Merge remote-tracking branch 'refs/remotes/origin/main'
This commit is contained in:
commit
bc474a69e2
48
flake.lock
48
flake.lock
|
@ -687,11 +687,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699368917,
|
"lastModified": 1699783872,
|
||||||
"narHash": "sha256-nUtGIWf86BOkUbtksWtfglvCZ/otP0FTZlQH8Rzc7PA=",
|
"narHash": "sha256-4zTwLT2LL45Nmo6iwKB3ls3hWodVP9DiSWxki/oewWE=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "6a8444467c83c961e2f5ff64fb4f422e303c98d3",
|
"rev": "280721186ab75a76537713ec310306f0eba3e407",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -713,11 +713,11 @@
|
||||||
"rust-overlay": "rust-overlay_2"
|
"rust-overlay": "rust-overlay_2"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699469975,
|
"lastModified": 1699626196,
|
||||||
"narHash": "sha256-TVYObcXFB6c3z5vF/aLZKDL7u+Rt0OZLWpvIdMcJZ4Q=",
|
"narHash": "sha256-/arAIgFkEOTss4BsppCJn1DIBxvx1ESgWOj9CJqx4lQ=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "lanzaboote",
|
"repo": "lanzaboote",
|
||||||
"rev": "bc0fd4e1d9cbba5f8dce5df845246d77eb7c01d6",
|
"rev": "81975f3bc4a7f3f4c689c43645110c2e1aac56b2",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -898,11 +898,11 @@
|
||||||
},
|
},
|
||||||
"nixos-hardware": {
|
"nixos-hardware": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699159446,
|
"lastModified": 1699701045,
|
||||||
"narHash": "sha256-cL63IjsbPl2otS7R4kdXbVOJOXYMpGw5KGZoWgdCuCM=",
|
"narHash": "sha256-mDzUXK7jNO/utInWpSWEX1NgEEunVIpJg+LyPsDTfy0=",
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"repo": "nixos-hardware",
|
"repo": "nixos-hardware",
|
||||||
"rev": "627bc9b88256379578885a7028c9e791c29fb581",
|
"rev": "b689465d0c5d88e158e7d76094fca08cc0223aad",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1089,11 +1089,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs_4": {
|
"nixpkgs_4": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699354722,
|
"lastModified": 1699686971,
|
||||||
"narHash": "sha256-abmqUReg4PsyQSwv4d0zjcWpMHrd3IFJiTb2tZpfF04=",
|
"narHash": "sha256-fttf55Uo88Ei57sxTuDOwKXg8izdR365lFjI13+XfwE=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "cfbb29d76949ae53c457f152c52c173ea4bdd862",
|
"rev": "d638da8b6a17041483d90ba9af6c3b5e30b4fbcc",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1104,11 +1104,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs_5": {
|
"nixpkgs_5": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1698924604,
|
"lastModified": 1699099776,
|
||||||
"narHash": "sha256-GCFbkl2tj8fEZBZCw3Tc0AkGo0v+YrQlohhEGJ/X4s0=",
|
"narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "fa804edfb7869c9fb230e174182a8a1a7e512c40",
|
"rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1205,11 +1205,11 @@
|
||||||
"pre-commit-hooks": "pre-commit-hooks"
|
"pre-commit-hooks": "pre-commit-hooks"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699308475,
|
"lastModified": 1699721903,
|
||||||
"narHash": "sha256-sFHOFiE+GV1JkwDmHi0LLJLSRyggdIK1Yra02oj2eZg=",
|
"narHash": "sha256-ghsMr6EqRNCRJtzNokmqeyA3soMjl7bc+/TN7LX/Izc=",
|
||||||
"owner": "pta2002",
|
"owner": "pta2002",
|
||||||
"repo": "nixvim",
|
"repo": "nixvim",
|
||||||
"rev": "6b93c8fa6db999320d53f13e0ebd555e33f86577",
|
"rev": "1286a0f41e37b2bb94f2eb87a7f4efde727f8e87",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1220,11 +1220,11 @@
|
||||||
},
|
},
|
||||||
"nur": {
|
"nur": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699536582,
