v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Actions Packages Projects Releases Activity

Merge remote-tracking branch 'refs/remotes/origin/main'

Browse source
This commit is contained in:
Vivian 2023-11-16 20:31:20 +01:00
parent 26bfe82032 cfa3ae8d24
commit bc474a69e2
22 changed files with 222 additions and 347 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
flake.lock
View file

@ -687,11 +687,11 @@
]
},
"locked": {
"lastModified": 1699368917,
"narHash": "sha256-nUtGIWf86BOkUbtksWtfglvCZ/otP0FTZlQH8Rzc7PA=",
"lastModified": 1699783872,
"narHash": "sha256-4zTwLT2LL45Nmo6iwKB3ls3hWodVP9DiSWxki/oewWE=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "6a8444467c83c961e2f5ff64fb4f422e303c98d3",
"rev": "280721186ab75a76537713ec310306f0eba3e407",
"type": "github"
},
"original": {
@ -713,11 +713,11 @@
"rust-overlay": "rust-overlay_2"
},
"locked": {
"lastModified": 1699469975,
"narHash": "sha256-TVYObcXFB6c3z5vF/aLZKDL7u+Rt0OZLWpvIdMcJZ4Q=",
"lastModified": 1699626196,
"narHash": "sha256-/arAIgFkEOTss4BsppCJn1DIBxvx1ESgWOj9CJqx4lQ=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "bc0fd4e1d9cbba5f8dce5df845246d77eb7c01d6",
"rev": "81975f3bc4a7f3f4c689c43645110c2e1aac56b2",
"type": "github"
},
"original": {
@ -898,11 +898,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1699159446,
"narHash": "sha256-cL63IjsbPl2otS7R4kdXbVOJOXYMpGw5KGZoWgdCuCM=",
"lastModified": 1699701045,
"narHash": "sha256-mDzUXK7jNO/utInWpSWEX1NgEEunVIpJg+LyPsDTfy0=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "627bc9b88256379578885a7028c9e791c29fb581",
"rev": "b689465d0c5d88e158e7d76094fca08cc0223aad",
"type": "github"
},
"original": {
@ -1089,11 +1089,11 @@
},
"nixpkgs_4": {
"locked": {
"lastModified": 1699354722,
"narHash": "sha256-abmqUReg4PsyQSwv4d0zjcWpMHrd3IFJiTb2tZpfF04=",
"lastModified": 1699686971,
"narHash": "sha256-fttf55Uo88Ei57sxTuDOwKXg8izdR365lFjI13+XfwE=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "cfbb29d76949ae53c457f152c52c173ea4bdd862",
"rev": "d638da8b6a17041483d90ba9af6c3b5e30b4fbcc",
"type": "github"
},
"original": {
@ -1104,11 +1104,11 @@
},
"nixpkgs_5": {
"locked": {
"lastModified": 1698924604,
"narHash": "sha256-GCFbkl2tj8fEZBZCw3Tc0AkGo0v+YrQlohhEGJ/X4s0=",
"lastModified": 1699099776,
"narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "fa804edfb7869c9fb230e174182a8a1a7e512c40",
"rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
"type": "github"
},
"original": {
@ -1205,11 +1205,11 @@
"pre-commit-hooks": "pre-commit-hooks"
},
"locked": {
"lastModified": 1699308475,
"narHash": "sha256-sFHOFiE+GV1JkwDmHi0LLJLSRyggdIK1Yra02oj2eZg=",
"lastModified": 1699721903,
"narHash": "sha256-ghsMr6EqRNCRJtzNokmqeyA3soMjl7bc+/TN7LX/Izc=",
"owner": "pta2002",
"repo": "nixvim",
"rev": "6b93c8fa6db999320d53f13e0ebd555e33f86577",
"rev": "1286a0f41e37b2bb94f2eb87a7f4efde727f8e87",
"type": "github"
},
"original": {
@ -1220,11 +1220,11 @@
},
"nur": {
"locked": {
"lastModified": 1699536582,
"narHash": "sha256-xW16bouhkI9fx6wMLy8002cbLvB3UK4B3J10+Anq9BU=",
"lastModified": 1699789173,
"narHash": "sha256-8ImqQHlD/RV/DqUkLX6OMOLC0L3rOnpz18/L8kt+9QQ=",
"owner": "nix-community",
"repo": "NUR",
"rev": "71d46644e40610ea90c7e97ba32667de90c5f1a5",
"rev": "cafc94f2fafd3bc7ef0a2f35a3484dd2df64f111",
"type": "github"
},
"original": {
@ -1289,11 +1289,11 @@
"nixpkgs-stable": "nixpkgs-stable_3"
},
"locked": {
"lastModified": 1698852633,
"narHash": "sha256-Hsc/cCHud8ZXLvmm8pxrXpuaPEeNaaUttaCvtdX/Wug=",
"lastModified": 1699271226,
"narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "dec10399e5b56aa95fcd530e0338be72ad6462a0",
"rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
"type": "github"
},
"original": {

