summaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/cloud/networking.nix2
-rw-r--r--hosts/cloud/proxy/default.nix4
-rw-r--r--hosts/cloud/proxy/git.nix68
-rw-r--r--hosts/forgejo/default.nix77
-rw-r--r--hosts/forgejo/forgejo.nix70
-rw-r--r--hosts/forgejo/secrets.yaml42
6 files changed, 261 insertions, 2 deletions
diff --git a/hosts/cloud/networking.nix b/hosts/cloud/networking.nix
index 71af8e1..3c5c08d 100644
--- a/hosts/cloud/networking.nix
+++ b/hosts/cloud/networking.nix
@@ -19,7 +19,9 @@
networkConfig = {
Address = [
"188.245.196.27/32"
+ "116.202.5.66/32"
"2a01:4f8:c17:7f8a::1/64"
+ "2a01:4f8:c17:7f8a::617/64"
];
DNS = [
"2a01:4ff:ff00::add:1"
diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix
index 42430b1..d092b02 100644
--- a/hosts/cloud/proxy/default.nix
+++ b/hosts/cloud/proxy/default.nix
@@ -6,6 +6,7 @@ in
imports = [
./auth.nix
./dav.nix
+ ./git.nix
./immich.nix
./news.nix
];
@@ -51,8 +52,7 @@ in
# Prevent injection of code in other mime types (XSS Attacks)
add_header X-Content-Type-Options nosniff;
'';
- # default vhost
-
+
virtualHosts."oxapentane.com" = {
forceSSL = true;
enableACME = true;
diff --git a/hosts/cloud/proxy/git.nix b/hosts/cloud/proxy/git.nix
new file mode 100644
index 0000000..ac53f4c
--- /dev/null
+++ b/hosts/cloud/proxy/git.nix
@@ -0,0 +1,68 @@
+{ ... }:
+{
+ # ssh config for forgejo
+ # need ip forward for nat
+ boot.kernel.sysctl = {
+ "net.ipv4.ip_forward" = 1;
+ };
+
+ networking.firewall = {
+ # open port explicitly
+ allowedTCPPorts = [ 22 ];
+ # git.oxapentane.com: port forward 22 to forgejo
+ # TODO do a proper thing with ipv6
+ extraCommands = ''
+ iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222
+ iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE
+ '';
+ extraStopCommands = ''
+ iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true
+ '';
+ };
+ # host sshd: only listen on oxapentane.com and mgmt vpn
+ services.openssh.listenAddresses =
+ map
+ (a: {
+ addr = a;
+ port = 22;
+ })
+ [
+ # enp1s0
+ "188.245.196.27"
+ "2a01:4f8:c17:7f8a::1"
+ # wg-0xa-mgmt
+ "10.89.87.1"
+ "fd31:185d:722e::1"
+ ];
+
+ services.nginx.upstreams.forgejo = {
+ servers = {
+ "10.89.88.15:3000" = { };
+ "[fd31:185d:722f::15]:3000" = { };
+ };
+ };
+
+ services.nginx.virtualHosts."git.oxapentane.com" = {
+ enableACME = true;
+ forceSSL = true;
+ locations."/" = {
+ proxyPass = "http://forgejo";
+ extraConfig = ''
+ client_max_body_size 50000M;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+
+ proxy_read_timeout 600s;
+ proxy_send_timeout 600s;
+ send_timeout 600s;
+ '';
+ };
+ };
+}
diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix
new file mode 100644
index 0000000..02211e5
--- /dev/null
+++ b/hosts/forgejo/default.nix
@@ -0,0 +1,77 @@
+{ config, lib, ... }:
+let
+ mac = "02:00:00:00:00:05";
+in
+{
+ imports = [
+ ./forgejo.nix
+ ];
+ sops.defaultSopsFile = ./secrets.yaml;
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+ sops.secrets = {
+ "wg/0xa-proxy" = {
+ owner = config.users.users.systemd-network.name;
+ };
+ };
+
+ microvm = {
+ hypervisor = "qemu";
+ mem = 3 * 1024;
+ vcpu = 2;
+ interfaces = [
+ {
+ type = "tap";
+ id = "uvm-forgejo";
+ mac = mac;
+ }
+ ];
+ shares =
+ [
+ {
+ source = "/nix/store";
+ mountPoint = "/nix/.ro-store";
+ tag = "store";
+ proto = "virtiofs";
+ socket = "store.socket";
+ }
+ ]
+ ++ map
+ (dir: {
+ source = dir;
+ mountPoint = "/${dir}";
+ tag = dir;
+ proto = "virtiofs";
+ socket = "${dir}.socket";
+ })
+ [
+ "etc"
+ "var"
+ "home"
+ ];
+ };
+
+ networking.useNetworkd = true;
+ networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+ systemd.network = {
+ enable = true;
+ networks."11-host" = {
+ matchConfig.MACAddress = mac;
+ networkConfig = {
+ Address = "10.99.99.15/24";