|
"lastModified": 1699789173,
|
||||||
"narHash": "sha256-xW16bouhkI9fx6wMLy8002cbLvB3UK4B3J10+Anq9BU=",
|
"narHash": "sha256-8ImqQHlD/RV/DqUkLX6OMOLC0L3rOnpz18/L8kt+9QQ=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "NUR",
|
"repo": "NUR",
|
||||||
"rev": "71d46644e40610ea90c7e97ba32667de90c5f1a5",
|
"rev": "cafc94f2fafd3bc7ef0a2f35a3484dd2df64f111",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1289,11 +1289,11 @@
|
||||||
"nixpkgs-stable": "nixpkgs-stable_3"
|
"nixpkgs-stable": "nixpkgs-stable_3"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1698852633,
|
"lastModified": 1699271226,
|
||||||
"narHash": "sha256-Hsc/cCHud8ZXLvmm8pxrXpuaPEeNaaUttaCvtdX/Wug=",
|
"narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
|
||||||
"owner": "cachix",
|
"owner": "cachix",
|
||||||
"repo": "pre-commit-hooks.nix",
|
"repo": "pre-commit-hooks.nix",
|
||||||
"rev": "dec10399e5b56aa95fcd530e0338be72ad6462a0",
|
"rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
|
@ -118,7 +118,7 @@
|
||||||
default = colmena.packages.${system}.colmena;
|
default = colmena.packages.${system}.colmena;
|
||||||
|
|
||||||
proxmox-lxc = nixos-generators.nixosGenerate {
|
proxmox-lxc = nixos-generators.nixosGenerate {
|
||||||
inherit system pkgs specialArgs;
|
inherit system specialArgs;
|
||||||
format = "proxmox-lxc";
|
format = "proxmox-lxc";
|
||||||
modules = util.base_imports
|
modules = util.base_imports
|
||||||
++ [ (import ./nixos/templates/proxmox-lxc.nix) ];
|
++ [ (import ./nixos/templates/proxmox-lxc.nix) ];
|
||||||
|
|
|
@ -1,17 +0,0 @@
|
||||||
apiVersion: external-secrets.io/v1beta1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: grist
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
refreshInterval: "5m"
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: grist
|
|
||||||
data:
|
|
||||||
- secretKey: GRIST_SESSION_SECRET
|
|
||||||
remoteRef:
|
|
||||||
key: services/grist
|
|
||||||
property: grist_session_secret
|
|
|
@ -1,47 +0,0 @@
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: grist
|
|
||||||
namespace: services
|
|
||||||
labels:
|
|
||||||
app: grist
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: grist
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: grist
|
|
||||||
spec:
|
|
||||||
volumes:
|
|
||||||
- name: persist
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: grist
|
|
||||||
containers:
|
|
||||||
- name: grist-core
|
|
||||||
image: gristlabs/grist:1.1.7
|
|
||||||
volumeMounts:
|
|
||||||
- name: persist
|
|
||||||
mountPath: /persist
|
|
||||||
env:
|
|
||||||
- name: APP_HOME_URL
|
|
||||||
value: "https://grist.0x76.dev"
|
|
||||||
- name: GRIST_SINGLE_ORG
|
|
||||||
value: ""
|
|
||||||
- name: GRIST_SUPPORT_ANON
|
|
||||||
value: false
|
|
||||||
- name: PYTHON_VERSION
|
|
||||||
value: 3
|
|
||||||
- name: PYTHON_VERSION_ON_CREATION
|
|
||||||
value: 3
|
|
||||||
- name: GRIST_FORWARD_AUTH_HEADER
|
|
||||||
value: X-Forwarded-User
|
|
||||||
- name: GRIST_FORWARD_AUTH_LOGOUT_PATH
|
|
||||||
value: /_oauth/logout
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: grist
|
|
||||||
ports:
|
|
||||||
- containerPort: 8484
|
|
|
@ -1,29 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: grist
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: grist
|
|
||||||
ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 8484
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: grist
