Merge branch 'main' of gh:greg-hellings/nixos-config
This commit is contained in:
Greg Hellings
@@ -1,3 +1,5 @@
|
||||
[](https://garnix.io)
|
||||
|
||||
This is a unified repo to contain my personal configurations for NixOS machines.
|
||||
|
||||
# How To Use This
|
||||
@@ -11,22 +13,12 @@ Go through the normal process to setup a NixOS system during installation.
|
||||
/etc/nixos folder
|
||||
5. Run the configuration generator. It should only genreate the hardware-configuration.nix
|
||||
file, which this repo gitignores
|
||||
6. Symlink the folder for the appropriate host to the location 'host' as such:
|
||||
`ln -s hosts/myhost host`.
|
||||
7. Run the nixos installation command
|
||||
6. Create a folder and file with the machine name in `hosts/<machine>/default.nix`
|
||||
7. Add `hosts/default.nix` an appropriate entry for the machine you are building
|
||||
8. Create a file `home/hosts/<machine>/default.nix` with the new machine name as well
|
||||
|
||||
# Adding new hosts
|
||||
|
||||
To add a new host, create a folder in the directory `hosts/` that matches the name of
|
||||
the target system. Each host must contain, minimally, a `default.nix` file that serves
|
||||
as the basis of configuring that host.
|
||||
|
||||
## Profiles
|
||||
|
||||
Certain shared characteristics can be created in the `profiles/` folder and included in
|
||||
a particular host's configuration. For instance, any hosts that are running on a
|
||||
Raspsberry Pi 4 should include the `profiles/rpi4.nix` file to properly configure things
|
||||
like the kernel and boot parameters. Since I live in the "America/Chicago" timezone, hosts
|
||||
that run in my home will also include `profiles/home.nix`. That file will also set the
|
||||
domain that I use for my hosts at home. This allows shared content to be reused across
|
||||
multiple machines without the need to repeat it.
|
||||
|
||||
Generated
+17
-17
@@ -274,6 +274,22 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix23_05": {
|
||||
"locked": {
|
||||
"lastModified": 1702759837,
|
||||
"narHash": "sha256-u3XeJVRe/Q975nwFE+6ALEwypMKJEELMJKDAhSKyq3M=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b2566f4f897ac6224e094b167d9488d03e157f28",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-23.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixneovim": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
@@ -372,22 +388,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpy311": {
|
||||
"locked": {
|
||||
"lastModified": 1698696950,
|
||||
"narHash": "sha256-FHFL58t6lMumvWqwundC8fDDDLOIvc+JJBNIAlPjrDY=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "017ef2132a5bda50bd713aeabce8f918502d4ec1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-23.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixstable": {
|
||||
"locked": {
|
||||
"lastModified": 1702233072,
|
||||
@@ -502,8 +502,8 @@
|
||||
"flake-utils": "flake-utils",
|
||||
"hm": "hm",
|
||||
"hmunstable": "hmunstable",
|
||||
"nix23_05": "nix23_05",
|
||||
"nixneovim": "nixneovim",
|
||||
"nixpy311": "nixpy311",
|
||||
"nixstable": "nixstable",
|
||||
"nixunstable": "nixunstable",
|
||||
"nurpkgs": "nurpkgs",
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
inputs.nixpkgs.follows = "nixstable";
|
||||
};
|
||||
nixneovim.url = "github:NixNeovim/NixNeovim";
|
||||
nixpy311.url = "github:NixOS/nixpkgs/nixos-23.05";
|
||||
nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05";
|
||||
nixstable.url = "github:nixos/nixpkgs/nixos-23.11";
|
||||
nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
nurpkgs.url = "github:nix-community/NUR";
|
||||
@@ -37,7 +37,7 @@
|
||||
hm,
|
||||
hmunstable,
|
||||
nixneovim,
|
||||
nixpy311,
|
||||
nix23_05,
|
||||
nixstable,
|
||||
nixunstable,
|
||||
nurpkgs,
|
||||
@@ -48,7 +48,8 @@
|
||||
let
|
||||
pkg-sets = (
|
||||
final: prev: {
|
||||
unstable = import inputs.nixunstable { system = final.system; };
|
||||
unstable = import inputs.nixunstable { system = final.system; inherit overlays; };
|
||||
nix23_05 = import inputs.nix23_05 { system = final.system; inherit overlays; };
|
||||
}
|
||||
);
|
||||
local_overlay = import ./overlays;
|
||||
|
||||
