From d740880c5f65591c978bbcf528a155322265bc0a Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 7 Dec 2023 11:45:03 -0600 Subject: [PATCH 01/21] Update networking --- hosts/genesis/networking.nix | 26 ++++++++++++++++---------- modules-linux/default.nix | 2 +- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 496e3dc..1fe9a8a 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -7,21 +7,23 @@ let routerIP = "10.42.1.2"; extraHosts = builtins.concatStringsSep "\n" [ # Local hosts - "10.42.0.1 switch" + "10.42.0.1 switch switch.thehellings.lan" "10.42.1.1 pve1.thehellings.lan" "10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan" - "10.42.1.3 printer" - "10.42.1.4 chronicles nas" + "10.42.1.3 printer.thehellings.lan" + "10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan" "10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.6 isaiah isaiah.thehellings.lan" "10.42.1.12 tv" + "10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan" # Tailscale hosts - "100.90.74.19 jude.shire-zebra.ts.net" - "100.88.91.27 dns.shire-zebra.ts.net" - "100.119.228.115 chronicles.shire-zebra.ts.net" - "100.115.57.8 linode.shire-zebra.ts.net" - "100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home" - "100.78.16.88 mm.shire-zebra.ts.net" + "100.90.74.19 jude.home" + "100.88.91.27 dns.home" + "100.119.228.115 chronicles.home nas.home" + "100.115.57.8 linode.home" + "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" + "100.78.16.88 mm.home" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" @@ -87,9 +89,9 @@ in { ]; }; nftables.enable = true; - extraHosts = "${extraHosts}"; }; + environment.etc."hosts.d/local".text = extraHosts; fileSystems."/media" = { device = "10.42.1.4:/volume1/video/"; @@ -148,6 +150,7 @@ in { dhcp-host = [ # Static IPs for personal work "00:00:de:ad:be:ef,10.42.2.254" + "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah # Static IPs for things in the IOT range "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 @@ -181,7 +184,9 @@ in { expand-hosts = true; log-dhcp = true; log-queries = true; + no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 addn-hosts = "/etc/adblock_hosts"; + hostsdir = "/etc/hosts.d/"; server = dnsServers; }; extraConfig = "${extraConfig}"; @@ -207,5 +212,6 @@ in { environment.systemPackages = with pkgs; [ curl # Used by dnsmasq fetching + sqlite ]; } diff --git a/modules-linux/default.nix b/modules-linux/default.nix index 8b6757f..2ac57da 100644 --- a/modules-linux/default.nix +++ b/modules-linux/default.nix @@ -30,7 +30,7 @@ networking = { search = [ "thehellings.lan" - "shire-zebra.ts.net" + "home" ]; networkmanager.enable = true; }; From 079bc1179abeb8665df8c4acc4771b1331b9e14a Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 12 Dec 2023 23:38:35 -0600 Subject: [PATCH 02/21] Add myself --- hosts/genesis/networking.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 1fe9a8a..2da1781 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -24,6 +24,7 @@ let "100.115.57.8 linode.home" "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" "100.78.16.88 mm.home" + "100..84.183.79 myself.home myself.shire-zebra.ts.net" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" From 3c6b4053694905a7fd54b542e891216a4d35bc40 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 13 Dec 2023 14:48:38 -0600 Subject: [PATCH 03/21] Decompose file a little bit --- hosts/myself/container-git.nix | 94 ++++++++++++++++++++++++++++++++++ hosts/myself/git.nix | 89 +------------------------------- 2 files changed, 96 insertions(+), 87 deletions(-) create mode 100644 hosts/myself/container-git.nix diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix new file mode 100644 index 0000000..8dcbbdf --- /dev/null +++ b/hosts/myself/container-git.nix @@ -0,0 +1,94 @@ +{ inputs, registryPort, ...}: +{ config, pkgs, lib, ... }: { + imports = [ + inputs.agenix.nixosModules.default + ../../modules-linux/proxy.nix + ]; + + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + age.secretsMountPoint = "/run/derp"; + age.secrets = let + cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; }; + in { + gitlab-secret = cfg "secret"; + gitlab-otp = cfg "otp"; + gitlab-db = cfg "db"; + gitlab-jws = cfg "jws"; + gitlab-key = cfg "key"; + gitlab-cert = cfg "cert"; + }; + + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 registryPort ]; + }; + useHostResolvConf = lib.mkForce false; + }; + + greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + + services = { + resolved.enable = true; + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "src.thehellings.com"; + https = false; + port = 443; + extraConfig = { + gitlab = { + trustedProxies = [ "192.168.200.1/32" ]; + }; + }; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = config.age.secrets.gitlab-cert.path; + keyFile = config.age.secrets.gitlab-key.path; + externalPort = registryPort; + }; + secrets = { + secretFile = config.age.secrets.gitlab-secret.path; + otpFile = config.age.secrets.gitlab-otp.path; + dbFile = config.age.secrets.gitlab-db.path; + jwsFile = config.age.secrets.gitlab-jws.path; + }; + }; + + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [ { + name = "gitlab"; + ensureDBOwnership = true; + } ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; + + redis.servers.gitlab = { + enable = true; + }; + }; + system.stateVersion = "24.05"; +} diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index db426c6..97aabe1 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -31,6 +31,7 @@ in { }; greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2"; + greg.proxies."myself.shire-zebra.ts.net".target = "http://192.168.200.2"; system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; @@ -46,92 +47,6 @@ in { privateNetwork = true; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; - config = { config, pkgs, ... }: { - imports = [ - inputs.agenix.nixosModules.default - ../../modules-linux/proxy.nix - ]; - - age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secretsMountPoint = "/run/derp"; - age.secrets = let - cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; }; - in { - gitlab-secret = cfg "secret"; - gitlab-otp = cfg "otp"; - gitlab-db = cfg "db"; - gitlab-jws = cfg "jws"; - gitlab-key = cfg "key"; - gitlab-cert = cfg "cert"; - }; - - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 registryPort ]; - }; - useHostResolvConf = lib.mkForce false; - }; - - greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; - - services = { - resolved.enable = true; - gitlab = { - enable = true; - backup = { - keepTime = 288; - startAt = [ "03:00" ]; - }; - host = "isaiah.thehellings.lan"; # Just for now... - https = false; - initialRootEmail = "greg@thehellings.com"; - initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; - pages = { - enable = true; - settings.pages-domain = "pages.thehellings.com"; - }; - puma = { - threadsMax = 6; - threadsMin = 2; - workers = 6; - }; - redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; - registry = { - enable = true; - certFile = config.age.secrets.gitlab-cert.path; - keyFile = config.age.secrets.gitlab-key.path; - externalPort = registryPort; - }; - secrets = { - secretFile = config.age.secrets.gitlab-secret.path; - otpFile = config.age.secrets.gitlab-otp.path; - dbFile = config.age.secrets.gitlab-db.path; - jwsFile = config.age.secrets.gitlab-jws.path; - }; - }; - - postgresql = { - enable = true; - checkConfig = true; - ensureDatabases = [ "gitlab" ]; - ensureUsers = [ { - name = "gitlab"; - ensureDBOwnership = true; - } ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - }; - - redis.servers.gitlab = { - enable = true; - }; - }; - system.stateVersion = "24.05"; - }; + config = ((import ./container-git.nix) { inherit inputs registryPort; }); }; } From 30e9ed87542a0b10c439488e8b05814be45689ff Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 13 Dec 2023 15:19:01 -0600 Subject: [PATCH 04/21] Use internal names --- hosts/myself/git.