From a38e90adf7d746cc9cb1c1e02a615e32556597fa Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sun, 26 Jul 2026 08:45:30 +0000 Subject: move microvms to separate folder --- .sops.yaml | 10 +++--- flake.nix | 2 +- hosts/auth/authentik.nix | 17 --------- hosts/auth/default.nix | 78 ------------------------------------------ hosts/auth/secrets.yaml | 39 --------------------- hosts/forgejo/default.nix | 78 ------------------------------------------ hosts/forgejo/forgejo.nix | 70 ------------------------------------- hosts/forgejo/secrets.yaml | 37 -------------------- hosts/immich/default.nix | 78 ------------------------------------------ hosts/immich/immich.nix | 23 ------------- hosts/immich/immich.yaml | 49 -------------------------- hosts/immich/secrets.yaml | 37 -------------------- hosts/miniflux/default.nix | 78 ------------------------------------------ hosts/miniflux/miniflux.nix | 22 ------------ hosts/miniflux/secrets.yaml | 38 -------------------- hosts/stream/default.nix | 77 ----------------------------------------- hosts/stream/navidrome.nix | 16 --------- hosts/stream/secrets.yaml | 37 -------------------- microvms/auth/authentik.nix | 17 +++++++++ microvms/auth/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/auth/secrets.yaml | 39 +++++++++++++++++++++ microvms/forgejo/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/forgejo/forgejo.nix | 70 +++++++++++++++++++++++++++++++++++++ microvms/forgejo/secrets.yaml | 37 ++++++++++++++++++++ microvms/immich/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/immich/immich.nix | 23 +++++++++++++ microvms/immich/immich.yaml | 49 ++++++++++++++++++++++++++ microvms/immich/secrets.yaml | 37 ++++++++++++++++++++ microvms/miniflux/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/miniflux/miniflux.nix | 22 ++++++++++++ microvms/miniflux/secrets.yaml | 38 ++++++++++++++++++++ microvms/stream/default.nix | 77 +++++++++++++++++++++++++++++++++++++++++ microvms/stream/navidrome.nix | 16 +++++++++ microvms/stream/secrets.yaml | 37 ++++++++++++++++++++ 34 files changed, 780 insertions(+), 780 deletions(-) delete mode 100644 hosts/auth/authentik.nix delete mode 100644 hosts/auth/default.nix delete mode 100644 hosts/auth/secrets.yaml delete mode 100644 hosts/forgejo/default.nix delete mode 100644 hosts/forgejo/forgejo.nix delete mode 100644 hosts/forgejo/secrets.yaml delete mode 100644 hosts/immich/default.nix delete mode 100644 hosts/immich/immich.nix delete mode 100644 hosts/immich/immich.yaml delete mode 100644 hosts/immich/secrets.yaml delete mode 100644 hosts/miniflux/default.nix delete mode 100644 hosts/miniflux/miniflux.nix delete mode 100644 hosts/miniflux/secrets.yaml delete mode 100644 hosts/stream/default.nix delete mode 100644 hosts/stream/navidrome.nix delete mode 100644 hosts/stream/secrets.yaml create mode 100644 microvms/auth/authentik.nix create mode 100644 microvms/auth/default.nix create mode 100644 microvms/auth/secrets.yaml create mode 100644 microvms/forgejo/default.nix create mode 100644 microvms/forgejo/forgejo.nix create mode 100644 microvms/forgejo/secrets.yaml create mode 100644 microvms/immich/default.nix create mode 100644 microvms/immich/immich.nix create mode 100644 microvms/immich/immich.yaml create mode 100644 microvms/immich/secrets.yaml create mode 100644 microvms/miniflux/default.nix create mode 100644 microvms/miniflux/miniflux.nix create mode 100644 microvms/miniflux/secrets.yaml create mode 100644 microvms/stream/default.nix create mode 100644 microvms/stream/navidrome.nix create mode 100644 microvms/stream/secrets.yaml diff --git a/.sops.yaml b/.sops.yaml index cb46d58..864422b 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -30,31 +30,31 @@ creation_rules: - *admin_toaster - *admin_frituurpan - *minime - - path_regex: hosts/auth/[^/]+\.yaml$ + - path_regex: microvms/auth/[^/]+\.yaml$ key_groups: - age: - *admin_toaster - *admin_frituurpan - *auth - - path_regex: hosts/immich/[^/]+\.yaml$ + - path_regex: microvms/immich/[^/]+\.yaml$ key_groups: - age: - *admin_toaster - *admin_frituurpan - *immich - - path_regex: hosts/miniflux/[^/]+\.yaml$ + - path_regex: microvms/miniflux/[^/]+\.yaml$ key_groups: - age: - *admin_toaster - *admin_frituurpan - *miniflux - - path_regex: hosts/forgejo/[^/]+\.yaml$ + - path_regex: microvms/forgejo/[^/]+\.yaml$ key_groups: - age: - *admin_toaster - *admin_frituurpan - *forgejo - - path_regex: hosts/stream/[^/]+\.yaml$ + - path_regex: microvms/stream/[^/]+\.yaml$ key_groups: - age: - *admin_toaster diff --git a/flake.nix b/flake.nix index 8a8a3a6..5215376 100644 --- a/flake.nix +++ b/flake.nix @@ -75,7 +75,7 @@ sops-nix.nixosModules.sops microvm.nixosModules.microvm - ./hosts/${vm} + ./microvms/${vm} ./modules/server ./modules/wg ]; diff --git a/hosts/auth/authentik.nix b/hosts/auth/authentik.nix deleted file mode 100644 index a1257ee..0000000 --- a/hosts/auth/authentik.