diff --git a/.sops.yaml b/.sops.yaml index 0251fcc..f283a56 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -6,9 +6,10 @@ keys: - &minime age1chq5k0t38882rtyljez8cwmvtcstu4tafzvveuhjrujvsqk72f9s9guc06 # microvms - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c + - &forgejo age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh + - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c creation_rules: - path_regex: hosts/toaster/[^/]+\.yaml$ key_groups: @@ -52,3 +53,9 @@ creation_rules: - *admin_oxa age: - *miniflux + - path_regex: hosts/forgejo/[^/]+\.yaml$ + key_groups: + - pgp: + - *admin_oxa + age: + - *forgejo diff --git a/flake.lock b/flake.lock index 0f21b43..7a14c69 100644 --- a/flake.lock +++ b/flake.lock @@ -385,11 +385,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1738471961, - "narHash": "sha256-cgXDFrplNGs7bCVzXhRofjD8oJYqqXGcmUzXjHmip6Y=", + "lastModified": 1738638143, + "narHash": "sha256-ZYMe4c4OCtIUBn5hx15PEGr0+B1cNEpl2dsaLxwY2W0=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "537286c3c59b40311e5418a180b38034661d2536", + "rev": "9bdd53f5908453e4d03f395eb1615c3e9a351f70", "type": "github" }, "original": { @@ -401,11 +401,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1738435198, - "narHash": "sha256-5+Hmo4nbqw8FrW85FlNm4IIrRnZ7bn0cmXlScNsNRLo=", + "lastModified": 1738574474, + "narHash": "sha256-rvyfF49e/k6vkrRTV4ILrWd92W+nmBDfRYZgctOyolQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f6687779bf4c396250831aa5a32cbfeb85bb07a3", + "rev": "fecfeb86328381268e29e998ddd3ebc70bbd7f7c", "type": "github" }, "original": { @@ -445,11 +445,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1738410390, - "narHash": "sha256-xvTo0Aw0+veek7hvEVLzErmJyQkEcRk6PSR4zsRQFEc=", + "lastModified": 1738546358, + "narHash": "sha256-nLivjIygCiqLp5QcL7l56Tca/elVqM9FG1hGd9ZSsrg=", "owner": "nixos", "repo": "nixpkgs", - "rev": "3a228057f5b619feb3186e986dbe76278d707b6e", + "rev": "c6e957d81b96751a3d5967a0fd73694f303cc914", "type": "github" }, "original": { @@ -701,11 +701,11 @@ ] }, "locked": { - "lastModified": 1738526440, - "narHash": "sha256-pveA7FOO6Y4pTnVIyx3xLUHUpq9JW9FqEj8E0t+YIjQ=", + "lastModified": 1738536830, + "narHash": "sha256-3QbNcI9qJ0tKv00w0r2Amqf9pylHVolcTyEi30WZxY8=", "ref": "main", - "rev": "b1c65c444b21d1c8ddbefcfa339ac7861358d323", - "revCount": 4, + "rev": "6fd169aab3ce461fef6a1a4dcbb2ef643e12d9e6", + "revCount": 5, "type": "git", "url": "https://codeberg.org/0xa/website.git" }, diff --git a/flake.nix b/flake.nix index 1070488..e7ae1b4 100644 --- a/flake.nix +++ b/flake.nix @@ -60,116 +60,96 @@ }: { - nixosConfigurations = { - toaster = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - lanzaboote.nixosModules.lanzaboote - nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 - lix-module.nixosModules.default - - ./hosts/toaster - - ./modules/basic-tools - ./modules/binary-caches.nix - ./modules/devtools.nix - ./modules/gnome.nix - ./modules/gnupg.nix - ./modules/radio.nix - ./modules/science.nix - ./modules/tlp.nix - ./modules/virtualization.nix - ./hosts/toaster/secure-boot.nix - ./modules/chromium.nix - ./modules/mail - ./modules/wg + nixosConfigurations = + let + microvm-list = [ + "auth" + "forgejo" + "immich" + "miniflux" + "radicale" ]; + + microvms = builtins.listToAttrs ( + map (vm: { + name = vm; + value = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + + ./hosts/${vm} + ./modules/server + ./modules/wg + ]; + }; + }) microvm-list + ); + in + microvms + // { + toaster = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lanzaboote.nixosModules.lanzaboote + nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 + lix-module.nixosModules.default + + ./hosts/toaster + + ./modules/basic-tools + ./modules/binary-caches.nix + ./modules/devtools.nix + ./modules/gnome.nix + ./modules/gnupg.nix + ./modules/radio.nix + ./modules/science.nix + ./modules/tlp.nix + ./modules/virtualization.nix + ./hosts/toaster/secure-boot.nix + ./modules/chromium.nix + ./modules/mail + ./modules/wg + ]; + }; + cloud = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lix-module.nixosModules.default + + ./hosts/cloud + + ./modules/basic-tools + ./modules/server + ./modules/binary-caches.nix + ./modules/wg + ]; + }; + minime = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.host + lix-module.nixosModules.default + + ./hosts/minime + ./modules/basic-tools + ./modules/server + ./modules/binary-caches.nix + ./modules/wg + + { + config.microvm.autostart = microvm-list; + } + ]; + }; }; - cloud = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - lix-module.nixosModules.default - - ./hosts/cloud - - ./modules/basic-tools - ./modules/server - ./modules/binary-caches.nix - ./modules/wg - ]; - }; - minime = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.host - lix-module.nixosModules.default - - ./hosts/minime - ./modules/basic-tools - ./modules/server - ./modules/binary-caches.nix - ./modules/wg - ]; - }; - - auth = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - authentik-nix.nixosModules.default - - ./hosts/auth - ./modules/server - ./modules/wg - ]; - }; - - immich = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/immich - ./modules/server - ./modules/wg - ]; - }; - - miniflux = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/miniflux - ./modules/server - ./modules/wg - ]; - }; - - radicale = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/radicale - ./modules/server - ./modules/wg - ]; - }; - }; }; } diff --git a/hosts/auth/authentik.nix b/hosts/auth/authentik.nix index f60f269..023e2db 100644 --- a/hosts/auth/authentik.nix +++ b/hosts/auth/authentik.nix @@ -1,5 +1,8 @@ -{ config, ... }: +{ config, inputs, ... }: { + imports = [ + inputs.authentik-nix.nixosModules.default + ]; sops.secrets."authentik/env" = { }; services.authentik = { enable = true; diff --git a/hosts/cloud/networking.nix b/hosts/cloud/networking.nix index 71af8e1..3c5c08d 100644 --- a/hosts/cloud/networking.nix +++ b/hosts/cloud/networking.nix @@ -19,7 +19,9 @@ networkConfig = { Address = [ "188.245.196.27/32" + "116.202.5.66/32" "2a01:4f8:c17:7f8a::1/64" + "2a01:4f8:c17:7f8a::617/64" ]; DNS = [ "2a01:4ff:ff00::add:1" diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 42430b1..d092b02 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -6,6 +6,7 @@ in imports = [ ./auth.nix ./dav.nix + ./git.nix ./immich.nix ./news.nix ]; @@ -51,8 +52,7 @@ in # Prevent injection of code in other mime types (XSS Attacks) add_header X-Content-Type-Options nosniff; ''; - # default vhost - + virtualHosts."oxapentane.com" = { forceSSL = true; enableACME = true; diff --git