2
flake.nix
View file

@ -118,7 +118,7 @@
default = colmena.packages.${system}.colmena;
proxmox-lxc = nixos-generators.nixosGenerate {
inherit system pkgs specialArgs;
inherit system specialArgs;
format = "proxmox-lxc";
modules = util.base_imports
++ [ (import ./nixos/templates/proxmox-lxc.nix) ];

17
flux/olympus/apps/services/grist/external-secret.yaml
View file

@ -1,17 +0,0 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: grist
namespace: services
spec:
refreshInterval: "5m"
secretStoreRef:
name: vault
kind: ClusterSecretStore
target:
name: grist
data:
- secretKey: GRIST_SESSION_SECRET
remoteRef:
key: services/grist
property: grist_session_secret

47
flux/olympus/apps/services/grist/grist.yaml
View file

@ -1,47 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: grist
namespace: services
labels:
app: grist
spec:
replicas: 1
selector:
matchLabels:
app: grist
template:
metadata:
labels:
app: grist
spec:
volumes:
- name: persist
persistentVolumeClaim:
claimName: grist
containers:
- name: grist-core
image: gristlabs/grist:1.1.7
volumeMounts:
- name: persist
mountPath: /persist
env:
- name: APP_HOME_URL
value: "https://grist.0x76.dev"
- name: GRIST_SINGLE_ORG
value: ""
- name: GRIST_SUPPORT_ANON
value: false
- name: PYTHON_VERSION
value: 3
- name: PYTHON_VERSION_ON_CREATION
value: 3
- name: GRIST_FORWARD_AUTH_HEADER
value: X-Forwarded-User
- name: GRIST_FORWARD_AUTH_LOGOUT_PATH
value: /_oauth/logout
envFrom:
- secretRef:
name: grist
ports:
- containerPort: 8484

29
flux/olympus/apps/services/grist/ingress.yaml
View file

@ -1,29 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: grist
namespace: services
spec:
selector:
app: grist
ports:
- protocol: TCP
port: 8484
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: grist
namespace: services
spec:
rules:
- host: "grist.0x76.dev"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: grist
port:
number: 8484

7
flux/olympus/apps/services/grist/kustomization.yaml
View file

@ -1,7 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- external-secret.yaml
- pvc.yaml
- grist.yaml
- ingress.yaml

12
flux/olympus/apps/services/grist/pvc.yaml
View file

@ -1,12 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: grist
namespace: services
spec:
accessModes:
- ReadWriteOnce
storageClassName: local-path
resources:
requests:
storage: 2Gi

1
flux/olympus/apps/services/kustomization.yaml
View file

@ -2,4 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- renovate
- oauth2-proxy

25
flux/olympus/apps/services/oauth2-proxy/external-secret.yaml
View file

@ -1,25 +0,0 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: oauth2-proxy
namespace: services
spec:
refreshInterval: "5m"
secretStoreRef:
name: vault
kind: ClusterSecretStore
target:
name: oauth2-proxy
data:
- secretKey: OAUTH2_PROXY_CLIENT_ID
remoteRef:
key: services/oauth2-proxy
property: client_id
- secretKey: OAUTH2_PROXY_CLIENT_SECRET
remoteRef:
key: services/oauth2-proxy
property: client_secret
- secretKey: OAUTH2_PROXY_COOKIE_SECRET
remoteRef:
key: services/oauth2-proxy
property: cookie_secret