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ config, inputs, ... }: -{ - imports = [ - inputs.authentik-nix.nixosModules.default - ]; - sops.secrets."authentik/env" = { }; - services.authentik = { - enable = true; - environmentFile = config.sops.secrets."authentik/env".path; - settings = { - log_level = "debug"; - disable_startup_analytics = true; - avatars = "initials"; - postgresql.host = "/run/postgresql"; - }; - }; -} diff --git a/hosts/auth/default.nix b/hosts/auth/default.nix deleted file mode 100644 index 734ef43..0000000 --- a/hosts/auth/default.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:01"; -in -{ - imports = [ - ./authentik.nix - ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 1; - mem = 2 * 1024; - vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-auth"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.11/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "auth"; - system.stateVersion = "24.11"; -} diff --git a/hosts/auth/secrets.yaml b/hosts/auth/secrets.yaml deleted file mode 100644 index 87d2f31..0000000 --- a/hosts/auth/secrets.yaml +++ /dev/null @@ -1,39 +0,0 @@ -authentik: - env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str] -wg: - 0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str] -sops: - age: - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE - NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281 - QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ - QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl - W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive - wWGaYQ== - -----END AGE ENCRYPTED FILE----- - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU - TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1 - eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY - WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY - eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV - iaiVrA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt - TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk - OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214 - V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN - 8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-01-21T00:19:40Z" - mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.9.3 diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix deleted file mode 100644 index 4e59c1b..0000000 --- a/hosts/forgejo/default.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:05"; -in -{ - imports = [ - ./forgejo.nix - ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 5; - mem = 3 * 1024; - vcpu = 4; - interfaces = [ - { - type = "tap"; - id = "uvm-forgejo"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.15/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "forgejo"; - system.stateVersion = "24.11"; -} diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix deleted file mode 100644 index 965354f..0000000 --- a/hosts/forgejo/forgejo.nix +++ /dev/null @@ -1,70 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: -{ - services.forgejo = { - enable = true; - package = pkgs.forgejo; - useWizard = false; - database = { - type = "postgres"; - createDatabase = true; - }; - lfs.enable = true; - settings = { - DEFAULT.APP_NAME = "0xa's compilable shitposts"; - actions.ENABLED = false; - database.LOG_SQL = false; - indexer.REPO_INDEXER_ENABLED = true; - mailer.ENABLED = false; - packages.ENABLED = false; - session.COOKIE_SECURE = true; - server = { - DOMAIN = "git.oxapentane.com"; - SSH_DOMAIN = "git.oxapentane.com"; - ROOT_URL = "https://git.oxapentane.com/"; - PROTOCOL = "http"; - START_SSH_SERVER = true; - BUILTIN_SSH_SERVER_USER = "git"; - SSH_LISTEN_PORT = 2222; - }; - repository = { - DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; - ENABLE_PUSH_CREATE_USER = true; - }; - service = { - REGISTER_EMAIL_CONFIRM = false; - DISABLE_REGISTRATION = true; - }; - oauth2_client = { - ENABLE_AUTO_REGISTRATION = true; - USERNAME = "nickname"; - ACCOUNT_LINKING = "login"; - }; - }; - }; - - # expose forgejo cli - environment.systemPackages = - let - cfg = config.services.forgejo; - forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' - #!