diff --git a/home/hosts/lappy/default.nix b/home/hosts/lappy/default.nix deleted file mode 100644 index d8147ea..0000000 --- a/home/hosts/lappy/default.nix +++ /dev/null @@ -1,5 +0,0 @@ -{ ... }: - -{ - -} diff --git a/hosts/lappy/default.nix b/hosts/lappy/default.nix deleted file mode 100644 index fb9dd7e..0000000 --- a/hosts/lappy/default.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ ... }: - -{ - imports = [ - ./hardware-configuration.nix - ]; - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - boot.loader.efi.efiSysMountPoint = "/boot/efi"; - # Graphics, please - greg.gnome.enable = true; - # Set host name - networking.hostName = "lappy"; -} diff --git a/hosts/lappy/hardware-configuration.nix b/hosts/lappy/hardware-configuration.nix deleted file mode 100644 index 19de254..0000000 --- a/hosts/lappy/hardware-configuration.nix +++ /dev/null @@ -1,39 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/63bcc80e-0501-4aef-bb58-30bb83881055"; - fsType = "ext4"; - }; - - fileSystems."/boot/efi" = - { device = "/dev/disk/by-uuid/C617-B2B1"; - fsType = "vfat"; - }; - - swapDevices = - [ { device = "/dev/disk/by-uuid/bc4f24a3-5969-4bcb-95f4-f80109e36ebb"; } - ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp7s0.useDHCP = lib.mkDefault true; - # networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true; - - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index f7b5ea6..b214b5f 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,131 +1,110 @@ { config, pkgs, lib, ... }: - { - imports = [ - ./hardware-configuration.nix - ]; + imports = [ + ./hardware-configuration.nix + ./git.nix + ]; - environment.systemPackages = with pkgs; [ - git - (python3.withPackages (p: with p; [ pip virtualenv ])) - tmux - tree - vim - xonsh - ]; - services = { - openssh.enable = true; - }; - systemd.services = let - def = id: { - enable = true; - ephemeral = false; - extraEnvironment = { - HTTP_PORT_MIN = builtins.toString (8000 + id); - HTTP_PORT_MAX = builtins.toString (8000 + id); - }; - extraLabels = [ "nixos" "isaiah" ]; - extraPackages = with pkgs; [ - config.virtualisation.virtualbox.host.package - curl - gawk - packer - pup - (python3.withPackages (p: with p; [ pip virtualenv ])) - qemu_full - qemu_kvm - xonsh - xorriso - ]; - name = "isaiah-nix-${builtins.toString id}"; - nodeRuntimes = [ "node20" ]; - package = pkgs.github-runner; - replace = true; - runnerGroup = null; - serviceOverrides = { - Group = "vboxusers"; - }; - tokenFile = "/etc/github_token"; - user = "runner"; - url = "https://github.com/greg-hellings/vms"; - workDir = "/home/runner/${builtins.toString id}"; - }; - runner = (import ./runner.nix); - in { - gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); - gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); - gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; }); - gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; }); - gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; }); - }; - networking = { - hostName = "myself"; - useDHCP = false; - defaultGateway = { - address = " 10.42.1.1"; - interface = "enp38s0"; - }; - interfaces.enp38s0 = { - ipv4.addresses = [ { - address = "10.42.1.6"; - prefixLength = 16; - } ]; - }; - nameservers = [ - "10.42.1.5" - ]; - }; - virtualisation = { - libvirtd = { - enable = false; - onBoot = "ignore"; - }; - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; - }; - users = { - users = { - runner = { - extraGroups = [ - "kvm" - "vboxusers" - ]; - group = "runner"; - isNormalUser = true; - }; - greg = { - extraGroups = [ - "kvm" - "sudo" - "vboxusers" - "wheel" - ]; - isNormalUser = true; - }; - }; - groups.runner = {}; - }; - system.stateVersion = lib.mkForce "24.05"; - boot = { - extraModprobeConfig = "options kvm_amd nested=1 vboxdrv"; - supportedFilesystems = [ "ntfs" ]; - loader = { - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot"; - }; - systemd-boot = { - enable = true; - configurationLimit = 10; - }; - }; - }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "nodejs-16.20.2" - ]; - }; + environment.systemPackages = with pkgs; [ + git + (python3.withPackages (p: with p; [ pip virtualenv ])) + tmux + tree + vim + xonsh + ]; + services = { + openssh.enable = true; + }; + systemd.services = let + def = id: { + enable = true; + ephemeral = false; + extraEnvironment = { + HTTP_PORT_MIN = builtins.toString (8000 + id); + HTTP_PORT_MAX = builtins.toString (8000 + id); + }; + extraLabels = [ "nixos" "isaiah" ]; + name = "isaiah-nix-${builtins.toString id}"; + nodeRuntimes = [ "node20" ]; + package = pkgs.github-runner; + replace = true; + runnerGroup = null; + serviceOverrides = { + Group = "vboxusers"; + }; + tokenFile = "/etc/github_token"; + user = "runner"; + url = "https://github.com/greg-hellings/vms"; + workDir = "/home/runner/${builtins.toString id}"; + }; + runner = a: {}; + in { + gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); + gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); + gh-three = (runner { inherit config lib pkgs; svcName = "gh-three"; cfg = def 3; }); + gh-four = (runner { inherit config lib pkgs; svcName = "gh-four"; cfg = def 4; }); + gh-five = (runner { inherit config lib pkgs; svcName = "gh-five"; cfg = def 5; }); + }; + networking = { + hostName = "myself"; + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp38s0"; + }; + interfaces.enp38s0 = { + ipv4.addresses = [ { + address = "10.42.1.6"; + prefixLength = 16; + } ]; + }; + nameservers = [ + "10.42.1.5" + ]; + }; + virtualisation = { + libvirtd = { + enable = false; + onBoot = "ignore"; + }; + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; + users = { + users = { + greg = { + extraGroups = [ + "kvm" + "sudo" + "vboxusers" + "wheel" + ]; + isNormalUser = true; + }; + }; + }; + system.stateVersion = lib.mkForce "24.05"; + boot = { + extraModprobeConfig = "options kvm_amd nested=1 vboxdrv"; + supportedFilesystems = [ "ntfs" ]; + loader = { + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + systemd-boot = { + enable = true; + configurationLimit = 10; + }; + }; + }; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "nodejs-16.20.2" + ]; + }; } diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix new file mode 100644 index 0000000..802423a --- /dev/null +++ b/hosts/myself/git.nix @@ -0,0 +1,120 @@ +{ config, pkgs, lib, ... }: + +let + extraPackages = with pkgs; [ + config.virtualisation.virtualbox.host.package + curl + gawk + packer + pup + (python3.withPackages (p: with p; [ pip virtualenv ])) + qemu_full + qemu_kvm + xonsh + xorriso + ]; + + secretsList = [ + "secret" + "otp" + "db" + "jws" + ]; + + secretsPaths = { + secret = "/var/lib/secret"; + otp = "/var/lib/otp"; + db = "/var/lib/db"; + jws = "/var/lib/jws"; + key = "/var/lib/registry-key"; + cert = "/var/lib/registry-cert"; + }; + + registryPort = 8001; +in { + age.secrets = { + gitlab-secret.file = ../../secrets/gitlab/secret.age; + gitlab-otp.file = ../../secrets/gitlab/otp.age; + gitlab-db.file = ../../secrets/gitlab/db.age; + gitlab-jws.file = ../../secrets/gitlab/jws.age; + gitlab-key.file = ../../secrets/gitlab/key.age; + gitlab-cert.file = ../../secrets/gitlab/cert.age; + }; + + containers.gitlab = { + autoStart = true; + bindMounts = { + "/var/gitlab/state" = { + hostPath = "/var/lib/gitlab"; + }; + "${secretsPaths.secret}".hostPath = config.age.secrets.gitlab-secret.path; + "${secretsPaths.otp}".hostPath = config.age.secrets.gitlab-otp.path; + "${secretsPaths.db}".hostPath = config.age.secrets.gitlab-db.path; + "${secretsPaths.jws}".hostPath = config.age.secrets.gitlab-jws.path; + "${secretsPaths.key}".hostPath = config.age.secrets.gitlab-key.path; + "${secretsPaths.cert}".hostPath = config.age.secrets.gitlab-cert.path; + }; + privateNetwork = true; + hostAddress = "192.168.200.1"; + localAddress = "192.168.20..2"; + config = { config, pkgs, ... }: { + services = { + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "10.42.1.6"; # Just for now... + https = false; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = secretsPaths.cert; + keyFile = secretsPaths.key; + externalPort = registryPort; + }; + secrets = { + secretFile = secretsPaths.secret; + otpFile = secretsPaths.otp; + dbFile = secretsPaths.db; + jwsFile = secretsPaths.jws; + }; + }; + + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [ { + name = "gitlab"; + ensureDBOwnership = true; + } ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; + + redis.servers.gitlab = { + enable = true; + logfile = "/var/log/redis-gitlab.log"; + }; + }; + system.stateVersion = "24.05"; + }; + }; +} diff --git a/hosts/myself/hardware-configuration.nix b/hosts/myself/hardware-configuration.nix index 7a0d889..7d20b31 100644 --- a/hosts/myself/hardware-configuration.nix +++ b/hosts/myself/hardware-configuration.nix @@ -1,51 +1,51 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. { config, lib, pkgs, modulesPath, ... }: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=nixos" ]; - }; + fileSystems."/" = + { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=nixos" ]; + }; - fileSystems."/home" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=home" ]; - }; + fileSystems."/home" = + { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=home" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/29E7-E20C"; - fsType = "vfat"; - }; + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/29E7-E20C"; + fsType = "vfat"; + }; - fileSystems."/myvol" = - { device = "/dev/nvme0n1p1"; - fsType = "btrfs"; - }; + fileSystems."/myvol" = + { device = "/dev/nvme0n1p1"; + fsType = "btrfs"; + }; - swapDevices = [ ]; + swapDevices = [ ]; - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/myself/runner.nix b/hosts/myself/runner.nix deleted file mode 100644 index 8578100..0000000 --- a/hosts/myself/runner.nix +++ /dev/null @@ -1,207 +0,0 @@ -{ config -, lib -, pkgs - -, cfg ? config.services.github-runner -, svcName - -, systemdDir ? "${svcName}/${cfg.name}" - # %t: Runtime directory root (usually /run); see systemd.unit(5) -, runtimeDir ? "%t/${systemdDir}" - # %S: State directory root (usually /var/lib); see systemd.unit(5) -, stateDir ? "%S/${systemdDir}" - # %L: Log directory root (usually /var/log); see systemd.unit(5) -, logsDir ? "%L/${systemdDir}" - # Name of file stored in service state directory -, currentConfigTokenFilename ? ".current-token" - -, ... -}: - -with lib; - -let - workDir = if cfg.workDir == null then runtimeDir else cfg.workDir; - package = cfg.package.override { inherit (cfg) nodeRuntimes; }; -in -{ - description = "GitHub Actions runner"; - - wantedBy = [ "multi-user.target" ]; - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - - environment = { - HOME = workDir; - RUNNER_ROOT = stateDir; - } // cfg.extraEnvironment; - - path = (with pkgs; [ - bash - coreutils - git - gnutar - gzip - ]) ++ [ - config.nix.package - ] ++ cfg.extraPackages; - - serviceConfig = mkMerge [ - { - ExecStart = "${package}/bin/Runner.Listener run --startuptype service"; - - # Does the following, sequentially: - # - If the module configuration or the token has changed, purge the state directory, - # and create the current and the new token file with the contents of the configured - # token. While both files have the same content, only the later is accessible by - # the service user. - # - Configure the runner using the new token file. When finished, delete it. - # - Set up the directory structure by creating the necessary symlinks. - ExecStartPre = - let - # Wrapper script which expects the full path of the state, working and logs - # directory as arguments. Overrides the respective systemd variables to provide - # unambiguous directory names. This becomes relevant, for example, if the - # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory= - # to contain more than one directory. This causes systemd to set the respective - # environment variables with the path of all of the given directories, separated - # by a colon. - writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" '' - set -euo pipefail - - STATE_DIRECTORY="$1" - WORK_DIRECTORY="$2" - LOGS_DIRECTORY="$3" - - ${lines} - ''; - runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg; - newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig); - currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json"; - newConfigTokenPath = "$STATE_DIRECTORY/.new-token"; - currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}"; - - runnerCredFiles = [ - ".credentials" - ".credentials_rsaparams" - ".runner" - ]; - unconfigureRunner = writeScript "unconfigure" '' - copy_tokens() { - # Copy the configured token file to the state dir and allow the service user to read the file - install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}" - # Also copy current file to allow for a diff on the next start - install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}" - } - clean_state() { - find "$STATE_DIRECTORY/" -mindepth 1 -delete - copy_tokens - } - diff_config() { - changed=0 - # Check for module config changes - [[ -f "${currentConfigPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \ - || changed=1 - # Also check the content of the token file - [[ -f "${currentConfigTokenPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \ - || changed=1 - # If the config has changed, remove old state and copy tokens - if [[ "$changed" -eq 1 ]]; then - echo "Config has changed, removing old runner state." - echo "The old runner will still appear in the GitHub Actions UI." \ - "You have to remove it manually." - clean_state - fi - } - if [[ "${optionalString cfg.ephemeral "1"}" ]]; then - # In ephemeral mode, we always want to start with a clean state - clean_state - elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then - # There are state files from a previous run; diff them to decide if we need a new registration - diff_config - else - # The state directory is entirely empty which indicates a first start - copy_tokens - fi - # Always clean workDir - find -H "$WORK_DIRECTORY" -mindepth 1 -delete - ''; - configureRunner = writeScript "configure" '' - if [[ -e "${newConfigTokenPath}" ]]; then - echo "Configuring GitHub Actions Runner" - args=( - --unattended - --disableupdate - --work "$WORK_DIRECTORY" - --url ${escapeShellArg cfg.url} - --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} - --name ${escapeShellArg cfg.name} - ${optionalString cfg.replace "--replace"} - ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"} - ${optionalString cfg.ephemeral "--ephemeral"} - ) - # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option, - # if it is not a PAT, we assume it contains a registration token and use the --token option - token=$(<"${newConfigTokenPath}") - if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then - args+=(--pat "$token") - else - args+=(--token "$token") - fi - ${package}/bin/Runner.Listener configure "''${args[@]}" - # Move the automatically created _diag dir to the logs dir - mkdir -p "$STATE_DIRECTORY/_diag" - cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/" - rm -rf "$STATE_DIRECTORY/_diag/" - # Cleanup token from config - rm "${newConfigTokenPath}" - # Symlink to new config - ln -s '${newConfigPath}' "${currentConfigPath}" - fi - ''; - setupWorkDir = writeScript "setup-work-dirs" '' - # Link _diag