From 8f21c5834283ddeb5cc9336bb7f2e2d8a7dbeaae Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sat, 1 Feb 2025 19:08:23 +0100 Subject: [PATCH 01/10] bump lock --- flake.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 03abfe4..5ffa27e 100644 --- a/flake.lock +++ b/flake.lock @@ -385,11 +385,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1737751639, - "narHash": "sha256-ZEbOJ9iT72iwqXsiEMbEa8wWjyFvRA9Ugx8utmYbpz4=", + "lastModified": 1738391520, + "narHash": "sha256-6HI58PKjddsC0RA0gBQlt6ox47oH//jLUHwx05RO8g0=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "dfad538f751a5aa5d4436d9781ab27a6128ec9d4", + "rev": "34b64e4e1ddb14e3ffc7db8d4a781396dbbab773", "type": "github" }, "original": { @@ -401,11 +401,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1738163270, - "narHash": "sha256-B/7Y1v4y+msFFBW1JAdFjNvVthvNdJKiN6EGRPnqfno=", + "lastModified": 1738277201, + "narHash": "sha256-6L+WXKCw5mqnUIExvqkD99pJQ41xgyCk6z/H9snClwk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "59e618d90c065f55ae48446f307e8c09565d5ab0", + "rev": "666e1b3f09c267afd66addebe80fb05a5ef2b554", "type": "github" }, "original": { From 50d6b096b8e052bed98203ba8a1d4f106feb4897 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sat, 1 Feb 2025 19:13:41 +0100 Subject: [PATCH 02/10] software changes --- modules/desktop-software.nix | 3 ++- modules/science.nix | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/desktop-software.nix b/modules/desktop-software.nix index 9bf944f..4a161f6 100644 --- a/modules/desktop-software.nix +++ b/modules/desktop-software.nix @@ -10,12 +10,13 @@ kicad signal-desktop tdesktop - tor-browser-bundle-bin + tor-browser wl-clipboard yt-dlp element-desktop discord spotify + mpv ]; programs.steam.enable = true; } diff --git a/modules/science.nix b/modules/science.nix index f937945..421f12e 100644 --- a/modules/science.nix +++ b/modules/science.nix @@ -4,5 +4,6 @@ gnuplot zotero paraview + numbat ]; } From 8bd48341e56007d9144cd4f24fe4b058f15ac348 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sun, 2 Feb 2025 15:38:12 +0100 Subject: [PATCH 03/10] software changes --- modules/chromium.nix | 6 +++--- modules/desktop-software.nix | 2 ++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/modules/chromium.nix b/modules/chromium.nix index 270a52b..30d6faf 100644 --- a/modules/chromium.nix +++ b/modules/chromium.nix @@ -10,16 +10,16 @@ programs.chromium = { enable = true; extensions = [ - "pkehgijcmpdhfbdbbnkijodmdjhbjlgp" # privacy badger + # "pkehgijcmpdhfbdbbnkijodmdjhbjlgp" # privacy badger "ekhagklcjbdpajgpjgmbionohlpdbjgc" # zotero connector "nngceckbapebfimnlniiiahkandclblb" # bitwarden # "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin - "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite + # "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite "mnjggcdmjocbbbhaepdhchncahnbgone" # sponsorblock ]; extraOpts = { "BrowserSignin" = 0; - "SyncDisabled" = true; + # "SyncDisabled" = true; "PasswordManagerEnabled" = false; "TranslateEnabled" = false; "AutofillAddressEnabled" = false; diff --git a/modules/desktop-software.nix b/modules/desktop-software.nix index 4a161f6..054ae37 100644 --- a/modules/desktop-software.nix +++ b/modules/desktop-software.nix @@ -5,6 +5,8 @@ dino ffmpeg-full firefox-wayland + vivaldi + vivaldi-ffmpeg-codecs gimp inkscape kicad