From 459889d1d2a04bf6bd25776fba6455e9a41d6392 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 16 Oct 2025 17:23:21 -0500 Subject: [PATCH] Add compose and attic configurations Add compose directory to store docker/podman compose files for running on the TrueNAS box Add attic configurations to auto-listen on all my home boxes to upload builds Update nix-conf to support reading from the Attic server --- compose/attic.yaml | 55 +++++++++++++++++++++++++++++++ compose/pinchflat.yaml | 8 +++++ compose/restic.yaml | 19 +++++++++++ home/baseline/tools.nix | 1 + hosts/exodus/default.nix | 4 +++ modules/nix-conf.nix | 2 +- modules/nixos/home.nix | 35 ++++++++++++++++++-- modules/nixos/remote-builder.nix | 33 ++----------------- secrets/attic.age | Bin 0 -> 2450 bytes secrets/compose/attic.env.age | Bin 0 -> 2379 bytes secrets/secrets.nix | 3 ++ 11 files changed, 127 insertions(+), 33 deletions(-) create mode 100644 compose/attic.yaml create mode 100644 compose/pinchflat.yaml create mode 100644 compose/restic.yaml create mode 100644 secrets/attic.age create mode 100644 secrets/compose/attic.env.age diff --git a/compose/attic.yaml b/compose/attic.yaml new file mode 100644 index 0000000..9933aad --- /dev/null +++ b/compose/attic.yaml @@ -0,0 +1,55 @@ +services: + attic: + container_name: attic + image: ghcr.io/zhaofengli/attic:latest + command: ["-f", "/attic/server.toml"] + restart: unless-stopped + ports: + - 8080:8080 + networks: + attic: + pgattic: + volumes: + - /mnt/all/configs/attic/server.toml:/attic/server.toml + - /mnt/all/containers/attic/data:/attic/storage + env_file: + - stack.env + depends_on: + pgattic: + condition: service_healthy + healthcheck: + test: + [ + "CMD-SHELL", + "wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1", + ] + interval: 15s + timeout: 10s + retries: 10 + start_period: 15s + deploy: + resources: + reservations: + cpus: 1.0 + + pgattic: + container_name: pgattic + image: postgres:17.6-alpine + restart: unless-stopped + ports: [] + #- 5432:5432 + networks: + pgattic: + volumes: + - /mnt/all/containers/attic/postgres:/var/lib/postgresql/data + env_file: + - stack.env + healthcheck: + test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"] + interval: 10s + timeout: 5s + retries: 5 + +networks: + attic: + pgattic: diff --git a/compose/pinchflat.yaml b/compose/pinchflat.yaml new file mode 100644 index 0000000..b77ee28 --- /dev/null +++ b/compose/pinchflat.yaml @@ -0,0 +1,8 @@ +services: + pinchflat: + image: ghcr.io/kieraneglin/pinchflat:latest + ports: + - "8945:8945" + volumes: + - "/mnt/all/configs/pinchflat:/config" + - "/mnt/all/video/yt:/downloads" diff --git a/compose/restic.yaml b/compose/restic.yaml new file mode 100644 index 0000000..4d28cf0 --- /dev/null +++ b/compose/restic.yaml @@ -0,0 +1,19 @@ +# Demo of rest-server