Compare commits
6
Commits
main
..
44f40b8b21
| Author | SHA1 | Date | |
|---|---|---|---|
 klaatu
|
44f40b8b21 | ||
|
klaatu
|
0ef9452316 | ||
|
klaatu
|
f32bce7dfc | ||
|
klaatu
|
d34dd0c0eb | ||
|
klaatu
|
a06de059ee | ||
|
klaatu
|
53ef9af83a |
@@ -1,51 +0,0 @@
|
||||
name: Update flake.lock
|
||||
|
||||
"on":
|
||||
schedule:
|
||||
- cron: "0 0 * * 0" # Every Sunday at midnight UTC
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
update-flake-lock:
|
||||
runs-on: nix-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Update flake.lock
|
||||
run: nix flake update
|
||||
|
||||
- name: Create PR if changed
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
|
||||
GITEA_URL: https://src.thehellings.com
|
||||
REPO: greg/nixos
|
||||
run: |
|
||||
if git diff --quiet flake.lock; then
|
||||
echo "flake.lock unchanged, nothing to do"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
BRANCH="auto/update-flake-lock-$(date +%Y%m%d)"
|
||||
git config user.email "klaatu@thehellings.com"
|
||||
git config user.name "klaatu"
|
||||
git checkout -b "$BRANCH"
|
||||
git add flake.lock
|
||||
git commit -m "chore: update flake.lock $(date +%Y-%m-%d)"
|
||||
|
||||
# Push branch using token auth
|
||||
git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
|
||||
git push origin "$BRANCH"
|
||||
|
||||
# Create PR via Gitea API
|
||||
curl -s -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
|
||||
-d "{
|
||||
\"title\": \"chore: update flake.lock $(date +%Y-%m-%d)\",
|
||||
\"head\": \"$BRANCH\",
|
||||
\"base\": \"main\",
|
||||
\"body\": \"Automated weekly flake.lock update.\\n\\nGenerated by Gitea Actions.\",
|
||||
\"assignees\": [\"greg\"]
|
||||
}"
|
||||
@@ -1,58 +0,0 @@
|
||||
name: Update manifest chart versions
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 0 * * 1" # Every Monday at midnight UTC
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
update-manifests:
|
||||
runs-on: [bare-metal, nix-latest]
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Scan manifests for chart version updates
|
||||
run: |
|
||||
echo "TODO: implement manifest update scanning"
|
||||
echo ""
|
||||
echo "Planned implementation:"
|
||||
echo " 1. Parse each manifests/*/chart.yaml for HelmRelease chart versions"
|
||||
echo " 2. Query artifact hub or helm repo for latest versions"
|
||||
echo " 3. Emit a diff of available updates"
|
||||
echo ""
|
||||
echo "Scanned manifests directories:"
|
||||
ls manifests/
|
||||
|
||||
- name: Create PR if changes found
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
|
||||
GITEA_URL: https://src.thehellings.com
|
||||
REPO: greg/nixos
|
||||
run: |
|
||||
if git diff --quiet; then
|
||||
echo "No manifest changes, nothing to do"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
BRANCH="auto/update-manifests-$(date +%Y%m%d)"
|
||||
git config user.email "klaatu@thehellings.com"
|
||||
git config user.name "klaatu"
|
||||
git checkout -b "$BRANCH"
|
||||
git add manifests/
|
||||
git commit -m "chore: update manifest chart versions $(date +%Y-%m-%d)"
|
||||
|
||||
git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
|
||||
git push origin "$BRANCH"
|
||||
|
||||
curl -s -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
|
||||
-d "{
|
||||
\"title\": \"chore: update manifest chart versions $(date +%Y-%m-%d)\",
|
||||
\"head\": \"$BRANCH\",
|
||||
\"base\": \"main\",
|
||||
\"body\": \"Automated weekly manifest chart version update.\\n\\nGenerated by Gitea Actions.\",
|
||||
\"assignees\": [\"greg\"]
|
||||
}"
|
||||
@@ -1,51 +0,0 @@
|
||||
name: Update zims pin
|
||||
|
||||
"on":
|
||||
schedule:
|
||||
- cron: "0 2 1 * *" # 0200 on the first of every month
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
update-flake-lock:
|
||||
runs-on: nix-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Update flake.lock
|
||||
run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
|
||||
|
||||
- name: Create PR if changed
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
|
||||
GITEA_URL: https://src.thehellings.com
|
||||
REPO: greg/nixos
|
||||
run: |
|
||||
if git diff --quiet pkgs/zim/blobs.json; then
|
||||
echo "blobs.json unchanged, nothing to do"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
BRANCH="auto/update-zims-$(date +%Y%m%d)"
|
||||
git config user.email "klaatu@thehellings.com"
|
||||
git config user.name "klaatu"
|
||||
git checkout -b "$BRANCH"
|
||||
git add pkgs/zim/blobs.json
|
||||
git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
|
||||
|
||||
# Push branch using token auth
|
||||
git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
|
||||
git push origin "$BRANCH"
|
||||
|
||||
# Create PR via Gitea API
|
||||
curl -s -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
|
||||
-d "{
|
||||
\"title\": \"chore: update zims $(date +%Y-%m-%d)\",
|
||||
\"head\": \"$BRANCH\",
|
||||
\"base\": \"main\",
|
||||
\"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
|
||||
\"assignees\": [\"greg\"]
|
||||
}"
|
||||
@@ -0,0 +1,23 @@
|
||||
stages:
|
||||
- eval
|
||||
- build
|
||||
- push
|
||||
|
||||
"Evaluate for builds":
|
||||
stage: eval
|
||||
tags:
|
||||
- kubernetes
|
||||
image: "$CI_REGISTRY/greg/ci-images/builder:latest"
|
||||
artifacts:
|
||||
paths:
|
||||
- gitlab-ci-continue.yml
|
||||
script: nix run ".#gen-build" > gitlab-ci-continue.yml
|
||||
|
||||
"Trigger builds":
|
||||
stage: build
|
||||
trigger:
|
||||
include:
|
||||
- artifact: gitlab-ci-continue.yml
|
||||
job: "Evaluate for builds"
|
||||
variables:
|
||||
PARENT_PIPELINE_ID: $CI_PIPELINE_ID
|
||||
@@ -17,7 +17,7 @@ repos:
|
||||
- id: mixed-line-ending
|
||||
- id: trailing-whitespace
|
||||
- repo: https://github.com/adrienverge/yamllint.git
|
||||
rev: v1.38.0
|
||||
rev: v1.37.1
|
||||
hooks:
|
||||
- id: yamllint
|
||||
args:
|
||||
@@ -30,9 +30,8 @@ repos:
|
||||
comments: false
|
||||
comments-indentation: false
|
||||
document-start: false
|
||||
line-length: false
|
||||
- repo: https://github.com/NixOS/nixfmt
|
||||
rev: v1.2.0
|
||||
rev: v1.1.0
|
||||
hooks:
|
||||
- id: nixfmt-nix
|
||||