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: "grist.0x76.dev"
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: grist
|
|
||||||
port:
|
|
||||||
number: 8484
|
|
|
@ -1,7 +0,0 @@
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- external-secret.yaml
|
|
||||||
- pvc.yaml
|
|
||||||
- grist.yaml
|
|
||||||
- ingress.yaml
|
|
|
@ -1,12 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: grist
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
storageClassName: local-path
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 2Gi
|
|
|
@ -2,4 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
kind: Kustomization
|
kind: Kustomization
|
||||||
resources:
|
resources:
|
||||||
- renovate
|
- renovate
|
||||||
- oauth2-proxy
|
|
||||||
|
|
|
@ -1,25 +0,0 @@
|
||||||
apiVersion: external-secrets.io/v1beta1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: oauth2-proxy
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
refreshInterval: "5m"
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: oauth2-proxy
|
|
||||||
data:
|
|
||||||
- secretKey: OAUTH2_PROXY_CLIENT_ID
|
|
||||||
remoteRef:
|
|
||||||
key: services/oauth2-proxy
|
|
||||||
property: client_id
|
|
||||||
- secretKey: OAUTH2_PROXY_CLIENT_SECRET
|
|
||||||
remoteRef:
|
|
||||||
key: services/oauth2-proxy
|
|
||||||
property: client_secret
|
|
||||||
- secretKey: OAUTH2_PROXY_COOKIE_SECRET
|
|
||||||
remoteRef:
|
|
||||||
key: services/oauth2-proxy
|
|
||||||
property: cookie_secret
|
|
|
@ -1,5 +0,0 @@
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- external-secret.yaml
|
|
||||||
- oauth2-proxy.yaml
|
|
|
@ -1,67 +0,0 @@
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: oauth2-proxy
|
|
||||||
name: oauth2-proxy
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: oauth2-proxy
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: oauth2-proxy
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
- --provider=oidc
|
|
||||||
- --provider-display2-name="Dex"
|
|
||||||
- --oidc-issuer-url=https://dex.0x76.dev/dex
|
|
||||||
- --redirect-url=https://o2p.0x76.dev/oauth2/callback
|
|
||||||
- --cookie-secure=false
|
|
||||||
- --http-address=0.0.0.0:4180
|
|
||||||
image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: oauth2-proxy
|
|
||||||
name: oauth2-proxy
|
|
||||||
ports:
|
|
||||||
- containerPort: 4180
|
|
||||||
protocol: TCP
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: oauth2-proxy
|
|
||||||
name: oauth2-proxy
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
port: 4180
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 4180
|
|
||||||
selector:
|
|
||||||
k8s-app: oauth2-proxy
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: oauth2-proxy
|
|
||||||
namespace: services
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: "o2p.0x76.dev"
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: oauth2-proxy
|
|
||||||
port:
|
|
||||||
number: 4180
|
|
|
@ -19,7 +19,7 @@ spec:
|
||||||
emptyDir: {}
|
emptyDir: {}
|
||||||
containers:
|
containers:
|
||||||
- name: renovate
|
- name: renovate
|
||||||
image: renovate/renovate:37.51.3
|
image: renovate/renovate:37.59.8
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: config-volume
|
- name: config-volume
|
||||||
mountPath: /opt/renovate/
|
mountPath: /opt/renovate/
|
||||||
|
|
|
@ -5,8 +5,7 @@ let
|
||||||
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
|
