From a38e90adf7d746cc9cb1c1e02a615e32556597fa Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Sun, 26 Jul 2026 08:45:30 +0000 Subject: move microvms to separate folder --- microvms/auth/authentik.nix | 17 +++++++++ microvms/auth/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/auth/secrets.yaml | 39 +++++++++++++++++++++ microvms/forgejo/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/forgejo/forgejo.nix | 70 +++++++++++++++++++++++++++++++++++++ microvms/forgejo/secrets.yaml | 37 ++++++++++++++++++++ microvms/immich/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/immich/immich.nix | 23 +++++++++++++ microvms/immich/immich.yaml | 49 ++++++++++++++++++++++++++ microvms/immich/secrets.yaml | 37 ++++++++++++++++++++ microvms/miniflux/default.nix | 78 ++++++++++++++++++++++++++++++++++++++++++ microvms/miniflux/miniflux.nix | 22 ++++++++++++ microvms/miniflux/secrets.yaml | 38 ++++++++++++++++++++ microvms/stream/default.nix | 77 +++++++++++++++++++++++++++++++++++++++++ microvms/stream/navidrome.nix | 16 +++++++++ microvms/stream/secrets.yaml | 37 ++++++++++++++++++++ 16 files changed, 774 insertions(+) create mode 100644 microvms/auth/authentik.nix create mode 100644 microvms/auth/default.nix create mode 100644 microvms/auth/secrets.yaml create mode 100644 microvms/forgejo/default.nix create mode 100644 microvms/forgejo/forgejo.nix create mode 100644 microvms/forgejo/secrets.yaml create mode 100644 microvms/immich/default.nix create mode 100644 microvms/immich/immich.nix create mode 100644 microvms/immich/immich.yaml create mode 100644 microvms/immich/secrets.yaml create mode 100644 microvms/miniflux/default.nix create mode 100644 microvms/miniflux/miniflux.nix create mode 100644 microvms/miniflux/secrets.yaml create mode 100644 microvms/stream/default.nix create mode 100644 microvms/stream/navidrome.nix create mode 100644 microvms/stream/secrets.yaml (limited to 'microvms') diff --git a/microvms/auth/authentik.nix b/microvms/auth/authentik.nix new file mode 100644 index 0000000..a1257ee --- /dev/null +++ b/microvms/auth/authentik.nix @@ -0,0 +1,17 @@ +{ config, inputs, ... }: +{ + imports = [ + inputs.authentik-nix.nixosModules.default + ]; + sops.secrets."authentik/env" = { }; + services.authentik = { + enable = true; + environmentFile = config.sops.secrets."authentik/env".path; + settings = { + log_level = "debug"; + disable_startup_analytics = true; + avatars = "initials"; + postgresql.host = "/run/postgresql"; + }; + }; +} diff --git a/microvms/auth/default.nix b/microvms/auth/default.nix new file mode 100644 index 0000000..734ef43 --- /dev/null +++ b/microvms/auth/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:01"; +in +{ + imports = [ + ./authentik.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 1; + mem = 2 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-auth"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.11/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "auth"; + system.stateVersion = "24.11"; +} diff --git a/microvms/auth/secrets.yaml b/microvms/auth/secrets.yaml new file mode 100644 index 0000000..87d2f31 --- /dev/null +++ b/microvms/auth/secrets.yaml @@ -0,0 +1,39 @@ +authentik: + env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str] +wg: + 0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE + NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281 + QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ + QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl + W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive + wWGaYQ== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU + TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1 + eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY + WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY + eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV + iaiVrA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt + TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk + OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214 + V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN + 8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-21T00:19:40Z" + mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.3 diff --git a/microvms/forgejo/default.nix b/microvms/forgejo/default.nix new file mode 100644 index 0000000..4e59c1b --- /dev/null +++ b/microvms/forgejo/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:05"; +in +{ + imports = [ + ./forgejo.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 5; + mem = 3 * 1024; + vcpu = 4; + interfaces = [ + { + type = "tap"; + id = "uvm-forgejo"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.15/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "forgejo"; + system.stateVersion = "24.11"; +} diff --git a/microvms/forgejo/forgejo.nix b/microvms/forgejo/forgejo.nix new file mode 100644 index 0000000..965354f --- /dev/null +++ b/microvms/forgejo/forgejo.nix @@ -0,0 +1,70 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + services.forgejo = { + enable = true; + package = pkgs.forgejo; + useWizard = false; + database = { + type = "postgres"; + createDatabase = true; + }; + lfs.enable = true; + settings = { + DEFAULT.APP_NAME = "0xa's compilable shitposts"; + actions.ENABLED = false; + database.LOG_SQL = false; + indexer.REPO_INDEXER_ENABLED = true; + mailer.ENABLED = false; + packages.ENABLED = false; + session.COOKIE_SECURE = true; + server = { + DOMAIN = "git.oxapentane.com"; + SSH_DOMAIN = "git.oxapentane.com"; + ROOT_URL = "https://git.oxapentane.com/"; + PROTOCOL = "http"; + START_SSH_SERVER = true; + BUILTIN_SSH_SERVER_USER = "git"; + SSH_LISTEN_PORT = 2222; + }; + repository = { + DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; + ENABLE_PUSH_CREATE_USER = true; + }; + service = { + REGISTER_EMAIL_CONFIRM = false; + DISABLE_REGISTRATION = true; + }; + oauth2_client = { + ENABLE_AUTO_REGISTRATION = true; + USERNAME = "nickname"; + ACCOUNT_LINKING = "login"; + }; + }; + }; + + # expose forgejo cli + environment.systemPackages = + let + cfg = config.services.forgejo; + forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' + #!