ajust settings

.sops.yaml

@@ -6,9 +6,10 @@ keys:
   - &minime age1chq5k0t38882rtyljez8cwmvtcstu4tafzvveuhjrujvsqk72f9s9guc06
   # microvms
   - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
-  - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c
+  - &forgejo age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt
   - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
   - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
+  - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c
 creation_rules:
   - path_regex: hosts/toaster/[^/]+\.yaml$
     key_groups:
@@ -52,3 +53,9 @@ creation_rules:
         - *admin_oxa
         age:
         - *miniflux
+  - path_regex: hosts/forgejo/[^/]+\.yaml$
+    key_groups:
+      - pgp:
+        - *admin_oxa
+        age:
+        - *forgejo

flake.nix

@@ -60,116 +60,96 @@
     }:
 
     {
-      nixosConfigurations = {
-        toaster = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            lanzaboote.nixosModules.lanzaboote
-            nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3
-            lix-module.nixosModules.default
-
-            ./hosts/toaster
-
-            ./modules/basic-tools
-            ./modules/binary-caches.nix
-            ./modules/devtools.nix
-            ./modules/gnome.nix
-            ./modules/gnupg.nix
-            ./modules/radio.nix
-            ./modules/science.nix
-            ./modules/tlp.nix
-            ./modules/virtualization.nix
-            ./hosts/toaster/secure-boot.nix
-            ./modules/chromium.nix
-            ./modules/mail
-            ./modules/wg
+      nixosConfigurations =
+        let
+          microvm-list = [
+            "auth"
+            "forgejo"
+            "immich"
+            "miniflux"
+            "radicale"
           ];
+
+          microvms = builtins.listToAttrs (
+            map (vm: {
+              name = vm;
+              value = nixpkgs.lib.nixosSystem {
+                system = "x86_64-linux";
+                specialArgs = { inherit inputs; };
+                modules = [
+                  sops-nix.nixosModules.sops
+                  microvm.nixosModules.microvm
+
+                  ./hosts/${vm}
+                  ./modules/server
+                  ./modules/wg
+                ];
+              };
+            }) microvm-list
+          );
+        in
+        microvms
+        // {
+          toaster = nixpkgs.lib.nixosSystem {
+            system = "x86_64-linux";
+            specialArgs = { inherit inputs; };
+            modules = [
+              sops-nix.nixosModules.sops
+              lanzaboote.nixosModules.lanzaboote
+              nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3
+              lix-module.nixosModules.default
+
+              ./hosts/toaster
+
+              ./modules/basic-tools
+              ./modules/binary-caches.nix
+              ./modules/devtools.nix
+              ./modules/gnome.nix
+              ./modules/gnupg.nix
+              ./modules/radio.nix
+              ./modules/science.nix
+              ./modules/tlp.nix
+              ./modules/virtualization.nix
+              ./hosts/toaster/secure-boot.nix
+              ./modules/chromium.nix
+              ./modules/mail
+              ./modules/wg
+            ];
+          };
+          cloud = nixpkgs.lib.nixosSystem {
+            system = "x86_64-linux";
+            specialArgs = { inherit inputs; };
+            modules = [
+              sops-nix.nixosModules.sops
+              lix-module.nixosModules.default
+
+              ./hosts/cloud
+
+              ./modules/basic-tools
+              ./modules/server
+              ./modules/binary-caches.nix
+              ./modules/wg
+            ];
+          };
+          minime = nixpkgs.lib.nixosSystem {
+            system = "x86_64-linux";
+            specialArgs = { inherit inputs; };
+            modules = [
+              sops-nix.nixosModules.sops
+              microvm.nixosModules.host
+              lix-module.nixosModules.default
+
+              ./hosts/minime
+              ./modules/basic-tools
+              ./modules/server
+              ./modules/binary-caches.nix
+              ./modules/wg
+
+              {
+                config.microvm.autostart = microvm-list;
+              }
+            ];
+          };
         };
-        cloud = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            lix-module.nixosModules.default
-
-            ./hosts/cloud
-
-            ./modules/basic-tools
-            ./modules/server
-            ./modules/binary-caches.nix
-            ./modules/wg
-          ];
-        };
-        minime = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            microvm.nixosModules.host
-            lix-module.nixosModules.default
-
-            ./hosts/minime
-            ./modules/basic-tools
-            ./modules/server
-            ./modules/binary-caches.nix
-            ./modules/wg
-          ];
-        };
-
-        auth = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            microvm.nixosModules.microvm
-            authentik-nix.nixosModules.default
-
-            ./hosts/auth
-            ./modules/server
-            ./modules/wg
-          ];
-        };
-
-        immich = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            microvm.nixosModules.microvm
-
-            ./hosts/immich
-            ./modules/server
-            ./modules/wg
-          ];
-        };
-
-        miniflux = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            microvm.nixosModules.microvm
-
-            ./hosts/miniflux
-            ./modules/server
-            ./modules/wg
-          ];
-        };
-
-        radicale = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = { inherit inputs; };
-          modules = [
-            sops-nix.nixosModules.sops
-            microvm.nixosModules.microvm
-
-            ./hosts/radicale
-            ./modules/server
-            ./modules/wg
-          ];
-        };
-      };
     };
 }