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
|
||||||
};
|
};
|
||||||
my-python-packages = ps: with ps; [ pandas requests numpy ];
|
my-python-packages = ps: with ps; [ pandas requests numpy ];
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
(python3.withPackages my-python-packages)
|
(python3.withPackages my-python-packages)
|
||||||
btop
|
btop
|
||||||
|
@ -35,7 +34,6 @@ in
|
||||||
plexamp
|
plexamp
|
||||||
spotify
|
spotify
|
||||||
qmk
|
qmk
|
||||||
rustup
|
|
||||||
solo2-cli
|
solo2-cli
|
||||||
tex
|
tex
|
||||||
unzip
|
unzip
|
||||||
|
@ -45,8 +43,11 @@ in
|
||||||
# Enable my own hm modules
|
# Enable my own hm modules
|
||||||
themes.v.catppuccin.enable = true;
|
themes.v.catppuccin.enable = true;
|
||||||
programs = {
|
programs = {
|
||||||
v.vscode.enable = true;
|
v = {
|
||||||
v.nvim.enable = true;
|
vscode.enable = true;
|
||||||
|
nvim.enable = true;
|
||||||
|
rust.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
riff = {
|
riff = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -72,16 +73,13 @@ in
|
||||||
|
|
||||||
thunderbird = {
|
thunderbird = {
|
||||||
enable = true;
|
enable = true;
|
||||||
profiles.default = {
|
profiles.default = { isDefault = true; };
|
||||||
isDefault = true;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# Syncthing
|
# Syncthing
|
||||||
services.syncthing.enable = true;
|
services.syncthing.enable = true;
|
||||||
xdg.userDirs =
|
xdg.userDirs = let home = config.home.homeDirectory;
|
||||||
let home = config.home.homeDirectory;
|
|
||||||
in {
|
in {
|
||||||
enable = true;
|
enable = true;
|
||||||
createDirectories = true;
|
createDirectories = true;
|
||||||
|
|
|
@ -1,3 +1,3 @@
|
||||||
{ ... }: {
|
{ ... }: {
|
||||||
imports = [ ./catppuccin.nix ./nvim.nix ./riff.nix ./vscode.nix ./git.nix ];
|
imports = [ ./catppuccin.nix ./nvim.nix ./riff.nix ./vscode.nix ./git.nix ./rust.nix ];
|
||||||
}
|
}
|
||||||
|
|
|
@ -7,7 +7,7 @@ in {
|
||||||
programs.git = {
|
programs.git = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.gitAndTools.gitFull;
|
package = pkgs.gitAndTools.gitFull;
|
||||||
userName = "Victor";
|
userName = "0x76";
|
||||||
userEmail = "victor@xirion.net";
|
userEmail = "victor@xirion.net";
|
||||||
lfs.enable = true;
|
lfs.enable = true;
|
||||||
extraConfig = {
|
extraConfig = {
|
||||||
|
|
23
nixos/common/hm-modules/rust.nix
Normal file
23
nixos/common/hm-modules/rust.nix
Normal file
|
@ -0,0 +1,23 @@
|
||||||
|
{ pkgs, lib, config, ... }:
|
||||||
|
with lib;
|
||||||
|
let cfg = config.programs.v.rust;
|
||||||
|
in {
|
||||||
|
options.programs.v.rust = { enable = mkEnableOption "rust"; };
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home = {
|
||||||
|
packages = with pkgs; [ rustup ];
|
||||||
|
|
||||||
|
file = {
|
||||||
|
".cargo/config.toml".text = ''
|
||||||
|
[registries.crates-io]
|
||||||
|
protocol = "sparse"
|
||||||
|
|
||||||
|
[build]
|
||||||
|
rustc-wrapper = "${pkgs.sccache}/bin/sccache"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
sessionPath = [ "$HOME/.cargo/bin" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -5,6 +5,7 @@ in {
|
||||||
|
|
||||||
vault-secrets.secrets.lidarr = {
|
vault-secrets.secrets.lidarr = {
|
||||||
quoteEnvironmentValues = false; # Needed for docker
|
quoteEnvironmentValues = false; # Needed for docker
|
||||||
|
services = [ "podman-lidarr" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