+2
-3
@@ -1,8 +1,7 @@
|
||||
builds:
|
||||
include:
|
||||
- '*.x86_64-linux.*'
|
||||
- '*.aarch64-linux.*'
|
||||
- nixosConfigurations.*
|
||||
- darwinConfigurations.*
|
||||
- devShell.x86_64-linux
|
||||
- devShell.aarch64-linux
|
||||
- homeConfigurations.greghellings.activationPackage
|
||||
- nixosConfigurations.*
|
||||
|
||||
+4
-2
@@ -4,8 +4,8 @@
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
"gregory.hellings" =
|
||||
rec {
|
||||
greghellings =
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
pkgs = (import inputs.nixunstable { inherit system overlays; });
|
||||
@@ -20,4 +20,6 @@
|
||||
username = "gregory.hellings";
|
||||
};
|
||||
};
|
||||
|
||||
"gregory.hellings" = greghellings;
|
||||
}
|
||||
|
||||
@@ -41,7 +41,6 @@
|
||||
gh
|
||||
git
|
||||
gnupatch
|
||||
gregpy
|
||||
hms
|
||||
htop
|
||||
inetutils
|
||||
|
||||
@@ -1,10 +1,21 @@
|
||||
{ pkgs, lib, inputs, ...}:
|
||||
|
||||
{
|
||||
let
|
||||
py = pkgs.nix23_05.python311.withPackages ( p: with p; [
|
||||
django
|
||||
djangorestframework
|
||||
django-rapyd-modernauth
|
||||
environs
|
||||
#itg-django-utils
|
||||
mysqlclient
|
||||
ruamel-yaml
|
||||
tox
|
||||
]);
|
||||
in {
|
||||
imports = [
|
||||
../../vscodium.nix
|
||||
];
|
||||
|
||||
greg.pypackage = py;
|
||||
home = {
|
||||
packages = with pkgs; [
|
||||
aacs
|
||||
@@ -13,7 +24,7 @@
|
||||
direnv
|
||||
home-manager
|
||||
insomnia
|
||||
pipenv
|
||||
pipenv-ivr
|
||||
];
|
||||
file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
|
||||
"[global]"
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
|
||||
}
|
||||
@@ -3,6 +3,7 @@
|
||||
{
|
||||
imports = [
|
||||
./gnome.nix
|
||||
./python.nix
|
||||
./xonsh.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
options.greg.pypackage = lib.mkOption {
|
||||
description = "Enable Gnome support and settings";
|
||||
type = lib.types.package;
|
||||
default = pkgs.gregpy;
|
||||
};
|
||||
|
||||
config.home.packages = [ config.greg.pypackage ];
|
||||
}
|
||||
+1
-1
@@ -27,7 +27,7 @@
|
||||
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas;
|
||||
|
||||
gh = { user = "git"; hostname = "github.com"; };
|
||||
"src" = { user = "gitea"; hostname = "src.thehellings.com"; };
|
||||
"src" = { user = "forgejo"; hostname = "src.thehellings.com"; };
|
||||
|
||||
"*.thehellings.lan" = owned;
|
||||
"10.42.*" = owned;
|
||||
|
||||
@@ -49,7 +49,6 @@ in {
|
||||
};
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = machine { name = "linode"; };
|
||||
lappy = machine { name = "lappy"; };
|
||||
mm = unstable { name = "mm"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
|
||||
@@ -10,12 +10,20 @@
|
||||
./postgres.nix
|
||||
./synapse.nix
|
||||
];
|
||||
greg.home = false;
|
||||
greg.linode.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
networking.hostName = "linode";
|
||||
networking.domain = "thehellings.com";
|
||||
greg = {
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [
|
||||
"100.88.91.27"
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
forgejo
|
||||
gitea-actions-runner
|
||||
graphviz
|
||||
|
||||
+26
-118
@@ -2,130 +2,38 @@
|
||||
|
||||
let
|
||||
srcDomain = "src.thehellings.com";
|
||||
ciDomain = "ci.thehellings.com";
|
||||
ciPort = "17080";
|
||||
droneDir = "/var/lib/drone";
|
||||
execWorkDir = "/var/lib/drone-exec";
|
||||
droneWorkerEnvironment = {
|
||||
DRONE_RPC_PROTO = "https";
|
||||
DRONE_RPC_HOST = ciDomain;
|
||||
DRONE_RUNNER_CAPACITY = "2";
|
||||
DRONE_RUNNER_NAME = "docker";
|
||||
};
|
||||
in {
|
||||
|
||||
environment.systemPackages = [ pkgs.drone-runner-exec ];
|
||||
##########################################################################################
|
||||
###########
|
||||
# GIT SERVICES
|
||||
##########
|
||||
##########################################################################################
|
||||
services = {
|
||||
forgejo = rec {
|
||||
enable = true;
|
||||
package = pkgs.unstable.forgejo;
|
||||
database = {
|
||||
type = "postgres";
|
||||
user = "forgejo";
|
||||
};
|
||||
dump = {
|
||||
enable = true;
|
||||
type = "tar.xz";
|
||||
};
|
||||
settings = {
|
||||
actions.ENABLED = true;
|
||||