dir - ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag" - - # Link the runner credentials to the work dir - ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/" - ''; - in - map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [ - "+${unconfigureRunner}" # runs as root - configureRunner - setupWorkDir - ]; - - # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner) - # to trigger a fresh registration. - Restart = if cfg.ephemeral then "on-success" else "no"; - # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service: - # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146 - RestartForceExitStatus = [ 2 ]; - - # Contains _diag - LogsDirectory = [ systemdDir ]; - # Default RUNNER_ROOT which contains ephemeral Runner data - RuntimeDirectory = [ systemdDir ]; - # Home of persistent runner data, e.g., credentials - StateDirectory = [ systemdDir ]; - StateDirectoryMode = "0700"; - WorkingDirectory = workDir; - - InaccessiblePaths = [ - # Token file path given in the configuration, if visible to the service - "-${cfg.tokenFile}" - # Token file in the state directory - "${stateDir}/${currentConfigTokenFilename}" - ]; - - KillSignal = "SIGINT"; - } - (mkIf (cfg.user != null) { User = cfg.user; }) - cfg.serviceOverrides - ]; -} - diff --git a/overlays/default.nix b/overlays/default.nix index e63fb1d..ec7a7a0 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -52,7 +52,6 @@ in rec { pkgs = final.pkgs; }; inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; - jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {}; libbluray-custom = prev.libbluray.override { withAACS = true; withBDplus = true; diff --git a/overlays/jinja2-cli.nix b/overlays/jinja2-cli.nix deleted file mode 100644 index 4cca67b..0000000 --- a/overlays/jinja2-cli.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - - flake8, - jinja2, - pytestCheckHook, - setuptools, -}: - -buildPythonPackage { - pname = "jinja2-cli"; - version = "0.8.2"; - - src = fetchFromGitHub { - owner = "mattrobenolt"; - repo = "jinja2-cli"; - rev = "0.8.2"; - hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0="; - }; - - propagatedBuildInputs = [ - jinja2 - setuptools - ]; - - checkInputs = [ - flake8 - pytestCheckHook - ]; - - meta = with lib; { - description = "A CLI interface for Jinja2 templates"; - homepage = "https://github.com/mattrobenolt/jinja2-cli"; - license = licenses.bsd2; - maintainers = [ lib.maintainers.greg ]; - }; -} diff --git a/secrets/gitlab/cert.age b/secrets/gitlab/cert.age new file mode 100644 index 0000000..80a6d0f Binary files /dev/null and b/secrets/gitlab/cert.age differ diff --git a/secrets/gitlab/db.age b/secrets/gitlab/db.age new file mode 100644 index 0000000..b55f095 --- /dev/null +++ b/secrets/gitlab/db.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg 5aqdEg4OJNg6Pw10HFpFKoRWZLvaiqsh0UWW2N5ql1Y +JfnQad6DgEqvRT7GJpjg+kFjgkz9P/Dc+rE3azeArOs +-> ssh-ed25519 YJiRbw R7DVCK0kirWs/OhPg4zUGqLMdO1usfDZNnmY5jndSQM +D47/wwjjRuzVSBdd5BG6nL4s1TtAGCBvrdGuwanyV68 +-> ssh-ed25519 Nl/5yA JkVW7aHVpsqPKY9wPoxS2MNCfmYv20Sk+844sNGjQxM +VojCPfa0dUGph/PJjocKVIGC1k9XYLiNfv7CPJyM8BY +-> ssh-ed25519 GdLgCQ WULneYbP+M1DrFX5JLVeCtkHycxtFBm9/x+oUXTu7Uk +2ez2hdvzXfhOePZsVzrVL+9XanmhyqcK/XkLdV43x68 +-> ssh-ed25519 tOH/HQ hHa+OtsIBPtYkDChXg2vhWhYdSqruooaWiPbdk9RgVQ +Ku6StrR8ZICUQEnXeZZ6gXAQp49tbluPKQIAa3KfuCc +-> ssh-ed25519 FpzvfQ DhdgZQSDKgmMmcitO4dHMJAbe+c67tfd8gDScp4Tvgc +h8PAX2B9t6VcqG9W1b0Z5moxD1b9P7Qgex6+ousoi3E +-> ssh-ed25519 kdPvzQ sSSfEIPPvA99/ziU676wPt9uLrHBIXECTuUmszYcZSk +TcssCYpN5wQTPCay8/gOeot1f6FyUK7sEBkhdwPIG3g +-> !Zmpi]O-grease KVI iU\+ he'#C +2O3D +--- Z3aUd7U6jlt1NiGY2oCzZKeD26gsiqB/Ysr+wRp7Y5E +T*#X )>D=>G|ZO2 `Fퟚ`f̎Z3+g=$ҫj1YԌxumqƅ \ No newline at end of file diff --git a/secrets/gitlab/jws.age b/secrets/gitlab/jws.age new file mode 100644 index 0000000..81cef5b --- /dev/null +++ b/secrets/gitlab/jws.