with prometheus and grafana +version: "2" + +services: + restserver: + image: "restic/rest-server:0.14.0" + volumes: + - /mnt/all/backups:/data + - /mnt/all/configs/certs:/certs + environment: + OPTIONS: >- + --tls + --tls-cert /certs/nas1.shire-zebra.ts.net.crt + --tls-key /certs/nas1.shire-zebra.ts.net.key + --path /data + --prometheus + --debug + ports: + - "30248:8000" diff --git a/home/baseline/tools.nix b/home/baseline/tools.nix index 59ea497..d751a6f 100644 --- a/home/baseline/tools.nix +++ b/home/baseline/tools.nix @@ -3,6 +3,7 @@ home.packages = with pkgs; [ + attic-client dig jqp kubernetes-helm diff --git a/hosts/exodus/default.nix b/hosts/exodus/default.nix index 3cb69a8..b3fb8db 100644 --- a/hosts/exodus/default.nix +++ b/hosts/exodus/default.nix @@ -11,6 +11,10 @@ top.nix-hardware.nixosModules.framework-11th-gen-intel ]; + age.secrets = { + compose-attic.file = ../../secrets/compose/attic.env.age; + }; + boot = { loader = { systemd-boot.enable = true; diff --git a/modules/nix-conf.nix b/modules/nix-conf.nix index 3122e63..0ebaf2e 100644 --- a/modules/nix-conf.nix +++ b/modules/nix-conf.nix @@ -42,7 +42,7 @@ in substituters = (lib.optionals cfg.cache [ "http://chronicles.shire-zebra.ts.net:9000/binary-cache/" - "http://nas1.shire-zebra.ts.net:8080/nixos" + "http://nas1.shire-zebra.ts.net:8080/default" ]) ++ [ "https://ai.cachix.org" diff --git a/modules/nixos/home.nix b/modules/nixos/home.nix index 4c9c8aa..a4684e2 100644 --- a/modules/nixos/home.nix +++ b/modules/nixos/home.nix @@ -1,4 +1,9 @@ -{ config, lib, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.greg.home; @@ -13,7 +18,33 @@ with lib; }; config = mkIf cfg { - time.timeZone = "America/Chicago"; + age.secrets.attic.file = ../../secrets/attic.age; networking.domain = "thehellings.lan"; + time.timeZone = "America/Chicago"; + + systemd.services.attic-client = { + enable = true; + description = "Attic client watch-store service"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "simple"; + Restart = "on-failure"; + RestartSec = "5s"; + }; + preStart = '' + set -x + mkdir -p $XDG_CONFIG_HOME/attic + cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml + ''; + script = "${pkgs.attic-client}/bin/attic watch-store default"; + environment = { + XDG_CONFIG_HOME = "/var/lib/attic-client"; + }; + }; + + systemd.tmpfiles.rules = [ + "d /var/lib/attic-client 0755 root root -" + ]; }; } diff --git a/modules/nixos/remote-builder.nix b/modules/nixos/remote-builder.nix index e11ffbd..94a71d6 100644 --- a/modules/nixos/remote-builder.nix +++ b/modules/nixos/remote-builder.nix @@ -1,7 +1,6 @@ { config, lib, - pkgs, ... }: @@ -40,35 +39,9 @@ with lib; greg.tailscale.enable = true; # The builder user needs to be trusted to submit builds - nix.settings = - let - upload = getExe ( - pkgs.writeShellScriptBin "upload-to-cache.sh" '' - set -eu - set -f - export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path} - export IFS=' ' - ${getExe config.nix.package} store sign --recursive --key-file "${config.age.secrets.private-cache.path}" "$@" - ${getExe config.nix.package} copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" "$@" - '' - ); - uploadRunner = getExe ( - pkgs.writeShellScriptBin "uploade-to-cache-runner.sh" '' - sum=$(printf "$OUT_PATHS" | ${lib.getExe' pkgs.coreutils-full "sha256sum"} | cut -d " " -f1) - ${lib.getExe' config.systemd.package "systemd-run"} \ - --unit "upload-$(${lib.getExe' pkgs.coreutils "date"} +%s%3N)-$sum" \ - --property Type=exec \ - --property CollectMode=inactive \ - --property Group=nixbld \ - ${upload} $OUT_PATHS - '' - ); - in - { - post-build-hook = uploadRunner; - secret-key-files = config.age.secrets.private-cache.path; - trusted-users = [ config.users.users.remote-builder-user.name ]; - }; + nix.settings = { + trusted-users = [ config.users.users.remote-builder-user.name ]; + }; users.users.remote-builder-user = { openssh.authorizedKeys.keys = [ diff --git a/secrets/attic.age b/secrets/attic.age new file mode 100644 index 0000000000000000000000000000000000000000..5d98c479b6573d168323f5326b50582de2451d00 GIT binary patch literal 2450 zcmZXUeeB}|9mYN58xsftJYF<15R|0+XxH^+P4uK)w{=~&wQJX{RRit%vaRpyd*eSx zEn=(vRfq!MNvB9iS+uBu+oVz$n@v>KKx0>%6WaI6Xpb!j?eADWSexBxWco zT3~8ocdbsBd~OfK1v`iH+LA~OoJJ~E$#slc(du*(C~Q11>CuFo&m9`pno3_IiFs!` zEhsyll-ColuQ>i@m7d$IAe$P`(6 zmtIV-nz1!5$AApgs&WYA{8SutTv>@pwd@QeZ^eh81#)HBipG(Vl`9~T=u@;Q>}sOt zbsG^mY7sR>x*a7FlNOZQQ}G#U7ZuvTpiH4L#m@}~mh76qllV}a5v`&vnn05z^B{Jr zg(l6|#4*Pv3KTg)HmnI~Z`YXj%gN37}X~y#k+DCmMddXMw6&WG$5f@LyF^5Ws+i0ry-k*?KG;DYq(Hvr3R|DK*Q7U zd@Mw{EHBVSl?SapI$w@DaihfC5H!eY7T0DWTo7%5DFp+9E8|uNnS_dkTY8GLM(uR!cv3nI!Py$Y`qDTrR_#t(5`&tq z&gT@!SHobQ4Nkt4R>X-#&s5|Vpu@`+6^x@0>_^S1vz-Qkvv^?F*|oede0JR{meELS z%tZpu2XJFm4aF8@%Gk<<4AKUxW+~Lx41iNqRdIOIT%eY3ORPE+6m+el4L2q1oNLk+ z-Km1%DGeC8AX<`j748rtKFIPIuuMQ~l1^3y<8>*dn-!x<4&aF^Ro_^u(5cCS31;vd zD$2Q)d7EI?UfYZZNmVgel-gYnl<_?b><hdbP|*G6z84{9!!;IqiUIz7w~?Bx`rXqbznj?MMW0?Q*~qQfmspNsS< zv}DYHj8OMnTu>uBH5Tv!l&1bFRYd}yE&F|1qWU5&GNj?Lz7G5SnkK<{%dxDcH}41O zqUyGQnTqLat^|7-Iw^Pp@DsK&hU-(D?1oil33a_;tzsgGM{2LkhP@D8G9eDpjo}F5 za%JP{3q0W5Ni`_rnl=hz+J(5`43JF=%!a7J5K2?DSf0Tqm^hro-L=Wti%8k-q+{?| zCDg@Evnz`(MQRjWMS+iu$-ZE=C;cwLcN=uUPH`R(k_l3fwN+s0f=Bv#U|61JPhuPS=&W$eRN80ZGTBab{%da zoHo-$vcKjcmZuPggoIQc28wP#c&nJsWQj&j7I~f5(z(bmiYTFu8UxcYuyi;4!XBw~ zmNP1t7IG(+k!px1qyBa$5i^9RWF4KC07GH#N{S9^lwLd!6K2&w?-7-=azLfo*pH~=Ri&-MUR?RBhT;GN8EYpbroy-5%>qq4_> zc>}{Fe6j8!$O2gprbB(Ua_xocpFB0&LGAIqm;UI6|83pOUGdJjtK|AS-n{SL^{169 zyw~_0Cw{SS_dE3y(;ctB`>VspW>2SssB9s>u;U$?AH&HKRxuZyWZJ( z>F*9cf6p0TJapl6ho8Ig+o!