greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Decompose file a little bit

Browse Source
This commit is contained in:
Greg Hellings
2023-12-13 14:48:38 -06:00
parent 466ffbe852
commit 3c6b405369
2 changed files with 96 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/myself/container-git.nix
+94
View File
@@ -0,0 +1,94 @@
{ inputs, registryPort, ...}:
{ config, pkgs, lib, ... }: {
imports = [
inputs.agenix.nixosModules.default
../../modules-linux/proxy.nix
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secretsMountPoint = "/run/derp";
age.secrets = let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
in {
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 registryPort ];
};
useHostResolvConf = lib.mkForce false;
};
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
services = {
resolved.enable = true;
gitlab = {
enable = true;
backup = {
keepTime = 288;
startAt = [ "03:00" ];
};
host = "src.thehellings.com";
https = false;
port = 443;
extraConfig = {
gitlab = {
trustedProxies = [ "192.168.200.1/32" ];
};
};
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalPort = registryPort;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [ {
name = "gitlab";
ensureDBOwnership = true;
} ];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
redis.servers.gitlab = {
enable = true;
};
};
system.stateVersion = "24.05";
}
hosts/myself/git.nix
+2 -87
View File
@@ -31,6 +31,7 @@ in {
};
greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2";
greg.proxies."myself.shire-zebra.ts.net".target = "http://192.168.200.2";
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
@@ -46,92 +47,6 @@ in {
privateNetwork = true;
hostAddress = "192.168.200.1";
localAddress = "192.168.200.2";
config = { config, pkgs, ... }: {
imports = [
inputs.agenix.nixosModules.default
../../modules-linux/proxy.nix
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secretsMountPoint = "/run/derp";
age.secrets = let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
in {
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 registryPort ];
};
useHostResolvConf = lib.mkForce false;
};
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
services = {
resolved.enable = true;
gitlab = {
enable = true;
backup = {
keepTime = 288;
startAt = [ "03:00" ];
};
host = "isaiah.thehellings.lan"; # Just for now...
https = false;
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalPort = registryPort;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [ {
name = "gitlab";
ensureDBOwnership = true;
} ];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
redis.servers.gitlab = {
enable = true;
};
};
system.stateVersion = "24.05";
};
config = ((import ./container-git.nix) { inherit inputs registryPort; });
};
}