v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Actions Packages Projects Releases Activity

Merge

Browse source
This commit is contained in:
Vivian 2023-06-09 15:07:00 +02:00
parent cc6d866069 153107772e
commit b041702dde
15 changed files with 135 additions and 59 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
.forgejo/workflows/nix.yml Normal file
View file

@ -0,0 +1,18 @@
name: Nix
jobs:
lint:
runs-on: docker
env:
container:
image: ghcr.io/catthehacker/ubuntu:js-20.04
steps:
- uses: actions/checkout@v3
- uses: https://github.com/cachix/install-nix-action@v20
env:
with:
nix_path: nixpkgs=channel:nixos-unstable
- name: Run `nix flake check`
run: |
sed -i '/^access-tokens/ d' /etc/nix/nix.conf
nix run '.#' -- -V

72
flake.lock
View file

@ -131,11 +131,11 @@
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1680733215, "lastModified": 1686077956,
"narHash": "sha256-5HNH/Lqj8OU/piH3tvPRkINXHHkt6bRp0QYYR4xOybE=", "narHash": "sha256-zkkjqU5NZipqakDfPSve85ljyZJ8aQtfk9mPkJ+w3IE=",
"owner": "nix-community", "owner": "nix-community",
"repo": "comma", "repo": "comma",
"rev": "ef97634016d17cc8cdea396ebcc002320494391a", "rev": "59a88b9b86bc35ee6c5ec02fab6819ad68bdaa3f",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -536,11 +536,11 @@
"systems": "systems_2" "systems": "systems_2"
}, },
"locked": { "locked": {
"lastModified": 1681202837, "lastModified": 1685518550,
"narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=", "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
"owner": "numtide", "owner": "numtide",
"repo": "flake-utils", "repo": "flake-utils",
"rev": "cfacdce06f30d2b68473a46042957675eebb3401", "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -695,11 +695,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1685573051, "lastModified": 1686168915,
"narHash": "sha256-zrpbdQVJFpNVFK3SlA6mE0le8qnKjUjcuY4OzL+wSHw=", "narHash": "sha256-zV5lh3PGKcI8W7+5bXSRsCetfsi6x10Xvojpk5HAQHU=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "3876cc613ac3983078964ffb5a0c01d00028139e", "rev": "cc6745b35fefe48624ebf573382e1e0e4a6fe85e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -721,11 +721,11 @@
"rust-overlay": "rust-overlay_2" "rust-overlay": "rust-overlay_2"
}, },
"locked": { "locked": {
"lastModified": 1685709197, "lastModified": 1685953862,
"narHash": "sha256-ASoXZVoXj6L9PzNDfuDrAxrqaDuH7e1qTzdzkOODu4M=", "narHash": "sha256-aROVoLllFZde9EWr3EP97fXIlOghgrdmO6TeYkZRs5g=",
"owner": "nix-community", "owner": "nix-community",
"repo": "lanzaboote", "repo": "lanzaboote",
"rev": "e422970c1bc3351bb7a20cf6e30e78d975280ed3", "rev": "45d04a45d3dfcdee5246f7c0dfed056313de2a61",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -869,11 +869,11 @@
}, },
"nixlib": { "nixlib": {
"locked": { "locked": {
"lastModified": 1681001314, "lastModified": 1685840432,
"narHash": "sha256-5sDnCLdrKZqxLPK4KA8+f4A3YKO/u6ElpMILvX0g72c=", "narHash": "sha256-VJIbiKsY7Xy4E4WcgwUt/UiwYDmN5BAk8tngAjcWsqY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixpkgs.lib", "repo": "nixpkgs.lib",
"rev": "367c0e1086a4eb4502b24d872cea2c7acdd557f4", "rev": "961e99baaaa57f5f7042fe7ce089a88786c839f4",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -890,11 +890,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1685446848, "lastModified": 1685943944,
