0xa/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

delete legacy stuff and reformat

Browse source
This commit is contained in:
Grisha Shipunov 2025-01-11 03:55:19 +01:00
parent 595d4935de
commit 62e2519639
51 changed files with 714 additions and 1056 deletions
Download patch file Download diff file Expand all files Collapse all files

1
microvms/dn42/default.nix
View file

@ -1 +0,0 @@
{ config, pkgs, lib, ... }: { }

40
microvms/music/default.nix
View file

@ -1,40 +0,0 @@
{ pkgs, lib, config, ... }: {
imports = [
./navidrome.nix
./oxaproxy.nix
./upload-user.nix
];
microvm = {
hypervisor = "qemu";
mem = 4 * 1024;
vcpu = 3;
shares = [{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "store";
proto = "virtiofs";
socket = "store.socket";
}] ++ map
(dir: {
source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
mountPoint = "/${dir}";
tag = dir;
proto = "virtiofs";
socket = "${dir}.socket";
}) [ "etc" "var" "home" ];
interfaces = [{
type = "tap";
id = "vm-music";
mac = "02:00:00:00:00:01";
}];
};
networking = {
hostName = "music";
};
system.stateVersion = "22.11";
}

16
microvms/music/navidrome.nix
View file

@ -1,16 +0,0 @@
{ config, ... }: {
networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ 4533 ];
services.navidrome = {
enable = true;
settings = {
Address = "10.34.45.101";
BaseUrl = "/";
EnableExternalServices = false;
MusicFolder = "/var/lib/music";
Port = 4533;
ScanSchedule = "@every 11m";
TranscondigCacheSize = "5GiB";
ReverseProxyWhitelist = "10.34.45.1/24";
};
};
}

68
microvms/music/oxaproxy.nix
View file

@ -1,68 +0,0 @@
{ config, ... }: {
networking.wireguard.enable = true;
networking.useNetworkd = true;
#oxaproxy secret
sops.defaultSopsFile = ../../secrets/music/secrets.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets."wg/oxaproxy-seckey" = {
owner = config.users.users.systemd-network.name;
};
systemd.network = {
enable = true;
netdevs."10-oxaproxy" = {
netdevConfig = {
Kind = "wireguard";
Name = "oxaproxy";
Description = "oxa's enterprise reverse-proxy network";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
#own pubkey: vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=
};
wireguardPeers = [
{
# cirrus
wireguardPeerConfig = {
PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
AllowedIPs = [ "10.34.45.0/24" ];
Endpoint = [ "95.216.166.21:51821" ];
PersistentKeepalive = 25;
};
}
];
};
networks."10-oxaproxy" = {
matchConfig.Name = "oxaproxy";
networkConfig = {
Address = "10.34.45.101/24";
};
};
networks."111-host" = {
matchConfig.MACAddress = "02:00:00:00:00:01";
networkConfig = {
Address = "10.99.99.101/24";
};
routes = [
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "0.0.0.0/0";
Metric = 1024;
};
}
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "10.99.99.0/24";
Metric = 1024;
};
}
];
};
};
}

