diff --git a/hosts/genesis/adblockUpdate.sh b/hosts/genesis/adblockUpdate.sh deleted file mode 100644 index 3a9d5e5..0000000 --- a/hosts/genesis/adblockUpdate.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/usr/bin/env bash -set -ex - -curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts -curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts - -# Custom domains that I need to preserve for some reason -for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do - sed -i -e "/${f}/d" /etc/adblock_hosts # Blocks Trelly content for house investors -done - -systemctl restart dnsmasq diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index aac76c6..18ae121 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -2,8 +2,29 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ pkgs, ... }: +{ lib, pkgs, ... }: +let + adblockUpdate = pkgs.writeShellApplication { + name = "adblock-update"; + runtimeInputs = with pkgs; [ + curl + gnused + systemd + ]; + text = '' + curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts + curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts + + # Custom domains that I need to preserve for some reason + for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do + sed -i -e "/''${f}/d" /etc/adblock_hosts # Blocks Trelly content for house investors + done + + systemctl restart dnsmasq + ''; + }; +in { imports = [ # Include the results of the hardware scan. @@ -36,4 +57,20 @@ ]; networking.hostName = "genesis"; # Define your hostname. + + systemd = { + services.adblock-update = { + after = [ "network-online.target" ]; + script = lib.getExe adblockUpdate; + serviceConfig.Type = "oneshot"; + }; + timers.adblock-update = { + wantedBy = [ "multi-user.target" ]; + after = [ "network-online.target" ]; + timerConfig = { + OnCalendar = "daily"; + Unit = "adblock-update.service"; + }; + }; + }; } diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 476d329..417c648 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -12,7 +12,6 @@ let routerIP = metadata.infra.gw; extraHosts = builtins.readFile ./net/hosts; - adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); proxyPort = 3128; dnsPort = 53; dhcpPort = 67; @@ -111,19 +110,8 @@ in }; }; - # Update adblock list - cron = { - enable = true; - systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ]; - }; - prometheus.exporters = { dnsmasq.enable = true; - kea = { - enable = true; - openFirewall = true; - targets = [ (builtins.head config.services.kea.dhcp4.settings.control-sockets).socket-name ]; - }; }; }; # End of services configuration diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix index 1695de2..3781977 100644 --- a/hosts/isaiah/default.nix +++ b/hosts/isaiah/default.nix @@ -10,6 +10,7 @@ ]; age.secrets = { + gitea-runner-isaiah-podman.file = ../../secrets/gitea/runner-isaiah-podman.age; gitea-workerPassword.file = ../../secrets/gitea/workerPassword.age; runner-reg.file = ../../secrets/gitlab/kubernetes-k3s-local.age; }; @@ -41,6 +42,7 @@ vip = metadata.hosts.${config.networking.hostName}.ip; priority = 255; }; + podman.enable = true; tailscale = { enable = true; tags = [ "home" ]; @@ -72,6 +74,37 @@ }; services = { + gitea-actions-runner.instances.podman = { + enable = true; + labels = [ + "debian-latest:docker://node:25-trixie" + + "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest" + "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04" + "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04" + + "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest" + "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04" + "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04" + + "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest" + "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04" + "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04" + + "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest" + "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04" + "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04" + + "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest" + "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04" + "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04" + + "nix-latest:docker://src.thehellings.com/greg/builder:latest" + ]; + name = "isaiah-podman"; + tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path; + url = "https://gitea.shire-zebra.ts.net"; + }; k3s.clusterInit = true; # This is the first node in the cluster openssh = { enable = true; diff --git a/network.json b/network.json index 0b436e7..11e1d54 100644 --- a/network.json +++ b/network.json @@ -19,7 +19,7 @@ "genesis": { "ip": "10.42.1.5", "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/CGE2rqlL2Qr0TJkwQMsHFSDkhGWlrUlvfcvcylO1n", - "ts": "100.88.91.27", + "ts": "100.96.198.104", "system": "x86_64-linux", "tags": ["router", "server"] }, diff --git a/secrets/gitea/runner-isaiah-podman.age b/secrets/gitea/runner-isaiah-podman.age new file mode 100644 index 0000000..fb59480 --- /dev/null +++ b/secrets/gitea/runner-isaiah-podman.age @@ -0,0 +1,23 @@ +age-encryption.org/v1 +-> ssh-ed25519 0/WsKg vQ4eMvPi1QQ+svR0gYOnLKq1zHjNIoi19/YCUfLqOGM +kQJHDNcounBvV515upCPK3cViSHvBfQB41OUbylsG10 +-> ssh-ed25519 Nl/5yA HNQECQls7N7qA0v1FaxExJUac91vYhWvFfzc+1nlY3Y +lZ0PXnhOHN241GjrKZbSNy1gKSvr9eXskzqrZ/n/C9Q +-> ssh-ed25519 GdLgCQ QFYdtiQRwhTKvE5jrB/cld9rIby9r7cmPjmv1+lOoRQ +V7xsHzRNYaXAD2pNW3TcNXmJJSNgtfTJJPQo8fKiNBY +-> ssh-ed25519 tOH/HQ OGVZ12WqiEWZR5K7QytactiIaoljT7i6HPGj2EenXDM +WiEYmixi3dVvhn+5VUGA+5VkNdoifwePy85T/lCXoCo +-> ssh-ed25519 FpzvfQ WKsCGUtsUyrvcxQ/qBCrBrJWDAEV549LzjqBDYO6zHU +EC8ieEl7pEz1sa5xS5asabZqHDPoPjMEnYmTPhvwfaU +-> ssh-ed25519 kdPvzQ wxHoixDeYprw52d6cl9QMjMI9NCHfnYFejXZNpS08yw +/QGHzQa86BnPCRNyV+77HCu4nCsHyqGC6wH8c7J1CRU +-> ssh-ed25519 onmXpg P550f4i8UwZc+WM9hIfEkHz/YLJzVZ5BJORLNKePjWo +4tPdk/SG0l8fmgSwlZJR4ieLjCfOhPozyQKBWTmaQRo +-> ssh-ed25519 CnhD0g poJIy1fOHzbRaGjYoSrZqSVP5NQKbiHKZGVV7g8GXHw +6wZRCHnkh1kZrL0P+d73XDnL5K0P9xXMrzn+astYI2E +-> ssh-ed25519 4ep2UA MeCTtP6dVnt7nhxLatRDUv7y16Oil+lo10udCSn1LlU +lddwyfXwB91RJBjr6lpsbvGMGXROIbmINU7T+O49VI8 +-> ssh-ed25519 aY2AXA YtHuclthAqBJAHNAsGTuGWPuunF1xk0uFeLcw7YNCm8 +9r1p2XGc+E9DoZYcdTaPW/BoODS7frcSehqNOCGeHE0 +--- PRiwIThQDkWZUuyddSK2FRBDuEqjrJ+w099T1OsTEVo +4K׶|}P/R`V{ms$Hk)cnY벬bVbnje&DgGF6UnT \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 72f8de6..26fb152 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -98,6 +98,7 @@ in "gitea/oauthToken.age".publicKeys = everyone; "gitea/webhookSecret.age".publicKeys = everyone; "gitea/workerPassword.age".publicKeys = everyone; + "gitea/runner-podman-isaiah.age".publicKeys = users ++ [ hosts.isaiah.pubkey ]; "gitlab/secret.age".publicKeys = everyone; "gitlab/otp.age".publicKeys = everyone;