+ DHCP = "no";
+ };
+ routes = [
+ {
+ Gateway = "10.99.99.1";
+ Destination = "0.0.0.0/0";
+ Metric = 1024;
+ }
+ ];
+ };
+ };
+
+ networking.hostName = "forgejo";
+ system.stateVersion = "24.11";
+}
diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix
new file mode 100644
index 0000000..965354f
--- /dev/null
+++ b/hosts/forgejo/forgejo.nix
@@ -0,0 +1,70 @@
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}:
+{
+ services.forgejo = {
+ enable = true;
+ package = pkgs.forgejo;
+ useWizard = false;
+ database = {
+ type = "postgres";
+ createDatabase = true;
+ };
+ lfs.enable = true;
+ settings = {
+ DEFAULT.APP_NAME = "0xa's compilable shitposts";
+ actions.ENABLED = false;
+ database.LOG_SQL = false;
+ indexer.REPO_INDEXER_ENABLED = true;
+ mailer.ENABLED = false;
+ packages.ENABLED = false;
+ session.COOKIE_SECURE = true;
+ server = {
+ DOMAIN = "git.oxapentane.com";
+ SSH_DOMAIN = "git.oxapentane.com";
+ ROOT_URL = "https://git.oxapentane.com/";
+ PROTOCOL = "http";
+ START_SSH_SERVER = true;
+ BUILTIN_SSH_SERVER_USER = "git";
+ SSH_LISTEN_PORT = 2222;
+ };
+ repository = {
+ DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls";
+ ENABLE_PUSH_CREATE_USER = true;
+ };
+ service = {
+ REGISTER_EMAIL_CONFIRM = false;
+ DISABLE_REGISTRATION = true;
+ };
+ oauth2_client = {
+ ENABLE_AUTO_REGISTRATION = true;
+ USERNAME = "nickname";
+ ACCOUNT_LINKING = "login";
+ };
+ };
+ };
+
+ # expose forgejo cli
+ environment.systemPackages =
+ let
+ cfg = config.services.forgejo;
+ forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
+ #!${pkgs.runtimeShell}
+ cd ${cfg.stateDir}
+ sudo=exec
+ if [[ "$USER" != forgejo ]]; then
+ sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
+ fi
+ # Note that these variable names will change
+ export GITEA_WORK_DIR=${cfg.stateDir}
+ export GITEA_CUSTOM=${cfg.customDir}
+ $sudo ${lib.getExe cfg.package} "$@"
+ '';
+ in
+ [
+ forgejo-cli
+ ];
+}
diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml
new file mode 100644
index 0000000..1bcf0a0
--- /dev/null
+++ b/hosts/forgejo/secrets.yaml
@@ -0,0 +1,42 @@
+wg:
+ 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV0ttcmFIeWtCdTFuS0Y1
+ ZzZHdUJmZ3ZlaUx3d0x5NGVaLzhXZjdtZHk4CkprNUZ5VThydVJ2dTBCdE5OQS8z
+ c0VtY1Vmd2N3bThEdDBFZWMxUC83RXMKLS0tIFluRjRrNG1Qam9MSjVvUWJjbHdq
+ VVRSM2JuOHpTYXRmOVRRSUN0NzlZeDQKcZ6ym4DTJqZjRpAUcWBcYXR/nVYZzhLx
+ vhtZzCmaQc2qYSVtDZE51N3cTqPWJD+l/cr8zp2lo0GCfNWO6BQthg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-02-03T18:25:04Z"
+ mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str]
+ pgp:
+ - created_at: "2025-02-03T18:24:33Z"
+ enc: |-
+ -----BEGIN PGP MESSAGE-----
+
+ hQIMA7zUOKwzpAE7AQ//fcUVRBuEFENKNck1l2/QVMIRwfZzxJO5fMy/r0GQzKiR
+ Nl9X4z0HGcxlCwfiUImif1UtQdMWs1RCXQ7HtFK8kKyNgIb07y5306TI/dmkhbP7
+ nWD0EstGEgbSiVGiFRlT/gy4FIVyKhBPxJqfT/dbAuRZb7NXsl8Rv1fsnZZFcJMu
+ MKO1S3DivJUS/YVXteoRf3T5DLobSpO7/5ok5LUXuuSpYKk20hUxFdJqhv1hsljZ
+ kjckGJ2L0OlxVz16nmg8Z1QI0jDfN6dLl/X+di3U2VACDQDMF+K9LCPLfAm295Y5
+ TAtPSv/yE5os9crJ+MCVKHbEI11Khe3mfdRWvVboVZP6jXoD4ZTe/ccXLZCN8pgE
+ KdSZWs/L2Ps66KYuxujk/c8khmmrmLpPk0qJo9zW0mAf9TSC8UPnMYAxbroeijIe
+ PVYOJS2AzySnRtXQY4MBPLqzlQ0tKf8HxaCBpZ6eCMsX0/9IDjJJOhCMuMavL+oJ
+ DnNQQwtSDXAtXcgvwIccEMzawjyPMS5QBx0hYuH8t0rSJtCYutk2op6yKb1vWmOq
+ 5EDksdNevT3QzGesjtPErh6s3hu3YUAM2k2h4MqXVCbFdchA//FBIHequPul+UMm
+ JMLsPLAk2FmtWAiOuXxdCPtoY7Jnd8Ziqiemhd961WTiWrCtsv7NSn7x4PIMeLfS
+ XgFpMQ+15G4NNCDpgJWGUUXc1H+OKj3XepY5EoONnhusT/gJAtxT9vnuJ+T9LDTt
+ a0Ye2g3jxugeupJ58vbZUifHy/B0OtSeXKkRHZuycCJd3bzxzNxpXLJ23ds40JA=
+ =/5W1
+ -----END PGP MESSAGE-----
+ fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+ unencrypted_suffix: _unencrypted
+ version: 3.9.4
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 05:10:20 +0000