A complete reformatting to match nixpkgs-fmt
This commit is contained in:
Greg Hellings
+30
-29
@@ -1,33 +1,34 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
|
||||
sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
|
||||
vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
|
||||
hostname = config.networking.hostName;
|
||||
baseConfig = import ../../ceph/home.nix;
|
||||
in {
|
||||
services.ceph-benaco = baseConfig // {
|
||||
enable = false;
|
||||
monitor = {
|
||||
enable = false;
|
||||
initialKeyring = ../../secrets/home.mon.keyring;
|
||||
nodeName = hostname;
|
||||
bindAddr = publicIp;
|
||||
advertisedPublicAddr = vip;
|
||||
};
|
||||
osdBindAddr = publicIp;
|
||||
osdAdvertisedPublicAddr = publicIp;
|
||||
osds = {
|
||||
osd1 = {
|
||||
enable = false;
|
||||
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
|
||||
id = 2;
|
||||
uuid = "73424b68-210b-415f-800f-8767babea625";
|
||||
blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
|
||||
blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
|
||||
clusterAddress = sanIp;
|
||||
};
|
||||
};
|
||||
};
|
||||
publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
|
||||
sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
|
||||
vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
|
||||
hostname = config.networking.hostName;
|
||||
baseConfig = import ../../ceph/home.nix;
|
||||
in
|
||||
{
|
||||
services.ceph-benaco = baseConfig // {
|
||||
enable = false;
|
||||
monitor = {
|
||||
enable = false;
|
||||
initialKeyring = ../../secrets/home.mon.keyring;
|
||||
nodeName = hostname;
|
||||
bindAddr = publicIp;
|
||||
advertisedPublicAddr = vip;
|
||||
};
|
||||
osdBindAddr = publicIp;
|
||||
osdAdvertisedPublicAddr = publicIp;
|
||||
osds = {
|
||||
osd1 = {
|
||||
enable = false;
|
||||
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
|
||||
id = 2;
|
||||
uuid = "73424b68-210b-415f-800f-8767babea625";
|
||||
blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
|
||||
blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
|
||||
clusterAddress = sanIp;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+187
-181
@@ -1,195 +1,201 @@
|
||||
{ config, pkgs, lib, ... }: let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.78.226.76";
|
||||
containerIp = "192.168.200.2";
|
||||
in {
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets = let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
|
||||
in {
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.78.226.76";
|
||||
containerIp = "192.168.200.2";
|
||||
in
|
||||
{
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets =
|
||||
let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
|
||||
in
|
||||
{
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
|
||||
minio_access_key_id = {
|
||||
file = ../../secrets/minio_access_key_id.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
minio_secret_access_key = {
|
||||
file = ../../secrets/minio_secret_access_key.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
minio_access_key_id = {
|
||||
file = ../../secrets/minio_access_key_id.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
minio_secret_access_key = {
|
||||
file = ../../secrets/minio_secret_access_key.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
|
||||
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
|
||||
|
||||
greg.proxies = let
|
||||
t = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
in {
|
||||
"${containerIp}" = t;
|
||||
"${vpnIp}" = t;
|
||||
"git.thehellings.lan" = t;
|
||||
};
|
||||
greg.proxies =
|
||||
let
|
||||
t = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
"${containerIp}" = t;
|
||||
"${vpnIp}" = t;
|
||||
"git.thehellings.lan" = t;
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host nas"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/duplicity_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host nas"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/duplicity_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
|
||||
greg.backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
id = "yha^-s45h";
|
||||
};
|
||||
greg.backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
id = "yha^-s45h";
|
||||
};
|
||||
|
||||
services = {
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
trustedProxies = [ "100.109.86.8/32" ];
|
||||
};
|
||||
};
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
services = {
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
trustedProxies = [ "100.109.86.8/32" ];
|
||||
};
|
||||
};
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
|
||||
extraConfig = {
|
||||
object_store = {
|
||||
enabled = true;
|
||||
proxy_download = false; # Tell them to reach out to object storage themselves!
|
||||
connection = {
|
||||
provider = "AWS";
|
||||
endpoint = "http://s3.thehellings.lan:9000";
|
||||
region = "us-east-1";
|
||||
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
|
||||
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
|
||||
path_style = true; # True for MinIO
|
||||
aws_signature_version = 2;
|
||||
};
|
||||
#storage_options = ...;
|
||||
objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
|
||||
"artifacts"
|
||||
"ci_secure_files"
|
||||
"dependency_proxy"
|
||||
"external_diffs"
|
||||
"lfs"
|
||||
"packages"
|
||||
"pages"
|
||||
"terraform_state"
|
||||
"uploads"
|
||||
]);
|
||||
};
|
||||
};
|
||||
};
|
||||
extraConfig = {
|
||||
object_store = {
|
||||
enabled = true;
|
||||
proxy_download = false; # Tell them to reach out to object storage themselves!
