From d4b99047e3554f1efb6f5b298358f4a61a6d70f5 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 11 Jun 2025 18:37:27 -0500 Subject: [PATCH 1/4] Add vm-gitlab --- home/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/home/default.nix b/home/default.nix index 504e188..0de9f49 100644 --- a/home/default.nix +++ b/home/default.nix @@ -36,4 +36,5 @@ in jude = greg "jude"; isaiah = greg "isaiah"; jeremiah = greg "jeremiah"; + vm-gitlab = greg "vm-gitlab"; } From 963757171af7e447db85cdcaf4ea986bc1c890b8 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 11 Jun 2025 20:03:18 -0500 Subject: [PATCH 2/4] New disks for vm-gitlab --- hosts/vm-gitlab/hardware-configuration.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hosts/vm-gitlab/hardware-configuration.nix b/hosts/vm-gitlab/hardware-configuration.nix index a945d9f..ae1216c 100644 --- a/hosts/vm-gitlab/hardware-configuration.nix +++ b/hosts/vm-gitlab/hardware-configuration.nix @@ -34,12 +34,12 @@ }; fileSystems."/" = { - device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + device = "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab"; fsType = "ext4"; }; fileSystems."/boot" = { - device = "/dev/disk/by-uuid/7115-EFA6"; + device = "/dev/disk/by-uuid/1E6A-C3BB"; fsType = "vfat"; options = [ "fmask=0077" From e13bee750cf969f550c245d0cd26226ab16aabf2 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 11 Jun 2025 21:29:20 -0500 Subject: [PATCH 3/4] Make gitlab use remote postgres --- hosts/vm-gitlab/default.nix | 101 +++++++++++++-------------------- secrets/gitlab/db-password.age | Bin 0 -> 2115 bytes secrets/secrets.nix | 1 + 3 files changed, 40 insertions(+), 62 deletions(-) create mode 100644 secrets/gitlab/db-password.age diff --git a/hosts/vm-gitlab/default.nix b/hosts/vm-gitlab/default.nix index 0c4a31d..266e281 100644 --- a/hosts/vm-gitlab/default.nix +++ b/hosts/vm-gitlab/default.nix @@ -33,6 +33,7 @@ in gitlab-secret = cfg "secret"; gitlab-otp = cfg "otp"; gitlab-db = cfg "db"; + gitlab-db-password = cfg "db-password"; gitlab-jws = cfg "jws"; gitlab-key = cfg "key"; gitlab-cert = cfg "cert"; @@ -105,9 +106,11 @@ in keepTime = 288; startAt = [ "03:00" ]; }; - host = "src.thehellings.com"; - https = true; - port = 443; + databaseHost = "postgres.kubernetes"; + databaseName = "gitlab"; + databaseUsername = "gitlab"; + databasePasswordFile = config.age.secrets.gitlab-db-password.path; + databaseCreateLocally = false; extraConfig = { gitlab = { trustedProxies = [ @@ -115,37 +118,6 @@ in "100.115.57.8/32" # Public server's IP ]; }; - }; - initialRootEmail = "greg@thehellings.com"; - initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; - pages = { - enable = true; - settings.pages-domain = "pages.thehellings.com"; - }; - puma = { - threadsMax = 6; - threadsMin = 2; - workers = 6; - }; - redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; - registry = { - enable = true; - certFile = config.age.secrets.gitlab-cert.path; - keyFile = config.age.secrets.gitlab-key.path; - externalAddress = "registry.thehellings.com"; - externalPort = 443; - }; - secrets = { - activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path; - activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path; - activeRecordSaltFile = config.age.secrets.gitlab-salt.path; - dbFile = config.age.secrets.gitlab-db.path; - jwsFile = config.age.secrets.gitlab-jws.path; - otpFile = config.age.secrets.gitlab-otp.path; - secretFile = config.age.secrets.gitlab-secret.path; - }; - - extraConfig = { object_store = { enabled = true; proxy_download = true; # Tell them to reach out to object storage themselves! @@ -182,6 +154,37 @@ in ); }; }; + host = "src.thehellings.com"; + https = true; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + port = 443; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = config.age.secrets.gitlab-cert.path; + keyFile = config.age.secrets.gitlab-key.path; + externalAddress = "registry.thehellings.com"; + externalPort = 443; + }; + secrets = { + activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path; + activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path; + activeRecordSaltFile = config.age.secrets.gitlab-salt.path; + dbFile = config.age.secrets.gitlab-db.path; + jwsFile = config.age.secrets.gitlab-jws.path; + otpFile = config.age.secrets.gitlab-otp.path; + secretFile = config.age.secrets.gitlab-secret.path; + }; }; nginx = { @@ -206,42 +209,16 @@ in }; }; - logrotate = { - enable = true; - settings = { - "/var/lib/postgresql/*/log/*.log" = { - enable = true; - compress = true; - compresscmd = "${pkgs.xz}/bin/xz"; - }; - }; - }; - openssh.enable = true; - postgresql = { - enable = true; - checkConfig = true; - ensureDatabases = [ "gitlab" ]; - ensureUsers = [ - { - name = "gitlab"; - ensureDBOwnership = true; - } - ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - }; + postgresql.enable = true; qemuGuest.enable = true; redis.servers.gitlab = { enable = true; }; + resolved.enable = true; }; diff --git a/secrets/gitlab/db-password.age b/secrets/gitlab/db-password.age new file mode 100644 index 0000000000000000000000000000000000000000..2deed6af3191bdb6abf26392f37657e4daf0a679 GIT binary patch literal 2115 zcmZYAIm`5H6$fw&3z;uq8?mqmx7oKw-XxPu_L*#x#l~!tOxBs~iG_ltg4jPcB9vTH+S!U$FIZSO^?iSW-*wJ)&i_Pt_Lj9tzdgo#*M76>b7)2mZ{Grjp?J$u zlpqiWAn_?G7l1$I1xke86p>9Yv}@qj@YdQ3nctPND^$xQS_7ensi6-mW?>TS&kH6O z9C^mhTHdip1agt(AL|77I0A17U2k{!z1D3)<17GPJZ!tf&VfSXSWA?6>W*vcXlQ}4 zSRI?OXwTVkbFAZV7^OWA&{CX^fl8lrN01~rQ9*A$F}ZV#!lR-ngFtjw5q_^V=jL+D zfl^y zaD#3VL$`w>U4+|MQ@$rA@3la=Tk!&nL_cMi=DE<8-e|?rlj9XZ$Jt1q{x&DGe({iE zGOWH#4k0V#Zmyss(uRtx>V#PH(<1Q>aZEtz+KRaEX`8d+`v)xwP}XMwryKLWBA2R> zJw1Lsw12cIq^u%rSK$^ZZ5sqwCQ%6*9LNgJ7Di-g>2h+apsVQi>LswbyHOW83a7f5 z6M#oQPCxwHYK(2i0=q=4B9W=Hc#@RTl$-e^*)u9lf|mNFj^GR0pH8Rcyi|wv-ZAi_ zRZcGX41AF{(YRM6HSWBbUd-{t8QOihMrTF)ps{9gLvkQ_3WPujLo@VohphM%JPP_s z?}a*Zosrgwp{}uCg^cYUGM8ypdqsT9uS$u#@2P6(Rr-+vLDyTQmSI?7QoohHL*ZzV_-J#xvO;!-|T9SJ+3RgdY z#4;Oa!Oiorybij#Uj{Fe=FWXTCA8amgbA#aW);?|nWM;hm5ObdJf!F*fW9T_#=wIu zg}3byv@7$Vo3~boim=Y$2ASF+fLT)VO*m~Y(&`z#AKwyOyJWUHyw_mJ8`K=|QenLo z4#GiKRT{a44sr$bjq{XnaCl;^#2#y&5{lKw52`|10dC)eWHAP+#1-z2-jg`LhLTp# z{KeN|4!I=!lhxmAMhy`g3sB=iJ(Ia>xt(DXm0veWLkfgka?%d7gx?(? z+(q`#a|f)O(!Gx5#Uh>2?2&D z207N^xmcq)0X^LuM6+;ggl5UWK6MNly_cX_4I>aE5z|MlGzRahK{&@_fStGY6Nj zK2isHb(3`Ao}LqGA8PB`#((6%<2ZrEt9y-rQA;0#%>v)aa#FW`5d}ULV-N)1?;!e%?| zJQ$o7X4uTmVDhWGdBwvtJX{d$ppg%{k}fV-!V-Ees+E*y&2bb^Q_j~L$vHtsU7B8d zR59&-*f%_Tpe_rD5XXr29^*!!;L#H9XD6|iu~N`GwL45n38Z+ruzmMRqo^aQN%i#A zcI;OUdorFPxYn!{F6Vm!p{w({9hxeSOK^C5djr_6YFoSW?bdosBVUE?{UY#pemOqY zPQ`CA_zGb{jardC{O{8*fA{-OfB4I1Km5*jJ>c8mpT7FF;PW5->+hfc;Gh5g;upXE t3izL|fANj)|M&LCf6Ra5eoC(F_kQxTFUP<6?B~Dz(w~(d|Mgd&{ttB+v339e literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 4e09c95..0282f14 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -87,6 +87,7 @@ in "gitlab/secret.age".publicKeys = everyone; "gitlab/otp.age".publicKeys = everyone; "gitlab/db.age".publicKeys = everyone; + "gitlab/db-password.age".publicKeys = everyone; "gitlab/jws.age".publicKeys = everyone; # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' # Then pipe the resulting files to agenix -e From eddbf9292f32c19888af582b45ee26759831c613 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 11 Jun 2025 22:57:09 -0500 Subject: [PATCH 4/4] Fix gitlab. Again --- hosts/linode/git.nix | 6 ++--- hosts/vm-gitlab/default.nix | 53 ++++++++++++++----------------------- modules/nix-conf.nix | 6 ++--- 3 files changed, 25 insertions(+), 40 deletions(-) diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index fdb2b41..e92d052 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -6,7 +6,7 @@ let in { greg.proxies."