hosts/auth/authentik.nix

@@ -1,5 +1,8 @@
-{ config, ... }:
+{ config, inputs, ... }:
 {
+  imports = [
+    inputs.authentik-nix.nixosModules.default
+  ];
   sops.secrets."authentik/env" = { };
   services.authentik = {
     enable = true;

hosts/cloud/networking.nix

@@ -19,7 +19,9 @@
       networkConfig = {
         Address = [
           "188.245.196.27/32"
+          "116.202.5.66/32"
           "2a01:4f8:c17:7f8a::1/64"
+          "2a01:4f8:c17:7f8a::617/64"
         ];
         DNS = [
           "2a01:4ff:ff00::add:1"

hosts/cloud/proxy/default.nix

@@ -6,6 +6,7 @@ in
   imports = [
     ./auth.nix
     ./dav.nix
+    ./git.nix
     ./immich.nix
     ./news.nix
   ];
@@ -51,8 +52,7 @@ in
       # Prevent injection of code in other mime types (XSS Attacks)
       add_header X-Content-Type-Options nosniff;
     '';
-    # default vhost
- 
+
     virtualHosts."oxapentane.com" = {
       forceSSL = true;
       enableACME = true;

hosts/cloud/proxy/git.nix

@@ -0,0 +1,65 @@
+{ ... }:
+{
+  # ssh config for forgejo
+  # need ip forward for nat
+  boot.kernel.sysctl = { "net.ipv4.ip_forward" = 1; };
+
+  networking.firewall = {
+    # open port explicitly
+    allowedTCPPorts = [ 22 ];
+    # git.oxapentane.com: port forward 22 to forgejo
+    # TODO do a proper thing with ipv6
+    extraCommands = ''
+      iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222
+      iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE
+    '';
+    extraStopCommands = ''
+      iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true
+    '';
+  };
+  # host sshd: only listen on oxapentane.com and mgmt vpn
+  services.openssh.listenAddresses = map (a :
+  {
+    addr = a;
+    port = 22;
+  }) [
+    # enp1s0
+    "188.245.196.27"
+    "2a01:4f8:c17:7f8a::1"
+    # wg-0xa-mgmt
+    "10.89.87.1"
+    "fd31:185d:722e::1"
+  ];
+
+
+  services.nginx.upstreams.forgejo = {
+    servers = {
+      "10.89.88.15:3000" = { };
+      "[fd31:185d:722f::15]:3000" = { };
+    };
+  };
+
+  services.nginx.virtualHosts."git.oxapentane.com" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://forgejo";
+      extraConfig = ''
+        client_max_body_size 50000M;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+        send_timeout 600s;
+      '';
+    };
+  };
+}

hosts/forgejo/default.nix

@@ -0,0 +1,77 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:05";
+in
+{
+  imports = [
+    ./forgejo.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "qemu";
+    mem = 3 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-forgejo";
+        mac = mac;
+      }
+    ];
+    shares =
+      [
+        {
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "store";
+          proto = "virtiofs";
+          socket = "store.socket";
+        }
+      ]
+      ++ map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.15/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "forgejo";
+  system.stateVersion = "24.11";
+}

hosts/forgejo/forgejo.nix

@@ -0,0 +1,63 @@
+{ config, pkgs, lib, ... }:
+{
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+    useWizard = false;
+    database = {
+      type = "postgres";
+      createDatabase = true;
+    };
+    lfs.enable = true;
+    settings = {
+      DEFAULT.APP_NAME = "0xa's compilable shitposts";
+      actions.ENABLED = false;
+      database.LOG_SQL = false;
+      indexer.REPO_INDEXER_ENABLED = true;
+      mailer.ENABLED = false;
+      packages.ENABLED = false;
+      session.COOKIE_SECURE = true;
+      server = {
+        DOMAIN = "git.oxapentane.com";
+        SSH_DOMAIN = "git.oxapentane.com";
+        ROOT_URL = "https://git.oxapentane.com/";
+        PROTOCOL = "http";
+        START_SSH_SERVER = true;
+        BUILTIN_SSH_SERVER_USER = "git";
+        SSH_LISTEN_PORT = 2222;
+      };
+      repository = {
+        DEFAULT_REPO_UNITS="repo.code,repo.releases,repo.issues,repo.pulls";
+        ENABLE_PUSH_CREATE_USER=true;
+      };
+      service = {
+        REGISTER_EMAIL_CONFIRM = false;
+        DISABLE_REGISTRATION = true;
+      };
+      oauth2_client = {
+        ENABLE_AUTO_REGISTRATION = true;
+        USERNAME = "nickname";
+        ACCOUNT_LINKING = "login";
+      };
+    };
+  };
+
+  # expose forgejo cli
+  environment.systemPackages = let
+    cfg = config.services.forgejo;
+    forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
+      #!${pkgs.runtimeShell}
+      cd ${cfg.stateDir}
+      sudo=exec
+      if [[ "$USER" != forgejo ]]; then
+        sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
+      fi
+      # Note that these variable names will change
+      export GITEA_WORK_DIR=${cfg.stateDir}
+      export GITEA_CUSTOM=${cfg.customDir}
+      $sudo ${lib.getExe cfg.package} "$@"
+  ''; in [
+    forgejo-cli
+  ];
+}
+