|
||||
connection = {
|
||||
provider = "AWS";
|
||||
endpoint = "http://s3.thehellings.lan:9000";
|
||||
region = "us-east-1";
|
||||
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
|
||||
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
|
||||
path_style = true; # True for MinIO
|
||||
aws_signature_version = 2;
|
||||
};
|
||||
#storage_options = ...;
|
||||
objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
|
||||
"artifacts"
|
||||
"ci_secure_files"
|
||||
"dependency_proxy"
|
||||
"external_diffs"
|
||||
"lfs"
|
||||
"packages"
|
||||
"pages"
|
||||
"terraform_state"
|
||||
"uploads"
|
||||
]);
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
|
||||
listen = [ {
|
||||
addr = vpnIp;
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
} ];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5000/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
|
||||
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
|
||||
"client_max_body_size 250m;"
|
||||
];
|
||||
};
|
||||
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
|
||||
listen = [{
|
||||
addr = vpnIp;
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
}];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5000/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
|
||||
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
|
||||
"client_max_body_size 250m;"
|
||||
];
|
||||
};
|
||||
|
||||
# Fetch the SSL certificates for nginx to use
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
|
||||
};
|
||||
# Fetch the SSL certificates for nginx to use
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [ {
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [{
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
}];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
};
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
};
|
||||
|
||||
# Do not start nginx until we have tailscaled up and running, so it can bind
|
||||
# to the 100.* addresses
|
||||
systemd.services = {
|
||||
nginx = rec {
|
||||
after = [
|
||||
"network-online.target"
|
||||
];
|
||||
wants = after;
|
||||
serviceConfig = {
|
||||
RestartMaxDelaySec = "30s";
|
||||
RestartSteps = "5";
|
||||
};
|
||||
};
|
||||
tailscaled.partOf = [ "network-online.target" ];
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
# Do not start nginx until we have tailscaled up and running, so it can bind
|
||||
# to the 100.* addresses
|
||||
systemd.services = {
|
||||
nginx = rec {
|
||||
after = [
|
||||
"network-online.target"
|
||||
];
|
||||
wants = after;
|
||||
serviceConfig = {
|
||||
RestartMaxDelaySec = "30s";
|
||||
RestartSteps = "5";
|
||||
};
|
||||
};
|
||||
tailscaled.partOf = [ "network-online.target" ];
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
}
|
||||
|
||||
@@ -1,91 +1,92 @@
|
||||
{ inputs, name, extra ? {}, packages ? [], overlays }:
|
||||
{ inputs, name, extra ? { }, packages ? [ ], overlays }:
|
||||
|
||||
({ config, pkgs, lib, ... }:
|
||||
(
|
||||
lib.attrsets.recursiveUpdate {
|
||||
lib.attrsets.recursiveUpdate
|
||||
{
|
||||
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
];
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
];
|
||||
|
||||
nixpkgs.overlays = overlays;
|
||||
nixpkgs.overlays = overlays;
|
||||
|
||||
greg.tailscale.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
] ++ packages;
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
] ++ packages;
|
||||
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "kvm";
|
||||
extraGroups = [ "kvm" ];
|
||||
};
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "kvm";
|
||||
extraGroups = [ "kvm" ];
|
||||
};
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
after = [
|
||||
"network.target"
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "root";
|
||||
Group = "kvm";
|
||||
};
|
||||
};
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
after = [
|
||||
"network.target"
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "root";
|
||||
Group = "kvm";
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
}
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
}
|
||||
|
||||
extra
|
||||
extra
|
||||
) # End of attrsets.recursiveUpdate
|
||||
) # End of outter function wrapper
|
||||
|
||||
+82
-81
@@ -1,86 +1,87 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./ceph.nix
|
||||
./hardware-configuration.nix
|
||||
./git.nix
|
||||
./matrix.nix
|
||||
./minio.nix
|
||||
];
|
||||
imports = [
|
||||
./ceph.nix
|
||||
./hardware-configuration.nix
|
||||
./git.nix
|
||||
./matrix.nix
|
||||
./minio.nix
|
||||
];
|
||||
|
||||
greg.tailscale.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
vlans = {
|
||||
san = {
|
||||
id = 616;
|
||||
interface = "enp39s0";
|
||||
};
|
||||
};
|
||||
interfaces = {
|
||||
enp38s0 = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
} {
|
||||
address = "10.42.100.1";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
san = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.201.1.1";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
];
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