${pkgs.runtimeShell} - cd ${cfg.stateDir} - sudo=exec - if [[ "$USER" != forgejo ]]; then - sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' - fi - # Note that these variable names will change - export GITEA_WORK_DIR=${cfg.stateDir} - export GITEA_CUSTOM=${cfg.customDir} - $sudo ${lib.getExe cfg.package} "$@" - ''; - in - [ - forgejo-cli - ]; -} diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml deleted file mode 100644 index a3d42af..0000000 --- a/hosts/forgejo/secrets.yaml +++ /dev/null @@ -1,37 +0,0 @@ -wg: - 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] -sops: - age: - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB2OXBT - QkRaOERCYmJPdTViMXBqc2FUbGUxZjNkNmlqa2pCQzZ5R1JYT2xjCm51THQ2cTMx - WkV6b2QvWmQ0SHo5Sk0xTFB3NHpXUVRuWExzcy9wQUNQdUEKLS0tIGpvRnFRbUpy - Q3pqbGszM2p1eXFueTF3YXh4T1hzV0ZnOXdYODFRZ0JQcEkKZfPbYqMxfD1Qvu31 - F7nESte4mN8YtUPnMTWHR0uNXWeUBAW2l/pjOOH40B8xHwmG/+4jv5fBVQJc2GKr - 9REjvg== - -----END AGE ENCRYPTED FILE----- - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBjRU9t - MWRoTEFsSFpUb1F4Mis5U0o4N3BldzlkSU53L3EwVTdkY2ZnUkZFCldvTmRNbjhD - eERYOTVob1o1c2xyVzNlbHd6ak5mbnk3dHc5YTB5SXNuR2cKLS0tIGpMRnRORy9k - N1F6a2lsQ2JCTFVHTXFtRTRJZHlUL1ZwVXhhNE9PUm15QlEK7Udv/Nx6FKfhjkBs - /hLzhzbZ3lwjexNhuyER+rpeZ70LtYmKm8EpcVnPdP3H0w5kyVyK31gv4iabpAUv - vNW+Wg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT05nL1Vla1k5S0VpVzY2 - ZXgvOHlycnljMFYrb1g4ZGI0YTBzMytTZWxVCmNKRW9LWld5enNyL2lKVEQyZFlw - RUVOQlFsOXFvaW91VUJUS0w4RWR2ZW8KLS0tIHVpVU8waXVYY1hKTHhneVV5NlVD - TnQ3SFFsd2ZYdlRhQ2MyNzV6SzZJS3MKlAJNMzDPlxBYcyl/AyvApsq825FnOS1s - Etv58L70JbhMgOuJY6tu/4uBAQd2dLphTb8lm4slAQxxtp40pXZ3IA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-02-03T18:25:04Z" - mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/hosts/immich/default.nix b/hosts/immich/default.nix deleted file mode 100644 index 9e635d9..0000000 --- a/hosts/immich/default.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:03"; -in -{ - imports = [ - ./immich.nix - ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 3; - mem = 3 * 1024; - vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-immich"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.13/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "immich"; - system.stateVersion = "24.11"; -} diff --git a/hosts/immich/immich.nix b/hosts/immich/immich.nix deleted file mode 100644 index bd17dd4..0000000 --- a/hosts/immich/immich.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ - config, - ... -}: -{ - sops.secrets."immich.yaml" = { - sopsFile = ./immich.yaml; - owner = config.services.immich.user; - key = ""; - }; - - services.immich = { - enable = true; - host = "10.89.88.13"; - redis.enable = true; - database.createDB = true; - machine-learning.enable = true; - settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815 - environment = { - IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path; - }; - }; -} diff --git a/hosts/immich/immich.yaml b/hosts/immich/immich.yaml deleted file mode 100644 index 54075df..0000000 --- a/hosts/immich/immich.yaml +++ /dev/null @@ -1,49 +0,0 @@ -server: - externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str] -oauth: - enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool] - autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool] - autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool] - clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str] - clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str] - issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS - aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT - cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ - Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9 - 7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-01-24T20:10:57Z" - mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str] - pgp: - - created_at: "2025-01-24T20:02:34Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb - UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1 - c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF - 0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx - tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7 - 3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K - fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ - 5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC - /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U - 6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb - pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS - XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX - ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU= - =sCmm - -----END PGP MESSAGE----- - fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C - unencrypted_suffix: _unencrypted - version: 3.9.2 diff --git a/hosts/immich/secrets.yaml b/hosts/immich/secrets.yaml deleted file mode 100644 index 45637d4..0000000 --- a/hosts/immich/secrets.yaml +++ /dev/null @@ -1,37 +0,0 @@ -wg: - 0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str] -sops: - age: - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBxbGRo - emhsNnkrYm8vNWhObGNVQnRJb1BaTzdrbDRmUktYMjRXSGlLQlVnCkd6dHR6Umpt - SXU4TzVMVWxYbDFIcEZPaUVjQURYQStjL1FKdnlXUGxZSlUKLS0tIE9yMEI4bEkw - aVl5Vm9FQUZjZWZIUEZVcTE4OWpUS0VEU1NVMjBvNmNDemMKXSDvFyMt+CiQj+Mo - WMWtregXZ2jMYk8Z9bJDeGQvymJxoUf98qvaTYSDXs1kCvVBrrOToGYHXwZ9j0cf - Uyib0A== - -----END AGE ENCRYPTED FILE----- - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSB2WXNs - dkdyZmtHYU9TYU1LQTNOUk9WYi92NFdBa1ljYll0ZVhGQVQ3WUJNCndCMkZPUmVq - SEhxS25KTEJoS0RPb3lVNVJhUXl0dnkyc0xzUDROazRVM0kKLS0tIEorVnZYbTVa - dkZwWWJhNnJUSGVqMXVJZHFmSGRKYmVXUWRWOGVEbnV2cUUKP4Nuqb4O7kP1okS5 - 9AbA9GC/eu7jXdXQeboEDY40U1yl+nZoCc0PcP5kXKGiMycP/4eaJtyTWVOCAFHq - 4aYVOg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eWFzdE05aCtjQkhZU2V5 - Y3VtRURLbWp3M0NOcG95L09SZktvbHFUNDNvCkVoM3kxYjFRTkw3SU1ZSkFqOUwr - ZHV0R1lNbVdaek5rRXlTODU1N3RCUm8KLS0tIEVYZHVrK0dGTFh6YmQxU09Hd3Az - SXB2bTJQYzRVZ3AwWXdlUjhJRUJWMG8KObHGuGc9xuGGsJhrD7SztKDxMmT28OnA - QtM7P1hEEtlC9uxvB6OXGRstHN7WRBj66hkEObuKuCJepTQE1pMV9w== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-01-21T17:43:24Z" - mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.9.3 diff --git a/hosts/miniflux/default.nix b/hosts/miniflux/default.nix deleted file mode 100644 index d2f024f..0000000 --- a/hosts/miniflux/default.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:04"; -in -{ - imports = [ - ./miniflux.nix - ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 4; - mem = 1 * 1024; - vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-miniflux"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.14/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "miniflux"; - system.stateVersion = "24.11"; -} diff --git a/hosts/miniflux/miniflux.nix b/hosts/miniflux/miniflux.nix deleted file mode 100644 index 9afbe29..0000000 --- a/hosts/miniflux/miniflux.nix +++ /dev/null @@ -1,22 +0,0 @@ -{ config, ... }: -{ - sops.secrets."miniflux" = { }; - - services.miniflux = { - enable = true; - createDatabaseLocally = true; - adminCredentialsFile = config.sops.secrets."miniflux".path; - config = { - LISTEN_ADDR = "10.89.88.14:8080"; - BASE_URL = "https://news.oxapentane.com"; - # oauth - DISABLE_LOCAL_AUTH = 1; - CREATE_ADMIN = 0; - OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/"; - OAUTH2_PROVIDER = "oidc"; - OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback"; - OAUTH2_USER_CREATION = 1; - POLLING_FREQUENCY = 37; - }; - }; -} diff --git a/hosts/miniflux/secrets.yaml b/hosts/miniflux/secrets.yaml deleted file mode 100644 index 39cb3b9..0000000 --- a/hosts/miniflux/secrets.yaml +++ /dev/null @@ -1,38 +0,0 @@ -wg: - 0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str] -miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str] -sops: - age: - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ - cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI - QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X - ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr - KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P - 3b+TwA== - -----END AGE ENCRYPTED FILE----- - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj - YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl - dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa - SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8 - Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN - 4/39SQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5 - bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5 - VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS - ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk - 4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-01-25T01:09:45Z" - mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str] - unencrypted_suffix: _unencrypted - version: 3.9.2 diff --git a/hosts/stream/default.nix b/hosts/stream/default.nix deleted file mode 100644 index 2cad795..0000000 --- a/hosts/stream/default.nix +++ /dev/null @@ -1,77 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:07"; -in -{ - imports = [ - ./navidrome.nix - ]; - - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 7; - mem = 3 * 1024; - vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-stream"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.17/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "stream"; - system.stateVersion = "25.05"; -} diff --git a/hosts/stream/navidrome.nix b/hosts/stream/navidrome.nix deleted file mode 100644 index 0b1cd07..0000000 --- a/hosts/stream/navidrome.