diff --git a/.sops.yaml b/.sops.yaml index 0251fcc..f283a56 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -6,9 +6,10 @@ keys: - &minime age1chq5k0t38882rtyljez8cwmvtcstu4tafzvveuhjrujvsqk72f9s9guc06 # microvms - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c + - &forgejo age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh + - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c creation_rules: - path_regex: hosts/toaster/[^/]+\.yaml$ key_groups: @@ -52,3 +53,9 @@ creation_rules: - *admin_oxa age: - *miniflux + - path_regex: hosts/forgejo/[^/]+\.yaml$ + key_groups: + - pgp: + - *admin_oxa + age: + - *forgejo diff --git a/flake.nix b/flake.nix index 541db86..e7ae1b4 100644 --- a/flake.nix +++ b/flake.nix @@ -64,6 +64,7 @@ let microvm-list = [ "auth" + "forgejo" "immich" "miniflux" "radicale" diff --git a/hosts/cloud/networking.nix b/hosts/cloud/networking.nix index 71af8e1..3c5c08d 100644 --- a/hosts/cloud/networking.nix +++ b/hosts/cloud/networking.nix @@ -19,7 +19,9 @@ networkConfig = { Address = [ "188.245.196.27/32" + "116.202.5.66/32" "2a01:4f8:c17:7f8a::1/64" + "2a01:4f8:c17:7f8a::617/64" ]; DNS = [ "2a01:4ff:ff00::add:1" diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 42430b1..d092b02 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -6,6 +6,7 @@ in imports = [ ./auth.nix ./dav.nix + ./git.nix ./immich.nix ./news.nix ]; @@ -51,8 +52,7 @@ in # Prevent injection of code in other mime types (XSS Attacks) add_header X-Content-Type-Options nosniff; ''; - # default vhost - + virtualHosts."oxapentane.com" = { forceSSL = true; enableACME = true; diff --git a/hosts/cloud/proxy/git.nix b/hosts/cloud/proxy/git.nix new file mode 100644 index 0000000..ac53f4c --- /dev/null +++ b/hosts/cloud/proxy/git.nix @@ -0,0 +1,68 @@ +{ ... }: +{ + # ssh config for forgejo + # need ip forward for nat + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + }; + + networking.firewall = { + # open port explicitly + allowedTCPPorts = [ 22 ]; + # git.oxapentane.com: port forward 22 to forgejo + # TODO do a proper thing with ipv6 + extraCommands = '' + iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 + iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE + ''; + extraStopCommands = '' + iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true + ''; + }; + # host sshd: only listen on oxapentane.com and mgmt vpn + services.openssh.listenAddresses = + map + (a: { + addr = a; + port = 22; + }) + [ + # enp1s0 + "188.245.196.27" + "2a01:4f8:c17:7f8a::1" + # wg-0xa-mgmt + "10.89.87.1" + "fd31:185d:722e::1" + ]; + + services.nginx.upstreams.forgejo = { + servers = { + "10.89.88.15:3000" = { }; + "[fd31:185d:722f::15]:3000" = { }; + }; + }; + + services.nginx.virtualHosts."git.oxapentane.com" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://forgejo"; + extraConfig = '' + client_max_body_size 50000M; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + }; + }; +} diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix new file mode 100644 index 0000000..02211e5 --- /dev/null +++ b/hosts/forgejo/default.nix @@ -0,0 +1,77 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:05"; +in +{ + imports = [ + ./forgejo.