From e9ea354f513eeac76dbcc30ea2688fadef0b5013 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sun, 2 Feb 2025 15:38:41 +0100 Subject: [PATCH 04/10] bump lock --- flake.lock | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index 5ffa27e..6093dcd 100644 --- a/flake.lock +++ b/flake.lock @@ -14,11 +14,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1738262370, - "narHash": "sha256-d58ioZQgJMmRfp7KIQKIy5G8uio7nCQPP+YsLEbxIgg=", + "lastModified": 1738503522, + "narHash": "sha256-1yrVbGLBMBPl34EibVARkUB9Gak1GjLRLZXJk9jbHxU=", "owner": "nix-community", "repo": "authentik-nix", - "rev": "e87750273754e7ee9249785ffc7151510e1d64c7", + "rev": "bc62d5509989f5dca633c65b58aa0ac79a48db3e", "type": "github" }, "original": { @@ -385,11 +385,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1738391520, - "narHash": "sha256-6HI58PKjddsC0RA0gBQlt6ox47oH//jLUHwx05RO8g0=", + "lastModified": 1738471961, + "narHash": "sha256-cgXDFrplNGs7bCVzXhRofjD8oJYqqXGcmUzXjHmip6Y=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "34b64e4e1ddb14e3ffc7db8d4a781396dbbab773", + "rev": "537286c3c59b40311e5418a180b38034661d2536", "type": "github" }, "original": { @@ -401,11 +401,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1738277201, - "narHash": "sha256-6L+WXKCw5mqnUIExvqkD99pJQ41xgyCk6z/H9snClwk=", + "lastModified": 1738435198, + "narHash": "sha256-5+Hmo4nbqw8FrW85FlNm4IIrRnZ7bn0cmXlScNsNRLo=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "666e1b3f09c267afd66addebe80fb05a5ef2b554", + "rev": "f6687779bf4c396250831aa5a32cbfeb85bb07a3", "type": "github" }, "original": { @@ -445,11 +445,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1738142207, - "narHash": "sha256-NGqpVVxNAHwIicXpgaVqJEJWeyqzoQJ9oc8lnK9+WC4=", + "lastModified": 1738410390, + "narHash": "sha256-xvTo0Aw0+veek7hvEVLzErmJyQkEcRk6PSR4zsRQFEc=", "owner": "nixos", "repo": "nixpkgs", - "rev": "9d3ae807ebd2981d593cddd0080856873139aa40", + "rev": "3a228057f5b619feb3186e986dbe76278d707b6e", "type": "github" }, "original": { From 8086efe6ec04e5e1e5909501001db8defff746f3 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sun, 2 Feb 2025 20:50:39 +0100 Subject: [PATCH 05/10] add landing page --- flake.lock | 27 ++++++++++++++++++++++++++- flake.nix | 6 ++++++ hosts/cloud/proxy/default.nix | 18 +++++++++++++++--- 3 files changed, 47 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 6093dcd..e85d055 100644 --- a/flake.lock +++ b/flake.lock @@ -528,7 +528,8 @@ "nixpkgs": "nixpkgs", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix", - "tmux-yank": "tmux-yank" + "tmux-yank": "tmux-yank", + "website": "website" } }, "rust-overlay": { @@ -689,6 +690,30 @@ "repo": "treefmt-nix", "type": "github" } + }, + "website": { + "inputs": { + "flake-utils": [ + "flake-utils" + ], + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1738525735, + "narHash": "sha256-aeNSiEkIE0n95q5V8HkxeNL4pZ7NojnH/eIoaP5h74Y=", + "ref": "main", + "rev": "25e2c1c97065ed33df66873e0899d110f3ead9e7", + "revCount": 3, + "type": "git", + "url": "https://codeberg.org/0xa/website.git" + }, + "original": { + "ref": "main", + "type": "git", + "url": "https://codeberg.org/0xa/website.git" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 8c112fa..1070488 100644 --- a/flake.nix +++ b/flake.nix @@ -35,6 +35,12 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + website = { + url = "git+https://codeberg.org/0xa/website.git?ref=main"; + inputs.nixpkgs.follows = "nixpkgs"; + inputs.flake-utils.follows = "flake-utils"; + }; + tmux-yank = { url = "github:tmux-plugins/tmux-yank"; flake = false; diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index c225ce3..42430b1 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -1,4 +1,7 @@ -{ ... }: +{ inputs, ... }: +let + website = inputs.website.packages."x86_64-linux".default; +in { imports = [ ./auth.nix @@ -49,12 +52,21 @@ add_header X-Content-Type-Options nosniff; ''; # default vhost + virtualHosts."oxapentane.com" = { forceSSL = true; enableACME = true; - # default = true; + default = true; locations."/" = { - return = "503"; + root = "${website}"; + index = "index.html"; + }; + }; + virtualHosts."www.oxapentane.com" = { + forceSSL = true; + enableACME = true; + locations."/" = { + return = "302 https://oxapentane.com"; }; }; }; From 3eaa328ca7027a353f12b7a39fff28268f923083 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sun, 2 Feb 2025 21:01:01 +0100 Subject: [PATCH 06/10] update website --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index e85d055..0f21b43 100644 --- a/flake.lock +++ b/flake.lock @@ -701,11 +701,11 @@ ] }, "locked": { - "lastModified": 1738525735, - "narHash": "sha256-aeNSiEkIE0n95q5V8HkxeNL4pZ7NojnH/eIoaP5h74Y=", + "lastModified": 1738526440, + "narHash": "sha256-pveA7FOO6Y4pTnVIyx3xLUHUpq9JW9FqEj8E0t+YIjQ=", "ref": "main", - "rev": "25e2c1c97065ed33df66873e0899d110f3ead9e7", - "revCount": 3, + "rev": "b1c65c444b21d1c8ddbefcfa339ac7861358d323", + "revCount": 4, "type": "git", "url": "https://codeberg.org/0xa/website.git" }, From 6e1af4849c593c1dd0bd1c849d0fe85f7b1fc455 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Tue, 4 Feb 2025 21:50:28 +0100 Subject: [PATCH 07/10] bump lock --- flake.lock | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/flake.lock b/flake.lock index 0f21b43..7a14c69 100644 --- a/flake.lock +++ b/flake.lock @@ -385,11 +385,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1738471961, - "narHash": "sha256-cgXDFrplNGs7bCVzXhRofjD8oJYqqXGcmUzXjHmip6Y=", + "lastModified": 1738638143, + "narHash": "sha256-ZYMe4c4OCtIUBn5hx15PEGr0+B1cNEpl2dsaLxwY2W0=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "537286c3c59b40311e5418a180b38034661d2536", + "rev": "9bdd53f5908453e4d03f395eb1615c3e9a351f70", "type": "github" }, "original": { @@ -401,11 +401,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1738435198, - "narHash": "sha256-5+Hmo4nbqw8FrW85FlNm4IIrRnZ7bn0cmXlScNsNRLo=", + "lastModified": 1738574474, + "narHash": "sha256-rvyfF49e/k6vkrRTV4ILrWd92W+nmBDfRYZgctOyolQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f6687779bf4c396250831aa5a32cbfeb85bb07a3", + "rev": "fecfeb86328381268e29e998ddd3ebc70bbd7f7c", "type": "github" }, "original": { @@ -445,11 +445,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1738410390, - "narHash": "sha256-xvTo0Aw0+veek7hvEVLzErmJyQkEcRk6PSR4zsRQFEc=", + "lastModified": 1738546358, + "narHash": "sha256-nLivjIygCiqLp5QcL7l56Tca/elVqM9FG1hGd9ZSsrg=", "owner": "nixos", "repo": "nixpkgs", - "rev": "3a228057f5b619feb3186e986dbe76278d707b6e", + "rev": "c6e957d81b96751a3d5967a0fd73694f303cc914", "type": "github" }, "original": { @@ -701,11 +701,11 @@ ] }, "locked": { - "lastModified": 