- repo: https://github.com/astro/deadnix
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER
|
||||
MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
|
||||
MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n
|
||||
czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C
|
||||
AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi
|
||||
7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD
|
||||
AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt
|
||||
zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49
|
||||
BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb
|
||||
LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,11 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER
|
||||
MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
|
||||
MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n
|
||||
czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
|
||||
AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2
|
||||
g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
|
||||
HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK
|
||||
BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi
|
||||
pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,54 @@
|
||||
services:
|
||||
attic:
|
||||
container_name: attic
|
||||
image: ghcr.io/zhaofengli/attic:latest
|
||||
command: ["-f", "/attic/server.toml"]
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- 8080:8080
|
||||
networks:
|
||||
attic:
|
||||
pgattic:
|
||||
volumes:
|
||||
- /mnt/all/configs/attic/server.toml:/attic/server.toml
|
||||
- /mnt/all/containers/attic/data:/attic/storage
|
||||
env_file:
|
||||
- stack.env
|
||||
depends_on:
|
||||
pgattic:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
"wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
|
||||
]
|
||||
interval: 15s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
start_period: 15s
|
||||
deploy:
|
||||
resources:
|
||||
reservations:
|
||||
cpus: 1.0
|
||||
|
||||
pgattic:
|
||||
container_name: pgattic
|
||||
image: postgres:17.6-alpine
|
||||
restart: unless-stopped
|
||||
ports: []
|
||||
networks:
|
||||
pgattic:
|
||||
volumes:
|
||||
- /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
|
||||
env_file:
|
||||
- stack.env
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
networks:
|
||||
attic:
|
||||
pgattic:
|
||||
@@ -0,0 +1,9 @@
|
||||
services:
|
||||
pinchflat:
|
||||
image: ghcr.io/kieraneglin/pinchflat:latest
|
||||
ports:
|
||||
- "8945:8945"
|
||||
volumes:
|
||||
- "/mnt/all/configs/pinchflat:/config"
|
||||
- "/mnt/all/video/yt:/downloads"
|
||||
restart: unless-stopped
|
||||
@@ -0,0 +1,19 @@
|
||||
# Demo of rest-server with prometheus and grafana
|
||||
version: "2"
|
||||
|
||||
services:
|
||||
restserver:
|
||||
image: "restic/rest-server:0.14.0"
|
||||
volumes:
|
||||
- /mnt/all/backups:/data
|
||||
- /mnt/all/configs/certs:/certs
|
||||
environment:
|
||||
OPTIONS: >-
|
||||
--tls
|
||||
--tls-cert /certs/nas1.shire-zebra.ts.net.crt
|
||||
--tls-key /certs/nas1.shire-zebra.ts.net.key
|
||||
--path /data
|
||||
--prometheus
|
||||
--debug
|
||||
ports:
|
||||
- "30248:8000"
|
||||
+26
-55
@@ -1,82 +1,53 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
pkgs',
|
||||
top,
|
||||
...
|
||||
}:
|
||||
let
|
||||
system = builtins.replaceStrings [ "darwin" ] [ "linux" ] pkgs.stdenv.hostPlatform.system;
|
||||
builderConfig = top.nixunstable.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
"${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
|
||||
{
|
||||
virtualisation = {
|
||||
host.pkgs = pkgs;
|
||||
darwin-builder = {
|
||||
workingDirectory = "/var/lib/darwin-builder";
|
||||
hostPort = 22;
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
builder-config = {
|
||||
darwin-aarch-builder = top.self.nixosConfigurations.builder-aarch;
|
||||
darwin-x86-builder = top.self.nixosConfigurations.builder-x86;
|
||||
};
|
||||
builder = {
|
||||
command = "${builderConfig.config.system.build.macos-builder-installer}/bin/create-builder";
|
||||
builder = arch: let
|
||||
b = builder-config."darwin-${arch}-builder";
|
||||
in {
|
||||
command = "${b.config.system.build.macos-builder-installer}/bin/create-builder";
|
||||
serviceConfig = {
|
||||
KeepAlive = true;
|
||||
RunAtLoad = true;
|
||||
StandardOutPath = "/var/log/builder-vm-${system}.log";
|
||||
StandardErrorPath = "/var/log/builder-vm-${system}.stderr.log";
|
||||
StandardOutPath = "/var/log/builder-vm-${arch}.log";
|
||||
StandardErrorPath = "/var/log/builder-vm-${arch}.stderr.log";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
environment = {
|
||||
launchDaemons = {
|
||||
"limit.maxfiles.plist" = {
|
||||
enable = true;
|
||||
text = ''
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Label</key>
|
||||
<string>limit.maxfiles</string>
|
||||
<key>ProgramArguments</key>
|
||||
<array>
|
||||
<string>launchctl</string>
|
||||
<string>limit</string>
|
||||
<string>maxfiles</string>
|
||||
<string>524288</string>
|
||||
<string>524288</string>
|
||||
</array>
|
||||
<key>RunAtLoad</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</plist>
|
||||
'';
|
||||
};
|
||||
};
|
||||
systemPackages = with pkgs; [
|
||||
agenix
|
||||
pkgs'.hms
|
||||
procps # Includes tools like `watch`, `kill`, and `ps`
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
hms
|
||||
];
|
||||
|
||||
fonts.packages = with pkgs; [
|
||||
dejavu_fonts
|
||||
nerd-fonts.hack
|
||||
];
|
||||
|
||||
#launchd.daemons.darwin-builder = builder;
|
||||
launchd.daemons = lib.genAttrs' [ "x86" "aarch" ] (arch: lib.nameValuePair "builder-${arch}-machine" (builder arch));
|
||||
|
||||
nix = {
|
||||
#buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
|
||||
enable = true;
|
||||
buildMachines = [
|
||||
{
|
||||
hostName = "ssh-ng://builder@localhost";
|
||||
system = "aarch64-linux";
|
||||
maxJobs = 4;
|
||||
supportedFeatures = [
|
||||
"kvm"
|
||||
"benchmarch"
|
||||
"big-parallel"
|
||||
];
|
||||
}
|
||||
];
|
||||
gc.interval.Hour = 3;
|
||||
#linux-builder.enable = true;
|
||||
settings.auto-optimise-store = false; # Darwin bugs?