a/hosts/cloud/proxy/git.nix b/hosts/cloud/proxy/git.nix new file mode 100644 index 0000000..ac53f4c --- /dev/null +++ b/hosts/cloud/proxy/git.nix @@ -0,0 +1,68 @@ +{ ... }: +{ + # ssh config for forgejo + # need ip forward for nat + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + }; + + networking.firewall = { + # open port explicitly + allowedTCPPorts = [ 22 ]; + # git.oxapentane.com: port forward 22 to forgejo + # TODO do a proper thing with ipv6 + extraCommands = '' + iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 + iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE + ''; + extraStopCommands = '' + iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true + ''; + }; + # host sshd: only listen on oxapentane.com and mgmt vpn + services.openssh.listenAddresses = + map + (a: { + addr = a; + port = 22; + }) + [ + # enp1s0 + "188.245.196.27" + "2a01:4f8:c17:7f8a::1" + # wg-0xa-mgmt + "10.89.87.1" + "fd31:185d:722e::1" + ]; + + services.nginx.upstreams.forgejo = { + servers = { + "10.89.88.15:3000" = { }; + "[fd31:185d:722f::15]:3000" = { }; + }; + }; + + services.nginx.virtualHosts."git.oxapentane.com" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://forgejo"; + extraConfig = '' + client_max_body_size 50000M; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + }; + }; +} diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix new file mode 100644 index 0000000..02211e5 --- /dev/null +++ b/hosts/forgejo/default.nix @@ -0,0 +1,77 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:05"; +in +{ + imports = [ + ./forgejo.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "qemu"; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-forgejo"; + mac = mac; + } + ]; + shares = + [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.15/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "forgejo"; + system.stateVersion = "24.11"; +} diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix new file mode 100644 index 0000000..965354f --- /dev/null +++ b/hosts/forgejo/forgejo.nix @@ -0,0 +1,70 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + services.forgejo = { + enable = true; + package = pkgs.forgejo; + useWizard = false; + database = { + type = "postgres"; + createDatabase = true; + }; + lfs.enable = true; + settings = { + DEFAULT.APP_NAME = "0xa's compilable shitposts"; + actions.ENABLED = false; + database.LOG_SQL = false; + indexer.REPO_INDEXER_ENABLED = true; + mailer.ENABLED = false; + packages.ENABLED = false; + session.COOKIE_SECURE = true; + server = { + DOMAIN = "git.oxapentane.com"; + SSH_DOMAIN = "git.oxapentane.com"; + ROOT_URL = "https://git.oxapentane.com/"; + PROTOCOL = "http"; + START_SSH_SERVER = true; + BUILTIN_SSH_SERVER_USER = "git"; + SSH_LISTEN_PORT = 2222; + }; + repository = { + DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; + ENABLE_PUSH_CREATE_USER = true; + }; + service = { + REGISTER_EMAIL_CONFIRM = false; + DISABLE_REGISTRATION = true; + }; + oauth2_client = { + ENABLE_AUTO_REGISTRATION = true; + USERNAME = "nickname"; + ACCOUNT_LINKING = "login"; + }; + }; + }; + + # expose forgejo cli + environment.systemPackages = + let + cfg = config.services.forgejo; + forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' + #!