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ ... }: -{ - services.navidrome = { - enable = true; - settings = { - Address = "10.89.88.17"; - BaseUrl = "/"; - EnableExternalServices = false; - MusicFolder = "/var/lib/navidrome/music"; - Port = 4533; - ScanSchedule = "@every 11m"; - TranscodingCacheSize = "11GiB"; - ReverseProxyWhitelist = "10.89.88.1/24"; - }; - }; -} diff --git a/hosts/stream/secrets.yaml b/hosts/stream/secrets.yaml deleted file mode 100644 index d26d805..0000000 --- a/hosts/stream/secrets.yaml +++ /dev/null @@ -1,37 +0,0 @@ -wg: - 0xa-proxy: ENC[AES256_GCM,data:uZfFc4elxCAVZvdIHJ7lgoPs9qKkD9ZvLhcYbexDcqn0alaMzIr++CY52FI=,iv:CREMt6GrLHs4Jwj/55awDFHh9hQlJPEi4ZQ7ZLMPvRA=,tag:iJAGdqzQbyezmDj+tzjdNQ==,type:str] -sops: - age: - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB5Zytw - K1ZKTHBFYy83WU94N3Izczh1RnE4Ry9iRkEvMUxLUUNaTW52MW1ZCjIxWFI3NTJ6 - eXlXYXVVbHQ5Qjkxc0YwSU1MUjRVRi9abFl2dm1QSkx4N00KLS0tIEtaeXgyUzAv - UWhnSjR0TlJyMkpEVlJkaEdNZURXNUhQdXpkcWRYMmxFNDAKFIoZevnllkATCBog - 5R7ntMPrAlub8WnOjZVT5QdMgU3dRmxUnnfXY4PY7QpLNKyjEUxQ/5zvEeogYOSZ - IUVfhA== - -----END AGE ENCRYPTED FILE----- - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBuVVJO - ZS9Ed3NrVEl4ZGRpZURZZVRaZ3pwcTZVRmJmQ3lrdHlQaWYzSjFvCkJQTXNDR2xm - WkhxdnA3RlhPRkpnMWIvS0RzcTRJdEFISlpUb0NaYXVoMlUKLS0tIGZDSGw5QjRG - bW9vUzRSRWk5ZG5rc0tjYjFzSzFuVWpJTExEVDhmdXloZzQKzJrWm1z3KRLSLkxt - ZsmunVoD55HjrFsvPNnVear40c9JB+U3+m1pjdL5eax27lrX/rlvXx7rhzOhtTkN - 9IDAjg== - -----END AGE ENCRYPTED FILE----- - - recipient: age148r2q3cy9sjem37rvgtcc4qjx8usxkdg77pqexa56gmcexn58aaslh3cnj - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNG9vM1FqTVVBSTFYaGt2 - Rkpvci9ibXJyL3ZVbHNYbmF4Umk5ZHJ1bURFCmVjalI0S084R1dsdzdHQ0lZbmcr - SjBXSDRUUGtUQ21wN2kzUmxwZmdKWUkKLS0tIHNjM1pkemxJbWZDNGZ4T01GZVli - b05oNElQQjUrUklpYkR1TCsrTU5uUHMKWB5XybfmmjTfk/c+mRT2PNgsI4q8tbac - nV6pFb97477fcnHH/vpbBD24bixFt/X8A90G3ilbjqL+1rd4G+K7jA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-06-12T22:54:11Z" - mac: ENC[AES256_GCM,data:15EU9VupWfvR8CrfKrX3nhpD60hYB2LY3vuAPvdqzKLliqSqolNj956fOFicfSHvmW/s+7x+M+5FROnOzSbToTZotFtvALQihHH999veGZMx8Q8oIyljT1PBw/SU9djXPI1KjG/zzYOAwu7y/Ffm0QKhMRziH7CQLn30KR0o2w0=,iv:ghdyTvcpgnBi2L9s4UrzwWwt9TeU0WkGquZ64+w9IN8=,tag:4m4hYFgejlEaQROB/OEi6g==,type:str] - unencrypted_suffix: _unencrypted - version: 3.10.2 diff --git a/microvms/auth/authentik.nix b/microvms/auth/authentik.nix new file mode 100644 index 0000000..a1257ee --- /dev/null +++ b/microvms/auth/authentik.nix @@ -0,0 +1,17 @@ +{ config, inputs, ... }: +{ + imports = [ + inputs.authentik-nix.nixosModules.default + ]; + sops.secrets."authentik/env" = { }; + services.authentik = { + enable = true; + environmentFile = config.sops.secrets."authentik/env".path; + settings = { + log_level = "debug"; + disable_startup_analytics = true; + avatars = "initials"; + postgresql.host = "/run/postgresql"; + }; + }; +} diff --git a/microvms/auth/default.nix b/microvms/auth/default.nix new file mode 100644 index 0000000..734ef43 --- /dev/null +++ b/microvms/auth/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:01"; +in +{ + imports = [ + ./authentik.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 1; + mem = 2 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-auth"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.11/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "auth"; + system.stateVersion = "24.11"; +} diff --git a/microvms/auth/secrets.yaml b/microvms/auth/secrets.yaml new file mode 100644 index 0000000..87d2f31 --- /dev/null +++ b/microvms/auth/secrets.yaml @@ -0,0 +1,39 @@ +authentik: + env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str] +wg: + 0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE + NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281 + QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ + QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl + W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive + wWGaYQ== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU + TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1 + eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY + WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY + eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV + iaiVrA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt + TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk + OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214 + V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN + 8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-21T00:19:40Z" + mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.3 diff --git a/microvms/forgejo/default.nix b/microvms/forgejo/default.nix new file mode 100644 index 0000000..4e59c1b --- /dev/null +++ b/microvms/forgejo/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:05"; +in +{ + imports = [ + ./forgejo.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 5; + mem = 3 * 1024; + vcpu = 4; + interfaces = [ + { + type = "tap"; + id = "uvm-forgejo"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.15/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "forgejo"; + system.stateVersion = "24.11"; +} diff --git a/microvms/forgejo/forgejo.nix b/microvms/forgejo/forgejo.nix new file mode 100644 index 0000000..965354f --- /dev/null +++ b/microvms/forgejo/forgejo.nix @@ -0,0 +1,70 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + services.forgejo = { + enable = true; + package = pkgs.forgejo; + useWizard = false; + database = { + type = "postgres"; + createDatabase = true; + }; + lfs.enable = true; + settings = { + DEFAULT.APP_NAME = "0xa's compilable shitposts"; + actions.ENABLED = false; + database.LOG_SQL = false; + indexer.REPO_INDEXER_ENABLED = true; + mailer.ENABLED = false; + packages.ENABLED = false; + session.COOKIE_SECURE = true; + server = { + DOMAIN = "git.oxapentane.com"; + SSH_DOMAIN = "git.oxapentane.com"; + ROOT_URL = "https://git.oxapentane.com/"; + PROTOCOL = "http"; + START_SSH_SERVER = true; + BUILTIN_SSH_SERVER_USER = "git"; + SSH_LISTEN_PORT = 2222; + }; + repository = { + DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; + ENABLE_PUSH_CREATE_USER = true; + }; + service = { + REGISTER_EMAIL_CONFIRM = false; + DISABLE_REGISTRATION = true; + }; + oauth2_client = { + ENABLE_AUTO_REGISTRATION = true; + USERNAME = "nickname"; + ACCOUNT_LINKING = "login"; + }; + }; + }; + + # expose forgejo cli + environment.systemPackages = + let + cfg = config.services.forgejo; + forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' + #!${pkgs.runtimeShell} + cd ${cfg.stateDir} + sudo=exec + if [[ "$USER" != forgejo ]]; then + sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' + fi + # Note that these variable names will change + export GITEA_WORK_DIR=${cfg.stateDir} + export GITEA_CUSTOM=${cfg.customDir} + $sudo ${lib.getExe cfg.package} "$@" + ''; + in + [ + forgejo-cli + ]; +} diff --git a/microvms/forgejo/secrets.yaml b/microvms/forgejo/secrets.yaml new file mode 100644 index 0000000..a3d42af --- /dev/null +++ b/microvms/forgejo/secrets.yaml @@ -0,0 +1,37 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB2OXBT + QkRaOERCYmJPdTViMXBqc2FUbGUxZjNkNmlqa2pCQzZ5R1JYT2xjCm51THQ2cTMx + WkV6b2QvWmQ0SHo5Sk0xTFB3NHpXUVRuWExzcy9wQUNQdUEKLS0tIGpvRnFRbUpy + Q3pqbGszM2p1eXFueTF3YXh4T1hzV0ZnOXdYODFRZ0JQcEkKZfPbYqMxfD1Qvu31 + F7nESte4mN8YtUPnMTWHR0uNXWeUBAW2l/pjOOH40B8xHwmG/+4jv5fBVQJc2GKr + 9REjvg== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBjRU9t + MWRoTEFsSFpUb1F4Mis5U0o4N3BldzlkSU53L3EwVTdkY2ZnUkZFCldvTmRNbjhD + eERYOTVob1o1c2xyVzNlbHd6ak5mbnk3dHc5YTB5SXNuR2cKLS0tIGpMRnRORy9k + N1F6a2lsQ2JCTFVHTXFtRTRJZHlUL1ZwVXhhNE9PUm15QlEK7Udv/Nx6FKfhjkBs + /hLzhzbZ3lwjexNhuyER+rpeZ70LtYmKm8EpcVnPdP3H0w5kyVyK31gv4iabpAUv + vNW+Wg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT05nL1Vla1k5S0VpVzY2 + ZXgvOHlycnljMFYrb1g4ZGI0YTBzMytTZWxVCmNKRW9LWld5enNyL2lKVEQyZFlw + RUVOQlFsOXFvaW91VUJUS0w4RWR2ZW8KLS0tIHVpVU8waXVYY1hKTHhneVV5NlVD + TnQ3SFFsd2ZYdlRhQ2MyNzV6SzZJS3MKlAJNMzDPlxBYcyl/AyvApsq825FnOS1s + Etv58L70JbhMgOuJY6tu/4uBAQd2dLphTb8lm4slAQxxtp40pXZ3IA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-02-03T18:25:04Z" + mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/microvms/immich/default.nix b/microvms/immich/default.nix new file mode 100644 index 0000000..9e635d9 --- /dev/null +++ b/microvms/immich/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:03"; +in +{ + imports = [ + ./immich.