vlans = {
|
||||
san = {
|
||||
id = 616;
|
||||
interface = "enp39s0";
|
||||
};
|
||||
};
|
||||
interfaces = {
|
||||
enp38s0 = {
|
||||
ipv4.addresses = [{
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
}
|
||||
{
|
||||
address = "10.42.100.1";
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
san = {
|
||||
ipv4.addresses = [{
|
||||
address = "10.201.1.1";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
];
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+130
-127
@@ -2,139 +2,142 @@
|
||||
|
||||
let
|
||||
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
|
||||
container = input: (lib.attrsets.recursiveUpdate {
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
enableTun = true;
|
||||
privateNetwork = true;
|
||||
} input);
|
||||
in {
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "enp38s0";
|
||||
};
|
||||
};
|
||||
container = input: (lib.attrsets.recursiveUpdate
|
||||
{
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
enableTun = true;
|
||||
privateNetwork = true;
|
||||
}
|
||||
input);
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "enp38s0";
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
greg.containers.gitlab = {
|
||||
tailscale = true;
|
||||
subnet = "200";
|
||||
builder = (import ./container-git.nix);
|
||||
};
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
systemd.services = {
|
||||
"gitlab-runner" = {
|
||||
after = [ "container@github.service" ];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe kvm"
|
||||
"${pkgs.kmod}/bin/modprobe kvm_amd"
|
||||
];
|
||||
postStop = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
PermissionsStartOnly = "true";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
greg.containers.gitlab = {
|
||||
tailscale = true;
|
||||
subnet = "200";
|
||||
builder = (import ./container-git.nix);
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner.nix) {
|
||||
inherit inputs overlays;
|
||||
name = "shell";
|
||||
extra.virtualisation.podman.enable = true;
|
||||
});
|
||||
};
|
||||
systemd.services = {
|
||||
"gitlab-runner" = {
|
||||
after = [ "container@github.service" ];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe kvm"
|
||||
"${pkgs.kmod}/bin/modprobe kvm_amd"
|
||||
];
|
||||
postStop = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
PermissionsStartOnly = "true";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
|
||||
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings = {
|
||||
concurrent = 5;
|
||||
};
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
|
||||
dockerAllowedImages = [
|
||||
"alpine:*"
|
||||
"debian:*"
|
||||
"docker:*"
|
||||
"fedora:*"
|
||||
"python:*"
|
||||
"ubuntu:*"
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner.nix) {
|
||||
inherit inputs overlays;
|
||||
name = "shell";
|
||||
extra.virtualisation.podman.enable = true;
|
||||
});
|
||||
};
|
||||
|
||||
"hashicorp/*:*"
|
||||
"koalaman/shellcheck:*"
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
|
||||
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings = {
|
||||
concurrent = 5;
|
||||
};
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
|
||||
dockerAllowedImages = [
|
||||
"alpine:*"
|
||||
"debian:*"
|
||||
"docker:*"
|
||||
"fedora:*"
|
||||
"python:*"
|
||||
"ubuntu:*"
|
||||
|
||||
"registry.gitlab.com/gitlab-org/*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerAllowedServices = [
|
||||
"docker:*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerPrivileged = true;
|
||||
dockerVolumes = [
|
||||
"/certs/client"
|
||||
"/cache"
|
||||
];
|
||||
};
|
||||
qemu = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
"hashicorp/*:*"
|
||||
"koalaman/shellcheck:*"
|
||||
|
||||
"registry.gitlab.com/gitlab-org/*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerAllowedServices = [
|
||||
"docker:*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerPrivileged = true;
|
||||
dockerVolumes = [
|
||||
"/certs/client"
|
||||
"/cache"
|
||||
];
|
||||
};
|
||||
qemu = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
}
|
||||
|
||||
@@ -4,48 +4,53 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
fileSystems."/home" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
fileSystems."/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/myvol" =
|
||||
{ device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
fileSystems."/myvol" =
|
||||
{
|
||||
device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
+79
-78
@@ -1,90 +1,91 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
let
|
||||
domain = "thehellings.com";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
domain = "thehellings.com";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
|
||||
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
|
||||
|
||||
greg.containers.matrix = {
|
||||
tailscale = true;
|
||||
subnet = "204";
|
||||
builder = { pkgs, config, ... }: {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
||||
greg.containers.matrix = {
|
||||
tailscale = true;
|
||||
subnet = "204";
|
||||
builder = { pkgs, config, ... }: {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
||||
|
||||
# Environment secrets
|
||||
age = {
|
||||
secrets.dendrite = {
|
||||
file = ../../secrets/dendrite.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
secrets.dendrite_key = {
|
||||
file = ../../secrets/dendrite_key.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
};
|
||||
# Environment secrets
|
||||
age = {
|
||||
secrets.dendrite = {
|
||||
file = ../../secrets/dendrite.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
secrets.dendrite_key = {
|
||||
file = ../../secrets/dendrite_key.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
};
|
||||
|
||||
users.users.dendrite = {
|
||||
isSystemUser = true;
|
||||
group = "dendrite";
|
||||
};
|
||||
users.groups.dendrite = {};
|
||||
users.users.dendrite = {
|
||||
isSystemUser = true;
|
||||
group = "dendrite";
|
||||
};
|
||||
users.groups.dendrite = { };
|
||||
|
||||
systemd.services.dendrite.serviceConfig = {
|
||||
User = "dendrite";
|
||||
};
|
||||
systemd.services.dendrite.serviceConfig = {
|
||||
User = "dendrite";
|
||||
};
|
||||
|
||||
greg.databases.dendrite = {};
|
||||
greg.databases.dendrite = { };
|
||||
|
||||
services.dendrite = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.dendrite.path;
|
||||
httpPort = 8448;
|
||||
# Identify ourselves as the root of our own domain
|
||||
settings = (
|
||||
(builtins.listToAttrs (
|
||||
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
|
||||
"app_service_api"
|
||||
"federation_api"
|
||||
"key_server"
|
||||
"media_api"
|
||||
"mscs"
|
||||
"relay_api"
|
||||
"room_server"
|
||||
"sync_api"
|
||||
])
|
||||
) ) //
|
||||
{
|
||||
user_api.account_database.connection_string = conn;
|
||||
user_api.device_database.connection_string = conn;
|
||||
global = {
|
||||
database = {
|
||||
connection_string = conn;
|
||||
max_open_conns = 25;
|
||||
max_idle_conns = 5;
|
||||
conn_max_lifetime = -1;
|
||||
};
|
||||
server_name = "thehellings.com";
|
||||
trusted_third_party_id_servers = [
|
||||
"matrix.org"
|
||||
"vector.im"
|
||||
"jupiterbroadcasting.com"
|
||||
];
|
||||
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
|
||||
private_key = config.age.secrets.dendrite_key.path;
|
||||
};
|
||||
client_api = {
|
||||
registration_enabled = false;
|
||||
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
|
||||
};
|
||||
});
|
||||
};
|
||||
services.dendrite = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.dendrite.path;
|
||||
httpPort = 8448;
|
||||
# Identify ourselves as the root of our own domain
|
||||
settings = (
|
||||
(builtins.listToAttrs (
|
||||
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
|
||||
"app_service_api"
|
||||
"federation_api"
|
||||
"key_server"
|
||||
"media_api"
|
||||
"mscs"
|
||||
"relay_api"
|
||||
"room_server"
|
||||
"sync_api"
|
||||
])
|
||||
)) //
|
||||
{
|
||||
user_api.account_database.connection_string = conn;
|
||||
user_api.device_database.connection_string = conn;
|
||||
global = {
|
||||
database = {
|
||||
connection_string = conn;
|
||||
max_open_conns = 25;
|
||||
max_idle_conns = 5;
|
||||
conn_max_lifetime = -1;
|
||||
};
|
||||
server_name = "thehellings.com";
|
||||
trusted_third_party_id_servers = [
|
||||
"matrix.org"
|
||||
"vector.im"
|
||||
"jupiterbroadcasting.com"
|
||||
];
|
||||
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
|
||||
private_key = config.age.secrets.dendrite_key.path;
|
||||
};
|
||||
client_api = {
|
||||
registration_enabled = false;
|
||||
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
systemd.services.dendrite = {
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services.dendrite = {
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+24
-23
@@ -1,32 +1,33 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
minioPort = 9000;
|
||||
minioConsolePort = 9001;
|
||||
in {
|
||||
environment.systemPackages = with pkgs; [
|
||||
minio-client
|
||||
xfsprogs
|
||||
];
|
||||
minioPort = 9000;
|
||||
minioConsolePort = 9001;
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
minio-client
|
||||
xfsprogs
|
||||
];
|
||||
|
||||
greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
|
||||
greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
|
||||
|
||||
fileSystems."/data/1" = {
|
||||
device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
|
||||
fsType = "xfs";
|
||||
};
|
||||
fileSystems."/data/1" = {
|
||||
device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
minioPort
|
||||
minioConsolePort
|
||||
];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
minioPort
|
||||
minioConsolePort
|
||||
];
|
||||
|
||||
age.secrets.minio.file = ../../secrets/minio.age;
|
||||
age.secrets.minio.file = ../../secrets/minio.age;
|
||||
|
||||
services.minio = {
|
||||
enable = true;
|
||||
dataDir = [ "/data/1/minio" ];
|
||||
rootCredentialsFile = config.age.secrets.minio.path;
|
||||
browser = true;
|
||||
};
|
||||
services.minio = {
|
||||
enable = true;
|
||||
dataDir = [ "/data/1/minio" ];
|
||||
rootCredentialsFile = config.age.secrets.minio.path;
|
||||
browser = true;
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user