${pkgs.runtimeShell} + cd ${cfg.stateDir} + sudo=exec + if [[ "$USER" != forgejo ]]; then + sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' + fi + # Note that these variable names will change + export GITEA_WORK_DIR=${cfg.stateDir} + export GITEA_CUSTOM=${cfg.customDir} + $sudo ${lib.getExe cfg.package} "$@" + ''; + in + [ + forgejo-cli + ]; +} diff --git a/microvms/forgejo/secrets.yaml b/microvms/forgejo/secrets.yaml new file mode 100644 index 0000000..a3d42af --- /dev/null +++ b/microvms/forgejo/secrets.yaml @@ -0,0 +1,37 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB2OXBT + QkRaOERCYmJPdTViMXBqc2FUbGUxZjNkNmlqa2pCQzZ5R1JYT2xjCm51THQ2cTMx + WkV6b2QvWmQ0SHo5Sk0xTFB3NHpXUVRuWExzcy9wQUNQdUEKLS0tIGpvRnFRbUpy + Q3pqbGszM2p1eXFueTF3YXh4T1hzV0ZnOXdYODFRZ0JQcEkKZfPbYqMxfD1Qvu31 + F7nESte4mN8YtUPnMTWHR0uNXWeUBAW2l/pjOOH40B8xHwmG/+4jv5fBVQJc2GKr + 9REjvg== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBjRU9t + MWRoTEFsSFpUb1F4Mis5U0o4N3BldzlkSU53L3EwVTdkY2ZnUkZFCldvTmRNbjhD + eERYOTVob1o1c2xyVzNlbHd6ak5mbnk3dHc5YTB5SXNuR2cKLS0tIGpMRnRORy9k + N1F6a2lsQ2JCTFVHTXFtRTRJZHlUL1ZwVXhhNE9PUm15QlEK7Udv/Nx6FKfhjkBs + /hLzhzbZ3lwjexNhuyER+rpeZ70LtYmKm8EpcVnPdP3H0w5kyVyK31gv4iabpAUv + vNW+Wg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT05nL1Vla1k5S0VpVzY2 + ZXgvOHlycnljMFYrb1g4ZGI0YTBzMytTZWxVCmNKRW9LWld5enNyL2lKVEQyZFlw + RUVOQlFsOXFvaW91VUJUS0w4RWR2ZW8KLS0tIHVpVU8waXVYY1hKTHhneVV5NlVD + TnQ3SFFsd2ZYdlRhQ2MyNzV6SzZJS3MKlAJNMzDPlxBYcyl/AyvApsq825FnOS1s + Etv58L70JbhMgOuJY6tu/4uBAQd2dLphTb8lm4slAQxxtp40pXZ3IA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-02-03T18:25:04Z" + mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/microvms/immich/default.nix b/microvms/immich/default.nix new file mode 100644 index 0000000..9e635d9 --- /dev/null +++ b/microvms/immich/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:03"; +in +{ + imports = [ + ./immich.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 3; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-immich"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.13/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "immich"; + system.stateVersion = "24.11"; +} diff --git a/microvms/immich/immich.nix b/microvms/immich/immich.nix new file mode 100644 index 0000000..bd17dd4 --- /dev/null +++ b/microvms/immich/immich.nix @@ -0,0 +1,23 @@ +{ + config, + ... +}: +{ + sops.secrets."immich.yaml" = { + sopsFile = ./immich.yaml; + owner = config.services.immich.user; + key = ""; + }; + + services.immich = { + enable = true; + host = "10.89.88.13"; + redis.enable = true; + database.createDB = true; + machine-learning.enable = true; + settings = null; # has to contain secrets https://github.com/immich-app/immich/discussions/14815 + environment = { + IMMICH_CONFIG_FILE = config.sops.secrets."immich.yaml".path; + }; + }; +} diff --git a/microvms/immich/immich.yaml b/microvms/immich/immich.yaml new file mode 100644 index 0000000..54075df --- /dev/null +++ b/microvms/immich/immich.yaml @@ -0,0 +1,49 @@ +server: + externalDomain: ENC[AES256_GCM,data:kkgCpF1B7CP9e5q1Z9mjRpnF1A4Vb3cbwq1FSxo=,iv:1QlSv8fHoYr+jZ57AQmGsD7VrR9e64PLHqqgvPPuj/E=,tag:WV55mQh/sAStV69tVHiizw==,type:str] +oauth: + enabled: ENC[AES256_GCM,data:QwT42Q==,iv:BJyMLRvXaz7p9ErktlYVWAHC9Z/q+TymoxlAwuXnJzM=,tag:kguUPvrO6ZVvjvIhT7P/sg==,type:bool] + autoLaunch: ENC[AES256_GCM,data:FmnAGw==,iv:0MhmkDPl7T03PyazLvdAvrAHLulwpuNLfGCK1xR5qr0=,tag:5hsgWYWF/iigMvs+DNeCnA==,type:bool] + autoRegister: ENC[AES256_GCM,data:EkaAlw==,iv:DdzbFyxhowt44kktxNjWDpe/ZhGtKGcviL5TbI9zFSA=,tag:gRtqFAsJWmbmDxXW/e4cjQ==,type:bool] + clientId: ENC[AES256_GCM,data:/ZX0Ez5X499VjzqsfGnNEt2k626EltpLY9TjK6UAalpPJVZ6Qr9O3A==,iv:/EmJ5GCs00FJyZSU5rYlCOUl4FlyuIDwtE8oR9pGwo0=,tag:CTHuJ7hhSFfzndeZL2mk4A==,type:str] + clientSecret: ENC[AES256_GCM,data:+orm+5TLYZ7ogjTNW6TS622/h6bYOc/iRHUc2gpEcLTHNw3ngnLP+omVJ4kCHPIaRWI44b6rnMuq9jDb4ILMSYQeFjK7Xk1TQU3qyMoT/Z8tekqRJ+bfjOA+aF4Tb8dxR6lmwX3iREtG19MYhknc6qYSj450tuB6dFdwigAa5nc=,iv:EsySo7SVy7FdW/s5qstissUCHKh1kyjAxCMF4fXZkrY=,tag:7t9NQdCPljsC8JvuVA7k+g==,type:str] + issuerUrl: ENC[AES256_GCM,data:fxqkJaCp48JrY0xoZ9nqlGUY1ymU5jKMkWDTJc+R3CLzhDdEUhf2ZYCLIwLAWRvXnw==,iv:1Qev2B5XDp9X6TaAJJKA7FPMwUNFtMQE8nzvbRdAyjI=,tag:BJIAty86QYxO/ClWo90R8g==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmE5d3NPM05kblJNbzFS + aWpheFB0dS9QT0RuOERqU3BRdlUrTkRMUjNjCmRKSHNXK29hS1BlWTlBVjVKdkZT + cmd1TGZDOFpYa2txUEdJL1RHYXdrdmMKLS0tIERaMFN3Q3E5UkZabU0xd0ZtUHBZ + Lzd6bFk2ZFZldmpKVEs3aGVJUmozdEEKv8cl7EqA42vUrlUQyisiEKyErjr+cOF9 + 7zBcA9qgwdGDTLaOIdeWd6SrEDBtxqYVW2Clx28CTqEsO+nbHDVRzg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-24T20:10:57Z" + mac: ENC[AES256_GCM,data:+nClWkdsMKGgFqJ9v801/GfF193jNT0NN57NdbF6tDfEiWmM34FP9EQVEUThzA8U+qzBkq1iEyoPA9OdIJnu1EOPT72a7C/cqzfBOoomZS7E+gvp+MhVkoqk2Id4AHSYly0VFjtIiDEY60Z6nvzr5w3rfOZMI3MaHn6cwt+gYZE=,iv:+OmqDPh8ISFoVccgvR+sN7kfXhGT3lSOG5enP3ys/JY=,tag:kCZWLD75TNMb2NodHZKmnQ==,type:str] + pgp: + - created_at: "2025-01-24T20:02:34Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ/8DMoRyd4MkIT7CwtVMskspJYWRseML+0bZe2POGa5CFqb + UoypBr+Isvml0RKdZgrZyGAgcU5OM9uTvPWf/9V4CGGxNn5yM3wpBYO1HNTLrTc1 + c9Xdl3Lj0nOmwyC4oVtKbl2wrLCrfewIoI3Q9AnQuNtnFbgjPvrCCKeHPzE7nOXF + 0Xy6Sy7Wk2HoFrEhztzB8sLEr9UxnMie9Z3p7nKbGoF2mLSoHrUVrVIK/6k+FcIx + tGPGXtysDAIMgkzksicFqM/6y3wcRVhbOJenFczIqb8Rfqeyen7PY53ozHoQpDr7 + 3uBNb8DD+9knqE/Y2fAsZhY39QwiSFR+QB9cePdpq2HlsqOqtD+48p8yBL/DeJ4K + fawzjP7NhgN0r92iMMmSsjUWM9HtXtONPiwwOptPxvWwSicN4fE9+JGQ7BNwtnvZ + 5QepbU33P6PNfEulUCr9+kRVP4apwGP6qWqyZaup4iiKil6AzLS/TBkJmj9eLtUC + /lh2Joih13YZJ5mCUqDuD4HCoZaDkbCgnufUc6u0H9Ox/1hri/V96wuXLT9IBh9U + 6nga/GVhf9T3yAHDaKeJA5/0fFqhh5mTZZuq6fOYQxih4Xmq7cx+F1Qc0NrFWSMb + pj725EzSXfrGCkdL3AT07JgK8DrLFtMu9yOWknZtP+wybKM6NUGevJ8+HUB9hFLS + XgFwgysGIBtTCo86/n/g/F2IIBSHtJ3607fuOHgI/MdC640fBrqcPJ6aznfOcNeX + ZMA2WN1XJTg4oTDKifS658fcN9peXe4ujwVkmTf+2gZUxr9lwOXCrXpAG6xrFHU= + =sCmm + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/microvms/immich/secrets.yaml b/microvms/immich/secrets.yaml new file mode 100644 index 0000000..45637d4 --- /dev/null +++ b/microvms/immich/secrets.yaml @@ -0,0 +1,37 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:4sJGq0MnoKwca2/CHGDzjxqNK9UH2lxByt/xZzhYVzgsmpjl8J5HLbb/xvY=,iv:SOlqtNMxlSp18AQ1j+B9xA8R+0xURkmrtgnACvG4n8s=,tag:5ittu905Pz6go/Otm5ZrBQ==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBxbGRo + emhsNnkrYm8vNWhObGNVQnRJb1BaTzdrbDRmUktYMjRXSGlLQlVnCkd6dHR6Umpt + SXU4TzVMVWxYbDFIcEZPaUVjQURYQStjL1FKdnlXUGxZSlUKLS0tIE9yMEI4bEkw + aVl5Vm9FQUZjZWZIUEZVcTE4OWpUS0VEU1NVMjBvNmNDemMKXSDvFyMt+CiQj+Mo + WMWtregXZ2jMYk8Z9bJDeGQvymJxoUf98qvaTYSDXs1kCvVBrrOToGYHXwZ9j0cf + Uyib0A== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSB2WXNs + dkdyZmtHYU9TYU1LQTNOUk9WYi92NFdBa1ljYll0ZVhGQVQ3WUJNCndCMkZPUmVq + SEhxS25KTEJoS0RPb3lVNVJhUXl0dnkyc0xzUDROazRVM0kKLS0tIEorVnZYbTVa + dkZwWWJhNnJUSGVqMXVJZHFmSGRKYmVXUWRWOGVEbnV2cUUKP4Nuqb4O7kP1okS5 + 9AbA9GC/eu7jXdXQeboEDY40U1yl+nZoCc0PcP5kXKGiMycP/4eaJtyTWVOCAFHq + 4aYVOg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eWFzdE05aCtjQkhZU2V5 + Y3VtRURLbWp3M0NOcG95L09SZktvbHFUNDNvCkVoM3kxYjFRTkw3SU1ZSkFqOUwr + ZHV0R1lNbVdaek5rRXlTODU1N3RCUm8KLS0tIEVYZHVrK0dGTFh6YmQxU09Hd3Az + SXB2bTJQYzRVZ3AwWXdlUjhJRUJWMG8KObHGuGc9xuGGsJhrD7SztKDxMmT28OnA + QtM7P1hEEtlC9uxvB6OXGRstHN7WRBj66hkEObuKuCJepTQE1pMV9w== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-21T17:43:24Z" + mac: ENC[AES256_GCM,data:oSaH4N4EDusCP76dupUzPMzNLZtqUHhmBHdA6sVkwx3kJilj/U+fQjLuBwD2XMxM5Z194yKnSzT+ZCP9b0V0NiOQyVp/ry/e3Hgs3aW0NPAFBPF126/iYts5fenDdonFO9Z85ge8ovorLVrziXLP6QQYCvfJdwh/p4faJdtkhWo=,iv:N7qCXhJFHyw8WNTATXlcwgGHh3d4i3Vr7fABOo8L4P0=,tag:4pZmCPrWxI6NkqkixgLHDg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.3 diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix new file mode 100644 index 0000000..d2f024f --- /dev/null +++ b/microvms/miniflux/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:04"; +in +{ + imports = [ + ./miniflux.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 4; + mem = 1 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-miniflux"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.14/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "miniflux"; + system.stateVersion = "24.11"; +} diff --git a/microvms/miniflux/miniflux.nix b/microvms/miniflux/miniflux.nix new file mode 100644 index 0000000..9afbe29 --- /dev/null +++ b/microvms/miniflux/miniflux.nix @@ -0,0 +1,22 @@ +{ config, ... }: +{ + sops.secrets."miniflux" = { }; + + services.miniflux = { + enable = true; + createDatabaseLocally = true; + adminCredentialsFile = config.sops.secrets."miniflux".path; + config = { + LISTEN_ADDR = "10.89.88.14:8080"; + BASE_URL = "https://news.oxapentane.com"; + # oauth + DISABLE_LOCAL_AUTH = 1; + CREATE_ADMIN = 0; + OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/"; + OAUTH2_PROVIDER = "oidc"; + OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback"; + OAUTH2_USER_CREATION = 1; + POLLING_FREQUENCY = 37; + }; + }; +} diff --git a/microvms/miniflux/secrets.yaml b/microvms/miniflux/secrets.yaml new file mode 100644 index 0000000..39cb3b9 --- /dev/null +++ b/microvms/miniflux/secrets.yaml @@ -0,0 +1,38 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str] +miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ + cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI + QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X + ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr + KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P + 3b+TwA== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj + YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl + dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa + SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8 + Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN + 4/39SQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5 + bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5 + VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS + ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk + 4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-25T01:09:45Z" + mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/microvms/stream/default.nix b/microvms/stream/default.nix new file mode 100644 index 0000000..2cad795 --- /dev/null +++ b/microvms/stream/default.nix @@ -0,0 +1,77 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:07"; +in +{ + imports = [ + ./navidrome.nix + ]; + + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 7; + mem = 3 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-stream"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.17/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "stream"; + system.stateVersion = "25.05"; +} diff --git a/microvms/stream/navidrome.nix b/microvms/stream/navidrome.nix new file mode 100644 index 0000000..0b1cd07 --- /dev/null +++ b/microvms/stream/navidrome.nix @@ -0,0 +1,16 @@ +{ ... }: +{ + services.navidrome = { + enable = true; + settings = { + Address = "10.89.88.17"; + BaseUrl = "/"; + EnableExternalServices = false; + MusicFolder = "/var/lib/navidrome/music"; + Port = 4533; + ScanSchedule = "@every 11m"; + TranscodingCacheSize = "11GiB"; + ReverseProxyWhitelist = "10.89.88.1/24"; + }; + }; +} diff --git a/microvms/stream/secrets.yaml b/microvms/stream/secrets.yaml new file mode 100644 index 0000000..d26d805 --- /dev/null +++ b/microvms/stream/secrets.yaml @@ -0,0 +1,37 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:uZfFc4elxCAVZvdIHJ7lgoPs9qKkD9ZvLhcYbexDcqn0alaMzIr++CY52FI=,iv:CREMt6GrLHs4Jwj/55awDFHh9hQlJPEi4ZQ7ZLMPvRA=,tag:iJAGdqzQbyezmDj+tzjdNQ==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyB5Zytw + K1ZKTHBFYy83WU94N3Izczh1RnE4Ry9iRkEvMUxLUUNaTW52MW1ZCjIxWFI3NTJ6 + eXlXYXVVbHQ5Qjkxc0YwSU1MUjRVRi9abFl2dm1QSkx4N00KLS0tIEtaeXgyUzAv + UWhnSjR0TlJyMkpEVlJkaEdNZURXNUhQdXpkcWRYMmxFNDAKFIoZevnllkATCBog + 5R7ntMPrAlub8WnOjZVT5QdMgU3dRmxUnnfXY4PY7QpLNKyjEUxQ/5zvEeogYOSZ + IUVfhA== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBuVVJO + ZS9Ed3NrVEl4ZGRpZURZZVRaZ3pwcTZVRmJmQ3lrdHlQaWYzSjFvCkJQTXNDR2xm + WkhxdnA3RlhPRkpnMWIvS0RzcTRJdEFISlpUb0NaYXVoMlUKLS0tIGZDSGw5QjRG + bW9vUzRSRWk5ZG5rc0tjYjFzSzFuVWpJTExEVDhmdXloZzQKzJrWm1z3KRLSLkxt + ZsmunVoD55HjrFsvPNnVear40c9JB+U3+m1pjdL5eax27lrX/rlvXx7rhzOhtTkN + 9IDAjg== + -----END AGE ENCRYPTED FILE----- + - recipient: age148r2q3cy9sjem37rvgtcc4qjx8usxkdg77pqexa56gmcexn58aaslh3cnj + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNG9vM1FqTVVBSTFYaGt2 + Rkpvci9ibXJyL3ZVbHNYbmF4Umk5ZHJ1bURFCmVjalI0S084R1dsdzdHQ0lZbmcr + SjBXSDRUUGtUQ21wN2kzUmxwZmdKWUkKLS0tIHNjM1pkemxJbWZDNGZ4T01GZVli + b05oNElQQjUrUklpYkR1TCsrTU5uUHMKWB5XybfmmjTfk/c+mRT2PNgsI4q8tbac + nV6pFb97477fcnHH/vpbBD24bixFt/X8A90G3ilbjqL+1rd4G+K7jA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-06-12T22:54:11Z" + mac: ENC[AES256_GCM,data:15EU9VupWfvR8CrfKrX3nhpD60hYB2LY3vuAPvdqzKLliqSqolNj956fOFicfSHvmW/s+7x+M+5FROnOzSbToTZotFtvALQihHH999veGZMx8Q8oIyljT1PBw/SU9djXPI1KjG/zzYOAwu7y/Ffm0QKhMRziH7CQLn30KR0o2w0=,iv:ghdyTvcpgnBi2L9s4UrzwWwt9TeU0WkGquZ64+w9IN8=,tag:4m4hYFgejlEaQROB/OEi6g==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 -- cgit v1.3.1