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 97aabe1..51ced90 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -30,8 +30,7 @@ in { }; }; - greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2"; - greg.proxies."myself.shire-zebra.ts.net".target = "http://192.168.200.2"; + greg.proxies."git.thehellings.lan".target = "http://192.168.200.2"; system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; From d9b8ec9f1ebfb93769c201f4c791a9510fae860f Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 13 Dec 2023 15:19:42 -0600 Subject: [PATCH 05/21] Fixup typos and remove cruft --- hosts/genesis/networking.nix | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 2da1781..bfe416a 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -17,6 +17,7 @@ let "10.42.1.12 tv" "10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan" + # Tailscale hosts "100.90.74.19 jude.home" "100.88.91.27 dns.home" @@ -24,15 +25,12 @@ let "100.115.57.8 linode.home" "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" "100.78.16.88 mm.home" - "100..84.183.79 myself.home myself.shire-zebra.ts.net" + "100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" ]; - extraConfig = builtins.concatStringsSep "\n" [ - ]; - adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); proxyPort = 3128; dnsPort = 53; @@ -190,7 +188,6 @@ in { hostsdir = "/etc/hosts.d/"; server = dnsServers; }; - extraConfig = "${extraConfig}"; }; # Update adblock list @@ -212,6 +209,7 @@ in { #}; environment.systemPackages = with pkgs; [ + bind curl # Used by dnsmasq fetching sqlite ]; From 68f025c8b4e4eec045add9a44c84dd3877f89117 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 00:42:50 -0600 Subject: [PATCH 06/21] Add LS23003 --- home/hosts/ls23003/default.nix | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 home/hosts/ls23003/default.nix diff --git a/home/hosts/ls23003/default.nix b/home/hosts/ls23003/default.nix new file mode 100644 index 0000000..facb35d --- /dev/null +++ b/home/hosts/ls23003/default.nix @@ -0,0 +1,4 @@ +{ ... }: +{ + +} From 03229f64059db7ff207a40e035e5cac7f94fa581 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 00:43:00 -0600 Subject: [PATCH 07/21] Update ssh name --- home/ssh.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/home/ssh.nix b/home/ssh.nix index 09ed6df..60f111f 100644 --- a/home/ssh.nix +++ b/home/ssh.nix @@ -27,7 +27,7 @@ "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas; gh = { user = "git"; hostname = "github.com"; }; - "src" = { user = "gitea"; hostname = "src.thehellings.com"; }; + "src" = { user = "forgejo"; hostname = "src.thehellings.com"; }; "*.thehellings.lan" = owned; "10.42.*" = owned; From 940c1954e4b3fa4348a1493f684abb973066c5be Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 00:45:31 -0600 Subject: [PATCH 08/21] Try adding homeConfigurations --- garnix.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/garnix.yaml b/garnix.yaml index ea35e6e..8e0084c 100644 --- a/garnix.yaml +++ b/garnix.yaml @@ -4,5 +4,6 @@ builds: - '*.aarch64-linux.*' - nixosConfigurations.* - darwinConfigurations.* + - homeConfigurations."gregory.hellings" - devShell.x86_64-linux - devShell.aarch64-linux From 457a4e1c624add48fac7606904482f1134c41d94 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 00:47:08 -0600 Subject: [PATCH 09/21] Remove lappy line --- garnix.yaml | 2 +- hosts/default.nix | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/garnix.yaml b/garnix.yaml index 8e0084c..f7459f8 100644 --- a/garnix.yaml +++ b/garnix.yaml @@ -4,6 +4,6 @@ builds: - '*.aarch64-linux.*' - nixosConfigurations.* - darwinConfigurations.* - - homeConfigurations."gregory.hellings" + - homeConfigurations."gregory.hellings".activationPackage - devShell.x86_64-linux - devShell.aarch64-linux diff --git a/hosts/default.nix b/hosts/default.nix index fd2cd79..ee0e65a 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -49,7 +49,6 @@ in { }; icdm-root = unstable { name = "icdm-root"; }; linode = machine { name = "linode"; }; - lappy = machine { name = "lappy"; }; mm = unstable { name = "mm"; }; myself = unstable { name = "myself"; }; iso = machine { name = "iso"; }; From 2ed4d83132f28ec91eff162eba5bcb08bf704e41 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 00:54:34 -0600 Subject: [PATCH 10/21] Maybe test home? --- garnix.yaml | 6 ++---- home/default.nix | 6 ++++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/garnix.yaml b/garnix.yaml index f7459f8..531ec88 100644 --- a/garnix.yaml +++ b/garnix.yaml @@ -1,9 +1,7 @@ builds: include: - - '*.x86_64-linux.*' - - '*.aarch64-linux.*' - - nixosConfigurations.* - darwinConfigurations.* - - homeConfigurations."gregory.hellings".activationPackage - devShell.x86_64-linux - devShell.aarch64-linux + - homeConfigurations.greghellings.activationPackage + - nixosConfigurations.* diff --git a/home/default.nix b/home/default.nix index 0e50814..ce74127 100644 --- a/home/default.nix +++ b/home/default.nix @@ -4,8 +4,8 @@ ... }: -{ - "gregory.hellings" = +rec { + greghellings = let system = "x86_64-linux"; pkgs = (import inputs.nixunstable { inherit system overlays; }); @@ -20,4 +20,6 @@ username = "gregory.hellings"; }; }; + + "gregory.hellings" = greghellings; } From 08e723361a2f8906f3626a0e2153f9ead8953551 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 00:59:16 -0600 Subject: [PATCH 11/21] Update README.md --- README.md | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 47a72e1..871747a 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgarnix-io%2Fhello-garnix)](https://garnix.io) + This is a unified repo to contain my personal configurations for NixOS machines. # How To Use This @@ -11,22 +13,12 @@ Go through the normal process to setup a NixOS system during installation. /etc/nixos folder 5. Run the configuration generator. It should only genreate the hardware-configuration.nix file, which this repo gitignores -6. Symlink the folder for the appropriate host to the location 'host' as such: - `ln -s hosts/myhost host`. -7. Run the nixos installation command +6. Create a folder and file with the machine name in `hosts//default.nix` +7. Add `hosts/default.nix` an appropriate entry for the machine you are building +8. Create a file `home/hosts//default.nix` with the new machine name as well # Adding new hosts To add a new host, create a folder in the directory `hosts/` that matches the name of the target system. Each host must contain, minimally, a `default.nix` file that serves as the basis of configuring that host. - -## Profiles - -Certain shared characteristics can be created in the `profiles/` folder and included in -a particular host's configuration. For instance, any hosts that are running on a -Raspsberry Pi 4 should include the `profiles/rpi4.nix` file to properly configure things -like the kernel and boot parameters. Since I live in the "America/Chicago" timezone, hosts -that run in my home will also include `profiles/home.nix`. That file will also set the -domain that I use for my hosts at home. This allows shared content to be reused across -multiple machines without the need to repeat it. From 962169858e52e7215cdaaa0c602c2de8b5c11259 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 01:04:40 -0600 Subject: [PATCH 12/21] The real badge --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 871747a..aaa5cad 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgarnix-io%2Fhello-garnix)](https://garnix.io) +[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) [![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io This is a unified repo to contain my personal configurations for NixOS machines. From 4db737ec5b202653dd60f609defa2ec667cdf585 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 01:05:26 -0600 Subject: [PATCH 13/21] Fix markdown --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index aaa5cad..d99178c 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) [![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io +[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) [![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) This is a unified repo to contain my personal configurations for NixOS machines. From 6d54788a889c5636cece588db3da196bfcf0257b Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 14 Dec 2023 01:06:12 -0600 Subject: [PATCH 14/21] De-duplicate badge --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d99178c..ba98a97 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) [![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) +[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) This is a unified repo to contain my personal configurations for NixOS machines. From 69e6c42886b599c2968d573f0869c9a7c6d5f781 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 15 Dec 2023 10:28:19 -0600 Subject: [PATCH 15/21] Gitlab and QEmu runner --- hosts/myself/container-git.nix | 3 +- hosts/myself/git.nix | 56 +++++++++++++++++++++++ secrets/gitlab/myself-qemu-runner-reg.age | 21 +++++++++ secrets/secrets.nix | 1 + 4 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 secrets/gitlab/myself-qemu-runner-reg.age diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index 8dcbbdf..c68fe88 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -30,6 +30,7 @@ services = { resolved.enable = true; + openssh.enable = true; gitlab = { enable = true; backup = { @@ -37,7 +38,7 @@ startAt = [ "03:00" ]; }; host = "src.thehellings.com"; - https = false; + https = true; port = 443; extraConfig = { gitlab = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 51ced90..94d85ab 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -5,11 +5,13 @@ let config.virtualisation.virtualbox.host.package curl gawk + git packer pup (python3.withPackages (p: with p; [ pip virtualenv ])) qemu_full qemu_kvm + shellcheck xonsh xorriso ]; @@ -43,9 +45,63 @@ in { }; "/etc/ssh".hostPath = "/etc/ssh"; }; + forwardPorts = [{ + hostPort = 2222; + containerPort = 22; + }]; privateNetwork = true; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; config = ((import ./container-git.nix) { inherit inputs registryPort; }); }; + + systemd.services."container@gitlab-runner".serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + }; + + containers.gitlab-runner = { + autoStart = true; + bindMounts = { + "/etc/ssh".hostPath = "/etc/ssh"; + "/dev/kvm" = { + hostPath = "/dev/kvm"; + isReadOnly = false; + }; + }; + extraFlags = [ + "--property=DeviceAllow=/dev/kvm" + ]; + privateNetwork = true; + hostAddress = "192.168.201.1"; + localAddress = "192.168.201.2"; + config = { config, pkgs, ... }: { + imports = [ + inputs.agenix.nixosModules.default + ]; + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + age.secrets.qemu-runner-reg = { + file = ../../secrets/gitlab/myself-qemu-runner-reg.age; + owner = "gitlab-runner"; + }; + + networking.useHostResolvConf = lib.mkForce false; + networking.nameservers = [ "100.100.100.100" ]; + services.resolved.enable = true; + + environment.systemPackages = extraPackages; + + services.gitlab-runner = { + enable = true; + services = { + shell = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.qemu-runner-reg.path; + tagList = [ "shell" "qemu" ]; + }; + }; + }; + system.stateVersion = "24.05"; + }; + }; } diff --git a/secrets/gitlab/myself-qemu-runner-reg.age b/secrets/gitlab/myself-qemu-runner-reg.age new file mode 100644 index 0000000..0418295 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE +UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo +-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg +cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY +-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI +sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU +-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ +tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY +-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc +rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA +-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k +EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw +-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI +JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew +-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ +8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg +-> ZOzxv-grease 1>wp U@ D2 +BaR+f/XM20cT+Ybw35peBoaM +--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw +,s dV"Y)<8@z\&W d r+r;_:y셱%z*G'w{ZW`6'.Mt at7K%ӵv^J \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 64d3428..04482a9 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,4 +49,5 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; } From 1afe353df7b5987c5c2defcfc6287e333ecf37ad Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 17 Dec 2023 15:47:52 -0600 Subject: [PATCH 16/21] Bring up the VM runners --- hosts/myself/container-runner-qemu.nix | 63 +++++++++++ hosts/myself/container-runner-vbox.nix | 84 ++++++++++++++ hosts/myself/default.nix | 10 -- hosts/myself/git.nix | 103 ++++++++++-------- ...r-reg.age => myself-qemu-runner-reg-1.age} | 0 secrets/gitlab/myself-qemu-runner-reg-2.age | 23 ++++ secrets/gitlab/myself-qemu-runner-reg-3.age | Bin 0 -> 1117 bytes secrets/gitlab/myself-qemu-runner-reg-4.age | Bin 0 -> 1241 bytes secrets/gitlab/myself-qemu-runner-reg-5.age | 21 ++++ secrets/gitlab/myself-vbox-runner-reg.age | 22 ++++ secrets/secrets.nix | 7 +- 11 files changed, 274 insertions(+), 59 deletions(-) create mode 100644 hosts/myself/container-runner-qemu.nix create mode 100644 hosts/myself/container-runner-vbox.nix rename secrets/gitlab/{myself-qemu-runner-reg.age => myself-qemu-runner-reg-1.age} (100%) create mode 100644 secrets/gitlab/myself-qemu-runner-reg-2.age create mode 100644 secrets/gitlab/myself-qemu-runner-reg-3.age create mode 100644 secrets/gitlab/myself-qemu-runner-reg-4.age create mode 100644 secrets/gitlab/myself-qemu-runner-reg-5.age create mode 100644 secrets/gitlab/myself-vbox-runner-reg.age diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix new file mode 100644 index 0000000..551d1da --- /dev/null +++ b/hosts/myself/container-runner-qemu.nix @@ -0,0 +1,63 @@ +inputs: +{ config, pkgs, ... }: +let + extraPackages = with pkgs; [ + curl + gawk + git + packer + pup + (python3.withPackages (p: with p; [ pip pyyaml virtualenv ])) + qemu_full + qemu_kvm + shellcheck + xonsh + xorriso + ]; +in { + imports = [ + inputs.agenix.nixosModules.default + ]; + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + age.secrets = let + file = num: { + file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age; + owner = "gitlab-runner"; + }; + in { + qemu-runner-reg-1 = file "1"; + qemu-runner-reg-2 = file "2"; + qemu-runner-reg-3 = file "3"; + qemu-runner-reg-4 = file "4"; + qemu-runner-reg-5 = file "5"; + }; + + networking.useHostResolvConf = pkgs.lib.mkForce false; + networking.nameservers = [ "100.100.100.100" ]; + services.resolved.enable = true; + + environment.systemPackages = extraPackages; + + services.gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = let + r = num: { + executor = "shell"; + registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path; + tagList = [ "shell" "qemu" ]; + }; + in { + shell1 = r "1"; + shell2 = r "2"; + shell3 = r "3"; + shell4 = r "4"; + shell5 = r "5"; + }; + }; + + systemd.services.gitlab-runner.wants = [ "network-online.target" ]; + systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ]; + + system.stateVersion = "24.05"; +} diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix new file mode 100644 index 0000000..93c46f7 --- /dev/null +++ b/hosts/myself/container-runner-vbox.nix @@ -0,0 +1,84 @@ +{ inputs, name, extra}: + +({ config, pkgs, lib, ... }: +let + py = (pkgs.python3.withPackages (p: with p; [ + pip + pyyaml + virtualenv + ])); +in ( + lib.attrsets.recursiveUpdate { + + imports = [ + inputs.agenix.nixosModules.default + ]; + + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.runner-reg = { + file = ../../secrets/gitlab/myself-${name}-runner-reg.age; + owner = "gitlab-runner"; + }; + }; + + environment.systemPackages = with pkgs; [ + curl + gawk + git + packer + pup + py + shellcheck + xorriso + ]; + + networking = { + useHostResolvConf = pkgs.lib.mkForce false; + nameservers = [ "100.100.100.100" ]; + }; + + nixpkgs.config.allowUnfree = true; + + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = { + shell = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.runner-reg.path; + tagList = [ "shell" name ]; + }; + }; + }; + resolved.enable = true; + }; + + systemd.services.gitlab-runner = { + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + serviceConfig = { + User = "root"; + DynamicUser = lib.mkForce false; + }; + }; + + system.stateVersion = "24.05"; + users.users.gitlab-runner = { + isNormalUser = true; + group = "gitlab-runner"; + extraGroups = [ + "root" + "sudo" + "vboxusers" + "wheel" + ]; + }; + users.groups.gitlab-runner = {}; + } + + extra +) # End of attrsets.recursiveUpdate +) # End of outter function wrapper diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index 48c2c8d..040759f 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -36,16 +36,6 @@ "10.42.1.5" ]; }; - virtualisation = { - libvirtd = { - enable = false; - onBoot = "ignore"; - }; - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; - }; users = { users = { greg = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 94d85ab..90a97fe 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -1,24 +1,15 @@ { config, pkgs, lib, inputs, ... }: let - extraPackages = with pkgs; [ - config.virtualisation.virtualbox.host.package - curl - gawk - git - packer - pup - (python3.withPackages (p: with p; [ pip virtualenv ])) - qemu_full - qemu_kvm - shellcheck - xonsh - xorriso - ]; gitlabStateDir = "/var/lib/gitlab"; registryPort = 8001; + + container = input: (lib.attrsets.recursiveUpdate { + bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets + privateNetwork = true; + } input); in { networking = { firewall = { @@ -36,33 +27,36 @@ in { system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; - containers.gitlab = { + containers.gitlab = container { autoStart = true; bindMounts = { "/var/gitlab/state" = { hostPath = gitlabStateDir; isReadOnly = false; }; - "/etc/ssh".hostPath = "/etc/ssh"; }; forwardPorts = [{ hostPort = 2222; containerPort = 22; }]; - privateNetwork = true; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; config = ((import ./container-git.nix) { inherit inputs registryPort; }); }; - systemd.services."container@gitlab-runner".serviceConfig = { + systemd.services."container@gitlab-runner-qemu".serviceConfig = { DevicePolicy = lib.mkForce "auto"; + ExecPostStop = [ + "rmmod kvm_amd kvm" + ]; + ExecPreStart = [ + "modprobe kvm" + ]; }; + systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ]; - containers.gitlab-runner = { - autoStart = true; + containers.gitlab-runner-qemu = container { bindMounts = { - "/etc/ssh".hostPath = "/etc/ssh"; "/dev/kvm" = { hostPath = "/dev/kvm"; isReadOnly = false; @@ -71,37 +65,50 @@ in { extraFlags = [ "--property=DeviceAllow=/dev/kvm" ]; - privateNetwork = true; hostAddress = "192.168.201.1"; localAddress = "192.168.201.2"; - config = { config, pkgs, ... }: { - imports = [ - inputs.agenix.nixosModules.default - ]; - age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secrets.qemu-runner-reg = { - file = ../../secrets/gitlab/myself-qemu-runner-reg.age; - owner = "gitlab-runner"; + config = ((import ./container-runner-qemu.nix) inputs); + }; + + systemd.services."container@gitlab-runner-vbox".serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + ExecPostStop = [ + "rmmod vboxnetadp vboxnetflt vboxdrv" + ]; + ExecPreStart = [ + "modprobe vboxdrv vboxnetadp vboxnetflt" + ]; + }; + systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ]; + + containers.gitlab-runner-vbox = container { + bindMounts = { + "/dev/vboxdrv" = { + hostPath = "/dev/vboxdrv"; + isReadOnly = false; }; - - networking.useHostResolvConf = lib.mkForce false; - networking.nameservers = [ "100.100.100.100" ]; - services.resolved.enable = true; - - environment.systemPackages = extraPackages; - - services.gitlab-runner = { - enable = true; - services = { - shell = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.qemu-runner-reg.path; - tagList = [ "shell" "qemu" ]; - }; + "/dev/vboxdrvu" = { + hostPath = "/dev/vboxdrvu"; + isReadOnly = false; + }; + "/dev/vboxnetctl" = { + hostPath = "/dev/vboxnetctl"; + isReadOnly = false; + }; + }; + hostAddress = "192.168.202.1"; + localAddress = "192.168.202.2"; + config = ((import ./container-runner-vbox.nix) { + inherit inputs; + name = "vbox"; + extra = { + virtualisation.virtualbox.host = { + enable = true; + enableExtensionPack = true; + enableHardening = false; + headless = true; }; }; - system.stateVersion = "24.05"; - }; + }); }; } diff --git a/secrets/gitlab/myself-qemu-runner-reg.age b/secrets/gitlab/myself-qemu-runner-reg-1.age similarity index 100% rename from secrets/gitlab/myself-qemu-runner-reg.age rename to secrets/gitlab/myself-qemu-runner-reg-1.age diff --git a/secrets/gitlab/myself-qemu-runner-reg-2.age b/secrets/gitlab/myself-qemu-runner-reg-2.age new file mode 100644 index 0000000..e2d7314 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg-2.age @@ -0,0 +1,23 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic +/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0 +-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY +QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38 +-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY +52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o +-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0 +sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips +-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI +T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc +-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg +lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro +-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg +FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg +-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk +LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM +-> XWz-grease ~X,$Oko +qcqccJwfeg +--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0 + +o8缹lOX"aq"E(_fɗ ,t4pNJYX{o^M +Іws 85yُl \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-3.age b/secrets/gitlab/myself-qemu-runner-reg-3.age new file mode 100644 index 0000000000000000000000000000000000000000..50e0948572fbda04294ad533b3c72da62d583bf9 GIT binary patch literal 1117 zcmZY4yUXJQ003}x5#sqDh{i+2qt-myJbH?fq#5Ibvia_ad@q$VyHua@ta^> zC*vqYF$|f3xt8nO7=*S2L&8WvPiAS*p{3(uQ>Mi0WSU5YE>!_ei#>{D(qsw@m=Y^z zMDu2W5K0qqPar{oAc}~UClz+d6~>>SJmiv4ysE7hsk!OFhB!g4b#Ub@JH&y28BvEi zT}yC~lld*%Dw0L!I6Bg-0$BP!6jXIMqaYcwCuUT0cFjb@+OT>tO5rod6uKay(-gj{ ztyd`JQJ{d;8E@BwtTBY8N6R&X>GWRd60ZuNU6M2IS(A?#xtNnc@9OH(ZA;g7GkNO9 zN)o26*~3%HLI#44L)A(0kmlFw@~WopA?!qfkdBn5sT-L+BzB;BvQBP!f4~!k*{(X& zOO)VD$Vw{AVW4Wmla-2%iDC?W$nB*aECn83REyTxLaaxjb1jSODiL>AH9nMM#sINW zZ%m^Z*ri-&E{rXZ!^{{~Ck}I3OBf{25-CDm*ti=2Qz!330`oJ44QL zGdo1HBvy3JA3UWJf~#7i36Nlby8@5wPR7kXZ%RJGpk7(N}JmW?z z0RtaBb$a2UaQXcYPf{Oz@!YdFZr=Fz`XAptm_7aFQKH)O#c#&n=#SxT{+mnplV2|X zWZ!y5$liZk?E2Sd_wS{5AKkur|62WFcjx&BU%m0q_|8i||HVA<`=_7Xx_sn(&Asd2 dyZGr>`t$Aex8J#Sara^K7=Q8O_v(vl{{pdudcFVv literal 0 HcmV?d00001 diff --git a/secrets/gitlab/myself-qemu-runner-reg-4.age b/secrets/gitlab/myself-qemu-runner-reg-4.age new file mode 100644 index 0000000000000000000000000000000000000000..a7bdccebe0c4e57c6b8bbe9286faa906e166c06a GIT binary patch literal 1241 zcmZY6$;;ye0LEc&O7P}@hzddQyTne{Yy*mEnx;*fW@(xY1hXg2o@Qx++d(hN2QuR5 zK@bE5K~TZLlgm-?B7zQhn8SeHM1?^IQBXX7{sj;3?=^jQ;HGxj{IJ6)5hu&kmwoEQg-8%!z|4@xGL5GB zsHb}oQAYjFv>;w$xL!)iMwGXVun$pt8*mr3Z9IfK0_4S2NvnlRJ7H5Lox(19pP<~+ zv8pz#B)~*Un=#fWj*0;$tA_>_Scp_CkSt(Rjfq{ec85h-WEiy#L#SSb+o~R}FKV>2 z@ktTPPNNJy#mn50D5x@$WO?#*yhUXJ%ApV;^L&97CX}E`3qV2zv15bWT1^(Xzm%Us{PeUQ#WwNQM8EtoYS%C4%!pK2*n@L8b-+WhjirBS#k{q*3-=SMXzD z%}NspMYWg%B!u)rA@`Tbfzv$&g>!-y)R7q1{3L9Of6EMYN(;suvA?)&nfHw+f}9E& zYn^wvid;KW%9@eNE~9&^agrO|Z%j*1-q7X%@hastgrU@)0h^WUH{}7^;g| zk6J>|G-gK7EH0qLMJ;lKrWZjrYRhJ^-bis<* z^#kzi5%5&2;FHMuDJ}zA#Y7aB>jQgMs$811-jZlcRiz`j+(Ej9ik4ReMVGsp6Hs)S z;HuxbA|5EiM3_fYpwE%MW&_wT3;kFIWjC(6cq)Ym-5=&hjp7$w%QDquMYt9do1?MP zLNY`Mql(j2v&-T@Jl3+A z0i$2giu)k9q2I*wvxk1{-+uX?YrFI4%D12Yah3h@ueUA%#?>#rd*S&v`0IDyFW&oW z^FVF9`^mF6o_qNA`*(iuAAISjo5l4zAAY6%dDpAAAHO2Le)hdG+`jg)ORg`ya_z-$ e-u(IN8-G9g&iSodAANS;dpC>o`uD4!%KrdDy{ZcU literal 0 HcmV?d00001 diff --git a/secrets/gitlab/myself-qemu-runner-reg-5.age b/secrets/gitlab/myself-qemu-runner-reg-5.age new file mode 100644 index 0000000..3b9b1e4 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg-5.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE +iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM +-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI +OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk +-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s +pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk +-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0 +oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA +-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg +/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c +-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls +olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ +-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU +ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo +-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4 +UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0 +-> I-grease nF) +EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI +--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04 +ƝPdٕ޵%1|' ZK'[@yF?'i{ !f> bt~zq$$]HBRL#r+@\ \ No newline at end of file diff --git a/secrets/gitlab/myself-vbox-runner-reg.age b/secrets/gitlab/myself-vbox-runner-reg.age new file mode 100644 index 0000000..40818f0 --- /dev/null +++ b/secrets/gitlab/myself-vbox-runner-reg.