5
flux/olympus/apps/services/oauth2-proxy/kustomization.yaml
View file

@ -1,5 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- external-secret.yaml
- oauth2-proxy.yaml

67
flux/olympus/apps/services/oauth2-proxy/oauth2-proxy.yaml
View file

@ -1,67 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
k8s-app: oauth2-proxy
name: oauth2-proxy
namespace: services
spec:
replicas: 1
selector:
matchLabels:
k8s-app: oauth2-proxy
template:
metadata:
labels:
k8s-app: oauth2-proxy
spec:
containers:
- args:
- --provider=oidc
- --provider-display2-name="Dex"
- --oidc-issuer-url=https://dex.0x76.dev/dex
- --redirect-url=https://o2p.0x76.dev/oauth2/callback
- --cookie-secure=false
- --http-address=0.0.0.0:4180
image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
envFrom:
- secretRef:
name: oauth2-proxy
name: oauth2-proxy
ports:
- containerPort: 4180
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
labels:
k8s-app: oauth2-proxy
name: oauth2-proxy
namespace: services
spec:
ports:
- name: http
port: 4180
protocol: TCP
targetPort: 4180
selector:
k8s-app: oauth2-proxy
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: oauth2-proxy
namespace: services
spec:
rules:
- host: "o2p.0x76.dev"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180

2
flux/olympus/apps/services/renovate/cronjob.yaml
View file

@ -19,7 +19,7 @@ spec:
emptyDir: {}
containers:
- name: renovate
image: renovate/renovate:37.51.3
image: renovate/renovate:37.59.8
volumeMounts:
- name: config-volume
mountPath: /opt/renovate/

42
nixos/common/desktop/home.nix
View file

@ -5,8 +5,7 @@ let
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
};
my-python-packages = ps: with ps; [ pandas requests numpy ];
in
{
in {
home.packages = with pkgs; [
(python3.withPackages my-python-packages)
btop
@ -35,7 +34,6 @@ in
plexamp
spotify
qmk
rustup
solo2-cli
tex
unzip
@ -45,8 +43,11 @@ in
# Enable my own hm modules
themes.v.catppuccin.enable = true;
programs = {
v.vscode.enable = true;
v.nvim.enable = true;
v = {
vscode.enable = true;
nvim.enable = true;
rust.enable = true;
};
riff = {
enable = true;
@ -72,26 +73,23 @@ in
thunderbird = {
enable = true;
profiles.default = {
isDefault = true;
};
profiles.default = { isDefault = true; };
};
};
# Syncthing
services.syncthing.enable = true;
xdg.userDirs =
let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
xdg.userDirs = let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
}

2
nixos/common/hm-modules/default.nix
View file

@ -1,3 +1,3 @@
{ ... }: {
imports = [ ./catppuccin.nix ./nvim.nix ./riff.nix ./vscode.nix ./git.nix ];
imports = [ ./catppuccin.nix ./nvim.nix ./riff.nix ./vscode.nix ./git.nix ./rust.nix ];
}

2
nixos/common/hm-modules/git.nix
View file

@ -7,7 +7,7 @@ in {
programs.git = {
enable = true;
package = pkgs.gitAndTools.gitFull;
userName = "Victor";
userName = "0x76";
userEmail = "victor@xirion.net";
lfs.enable = true;
extraConfig = {

23
nixos/common/hm-modules/rust.nix Normal file
View file

@ -0,0 +1,23 @@
{ pkgs, lib, config, ... }:
with lib;
let cfg = config.programs.v.rust;
in {
options.programs.v.rust = { enable = mkEnableOption "rust"; };
config = mkIf cfg.enable {
home = {
packages = with pkgs; [ rustup ];
file = {
".cargo/config.toml".text = ''
[registries.crates-io]
protocol = "sparse"
[build]
rustc-wrapper = "${pkgs.sccache}/bin/sccache"
'';
};
sessionPath = [ "$HOME/.cargo/bin" ];
};
};
}

1
nixos/hosts/hades/overseerr/lidarr.nix
View file

@ -5,6 +5,7 @@ in {
vault-secrets.secrets.lidarr = {
quoteEnvironmentValues = false; # Needed for docker
services = [ "podman-lidarr" ];
};
virtualisation.oci-containers.containers.lidarr = {