"narHash": "sha256-vEU1jynjDXwOJESHeJyABqbY/Y+DoihZq9iDVtYgrMg=", "narHash": "sha256-GpaQwOkvwkmSWxvWaZqbMKyyOSaBAwgdEcHCqLW/240=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixos-generators", "repo": "nixos-generators",
"rev": "b6114e214e5b546c4cceccd33ee6b72294a76b60", "rev": "122dcc32cadf14c5015aa021fae8882c5058263a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1066,11 +1066,11 @@
}, },
"nixpkgs_22-11": { "nixpkgs_22-11": {
"locked": { "locked": {
"lastModified": 1685650716, "lastModified": 1686035213,
"narHash": "sha256-sDd7QIcMbIb37nuqMrJElvuyE5eVgWuKGtIPP8IWwCc=", "narHash": "sha256-hRcXUoVWWuLqFzQ1QVQx4ewvbnst1NkCxoZhmpzrilA=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "f7c1500e2eefa58f3c80dd046cba256e10440201", "rev": "d83945caa7624015f11b152bf5c6c4363ffe9f7c",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1098,11 +1098,11 @@
}, },
"nixpkgs_4": { "nixpkgs_4": {
"locked": { "locked": {
"lastModified": 1685693126, "lastModified": 1686131476,
"narHash": "sha256-Q+fZjmYsFYOjOB8RFRkOqQj09tJa4pVh8qaZCYmsw1o=", "narHash": "sha256-d/VZjsgW7dBwqN77EcQ4HqQifpATkT5WnCvYbovIhf0=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "b49720ccd2ca03ef35e213ebd43bd57c7eb83fa7", "rev": "32d8e07a8ea673bc9b8c0f8106fb0b776c6ea6a8",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1114,11 +1114,11 @@
}, },
"nixpkgs_5": { "nixpkgs_5": {
"locked": { "locked": {
"lastModified": 1685168767, "lastModified": 1685655444,
"narHash": "sha256-wQgnxz0PdqbyKKpsWl/RU8T8QhJQcHfeC6lh1xRUTfk=", "narHash": "sha256-6EujQNAeaUkWvpEZZcVF8qSfQrNVWFNNGbUJxv/A5a8=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "e10802309bf9ae351eb27002c85cfdeb1be3b262", "rev": "e635192892f5abbc2289eaac3a73cdb249abaefd",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1198,11 +1198,11 @@
"pre-commit-hooks": "pre-commit-hooks" "pre-commit-hooks": "pre-commit-hooks"
}, },
"locked": { "locked": {
"lastModified": 1685708456, "lastModified": 1686210684,
"narHash": "sha256-3zKQMUJhAK19NIzWyLBn3ggEsMtgamVd7l0+PWtFYEM=", "narHash": "sha256-dlQDXx0P/MmiBOhJ733AyD0+ym7U7Pe080gIBSgFK0E=",
"owner": "pta2002", "owner": "pta2002",
"repo": "nixvim", "repo": "nixvim",
"rev": "1f285df66498952c9b1315fdc591c0c3e1d3b5f1", "rev": "ab8377f319a2d84026244bf81b3b3f8e49c2a518",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1213,11 +1213,11 @@
}, },
"nur": { "nur": {
"locked": { "locked": {
"lastModified": 1685699083, "lastModified": 1686210105,
"narHash": "sha256-EqgVvQLjMuXMU0yiSRoCZZnnU8ATWdd8vWzWOBAeT4M=", "narHash": "sha256-hA1NWUCfZHmZcUaLP7R8rDHp4ssZI1CbreGMol5vKqM=",
"owner": "nix-community", "owner": "nix-community",
"repo": "NUR", "repo": "NUR",
"rev": "7dbd5a6621059db78edd523eb1da98252d96b23d", "rev": "dd2b073a0d02c76e1b22d6f017675522464642fb",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1282,11 +1282,11 @@
"nixpkgs-stable": "nixpkgs-stable_3" "nixpkgs-stable": "nixpkgs-stable_3"
}, },
"locked": { "locked": {
"lastModified": 1684842236, "lastModified": 1685361114,
"narHash": "sha256-rYWsIXHvNhVQ15RQlBUv67W3YnM+Pd+DuXGMvCBq2IE=", "narHash": "sha256-4RjrlSb+OO+e1nzTExKW58o3WRwVGpXwj97iCta8aj4=",
"owner": "cachix", "owner": "cachix",
"repo": "pre-commit-hooks.nix", "repo": "pre-commit-hooks.nix",
"rev": "61e567d6497bc9556f391faebe5e410e6623217f", "rev": "ca2fdbf3edda2a38140184da6381d49f8206eaf4",
"type": "github" "type": "github"
}, },
"original": { "original": {