DEFAULT = {
|
||||
APP_NAME = "Greg's Sources";
|
||||
};
|
||||
server = rec {
|
||||
ROOT_URL = "https://${DOMAIN}/";
|
||||
DOMAIN = srcDomain;
|
||||
HTTP_PORT = 3001;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = pkgs.lib.mkForce true;
|
||||
session.COOKIE_SECURE = pkgs.lib.mkForce true;
|
||||
log.level = "Info";
|
||||
};
|
||||
};
|
||||
|
||||
# For now, at least, this is the same as Forgejo's action runner
|
||||
gitea-actions-runner.instances = {
|
||||
exec = {
|
||||
enable = true;
|
||||
hostPackages = with pkgs; [
|
||||
bashInteractive
|
||||
podman
|
||||
git
|
||||
nodejs
|
||||
];
|
||||
name = "Linode";
|
||||
labels = [
|
||||
"native:host"
|
||||
];
|
||||
tokenFile = config.age.secrets.forgejo-runner.path;
|
||||
url = "https://src.thehellings.com";
|
||||
settings = {
|
||||
log.level = "info";
|
||||
runner = {
|
||||
file = ".runner";
|
||||
capacity = 3;
|
||||
envs = {}; # Environment variables
|
||||
env_file = ".env";
|
||||
timeout = "3h"; # This is the default on Gitea/Forgejo as well
|
||||
insecure = false; # TLS verification
|
||||
fetch_timeout = "5s";
|
||||
fetch_interval = "2s";
|
||||
#labels = []; # See above
|
||||
};
|
||||
cache = {
|
||||
enabled = true;
|
||||
dir = ""; # Default is $HOME/.cache/actcache
|
||||
host = ""; # How to access cache from the runner, autodetect
|
||||
port = 0;
|
||||
external_server = ""; #We are not going externally
|
||||
};
|
||||
container = {
|
||||
network = ""; # Auto-create
|
||||
privileged = false;
|
||||
options = null;
|
||||
workdir_parent = "/workspace";
|
||||
valid_volumes = [];
|
||||
#docker_host = "";
|
||||
force_pull = false;
|
||||
};
|
||||
host = {
|
||||
workdir_parent = null; # Default $HOME/.cache/act
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
forgejo = {
|
||||
enable = true;
|
||||
files = "${config.services.forgejo.dump.backupDir}/*";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.forgejo-runner = {
|
||||
file = ../../secrets/linode-forgejo-runner.age;
|
||||
owner = config.systemd.services.gitea-runner-exec.serviceConfig.User;
|
||||
};
|
||||
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "${config.services.forgejo.settings.server.PROTOCOL}://${config.services.forgejo.settings.server.DOMAIN}:${toString config.services.forgejo.settings.server.HTTP_PORT}";
|
||||
target = "http://git.thehellings.lan";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
greg.backup.jobs.forgejo = {
|
||||
src = config.services.forgejo.dump.backupDir;
|
||||
dest = "forgejo";
|
||||
user = "forgejo";
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = builtins.concatStringsSep "\n" [
|
||||
"global"
|
||||
" daemon"
|
||||
" maxconn 20"
|
||||
|
||||
"defaults"
|
||||
" timeout connect 500s"
|
||||
" timeout client 500s"
|
||||
" timeout server 1h"
|
||||
|
||||
"frontend gitsshd"
|
||||
" bind *:2222"
|
||||
" default_backend gitssh"
|
||||
" timeout client 1h"
|
||||
|
||||
"backend gitssh"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:2222"
|
||||
];
|
||||
};
|
||||
|
||||
##########################################################################################
|
||||
|
||||
@@ -26,10 +26,17 @@
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
greg.proxies."192.168.200.2" = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
services = {
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
@@ -37,7 +44,7 @@
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = false;
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
inputs:
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
shellcheck
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
in {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secrets.qemu-runner-reg-1 = {
|
||||
file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
|
||||
networking.useHostResolvConf = pkgs.lib.mkForce false;
|
||||
networking.nameservers = [ "100.100.100.100" ];
|
||||
services.resolved.enable = true;
|
||||
|
||||
environment.systemPackages = extraPackages;
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services.shell = {
|
||||
executor = "shell";
|
||||
registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path;
|
||||
