Merge branch 'main' of gh:greg-hellings/nixos-config
This commit is contained in:
Greg Hellings
@@ -51,6 +51,7 @@ in {
|
||||
linode = machine { name = "linode"; };
|
||||
lappy = machine { name = "lappy"; };
|
||||
mm = unstable { name = "mm"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
iso-beta = unstable { name = "iso"; };
|
||||
# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
|
||||
|
||||
+15
-18
@@ -1,37 +1,34 @@
|
||||
{ lib, ... }:
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot = {
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
timeout = 15;
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
configurationLimit = 20;
|
||||
extraEntries = {
|
||||
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Windows"
|
||||
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
|
||||
]);
|
||||
"Pop.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Pop!_OS"
|
||||
"linux /EFI/Pop_OS-e4918d10-538d-42ad-b35d-a1ee2ed2a433/vmlinuz.efi"
|
||||
"initrd /EFI/Pop_OS-e4918d10-538d-42ad-b35d-a1ee2ed2a433/initrd.img"
|
||||
"options root=UUID=e4918d10-538d-42ad-b35d-a1ee2ed2a433 ro quiet loglevel=0 systemd.show_status=false splash"
|
||||
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Windows 11"
|
||||
"efi /shellx64.efi"
|
||||
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
|
||||
]);
|
||||
"Pop-oldkern.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Pop!_OS"
|
||||
"linux /EFI/Pop_OS-e4918d10-538d-42ad-b35d-a1ee2ed2a433/vmlinuz-previous.efi"
|
||||
"initrd /EFI/Pop_OS-e4918d10-538d-42ad-b35d-a1ee2ed2a433/initrd.img-previous"
|
||||
"options root=UUID=e4918d10-538d-42ad-b35d-a1ee2ed2a433 ro quiet loglevel=0 systemd.show_status=false splash"
|
||||
]);
|
||||
"Pop-recovery.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Pop!_OS Recovery"
|
||||
"linux /EFI/Recovery-1E97-BC0F/vmlinuz.efi"
|
||||
"initrd /EFI/Recovery-1E97-BC0F/initrd.gz"
|
||||
"options boot=casper hostname=recovery userfullname=Recovery username=recovery live-media-path=/casper-1E97-BC0F noprompt "
|
||||
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title EFI Shell"
|
||||
"efi /shell.efi"
|
||||
]);
|
||||
};
|
||||
extraFiles = {
|
||||
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
|
||||
]));
|
||||
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
|
||||
};
|
||||
};
|
||||
grub = {
|
||||
enable = false;
|
||||
|
||||
+23
-9
@@ -61,17 +61,31 @@
|
||||
device = "/dev/nvme0n1p5";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
"/windows11" = {
|
||||
device = "/dev/nvme1n1p2";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
};
|
||||
|
||||
# Let's do a sound thing
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
|
||||
wireplumber.enable = true;
|
||||
services = {
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
xserver.videoDrivers = [ "nvidia" ];
|
||||
};
|
||||
hardware = {
|
||||
nvidia = {
|
||||
modesetting.enable = true;
|
||||
nvidiaSettings = true;
|
||||
open = true;
|
||||
};
|
||||
pulseaudio.enable = false; # This conflicts with pipewire
|
||||
system76.enableAll = true;
|
||||
};
|
||||
hardware.pulseaudio.enable = false; # This conflicts with pipewire
|
||||
}
|
||||
|
||||
@@ -33,4 +33,15 @@
|
||||
users.extraGroups.vboxusers.members = [ "greg" ];
|
||||
|
||||
boot.extraModprobeConfig = "options kvm_amd nested=1";
|
||||
|
||||
greg.ci-runner = {
|
||||
qemu = {
|
||||
labels = [
|
||||
"qemu:host"
|
||||
];
|
||||
packages = with pkgs; [
|
||||
qemu
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
# Graphics, please
|
||||
greg.gnome.enable = true;
|
||||
# Set host name
|
||||
networking.hostName = "lappy";
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/63bcc80e-0501-4aef-bb58-30bb83881055";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/dev/disk/by-uuid/C617-B2B1";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/bc4f24a3-5969-4bcb-95f4-f80109e36ebb"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