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 3; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-immich"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.13/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "immich"; + system.stateVersion = "24.11"; +} diff --git a/microvms/immich/immich.nix b/microvms/immich/immich.nix new file mode 100644 index 0000000..bd17dd4 --- /dev/null +++ b/microvms/immich/immich.nix @@ -0,0 +1,23 @@ +{ + config, + ... +}: +{ + sops.secrets."immich.yaml" = { + sopsFile = ./immich.yaml; + owner = config.services.immich.user; + key = ""; + }; + + services.immich = { + enable = true; + host = "10.89.88.13"; + redis.enable = true; + database.createDB = true; + machine-learning.enable = true; + settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815 + environment = { + IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path; + }; + }; +} diff --git a/microvms/immich/immich.yaml b/microvms/immich/immich.yaml new file mode 100644 index 0000000..54075df --- /dev/null +++ b/microvms/immich/immich.yaml @@ -0,0 +1,49 @@ +server: + externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str] +oauth: + enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool] + autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool] + autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool] + clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str] + clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str] + issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS + aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT + cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ + Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9 + 7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-24T20:10:57Z" + mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str] + pgp: + - created_at: "2025-01-24T20:02:34Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb + UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1 + c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF + 0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx + tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7 + 3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K + fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ + 5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC + /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U + 6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb + pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS + XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX + ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU= + =sCmm + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/microvms/immich/secrets.yaml b/microvms/immich/secrets.yaml new file mode 100644 index 0000000..45637d4 --- /dev/null +++ b/microvms/immich/secrets.yaml @@ -0,0 +1,37 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBxbGRo + emhsNnkrYm8vNWhObGNVQnRJb1BaTzdrbDRmUktYMjRXSGlLQlVnCkd6dHR6Umpt + SXU4TzVMVWxYbDFIcEZPaUVjQURYQStjL1FKdnlXUGxZSlUKLS0tIE9yMEI4bEkw + aVl5Vm9FQUZjZWZIUEZVcTE4OWpUS0VEU1NVMjBvNmNDemMKXSDvFyMt+CiQj+Mo + WMWtregXZ2jMYk8Z9bJDeGQvymJxoUf98qvaTYSDXs1kCvVBrrOToGYHXwZ9j0cf + Uyib0A== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSB2WXNs + dkdyZmtHYU9TYU1LQTNOUk9WYi92NFdBa1ljYll0ZVhGQVQ3WUJNCndCMkZPUmVq + SEhxS25KTEJoS0RPb3lVNVJhUXl0dnkyc0xzUDROazRVM0kKLS0tIEorVnZYbTVa + dkZwWWJhNnJUSGVqMXVJZHFmSGRKYmVXUWRWOGVEbnV2cUUKP4Nuqb4O7kP1okS5 + 9AbA9GC/eu7jXdXQeboEDY40U1yl+nZoCc0PcP5kXKGiMycP/4eaJtyTWVOCAFHq + 4aYVOg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eWFzdE05aCtjQkhZU2V5 + Y3VtRURLbWp3M0NOcG95L09SZktvbHFUNDNvCkVoM3kxYjFRTkw3SU1ZSkFqOUwr + ZHV0R1lNbVdaek5rRXlTODU1N3RCUm8KLS0tIEVYZHVrK0dGTFh6YmQxU09Hd3Az + SXB2bTJQYzRVZ3AwWXdlUjhJRUJWMG8KObHGuGc9xuGGsJhrD7SztKDxMmT28OnA + QtM7P1hEEtlC9uxvB6OXGRstHN7WRBj66hkEObuKuCJepTQE1pMV9w== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-21T17:43:24Z" + mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.3 diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix new file mode 100644 index 0000000..d2f024f --- /dev/null +++ b/microvms/miniflux/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:04"; +in +{ + imports = [ + ./miniflux.