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg kNX5PaaipRVvjzMrXxjhlTSJD550eSGoa5zDbI4zQVc +VAWoBCGuVqKgDw7yEi0YkeIlO+YwdxFoEdLVPXO9y0s +-> ssh-ed25519 YJiRbw 9r/cKqXdhpXcDL9S8CDRGLD65Y8yopFGiMmWILtbXG4 +uifiAw7UCRkHc/uvwEnlzc7+2mKuLCYiAMREHzXdWZs +-> ssh-ed25519 Nl/5yA eVSbQEyXXYEBBiMenLZ6uEP/NNlB4pW4GYMaww6KJTg +8L2cYg6eYSFHAeY1jgk3GPDOYQYHsRcSXZDMxDW0hBQ +-> ssh-ed25519 GdLgCQ HDciLBHQg0Nhd8/QVfgY/6aOEfHdWMs2CwWjieKgIBM +/U/EP99DxhcMrhIa9ggQJSczTQCpDf2mzDJI0uXUYZo +-> ssh-ed25519 tOH/HQ ZHmlo/urIFxi8zShOTUqJRuVpFm9RdNtDi6+Fc79dE0 +RC+z3vkORLSFETGPoSbaml7kfA5GG/NK1IwNwn2XD0c +-> ssh-ed25519 FpzvfQ kQHudI+8AYPU9gWEp5rR5UeBoppKtdNONPgNpAGM0mo +025maJUyvy7QQpvv+eW7F0rOBMF3BBrwYHHnvwz67dk +-> ssh-ed25519 kdPvzQ lUYVBtzSufAD2XZmIH3J788y9oTunIFSNjKIOjuFCBM +bvW8hq+4iFgTpDf0zBIcxWwKMq6xkdKgnjm8q3YYYDk +-> NJL_l7-grease y4c : +kVPvEEpHy8iy//hr42NPPa1DWxgrk2+iAy3KqTZ4oQ +--- /muOWusu9T+JEtIWyMOb78bya/kLZ7AJ9VTNJeZrKLw +a{(F!&h,Ncy!66-<˃6tqi3 *WtXi|r?E'42YJ \ No newline at end of file diff --git a/secrets/gitlab/key.age b/secrets/gitlab/key.age new file mode 100644 index 0000000..38d0f7e Binary files /dev/null and b/secrets/gitlab/key.age differ diff --git a/secrets/gitlab/otp.age b/secrets/gitlab/otp.age new file mode 100644 index 0000000..6f3c7d3 --- /dev/null +++ b/secrets/gitlab/otp.age @@ -0,0 +1,20 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg LVJSQ+R7PMpUpKdscHK4alpoivahuvF6hISGdY7gujU +XsmhzzTlEIWo8trvWg7wL6uI6bnHmc71tS8OIz61Xus +-> ssh-ed25519 YJiRbw Nl46Ujkg1RQDQ3jo6MoOWvOuiAce2Vhmk43wDiKC03M +Si/YWv3MSpQAwiD+IQWUD8eWPsWwI19ojsi46+ENr7Y +-> ssh-ed25519 Nl/5yA XDT/tyZ+W5dT1VkBNQcpYMtebHc/37K0hY6kMrtOzl0 +ugulqsgQ5Wp9t7nwhbYvdmL/9YAkpiTF0hJSVPiOvEA +-> ssh-ed25519 GdLgCQ hlBfw0CRRL+d7g5Xxp9zjOVGkO5wy8PAA7ukMCAb5Vg +MDrDCysJ3LJ7o0y/bXkxnx41Bq6Wr0EYEpqeBkbtbPc +-> ssh-ed25519 tOH/HQ 8QGmTG8sbWch2xOFqf9SfLiMY8hLmwIfWMOuHUg+AE4 +3cMeP+NMohzZ8ecMqKEvOo3vta+m1aUtQPBg+jCjyQs +-> ssh-ed25519 FpzvfQ cCNXN61RMnEqcGw199t2xZHug3qVrdtaSkbnqO4Onx8 +MfJHCpsMULqxj2/NSJob24uhFZR0ZhbIh1Arncs9bPw +-> ssh-ed25519 kdPvzQ SDan5OS6ZlZ6+btBx/nDwrPt1kAucMDVZZNlYnAFYA4 +cW6PL2fA8xazBvEe7SjW14o8R4djmCDmtuU8Z1+AEGw +-> }d^ +l78JedCUzpJH0PazQTE3FhpXmW39G5W78avwFQ +--- OvRr3P4ypXczMWZTi7HrsbPEz17jPYAS/k+XScuzEJM +v)WHr/w% +3+rǫK/ￍ*^{:2dbXCd aQ( +7"|L43E=?t߁ \ No newline at end of file diff --git a/secrets/gitlab/secret.age b/secrets/gitlab/secret.age new file mode 100644 index 0000000..19f0a95 Binary files /dev/null and b/secrets/gitlab/secret.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index f3f31e5..64d3428 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,7 +1,8 @@ let linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q"; jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; - systems = [ linode jude ]; + myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; + systems = [ linode jude myself ]; user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; @@ -9,15 +10,17 @@ let user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; + user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; - user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; + user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; users = [ user_genesis_virt + user_ivr user_jude user_linode - user_ivr + user_myself ]; everyone = systems ++ users; @@ -36,4 +39,14 @@ in "linode-forgejo-runner.age".publicKeys = everyone; "jude-forgejo-runner.age".publicKeys = everyone; + + + "gitlab/secret.age".publicKeys = everyone; + "gitlab/otp.age".publicKeys = everyone; + "gitlab/db.age".publicKeys = everyone; + "gitlab/jws.age".publicKeys = everyone; + # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' + # Then pipe the resulting files to agenix -e + "gitlab/key.age".publicKeys = everyone; + "gitlab/cert.age".publicKeys = everyone; }