${pkgs.runtimeShell} + cd ${cfg.stateDir} + sudo=exec + if [[ "$USER" != forgejo ]]; then + sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' + fi + # Note that these variable names will change + export GITEA_WORK_DIR=${cfg.stateDir} + export GITEA_CUSTOM=${cfg.customDir} + $sudo ${lib.getExe cfg.package} "$@" + ''; + in + [ + forgejo-cli + ]; +} diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml new file mode 100644 index 0000000..1bcf0a0 --- /dev/null +++ b/hosts/forgejo/secrets.yaml @@ -0,0 +1,42 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV0ttcmFIeWtCdTFuS0Y1 + ZzZHdUJmZ3ZlaUx3d0x5NGVaLzhXZjdtZHk4CkprNUZ5VThydVJ2dTBCdE5OQS8z + c0VtY1Vmd2N3bThEdDBFZWMxUC83RXMKLS0tIFluRjRrNG1Qam9MSjVvUWJjbHdq + VVRSM2JuOHpTYXRmOVRRSUN0NzlZeDQKcZ6ym4DTJqZjRpAUcWBcYXR/nVYZzhLx + vhtZzCmaQc2qYSVtDZE51N3cTqPWJD+l/cr8zp2lo0GCfNWO6BQthg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-02-03T18:25:04Z" + mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] + pgp: + - created_at: "2025-02-03T18:24:33Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ//fcUVRBuEFENKNck1l2/QVMIRwfZzxJO5fMy/r0GQzKiR + Nl9X4z0HGcxlCwfiUImif1UtQdMWs1RCXQ7HtFK8kKyNgIb07y5306TI/dmkhbP7 + nWD0EstGEgbSiVGiFRlT/gy4FIVyKhBPxJqfT/dbAuRZb7NXsl8Rv1fsnZZFcJMu + MKO1S3DivJUS/YVXteoRf3T5DLobSpO7/5ok5LUXuuSpYKk20hUxFdJqhv1hsljZ + kjckGJ2L0OlxVz16nmg8Z1QI0jDfN6dLl/X+di3U2VACDQDMF+K9LCPLfAm295Y5 + TAtPSv/yE5os9crJ+MCVKHbEI11Khe3mfdRWvVboVZP6jXoD4ZTe/ccXLZCN8pgE + KdSZWs/L2Ps66KYuxujk/c8khmmrmLpPk0qJo9zW0mAf9TSC8UPnMYAxbroeijIe + PVYOJS2AzySnRtXQY4MBPLqzlQ0tKf8HxaCBpZ6eCMsX0/9IDjJJOhCMuMavL+oJ + DnNQQwtSDXAtXcgvwIccEMzawjyPMS5QBx0hYuH8t0rSJtCYutk2op6yKb1vWmOq + 5EDksdNevT3QzGesjtPErh6s3hu3YUAM2k2h4MqXVCbFdchA//FBIHequPul+UMm + JMLsPLAk2FmtWAiOuXxdCPtoY7Jnd8Ziqiemhd961WTiWrCtsv7NSn7x4PIMeLfS + XgFpMQ+15G4NNCDpgJWGUUXc1H+OKj3XepY5EoONnhusT/gJAtxT9vnuJ+T9LDTt + a0Ye2g3jxugeupJ58vbZUifHy/B0OtSeXKkRHZuycCJd3bzxzNxpXLJ23ds40JA= + =/5W1 + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix deleted file mode 100644 index 93f2253..0000000 --- a/hosts/minime/uvm.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ inputs, ... }: -{ - microvm.stateDir = "/var/lib/microvms"; - microvm.autostart = [ - "auth" - "radicale" - "immich" - "miniflux" - ]; - microvm.vms = { - auth = { - flake = inputs.self; - updateFlake = "github:gshipunov/nix-config/master"; - }; - radicale = { - flake = inputs.self; - updateFlake = "github:gshipunov/nix-config/master"; - }; - immich = { - flake = inputs.self; - updateFlake = "github:gshipunov/nix-config/master"; - }; - }; -} diff --git a/modules/tlp.nix b/modules/tlp.nix index 0265110..5606ab2 100644 --- a/modules/tlp.nix +++ b/modules/tlp.nix @@ -9,7 +9,6 @@ USB_BLACKLIST = "1d50:604b 1d50:6089 1d50:cc15 1fc9:000c"; CPU_SCALING_GOVERNOR_ON_AC = "performance"; CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; - WIFI_PWR_ON_BAT = "off"; }; }; } diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix index f149049..a94f7e2 100644 --- a/modules/wg/proxy.nix +++ b/modules/wg/proxy.nix @@ -55,6 +55,14 @@ publicKey = "2Lvjzg8k5EIR0Y5mlsCHOs1cJl1+1SL0QMxkKUmliE0="; privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; }; + "forgejo" = { + address = [ + "10.89.88.15/24" + "fd31:185d:722f::15/48" + ]; + publicKey = "pXiOmI3aspl2IvdvLXLddxw76QYMRTACNm42nq+L4D0="; + privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; + }; }; } ];