tagList = [ "shell" "qemu" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ];
|
||||
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{ inputs, name, extra ? {} }:
|
||||
|
||||
({ config, pkgs, lib, ... }:
|
||||
let
|
||||
py = (pkgs.python3.withPackages (p: with p; [
|
||||
pip
|
||||
pyyaml
|
||||
virtualenv
|
||||
]));
|
||||
in (
|
||||
lib.attrsets.recursiveUpdate {
|
||||
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
p7zip
|
||||
packer
|
||||
pup
|
||||
py
|
||||
shellcheck
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
];
|
||||
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
tagList = [ "shell" name ];
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [ "network-online.target" "systemd-resolved.service" ];
|
||||
after = [ "network.target" "network-online.target" "systemd-resolved.service" ];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
||||
extra
|
||||
) # End of attrsets.recursiveUpdate
|
||||
) # End of outter function wrapper
|
||||
@@ -36,16 +36,6 @@
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = false;
|
||||
onBoot = "ignore";
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
|
||||
+130
-16
@@ -1,22 +1,15 @@
|
||||
{ config, pkgs, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
config.virtualisation.virtualbox.host.package
|
||||
curl
|
||||
gawk
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
|
||||
registryPort = 8001;
|
||||
|
||||
container = input: (lib.attrsets.recursiveUpdate {
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
privateNetwork = true;
|
||||
} input);
|
||||
in {
|
||||
networking = {
|
||||
firewall = {
|
||||
@@ -30,22 +23,143 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
containers.gitlab = {
|
||||
containers.gitlab = container {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/var/gitlab/state" = {
|
||||
hostPath = gitlabStateDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/etc/ssh".hostPath = "/etc/ssh";
|
||||
};
|
||||
privateNetwork = true;
|
||||
forwardPorts = [{
|
||||
hostPort = 2222;
|
||||
containerPort = 22;
|
||||
}];
|
||||
hostAddress = "192.168.200.1";
|
||||
localAddress = "192.168.200.2";
|
||||
config = ((import ./container-git.nix) { inherit inputs registryPort; });
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
"container@gitlab-runner-qemu" = {
|
||||
conflicts = [
|
||||
"container@gitlab-runner-vbox.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [ "rmmod kvm_amd kvm" ];
|
||||
ExecPreStart = [ "modprobe kvm" ];
|
||||
};
|
||||
};
|
||||
"container@gitlab-runner-vbox" = {
|
||||
conflicts = [
|
||||
"container@gitlab-runner-qemu.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ];
|
||||
ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### QEmu Runner ####################################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-qemu = container {
|
||||
bindMounts = {
|
||||
"/dev/kvm" = {
|
||||
hostPath = "/dev/kvm";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
extraFlags = [
|
||||
"--property=DeviceAllow=/dev/kvm"
|
||||
];
|
||||
hostAddress = "192.168.201.1";
|
||||
localAddress = "192.168.201.2";
|
||||
config = ((import ./container-runner-qemu.nix) inputs);
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Virtualbox Runner ##############################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-vbox = container {
|
||||
bindMounts = {
|
||||
"/dev/vboxdrv" = {
|
||||
hostPath = "/dev/vboxdrv";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/vboxdrvu" = {
|
||||
hostPath = "/dev/vboxdrvu";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/vboxnetctl" = {
|
||||
hostPath = "/dev/vboxnetctl";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
hostAddress = "192.168.202.1";
|
||||
localAddress = "192.168.202.2";
|
||||
config = ((import ./container-runner-vbox.nix) {
|
||||
inherit inputs;
|
||||
name = "vbox";
|
||||
extra = {
|
||||
systemd.services.gitlab-runner.serviceConfig = {
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
virtualisation.virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
enableHardening = false;
|
||||
headless = true;
|
||||
};
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner-vbox.nix) {