1738526440, - "narHash": "sha256-pveA7FOO6Y4pTnVIyx3xLUHUpq9JW9FqEj8E0t+YIjQ=", + "lastModified": 1738536830, + "narHash": "sha256-3QbNcI9qJ0tKv00w0r2Amqf9pylHVolcTyEi30WZxY8=", "ref": "main", - "rev": "b1c65c444b21d1c8ddbefcfa339ac7861358d323", - "revCount": 4, + "rev": "6fd169aab3ce461fef6a1a4dcbb2ef643e12d9e6", + "revCount": 5, "type": "git", "url": "https://codeberg.org/0xa/website.git" }, From 9842b2df1aaee81591f50904e89ababb6677e0e3 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Tue, 4 Feb 2025 21:59:05 +0100 Subject: [PATCH 08/10] wifi sleep seems to work again --- modules/tlp.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/tlp.nix b/modules/tlp.nix index 0265110..5606ab2 100644 --- a/modules/tlp.nix +++ b/modules/tlp.nix @@ -9,7 +9,6 @@ USB_BLACKLIST = "1d50:604b 1d50:6089 1d50:cc15 1fc9:000c"; CPU_SCALING_GOVERNOR_ON_AC = "performance"; CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; - WIFI_PWR_ON_BAT = "off"; }; }; } From 9ebfe0c59b6503b4b29744ad7b63c3e4addcc84b Mon Sep 17 00:00:00 2001 From: Grigory Shipunov Date: Sun, 2 Feb 2025 23:18:19 +0000 Subject: [PATCH 09/10] less microvm boilerplate --- flake.nix | 197 +++++++++++++++++---------------------- hosts/auth/authentik.nix | 5 +- hosts/minime/uvm.nix | 24 ----- 3 files changed, 92 insertions(+), 134 deletions(-) delete mode 100644 hosts/minime/uvm.nix diff --git a/flake.nix b/flake.nix index 1070488..541db86 100644 --- a/flake.nix +++ b/flake.nix @@ -60,116 +60,95 @@ }: { - nixosConfigurations = { - toaster = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - lanzaboote.nixosModules.lanzaboote - nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 - lix-module.nixosModules.default - - ./hosts/toaster - - ./modules/basic-tools - ./modules/binary-caches.nix - ./modules/devtools.nix - ./modules/gnome.nix - ./modules/gnupg.nix - ./modules/radio.nix - ./modules/science.nix - ./modules/tlp.nix - ./modules/virtualization.nix - ./hosts/toaster/secure-boot.nix - ./modules/chromium.nix - ./modules/mail - ./modules/wg + nixosConfigurations = + let + microvm-list = [ + "auth" + "immich" + "miniflux" + "radicale" ]; + + microvms = builtins.listToAttrs ( + map (vm: { + name = vm; + value = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + + ./hosts/${vm} + ./modules/server + ./modules/wg + ]; + }; + }) microvm-list + ); + in + microvms + // { + toaster = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lanzaboote.nixosModules.lanzaboote + nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 + lix-module.nixosModules.default + + ./hosts/toaster + + ./modules/basic-tools + ./modules/binary-caches.nix + ./modules/devtools.nix + ./modules/gnome.nix + ./modules/gnupg.nix + ./modules/radio.nix + ./modules/science.nix + ./modules/tlp.nix + ./modules/virtualization.nix + ./hosts/toaster/secure-boot.nix + ./modules/chromium.nix + ./modules/mail + ./modules/wg + ]; + }; + cloud = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lix-module.nixosModules.default + + ./hosts/cloud + + ./modules/basic-tools + ./modules/server + ./modules/binary-caches.nix + ./modules/wg + ]; + }; + minime = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.host + lix-module.nixosModules.default + + ./hosts/minime + ./modules/basic-tools + ./modules/server + ./modules/binary-caches.nix + ./modules/wg + + { + config.microvm.autostart = microvm-list; + } + ]; + }; }; - cloud = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - lix-module.nixosModules.default - - ./hosts/cloud - - ./modules/basic-tools - ./modules/server - ./modules/binary-caches.nix - ./modules/wg - ]; - }; - minime = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.host - lix-module.nixosModules.default - - ./hosts/minime - ./modules/basic-tools - ./modules/server - ./modules/binary-caches.nix - ./modules/wg - ]; - }; - - auth = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - authentik-nix.nixosModules.default - - ./hosts/auth - ./modules/server - ./modules/wg - ]; - }; - - immich = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/immich - ./modules/server - ./modules/wg - ]; - }; - - miniflux = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/miniflux - ./modules/server - ./modules/wg - ]; - }; - - radicale = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/radicale - ./modules/server - ./modules/wg - ]; - }; - }; }; } diff --git a/hosts/auth/authentik.nix b/hosts/auth/authentik.nix index f60f269..023e2db 100644 --- a/hosts/auth/authentik.nix +++ b/hosts/auth/authentik.nix @@ -1,5 +1,8 @@ -{ config, ... }: +{ config, inputs, ... }: { + imports = [ + inputs.authentik-nix.nixosModules.default + ]; sops.secrets."authentik/env" = { }; services.authentik = { enable = true; diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix deleted file mode 100644 index 93f2253..0000000 --- a/hosts/minime/uvm.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ inputs, ... }: -{ - microvm.stateDir = "/var/lib/microvms"; - microvm.autostart = [ - "auth" - "radicale" - "immich" - "miniflux" - ]; - microvm.vms = { - auth = { - flake = inputs.self; - updateFlake = "github:gshipunov/nix-config/master"; - }; - radicale = { - flake = inputs.self; - updateFlake = "github:gshipunov/nix-config/master"; - }; - immich = { - flake = inputs.self; - updateFlake = "github:gshipunov/nix-config/master"; - }; - }; -} From 20ac636eb8e5bfebc104d7a3653faa2a852fa3fd Mon Sep 17 00:00:00 2001 From: Grigory Shipunov Date: Mon, 3 Feb 2025 17:12:11 +0000 Subject: [PATCH 10/10] add forgejo microvm --- .sops.yaml | 9 +++- flake.nix | 1 + hosts/cloud/networking.nix | 2 + hosts/cloud/proxy/default.nix | 4 +- hosts/cloud/proxy/git.nix | 68 +++++++++++++++++++++++++++++++ hosts/forgejo/default.nix | 77 +++++++++++++++++++++++++++++++++++ hosts/forgejo/forgejo.nix | 70 +++++++++++++++++++++++++++++++ hosts/forgejo/secrets.yaml | 42 +++++++++++++++++++ modules/wg/proxy.nix | 8 ++++ 9 files changed, 278 insertions(+), 3 deletions(-) create mode 100644 hosts/cloud/proxy/git.nix create mode 100644 hosts/forgejo/default.nix create mode 100644 hosts/forgejo/forgejo.nix create mode 100644 hosts/forgejo/secrets.yaml diff --git a/.sops.yaml b/.sops.yaml index 0251fcc..f283a56 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -6,9 +6,10 @@ keys: - &minime age1chq5k0t38882rtyljez8cwmvtcstu4tafzvveuhjrujvsqk72f9s9guc06 # microvms - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c + - &forgejo age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh + - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c creation_rules: - path_regex: hosts/toaster/[^/]+\.yaml$ key_groups: @@ -52,3 +53,9 @@ creation_rules: - *admin_oxa age: - *miniflux + - path_regex: hosts/forgejo/[^/]+\.yaml$ + key_groups: + - pgp: + - *admin_oxa + age: + - *forgejo diff --git a/flake.nix b/flake.nix index 541db86..e7ae1b4 100644 --- a/flake.nix +++ b/flake.nix @@ -64,6 +64,7 @@ let microvm-list = [ "auth" + "forgejo" "immich" "miniflux" "radicale" diff --git a/hosts/cloud/networking.nix b/hosts/cloud/networking.nix index 71af8e1..3c5c08d 100644 --- a/hosts/cloud/networking.nix +++ b/hosts/cloud/networking.nix @@ -19,7 +19,9 @@ networkConfig = { Address = [ "188.245.196.27/32" + "116.202.5.66/32" "2a01:4f8:c17:7f8a::1/64" + "2a01:4f8:c17:7f8a::617/64" ]; DNS = [ "2a01:4ff:ff00::add:1" diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 42430b1..d092b02 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -6,6 +6,7 @@ in imports = [ ./auth.nix ./dav.nix + ./git.nix ./immich.nix ./news.nix ]; @@ -51,8 +52,7 @@ in # Prevent injection of code in other mime types (XSS Attacks) add_header X-Content-Type-Options nosniff; ''; - # default vhost - + virtualHosts."oxapentane.com" = { forceSSL = true; enableACME = true; diff --git a/hosts/cloud/proxy/git.nix b/hosts/cloud/proxy/git.nix new file mode 100644 index 0000000..ac53f4c --- /dev/null +++ b/hosts/cloud/proxy/git.nix @@ -0,0 +1,68 @@ +{ ... }: +{ + # ssh config for forgejo + # need ip forward for nat + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + }; + + networking.firewall = { + # open port explicitly + allowedTCPPorts = [ 22 ]; + # git.oxapentane.com: port forward 22 to forgejo + # TODO do a proper thing with ipv6 + extraCommands = '' + iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 + iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE + ''; + extraStopCommands = '' + iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true + ''; + }; + # host sshd: only listen on oxapentane.com and mgmt vpn + services.openssh.listenAddresses = + map + (a: { + addr = a; + port = 22; + }) + [ + # enp1s0 + "188.245.196.27" + "2a01:4f8:c17:7f8a::1" + # wg-0xa-mgmt + "10.89.87.1" + "fd31:185d:722e::1" + ]; + + services.nginx.upstreams.forgejo = { + servers = { + "10.89.88.15:3000" = { }; + "[fd31:185d:722f::15]:3000" = { }; + }; + }; + + services.nginx.virtualHosts."git.oxapentane.com" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://forgejo"; + extraConfig = '' + client_max_body_size 50000M; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + }; + }; +} diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix new file mode 100644 index 0000000..02211e5 --- /dev/null +++ b/hosts/forgejo/default.nix @@ -0,0 +1,77 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:05"; +in +{ + imports = [ + ./forgejo.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "qemu"; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-forgejo"; + mac = mac; + } + ]; + shares = + [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.15/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "forgejo"; + system.stateVersion = "24.11"; +} diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix new file mode 100644 index 0000000..965354f --- /dev/null +++ b/hosts/forgejo/forgejo.nix @@ -0,0 +1,70 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + services.forgejo = { + enable = true; + package = pkgs.forgejo; + useWizard = false; + database = { + type = "postgres"; + createDatabase = true; + }; + lfs.enable = true; + settings = { + DEFAULT.APP_NAME = "0xa's compilable