|
||||
};
|
||||
|
||||
|
||||
+4
-2
@@ -19,7 +19,6 @@ let
|
||||
specialArgs = {
|
||||
inherit metadata top;
|
||||
inherit (top) self;
|
||||
pkgs' = top.self.packages.${system};
|
||||
};
|
||||
modules = [
|
||||
{
|
||||
@@ -38,4 +37,7 @@ let
|
||||
++ lib.optionals (builtins.pathExists ./hosts/${name}) [ ./hosts/${name} ];
|
||||
};
|
||||
in
|
||||
(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) (name: mac { inherit name; }))
|
||||
{
|
||||
"MacBook-Pro" = mac { name = "ivr"; };
|
||||
"MacBook-Prolocal" = mac { name = "ivr"; };
|
||||
}
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
gregory
|
||||
@@ -1 +0,0 @@
|
||||
gregory
|
||||
@@ -1 +0,0 @@
|
||||
gregory/
|
||||
@@ -31,7 +31,6 @@ in
|
||||
"bitwarden"
|
||||
"bruno"
|
||||
"chromium"
|
||||
"claude"
|
||||
"dbeaver-community"
|
||||
"ghostty"
|
||||
"firefox"
|
||||
@@ -1 +0,0 @@
|
||||
lithic/
|
||||
@@ -1,53 +0,0 @@
|
||||
{ ... }:
|
||||
let
|
||||
username = "greg";
|
||||
in
|
||||
{
|
||||
greg = {
|
||||
nix.cache = false;
|
||||
};
|
||||
|
||||
homebrew = {
|
||||
enable = true;
|
||||
brews = [
|
||||
"bitwarden-cli"
|
||||
"colima"
|
||||
"direnv"
|
||||
"github-mcp-server"
|
||||
{
|
||||
name = "libvirt";
|
||||
restart_service = true;
|
||||
}
|
||||
"mcp-atlassian"
|
||||
"notion-mcp-server"
|
||||
"nushell"
|
||||
"qemu"
|
||||
"slack-mcp-server"
|
||||
"zlib"
|
||||
];
|
||||
casks = [
|
||||
"alt-tab"
|
||||
"audacity"
|
||||
"bitwarden"
|
||||
"bruno"
|
||||
"chromium"
|
||||
"claude-code"
|
||||
"dbeaver-community"
|
||||
"ghostty"
|
||||
"firefox"
|
||||
"notion"
|
||||
"notunes"
|
||||
"onlyoffice"
|
||||
"tabby"
|
||||
"zed"
|
||||
];
|
||||
user = username;
|
||||
};
|
||||
|
||||
system.primaryUser = username;
|
||||
|
||||
users.users."${username}" = {
|
||||
name = username;
|
||||
home = "/Users/${username}";
|
||||
};
|
||||
}
|
||||
Generated
+276
-232
@@ -25,17 +25,19 @@
|
||||
},
|
||||
"buildbot": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts",
|
||||
"hercules-ci-effects": "hercules-ci-effects",
|
||||
"nixpkgs": [
|
||||
"nixunstable"
|
||||
],
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1783833875,
|
||||
"narHash": "sha256-G+hRtNJ/Nnr6VFMQp2UZdx/ckJDR/RJoK0Fy/yx1/YY=",
|
||||
"lastModified": 1772467670,
|
||||
"narHash": "sha256-DF/1VCg7Qmw5iaFhBeKBysOSTDCxZlKJHdbJc7Q2e1k=",
|
||||
"owner": "nix-community",
|
||||
"repo": "buildbot-nix",
|
||||
"rev": "147af587241e2af85399402da60a4f44fdb1e5d7",
|
||||
"rev": "f927795b97474875738ac134525af560b2d4a8a5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -44,20 +46,44 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"charts": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"haumea": "haumea",
|
||||
"nix-kube-generators": "nix-kube-generators",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"pyproject-build-systems": "pyproject-build-systems",
|
||||
"pyproject-nix": "pyproject-nix",
|
||||
"uv2nix": "uv2nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1772676442,
|
||||
"narHash": "sha256-bPxUBXS2mdT4BjMAmTap5TkXnUX807qo4Uho2oVb2Fg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixhelm",
|
||||
"rev": "19cdbb3a03554059165a25a18b32bd253e62c883",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixhelm",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"colmena": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"flake-utils": "flake-utils",
|
||||
"flake-utils": "flake-utils_2",
|
||||
"nix-github-actions": "nix-github-actions",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"stable": "stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1783909498,
|
||||
"narHash": "sha256-T9OfLPLuh1Bf1xojlpWXwooJ6IXapxvb8GM0p3YNy8g=",
|
||||
"lastModified": 1762034856,
|
||||
"narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
|
||||
"owner": "zhaofengli",
|
||||
"repo": "colmena",
|
||||
"rev": "76ba0daa542880b730faec81f4e87efcaa63bc57",
|
||||
"rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -95,11 +121,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784362797,
|
||||
"narHash": "sha256-EP9b9b+OXDxHBPefFwMYCIaLq0fn3UkmrbfzbLUT7kQ=",
|
||||
"lastModified": 1772379624,
|
||||
"narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "b4cccbd4bc299c1f71ae185b79c3cf99aa82805c",
|
||||
"rev": "52d061516108769656a8bd9c6e811c677ec5b462",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -112,11 +138,11 @@
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1767039857,
|
||||
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
|
||||
"lastModified": 1650374568,
|
||||
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
|
||||
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -126,22 +152,6 @@
|
||||
}
|
||||
},
|
||||
"flake-compat_2": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1747046372,
|
||||
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat_3": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1767039857,
|
||||
@@ -159,14 +169,17 @@
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
"nixpkgs-lib": [
|
||||
"buildbot",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782949081,
|
||||
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
|
||||
"lastModified": 1769996383,
|
||||
"narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
|
||||
"rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -177,17 +190,14 @@
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nixvimunstable",
|
||||
"nixpkgs"
|
||||
]
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782949081,
|
||||
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
|
||||
"lastModified": 1772408722,
|
||||
"narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
|
||||
"rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -197,6 +207,27 @@
|
||||
}
|
||||
},
|
||||
"flake-parts_3": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nixvimunstable",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1769996383,