|
||||
inherit inputs;
|
||||
name = "shell";
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = false;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "debian:stable";
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
#users.users.gitlab-runner.extraGroups = [ "docker" ];
|
||||
}
|
||||
|
||||
@@ -14,7 +14,7 @@ let
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
'';
|
||||
'' + dest.extraConfig;
|
||||
};
|
||||
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
|
||||
};
|
||||
@@ -63,6 +63,12 @@ in with lib; {
|
||||
description = "The path prefix for this proxy";
|
||||
default = "/";
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.str;
|
||||
description = "Extra nginx config options";
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
|
||||
@@ -33,6 +33,8 @@ in rec {
|
||||
pythonPackagesExtensions = (prev.pythonPackagesExtensions or []) ++ [
|
||||
(python-final: python-prev: let cp = python-final.callPackage; in {
|
||||
django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix {};
|
||||
graypy = cp ./graypy.nix {};
|
||||
itg-django-utils = cp ./itg-django-utils.nix {};
|
||||
xonsh-apipenv = cp ./xonsh-apipenv.nix {};
|
||||
xonsh-direnv = cp ./xonsh-direnv.nix {};
|
||||
xontrib-vox = cp ./xonsh-vox.nix {};
|
||||
@@ -63,6 +65,7 @@ in rec {
|
||||
handbrake = prev.handbrake.override {
|
||||
libbluray = libbluray-custom;
|
||||
};
|
||||
pipenv-ivr = prev.callPackage ./pipenv.nix { };
|
||||
|
||||
xonsh = prev.xonsh.overridePythonAttrs (old: rec{
|
||||
python3 = final.gregpy;
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
lib,
|
||||
buildPythonPackage,
|
||||
fetchFromGitHub,
|
||||
|
||||
amqplib,
|
||||
mock,
|
||||
pytestCheckHook,
|
||||
requests,
|
||||
}:
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "graypy";
|
||||
version = "2.1.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "severb";
|
||||
repo = "graypy";
|
||||
rev = "2.1.0";
|
||||
hash = "sha256-y1HbJEpqnAgOeB+zXKy3iUT6Lpv0bufjL7+jWUSAjFs=";
|
||||
};
|
||||
|
||||
nativeCheckInputs = [
|
||||
amqplib
|
||||
mock
|
||||
pytestCheckHook
|
||||
requests
|
||||
];
|
||||
|
||||
meta = with lib; {
|
||||
description = "Python logging handlers that send messages in the Graylog Extended Log Format (GELF).";
|
||||
homepage = "https://github.com/severb/graypy";
|
||||
license = licenses.bsd3;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
lib,
|
||||
buildPythonPackage,
|
||||
fetchurl,
|
||||
|
||||
django,
|
||||
djangorestframework,
|
||||
graypy,
|
||||
setuptools,
|
||||
}:
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "itg-django-utils";
|
||||
version = "0.1.11";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://pypi.ivrtechnology.com/packages/itg-django-utils-0.1.12.tar.gz";
|
||||
hash = "sha256-LbOl4L4UZbRTlLuBL4L3ser6+WDuP3R5a03EIh1xSK8=";
|
||||
};
|
||||
|
||||
propagatedBuildInputs = [
|
||||
django
|
||||
djangorestframework
|
||||
graypy
|
||||
setuptools
|
||||
];
|
||||
|
||||
meta = with lib; {
|
||||
description = "ITG specific stuff";
|
||||
homepage = "http://www.ivrtechnology.com";
|
||||
maintainers = [];
|
||||
};
|
||||
|
||||
doCheck = false;
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
{ lib
|
||||
, stdenv
|
||||
, python3
|
||||
, fetchFromGitHub
|
||||
, installShellFiles
|
||||
}:
|
||||
|
||||
with python3.pkgs;
|
||||
|
||||
let
|
||||
|
||||
runtimeDeps = ps: with ps; [
|
||||
certifi
|
||||
setuptools
|
||||
pip
|
||||
virtualenv
|
||||
virtualenv-clone
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isAndroid [
|
||||
pyjnius
|
||||
];
|
||||
|
||||
pythonEnv = python3.withPackages runtimeDeps;
|
||||
|
||||
in buildPythonApplication rec {
|
||||
pname = "pipenv";
|
||||
version = "2023.11.15";
|
||||
format = "pyproject";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "pypa";
|
||||
repo = "pipenv";
|
||||
rev = "refs/tags/v${version}";
|
||||
hash = "sha256-kxwyws22xJkqBy/hXXcAPHZR2NgZHbmwZr9vYqce434=";
|
||||
};
|
||||
|
||||
env.LC_ALL = "en_US.UTF-8";
|
||||
|
||||
nativeBuildInputs = [
|
||||
installShellFiles
|
||||
setuptools
|
||||
wheel
|
||||
];
|
||||
|
||||
postPatch = ''
