailerPasswordFile = "${vs.gitea}/mailPassword";
settings = {
actions = {
"ENABLED" = true;
};
actions = { "ENABLED" = true; };
repository = {
"ENABLE_PUSH_CREATE_USER" = true;
"DEFAULT_PUSH_CREATE_PRIVATE" = false;

18
nixos/hosts/olympus/mailserver/configuration.nix
View file

@ -3,8 +3,8 @@
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
let vs = config.vault-secrets.secrets; in
{
let vs = config.vault-secrets.secrets;
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -22,9 +22,7 @@ let vs = config.vault-secrets.secrets; in
10.42.42.6 vault.olympus
'';
vault-secrets.secrets.mailserver = {
services = [ "dovecot2" "postfix" ];
};
vault-secrets.secrets.mailserver = { services = [ "dovecot2" "postfix" ]; };
mailserver = {
enable = true;
@ -36,7 +34,8 @@ let vs = config.vault-secrets.secrets; in
# People
"v@0x76.dev" = {
hashedPasswordFile = "${vs.mailserver}/v@0x76.dev";
aliases = [ "v@meowy.tech" "postmaster@0x76.dev" "postmaster@meowy.tech" ];
aliases =
[ "v@meowy.tech" "postmaster@0x76.dev" "postmaster@meowy.tech" ];
};
"laura@meowy.tech" = {
hashedPasswordFile = "${vs.mailserver}/laura@meowy.tech";
@ -79,7 +78,8 @@ let vs = config.vault-secrets.secrets; in
services.roundcube = {
enable = true;
package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
package =
pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
plugins = [
"archive"
# "enigma"
@ -98,9 +98,7 @@ let vs = config.vault-secrets.secrets; in
'';
};
services.nginx = {
enable = true;
};
services.nginx = { enable = true; };
security.acme.acceptTerms = true;
security.acme.defaults.email = "v@0x76.dev";

3
nixos/hosts/olympus/minecraft/configuration.nix
View file

@ -2,8 +2,7 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ lib, pkgs, ... }:
{
{ lib, pkgs, ... }: {
imports = [ ];
# This value determines the NixOS release from which the default

3
nixos/hosts/olympus/mosquitto/configuration.nix
View file

@ -4,8 +4,7 @@
{ config, pkgs, ... }:
let mosquittoPort = 1883;
in
{
in {
imports = [ ];
# This value determines the NixOS release from which the default

3
nixos/hosts/olympus/ntfy/configuration.nix
View file

@ -20,7 +20,8 @@
networking.firewall.allowedTCPPorts = [ 80 ];
services.ntfy-sh = let datadir = "/var/lib/ntfy"; in {
services.ntfy-sh = let datadir = "/var/lib/ntfy";
in {
enable = true;
settings = {
base-url = "https://ntfy.0x76.dev";

10
nixos/hosts/olympus/outline/configuration.nix
View file

@ -3,8 +3,8 @@
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, ... }:
let vs = config.vault-secrets.secrets; in
{
let vs = config.vault-secrets.secrets;
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -16,9 +16,7 @@ let vs = config.vault-secrets.secrets; in
system.stateVersion = "22.11"; # Did you read the comment?
# Additional packages
networking.firewall.allowedTCPPorts = [
config.services.outline.port
];
networking.firewall.allowedTCPPorts = [ config.services.outline.port ];
vault-secrets.secrets.outline = {
inherit (config.services.outline) user group;
@ -40,7 +38,7 @@ let vs = config.vault-secrets.secrets; in
uploadBucketName = "outline";
region = "us-east-1"; # fake
};
oidcAuthentication = {
oidcAuthentication = {
displayName = "Dex";
userinfoUrl = "https://dex.0x76.dev/userinfo";
tokenUrl = "https://dex.0x76.dev/token";

113
nixos/hosts/olympus/synapse/configuration.nix
View file

@ -7,8 +7,7 @@ let
vs = config.vault-secrets.secrets;
port = 8008;
metricsPort = 9000;
in
{
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -53,66 +52,60 @@ in
"${vs.synapse}/email_password" # Also contains the rest of the email config
];
settings =
let log_file = pkgs.writeText "log.yml" ''
version: 1
settings = let
log_file = pkgs.writeText "log.yml" ''
version: 1
formatters:
structured:
class: synapse.logging.TerseJsonFormatter
formatters:
structured:
class: synapse.logging.TerseJsonFormatter
handlers:
file:
class: logging.handlers.TimedRotatingFileHandler
formatter: structured
filename: /var/lib/matrix-synapse/synapse.log
when: midnight
backupCount: 3 # Does not include the current log file.
encoding: utf8
handlers:
file:
class: logging.handlers.TimedRotatingFileHandler
formatter: structured
filename: /var/lib/matrix-synapse/synapse.log
when: midnight
backupCount: 3 # Does not include the current log file.
encoding: utf8
loggers:
synapse:
level: INFO
handlers: [file]
''; in
{
server_name = "meowy.tech";
enable_registration = true;
public_baseurl = "https://chat.meowy.tech";
enable_metrics = true;
max_upload_size = "100M";
registration_requires_token = true;
media_retention = {
remote_media_lifetime = "90d";
};
log_config = "${log_file}";
listeners = [
{
inherit port;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [ "client" "federation" ];
compress = true;
}
];
}
{
port = metricsPort;
bind_addresses = [ "0.0.0.0" ];
type = "metrics";
tls = false;
resources = [
{
names = [ "metrics" ];
compress = false;
}
];
}
];
};
loggers:
synapse:
level: INFO
handlers: [file]
'';
in {
server_name = "meowy.tech";
enable_registration = true;
public_baseurl = "https://chat.meowy.tech";
enable_metrics = true;
max_upload_size = "100M";
registration_requires_token = true;
media_retention = { remote_media_lifetime = "90d"; };
log_config = "${log_file}";
listeners = [
{
inherit port;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [{
names = [ "client" "federation" ];
compress = true;
}];
}
{
port = metricsPort;
bind_addresses = [ "0.0.0.0" ];
type = "metrics";
tls = false;
resources = [{
names = [ "metrics" ];
compress = false;
}];
}
];
};
};
}

2
nixos/hosts/olympus/unifi/configuration.nix
View file

@ -22,7 +22,7 @@
services.unifi = {
enable = true;
unifiPackage = pkgs.unifi;
mongodbPackage = pkgs.mongodb-4_2;
mongodbPackage = pkgs.mongodb-4_2;
openFirewall = true;
};
}

16
nixos/hosts/olympus/victoriametrics/configuration.nix
View file

@ -6,8 +6,7 @@
let
vmPort = 8428;
vs = config.vault-secrets.secrets;
in
{
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -21,7 +20,8 @@ in
# Additional packages
environment.systemPackages = with pkgs; [ ];
networking.firewall.allowedTCPPorts = [ vmPort config.services.grafana.settings.server.http_port ];
networking.firewall.allowedTCPPorts =
[ vmPort config.services.grafana.settings.server.http_port ];
networking.firewall.allowedUDPPorts = [ vmPort ];
services.victoriametrics = {
@ -42,12 +42,10 @@ in
scrape_configs = [
{
job_name = "nginx";
static_configs = [
{
targets = [ "nginx.olympus:9113" ];
labels.app = "nginx";
}
];
static_configs = [{
targets = [ "nginx.olympus:9113" ];
labels.app = "nginx";
}];
}
{
job_name = "synapse";