|
||||
"narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_4": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nurpkgs",
|
||||
@@ -235,6 +266,68 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"locked": {
|
||||
"lastModified": 1659877975,
|
||||
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"haumea": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"charts",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1685133229,
|
||||
"narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
|
||||
"owner": "nix-community",
|
||||
"repo": "haumea",
|
||||
"rev": "34dd58385092a23018748b50f9b23de6266dffc2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "v0.2.2",
|
||||
"repo": "haumea",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"hercules-ci-effects": {
|
||||
"inputs": {
|
||||
"flake-parts": [
|
||||
"buildbot",
|
||||
"flake-parts"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"buildbot",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1771131391,
|
||||
"narHash": "sha256-HPBNYf7HiKtBVy7/69vKpLYHX6wTcUxndxmybzDlXP8=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "hercules-ci-effects",
|
||||
"rev": "0b152e0f7c5cc265a529cd63374b80e2771b207b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "hercules-ci-effects",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"hmunstable": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -242,11 +335,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784407317,
|
||||
"narHash": "sha256-iZrxHToDJWnvt+5LGAtvuQMTy1NZYlNEKbKaVtBJNcc=",
|
||||
"lastModified": 1772633327,
|
||||
"narHash": "sha256-jl+DJB2DUx7EbWLRng+6HNWW/1/VQOnf0NsQB4PlA7I=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "39411a8e12a5526d992e65bc7e3dc9a4414d6713",
|
||||
"rev": "5a75730e6f21ee624cbf86f4915c6e7489c74acc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -277,45 +370,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"minecraft": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_2",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784344393,
|
||||
"narHash": "sha256-yAo2ZzSIdeBZg7cOKUpQxwflL+DRYN+1DMObZk2lP2Q=",
|
||||
"owner": "Infinidoge",
|
||||
"repo": "nix-minecraft",
|
||||
"rev": "7297d14c52ec8ef39c6aeff2c1818541fd030473",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Infinidoge",
|
||||
"repo": "nix-minecraft",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"niks3": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"treefmt-nix": "treefmt-nix_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784016977,
|
||||
"narHash": "sha256-TydDba3YD2u15uS0L+PDs7lMqPopnzWggljTKDqOCSw=",
|
||||
"owner": "Mic92",
|
||||
"repo": "niks3",
|
||||
"rev": "b306808bf381e7e66e33de1e9446a1be0935f4e3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Mic92",
|
||||
"repo": "niks3",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-github-actions": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -324,11 +378,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737420293,
|
||||
"narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
|
||||
"lastModified": 1729742964,
|
||||
"narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-github-actions",
|
||||
"rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
|
||||
"rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -338,15 +392,12 @@
|
||||
}
|
||||
},
|
||||
"nix-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784310968,
|
||||
"narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
|
||||
"lastModified": 1771969195,
|
||||
"narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "779c32a00155994c86cde8213a8dd4df139d4355",
|
||||
"rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -355,13 +406,28 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-kube-generators": {
|
||||
"locked": {
|
||||
"lastModified": 1762437901,
|
||||
"narHash": "sha256-5yuJODagAq+aMXQAT2c0gfXKLqapmA6eUHR33jKNHuU=",
|
||||
"owner": "farcaller",
|
||||
"repo": "nix-kube-generators",
|
||||
"rev": "810dcf792081790648ba9ae705b9a2286115ace8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "farcaller",
|
||||
"repo": "nix-kube-generators",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1783224372,
|
||||
"narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
|
||||
"lastModified": 1767767207,
|
||||
"narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "d407951447dcd00442e97087bf374aad70c04cea",
|
||||
"rev": "5912c1772a44e31bf1c63c0390b90501e5026886",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -373,26 +439,11 @@
|
||||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1782614948,
|
||||
"narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
|
||||
"lastModified": 1772328832,
|
||||
"narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-lib_2": {
|
||||
"locked": {
|
||||
"lastModified": 1783821755,
|
||||
"narHash": "sha256-eMPX9S6MKPyUnaOgeRfrG7OKUiAlc1AlcRinMbSB0WA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "228ab8523d81526e57a6ca342e1a919fb6d246a8",
|
||||
"rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -403,15 +454,15 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1769461804,
|
||||
"narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
|
||||
"owner": "nixos",
|
||||
"lastModified": 1750134718,
|
||||
"narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
|
||||
"rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
@@ -419,56 +470,11 @@
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1783978241,
|
||||
"narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1767892417,
|
||||
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
|
||||
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
|
||||
}
|
||||
},
|
||||
"nixpkgs_5": {
|
||||
"locked": {
|
||||
"lastModified": 1783915482,
|
||||
"narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_6": {
|
||||
"locked": {
|
||||
"lastModified": 1784356753,
|
||||
"narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
|
||||
"lastModified": 1772624091,
|
||||
"narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
|
||||
"rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -478,50 +484,52 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_7": {
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1777207419,
|
||||
"narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
|
||||
"lastModified": 1766025857,
|
||||
"narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
|
||||
"rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
|
||||
"rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixunstable": {
|
||||
"locked": {
|
||||
"lastModified": 1784700541,
|
||||
"narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
|
||||
"owner": "geri1701",
|
||||
"lastModified": 1772963539,
|
||||
"narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7",
|
||||
"rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "geri1701",
|
||||
"ref": "lego-v5-acme-spike",
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixvimunstable": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts_2",
|
||||
"nixpkgs": "nixpkgs_5",
|
||||
"systems": "systems_4"
|
||||
"flake-parts": "flake-parts_3",
|
||||
"nixpkgs": [
|
||||
"nixunstable"
|
||||
],
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784057377,
|
||||
"narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
|
||||
"lastModified": 1772402258,
|
||||
"narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "07180a087e4a00720dc0731cbcd8dec796974381",
|
||||
"rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -533,15 +541,15 @@
|
||||
},
|
||||
"nurpkgs": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts_3",
|
||||
"nixpkgs": "nixpkgs_6"
|
||||
"flake-parts": "flake-parts_4",
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784417922,
|
||||
"narHash": "sha256-19XZ56wJXArMKxjY25pKXkNp/FrYHGoo+HuQtW6teSM=",
|
||||
"lastModified": 1772717146,
|
||||
"narHash": "sha256-x2nJlzpiHWHLkGDBvaiO1ysLhaxjQCLsG3XieRueJ/c=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "2c806d314605495dd7fd75b5950003a062e2b47a",
|
||||
"rev": "2e1bffbdde931c4300a59418d0150c7457022f2d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -550,18 +558,66 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pyproject-build-systems": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"charts",
|
||||
"nixpkgs"
|
||||
],
|
||||
"pyproject-nix": [
|
||||
"charts",
|
||||
"pyproject-nix"
|
||||
],
|
||||
"uv2nix": [
|
||||
"charts",
|
||||
"uv2nix"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1763662255,
|
||||
"narHash": "sha256-4bocaOyLa3AfiS8KrWjZQYu+IAta05u3gYZzZ6zXbT0=",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "build-system-pkgs",
|
||||
"rev": "042904167604c681a090c07eb6967b4dd4dae88c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "build-system-pkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pyproject-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"charts",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1764134915,
|
||||
"narHash": "sha256-xaKvtPx6YAnA3HQVp5LwyYG1MaN4LLehpQI8xEdBvBY=",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "pyproject.nix",
|
||||
"rev": "2c8df1383b32e5443c921f61224b198a2282a657",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "pyproject.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"buildbot": "buildbot",
|
||||
"charts": "charts",
|
||||
"colmena": "colmena",
|
||||
"darwin": "darwin_2",
|
||||
"flake-parts": "flake-parts",
|
||||
"flake-parts": "flake-parts_2",
|
||||
"hmunstable": "hmunstable",
|
||||
"minecraft": "minecraft",
|
||||
"niks3": "niks3",
|
||||
"nix-hardware": "nix-hardware",
|
||||
"nixpkgs-lib": "nixpkgs-lib_2",
|
||||
"nixunstable": "nixunstable",
|
||||
"nixvimunstable": "nixvimunstable",
|
||||
"nurpkgs": "nurpkgs",
|
||||
@@ -571,16 +627,16 @@
|
||||
},
|
||||
"stable": {
|
||||
"locked": {
|
||||
"lastModified": 1783625654,
|
||||
"narHash": "sha256-pI1244/PJfTyKhlAr2QYQC55vR6UQdnGA0rJUgtO2IQ=",
|
||||
"lastModified": 1750133334,
|
||||
"narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0230bd8d5cbd13893b2263918d396a2c7dd0407",
|
||||
"rev": "36ab78dab7da2e4e27911007033713bab534187b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-26.05",
|
||||
"ref": "nixos-25.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -630,22 +686,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_4": {
|
||||
"locked": {
|
||||
"lastModified": 1774449309,
|
||||
"narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"ref": "future-26.11",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"treefmt-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -654,11 +694,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780220602,
|
||||
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
|
||||
"lastModified": 1770228511,
|
||||
"narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
|
||||
"rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -667,37 +707,41 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"treefmt-nix_2": {
|
||||
"uv2nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"niks3",
|
||||
"charts",
|
||||
"nixpkgs"
|
||||
],
|
||||
"pyproject-nix": [
|
||||
"charts",
|
||||
"pyproject-nix"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780220602,
|
||||
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
|
||||
"lastModified": 1767701098,
|
||||
"narHash": "sha256-CJhKZnWb3gumR9oTRjFvCg/6lYTGbZRU7xtvcyWIRwU=",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "uv2nix",
|
||||
"rev": "9d357f0d2ce6f5f35ec7959d7e704452352eb4da",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"owner": "pyproject-nix",
|
||||