3
flake.nix
View file

@ -47,7 +47,7 @@
}; };
outputs = { self, nixpkgs, nixpkgs_22-11, vault-secrets, colmena outputs = { self, nixpkgs, nixpkgs_22-11, vault-secrets, colmena
, nixos-generators, nur, ... }@inputs: , nixos-generators, nur, attic, ... }@inputs:
let let
inherit (nixpkgs) lib; inherit (nixpkgs) lib;
@ -125,6 +125,7 @@
devShells.${system}.default = pkgs.mkShell { devShells.${system}.default = pkgs.mkShell {
VAULT_ADDR = "http://vault.olympus:8200/"; VAULT_ADDR = "http://vault.olympus:8200/";
buildInputs = with pkgs; [ buildInputs = with pkgs; [
attic.packages.${pkgs.system}.attic
apply-local apply-local
colmena.packages.${system}.colmena colmena.packages.${system}.colmena
cachix cachix

2
flux/olympus/apps/services/renovate/cronjob.yaml
View file

@ -19,7 +19,7 @@ spec:
emptyDir: {} emptyDir: {}
containers: containers:
- name: renovate - name: renovate
image: renovate/renovate:35.105.5 image: renovate/renovate:35.114.2
volumeMounts: volumeMounts:
- name: config-volume - name: config-volume
mountPath: /opt/renovate/ mountPath: /opt/renovate/

2
nixos/common/default.nix
View file

@ -77,7 +77,7 @@
nixpkgs.config.allowUnfree = true; nixpkgs.config.allowUnfree = true;
nixpkgs.config.permittedInsecurePackages = nixpkgs.config.permittedInsecurePackages =
[ "nodejs-14.21.3" "openssl-1.1.1t" "nodejs-16.20.0" ]; [ "nodejs-14.21.3" "openssl-1.1.1t" "nodejs-16.20.0" "openssl-1.1.1u" ];
# Limit the systemd journal to 100 MB of disk or the # Limit the systemd journal to 100 MB of disk or the
# last 7 days of logs, whichever happens first. # last 7 days of logs, whichever happens first.

1
nixos/common/desktop/home.nix
View file

@ -15,6 +15,7 @@ in {
fusee-launcher fusee-launcher
gcc gcc
gimp gimp
inputs.attic.packages.${pkgs.system}.attic
inputs.comma.packages.${pkgs.system}.default inputs.comma.packages.${pkgs.system}.default
inputs.webcord.packages.${pkgs.system}.default inputs.webcord.packages.${pkgs.system}.default
kdenlive kdenlive

1
nixos/common/hm-modules/nvim.nix
View file

@ -70,6 +70,7 @@ in {
servers.pyright.enable = true; servers.pyright.enable = true;
servers.elixirls.enable = true; servers.elixirls.enable = true;
servers.clangd.enable = true; servers.clangd.enable = true;
servers.yamlls.enable = true;
}; };
trouble.enable = true; trouble.enable = true;
lspkind.enable = true; lspkind.enable = true;

19
nixos/hosts/hades/attic/configuration.nix
View file

@ -18,10 +18,21 @@ in {
# Additional packages # Additional packages
environment.systemPackages = with pkgs; [ ]; environment.systemPackages = with pkgs; [ ];
vault-secrets.secrets.attic = { vault-secrets.secrets.attic = { services = [ "atticd" ]; };
services = [ "atticd" ];
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
ensureDatabases = [ "atticd" ];
ensureUsers = [{
name = "atticd";
ensurePermissions = {
"DATABASE atticd" = "ALL PRIVILEGES";
"schema public" = "ALL";
};
}];
};
services.atticd = { services.atticd = {
enable = true; enable = true;
@ -44,6 +55,8 @@ in {
level = 8; level = 8;
}; };
database.url = "postgresql://atticd?host=/run/postgresql";
storage = { storage = {
type = "s3"; type = "s3";
region = "hades"; region = "hades";

