summaryrefslogtreecommitdiff
path: root/microvms
diff options
context:
space:
mode:
Diffstat (limited to 'microvms')
-rw-r--r--microvms/dn42/default.nix1
-rw-r--r--microvms/music/default.nix40
-rw-r--r--microvms/music/navidrome.nix16
-rw-r--r--microvms/music/oxaproxy.nix68
-rw-r--r--microvms/music/upload-user.nix21
-rw-r--r--microvms/news/default.nix39
-rw-r--r--microvms/news/miniflux.nix18
-rw-r--r--microvms/news/oxaproxy.nix68
-rw-r--r--microvms/nextcloud/default.nix115
-rw-r--r--microvms/nextcloud/oxaproxy.nix58
-rw-r--r--microvms/nextcloud/secrets.nix11
11 files changed, 0 insertions, 455 deletions
diff --git a/microvms/dn42/default.nix b/microvms/dn42/default.nix
deleted file mode 100644
index 3f9e239..0000000
--- a/microvms/dn42/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-{ config, pkgs, lib, ... }: { }
diff --git a/microvms/music/default.nix b/microvms/music/default.nix
deleted file mode 100644
index 6c5d053..0000000
--- a/microvms/music/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ pkgs, lib, config, ... }: {
- imports = [
- ./navidrome.nix
- ./oxaproxy.nix
- ./upload-user.nix
- ];
-
- microvm = {
- hypervisor = "qemu";
- mem = 4 * 1024;
- vcpu = 3;
-
- shares = [{
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }] ++ map
- (dir: {
- source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- }) [ "etc" "var" "home" ];
-
- interfaces = [{
- type = "tap";
- id = "vm-music";
- mac = "02:00:00:00:00:01";
- }];
- };
-
- networking = {
- hostName = "music";
- };
-
- system.stateVersion = "22.11";
-}
diff --git a/microvms/music/navidrome.nix b/microvms/music/navidrome.nix
deleted file mode 100644
index f62ddd3..0000000
--- a/microvms/music/navidrome.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ config, ... }: {
- networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ 4533 ];
- services.navidrome = {
- enable = true;
- settings = {
- Address = "10.34.45.101";
- BaseUrl = "/";
- EnableExternalServices = false;
- MusicFolder = "/var/lib/music";
- Port = 4533;
- ScanSchedule = "@every 11m";
- TranscondigCacheSize = "5GiB";
- ReverseProxyWhitelist = "10.34.45.1/24";
- };
- };
-}
diff --git a/microvms/music/oxaproxy.nix b/microvms/music/oxaproxy.nix
deleted file mode 100644
index 737d413..0000000
--- a/microvms/music/oxaproxy.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ config, ... }: {
-
- networking.wireguard.enable = true;
- networking.useNetworkd = true;
-
- #oxaproxy secret
- sops.defaultSopsFile = ../../secrets/music/secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets."wg/oxaproxy-seckey" = {
- owner = config.users.users.systemd-network.name;
- };
-
- systemd.network = {
- enable = true;
- netdevs."10-oxaproxy" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "oxaproxy";
- Description = "oxa's enterprise reverse-proxy network";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
- #own pubkey: vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=
- };
- wireguardPeers = [
- {
- # cirrus
- wireguardPeerConfig = {
- PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
- AllowedIPs = [ "10.34.45.0/24" ];
- Endpoint = [ "95.216.166.21:51821" ];
- PersistentKeepalive = 25;
- };
- }
- ];
- };
- networks."10-oxaproxy" = {
- matchConfig.Name = "oxaproxy";