"repo": "uv2nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"vsext": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_7"
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784343266,
|
||||
"narHash": "sha256-EGkegdTz2n6ESyih8s3dUuPyJQWlYfPp7U41J05g8PY=",
|
||||
"lastModified": 1772678592,
|
||||
"narHash": "sha256-1VZ1hg1YHW+WyBXIOfrQ9Oq+qLL0w93lkdKAiRRHEuI=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-vscode-extensions",
|
||||
"rev": "472a3e862c76c64ac3ad75a24d332cb5cdd5f1bb",
|
||||
"rev": "5521856f37c3d2654fe9b20b03331a6594f855c6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -708,17 +752,17 @@
|
||||
},
|
||||
"wsl": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_3",
|
||||
"flake-compat": "flake-compat_2",
|
||||
"nixpkgs": [
|
||||
"nixunstable"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784058842,
|
||||
"narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
|
||||
"lastModified": 1772386632,
|
||||
"narHash": "sha256-sm6OpWZuoDwR53KNlsY482YOoHFWlWYwt0wHmqLkRGE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NixOS-WSL",
|
||||
"rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
|
||||
"rev": "be894604b2aa2184c0b3d3b44995acd0da14dc0c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -13,6 +13,9 @@
|
||||
url = "github:nix-community/buildbot-nix";
|
||||
inputs.nixpkgs.follows = "nixunstable";
|
||||
};
|
||||
charts = {
|
||||
url = "github:nix-community/nixhelm";
|
||||
};
|
||||
colmena.url = "github:zhaofengli/colmena";
|
||||
darwin = {
|
||||
url = "github:lnl7/nix-darwin/master";
|
||||
@@ -23,13 +26,12 @@
|
||||
url = "github:nix-community/home-manager/master";
|
||||
inputs.nixpkgs.follows = "nixunstable";
|
||||
};
|
||||
minecraft.url = "github:Infinidoge/nix-minecraft";
|
||||
niks3.url = "github:Mic92/niks3";
|
||||
nix-hardware.url = "github:nixos/nixos-hardware";
|
||||
nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
|
||||
nixvimunstable.url = "github:nix-community/nixvim/main";
|
||||
#nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
|
||||
nixvimunstable = {
|
||||
url = "github:nix-community/nixvim/main";
|
||||
inputs.nixpkgs.follows = "nixunstable";
|
||||
};
|
||||
nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
nurpkgs.url = "github:nix-community/NUR";
|
||||
vsext.url = "github:nix-community/nix-vscode-extensions";
|
||||
wsl = {
|
||||
@@ -48,7 +50,6 @@
|
||||
top.nixvimunstable.overlays.default
|
||||
top.nurpkgs.overlays.default
|
||||
top.vsext.overlays.default
|
||||
top.minecraft.overlay
|
||||
];
|
||||
metadata = builtins.fromJSON (builtins.readFile ./network.json);
|
||||
systems = [
|
||||
@@ -63,14 +64,10 @@
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
allowUnfreePredicate = _: true;
|
||||
permittedInsecurePackages = [
|
||||
"ventoy-1.1.05"
|
||||
"electron-39.8.10"
|
||||
];
|
||||
permittedInsecurePackages = [ "ventoy-1.1.05" ];
|
||||
};
|
||||
}
|
||||
);
|
||||
lib' = import ./lib { inherit (top.nixunstable) lib; };
|
||||
in
|
||||
top.flake-parts.lib.mkFlake { inputs = top; } {
|
||||
inherit systems;
|
||||
@@ -82,12 +79,10 @@
|
||||
nixpkgs = imported_packages.x86_64-linux;
|
||||
specialArgs = {
|
||||
inherit
|
||||
lib'
|
||||
metadata
|
||||
self
|
||||
top
|
||||
;
|
||||
pkgs' = top.self.packages.x86_64-linux;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -101,7 +96,7 @@
|
||||
{
|
||||
deployment = {
|
||||
inherit (v) tags;
|
||||
targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
|
||||
targetHost = v.ts;
|
||||
targetUser = "greg";
|
||||
};
|
||||
}
|
||||
@@ -120,7 +115,7 @@
|
||||
|
||||
nixosConfigurations = (
|
||||
import ./hosts {
|
||||
inherit top metadata lib';
|
||||
inherit top metadata;
|
||||
nixpkgs = imported_packages;
|
||||
}
|
||||
);
|
||||
@@ -149,17 +144,16 @@
|
||||
pkgs = imported_packages.${system};
|
||||
};
|
||||
|
||||
packages = (import ./pkgs { inherit pkgs top; });
|
||||
packages = (import ./pkgs { inherit pkgs; });
|
||||
|
||||
checks = import ./checks.nix {
|
||||
inherit system top self';
|
||||
inherit (top.nixpkgs-lib) lib;
|
||||
inherit (pkgs) lib;
|
||||
};
|
||||
|
||||
devShells = import ./shells.nix {
|
||||
inherit pkgs;
|
||||
inherit (top) colmena;
|
||||
inherit (self') packages;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
+22
-22
@@ -1,23 +1,23 @@
|
||||
builds:
|
||||
# Exclude most things, as I locally build x86_64-linux and aarch64-linux
|
||||
- exclude:
|
||||
- "homeConfigurations.*"
|
||||
- "nixosConfigurations.*"
|
||||
- "packages.*"
|
||||
# These are just images which I will build when
|
||||
# I feel like it
|
||||
- "devShells.*"
|
||||
include:
|
||||
- "packages.aarch64-darwin.*"
|
||||
- darwinConfigurations.MacBook-Pro
|
||||
- darwinConfigurations.MacBook-Prolocal
|
||||
- darwinConfigurations.li
|
||||
# Some specific includes which are not specific enough to override the rules
|
||||
# above, due to the intrepretation of the glob excludes, but which I still
|
||||
# need included
|
||||
- include:
|
||||
# These are Mac homeConfigurations, which I do not have the infra
|
||||
# to build at home
|
||||
- homeConfigurations."gregory.hellings-mbp"
|
||||
- homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
|
||||
- homeConfigurations.ivr
|
||||
exclude:
|
||||
- "homeConfigurations.*"
|
||||
- "nixosConfigurations.*"
|
||||
- "packages.*"
|
||||
# bitwarden-cli package is broken on aarch64-darwin
|
||||
- "packages.aarch64-darwin.img-bitwarden"
|
||||
# kmod-31 is not a thing on Darwin
|
||||
- "packages.aarch64-darwin.qemu-hook"
|
||||
- "packages.aarch64-darwin.vfio_shutdown"
|
||||
- "packages.aarch64-darwin.vfio_startup"
|
||||
# This one is a bit of a beast and shouldn't take up Garnix time
|
||||
- "packages.aarch64-darwin.zim"
|
||||
# These are just images which I will build when
|
||||
# I feel like it
|
||||
- "devShells.*"
|
||||
include:
|
||||
- "packages.aarch64-darwin.*"