virtualisation.oci-containers.containers.lidarr = {
|
virtualisation.oci-containers.containers.lidarr = {
|
||||||
|
|
|
@ -5,7 +5,7 @@ _: {
|
||||||
};
|
};
|
||||||
|
|
||||||
virtualisation.oci-containers.containers.flaresolverr = {
|
virtualisation.oci-containers.containers.flaresolverr = {
|
||||||
image = "flaresolverr/flaresolverr:v3.3.7";
|
image = "flaresolverr/flaresolverr:v3.3.9";
|
||||||
ports = [ "8191:8191" ];
|
ports = [ "8191:8191" ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -53,7 +53,6 @@
|
||||||
exposes = {
|
exposes = {
|
||||||
www.domain = "0x76.dev";
|
www.domain = "0x76.dev";
|
||||||
flux.domain = "flux.0x76.dev";
|
flux.domain = "flux.0x76.dev";
|
||||||
o2p.domain = "o2p.0x76.dev";
|
|
||||||
internal.domain = "internal.xirion.net";
|
internal.domain = "internal.xirion.net";
|
||||||
blog.domain = "blog.xirion.net";
|
blog.domain = "blog.xirion.net";
|
||||||
};
|
};
|
||||||
|
@ -61,10 +60,16 @@
|
||||||
"dex" = {
|
"dex" = {
|
||||||
ip = "10.42.42.11";
|
ip = "10.42.42.11";
|
||||||
mac = "AE:66:7B:FA:15:72";
|
mac = "AE:66:7B:FA:15:72";
|
||||||
exposes.dex = {
|
exposes = {
|
||||||
|
dex = {
|
||||||
domain = "dex.0x76.dev";
|
domain = "dex.0x76.dev";
|
||||||
port = 5556;
|
port = 5556;
|
||||||
};
|
};
|
||||||
|
o2p_proxy = {
|
||||||
|
domain = "o2p.0x76.dev";
|
||||||
|
port = 8484;
|
||||||
|
};
|
||||||
|
};
|
||||||
};
|
};
|
||||||
"WoolooTV" = {
|
"WoolooTV" = {
|
||||||
ip = "10.42.42.13";
|
ip = "10.42.42.13";
|
||||||
|
@ -151,7 +156,14 @@
|
||||||
ip = "10.42.42.25";
|
ip = "10.42.42.25";
|
||||||
mac = "1E:ED:97:2C:C3:9D";
|
mac = "1E:ED:97:2C:C3:9D";
|
||||||
};
|
};
|
||||||
# 10.42.42.26
|
"grist" = {
|
||||||
|
ip = "10.42.42.26";
|
||||||
|
mac = "B2:AA:AB:5D:2F:22";
|
||||||
|
exposes.grist = {
|
||||||
|
domain = "grist.0x76.dev";
|
||||||
|
port = 8484;
|
||||||
|
};
|
||||||
|
};
|
||||||
"bookwyrm" = {
|
"bookwyrm" = {
|
||||||
ip = "10.42.42.27";
|
ip = "10.42.42.27";
|
||||||
mac = "9E:8A:6C:39:27:DE";
|
mac = "9E:8A:6C:39:27:DE";
|
||||||
|
|
|
@ -9,8 +9,7 @@ let
|
||||||
db_name = "dex";
|
db_name = "dex";
|
||||||
inherit (config.meta.exposes.dex) port;
|
inherit (config.meta.exposes.dex) port;
|
||||||
metricsPort = 5558;
|
metricsPort = 5558;
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
imports = [ ];
|
imports = [ ];
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
|
@ -23,7 +22,12 @@ in
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ port metricsPort ];
|
networking.firewall.allowedTCPPorts = [ port metricsPort ];
|
||||||
|
|
||||||
services.postgresql = {
|
vault-secrets.secrets.dex = { };
|
||||||
|
vault-secrets.secrets.oauth2_proxy = { };
|
||||||
|
|
||||||
|
services = {
|
||||||
|
|
||||||
|
postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.postgresql_15;
|
package = pkgs.postgresql_15;
|
||||||
ensureDatabases = [ db_name ];
|
ensureDatabases = [ db_name ];
|
||||||
|
@ -36,9 +40,7 @@ in
|
||||||
}];
|
}];
|
||||||
};
|
};
|
||||||
|
|
||||||
vault-secrets.secrets.dex = { };
|
dex = {
|
||||||
|
|
||||||
services.dex = {
|
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
issuer = "https://dex.0x76.dev";
|
issuer = "https://dex.0x76.dev";
|
||||||
|
@ -52,7 +54,6 @@ in
|
||||||
};
|
};
|
||||||
web.http = "0.0.0.0:${toString port}";
|
web.http = "0.0.0.0:${toString port}";
|
||||||
telemetry.http = "0.0.0.0:${toString metricsPort}";
|
telemetry.http = "0.0.0.0:${toString metricsPort}";