21
microvms/music/upload-user.nix
View file

@ -1,21 +0,0 @@
{ config, ... }: {
security.sudo.wheelNeedsPassword = false;
users.users.caretaker = {
isNormalUser = true;
home = "/home/caretaker";
createHome = true;
extraGroups = [
"wheel"
"navidrome"
];
openssh.authorizedKeys.keys = [
# melo
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMbUizElFyULDlpEE9XHWWOca4ZXepS18ljh4Fj4YnJOAs7sbYzzhfMUiD703FIgK5YObzOlheu/PBbwUOStgcmPDuRalZWLr+0kCUYERfjLHkgliFx96xEFw9dluvII6JpbzFI/uvkEkQ3ESKapRcYAuBTk2sRoit8za+HX9sLmMueqNtN4H92sFYYm1wWy3FFgz/NN+uTh7F5nmA7SrSS/fpbmugcgBdR/Zy1YwSA8Rl1pagEvgN9/qAnP7pssvXr9pTCUNxVSQ7FlTUOHmxzG16RybYRikgevQaHtFYvmS7AuRvRDlQWhHt1drREGOIwwZPXD1smfQAsvP66J85j9aeanZdoBoJcvvFNer3071QGmi+5NHDSiG+YvoWt7qgiKLF4lOfByzjdoRRSg01uuhdQLOHHt0hbfyGS6hx//1MtjiXTElXvOOiUJ6AqfCSwOTK+72W6VKhKYcO11+Ngym1dyF3TtVcoEYN3JpUdbNq+qctMzXFMGovPEEMh7s= mel@umbreon"
# revol-xut
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6NLB8EHnUgl2GO2uaojdf3p3YpsHH6px6CZleif8klhLN+ro5KeFK2OXC2SO3Vo4qgF/NySdsoInV9JEsssELZ2ttVbeKxI6f76V5dZgGI7qoSf4E0TXIgpS9n9K2AEmRKr65uC2jgkSJuo/T1mF+4/Nzyo706FT/GGVoiBktgq9umbYX0vIQkTMFAcw921NwFCWFQcMYRruaH01tLu6HIAdJ9FVG8MAt84hCr4D4PobD6b029bHXTzcixsguRtl+q4fQAl3WK3HAxT+txN91CDoP2eENo3gbmdTBprD2RcB/hz5iI6IaY3p1+8fTX2ehvI3loRA8Qjr/xzkzMUlpA/8NLKbJD4YxNGgFbauEmEnlC8Evq2vMrxdDr2SjnBAUwzZ63Nq+pUoBNYG/c+h+eO/s7bjnJVe0m2/2ZqPj1jWQp4hGoNzzU1cQmy6TdEWJcg2c8ints5068HN3o0gQKkp1EseNrdB8SuG+me/c/uIOX8dPASgo3Yjv9IGLhhx8GOGQxHEQN9QFC4QyZt/rrAyGmlX342PBNYmmStgVWHiYCcMVUWGlsG0XvG6bvGgmMeHNVsDf6WdMQuLj9luvxJzrd4FlKX6O0X/sIaqMVSkhIbD2+vvKNqrii7JdUTntUPs89L5h9DoDqQWkL13Plg1iQt4/VYeKTbUhYYz1lw== revo-xut@plank"
# 0xa gpg
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHv82n6F6kwJ3/EMYlOoCc1/NaYFW7QHC5F8jKVzdlio gshipunov@toaster"
];
};
}

39
microvms/news/default.nix
View file

@ -1,39 +0,0 @@
{ config, ... }: {
imports = [
./miniflux.nix
./oxaproxy.nix
];
microvm = {
hypervisor = "qemu";
mem = 1 * 1024;
vcpu = 1;
shares = [{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "store";
proto = "virtiofs";
socket = "store.socket";
}] ++ map
(dir: {
source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
mountPoint = "/${dir}";
tag = dir;
proto = "virtiofs";
socket = "${dir}.socket";
}) [ "etc" "var" "home" ];
interfaces = [{
type = "tap";
id = "vm-news";
mac = "02:00:00:00:00:02";
}];
};
networking = {
hostName = "news";
};
system.stateVersion = "22.11";
}

18
microvms/news/miniflux.nix
View file

@ -1,18 +0,0 @@
{ config, ... }:
let
listenport = 8080;
in
{
sops.secrets."miniflux-admin" = { };
networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ listenport ];
services.miniflux = {
enable = true;
config = {
LISTEN_ADDR = "10.34.45.102:${toString listenport}";
POLLING_FREQUENCY = "37";
CREATE_ADMIN = "1";
};
adminCredentialsFile = config.sops.secrets."miniflux-admin".path;
};
}

68
microvms/news/oxaproxy.nix
View file

@ -1,68 +0,0 @@
{ config, ... }: {
networking.wireguard.enable = true;
networking.useNetworkd = true;
#oxaproxy secret
sops.defaultSopsFile = ../../secrets/news/secrets.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets."oxaproxy-seckey" = {
owner = config.users.users.systemd-network.name;
};
systemd.network = {
enable = true;
netdevs."10-oxaproxy" = {
netdevConfig = {
Kind = "wireguard";
Name = "oxaproxy";
Description = "oxa's enterprise reverse-proxy network";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."oxaproxy-seckey".path;
#own pubkey: guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=
};
wireguardPeers = [
{
# cirrus
wireguardPeerConfig = {
PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
AllowedIPs = [ "10.34.45.0/24" ];
Endpoint = [ "95.216.166.21:51821" ];
PersistentKeepalive = 25;
};
}
];
};
networks."10-oxaproxy" = {
matchConfig.Name = "oxaproxy";
networkConfig = {
Address = "10.34.45.102/24";
};
};
networks."111-host" = {
matchConfig.MACAddress = (builtins.elemAt config.microvm.interfaces 0).mac;
networkConfig = {
Address = "10.99.99.102/24";
};
routes = [
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "0.0.0.0/0";
Metric = 1024;
};
}
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "10.99.99.0/24";
Metric = 1024;
};
}
];
};
};
}