|
||||
- homeConfigurations.exodus
|
||||
- darwinConfigurations.MacBook-Pro
|
||||
- darwinConfigurations.MacBook-Prolocal
|
||||
- nixosConfigurations.builder-x86
|
||||
- nixosConfigurations.builder-aarch
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# vim: set filetype=nushell :
|
||||
let servers = [isaiah jeremiah zeke genesis hosea]
|
||||
let servers = [isaiah jeremiah zeke genesis vm-gitlab]
|
||||
|
||||
def par-map [ items: list, c: closure ] {
|
||||
let results = $items | par-each -k $c
|
||||
@@ -12,55 +12,15 @@ def --env unlock [] {
|
||||
}
|
||||
}
|
||||
|
||||
def nebulaIps [] {
|
||||
open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
|
||||
}
|
||||
|
||||
def localIps [] {
|
||||
open /etc/nixos/network.json | get hosts | items { |h, e| $e.ip? } | where $it != null | sort
|
||||
}
|
||||
|
||||
def genNebulaCert [ --ips: string, --name: string ] {
|
||||
let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
|
||||
let private = $'~/SynologyDrive/nebula/($name).key' | path expand
|
||||
let cert = $'/etc/nixos/secrets/nebula/($name).crt'
|
||||
let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
|
||||
let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
|
||||
|
||||
# Generate public key if there isn't one already
|
||||
if ( not ($public | path exists) ) {
|
||||
nebula-cert keygen -out-key $private -out-pub $public
|
||||
}
|
||||
# Clear old cert if there is one
|
||||
if ( $cert | path exists) {
|
||||
rm $cert
|
||||
}
|
||||
|
||||
# Create and sign certs
|
||||
(nebula-cert sign
|
||||
-ca-crt $ca_cert
|
||||
-ca-key $ca_key
|
||||
-name $name
|
||||
-networks $ips
|
||||
-out-crt $cert
|
||||
-in-pub $public
|
||||
)
|
||||
|
||||
# Agenix update
|
||||
cd /etc/nixos/secrets
|
||||
cat $private | agenix -e $'nebula/($name).key.age'
|
||||
}
|
||||
|
||||
|
||||
def rebuild [ $target: string = "switch" ] {
|
||||
def rebuild [] {
|
||||
if (uname | get operating-system) == "Darwin" {
|
||||
sudo darwin-rebuild $target
|
||||
sudo darwin-rebuild switch
|
||||
} else {
|
||||
let hostname = uname | get nodename
|
||||
let build = ^nom build --keep-going $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
|
||||
if $env.LAST_EXIT_CODE == 0 {
|
||||
nvd diff /run/current-system result
|
||||
run0 result/bin/switch-to-configuration $target
|
||||
run0 result/bin/switch-to-configuration switch
|
||||
} else {
|
||||
print "Error during build"
|
||||
}
|
||||
@@ -75,8 +35,7 @@ def deploy [ $host: string, $build: string = "" ] {
|
||||
if $buildhost == "linode" or $buildhost == "genesis" {
|
||||
$buildhost = "isaiah"
|
||||
}
|
||||
colmena apply --on $host
|
||||
#nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
|
||||
nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
|
||||
}
|
||||
|
||||
def ff [ $file: string ] {
|
||||
@@ -113,4 +72,3 @@ def dc [ $cmd: string = "sh" ] {
|
||||
if ("/usr/local/bin" | path exists) {
|
||||
$env.PATH = $env.PATH | append "/usr/local/bin"
|
||||
}
|
||||
$env.PATH = $env.PATH | prepend "~/.local/bin"
|
||||
|
||||
@@ -26,7 +26,6 @@
|
||||
nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
|
||||
r = "run0";
|
||||
updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
|
||||
p = "${lib.getExe pkgs.podman-tui}";
|
||||
|
||||
# General
|
||||
k = "kubectl";
|
||||
|
||||
+26
-27
@@ -5,7 +5,7 @@
|
||||
# This allows things like SSH in distrobox to read the config file just fine
|
||||
home.file.".ssh/config" = {
|
||||
target = ".ssh/config_source";
|
||||
onChange = "cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config";
|
||||
onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
|
||||
};
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
@@ -13,25 +13,24 @@
|
||||
includes = [ "config.local" ];
|
||||
enableDefaultConfig = false;
|
||||
|
||||
settings =
|
||||
matchBlocks =
|
||||
let
|
||||
nas = {
|
||||
User = "admin";
|
||||
user = "admin";
|
||||
};
|
||||
owned = {
|
||||
User = "greg";
|
||||
user = "greg";
|
||||
};
|
||||
in
|
||||
{
|
||||
inherit nas;
|
||||
|
||||
"*" = {
|
||||
DynamicForward = [ "10240" ];
|
||||
ForwardAgent = "yes";
|
||||
LogLevel = "error";
|
||||
ServerAliveInterval = 60;
|
||||
SetEnv = {
|
||||
TERM = "xterm-256color";
|
||||
dynamicForwards = [ { port = 10240; } ];
|
||||
serverAliveInterval = 60;
|
||||
extraOptions = {
|
||||
LogLevel = "error";
|
||||
SetEnv = "TERM=xterm-256color";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -42,46 +41,46 @@
|
||||
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
|
||||
|
||||
gh = {
|
||||
User = "git";
|
||||
Hostname = "github.com";
|
||||
user = "git";
|
||||
hostname = "github.com";
|
||||
};
|
||||
"src" = {
|
||||
User = "git";
|
||||
Hostname = "jeremiah.shire-zebra.ts.net";
|
||||
Port = 32222;
|
||||
user = "git";
|
||||
hostname = "jeremiah.shire-zebra.ts.net";
|
||||
port = 32222;
|
||||
};
|
||||
srcpub = {
|
||||
User = "git";
|
||||
Hostname = "src.thehellings.com";
|
||||
Port = 2222;
|
||||
user = "git";
|
||||
hostname = "src.thehellings.com";
|
||||
port = 2222;
|
||||
};
|
||||
ivr = {
|
||||
User = "git";
|
||||
Hostname = "gitlab.com";
|
||||
user = "git";
|
||||
hostname = "gitlab.com";
|
||||
};
|
||||
|
||||
"ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
|
||||
User = "gregory.hellings";
|
||||
user = "gregory.hellings";
|
||||
};
|
||||
|
||||
"*.thehellings.lan" = owned;
|
||||
"10.42.*" = owned;
|
||||
|
||||
"host.crosswire.org crosswire" = {
|
||||
Hostname = "host.crosswire.org";
|
||||
User = "ghellings";
|
||||
hostname = "host.crosswire.org";
|
||||
user = "ghellings";
|
||||
};
|
||||
|
||||
fedpeople = {
|
||||
Hostname = "fedorapeople.org";
|
||||
User = "greghellings";
|
||||
hostname = "fedorapeople.org";
|
||||
user = "greghellings";
|
||||
};
|
||||
|
||||
"src.fedoraproject.org pkgs.fedoraproject.org" = {
|
||||