hosts/forgejo/secrets.yaml

@@ -0,0 +1,42 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV0ttcmFIeWtCdTFuS0Y1
+            ZzZHdUJmZ3ZlaUx3d0x5NGVaLzhXZjdtZHk4CkprNUZ5VThydVJ2dTBCdE5OQS8z
+            c0VtY1Vmd2N3bThEdDBFZWMxUC83RXMKLS0tIFluRjRrNG1Qam9MSjVvUWJjbHdq
+            VVRSM2JuOHpTYXRmOVRRSUN0NzlZeDQKcZ6ym4DTJqZjRpAUcWBcYXR/nVYZzhLx
+            vhtZzCmaQc2qYSVtDZE51N3cTqPWJD+l/cr8zp2lo0GCfNWO6BQthg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-03T18:25:04Z"
+    mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str]
+    pgp:
+        - created_at: "2025-02-03T18:24:33Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ//fcUVRBuEFENKNck1l2/QVMIRwfZzxJO5fMy/r0GQzKiR
+            Nl9X4z0HGcxlCwfiUImif1UtQdMWs1RCXQ7HtFK8kKyNgIb07y5306TI/dmkhbP7
+            nWD0EstGEgbSiVGiFRlT/gy4FIVyKhBPxJqfT/dbAuRZb7NXsl8Rv1fsnZZFcJMu
+            MKO1S3DivJUS/YVXteoRf3T5DLobSpO7/5ok5LUXuuSpYKk20hUxFdJqhv1hsljZ
+            kjckGJ2L0OlxVz16nmg8Z1QI0jDfN6dLl/X+di3U2VACDQDMF+K9LCPLfAm295Y5
+            TAtPSv/yE5os9crJ+MCVKHbEI11Khe3mfdRWvVboVZP6jXoD4ZTe/ccXLZCN8pgE
+            KdSZWs/L2Ps66KYuxujk/c8khmmrmLpPk0qJo9zW0mAf9TSC8UPnMYAxbroeijIe
+            PVYOJS2AzySnRtXQY4MBPLqzlQ0tKf8HxaCBpZ6eCMsX0/9IDjJJOhCMuMavL+oJ
+            DnNQQwtSDXAtXcgvwIccEMzawjyPMS5QBx0hYuH8t0rSJtCYutk2op6yKb1vWmOq
+            5EDksdNevT3QzGesjtPErh6s3hu3YUAM2k2h4MqXVCbFdchA//FBIHequPul+UMm
+            JMLsPLAk2FmtWAiOuXxdCPtoY7Jnd8Ziqiemhd961WTiWrCtsv7NSn7x4PIMeLfS
+            XgFpMQ+15G4NNCDpgJWGUUXc1H+OKj3XepY5EoONnhusT/gJAtxT9vnuJ+T9LDTt
+            a0Ye2g3jxugeupJ58vbZUifHy/B0OtSeXKkRHZuycCJd3bzxzNxpXLJ23ds40JA=
+            =/5W1
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

hosts/minime/uvm.nix

@@ -1,24 +0,0 @@
-{ inputs, ... }:
-{
-  microvm.stateDir = "/var/lib/microvms";
-  microvm.autostart = [
-    "auth"
-    "radicale"
-    "immich"
-    "miniflux"
-  ];
-  microvm.vms = {
-    auth = {
-      flake = inputs.self;
-      updateFlake = "github:gshipunov/nix-config/master";
-    };
-    radicale = {
-      flake = inputs.self;
-      updateFlake = "github:gshipunov/nix-config/master";
-    };
-    immich = {
-      flake = inputs.self;
-      updateFlake = "github:gshipunov/nix-config/master";
-    };
-  };
-}

modules/wg/proxy.nix

@@ -55,6 +55,14 @@
           publicKey = "2Lvjzg8k5EIR0Y5mlsCHOs1cJl1+1SL0QMxkKUmliE0=";
           privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
         };
+        "forgejo" = {
+          address = [
+            "10.89.88.15/24"
+            "fd31:185d:722f::15/48"
+          ];
+          publicKey = "pXiOmI3aspl2IvdvLXLddxw76QYMRTACNm42nq+L4D0=";
+          privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
+        };
       };
     }
   ];