6
nixos/hosts/hades/dns/configuration.nix
View file

@ -21,7 +21,10 @@
services.unbound.settings.server = { services.unbound.settings.server = {
local-zone = [ local-zone = [
"xirion.net typetransparent" "xirion.net typetransparent"
"attic.xirion.net typetransparent"
"o.xirion.net typetransparent" "o.xirion.net typetransparent"
"attic.xirion.net typetransparent"
"g.xirion.net typetransparent"
"fedi-media.xirion.net typetransparent" "fedi-media.xirion.net typetransparent"
"hades.xirion.net typetransparent" "hades.xirion.net typetransparent"
"requests.xirion.net typetransparent" "requests.xirion.net typetransparent"
@ -31,8 +34,11 @@
local-data = [ local-data = [
''"xirion.net A 192.168.0.122"'' ''"xirion.net A 192.168.0.122"''
''"attic.xirion.net A 192.168.0.122"''
''"hades.xirion.net A 192.168.0.122"'' ''"hades.xirion.net A 192.168.0.122"''
''"o.xirion.net A 192.168.0.122"'' ''"o.xirion.net A 192.168.0.122"''
''"attic.xirion.net A 192.168.0.122"''
''"g.xirion.net A 192.168.0.122"''
''"fedi-media.xirion.net A 192.168.0.122"'' ''"fedi-media.xirion.net A 192.168.0.122"''
''"requests.xirion.net A 192.168.0.122"'' ''"requests.xirion.net A 192.168.0.122"''
''"ha.xirion.net A 192.168.0.122"'' ''"ha.xirion.net A 192.168.0.122"''

3
nixos/hosts/hades/nginx/configuration.nix
View file

@ -36,7 +36,7 @@ in {
recommendedTlsSettings = true; recommendedTlsSettings = true;
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedBrotliSettings = true; recommendedBrotliSettings = true;
clientMaxBodySize = "500m"; clientMaxBodySize = "1024m";
package = pkgs.nginxMainline; package = pkgs.nginxMainline;
@ -59,6 +59,7 @@ in {
virtualHosts."git.xirion.net" = proxy "http://10.10.10.12"; virtualHosts."git.xirion.net" = proxy "http://10.10.10.12";
virtualHosts."mail.xirion.net" = proxy "http://192.168.0.118"; virtualHosts."mail.xirion.net" = proxy "http://192.168.0.118";
virtualHosts."o.xirion.net" = proxy "http://192.168.0.112:9000"; virtualHosts."o.xirion.net" = proxy "http://192.168.0.112:9000";
virtualHosts."g.xirion.net" = proxy "http://garage.hades:3900";
virtualHosts."requests.xirion.net" = proxy "http://overseerr.hades:5055"; virtualHosts."requests.xirion.net" = proxy "http://overseerr.hades:5055";
virtualHosts."pass.xirion.net" = proxy "http://bitwarden_rs"; virtualHosts."pass.xirion.net" = proxy "http://bitwarden_rs";
virtualHosts."repo.xirion.net" = proxy "http://archlinux"; virtualHosts."repo.xirion.net" = proxy "http://archlinux";

20
nixos/hosts/hades/rtorrent/configuration.nix
View file

@ -34,12 +34,20 @@ in {
privateKeyFile = "${vs.rtorrent}/wireguardKey"; privateKeyFile = "${vs.rtorrent}/wireguardKey";
postUp = "${postUpScript}/bin/post_up || true"; postUp = "${postUpScript}/bin/post_up || true";
peers = [{ peers = [
publicKey = "DVui+5aifNFRIVDjH3v2y+dQ+uwI+HFZOd21ajbEpBo="; {
allowedIPs = [ "0.0.0.0/0" "::/0" ]; publicKey = "33BoONMGCm2vknq2eq72eozRsHmHQY6ZHEEZ4851TkY=";
endpoint = "185.65.134.82:51820"; allowedIPs = [ "0.0.0.0/0" "::/0"];
persistentKeepalive = 25; endpoint = "193.32.249.70:51820";
}]; persistentKeepalive = 25;
}
# {
# publicKey = "DVui+5aifNFRIVDjH3v2y+dQ+uwI+HFZOd21ajbEpBo=";
# allowedIPs = [ "0.0.0.0/0" "::/0" ];
# endpoint = "185.65.134.82:51820";
# persistentKeepalive = 25;
# }
];
}; };
}; };
} }

9
nixos/hosts/olympus/ci/configuration.nix
View file

@ -40,6 +40,15 @@ in {
}; };
services.gitea-actions-runner.instances = { services.gitea-actions-runner.instances = {
runner_1 = {
name = "runner_1";
enable = true;
labels = [
"docker:docker://node:16-bullseye"
];
url = "https://git.0x76.dev";
tokenFile = "${vs.gitea_runner}/token_runner_1";
};
nix-native = { nix-native = {
enable = true; enable = true;
name = "nix-native"; name = "nix-native";