- networkConfig = {
- Address = "10.34.45.101/24";
- };
- };
-
- networks."111-host" = {
- matchConfig.MACAddress = "02:00:00:00:00:01";
- networkConfig = {
- Address = "10.99.99.101/24";
- };
- routes = [
- {
- routeConfig = {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- };
- }
- {
- routeConfig = {
- Gateway = "10.99.99.1";
- Destination = "10.99.99.0/24";
- Metric = 1024;
- };
- }
- ];
- };
- };
-}
diff --git a/microvms/music/upload-user.nix b/microvms/music/upload-user.nix
deleted file mode 100644
index ae67f66..0000000
--- a/microvms/music/upload-user.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, ... }: {
- security.sudo.wheelNeedsPassword = false;
-
- users.users.caretaker = {
- isNormalUser = true;
- home = "/home/caretaker";
- createHome = true;
- extraGroups = [
- "wheel"
- "navidrome"
- ];
- openssh.authorizedKeys.keys = [
- # melo
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMbUizElFyULDlpEE9XHWWOca4ZXepS18ljh4Fj4YnJOAs7sbYzzhfMUiD703FIgK5YObzOlheu/PBbwUOStgcmPDuRalZWLr+0kCUYERfjLHkgliFx96xEFw9dluvII6JpbzFI/uvkEkQ3ESKapRcYAuBTk2sRoit8za+HX9sLmMueqNtN4H92sFYYm1wWy3FFgz/NN+uTh7F5nmA7SrSS/fpbmugcgBdR/Zy1YwSA8Rl1pagEvgN9/qAnP7pssvXr9pTCUNxVSQ7FlTUOHmxzG16RybYRikgevQaHtFYvmS7AuRvRDlQWhHt1drREGOIwwZPXD1smfQAsvP66J85j9aeanZdoBoJcvvFNer3071QGmi+5NHDSiG+YvoWt7qgiKLF4lOfByzjdoRRSg01uuhdQLOHHt0hbfyGS6hx//1MtjiXTElXvOOiUJ6AqfCSwOTK+72W6VKhKYcO11+Ngym1dyF3TtVcoEYN3JpUdbNq+qctMzXFMGovPEEMh7s= mel@umbreon"
- # revol-xut
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6NLB8EHnUgl2GO2uaojdf3p3YpsHH6px6CZleif8klhLN+ro5KeFK2OXC2SO3Vo4qgF/NySdsoInV9JEsssELZ2ttVbeKxI6f76V5dZgGI7qoSf4E0TXIgpS9n9K2AEmRKr65uC2jgkSJuo/T1mF+4/Nzyo706FT/GGVoiBktgq9umbYX0vIQkTMFAcw921NwFCWFQcMYRruaH01tLu6HIAdJ9FVG8MAt84hCr4D4PobD6b029bHXTzcixsguRtl+q4fQAl3WK3HAxT+txN91CDoP2eENo3gbmdTBprD2RcB/hz5iI6IaY3p1+8fTX2ehvI3loRA8Qjr/xzkzMUlpA/8NLKbJD4YxNGgFbauEmEnlC8Evq2vMrxdDr2SjnBAUwzZ63Nq+pUoBNYG/c+h+eO/s7bjnJVe0m2/2ZqPj1jWQp4hGoNzzU1cQmy6TdEWJcg2c8ints5068HN3o0gQKkp1EseNrdB8SuG+me/c/uIOX8dPASgo3Yjv9IGLhhx8GOGQxHEQN9QFC4QyZt/rrAyGmlX342PBNYmmStgVWHiYCcMVUWGlsG0XvG6bvGgmMeHNVsDf6WdMQuLj9luvxJzrd4FlKX6O0X/sIaqMVSkhIbD2+vvKNqrii7JdUTntUPs89L5h9DoDqQWkL13Plg1iQt4/VYeKTbUhYYz1lw== revo-xut@plank"
- # 0xa gpg
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHv82n6F6kwJ3/EMYlOoCc1/NaYFW7QHC5F8jKVzdlio gshipunov@toaster"
- ];
- };
-}
diff --git a/microvms/news/default.nix b/microvms/news/default.nix
deleted file mode 100644
index dfb196c..0000000
--- a/microvms/news/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ config, ... }: {
- imports = [
- ./miniflux.nix
- ./oxaproxy.nix
- ];
-
- microvm = {
- hypervisor = "qemu";
- mem = 1 * 1024;
- vcpu = 1;
-
- shares = [{
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }] ++ map
- (dir: {
- source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- }) [ "etc" "var" "home" ];
-
- interfaces = [{
- type = "tap";
- id = "vm-news";
- mac = "02:00:00:00:00:02";
- }];
- };
-
- networking = {
- hostName = "news";
- };
-
- system.stateVersion = "22.11";
-}
diff --git a/microvms/news/miniflux.nix b/microvms/news/miniflux.nix
deleted file mode 100644
index 94d409b..0000000
--- a/microvms/news/miniflux.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ config, ... }:
