greg/nixos
1
0
Fork 2
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main'

Browse Source
This commit is contained in:
Greg Hellings
2023-12-19 19:07:45 +00:00
parent 7cbd9491d2 d72f2a85b5
commit 87a1d2766d
20 changed files with 448 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/default.nix
-1
View File
@@ -49,7 +49,6 @@ in {
};
icdm-root = unstable { name = "icdm-root"; };
linode = machine { name = "linode"; };
lappy = machine { name = "lappy"; };
mm = unstable { name = "mm"; };
myself = unstable { name = "myself"; };
iso = machine { name = "iso"; };
hosts/genesis/networking.nix
+19 -14
View File
@@ -7,29 +7,30 @@ let
routerIP = "10.42.1.2";
extraHosts = builtins.concatStringsSep "\n" [
# Local hosts
"10.42.0.1 switch"
"10.42.0.1 switch switch.thehellings.lan"
"10.42.1.1 pve1.thehellings.lan"
"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
"10.42.1.3 printer"
"10.42.1.4 chronicles nas"
"10.42.1.3 printer.thehellings.lan"
"10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan"
"10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.6 isaiah isaiah.thehellings.lan"
"10.42.1.12 tv"
"10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan"
# Tailscale hosts
"100.90.74.19 jude.shire-zebra.ts.net"
"100.88.91.27 dns.shire-zebra.ts.net"
"100.119.228.115 chronicles.shire-zebra.ts.net"
"100.115.57.8 linode.shire-zebra.ts.net"
"100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home"
"100.78.16.88 mm.shire-zebra.ts.net"
"100.90.74.19 jude.home"
"100.88.91.27 dns.home"
"100.119.228.115 chronicles.home nas.home"
"100.115.57.8 linode.home"
"100.88.91.27 genesis.home jellyfin.home smart.home zwave.home"
"100.78.16.88 mm.home"
"100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan"
# Dev hosts
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
];
extraConfig = builtins.concatStringsSep "\n" [
];
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
proxyPort = 3128;
dnsPort = 53;
@@ -87,9 +88,9 @@ in {
];
};
nftables.enable = true;
extraHosts = "${extraHosts}";
};
environment.etc."hosts.d/local".text = extraHosts;
fileSystems."/media" = {
device = "10.42.1.4:/volume1/video/";
@@ -148,6 +149,7 @@ in {
dhcp-host = [
# Static IPs for personal work
"00:00:de:ad:be:ef,10.42.2.254"
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
# Static IPs for things in the IOT range
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
@@ -181,10 +183,11 @@ in {
expand-hosts = true;
log-dhcp = true;
log-queries = true;
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
addn-hosts = "/etc/adblock_hosts";
hostsdir = "/etc/hosts.d/";
server = dnsServers;
};
extraConfig = "${extraConfig}";
};
# Update adblock list
@@ -206,6 +209,8 @@ in {
#};
environment.systemPackages = with pkgs; [
bind
curl # Used by dnsmasq fetching
sqlite
];
}
hosts/myself/container-git.nix
+95
View File
@@ -0,0 +1,95 @@
{ inputs, registryPort, ...}:
{ config, pkgs, lib, ... }: {
imports = [
inputs.agenix.nixosModules.default
../../modules-linux/proxy.nix
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secretsMountPoint = "/run/derp";
age.secrets = let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
in {
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 registryPort ];
};
useHostResolvConf = lib.mkForce false;
};
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
services = {
resolved.enable = true;
openssh.enable = true;
gitlab = {
enable = true;
backup = {
keepTime = 288;
startAt = [ "03:00" ];
};
host = "src.thehellings.com";
https = true;
port = 443;
extraConfig = {
gitlab = {
trustedProxies = [ "192.168.200.1/32" ];
};
};
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalPort = registryPort;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [ {
name = "gitlab";
ensureDBOwnership = true;
} ];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
redis.servers.gitlab = {
enable = true;
};
};
system.stateVersion = "24.05";
}
hosts/myself/container-runner-qemu.nix
+63
View File
@@ -0,0 +1,63 @@
inputs:
{ config, pkgs, ... }:
let
extraPackages = with pkgs; [
curl
gawk
git
packer
pup
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]))
qemu_full
qemu_kvm
shellcheck
xonsh
xorriso
];
in {
imports = [
inputs.agenix.nixosModules.default
];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secrets = let
file = num: {
file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age;
owner = "gitlab-runner";
};
in {
qemu-runner-reg-1 = file "1";
qemu-runner-reg-2 = file "2";
qemu-runner-reg-3 = file "3";
qemu-runner-reg-4 = file "4";
qemu-runner-reg-5 = file "5";
};
networking.useHostResolvConf = pkgs.lib.mkForce false;
networking.nameservers = [ "100.100.100.100" ];
services.resolved.enable = true;
environment.systemPackages = extraPackages;
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = let
r = num: {
executor = "shell";
registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path;
tagList = [ "shell" "qemu" ];
};
in {
shell1 = r "1";
shell2 = r "2";
shell3 = r "3";
shell4 = r "4";
shell5 = r "5";
};
};