24
nixos/hosts/olympus/mailserver/configuration.nix
View file

@ -27,20 +27,37 @@ in {
mailserver = { mailserver = {
enable = true; enable = true;
fqdn = "mail.0x76.dev"; fqdn = "mail.0x76.dev";
domains = [ "0x76.dev" "meowy.tech" ]; domains = [ "0x76.dev" "meowy.tech" "xirion.net" ];
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
enableManageSieve = true;
monitoring = {
alertAddress = "v@0x76.dev";
enable = true;
};
loginAccounts = { loginAccounts = {
# People # People
"v@0x76.dev" = { "v@0x76.dev" = {
hashedPasswordFile = "${vs.mailserver}/v@0x76.dev"; hashedPasswordFile = "${vs.mailserver}/v@0x76.dev";
aliases = catchAll = [ "xirion.net" "0x76.dev" ];
[ "v@meowy.tech" "postmaster@0x76.dev" "postmaster@meowy.tech" ]; aliases = [
"postmaster@0x76.dev"
"abuse@0x76.dev"
"v@meowy.tech"
"abuse@meowy.tech"
"postmaster@meowy.tech"
"@xirion.net"
"@0x76.dev"
];
}; };
"laura@meowy.tech" = { "laura@meowy.tech" = {
hashedPasswordFile = "${vs.mailserver}/laura@meowy.tech"; hashedPasswordFile = "${vs.mailserver}/laura@meowy.tech";
aliases = [ "lau@meowy.tech" ]; aliases = [ "lau@meowy.tech" ];
}; };
# Services # Services
"gitea@0x76.dev" = { "gitea@0x76.dev" = {
hashedPasswordFile = "${vs.mailserver}/gitea@0x76.dev"; hashedPasswordFile = "${vs.mailserver}/gitea@0x76.dev";
@ -82,6 +99,7 @@ in {
pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]); pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
plugins = [ plugins = [
"archive" "archive"
"managesieve"
# "enigma" # "enigma"
# "markasjunk" # "markasjunk"
"persistent_login" "persistent_login"

12
nixos/pkgs/plex-pass/sources.json
View file

@ -1,14 +1,14 @@
[ [
{ {
"version": "1.32.3.7089", "version": "1.32.4.7164",
"platform": "aarch64-linux", "platform": "aarch64-linux",
"url": "https://downloads.plex.tv/plex-media-server-new/1.32.3.7089-b0a36929b/debian/plexmediaserver_1.32.3.7089-b0a36929b_arm64.deb", "url": "https://downloads.plex.tv/plex-media-server-new/1.32.4.7164-1dc22f47b/debian/plexmediaserver_1.32.4.7164-1dc22f47b_arm64.deb",
"hash": "1sc6h04l0lxw3jzz01gn7i6wikqqds7nqh35rqvwhffjgdvmcjhq" "hash": "1k61rrdjlwhf14q8qdj976a53wf9f9ask0fwynldyqbvjfjgy0ws"
}, },
{ {
"version": "1.32.3.7089", "version": "1.32.4.7164",
"platform": "x86_64-linux", "platform": "x86_64-linux",
"url": "https://downloads.plex.tv/plex-media-server-new/1.32.3.7089-b0a36929b/debian/plexmediaserver_1.32.3.7089-b0a36929b_amd64.deb", "url": "https://downloads.plex.tv/plex-media-server-new/1.32.4.7164-1dc22f47b/debian/plexmediaserver_1.32.4.7164-1dc22f47b_amd64.deb",
"hash": "074qvjl49rfn6s3naa5s71i5kd0an64laijz13cpsh55yy6zwgb3" "hash": "0sa537yx7gjbabmisb26yrrlg7ql124qhwlc20r5m1hbq8i1i23w"
} }
] ]

2
nixos/pkgs/vscode-extensions/platformio.nix
View file

@ -5,7 +5,7 @@ in buildVscodeMarketplaceExtension {
name = "platformio-ide"; name = "platformio-ide";
publisher = "platformio"; publisher = "platformio";
version = "3.1.1"; version = "3.1.1";
sha256 = "sha256-fwEct7Tj8bfTOLRozSZJGWoLzWRSvYz/KxcnfpO8Usg="; sha256 = "sha256-g9yTG3DjVUS2w9eHGAai5LoIfEGus+FPhqDnCi4e90Q=";
# sha256 = lib.fakeSha256; # sha256 = lib.fakeSha256;
}; };
} }