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020 +AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0 +-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo +oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8 +-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw +VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg +-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0 +kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y +-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE +6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU +-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0 +IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk +-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20 +IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI +-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo +ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o +-> x+-grease 1 Wd/1m/ +Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y +6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7 +--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ +HdJDhLx1HDx귟#y!uA'[CxS7]"<\]{2IHew ;67!tUlb)rԁ`eƍ{7az \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 04482a9..25a4be8 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,5 +49,10 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; - "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone; + "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; } From d0d7d25b90823c1d753d3b2e0b7be64ed51d4846 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 17 Dec 2023 19:54:28 -0600 Subject: [PATCH 17/21] QEmu and VirtualBox working --- hosts/myself/container-runner-qemu.nix | 34 ++----- hosts/myself/container-runner-vbox.nix | 105 +++++++++----------- hosts/myself/git.nix | 46 +++++++++ secrets/gitlab/myself-podman-runner-reg.age | 22 ++++ secrets/gitlab/myself-qemu-runner-reg-2.age | 23 ----- secrets/gitlab/myself-qemu-runner-reg-3.age | Bin 1117 -> 0 bytes secrets/gitlab/myself-qemu-runner-reg-4.age | Bin 1241 -> 0 bytes secrets/gitlab/myself-qemu-runner-reg-5.age | 21 ---- secrets/gitlab/myself-shell-runner-reg.age | 21 ++++ secrets/secrets.nix | 6 +- 10 files changed, 145 insertions(+), 133 deletions(-) create mode 100644 secrets/gitlab/myself-podman-runner-reg.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-2.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-3.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-4.age delete mode 100644 secrets/gitlab/myself-qemu-runner-reg-5.age create mode 100644 secrets/gitlab/myself-shell-runner-reg.age diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix index 551d1da..7ef7574 100644 --- a/hosts/myself/container-runner-qemu.nix +++ b/hosts/myself/container-runner-qemu.nix @@ -19,17 +19,9 @@ in { inputs.agenix.nixosModules.default ]; age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secrets = let - file = num: { - file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age; - owner = "gitlab-runner"; - }; - in { - qemu-runner-reg-1 = file "1"; - qemu-runner-reg-2 = file "2"; - qemu-runner-reg-3 = file "3"; - qemu-runner-reg-4 = file "4"; - qemu-runner-reg-5 = file "5"; + age.secrets.qemu-runner-reg-1 = { + file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age; + owner = "gitlab-runner"; }; networking.useHostResolvConf = pkgs.lib.mkForce false; @@ -41,23 +33,15 @@ in { services.gitlab-runner = { enable = true; settings.concurrent = 5; - services = let - r = num: { - executor = "shell"; - registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path; - tagList = [ "shell" "qemu" ]; - }; - in { - shell1 = r "1"; - shell2 = r "2"; - shell3 = r "3"; - shell4 = r "4"; - shell5 = r "5"; + services.shell = { + executor = "shell"; + registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path; + tagList = [ "shell" "qemu" ]; }; }; - systemd.services.gitlab-runner.wants = [ "network-online.target" ]; - systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ]; + systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ]; + systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix index 93c46f7..c73e3c1 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner-vbox.nix @@ -1,4 +1,4 @@ -{ inputs, name, extra}: +{ inputs, name, extra ? {} }: ({ config, pkgs, lib, ... }: let @@ -8,77 +8,62 @@ let virtualenv ])); in ( - lib.attrsets.recursiveUpdate { +lib.attrsets.recursiveUpdate { - imports = [ - inputs.agenix.nixosModules.default - ]; + imports = [ + inputs.agenix.nixosModules.default + ]; - age = { - identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - secrets.runner-reg = { - file = ../../secrets/gitlab/myself-${name}-runner-reg.age; - owner = "gitlab-runner"; - }; + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.runner-reg = { + file = ../../secrets/gitlab/myself-${name}-runner-reg.age; + owner = "gitlab-runner"; }; + }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - packer - pup - py - shellcheck - xorriso - ]; + environment.systemPackages = with pkgs; [ + curl + gawk + git + packer + pup + py + shellcheck + xorriso + ]; - networking = { - useHostResolvConf = pkgs.lib.mkForce false; - nameservers = [ "100.100.100.100" ]; - }; + networking = { + useHostResolvConf = pkgs.lib.mkForce false; + nameservers = [ "100.100.100.100" ]; + }; - nixpkgs.config.allowUnfree = true; + nixpkgs.config.allowUnfree = true; - services = { - gitlab-runner = { - enable = true; - settings.concurrent = 5; - services = { - shell = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.runner-reg.path; - tagList = [ "shell" name ]; - }; + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = { + shell = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.runner-reg.path; + tagList = [ "shell" name ]; }; }; - resolved.enable = true; }; + resolved.enable = true; + }; - systemd.services.gitlab-runner = { - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - serviceConfig = { - User = "root"; - DynamicUser = lib.mkForce false; - }; - }; + systemd.services.gitlab-runner = { + wants = [ "network-online.target" "systemd-resolved.service" ]; + after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + }; - system.stateVersion = "24.05"; - users.users.gitlab-runner = { - isNormalUser = true; - group = "gitlab-runner"; - extraGroups = [ - "root" - "sudo" - "vboxusers" - "wheel" - ]; - }; - users.groups.gitlab-runner = {}; - } + system.stateVersion = "24.05"; +} - extra +extra ) # End of attrsets.recursiveUpdate ) # End of outter function wrapper diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 90a97fe..6ae3a52 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -81,6 +81,14 @@ in { }; systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ]; + systemd.services.gitlab-runner = { + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + }; + + ##################################################################################### + #################### Virtualbox Runner ############################################## + ##################################################################################### containers.gitlab-runner-vbox = container { bindMounts = { "/dev/vboxdrv" = { @@ -102,6 +110,10 @@ in { inherit inputs; name = "vbox"; extra = { + systemd.services.gitlab-runner.serviceConfig = { + User = "root"; + DynamicUser = lib.mkForce false; + }; virtualisation.virtualbox.host = { enable = true; enableExtensionPack = true; @@ -111,4 +123,38 @@ in { }; }); }; + + ##################################################################################### + #################### Container Podman Runner ######################################## + ##################################################################################### + containers.gitlab-runner-shell = container { + autoStart = true; + hostAddress = "192.168.203.1"; + localAddress = "192.168.203.2"; + config = ((import ./container-runner-vbox.nix) { + inherit inputs; + name = "shell"; + }); + }; + + ##################################################################################### + #################### Local Podman/Docker Runner ##################################### + ##################################################################################### + age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + services.gitlab-runner = { + enable = true; + settings.concurrent = 5; + services.podman = { + executor = "docker"; + registrationConfigFile = config.age.secrets.runner-reg.path; + tagList = [ "container" ]; + dockerImage = "ubuntu:22.04"; + }; + }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + dockerSocket.enable = true; + }; + virtualisation.docker.enable = false; } diff --git a/secrets/gitlab/myself-podman-runner-reg.age b/secrets/gitlab/myself-podman-runner-reg.age new file mode 100644 index 0000000..4037117 --- /dev/null +++ b/secrets/gitlab/myself-podman-runner-reg.