*L!2Qae7k6H+snrN6Zu$p$$!Yh0{F#At+c$1Fd*}6k z*z>nN2R?G-bB~>KsB`S`M{hX$_Io~~{rt)U%IA;lKhxj!e(mVqZ(h;u|KR-VK6_BU zXrtj@{$6eGV~3A*-@WYWzh3_8a{sZbpWfvRPQ3j_^Ooc1efPZ=g7}s%J@mBt{w3ly zzd8MbXOBMh@L#&S4{J{)|9be=M-P7V6?ApG@~U(3doP~*ko0%_PV3)WJ0J00>OOo% zb>CwbLHASpZ#)ls_l4)r{_`8Xeb}MjAHVk2S3bP%J2xvw4x#sbc)?etJMQ|~Ba80t z3x2|#fAsyGHTc2nZ@VM>=a26^>$xu&54_!fa`(Qgo;~-!=a_pQf{x#WVQ1bS?0Wrc ze|l}l_}Ytqd-IOBb{+lWHS(D!e#n0UlD~i2%X^PZ^t&Gno`Rpb_p1EOyWhI*z>dp4 Scz}E9i6_sx@%CMx-1C12JzPov literal 0 HcmV?d00001 diff --git a/secrets/compose/attic.env.age b/secrets/compose/attic.env.age new file mode 100644 index 0000000000000000000000000000000000000000..e0426b8e10f18d535ef99b59014e183c3fa002fb GIT binary patch literal 2379 zcmZXV>&q+!0mci;4@-9s9F9hA}A3s$qUvokxhbJ?Bij+E&K zGm_K_>5vDFva*wx=!1$H7$_BKXpm_gD9hA7SXPQ;MsHu=^B4ShE&0Z0yn zNAwhu_(7TE9l;7XeaE2kwDno2u;%3$E9;pnnRCt0rtU=4Gs5(ECXJ5L(mfOFb+;yW zo{1r$AkGS<4yNN>o@xAaYp-ctm2su7h$LAPLxM;JB&bl1yc!6 z0f7Q!ax~?}bx%nrDGf$|+hj3p)d6O}aMY<$O;b^WTkk={Ym30$Az~P5Q!UXd3Wkt& z?%7JZitJE1N^@+8u!wF;8}-^?CJgMV(3IeI!ETJ}0*coS4TY-dOp2_RuMu*ScWjAF z7PcAbMGvFddDVBIayHvyHEk}1!BN`4 zNM@+gUA40&M)v+ZVyCSZtd$|KqfIhw*ev%sZEX(5B;}F=53W1-WXvx5jR>eco!du@ zW{3%8F-)1#uAJnfi4%{E5#_ACbF}q)vwZ4z`EoNB^-(Qt@nAGoO#pFhx$i@xb|j+l zh|z{#rMe@|^!uHqhwZIJARhK20@(eI8v@DF<8)D5aOx8G^x3LeZM=1+5=XU(n;yC+ zx&kIs+|=i1Lryqc7j-X=Zchu0ny949 ztsDd1z=ZAYjHHkE%zVVA=X8==@;;?>snl)v{lu;cTPpQxxE?Lg)>#L0vTBe4y>EhS zzz0$h)#Hw~Sb?UY3~h8fn{Ob^T<;dLZ>ef8Asn3Jr5sJxP7jU6bDS)sQE#Ml**Jvy z_0|#Hs8u~{OZMz2h-XED_)e~?5X}f8E5m9=)SXegS66y95DSeR+ASq8ASOp}oJ9#b zl@M&uQoEFJjUX|OI>}~jwNkn=sE~lw$1K_DOAWK?ag9*g<7KZj2z{y5;Fy+|oHF(P zpWB$WLB}ZeDH$1U-pooXJKWhEQ2fYt3XM#79^G&p3!al(w3Mq>>8kAl(YMBUL(up( z1^}}`0AU7h@i0{RiAAAf9v>QW4{PcUxlHwm0|WMoC#>;yu%`%iv0!HOoCsIgcD@~i zQehMtzdT1I>9wQ7 zpf9ZhQ%qfVx`71Kq^e|-uyQplM7dC)A`BMFIa@*{0p0hzLa91Mwcan-pa2XRT16ft zCP2S8L|I2HQ`jwOkiwuH%X9{{7ILetAs3uF4O7Y$@Hw88rIYued3ty>1TXJp(Q(D} zXl{s?K?c!9irj9-PU>Mmsk#-QK#(?Tf>e*jem;dIs;btJSTUAKbYhHQ__(aqxw!W$ zLNc<%%KKZ5V;Y+4uUv|mAi`=g48_BLJ2>dZB-N`jb~6y>sen&1%+GoifQmcJ5vTn! zutIuV?>Kr`8l6v_y5J`-&0F#KYgZ+AoY(u@J3hFnAHMKkl<$1~%3nWy!SIgs#Y@5~ zyO*EdepkQr%sn@~{?@lYh<*5#cb}*qs^8?;4_$oCs}H>Y)HQl;-gomqu6U&X_a|P| z-}cPk{(04f?>QEn_xfjk|L>RHe6;@36<6MP!R^;V-AA9g{+?ss`0b6sMD__n;B|`8jX!!VSMW{psV`4^RF4 zw0qI9ujyyL|I)#qo+@s!zxtnFo{dj@=T%9%>F(>keA~&tyli~p$v^&d|MDpR_T;md z8Ljo#tKWO)+4|xazWMwUk9_6%hrjjUn_sx=ZU24tlKSPR-*waLZ(MJ3um0@B-3KSH zec;6B&%W>e^G_uZbLVrXPrepB_JK3E{^p~{Z}{RnFZ;+XAA8H0gG*07{)f(S;mN6d e{sZ@Z&-}sZXI{YXekeIxJbwRUlsUQYuKxjgFEecb literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 2fa244c..a65b746 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -60,6 +60,7 @@ in "jude-forgejo-runner.age".publicKeys = everyone; "minio.age".publicKeys = everyone; + "attic.age".publicKeys = everyone; "cache-private-key.age".publicKeys = [ jeremiah isaiah @@ -119,4 +120,6 @@ in user_jeremiah user_jude ]; + + "compose/attic.env.age".publicKeys = everyone; }