|
||||||
|
|
||||||
connectors = [{
|
connectors = [{
|
||||||
type = "gitea";
|
type = "gitea";
|
||||||
id = "gitea";
|
id = "gitea";
|
||||||
|
@ -91,23 +92,15 @@ in
|
||||||
secretEnv = "FLUX_CLIENT_SECRET";
|
secretEnv = "FLUX_CLIENT_SECRET";
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
id = "oauth2-proxy";
|
id = "grist";
|
||||||
name = "OAuth2 Proxy";
|
name = "grist";
|
||||||
redirectURIs = [ "https://o2p.0x76.dev/oauth2/callback" ];
|
redirectURIs = [ "https://grist.0x76.dev/oauth2/callback" ];
|
||||||
secretEnv = "O2P_CLIENT_SECRET";
|
secretEnv = "GRIST_CLIENT_SECRET";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
environmentFile = "${vs.dex}/environment";
|
environmentFile = "${vs.dex}/environment";
|
||||||
};
|
};
|
||||||
|
|
||||||
services.oauth2_proxy = {
|
|
||||||
enable = false;
|
|
||||||
provider = "oidc";
|
|
||||||
redirectURL = "https://o2p.0x76.dev/oauth2/callback";
|
|
||||||
cookie.secure = false;
|
|
||||||
httpAddress = "0.0.0.0:4180";
|
|
||||||
keyFile = "";
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, config, ... }: {
|
{ pkgs, ... }: {
|
||||||
hardware = {
|
hardware = {
|
||||||
enableAllFirmware = true;
|
enableAllFirmware = true;
|
||||||
nvidia = {
|
nvidia = {
|
||||||
|
|
58
nixos/hosts/olympus/grist/configuration.nix
Normal file
58
nixos/hosts/olympus/grist/configuration.nix
Normal file
|
@ -0,0 +1,58 @@
|
||||||
|
# Edit this configuration file to define what should be installed on
|
||||||
|
# your system. Help is available in the configuration.nix(5) man page
|
||||||
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
let vs = config.vault-secrets.secrets;
|
||||||
|
in {
|
||||||
|
imports = [ ];
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.11"; # Did you read the comment?
|
||||||
|
networking.firewall.allowedTCPPorts = [ 8484 ];
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [ sqlite ];
|
||||||
|
virtualisation = {
|
||||||
|
|
||||||
|
podman.enable = true;
|
||||||
|
oci-containers.backend = "podman";
|
||||||
|
|
||||||
|
oci-containers.containers.grist = {
|
||||||
|
image =
|
||||||
|
"gristlabs/grist:latest"; # Switch to versioned release as soon as OIDC hits stable
|
||||||
|
environment = {
|
||||||
|
APP_HOME_URL = "https://grist.0x76.dev";
|
||||||
|
GRIST_SUPPORT_ANON = "false";
|
||||||
|
GRIST_FORCE_LOGIN = "true";
|
||||||
|
GRIST_SINGLE_ORG = "xirion";
|
||||||
|
GRIST_ORG_IN_PATH = "false";
|
||||||
|
GRIST_DEFAULT_EMAIL = "v@0x76.dev"; # Defines admin user
|
||||||
|
GRIST_HIDE_UI_ELEMENTS =
|
||||||
|
"helpCenter,billing,templates,multiSite,multiAccounts";
|
||||||
|
GRIST_TELEMETRY_LEVEL = "off";
|
||||||
|
GRIST_WIDGET_LIST_URL =
|
||||||
|
"https://github.com/gristlabs/grist-widget/releases/download/latest/manifest.json";
|
||||||
|
|
||||||
|
# No Python 2
|
||||||
|
PYTHON_VERSION = "3";
|
||||||
|
PYTHON_VERSION_ON_CREATION = "3";
|
||||||
|
|
||||||
|
# Beta OIDC support
|
||||||
|
GRIST_OIDC_IDP_ISSUER = "https://dex.0x76.dev";
|
||||||
|
};
|
||||||
|
environmentFiles = [ "${vs.grist}/environment" ];
|
||||||
|
ports = [ "8484:8484" ];
|
||||||
|
volumes = [ "/var/lib/grist:/persist" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
vault-secrets.secrets.grist = {
|
||||||
|
quoteEnvironmentValues = false; # Needed for docker
|
||||||
|
services = [ "podman-grist" ];
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue