Merge remote-tracking branch 'origin/main'
This commit is contained in:
Greg Hellings
@@ -1,3 +1,5 @@
|
||||
[](https://garnix.io)
|
||||
|
||||
This is a unified repo to contain my personal configurations for NixOS machines.
|
||||
|
||||
# How To Use This
|
||||
@@ -11,22 +13,12 @@ Go through the normal process to setup a NixOS system during installation.
|
||||
/etc/nixos folder
|
||||
5. Run the configuration generator. It should only genreate the hardware-configuration.nix
|
||||
file, which this repo gitignores
|
||||
6. Symlink the folder for the appropriate host to the location 'host' as such:
|
||||
`ln -s hosts/myhost host`.
|
||||
7. Run the nixos installation command
|
||||
6. Create a folder and file with the machine name in `hosts/<machine>/default.nix`
|
||||
7. Add `hosts/default.nix` an appropriate entry for the machine you are building
|
||||
8. Create a file `home/hosts/<machine>/default.nix` with the new machine name as well
|
||||
|
||||
# Adding new hosts
|
||||
|
||||
To add a new host, create a folder in the directory `hosts/` that matches the name of
|
||||
the target system. Each host must contain, minimally, a `default.nix` file that serves
|
||||
as the basis of configuring that host.
|
||||
|
||||
## Profiles
|
||||
|
||||
Certain shared characteristics can be created in the `profiles/` folder and included in
|
||||
a particular host's configuration. For instance, any hosts that are running on a
|
||||
Raspsberry Pi 4 should include the `profiles/rpi4.nix` file to properly configure things
|
||||
like the kernel and boot parameters. Since I live in the "America/Chicago" timezone, hosts
|
||||
that run in my home will also include `profiles/home.nix`. That file will also set the
|
||||
domain that I use for my hosts at home. This allows shared content to be reused across
|
||||
multiple machines without the need to repeat it.
|
||||
|
||||
+2
-3
@@ -1,8 +1,7 @@
|
||||
builds:
|
||||
include:
|
||||
- '*.x86_64-linux.*'
|
||||
- '*.aarch64-linux.*'
|
||||
- nixosConfigurations.*
|
||||
- darwinConfigurations.*
|
||||
- devShell.x86_64-linux
|
||||
- devShell.aarch64-linux
|
||||
- homeConfigurations.greghellings.activationPackage
|
||||
- nixosConfigurations.*
|
||||
|
||||
+4
-2
@@ -4,8 +4,8 @@
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
"gregory.hellings" =
|
||||
rec {
|
||||
greghellings =
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
pkgs = (import inputs.nixunstable { inherit system overlays; });
|
||||
@@ -20,4 +20,6 @@
|
||||
username = "gregory.hellings";
|
||||
};
|
||||
};
|
||||
|
||||
"gregory.hellings" = greghellings;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
|
||||
}
|
||||
+1
-1
@@ -27,7 +27,7 @@
|
||||
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas;
|
||||
|
||||
gh = { user = "git"; hostname = "github.com"; };
|
||||
"src" = { user = "gitea"; hostname = "src.thehellings.com"; };
|
||||
"src" = { user = "forgejo"; hostname = "src.thehellings.com"; };
|
||||
|
||||
"*.thehellings.lan" = owned;
|
||||
"10.42.*" = owned;
|
||||
|
||||
@@ -49,7 +49,6 @@ in {
|
||||
};
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = machine { name = "linode"; };
|
||||
lappy = machine { name = "lappy"; };
|
||||
mm = unstable { name = "mm"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
|
||||
@@ -7,29 +7,30 @@ let
|
||||
routerIP = "10.42.1.2";
|
||||
extraHosts = builtins.concatStringsSep "\n" [
|
||||
# Local hosts
|
||||
"10.42.0.1 switch"
|
||||
"10.42.0.1 switch switch.thehellings.lan"
|
||||
"10.42.1.1 pve1.thehellings.lan"
|
||||
"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
|
||||
"10.42.1.3 printer"
|
||||
"10.42.1.4 chronicles nas"
|
||||
"10.42.1.3 printer.thehellings.lan"
|
||||
"10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan"
|
||||
"10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
|
||||
"10.42.1.6 isaiah isaiah.thehellings.lan"
|
||||
"10.42.1.12 tv"
|
||||
|
||||
"10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan"
|
||||
|
||||
# Tailscale hosts
|
||||
"100.90.74.19 jude.shire-zebra.ts.net"
|
||||
"100.88.91.27 dns.shire-zebra.ts.net"
|
||||
"100.119.228.115 chronicles.shire-zebra.ts.net"
|
||||
"100.115.57.8 linode.shire-zebra.ts.net"
|
||||
"100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home"
|
||||
"100.78.16.88 mm.shire-zebra.ts.net"
|
||||
"100.90.74.19 jude.home"
|
||||
"100.88.91.27 dns.home"
|
||||
"100.119.228.115 chronicles.home nas.home"
|
||||
"100.115.57.8 linode.home"
|
||||
"100.88.91.27 genesis.home jellyfin.home smart.home zwave.home"
|
||||
"100.78.16.88 mm.home"
|
||||
"100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan"
|
||||
|
||||
# Dev hosts
|
||||
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
|
||||
];
|
||||
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
];
|
||||
|
||||
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
|
||||
proxyPort = 3128;
|
||||
dnsPort = 53;
|
||||
@@ -87,9 +88,9 @@ in {
|
||||
];
|
||||
};
|
||||
nftables.enable = true;
|
||||
extraHosts = "${extraHosts}";
|
||||
};
|
||||
|
||||
environment.etc."hosts.d/local".text = extraHosts;
|
||||
|
||||
fileSystems."/media" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
@@ -148,6 +149,7 @@ in {
|
||||
dhcp-host = [
|
||||
# Static IPs for personal work
|
||||
"00:00:de:ad:be:ef,10.42.2.254"
|
||||
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
|
||||
|
||||
# Static IPs for things in the IOT range
|
||||
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
|
||||
@@ -181,10 +183,11 @@ in {
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
hostsdir = "/etc/hosts.d/";
|
||||
server = dnsServers;
|
||||
};
|
||||
extraConfig = "${extraConfig}";
|
||||
};
|
||||
|
||||
# Update adblock list
|
||||
@@ -206,6 +209,8 @@ in {
|
||||
#};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
curl # Used by dnsmasq fetching
|
||||
sqlite
|
||||
];
|
||||
}
|
||||
|
||||
@@ -0,0 +1,95 @@
|
||||
{ inputs, registryPort, ...}:
|
||||
{ config, pkgs, lib, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
../../modules-linux/proxy.nix
|
||||
];
|
||||
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets = let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
|
||||
in {
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 registryPort ];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
|
||||
services = {
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
trustedProxies = [ "192.168.200.1/32" ];
|
||||
};
|
||||
};
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalPort = registryPort;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [ {
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
inputs:
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
shellcheck
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
in {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secrets = let
|
||||
file = num: {
|
||||
file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
in {
|
||||
qemu-runner-reg-1 = file "1";
|
||||
qemu-runner-reg-2 = file "2";
|
||||
qemu-runner-reg-3 = file "3";
|
||||
qemu-runner-reg-4 = file "4";
|
||||
qemu-runner-reg-5 = file "5";
|
||||
};
|
||||
|
||||
networking.useHostResolvConf = pkgs.lib.mkForce false;
|
||||
networking.nameservers = [ "100.100.100.100" ];
|
||||
services.resolved.enable = true;
|
||||
|
||||
environment.systemPackages = extraPackages;
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = let
|
||||
r = num: {
|
||||
executor = "shell";
|
||||
registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
|
||||
tagList = [ "shell" "qemu" ];
|
||||
};
|
||||
in {
|
||||
shell1 = r "1";
|
||||
shell2 = r "2";
|
||||
shell3 = r "3";
|
||||
shell4 = r "4";
|
||||
shell5 = r "5";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner.wants = [ "network-online.target" ];
|
||||
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
{ inputs, name, extra}:
|
||||
|
||||
({ config, pkgs, lib, ... }:
|
||||
let
|
||||
py = (pkgs.python3.withPackages (p: with p; [
|
||||
pip
|
||||
pyyaml
|
||||
virtualenv
|
||||
]));
|
||||
in (
|
||||
lib.attrsets.recursiveUpdate {
|
||||
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
];
|
||||
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
packer
|
||||
pup
|
||||
py
|
||||
shellcheck
|
||||
xorriso
|
||||
];
|
||||
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
registrationConfigFile = config.age.secrets.runner-reg.path;
|
||||
tagList = [ "shell" name ];
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
users.users.gitlab-runner = {
|
||||
isNormalUser = true;
|
||||
group = "gitlab-runner";
|
||||
extraGroups = [
|
||||
"root"
|
||||
"sudo"
|
||||
"vboxusers"
|
||||
"wheel"
|
||||
];
|
||||
};
|
||||
users.groups.gitlab-runner = {};
|
||||
}
|
||||
|
||||
extra
|
||||
) # End of attrsets.recursiveUpdate
|
||||
) # End of outter function wrapper
|
||||
@@ -36,16 +36,6 @@
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = false;
|
||||
onBoot = "ignore";
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
|
||||
+77
-100
@@ -1,22 +1,15 @@
|
||||
{ config, pkgs, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
config.virtualisation.virtualbox.host.package
|
||||
curl
|
||||
gawk
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
|
||||
registryPort = 8001;
|
||||
|
||||
container = input: (lib.attrsets.recursiveUpdate {
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
privateNetwork = true;
|
||||
} input);
|
||||
in {
|
||||
networking = {
|
||||
firewall = {
|
||||
@@ -30,108 +23,92 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2";
|
||||
greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
containers.gitlab = {
|
||||
containers.gitlab = container {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/var/gitlab/state" = {
|
||||
hostPath = gitlabStateDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/etc/ssh".hostPath = "/etc/ssh";
|
||||
};
|
||||
privateNetwork = true;
|
||||
forwardPorts = [{
|
||||
hostPort = 2222;
|
||||
containerPort = 22;
|
||||
}];
|
||||
hostAddress = "192.168.200.1";
|
||||
localAddress = "192.168.200.2";
|
||||
config = { config, pkgs, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
../../modules-linux/proxy.nix
|
||||
];
|
||||
config = ((import ./container-git.nix) { inherit inputs registryPort; });
|
||||
};
|
||||
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets = let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
|
||||
in {
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
systemd.services."container@gitlab-runner-qemu".serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [
|
||||
"rmmod kvm_amd kvm"
|
||||
];
|
||||
ExecPreStart = [
|
||||
"modprobe kvm"
|
||||
];
|
||||
};
|
||||
systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
|
||||
|
||||
containers.gitlab-runner-qemu = container {
|
||||
bindMounts = {
|
||||
"/dev/kvm" = {
|
||||
hostPath = "/dev/kvm";
|
||||
isReadOnly = false;
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 registryPort ];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
|
||||
services = {
|
||||
resolved.enable = true;
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "isaiah.thehellings.lan"; # Just for now...
|
||||
https = false;
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalPort = registryPort;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [ {
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
extraFlags = [
|
||||
"--property=DeviceAllow=/dev/kvm"
|
||||
];
|
||||
hostAddress = "192.168.201.1";
|
||||
localAddress = "192.168.201.2";
|
||||
config = ((import ./container-runner-qemu.nix) inputs);
|
||||
};
|
||||
|
||||
systemd.services."container@gitlab-runner-vbox".serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
ExecPostStop = [
|
||||
"rmmod vboxnetadp vboxnetflt vboxdrv"
|
||||
];
|
||||
ExecPreStart = [
|
||||
"modprobe vboxdrv vboxnetadp vboxnetflt"
|
||||
];
|
||||
};
|
||||
systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
|
||||
|
||||
containers.gitlab-runner-vbox = container {
|
||||
bindMounts = {
|
||||
"/dev/vboxdrv" = {
|
||||
hostPath = "/dev/vboxdrv";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/vboxdrvu" = {
|
||||
hostPath = "/dev/vboxdrvu";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/vboxnetctl" = {
|
||||
hostPath = "/dev/vboxnetctl";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
hostAddress = "192.168.202.1";
|
||||
localAddress = "192.168.202.2";
|
||||
config = ((import ./container-runner-vbox.nix) {
|
||||
inherit inputs;
|
||||
name = "vbox";
|
||||
extra = {
|
||||
virtualisation.virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
enableHardening = false;
|
||||
headless = true;
|
||||
};
|
||||
};
|
||||
});
|
||||
};
|
||||
}
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
networking = {
|
||||
search = [
|
||||
"thehellings.lan"
|
||||
"shire-zebra.ts.net"
|
||||
"home"
|
||||
];
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE
|
||||
UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo
|
||||
-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg
|
||||
cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY
|
||||
-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI
|
||||
sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU
|
||||
-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ
|
||||
tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY
|
||||
-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc
|
||||
rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA
|
||||
-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k
|
||||
EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw
|
||||
-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI
|
||||
JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew
|
||||
-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ
|
||||
8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg
|
||||
-> ZOzxv-grease 1>wp U@ D2
|
||||
BaR+f/XM20cT+Ybw35peBoaM
|
||||
--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw
|
||||
¾ª,©Îs␍dV™"¦èYæ)<©¢8Ø@z�Ì×\&ÕÔW d ¹ríæ+±r‡;Îð_:yôì…±%÷z*þG'ó©Øw{Z½Wäï`6'.ŠM¼ tŒ¶” óöat7öíäK¢�¶%ºåÕÓµv^žÖÁJ
|
||||
@@ -0,0 +1,23 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic
|
||||
/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0
|
||||
-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY
|
||||
QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38
|
||||
-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY
|
||||
52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o
|
||||
-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0
|
||||
sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips
|
||||
-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI
|
||||
T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc
|
||||
-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg
|
||||
lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro
|
||||
-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg
|
||||
FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg
|
||||
-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk
|
||||
LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM
|
||||
-> XWz-grease ~X,$Oko
|
||||
qcqccJwfeg
|
||||
--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0
|
||||
æïå¬
|
||||
o”½8¥éÏêú缹lOX"aÐq"¬ýE(…†æ_´•fÉ—ÙÎ , t±¦º4¸pN°J½Y¨X{ì‚oÙ�^º„ÁœM½
|
||||
œ¾çýªÐ†þ‚±wÉâý s 8¯5—yý‡ÜÙ�›éò¸l£¼
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,21 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE
|
||||
iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM
|
||||
-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI
|
||||
OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk
|
||||
-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s
|
||||
pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk
|
||||
-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0
|
||||
oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA
|
||||
-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg
|
||||
/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c
|
||||
-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls
|
||||
olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ
|
||||
-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU
|
||||
ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo
|
||||
-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4
|
||||
UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0
|
||||
-> I-grease nF)
|
||||
EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI
|
||||
--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04
|
||||
Æ�£Pü dÙ•ÔÞµÃ%1|' åîZšÑþÒK¯'¥[½@—yF¯?¼Ó'®¬…iÚé ¿ï{Á »‚Ð!Áf> êbðÛt~‘z¦à q$“Š$Œ£µ]HçBÛÍçRLµÚ#ôóé‚äËr€¦¨+„@\àóð
|
||||
@@ -0,0 +1,22 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020
|
||||
AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0
|
||||
-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo
|
||||
oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8
|
||||
-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw
|
||||
VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg
|
||||
-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0
|
||||
kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y
|
||||
-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE
|
||||
6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU
|
||||
-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0
|
||||
IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk
|
||||
-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20
|
||||
IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI
|
||||
-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo
|
||||
ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o
|
||||
-> x+-grease 1 Wd/1m/
|
||||
Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y
|
||||
6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7
|
||||
--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ
|
||||
„«ëH“ÖdJÌDhˆòLxÄ 1¾…H¯æDÄxê·Ÿ#òy!uüßëA'[¨§ óCºx¨SÖ7Ý]îÖë‹à"‚â<˜\]{2ÛêIôH ew␍;ƒ67®!¯tUúlÞb)r²Ô�Ž×ö`e±Æ�{7az‹
|
||||
@@ -49,4 +49,10 @@ in
|
||||
# Then pipe the resulting files to agenix -e <foo>
|
||||
"gitlab/key.age".publicKeys = everyone;
|
||||
"gitlab/cert.age".publicKeys = everyone;
|
||||
"gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone;
|
||||
"gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone;
|
||||
"gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone;
|
||||
"gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone;
|
||||
"gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone;
|
||||
"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user