systemd.services.gitlab-runner.wants = [ "network-online.target" ];
systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ];
system.stateVersion = "24.05";
}
hosts/myself/container-runner-vbox.nix
+84
View File
@@ -0,0 +1,84 @@
{ inputs, name, extra}:
({ config, pkgs, lib, ... }:
let
py = (pkgs.python3.withPackages (p: with p; [
pip
pyyaml
virtualenv
]));
in (
lib.attrsets.recursiveUpdate {
imports = [
inputs.agenix.nixosModules.default
];
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
};
environment.systemPackages = with pkgs; [
curl
gawk
git
packer
pup
py
shellcheck
xorriso
];
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
nixpkgs.config.allowUnfree = true;
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.runner-reg.path;
tagList = [ "shell" name ];
};
};
};
resolved.enable = true;
};
systemd.services.gitlab-runner = {
wants = [ "network-online.target" ];
after = [ "network.target" "network-online.target" ];
serviceConfig = {
User = "root";
DynamicUser = lib.mkForce false;
};
};
system.stateVersion = "24.05";
users.users.gitlab-runner = {
isNormalUser = true;
group = "gitlab-runner";
extraGroups = [
"root"
"sudo"
"vboxusers"
"wheel"
];
};
users.groups.gitlab-runner = {};
}
extra
) # End of attrsets.recursiveUpdate
) # End of outter function wrapper
hosts/myself/default.nix
-10
View File
@@ -36,16 +36,6 @@
"10.42.1.5"
];
};
virtualisation = {
libvirtd = {
enable = false;
onBoot = "ignore";
};
virtualbox.host = {
enable = true;
enableExtensionPack = true;
};
};
users = {
users = {
greg = {
hosts/myself/git.nix
+77 -100
View File
@@ -1,22 +1,15 @@
{ config, pkgs, lib, inputs, ... }:
let
extraPackages = with pkgs; [
config.virtualisation.virtualbox.host.package
curl
gawk
packer
pup
(python3.withPackages (p: with p; [ pip virtualenv ]))
qemu_full
qemu_kvm
xonsh
xorriso
];
gitlabStateDir = "/var/lib/gitlab";
registryPort = 8001;
container = input: (lib.attrsets.recursiveUpdate {
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
privateNetwork = true;
} input);
in {
networking = {
firewall = {
@@ -30,108 +23,92 @@ in {
};
};
greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2";
greg.proxies."git.thehellings.lan".target = "http://192.168.200.2";
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
containers.gitlab = {
containers.gitlab = container {
autoStart = true;
bindMounts = {
"/var/gitlab/state" = {
hostPath = gitlabStateDir;
isReadOnly = false;
};
"/etc/ssh".hostPath = "/etc/ssh";
};
privateNetwork = true;
forwardPorts = [{
hostPort = 2222;
containerPort = 22;
}];
hostAddress = "192.168.200.1";
localAddress = "192.168.200.2";
config = { config, pkgs, ... }: {
imports = [
inputs.agenix.nixosModules.default
../../modules-linux/proxy.nix
];
config = ((import ./container-git.nix) { inherit inputs registryPort; });
};
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secretsMountPoint = "/run/derp";
age.secrets = let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
in {
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
systemd.services."container@gitlab-runner-qemu".serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [
"rmmod kvm_amd kvm"
];
ExecPreStart = [
"modprobe kvm"
];
};
systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ];
containers.gitlab-runner-qemu = container {
bindMounts = {
"/dev/kvm" = {
hostPath = "/dev/kvm";
isReadOnly = false;
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 registryPort ];
};
useHostResolvConf = lib.mkForce false;
};
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
services = {
resolved.enable = true;
gitlab = {
enable = true;
backup = {
keepTime = 288;
startAt = [ "03:00" ];
};
host = "isaiah.thehellings.lan"; # Just for now...
https = false;
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalPort = registryPort;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [ {
name = "gitlab";
ensureDBOwnership = true;
} ];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
redis.servers.gitlab = {
enable = true;
};
};
system.stateVersion = "24.05";
};
extraFlags = [
"--property=DeviceAllow=/dev/kvm"
];
hostAddress = "192.168.201.1";
localAddress = "192.168.201.2";
config = ((import ./container-runner-qemu.nix) inputs);
};
systemd.services."container@gitlab-runner-vbox".serviceConfig = {
DevicePolicy = lib.mkForce "auto";
ExecPostStop = [
"rmmod vboxnetadp vboxnetflt vboxdrv"
];
ExecPreStart = [
"modprobe vboxdrv vboxnetadp vboxnetflt"
];
};
systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ];
containers.gitlab-runner-vbox = container {
bindMounts = {
"/dev/vboxdrv" = {
hostPath = "/dev/vboxdrv";
isReadOnly = false;
};
"/dev/vboxdrvu" = {
hostPath = "/dev/vboxdrvu";
isReadOnly = false;
};
"/dev/vboxnetctl" = {
hostPath = "/dev/vboxnetctl";
isReadOnly = false;
};
};
hostAddress = "192.168.202.1";
localAddress = "192.168.202.2";
config = ((import ./container-runner-vbox.nix) {
inherit inputs;
name = "vbox";
extra = {
virtualisation.virtualbox.host = {
enable = true;
enableExtensionPack = true;
enableHardening = false;
headless = true;
};
};
});
};
}