-let
- listenport = 8080;
-in
-{
- sops.secrets."miniflux-admin" = { };
-
- networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ listenport ];
- services.miniflux = {
- enable = true;
- config = {
- LISTEN_ADDR = "10.34.45.102:${toString listenport}";
- POLLING_FREQUENCY = "37";
- CREATE_ADMIN = "1";
- };
- adminCredentialsFile = config.sops.secrets."miniflux-admin".path;
- };
-}
diff --git a/microvms/news/oxaproxy.nix b/microvms/news/oxaproxy.nix
deleted file mode 100644
index d7de046..0000000
--- a/microvms/news/oxaproxy.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ config, ... }: {
-
- networking.wireguard.enable = true;
- networking.useNetworkd = true;
-
- #oxaproxy secret
- sops.defaultSopsFile = ../../secrets/news/secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets."oxaproxy-seckey" = {
- owner = config.users.users.systemd-network.name;
- };
-
- systemd.network = {
- enable = true;
- netdevs."10-oxaproxy" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "oxaproxy";
- Description = "oxa's enterprise reverse-proxy network";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."oxaproxy-seckey".path;
- #own pubkey: guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=
- };
- wireguardPeers = [
- {
- # cirrus
- wireguardPeerConfig = {
- PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
- AllowedIPs = [ "10.34.45.0/24" ];
- Endpoint = [ "95.216.166.21:51821" ];
- PersistentKeepalive = 25;
- };
- }
- ];
- };
- networks."10-oxaproxy" = {
- matchConfig.Name = "oxaproxy";
- networkConfig = {
- Address = "10.34.45.102/24";
- };
- };
-
- networks."111-host" = {
- matchConfig.MACAddress = (builtins.elemAt config.microvm.interfaces 0).mac;
- networkConfig = {
- Address = "10.99.99.102/24";
- };
- routes = [
- {
- routeConfig = {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- };
- }
- {
- routeConfig = {
- Gateway = "10.99.99.1";
- Destination = "10.99.99.0/24";
- Metric = 1024;
- };
- }
- ];
- };
- };
-}
diff --git a/microvms/nextcloud/default.nix b/microvms/nextcloud/default.nix
deleted file mode 100644
index 94b1fa3..0000000
--- a/microvms/nextcloud/default.nix
+++ /dev/null
@@ -1,115 +0,0 @@
-{ config, pkgs, ... }: {
-
- imports = [
- ./oxaproxy.nix
- ./secrets.nix
- ];
-
- # nextcloud goes here
- networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ 8080 ];
-
- services.postgresql = {
- enable = true;
- package = pkgs.postgresql_14;
- ensureDatabases = [ "nextcloud" ];
- ensureUsers = [{
- name = "nextcloud";
- ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
- }];
- };
-
- services.redis.servers.nextcloud.enable = true;
-
- services.nginx = {
- enable = true;
- recommendedGzipSettings = true;
- recommendedOptimisation = true;
- virtualHosts."nc.oxapentane.com" = {
- extraConfig = ''
- # HTTP response headers borrowed from Nextcloud .htaccess
- add_header Referrer-Policy "no-referrer" always;
- #add_header X-Content-Type-Options "nosniff" always;
- add_header X-Download-Options "noopen" always;
- #add_header X-Frame-Options "SAMEORIGIN" always;
- add_header X-Permitted-Cross-Domain-Policies "none" always;
- add_header X-Robots-Tag "none" always;
- add_header X-XSS-Protection "1; mode=block" always;
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