|
||||
# pipenv invokes python in a subprocess to create a virtualenv
|
||||
# and to call setup.py.
|
||||
# It would use sys.executable, which in our case points to a python that
|
||||
# does not have the required dependencies.
|
||||
substituteInPlace pipenv/utils/virtualenv.py \
|
||||
--replace "sys.executable" "'${pythonEnv.interpreter}'"
|
||||
'';
|
||||
|
||||
propagatedBuildInputs = runtimeDeps python3.pkgs;
|
||||
|
||||
preCheck = ''
|
||||
export HOME="$TMPDIR"
|
||||
'';
|
||||
|
||||
nativeCheckInputs = [
|
||||
mock
|
||||
pytestCheckHook
|
||||
pytest-xdist
|
||||
pytz
|
||||
requests
|
||||
];
|
||||
|
||||
disabledTests = [
|
||||
"test_convert_deps_to_pip"
|
||||
"test_download_file"
|
||||
];
|
||||
|
||||
disabledTestPaths = [
|
||||
"tests/integration"
|
||||
];
|
||||
|
||||
postInstall = ''
|
||||
installShellCompletion --cmd pipenv \
|
||||
--bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
|
||||
--zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
|
||||
--fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv)
|
||||
'';
|
||||
|
||||
meta = with lib; {
|
||||
description = "Python Development Workflow for Humans";
|
||||
license = licenses.mit;
|
||||
platforms = platforms.all;
|
||||
maintainers = with maintainers; [ berdario ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI
|
||||
zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4
|
||||
-> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo
|
||||
dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4
|
||||
-> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM
|
||||
wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0
|
||||
-> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE
|
||||
0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw
|
||||
-> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM
|
||||
mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00
|
||||
-> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc
|
||||
Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo
|
||||
-> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk
|
||||
Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4
|
||||
-> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI
|
||||
0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc
|
||||
-> =E!-grease uD%0 \!WY E@ )8GeC
|
||||
jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM
|
||||
q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw
|
||||
--- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ
|
||||
IúnïT zG\TC–3*€ÈšÂ%â¹âcl…âAÉ»úýn9ÎóÜT¹,v â1¸”³êUO¸Èl ùµà±•Ö`p®ùLÚûW␍YRþyZ8ZÛ�,·ÉK"¦J3*ã"¸ UM_=4¥ k÷Cýu¡îy
|
||||
@@ -0,0 +1,21 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE
|
||||
UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo
|
||||
-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg
|
||||
cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY
|
||||
-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI
|
||||
sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU
|
||||
-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ
|
||||
tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY
|
||||
-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc
|
||||
rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA
|
||||
-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k
|
||||
EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw
|
||||
-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI
|
||||
JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew
|
||||