2
nixos/hosts/hades/overseerr/prowlarr.nix
View file

@ -5,7 +5,7 @@ _: {
};
virtualisation.oci-containers.containers.flaresolverr = {
image = "flaresolverr/flaresolverr:v3.3.7";
image = "flaresolverr/flaresolverr:v3.3.9";
ports = [ "8191:8191" ];
};
}

22
nixos/hosts/olympus/default.nix
View file

@ -53,7 +53,6 @@
exposes = {
www.domain = "0x76.dev";
flux.domain = "flux.0x76.dev";
o2p.domain = "o2p.0x76.dev";
internal.domain = "internal.xirion.net";
blog.domain = "blog.xirion.net";
};
@ -61,9 +60,15 @@
"dex" = {
ip = "10.42.42.11";
mac = "AE:66:7B:FA:15:72";
exposes.dex = {
domain = "dex.0x76.dev";
port = 5556;
exposes = {
dex = {
domain = "dex.0x76.dev";
port = 5556;
};
o2p_proxy = {
domain = "o2p.0x76.dev";
port = 8484;
};
};
};
"WoolooTV" = {
@ -151,7 +156,14 @@
ip = "10.42.42.25";
mac = "1E:ED:97:2C:C3:9D";
};
# 10.42.42.26
"grist" = {
ip = "10.42.42.26";
mac = "B2:AA:AB:5D:2F:22";
exposes.grist = {
domain = "grist.0x76.dev";
port = 8484;
};
};
"bookwyrm" = {
ip = "10.42.42.27";
mac = "9E:8A:6C:39:27:DE";

153
nixos/hosts/olympus/dex/configuration.nix
View file

@ -9,8 +9,7 @@ let
db_name = "dex";
inherit (config.meta.exposes.dex) port;
metricsPort = 5558;
in
{
in {
imports = [ ];
# This value determines the NixOS release from which the default
@ -23,91 +22,85 @@ in
networking.firewall.allowedTCPPorts = [ port metricsPort ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
ensureDatabases = [ db_name ];
ensureUsers = [{
name = db_user;
ensurePermissions = {
"DATABASE ${db_name}" = "ALL PRIVILEGES";
"schema public" = "ALL";
};
}];
};
vault-secrets.secrets.dex = { };
vault-secrets.secrets.oauth2_proxy = { };
services.dex = {
enable = true;
settings = {
issuer = "https://dex.0x76.dev";
storage = {
type = "postgres";
config = {
host = "/var/run/postgresql";
user = db_user;
database = db_name;
};
};
web.http = "0.0.0.0:${toString port}";
telemetry.http = "0.0.0.0:${toString metricsPort}";
services = {
connectors = [{
type = "gitea";
id = "gitea";
name = "Gitea";
config = {
clientID = "$GITEA_CLIENT_ID";
clientSecret = "$GITEA_CLIENT_SECRET";
redirectURI = "https://dex.0x76.dev/callback";
baseURL = "https://git.0x76.dev";
postgresql = {
enable = true;
package = pkgs.postgresql_15;
ensureDatabases = [ db_name ];
ensureUsers = [{
name = db_user;
ensurePermissions = {
"DATABASE ${db_name}" = "ALL PRIVILEGES";
"schema public" = "ALL";
};
}];
staticClients = [
{
id = "outline";
name = "Outline";
redirectURIs = [ "https://outline.0x76.dev/auth/oidc.callback" ];
secretEnv = "OUTLINE_CLIENT_SECRET";
}
{
id = "grafana";
name = "Grafana";
redirectURIs = [ "https://grafana.0x76.dev/login/generic_oauth" ];
secretEnv = "GRAFANA_CLIENT_SECRET";
}
{
id = "hedgedoc";
name = "Hedgedoc";
redirectURIs = [ "https://md.0x76.dev/auth/oauth2/callback" ];
secretEnv = "HEDGEDOC_CLIENT_SECRET";
}
{
id = "flux";
name = "Weave Gitops Flux Dashboard";
redirectURIs = [ "https://flux.0x76.dev/oauth2/callback" ];
secretEnv = "FLUX_CLIENT_SECRET";
}
{
id = "oauth2-proxy";
name = "OAuth2 Proxy";
redirectURIs = [ "https://o2p.0x76.dev/oauth2/callback" ];
secretEnv = "O2P_CLIENT_SECRET";
}
];
};
environmentFile = "${vs.dex}/environment";
};
dex = {
enable = true;
settings = {
issuer = "https://dex.0x76.dev";
storage = {
type = "postgres";
config = {
host = "/var/run/postgresql";
user = db_user;
database = db_name;
};
};
web.http = "0.0.0.0:${toString port}";
telemetry.http = "0.0.0.0:${toString metricsPort}";
connectors = [{
type = "gitea";
id = "gitea";
name = "Gitea";
config = {
clientID = "$GITEA_CLIENT_ID";
clientSecret = "$GITEA_CLIENT_SECRET";
redirectURI = "https://dex.0x76.dev/callback";
baseURL = "https://git.0x76.dev";
};
}];
services.oauth2_proxy = {
enable = false;
provider = "oidc";
redirectURL = "https://o2p.0x76.dev/oauth2/callback";
cookie.secure = false;
httpAddress = "0.0.0.0:4180";
keyFile = "";
staticClients = [
{
id = "outline";
name = "Outline";
redirectURIs = [ "https://outline.0x76.dev/auth/oidc.callback" ];
secretEnv = "OUTLINE_CLIENT_SECRET";
}
{
id = "grafana";
name = "Grafana";
redirectURIs = [ "https://grafana.0x76.dev/login/generic_oauth" ];
secretEnv = "GRAFANA_CLIENT_SECRET";
}
{
id = "hedgedoc";
name = "Hedgedoc";
redirectURIs = [ "https://md.0x76.dev/auth/oauth2/callback" ];
secretEnv = "HEDGEDOC_CLIENT_SECRET";
}
{
id = "flux";
name = "Weave Gitops Flux Dashboard";
redirectURIs = [ "https://flux.0x76.dev/oauth2/callback" ];
secretEnv = "FLUX_CLIENT_SECRET";
}
{
id = "grist";
name = "grist";
redirectURIs = [ "https://grist.0x76.dev/oauth2/callback" ];
secretEnv = "GRIST_CLIENT_SECRET";
}
];
};
environmentFile = "${vs.dex}/environment";
};
};
}