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "qemu"; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-forgejo"; + mac = mac; + } + ]; + shares = + [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.15/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "forgejo"; + system.stateVersion = "24.11"; +} diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix new file mode 100644 index 0000000..965354f --- /dev/null +++ b/hosts/forgejo/forgejo.nix @@ -0,0 +1,70 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + services.forgejo = { + enable = true; + package = pkgs.forgejo; + useWizard = false; + database = { + type = "postgres"; + createDatabase = true; + }; + lfs.enable = true; + settings = { + DEFAULT.APP_NAME = "0xa's compilable shitposts"; + actions.ENABLED = false; + database.LOG_SQL = false; + indexer.REPO_INDEXER_ENABLED = true; + mailer.ENABLED = false; + packages.ENABLED = false; + session.COOKIE_SECURE = true; + server = { + DOMAIN = "git.oxapentane.com"; + SSH_DOMAIN = "git.oxapentane.com"; + ROOT_URL = "https://git.oxapentane.com/"; + PROTOCOL = "http"; + START_SSH_SERVER = true; + BUILTIN_SSH_SERVER_USER = "git"; + SSH_LISTEN_PORT = 2222; + }; + repository = { + DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; + ENABLE_PUSH_CREATE_USER = true; + }; + service = { + REGISTER_EMAIL_CONFIRM = false; + DISABLE_REGISTRATION = true; + }; + oauth2_client = { + ENABLE_AUTO_REGISTRATION = true; + USERNAME = "nickname"; + ACCOUNT_LINKING = "login"; + }; + }; + }; + + # expose forgejo cli + environment.systemPackages = + let + cfg = config.services.forgejo; + forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' + #!${pkgs.runtimeShell} + cd ${cfg.stateDir} + sudo=exec + if [[ "$USER" != forgejo ]]; then + sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' + fi + # Note that these variable names will change + export GITEA_WORK_DIR=${cfg.stateDir} + export GITEA_CUSTOM=${cfg.customDir} + $sudo ${lib.getExe cfg.package} "$@" + ''; + in + [ + forgejo-cli + ]; +} diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml new file mode 100644 index 0000000..1bcf0a0 --- /dev/null +++ b/hosts/forgejo/secrets.yaml @@ -0,0 +1,42 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV0ttcmFIeWtCdTFuS0Y1 + ZzZHdUJmZ3ZlaUx3d0x5NGVaLzhXZjdtZHk4CkprNUZ5VThydVJ2dTBCdE5OQS8z + c0VtY1Vmd2N3bThEdDBFZWMxUC83RXMKLS0tIFluRjRrNG1Qam9MSjVvUWJjbHdq + VVRSM2JuOHpTYXRmOVRRSUN0NzlZeDQKcZ6ym4DTJqZjRpAUcWBcYXR/nVYZzhLx + vhtZzCmaQc2qYSVtDZE51N3cTqPWJD+l/cr8zp2lo0GCfNWO6BQthg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-02-03T18:25:04Z" + mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] + pgp: + - created_at: "2025-02-03T18:24:33Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ//fcUVRBuEFENKNck1l2/QVMIRwfZzxJO5fMy/r0GQzKiR + Nl9X4z0HGcxlCwfiUImif1UtQdMWs1RCXQ7HtFK8kKyNgIb07y5306TI/dmkhbP7 + nWD0EstGEgbSiVGiFRlT/gy4FIVyKhBPxJqfT/dbAuRZb7NXsl8Rv1fsnZZFcJMu + MKO1S3DivJUS/YVXteoRf3T5DLobSpO7/5ok5LUXuuSpYKk20hUxFdJqhv1hsljZ + kjckGJ2L0OlxVz16nmg8Z1QI0jDfN6dLl/X+di3U2VACDQDMF+K9LCPLfAm295Y5 + TAtPSv/yE5os9crJ+MCVKHbEI11Khe3mfdRWvVboVZP6jXoD4ZTe/ccXLZCN8pgE + KdSZWs/L2Ps66KYuxujk/c8khmmrmLpPk0qJo9zW0mAf9TSC8UPnMYAxbroeijIe + PVYOJS2AzySnRtXQY4MBPLqzlQ0tKf8HxaCBpZ6eCMsX0/9IDjJJOhCMuMavL+oJ + DnNQQwtSDXAtXcgvwIccEMzawjyPMS5QBx0hYuH8t0rSJtCYutk2op6yKb1vWmOq + 5EDksdNevT3QzGesjtPErh6s3hu3YUAM2k2h4MqXVCbFdchA//FBIHequPul+UMm + JMLsPLAk2FmtWAiOuXxdCPtoY7Jnd8Ziqiemhd961WTiWrCtsv7NSn7x4PIMeLfS + XgFpMQ+15G4NNCDpgJWGUUXc1H+OKj3XepY5EoONnhusT/gJAtxT9vnuJ+T9LDTt + a0Ye2g3jxugeupJ58vbZUifHy/B0OtSeXKkRHZuycCJd3bzxzNxpXLJ23ds40JA= + =/5W1 + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix index f149049..a94f7e2 100644 --- a/modules/wg/proxy.nix +++ b/modules/wg/proxy.nix @@ -55,6 +55,14 @@ publicKey = "2Lvjzg8k5EIR0Y5mlsCHOs1cJl1+1SL0QMxkKUmliE0="; privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; }; + "forgejo" = { + address = [ + "10.89.88.15/24" + "fd31:185d:722f::15/48" + ]; + publicKey = "pXiOmI3aspl2IvdvLXLddxw76QYMRTACNm42nq+L4D0="; + privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; + }; }; } ];