@@ -8,7 +8,6 @@
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
./rei.nix
|
||||
./synapse.nix
|
||||
];
|
||||
greg.home = false;
|
||||
@@ -16,4 +15,10 @@
|
||||
greg.tailscale.enable = true;
|
||||
networking.hostName = "linode";
|
||||
networking.domain = "thehellings.com";
|
||||
environment.systemPackages = with pkgs; [
|
||||
forgejo
|
||||
gitea-actions-runner
|
||||
graphviz
|
||||
nix-du
|
||||
];
|
||||
}
|
||||
|
||||
+95
-121
@@ -20,49 +20,112 @@ in {
|
||||
# GIT SERVICES
|
||||
##########
|
||||
##########################################################################################
|
||||
services.gitea = rec {
|
||||
enable = true;
|
||||
appName = "Greg's Sources";
|
||||
database = {
|
||||
type = "postgres";
|
||||
user = "gitea";
|
||||
};
|
||||
dump = {
|
||||
services = {
|
||||
forgejo = rec {
|
||||
enable = true;
|
||||
type = "tar.xz";
|
||||
package = pkgs.unstable.forgejo;
|
||||
database = {
|
||||
type = "postgres";
|
||||
user = "forgejo";
|
||||
};
|
||||
dump = {
|
||||
enable = true;
|
||||
type = "tar.xz";
|
||||
};
|
||||
settings = {
|
||||
actions.ENABLED = true;
|
||||
DEFAULT = {
|
||||
APP_NAME = "Greg's Sources";
|
||||
};
|
||||
server = rec {
|
||||
ROOT_URL = "https://${DOMAIN}/";
|
||||
DOMAIN = srcDomain;
|
||||
HTTP_PORT = 3001;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = pkgs.lib.mkForce true;
|
||||
session.COOKIE_SECURE = pkgs.lib.mkForce true;
|
||||
log.level = "Info";
|
||||
};
|
||||
};
|
||||
settings = {
|
||||
server = rec {
|
||||
ROOT_URL = "https://${DOMAIN}/";
|
||||
DOMAIN = srcDomain;
|
||||
HTTP_PORT = 3001;
|
||||
|
||||
# For now, at least, this is the same as Forgejo's action runner
|
||||
gitea-actions-runner.instances = {
|
||||
exec = {
|
||||
enable = true;
|
||||
hostPackages = with pkgs; [
|
||||
bashInteractive
|
||||
podman
|
||||
git
|
||||
nodejs
|
||||
];
|
||||
name = "Linode";
|
||||
labels = [
|
||||
"native:host"
|
||||
];
|
||||
tokenFile = config.age.secrets.forgejo-runner.path;
|
||||
url = "https://src.thehellings.com";
|
||||
settings = {
|
||||
log.level = "info";
|
||||
runner = {
|
||||
file = ".runner";
|
||||
capacity = 3;
|
||||
envs = {}; # Environment variables
|
||||
env_file = ".env";
|
||||
timeout = "3h"; # This is the default on Gitea/Forgejo as well
|
||||
insecure = false; # TLS verification
|
||||
fetch_timeout = "5s";
|
||||
fetch_interval = "2s";
|
||||
#labels = []; # See above
|
||||
};
|
||||
cache = {
|
||||
enabled = true;
|
||||
dir = ""; # Default is $HOME/.cache/actcache
|
||||
host = ""; # How to access cache from the runner, autodetect
|
||||
port = 0;
|
||||
external_server = ""; #We are not going externally
|
||||
};
|
||||
container = {
|
||||
network = ""; # Auto-create
|
||||
privileged = false;
|
||||
options = null;
|
||||
workdir_parent = "/workspace";
|
||||
valid_volumes = [];
|
||||
#docker_host = "";
|
||||
force_pull = false;
|
||||
};
|
||||
host = {
|
||||
workdir_parent = null; # Default $HOME/.cache/act
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
forgejo = {
|
||||
enable = true;
|
||||
files = "${config.services.forgejo.dump.backupDir}/*";
|
||||
};
|
||||
};
|
||||
service.DISABLE_REGISTRATION = pkgs.lib.mkForce true;
|
||||
session.COOKIE_SECURE = pkgs.lib.mkForce true;
|
||||
log.level = "Info";
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.forgejo-runner = {
|
||||
file = ../../secrets/linode-forgejo-runner.age;
|
||||
owner = config.systemd.services.gitea-runner-exec.serviceConfig.User;
|
||||
};
|
||||
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "${config.services.gitea.settings.server.PROTOCOL}://${config.services.gitea.settings.server.DOMAIN}:${toString config.services.gitea.settings.server.HTTP_PORT}";
|
||||