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 4; + mem = 1 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-miniflux"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.14/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "miniflux"; + system.stateVersion = "24.11"; +} diff --git a/microvms/miniflux/miniflux.nix b/microvms/miniflux/miniflux.nix new file mode 100644 index 0000000..9afbe29 --- /dev/null +++ b/microvms/miniflux/miniflux.nix @@ -0,0 +1,22 @@ +{ config, ... }: +{ + sops.secrets."miniflux" = { }; + + services.miniflux = { + enable = true; + createDatabaseLocally = true; + adminCredentialsFile = config.sops.secrets."miniflux".path; + config = { + LISTEN_ADDR = "10.89.88.14:8080"; + BASE_URL = "https://news.oxapentane.com"; + # oauth + DISABLE_LOCAL_AUTH = 1; + CREATE_ADMIN = 0; + OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/"; + OAUTH2_PROVIDER = "oidc"; + OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback"; + OAUTH2_USER_CREATION = 1; + POLLING_FREQUENCY = 37; + }; + }; +} diff --git a/microvms/miniflux/secrets.yaml b/microvms/miniflux/secrets.yaml new file mode 100644 index 0000000..39cb3b9 --- /dev/null +++ b/microvms/miniflux/secrets.yaml @@ -0,0 +1,38 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str] +miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ + cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI + QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X + ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr + KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P + 3b+TwA== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj + YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl + dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa + SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8 + Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN + 4/39SQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5 + bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5 + VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS + ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk + 4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-25T01:09:45Z" + mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/microvms/stream/default.nix b/microvms/stream/default.nix new file mode 100644 index 0000000..2cad795 --- /dev/null +++ b/microvms/stream/default.nix @@ -0,0 +1,77 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:07"; +in +{ + imports = [ + ./navidrome.nix + ]; + + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 7; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-stream"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.17/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "stream"; + system.stateVersion = "25.05"; +} diff --git a/microvms/stream/navidrome.nix b/microvms/stream/navidrome.nix new file mode 100644 index 0000000..0b1cd07 --- /dev/null +++ b/microvms/stream/navidrome.nix @@ -0,0 +1,16 @@ +{ ... }: +{ + services.navidrome = { + enable = true; + settings = { + Address = "10.89.88.17"; + BaseUrl = "/"; + EnableExternalServices = false; + MusicFolder = "/var/lib/navidrome/music"; + Port = 4533; + ScanSchedule = "@every 11m"; + TranscodingCacheSize = "11GiB"; + ReverseProxyWhitelist = "10.89.88.1/24"; + }; + }; +} diff --git a/microvms/stream/secrets.yaml b/microvms/stream/secrets.yaml new file mode 100644 index 0000000..d26d805 --- /dev/null +++ b/microvms/stream/secrets.yaml @@ -0,0 +1,37 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:uZfFc4elxCAVZvdIHJ7lgoPs9qKkD9ZvLhcYbexDcqn0alaMzIr++CY52FI=,iv:CREMt6GrLHs4Jwj/55awDFHh9hQlJPEi4ZQ7ZLMPvRA=,tag:iJAGdqzQbyezmDj+tzjdNQ==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB5Zytw + K1ZKTHBFYy83WU94N3Izczh1RnE4Ry9iRkEvMUxLUUNaTW52MW1ZCjIxWFI3NTJ6 + eXlXYXVVbHQ5Qjkxc0YwSU1MUjRVRi9abFl2dm1QSkx4N00KLS0tIEtaeXgyUzAv + UWhnSjR0TlJyMkpEVlJkaEdNZURXNUhQdXpkcWRYMmxFNDAKFIoZevnllkATCBog + 5R7ntMPrAlub8WnOjZVT5QdMgU3dRmxUnnfXY4PY7QpLNKyjEUxQ/5zvEeogYOSZ + IUVfhA== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBuVVJO + ZS9Ed3NrVEl4ZGRpZURZZVRaZ3pwcTZVRmJmQ3lrdHlQaWYzSjFvCkJQTXNDR2xm + WkhxdnA3RlhPRkpnMWIvS0RzcTRJdEFISlpUb0NaYXVoMlUKLS0tIGZDSGw5QjRG + bW9vUzRSRWk5ZG5rc0tjYjFzSzFuVWpJTExEVDhmdXloZzQKzJrWm1z3KRLSLkxt + ZsmunVoD55HjrFsvPNnVear40c9JB+U3+m1pjdL5eax27lrX/rlvXx7rhzOhtTkN + 9IDAjg== + -----END AGE ENCRYPTED FILE----- + - recipient: age148r2q3cy9sjem37rvgtcc4qjx8usxkdg77pqexa56gmcexn58aaslh3cnj + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNG9vM1FqTVVBSTFYaGt2 + Rkpvci9ibXJyL3ZVbHNYbmF4Umk5ZHJ1bURFCmVjalI0S084R1dsdzdHQ0lZbmcr + SjBXSDRUUGtUQ21wN2kzUmxwZmdKWUkKLS0tIHNjM1pkemxJbWZDNGZ4T01GZVli + b05oNElQQjUrUklpYkR1TCsrTU5uUHMKWB5XybfmmjTfk/c+mRT2PNgsI4q8tbac + nV6pFb97477fcnHH/vpbBD24bixFt/X8A90G3ilbjqL+1rd4G+K7jA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-06-12T22:54:11Z" + mac: ENC[AES256_GCM,data:15EU9VupWfvR8CrfKrX3nhpD60hYB2LY3vuAPvdqzKLliqSqolNj956fOFicfSHvmW/s+7x+M+5FROnOzSbToTZotFtvALQihHH999veGZMx8Q8oIyljT1PBw/SU9djXPI1KjG/zzYOAwu7y/Ffm0QKhMRziH7CQLn30KR0o2w0=,iv:ghdyTvcpgnBi2L9s4UrzwWwt9TeU0WkGquZ64+w9IN8=,tag:4m4hYFgejlEaQROB/OEi6g==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 -- cgit v1.3.1