shitposts"; + actions.ENABLED = false; + database.LOG_SQL = false; + indexer.REPO_INDEXER_ENABLED = true; + mailer.ENABLED = false; + packages.ENABLED = false; + session.COOKIE_SECURE = true; + server = { + DOMAIN = "git.oxapentane.com"; + SSH_DOMAIN = "git.oxapentane.com"; + ROOT_URL = "https://git.oxapentane.com/"; + PROTOCOL = "http"; + START_SSH_SERVER = true; + BUILTIN_SSH_SERVER_USER = "git"; + SSH_LISTEN_PORT = 2222; + }; + repository = { + DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; + ENABLE_PUSH_CREATE_USER = true; + }; + service = { + REGISTER_EMAIL_CONFIRM = false; + DISABLE_REGISTRATION = true; + }; + oauth2_client = { + ENABLE_AUTO_REGISTRATION = true; + USERNAME = "nickname"; + ACCOUNT_LINKING = "login"; + }; + }; + }; + + # expose forgejo cli + environment.systemPackages = + let + cfg = config.services.forgejo; + forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' + #!${pkgs.runtimeShell} + cd ${cfg.stateDir} + sudo=exec + if [[ "$USER" != forgejo ]]; then + sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' + fi + # Note that these variable names will change + export GITEA_WORK_DIR=${cfg.stateDir} + export GITEA_CUSTOM=${cfg.customDir} + $sudo ${lib.getExe cfg.package} "$@" + ''; + in + [ + forgejo-cli + ]; +} diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml new file mode 100644 index 0000000..1bcf0a0 --- /dev/null +++ b/hosts/forgejo/secrets.yaml @@ -0,0 +1,42 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV0ttcmFIeWtCdTFuS0Y1 + ZzZHdUJmZ3ZlaUx3d0x5NGVaLzhXZjdtZHk4CkprNUZ5VThydVJ2dTBCdE5OQS8z + c0VtY1Vmd2N3bThEdDBFZWMxUC83RXMKLS0tIFluRjRrNG1Qam9MSjVvUWJjbHdq + VVRSM2JuOHpTYXRmOVRRSUN0NzlZeDQKcZ6ym4DTJqZjRpAUcWBcYXR/nVYZzhLx + vhtZzCmaQc2qYSVtDZE51N3cTqPWJD+l/cr8zp2lo0GCfNWO6BQthg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-02-03T18:25:04Z" + mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] + pgp: + - created_at: "2025-02-03T18:24:33Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ//fcUVRBuEFENKNck1l2/QVMIRwfZzxJO5fMy/r0GQzKiR + Nl9X4z0HGcxlCwfiUImif1UtQdMWs1RCXQ7HtFK8kKyNgIb07y5306TI/dmkhbP7 + nWD0EstGEgbSiVGiFRlT/gy4FIVyKhBPxJqfT/dbAuRZb7NXsl8Rv1fsnZZFcJMu + MKO1S3DivJUS/YVXteoRf3T5DLobSpO7/5ok5LUXuuSpYKk20hUxFdJqhv1hsljZ + kjckGJ2L0OlxVz16nmg8Z1QI0jDfN6dLl/X+di3U2VACDQDMF+K9LCPLfAm295Y5 + TAtPSv/yE5os9crJ+MCVKHbEI11Khe3mfdRWvVboVZP6jXoD4ZTe/ccXLZCN8pgE + KdSZWs/L2Ps66KYuxujk/c8khmmrmLpPk0qJo9zW0mAf9TSC8UPnMYAxbroeijIe + PVYOJS2AzySnRtXQY4MBPLqzlQ0tKf8HxaCBpZ6eCMsX0/9IDjJJOhCMuMavL+oJ + DnNQQwtSDXAtXcgvwIccEMzawjyPMS5QBx0hYuH8t0rSJtCYutk2op6yKb1vWmOq + 5EDksdNevT3QzGesjtPErh6s3hu3YUAM2k2h4MqXVCbFdchA//FBIHequPul+UMm + JMLsPLAk2FmtWAiOuXxdCPtoY7Jnd8Ziqiemhd961WTiWrCtsv7NSn7x4PIMeLfS + XgFpMQ+15G4NNCDpgJWGUUXc1H+OKj3XepY5EoONnhusT/gJAtxT9vnuJ+T9LDTt + a0Ye2g3jxugeupJ58vbZUifHy/B0OtSeXKkRHZuycCJd3bzxzNxpXLJ23ds40JA= + =/5W1 + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix index f149049..a94f7e2 100644 --- a/modules/wg/proxy.nix +++ b/modules/wg/proxy.nix @@ -55,6 +55,14 @@ publicKey = "2Lvjzg8k5EIR0Y5mlsCHOs1cJl1+1SL0QMxkKUmliE0="; privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; }; + "forgejo" = { + address = [ + "10.89.88.15/24" + "fd31:185d:722f::15/48" + ]; + publicKey = "pXiOmI3aspl2IvdvLXLddxw76QYMRTACNm42nq+L4D0="; + privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; + }; }; } ];