target = "${config.services.forgejo.settings.server.PROTOCOL}://${config.services.forgejo.settings.server.DOMAIN}:${toString config.services.forgejo.settings.server.HTTP_PORT}";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
|
||||
greg.backup.jobs.gitea = {
|
||||
src = config.services.gitea.dump.backupDir;
|
||||
dest = "gitea";
|
||||
user = "gitea";
|
||||
};
|
||||
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
gitea = {
|
||||
enable = true;
|
||||
files = "${config.services.gitea.dump.backupDir}/*";
|
||||
};
|
||||
};
|
||||
greg.backup.jobs.forgejo = {
|
||||
src = config.services.forgejo.dump.backupDir;
|
||||
dest = "forgejo";
|
||||
user = "forgejo";
|
||||
};
|
||||
|
||||
##########################################################################################
|
||||
@@ -70,99 +133,10 @@ in {
|
||||
# CI SERVICES
|
||||
##########
|
||||
##########################################################################################
|
||||
|
||||
# Service user
|
||||
users.users.drone = {
|
||||
isSystemUser = true;
|
||||
group = "drone";
|
||||
home = droneDir;
|
||||
};
|
||||
users.groups.drone = {};
|
||||
|
||||
# Environment secrets
|
||||
age.secrets.drone = {
|
||||
file = ../../secrets/drone.age;
|
||||
owner = "root";
|
||||
};
|
||||
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers = {
|
||||
"drone" = {
|
||||
environment = {
|
||||
DRONE_GITEA_SERVER = "https://${srcDomain}";
|
||||
DRONE_LOGS_DEBUG = "true";
|
||||
DRONE_SERVER_HOST = ciDomain;
|
||||
DRONE_SERVER_PROTO = "https";
|
||||
DRONE_SERVER_PROXY_HOST = ciDomain;
|
||||
DRONE_SERVER_PROXY_PROTO = "https";
|
||||
DRONE_TLS_AUTOCERT = "false"; # Suppress it generating SSL certificates, as our proxy handles that
|
||||
};
|
||||
environmentFiles = [
|
||||
"/run/agenix/drone"
|
||||
];
|
||||
extraOptions = [ "--pull=newer" ];
|
||||
image = "drone/drone:2.17";
|
||||
ports = [ "${ciPort}:80" ];
|
||||
volumes = [ "${droneDir}:/data" ];
|
||||
};
|
||||
|
||||
"drone-docker" = {
|
||||
environment = droneWorkerEnvironment;
|
||||
environmentFiles = [
|
||||
"/run/agenix/drone"
|
||||
];
|
||||
extraOptions = [ "--pull=newer" ];
|
||||
image = "drone/drone-runner-docker:1.8";
|
||||
volumes = [ "/run/podman/podman.sock:/var/run/docker.sock" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
"podman-drone".serviceConfig = {
|
||||
StateDirectory = "drone";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
WorkingDirectory = droneDir;
|
||||
};
|
||||
|
||||
"drone-exec-runner" = {
|
||||
environment = droneWorkerEnvironment;
|
||||
description = "Drone pipeline runner that executes locally";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [
|
||||
bash
|
||||
drone-runner-exec
|
||||
git
|
||||
podman
|
||||
];
|
||||
|
||||
preStart = ''
|
||||
mkdir -p ${execWorkDir}
|
||||
cat /run/agenix/drone > ${execWorkDir}/conf.env
|
||||
echo "" >> ${execWorkDir}/conf.env
|
||||
'';
|
||||
script = "exec ${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon ${execWorkDir}/conf.env";
|
||||
|
||||
serviceConfig = {
|
||||
StateDirectory = "drone-exec";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."${ciDomain}" = {
|
||||
target = "http://localhost:${ciPort}";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
|
||||
##########################################################################################
|
||||
###########
|
||||
# CI WORKERS
|
||||
##########
|
||||
##########################################################################################
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
|
||||
@@ -6,10 +6,9 @@
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud26;
|
||||
package = pkgs.nextcloud27;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
enableBrokenCiphersForSSE = false;
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
checkConfig = true;
|
||||
ensureDatabases = [
|
||||
"dendrite"
|
||||
"gitea"
|
||||
"forgejo"
|
||||
"monica"
|
||||
"nextcloud"
|
||||
];
|
||||