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI +zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4 +-> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo +dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4 +-> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM +wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0 +-> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE +0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw +-> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM +mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00 +-> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc +Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo +-> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk +Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4 +-> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI +0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc +-> =E!-grease uD%0 \!WY E@ )8GeC +jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM +q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw +--- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ +InT zG\TC3*Ț%clAɻn9T,v1UOl ౕ`pLW YRyZ8Zې,K"J3*" UM_=4kCuy \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-2.age b/secrets/gitlab/myself-qemu-runner-reg-2.age deleted file mode 100644 index e2d7314..0000000 --- a/secrets/gitlab/myself-qemu-runner-reg-2.age +++ /dev/null @@ -1,23 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic -/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0 --> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY -QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38 --> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY -52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o --> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0 -sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips --> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI -T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc --> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg -lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro --> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg -FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg --> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk -LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM --> XWz-grease ~X,$Oko -qcqccJwfeg ---- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0 - -o8缹lOX"aq"E(_fɗ ,t4pNJYX{o^M -Іws 85yُl \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-3.age b/secrets/gitlab/myself-qemu-runner-reg-3.age deleted file mode 100644 index 50e0948572fbda04294ad533b3c72da62d583bf9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1117 zcmZY4yUXJQ003}x5#sqDh{i+2qt-myJbH?fq#5Ibvia_ad@q$VyHua@ta^> zC*vqYF$|f3xt8nO7=*S2L&8WvPiAS*p{3(uQ>Mi0WSU5YE>!_ei#>{D(qsw@m=Y^z zMDu2W5K0qqPar{oAc}~UClz+d6~>>SJmiv4ysE7hsk!OFhB!g4b#Ub@JH&y28BvEi zT}yC~lld*%Dw0L!I6Bg-0$BP!6jXIMqaYcwCuUT0cFjb@+OT>tO5rod6uKay(-gj{ ztyd`JQJ{d;8E@BwtTBY8N6R&X>GWRd60ZuNU6M2IS(A?#xtNnc@9OH(ZA;g7GkNO9 zN)o26*~3%HLI#44L)A(0kmlFw@~WopA?!qfkdBn5sT-L+BzB;BvQBP!f4~!k*{(X& zOO)VD$Vw{AVW4Wmla-2%iDC?W$nB*aECn83REyTxLaaxjb1jSODiL>AH9nMM#sINW zZ%m^Z*ri-&E{rXZ!^{{~Ck}I3OBf{25-CDm*ti=2Qz!330`oJ44QL zGdo1HBvy3JA3UWJf~#7i36Nlby8@5wPR7kXZ%RJGpk7(N}JmW?z z0RtaBb$a2UaQXcYPf{Oz@!YdFZr=Fz`XAptm_7aFQKH)O#c#&n=#SxT{+mnplV2|X zWZ!y5$liZk?E2Sd_wS{5AKkur|62WFcjx&BU%m0q_|8i||HVA<`=_7Xx_sn(&Asd2 dyZGr>`t$Aex8J#Sara^K7=Q8O_v(vl{{pdudcFVv diff --git a/secrets/gitlab/myself-qemu-runner-reg-4.age b/secrets/gitlab/myself-qemu-runner-reg-4.age deleted file mode 100644 index a7bdccebe0c4e57c6b8bbe9286faa906e166c06a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1241 zcmZY6$;;ye0LEc&O7P}@hzddQyTne{Yy*mEnx;*fW@(xY1hXg2o@Qx++d(hN2QuR5 zK@bE5K~TZLlgm-?B7zQhn8SeHM1?^IQBXX7{sj;3?=^jQ;HGxj{IJ6)5hu&kmwoEQg-8%!z|4@xGL5GB zsHb}oQAYjFv>;w$xL!)iMwGXVun$pt8*mr3Z9IfK0_4S2NvnlRJ7H5Lox(19pP<~+ zv8pz#B)~*Un=#fWj*0;$tA_>_Scp_CkSt(Rjfq{ec85h-WEiy#L#SSb+o~R}FKV>2 z@ktTPPNNJy#mn50D5x@$WO?#*yhUXJ%ApV;^L&97CX}E`3qV2zv15bWT1^(Xzm%Us{PeUQ#WwNQM8EtoYS%C4%!pK2*n@L8b-+WhjirBS#k{q*3-=SMXzD z%}NspMYWg%B!u)rA@`Tbfzv$&g>!-y)R7q1{3L9Of6EMYN(;suvA?)&nfHw+f}9E& zYn^wvid;KW%9@eNE~9&^agrO|Z%j*1-q7X%@hastgrU@)0h^WUH{}7^;g| zk6J>|G-gK7EH0qLMJ;lKrWZjrYRhJ^-bis<* z^#kzi5%5&2;FHMuDJ}zA#Y7aB>jQgMs$811-jZlcRiz`j+(Ej9ik4ReMVGsp6Hs)S z;HuxbA|5EiM3_fYpwE%MW&_wT3;kFIWjC(6cq)Ym-5=&hjp7$w%QDquMYt9do1?MP zLNY`Mql(j2v&-T@Jl3+A z0i$2giu)k9q2I*wvxk1{-+uX?YrFI4%D12Yah3h@ueUA%#?>#rd*S&v`0IDyFW&oW z^FVF9`^mF6o_qNA`*(iuAAISjo5l4zAAY6%dDpAAAHO2Le)hdG+`jg)ORg`ya_z-$ e-u(IN8-G9g&iSodAANS;dpC>o`uD4!%KrdDy{ZcU diff --git a/secrets/gitlab/myself-qemu-runner-reg-5.age b/secrets/gitlab/myself-qemu-runner-reg-5.age deleted file mode 100644 index 3b9b1e4..0000000 --- a/secrets/gitlab/myself-qemu-runner-reg-5.age +++ /dev/null @@ -1,21 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE -iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM --> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI -OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk --> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s -pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk --> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0 -oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA --> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg -/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c --> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls -olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ --> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU -ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo --> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4 -UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0 --> I-grease nF) -EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI ---- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04 -ƝPdٕ޵%1|' ZK'[@yF?'i{ !f> bt~zq$$]HBRL#r+@\ \ No newline at end of file diff --git a/secrets/gitlab/myself-shell-runner-reg.age b/secrets/gitlab/myself-shell-runner-reg.age new file mode 100644 index 0000000..5f40ae9 --- /dev/null +++ b/secrets/gitlab/myself-shell-runner-reg.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg GbbSlZ/V1ackzrCD5U7N5JchEZ9UuowST/Y71Sfp3BI +GZSzZfu2Wux34LPZBQvwkqxKjXDrOOqmkRJt3qDtCJg +-> ssh-ed25519 YJiRbw HISatsdrNt+GumrPyyArj+Dqw+eULCD7RpRV1YiBu3k +hhhcKHrgPVkm+PK/s/p4Osgzls4FVVbNQ9vzGky8QW4 +-> ssh-ed25519 aY2AXA wYRNkYdk2GHITA+WAXkgoo5I4Wq4cLBFcMXSf9BUL08 +T74l0pjESuW1gblGpb8Mz2WdjRItcO+8MA78aI5K/Uk +-> ssh-ed25519 Nl/5yA iK7ae7vwUHydJ928biSU8d9Aw23+9GpUF+MJPtjwjik +9a8ljhEXqV8HlUPGOChbRMqkppeadkFT6ug7zx0oaws +-> ssh-ed25519 GdLgCQ Zzbgl2Y8pmYhXmg0So1kEyZYPJweQw1AAsrmmNTGqXM +26whD+QrG/4WtXYs5gYGiR2BSW4y9dTtV6bIFTX6hlM +-> ssh-ed25519 tOH/HQ rL3qA2pX4ikDfp3Y/A+Hw9wJow2/T8hSiLAS0voHKi0 +JuL5zXRIK05O1wTrRMuuOvvG0UUSa7M/yqB12pJWV6Q +-> ssh-ed25519 FpzvfQ n38lhFDy+xuLOlqQgXUhCrRfJJXG45J/lR3CvXyyNhs +cpIJXnimD4Kw7qwFnYmzDdv+peFSeVoDLepn074P22g +-> ssh-ed25519 kdPvzQ 6BFcuWAwjkas16kb0aWicpUw/+s5oS5fsQM06aowNDM +RMKPRUlPacPLLY02A21hy3qfIGkgTMCx3fduMNPZb8k +-> Vd,~-grease eb >N- +nhFZ/S0aoHjZpo4vX3M4aGEfzD2Qm2ey+fsPpSo +--- Rug5lKlvevXobavIgMKn7vLlfwE+YGx5/aR4eaGA3P8 +@+j&v*.u姪W}ݲ㺹9Z):p# "LQj Date: Tue, 19 Dec 2023 19:07:02 +0000 Subject: [PATCH 18/21] Move git to self-hosted hardware --- hosts/linode/default.nix | 18 ++++-- hosts/linode/git.nix | 126 ++------------------------------------- modules-linux/proxy.nix | 8 ++- 3 files changed, 25 insertions(+), 127 deletions(-) diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index eeca23e..c3eeb02 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -10,12 +10,20 @@ ./postgres.nix ./synapse.nix ]; - greg.home = false; - greg.linode.enable = true; - greg.tailscale.enable = true; - networking.hostName = "linode"; - networking.domain = "thehellings.com"; + greg = { + home = false; + linode.enable = true; + tailscale.enable = true; + }; + networking = { + hostName = "linode"; + domain = "thehellings.com"; + nameservers = [ + "100.88.91.27" + ]; + }; environment.systemPackages = with pkgs; [ + bind forgejo gitea-actions-runner graphviz diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index b0029c8..b6786d7 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -2,132 +2,16 @@ let srcDomain = "src.thehellings.com"; - ciDomain = "ci.thehellings.com"; - ciPort = "17080"; - droneDir = "/var/lib/drone"; - execWorkDir = "/var/lib/drone-exec"; - droneWorkerEnvironment = { - DRONE_RPC_PROTO = "https"; - DRONE_RPC_HOST = ciDomain; - DRONE_RUNNER_CAPACITY = "2"; - DRONE_RUNNER_NAME = "docker"; - }; in { - - environment.systemPackages = [ pkgs.drone-runner-exec ]; - ########################################################################################## - ########### - # GIT