2
nixos/hosts/olympus/eevee/hardware.nix
View file

@ -1,4 +1,4 @@
{ pkgs, config, ... }: {
{ pkgs, ... }: {
hardware = {
enableAllFirmware = true;
nvidia = {

58
nixos/hosts/olympus/grist/configuration.nix Normal file
View file

@ -0,0 +1,58 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
let vs = config.vault-secrets.secrets;
in {
imports = [ ];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.11"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ 8484 ];
environment.systemPackages = with pkgs; [ sqlite ];
virtualisation = {
podman.enable = true;
oci-containers.backend = "podman";
oci-containers.containers.grist = {
image =
"gristlabs/grist:latest"; # Switch to versioned release as soon as OIDC hits stable
environment = {
APP_HOME_URL = "https://grist.0x76.dev";
GRIST_SUPPORT_ANON = "false";
GRIST_FORCE_LOGIN = "true";
GRIST_SINGLE_ORG = "xirion";
GRIST_ORG_IN_PATH = "false";
GRIST_DEFAULT_EMAIL = "v@0x76.dev"; # Defines admin user
GRIST_HIDE_UI_ELEMENTS =
"helpCenter,billing,templates,multiSite,multiAccounts";
GRIST_TELEMETRY_LEVEL = "off";
GRIST_WIDGET_LIST_URL =
"https://github.com/gristlabs/grist-widget/releases/download/latest/manifest.json";
# No Python 2
PYTHON_VERSION = "3";
PYTHON_VERSION_ON_CREATION = "3";
# Beta OIDC support
GRIST_OIDC_IDP_ISSUER = "https://dex.0x76.dev";
};
environmentFiles = [ "${vs.grist}/environment" ];
ports = [ "8484:8484" ];
volumes = [ "/var/lib/grist:/persist" ];
};
};
vault-secrets.secrets.grist = {
quoteEnvironmentValues = false; # Needed for docker
services = [ "podman-grist" ];
};
}