${srcDomain}" = { - target = "http://git.thehellings.lan"; + target = "http://vm-gitlab.shire-zebra.ts.net"; ssl = true; genAliases = false; extraConfig = '' @@ -16,7 +16,7 @@ in ''; }; greg.proxies."registry.thehellings.com" = { - target = "https://registry.thehellings.lan:5000"; + target = "https://vm-gitlab.shire-zebra.ts.net:5000"; ssl = true; genAliases = false; extraConfig = "client_max_body_size 25000m;"; @@ -44,7 +44,7 @@ in " bind *:${toString sshPort}" " timeout client 1h" " mode tcp" - " server git-thehellings-lan git.thehellings.lan:22" + " server git-thehellings-lan vm-gitlab.shire-zebra.ts.net:22" ]; }; } diff --git a/hosts/vm-gitlab/default.nix b/hosts/vm-gitlab/default.nix index 266e281..c39c78b 100644 --- a/hosts/vm-gitlab/default.nix +++ b/hosts/vm-gitlab/default.nix @@ -11,12 +11,10 @@ let registryPort = 5000; - vpnIp = "100.91.131.66"; - containerIp = "192.168.200.2"; + vpnIp = "100.117.28.111"; in { imports = [ - # Include the results of the hardware scan. ./hardware-configuration.nix ]; @@ -55,30 +53,12 @@ in }; }; - greg.proxies = - let - t = { - target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - client_max_body_size 10000m; - ''; - }; - in - { - "${containerIp}" = t; - "${vpnIp}" = t; - "git.thehellings.lan" = t; - }; - - greg.backup.jobs.nas-backup = { - src = "/var/gitlab/state/backup/"; - dest = "gitlab"; - id = "container-gitlab"; - }; - greg = { + backup.jobs.nas-backup = { + src = "/var/gitlab/state/backup/"; + dest = "gitlab"; + id = "container-gitlab"; + }; home = true; tailscale.enable = true; }; @@ -96,7 +76,7 @@ in cron = { enable = true; systemCronJobs = [ - "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" + "0 0 1 */2 * cd /etc/certs && tailscale cert vm-gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; }; @@ -114,8 +94,8 @@ in extraConfig = { gitlab = { trustedProxies = [ - "${vpnIp}/32" # The container itself - "100.115.57.8/32" # Public server's IP + "${vpnIp}/32" # The system itself + "100.109.86.8/32" # Public server's IP ]; }; object_store = { @@ -188,22 +168,29 @@ in }; nginx = { + enable = true; clientMaxBodySize = "25000m"; - virtualHosts."gitlab.shire-zebra.ts.net" = { + virtualHosts."vm-gitlab.shire-zebra.ts.net" = { listen = [ { addr = "0.0.0.0"; port = registryPort; ssl = true; } + { + addr = "0.0.0.0"; + port = 443; + ssl = true; + } ]; locations."/" = { - proxyPass = "http://127.0.0.1:4567/"; + proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + #proxyPass = "http://127.0.0.1:4567/"; recommendedProxySettings = true; }; extraConfig = '' - ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ; - ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ; + ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ; + ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ; client_max_body_size 10000m ; ''; }; diff --git a/modules/nix-conf.nix b/modules/nix-conf.nix index 4b4b27c..0d5d7c8 100644 --- a/modules/nix-conf.nix +++ b/modules/nix-conf.nix @@ -41,8 +41,7 @@ in ]; # For home and for work machines substituters = (lib.optionals cfg.cache [ - "http://nas.thehellings.lan:9000/binary-cache/" - "http://nas.home:9000/binary-cache/" + "http://chronicles.shire-zebra.ts.net:9000/binary-cache/" ]) ++ [ "https://ai.cachix.org" @@ -52,8 +51,7 @@ in "https://cache.nixos.org" ]; trusted-public-keys = [ - "nix.thehellings.lan:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" - "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" + "chronicles.shire-zebra.ts.net:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU=" "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="