SERVICES - ########## - ########################################################################################## - services = { - forgejo = rec { - enable = true; - package = pkgs.unstable.forgejo; - database = { - type = "postgres"; - user = "forgejo"; - }; - dump = { - enable = true; - type = "tar.xz"; - }; - settings = { - actions.ENABLED = true; - DEFAULT = { - APP_NAME = "Greg's Sources"; - }; - server = rec { - ROOT_URL = "https://${DOMAIN}/"; - DOMAIN = srcDomain; - HTTP_PORT = 3001; - }; - service.DISABLE_REGISTRATION = pkgs.lib.mkForce true; - session.COOKIE_SECURE = pkgs.lib.mkForce true; - log.level = "Info"; - }; - }; - - # For now, at least, this is the same as Forgejo's action runner - gitea-actions-runner.instances = { - exec = { - enable = true; - hostPackages = with pkgs; [ - bashInteractive - podman - git - nodejs - ]; - name = "Linode"; - labels = [ - "native:host" - ]; - tokenFile = config.age.secrets.forgejo-runner.path; - url = "https://src.thehellings.com"; - settings = { - log.level = "info"; - runner = { - file = ".runner"; - capacity = 3; - envs = {}; # Environment variables - env_file = ".env"; - timeout = "3h"; # This is the default on Gitea/Forgejo as well - insecure = false; # TLS verification - fetch_timeout = "5s"; - fetch_interval = "2s"; - #labels = []; # See above - }; - cache = { - enabled = true; - dir = ""; # Default is $HOME/.cache/actcache - host = ""; # How to access cache from the runner, autodetect - port = 0; - external_server = ""; #We are not going externally - }; - container = { - network = ""; # Auto-create - privileged = false; - options = null; - workdir_parent = "/workspace"; - valid_volumes = []; - #docker_host = ""; - force_pull = false; - }; - host = { - workdir_parent = null; # Default $HOME/.cache/act - }; - }; - }; - }; - - logrotate = { - enable = true; - settings = { - forgejo = { - enable = true; - files = "${config.services.forgejo.dump.backupDir}/*"; - }; - }; - }; - }; - - age.secrets.forgejo-runner = { - file = ../../secrets/linode-forgejo-runner.age; - owner = config.systemd.services.gitea-runner-exec.serviceConfig.User; - }; - greg.proxies."${srcDomain}" = { - target = "${config.services.forgejo.settings.server.PROTOCOL}://${config.services.forgejo.settings.server.DOMAIN}:${toString config.services.forgejo.settings.server.HTTP_PORT}"; + target = "http://git.thehellings.lan"; ssl = true; genAliases = false; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; }; - - greg.backup.jobs.forgejo = { - src = config.services.forgejo.dump.backupDir; - dest = "forgejo"; - user = "forgejo"; - }; - ########################################################################################## ########### # CI SERVICES diff --git a/modules-linux/proxy.nix b/modules-linux/proxy.nix index e108242..e3d87ec 100644 --- a/modules-linux/proxy.nix +++ b/modules-linux/proxy.nix @@ -14,7 +14,7 @@ let proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; -''; +'' + dest.extraConfig; }; serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; }; @@ -63,6 +63,12 @@ in with lib; { description = "The path prefix for this proxy"; default = "/"; }; + + extraConfig = mkOption { + type = types.str; + description = "Extra nginx config options"; + default = ""; + }; }; })); }; From fb79feb58dea1ad8984a329bf93bff825cc6e088 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 19 Dec 2023 13:45:06 -0600 Subject: [PATCH 19/21] Login from Windows finally! --- hosts/myself/container-git.nix | 8 ++- hosts/myself/container-runner-vbox.nix | 3 + hosts/myself/git.nix | 79 ++++++++++++++------------ secrets/secrets.nix | 1 + 4 files changed, 53 insertions(+), 38 deletions(-) diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index c68fe88..bd46e0e 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -26,7 +26,13 @@ useHostResolvConf = lib.mkForce false; }; - greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + greg.proxies."192.168.200.2" = { + target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; services = { resolved.enable = true; diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix index c73e3c1..0bc60b3 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner-vbox.nix @@ -26,11 +26,14 @@ lib.attrsets.recursiveUpdate { curl gawk git + p7zip packer pup py shellcheck + unzip xorriso + wget ]; networking = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 6ae3a52..8a588b9 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -23,7 +23,13 @@ in { }; }; - greg.proxies."git.thehellings.lan".target = "http://192.168.200.2"; + greg.proxies."git.thehellings.lan" = { + target = "http://192.168.200.2"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; @@ -44,17 +50,32 @@ in { config = ((import ./container-git.nix) { inherit inputs registryPort; }); }; - systemd.services."container@gitlab-runner-qemu".serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ - "rmmod kvm_amd kvm" - ]; - ExecPreStart = [ - "modprobe kvm" - ]; + systemd.services = { + "container@gitlab-runner-qemu" = { + conflicts = [ + "container@gitlab-runner-vbox.service" + ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + ExecPostStop = [ "rmmod kvm_amd kvm" ]; + ExecPreStart = [ "modprobe kvm" ]; + }; + }; + "container@gitlab-runner-vbox" = { + conflicts = [ + "container@gitlab-runner-qemu.service" + ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ]; + ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ]; + }; + }; }; - systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ]; + ##################################################################################### + #################### QEmu Runner #################################################### + ##################################################################################### containers.gitlab-runner-qemu = container { bindMounts = { "/dev/kvm" = { @@ -70,22 +91,6 @@ in { config = ((import ./container-runner-qemu.nix) inputs); }; - systemd.services."container@gitlab-runner-vbox".serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ - "rmmod vboxnetadp vboxnetflt vboxdrv" - ]; - ExecPreStart = [ - "modprobe vboxdrv vboxnetadp vboxnetflt" - ]; - }; - systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ]; - - systemd.services.gitlab-runner = { - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - }; - ##################################################################################### #################### Virtualbox Runner ############################################## ##################################################################################### @@ -142,19 +147,19 @@ in { ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; services.gitlab-runner = { - enable = true; + enable = false; settings.concurrent = 5; - services.podman = { - executor = "docker"; - registrationConfigFile = config.age.secrets.runner-reg.path; - tagList = [ "container" ]; - dockerImage = "ubuntu:22.04"; + services = { + default = { + executor = "docker"; + registrationConfigFile = config.age.secrets.runner-reg.path; + dockerImage = "debian:stable"; + }; }; }; - virtualisation.podman = { - enable = true; - dockerCompat = true; - dockerSocket.enable = true; + virtualisation = { + docker.enable = true; + oci-containers.backend = "docker"; }; - virtualisation.docker.enable = false; + #users.users.gitlab-runner.extraGroups = [ "docker" ]; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index a82e039..d71e864 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -53,4 +53,5 @@ in "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; + "gitlab/myself-vmware-runner-reg.age".publicKeys = everyone; } From 714f9a6525f039dd0a62663a9223749c94cb65f8 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 19 Dec 2023 20:08:22 +0000 Subject: [PATCH 20/21] Add HAProxy for Git SSH --- hosts/linode/git.nix | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index b6786d7..23d762b 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -12,6 +12,30 @@ in { proxy_set_header X-Forwarded-Ssl on; ''; }; + + services.haproxy = { + enable = true; + config = builtins.concatStringsSep "\n" [ + "global" + " daemon" + " maxconn 20" + + "defaults" + " timeout connect 500s" + " timeout client 500s" + " timeout server 1h" + + "frontend gitsshd" + " bind *:2222" + " default_backend gitssh" + " timeout client 1h" + + "backend gitssh" + " mode tcp" + " server git-thehellings-lan git.thehellings.lan:2222" + ]; + }; + ########################################################################################## ########### # CI SERVICES From 11825d46be9875bb88b86f2f50c649ca32a6cda0 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 19 Dec 2023 23:03:38 -0600 Subject: [PATCH 21/21] Update pipenv, add ITG options, py311 from nixos23_05 --- flake.lock | 34 ++++++------- flake.nix | 7 +-- home/home.nix | 1 - home/hosts/ivr/default.nix | 17 +++++-- home/modules/default.nix | 1 + home/modules/python.nix | 10 ++++ overlays/default.nix | 3 ++ overlays/graypy.nix | 35 ++++++++++++++ overlays/itg-django-utils.nix | 35 ++++++++++++++ overlays/pipenv.nix | 90 +++++++++++++++++++++++++++++++++++ 10 files changed, 209 insertions(+), 24 deletions(-) create mode 100644 home/modules/python.nix create mode 100644 overlays/graypy.nix create mode 100644 overlays/itg-django-utils.nix create mode 100644 overlays/pipenv.nix diff --git a/flake.lock b/flake.lock index 7170cee..aaccb3f 100644 --- a/flake.lock +++ b/flake.lock @@ -274,6 +274,22 @@ "type": "github" } }, + "nix23_05": { + "locked": { + "lastModified": 1702759837, + "narHash": "sha256-u3XeJVRe/Q975nwFE+6ALEwypMKJEELMJKDAhSKyq3M=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "b2566f4f897ac6224e094b167d9488d03e157f28", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.05", + "repo": "nixpkgs", + "type": "github" + } + }, "nixneovim": { "inputs": { "flake-utils": "flake-utils_2", @@ -372,22 +388,6 @@ "type": "github" } }, - "nixpy311": { - "locked": { - "lastModified": 1698696950, - "narHash": "sha256-FHFL58t6lMumvWqwundC8fDDDLOIvc+JJBNIAlPjrDY=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "017ef2132a5bda50bd713aeabce8f918502d4ec1", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-23.05", - "repo": "nixpkgs", - "type": "github" - } - }, "nixstable": { "locked": { "lastModified": 1702233072, @@ -502,8 +502,8 @@ "flake-utils": "flake-utils", "hm": "hm", "hmunstable": "hmunstable", + "nix23_05": "nix23_05", "nixneovim": "nixneovim", - "nixpy311": "nixpy311", "nixstable": "nixstable", "nixunstable": "nixunstable", "nurpkgs": "nurpkgs", diff --git a/flake.nix b/flake.nix index e309825..15533ae 100644 --- a/flake.nix +++ b/flake.nix @@ -20,7 +20,7 @@ inputs.nixpkgs.follows = "nixstable"; }; nixneovim.url = "github:NixNeovim/NixNeovim"; - nixpy311.url = "github:NixOS/nixpkgs/nixos-23.05"; + nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05"; nixstable.url = "github:nixos/nixpkgs/nixos-23.11"; nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; nurpkgs.url = "github:nix-community/NUR"; @@ -37,7 +37,7 @@ hm, hmunstable, nixneovim, - nixpy311, + nix23_05, nixstable, nixunstable, nurpkgs, @@ -48,7 +48,8 @@ let pkg-sets = ( final: prev: { - unstable = import inputs.nixunstable { system = final.system; }; + unstable = import inputs.nixunstable { system = final.system; inherit overlays; }; + nix23_05 = import inputs.nix23_05 { system = final.system; inherit overlays; }; } ); local_overlay = import ./overlays; diff --git a/home/home.nix b/home/home.nix index 25e6912..2bb02f5 100644 --- a/home/home.nix +++ b/home/home.nix @@ -41,7 +41,6 @@ gh git gnupatch - gregpy hms htop inetutils diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix index e2713dc..1300fc9 100644 --- a/home/hosts/ivr/default.nix +++ b/home/hosts/ivr/default.nix @@ -1,10 +1,21 @@ { pkgs, lib, inputs, ...}: - -{ +let + py = pkgs.nix23_05.python311.withPackages ( p: with p; [ + django + djangorestframework + django-rapyd-modernauth + environs + #itg-django-utils + mysqlclient + ruamel-yaml + tox + ]); +in { imports = [ ../../vscodium.nix ]; + greg.pypackage = py; home = { packages = with pkgs; [ aacs @@ -13,7 +24,7 @@ direnv home-manager insomnia - pipenv + pipenv-ivr ]; file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ "[global]" diff --git a/home/modules/default.nix b/home/modules/default.nix index a6344c7..81d29d5 100644 --- a/home/modules/default.nix +++ b/home/modules/default.nix @@ -3,6 +3,7 @@ { imports = [ ./gnome.nix + ./python.nix ./xonsh.nix ]; } diff --git a/home/modules/python.nix b/home/modules/python.nix new file mode 100644 index 0000000..d7ed997 --- /dev/null +++ b/home/modules/python.nix @@ -0,0 +1,10 @@ +{ config, pkgs, lib, ... }: +{ + options.greg.pypackage = lib.mkOption { + description = "Enable Gnome support and settings"; + type = lib.types.package; + default = pkgs.gregpy; + }; + + config.home.packages = [ config.greg.pypackage ]; +} diff --git a/overlays/default.nix b/overlays/default.nix index ec7a7a0..7f58711 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -33,6 +33,8 @@ in rec { pythonPackagesExtensions = (prev.pythonPackagesExtensions or []) ++ [ (python-final: python-prev: let cp = python-final.callPackage; in { django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix {}; + graypy = cp ./graypy.nix {}; + itg-django-utils = cp ./itg-django-utils.nix {}; xonsh-apipenv = cp ./xonsh-apipenv.nix {}; xonsh-direnv = cp ./xonsh-direnv.nix {}; xontrib-vox = cp ./xonsh-vox.nix {}; @@ -63,6 +65,7 @@ in rec { handbrake = prev.handbrake.override { libbluray = libbluray-custom; }; + pipenv-ivr = prev.callPackage ./pipenv.nix { }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; diff --git a/overlays/graypy.nix b/overlays/graypy.nix new file mode 100644 index 0000000..2cce63e --- /dev/null +++ b/overlays/graypy.nix @@ -0,0 +1,35 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + + amqplib, + mock, + pytestCheckHook, + requests, +}: + +buildPythonPackage rec { + pname = "graypy"; + version = "2.1.0"; + + src = fetchFromGitHub { + owner = "severb"; + repo = "graypy"; + rev = "2.1.0"; + hash = "sha256-y1HbJEpqnAgOeB+zXKy3iUT6Lpv0bufjL7+jWUSAjFs="; + }; + + nativeCheckInputs = [ + amqplib + mock + pytestCheckHook + requests + ]; + + meta = with lib; { + description = "Python logging handlers that send messages in the Graylog Extended Log Format (GELF)."; + homepage = "https://github.com/severb/graypy"; + license = licenses.bsd3; + }; +} diff --git a/overlays/itg-django-utils.nix b/overlays/itg-django-utils.nix new file mode 100644 index 0000000..0a4f712 --- /dev/null +++ b/overlays/itg-django-utils.nix @@ -0,0 +1,35 @@ +{ + lib, + buildPythonPackage, + fetchurl, + + django, + djangorestframework, + graypy, + setuptools, +}: + +buildPythonPackage rec { + pname = "itg-django-utils"; + version = "0.1.11"; + + src = fetchurl { + url = "https://pypi.ivrtechnology.com/packages/itg-django-utils-0.1.12.tar.gz"; + hash = "sha256-LbOl4L4UZbRTlLuBL4L3ser6+WDuP3R5a03EIh1xSK8="; + }; + + propagatedBuildInputs = [ + django + djangorestframework + graypy + setuptools + ]; + + meta = with lib; { + description = "ITG specific stuff"; + homepage = "http://www.ivrtechnology.com"; + maintainers = []; + }; + + doCheck = false; +} diff --git a/overlays/pipenv.nix b/overlays/pipenv.nix new file mode 100644 index 0000000..6f129ab --- /dev/null +++ b/overlays/pipenv.nix @@ -0,0 +1,90 @@ +{ lib +, stdenv +, python3 +, fetchFromGitHub +, installShellFiles +}: + +with python3.pkgs; + +let + + runtimeDeps = ps: with ps; [ + certifi + setuptools + pip + virtualenv + virtualenv-clone + ] + ++ lib.optionals stdenv.hostPlatform.isAndroid [ + pyjnius + ]; + + pythonEnv = python3.withPackages runtimeDeps; + +in buildPythonApplication rec { + pname = "pipenv"; + version = "2023.11.15"; + format = "pyproject"; + + src = fetchFromGitHub { + owner = "pypa"; + repo = "pipenv"; + rev = "refs/tags/v${version}"; + hash = "sha256-kxwyws22xJkqBy/hXXcAPHZR2NgZHbmwZr9vYqce434="; + }; + + env.LC_ALL = "en_US.UTF-8"; + + nativeBuildInputs = [ + installShellFiles + setuptools + wheel + ]; + + postPatch = '' + # pipenv invokes python in a subprocess to create a virtualenv + # and to call setup.py. + # It would use sys.executable, which in our case points to a python that + # does not have the required dependencies. + substituteInPlace pipenv/utils/virtualenv.py \ + --replace "sys.executable" "'${pythonEnv.interpreter}'" + ''; + + propagatedBuildInputs = runtimeDeps python3.pkgs; + + preCheck = '' + export HOME="$TMPDIR" + ''; + + nativeCheckInputs = [ + mock + pytestCheckHook + pytest-xdist + pytz + requests + ]; + + disabledTests = [ + "test_convert_deps_to_pip" + "test_download_file" + ]; + + disabledTestPaths = [ + "tests/integration" + ]; + + postInstall = '' + installShellCompletion --cmd pipenv \ + --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \ + --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \ + --fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv) + ''; + + meta = with lib; { + description = "Python Development Workflow for Humans"; + license = licenses.mit; + platforms = platforms.all; + maintainers = with maintainers; [ berdario ]; + }; +}