-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ
|
||||
8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg
|
||||
-> ZOzxv-grease 1>wp U@ D2
|
||||
BaR+f/XM20cT+Ybw35peBoaM
|
||||
--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw
|
||||
¾ª,©Îs␍dV™"¦èYæ)<©¢8Ø@z�Ì×\&ÕÔW d ¹ríæ+±r‡;Îð_:yôì…±%÷z*þG'ó©Øw{Z½Wäï`6'.ŠM¼ tŒ¶” óöat7öíäK¢�¶%ºåÕÓµv^žÖÁJ
|
||||
@@ -0,0 +1,21 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg GbbSlZ/V1ackzrCD5U7N5JchEZ9UuowST/Y71Sfp3BI
|
||||
GZSzZfu2Wux34LPZBQvwkqxKjXDrOOqmkRJt3qDtCJg
|
||||
-> ssh-ed25519 YJiRbw HISatsdrNt+GumrPyyArj+Dqw+eULCD7RpRV1YiBu3k
|
||||
hhhcKHrgPVkm+PK/s/p4Osgzls4FVVbNQ9vzGky8QW4
|
||||
-> ssh-ed25519 aY2AXA wYRNkYdk2GHITA+WAXkgoo5I4Wq4cLBFcMXSf9BUL08
|
||||
T74l0pjESuW1gblGpb8Mz2WdjRItcO+8MA78aI5K/Uk
|
||||
-> ssh-ed25519 Nl/5yA iK7ae7vwUHydJ928biSU8d9Aw23+9GpUF+MJPtjwjik
|
||||
9a8ljhEXqV8HlUPGOChbRMqkppeadkFT6ug7zx0oaws
|
||||
-> ssh-ed25519 GdLgCQ Zzbgl2Y8pmYhXmg0So1kEyZYPJweQw1AAsrmmNTGqXM
|
||||
26whD+QrG/4WtXYs5gYGiR2BSW4y9dTtV6bIFTX6hlM
|
||||
-> ssh-ed25519 tOH/HQ rL3qA2pX4ikDfp3Y/A+Hw9wJow2/T8hSiLAS0voHKi0
|
||||
JuL5zXRIK05O1wTrRMuuOvvG0UUSa7M/yqB12pJWV6Q
|
||||
-> ssh-ed25519 FpzvfQ n38lhFDy+xuLOlqQgXUhCrRfJJXG45J/lR3CvXyyNhs
|
||||
cpIJXnimD4Kw7qwFnYmzDdv+peFSeVoDLepn074P22g
|
||||
-> ssh-ed25519 kdPvzQ 6BFcuWAwjkas16kb0aWicpUw/+s5oS5fsQM06aowNDM
|
||||
RMKPRUlPacPLLY02A21hy3qfIGkgTMCx3fduMNPZb8k
|
||||
-> Vd,~-grease eb >N-
|
||||
nhFZ/S0aoHjZpo4vX3M4aGEfzD2Qm2ey+fsPpSo
|
||||
--- Rug5lKlvevXobavIgMKn7vLlfwE+YGx5/aR4eaGA3P8
|
||||
@+j¥&v*.îËu姪W…}ݲ㺹9Z)¤:p#¿§›␍½š"L˜QÃj<”ñSF¦êÅXUx³E Æ1§ õ˾Á¸�¦ÓŽ“·EFc6ªàÎ ÿ™?ÈWzÚéògmK™x\ ‰º.™ÎÝŸãÒ?Û‡�?
|
||||
@@ -0,0 +1,22 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020
|
||||
AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0
|
||||
-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo
|
||||
oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8
|
||||
-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw
|
||||
VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg
|
||||
-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0
|
||||
kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y
|
||||
-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE
|
||||
6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU
|
||||
-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0
|
||||
IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk
|
||||
-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20
|
||||
IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI
|
||||
-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo
|
||||
ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o
|
||||
-> x+-grease 1 Wd/1m/
|
||||
Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y
|
||||
6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7
|
||||
--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ
|
||||
„«ëH“ÖdJÌDhˆòLxÄ 1¾…H¯æDÄxê·Ÿ#òy!uüßëA'[¨§ óCºx¨SÖ7Ý]îÖë‹à"‚â<˜\]{2ÛêIôH ew␍;ƒ67®!¯tUúlÞb)r²Ô�Ž×ö`e±Æ�{7az‹
|
||||
@@ -49,4 +49,9 @@ in
|
||||
# Then pipe the resulting files to agenix -e <foo>
|
||||
"gitlab/key.age".publicKeys = everyone;
|
||||
"gitlab/cert.age".publicKeys = everyone;
|
||||
"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
|
||||
"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
|
||||
"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;
|
||||
"gitlab/myself-shell-runner-reg.age".publicKeys = everyone;
|
||||
"gitlab/myself-vmware-runner-reg.age".publicKeys = everyone;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user