@@ -17,19 +17,16 @@
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [ {
|
||||
name = "nextcloud";
|
||||
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
|
||||
ensureDBOwnership = true;
|
||||
} {
|
||||
name = "root";
|
||||
ensurePermissions."ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
|
||||
} {
|
||||
name = "gitea";
|
||||
ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES";
|
||||
name = "forgejo";
|
||||
ensureDBOwnership = true;
|
||||
} {
|
||||
name = "dendrite";
|
||||
ensurePermissions."DATABASE dendrite" = "ALL PRIVILEGES";
|
||||
ensureDBOwnership = true;
|
||||
} {
|
||||
name = "monica";
|
||||
ensurePermissions."DATABASE monica" = "ALL PRIVILEGES";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
@@ -46,7 +43,7 @@ root root postgres
|
||||
enable = true;
|
||||
databases = [
|
||||
"dendrite"
|
||||
"gitea"
|
||||
"forgejo"
|
||||
"monica"
|
||||
"nextcloud"
|
||||
];
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
services.monica = {
|
||||
enable = true;
|
||||
appKeyFile = config.age.secrets.monica.path;
|
||||
appURL = "https://people.thehellings.com";
|
||||
database = {
|
||||
port = 5432;
|
||||
};
|
||||
nginx = {
|
||||
addSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "people.thehellings.com" ];
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.monica = {
|
||||
file = ../../secrets/monica.age;
|
||||
owner = "monica";
|
||||
};
|
||||
|
||||
greg.backup.jobs.monica = {
|
||||
src = "/var/lib/monica";
|
||||
dest = "monica";
|
||||
user = "monica";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./git.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
tmux
|
||||
tree
|
||||
vim
|
||||
xonsh
|
||||
];
|
||||
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
interfaces.enp38s0 = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = false;
|
||||
onBoot = "ignore";
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"vboxusers"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1 vboxdrv";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
{ config, pkgs, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
extraPackages = with pkgs; [
|
||||
config.virtualisation.virtualbox.host.package
|
||||
curl
|
||||
gawk
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip virtualenv ]))
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
xonsh
|
||||
xorriso
|
||||
];
|
||||
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
|
||||
registryPort = 8001;
|
||||
in {
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 registryPort ];
|
||||
};
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "enp38s0";
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2";
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
containers.gitlab = {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/var/gitlab/state" = {
|
||||
hostPath = gitlabStateDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/etc/ssh".hostPath = "/etc/ssh";
|
||||
};
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.200.1";
|
||||
localAddress = "192.168.200.2";
|
||||
config = { config, pkgs, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
../../modules-linux/proxy.nix
|
||||
];
|
||||
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets = let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
|
||||
in {
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 registryPort ];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
|
||||
services = {
|
||||
resolved.enable = true;
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "isaiah.thehellings.lan"; # Just for now...
|
||||
https = false;
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalPort = registryPort;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [ {
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/myvol" =
|
||||
{ device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
Reference in New Issue
Block a user