- # Remove X-Powered-By, which is an information leak
- fastcgi_hide_header X-Powered-By;
- '';
- listen = [{
- # We are listening on wireguard interface only
- addr = "10.34.45.100";
- port = 8080;
- ssl = false;
- }];
- };
- };
-
- services.nextcloud = {
- enable = true;
- hostName = "nc.oxapentane.com";
- home = "/var/lib/nextcloud-oxa";
- package = pkgs.nextcloud28;
- maxUploadSize = "5000M";
- caching.redis = true;
- autoUpdateApps = {
- enable = true;
- startAt = "07:00:00";
- };
- config = {
- overwriteProtocol = "https";
- trustedProxies = [ "10.34.45.1" ];
-
- dbtype = "pgsql";
- dbuser = "nextcloud";
- dbhost = "/run/postgresql";
- dbname = "nextcloud";
- adminuser = "admin";
- adminpassFile = config.sops.secrets."nextcloud/adminpass".path;
- };
- };
-
- systemd.services."nextcloud-setup" = {
- requires = [ "postgresql.service" ];
- after = [ "postgresql.service" ];
- };
-
-
-
-
- microvm = {
- hypervisor = "qemu";
- mem = 4 * 1024;
- vcpu = 3;
-
- shares = [{
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }] ++ map
- (dir: {
- source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- }) [ "etc" "var" "home" ];
-
- interfaces = [{
- type = "tap";
- id = "vm-nextcloud";
- mac = "02:00:00:00:00:00";
- }];
- };
-
- networking = {
- hostName = "nextcloud";
- };
-
- system.stateVersion = "22.05";
-}
diff --git a/microvms/nextcloud/oxaproxy.nix b/microvms/nextcloud/oxaproxy.nix
deleted file mode 100644
index 3a3843c..0000000
--- a/microvms/nextcloud/oxaproxy.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ config, ... }: {
- networking.wireguard.enable = true;
- networking.useNetworkd = true;
- systemd.network = {
- enable = true;
- netdevs."10-oxaproxy" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "oxaproxy";
- Description = "oxa's enterprise reverse-proxy network";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
- #own pubkey: KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=
- };
- wireguardPeers = [
- {
- # cirrus
- wireguardPeerConfig = {
- PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
- AllowedIPs = [ "10.34.45.0/24" ];
- Endpoint = [ "95.216.166.21:51821" ];
- PersistentKeepalive = 25;
- };
- }
- ];
- };
- networks."10-oxaproxy" = {
- matchConfig.Name = "oxaproxy";
- networkConfig = {
- Address = "10.34.45.100/24";
- };
- };
-
- networks."111-host" = {
- matchConfig.MACAddress = "02:00:00:00:00:00";
- networkConfig = {
- Address = "10.99.99.100/24";
- };
- routes = [
- {
- routeConfig = {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- };
- }
- {
- routeConfig = {
- Gateway = "10.99.99.1";
- Destination = "10.99.99.0/24";
- Metric = 1024;
- };
- }
- ];
- };
- };
-}
diff --git a/microvms/nextcloud/secrets.nix b/microvms/nextcloud/secrets.nix
deleted file mode 100644
index 50ae8e0..0000000
--- a/microvms/nextcloud/secrets.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, ... }: {
- sops.defaultSopsFile = ../../secrets/nextcloud/secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets."wg/oxaproxy-seckey" = {
- owner = config.users.users.systemd-network.name;
- };
- sops.secrets."nextcloud/adminpass" = {
- owner = config.users.users.nextcloud.name;
- };
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 02:30:10 +0000