115
microvms/nextcloud/default.nix
View file

@ -1,115 +0,0 @@
{ config, pkgs, ... }: {
imports = [
./oxaproxy.nix
./secrets.nix
];
# nextcloud goes here
networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ 8080 ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_14;
ensureDatabases = [ "nextcloud" ];
ensureUsers = [{
name = "nextcloud";
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
}];
};
services.redis.servers.nextcloud.enable = true;
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
virtualHosts."nc.oxapentane.com" = {
extraConfig = ''
# HTTP response headers borrowed from Nextcloud .htaccess
add_header Referrer-Policy "no-referrer" always;
#add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
#add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
'';
listen = [{
# We are listening on wireguard interface only
addr = "10.34.45.100";
port = 8080;
ssl = false;
}];
};
};
services.nextcloud = {
enable = true;
hostName = "nc.oxapentane.com";
home = "/var/lib/nextcloud-oxa";
package = pkgs.nextcloud28;
maxUploadSize = "5000M";
caching.redis = true;
autoUpdateApps = {
enable = true;
startAt = "07:00:00";
};
config = {
overwriteProtocol = "https";
trustedProxies = [ "10.34.45.1" ];
dbtype = "pgsql";
dbuser = "nextcloud";
dbhost = "/run/postgresql";
dbname = "nextcloud";
adminuser = "admin";
adminpassFile = config.sops.secrets."nextcloud/adminpass".path;
};
};
systemd.services."nextcloud-setup" = {
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
};
microvm = {
hypervisor = "qemu";
mem = 4 * 1024;
vcpu = 3;
shares = [{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "store";
proto = "virtiofs";
socket = "store.socket";
}] ++ map
(dir: {
source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
mountPoint = "/${dir}";
tag = dir;
proto = "virtiofs";
socket = "${dir}.socket";
}) [ "etc" "var" "home" ];
interfaces = [{
type = "tap";
id = "vm-nextcloud";
mac = "02:00:00:00:00:00";
}];
};
networking = {
hostName = "nextcloud";
};
system.stateVersion = "22.05";
}

58
microvms/nextcloud/oxaproxy.nix
View file

@ -1,58 +0,0 @@
{ config, ... }: {
networking.wireguard.enable = true;
networking.useNetworkd = true;
systemd.network = {
enable = true;
netdevs."10-oxaproxy" = {
netdevConfig = {
Kind = "wireguard";
Name = "oxaproxy";
Description = "oxa's enterprise reverse-proxy network";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
#own pubkey: KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=
};
wireguardPeers = [
{
# cirrus
wireguardPeerConfig = {
PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
AllowedIPs = [ "10.34.45.0/24" ];
Endpoint = [ "95.216.166.21:51821" ];
PersistentKeepalive = 25;
};
}
];
};
networks."10-oxaproxy" = {
matchConfig.Name = "oxaproxy";
networkConfig = {
Address = "10.34.45.100/24";
};
};
networks."111-host" = {
matchConfig.MACAddress = "02:00:00:00:00:00";
networkConfig = {
Address = "10.99.99.100/24";
};
routes = [
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "0.0.0.0/0";
Metric = 1024;
};
}
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "10.99.99.0/24";
Metric = 1024;
};
}
];
};
};
}

11
microvms/nextcloud/secrets.nix
View file

@ -1,11 +0,0 @@
{ config, ... }: {
sops.defaultSopsFile = ../../secrets/nextcloud/secrets.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets."wg/oxaproxy-seckey" = {
owner = config.users.users.systemd-network.name;
};
sops.secrets."nextcloud/adminpass" = {
owner = config.users.users.nextcloud.name;
};
}