User = "greghellings";
|
||||
user = "greghellings";
|
||||
};
|
||||
|
||||
"127.*" = {
|
||||
"127.*".extraOptions = {
|
||||
PubkeyAcceptedAlgorithms = "+ssh-rsa";
|
||||
HostkeyAlgorithms = "+ssh-rsa";
|
||||
};
|
||||
|
||||
@@ -8,10 +8,11 @@
|
||||
home.packages =
|
||||
with pkgs;
|
||||
[
|
||||
attic-client
|
||||
dig
|
||||
jqp
|
||||
kubernetes-helm
|
||||
#iamb
|
||||
iamb
|
||||
lazyssh
|
||||
rainfrog
|
||||
tenere
|
||||
|
||||
@@ -38,6 +38,11 @@ def _ivr2(args):
|
||||
vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
|
||||
aliases['ivr2'] = _ivr2
|
||||
|
||||
def _glrestart(args):
|
||||
sudo nixos-container run gitlab -- systemctl restart gitlab
|
||||
sudo nixos-container run gitlab -- systemctl restart nginx
|
||||
aliases['glrestart'] = _glrestart
|
||||
|
||||
def _aws_creds(args):
|
||||
$AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
|
||||
$AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")
|
||||
|
||||
+16
-7
@@ -4,15 +4,11 @@
|
||||
top,
|
||||
}:
|
||||
let
|
||||
inherit (top.nixunstable) lib;
|
||||
user =
|
||||
host:
|
||||
host: username:
|
||||
let
|
||||
inherit (metadata.hosts.${host}) system;
|
||||
pkgs = nixpkgs.${system};
|
||||
pkgs' = top.self.packages.${system};
|
||||
username =
|
||||
if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
|
||||
in
|
||||
top.hmunstable.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
@@ -26,12 +22,25 @@ let
|
||||
host
|
||||
username
|
||||
metadata
|
||||
pkgs'
|
||||
;
|
||||
nixvim = top.nixvimunstable;
|
||||
gui = false;
|
||||
gnome = false;
|
||||
};
|
||||
};
|
||||
greg = host: (user host "greg");
|
||||
in
|
||||
(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) user)
|
||||
{
|
||||
"MacBook-Pro.local" = user "ivr" "gregory.hellings";
|
||||
"MacBook-Prolocal.local" = user "ivr" "gregory.hellings";
|
||||
"MacBook-Pro.thehellings.lan" = user "ivr" "gregory.hellings";
|
||||
"gregory.hellings-mbp" = user "ivr" "gregory.hellings";
|
||||
genesis = greg "genesis";
|
||||
exodus = greg "exodus";
|
||||
zeke = greg "zeke";
|
||||
isaiah = greg "isaiah";
|
||||
jeremiah = greg "jeremiah";
|
||||
linode = greg "linode";
|
||||
hosea = greg "hosea";
|
||||
gitlab = greg "gitlab";
|
||||
}
|
||||
|
||||
+3
-9
@@ -1,6 +1,5 @@
|
||||
{
|
||||
pkgs,
|
||||
pkgs',
|
||||
lib,
|
||||
host ? "most",
|
||||
top,
|
||||
@@ -20,14 +19,9 @@ in
|
||||
imports = [
|
||||
top.nixvimunstable.homeModules.nixvim
|
||||
top.self.modules.homeManagerModule
|
||||
top.agenix.homeManagerModules.default
|
||||
./baseline
|
||||
]
|
||||
++ lib.optionals (builtins.pathExists ./hosts/${host}/default.nix) [ ./hosts/${host} ];
|
||||
|
||||
age = {
|
||||
identityPaths = [ "${homeDirectory}/.ssh/id_ed25519" ];
|
||||
};
|
||||
++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
|
||||
|
||||
home = {
|
||||
inherit homeDirectory username;
|
||||
@@ -39,7 +33,7 @@ in
|
||||
gh
|
||||
git
|
||||
gnupatch
|
||||
pkgs'.hms
|
||||
hms
|
||||
btop
|
||||
inetutils
|
||||
jq
|
||||
@@ -47,7 +41,7 @@ in
|
||||
nix-prefetch
|
||||
nmap
|
||||
openssl
|
||||
pkgs'.setup-ssh
|
||||
setup-ssh
|
||||
tmux
|
||||
tree
|
||||
unzip
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
{...}: {}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ lib, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
greg = {
|
||||
@@ -21,32 +21,11 @@
|
||||
kubectl
|
||||
kubectl-cnpg
|
||||
mattermost-desktop
|
||||
minio-client
|
||||
mumble
|
||||
nebula
|
||||
nix-index
|
||||
adoptopenjdk-icedtea-web
|
||||
pre-commit
|
||||
prismlauncher
|
||||
rclone
|
||||
restic
|
||||
restic-browser
|
||||
tea
|
||||
wineWow64Packages.stable
|
||||
];
|
||||
programs = {
|
||||
discord = {
|
||||
enable = true;
|
||||
settings.SKIP_HOST_UPDATE = true;
|
||||
};
|
||||
};
|
||||
xdg.desktopEntries = {
|
||||
prismlauncher = {
|
||||
name = "Prism Launcher - Minecraft";
|
||||
actions.minecraft = {
|
||||
name = "Minecraft";
|
||||
exec = lib.getExe pkgs.prismlauncher;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
lithic/
|
||||
@@ -0,0 +1,4 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
gregory.hellings-mbp/
|
||||
@@ -1,10 +1,21 @@
|
||||
{
|
||||
pkgs,
|
||||
pkgs',
|
||||
lib,
|
||||
username,
|
||||
...
|
||||
}:
|
||||
let
|
||||
username = "gregory.hellings";
|
||||
x = pkgs.xonsh.override {
|
||||
extraPackages = (
|
||||
ps: [
|
||||
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
|
||||
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
|
||||
ps.xonsh-apipenv
|
||||
pkgs.pipenv-ivr
|
||||
]
|
||||
);
|
||||
};
|
||||
in
|
||||
{
|
||||
# Disables hitting local cache
|
||||
_module.args.cache = lib.mkForce false;
|
||||
@@ -17,43 +28,43 @@
|
||||
|
||||
home = {
|
||||
packages = with pkgs; [
|
||||
aacs
|
||||
ansible
|
||||
claude-code
|
||||
direnv
|
||||
home-manager
|
||||
pkgs'.dockerCompat
|
||||
python3Packages.ipython
|
||||
just
|
||||
glab
|
||||
go
|
||||
gopls
|
||||
k9s
|
||||
kubectl
|
||||
mariadb
|
||||
minikube
|
||||
mise
|
||||
nil
|
||||
nixVersions.stable
|
||||
pipenv-ivr
|
||||
pre-commit
|
||||
python311
|
||||
python3Packages.flake8
|
||||
skaffold
|
||||
twine
|
||||
x
|
||||
];
|
||||
file = {
|
||||
".pip/pip.conf".text = ''
|
||||
[global]
|
||||
retries = 1
|
||||
index-url = https://pypi.python.org/
|
||||
index-url = https://pypi.python.org/simple
|
||||
extra-index-url =
|
||||
https://pypidev.ivrtechnology.com/
|
||||
https://pypidev.ivrtechnology.com/simple/
|
||||
'';
|
||||
".config/uv/uv.toml".text = ''
|
||||
index-strategy = "unsafe-first-match"
|
||||
[[index]]
|
||||
url = "https://pypidev.ivrtechnology.com/"
|
||||
url = "https://pypidev.ivrtechnology.com/simple/"
|
||||
name = "pypidev"
|
||||
ignore-error-codes = [403]
|
||||
'';
|
||||
};
|
||||
sessionVariables = {
|
||||
BW_GITLAB_ITEM = "7d3da4e9-5f9a-49d0-8e14-b39c010a4001";
|
||||
BW_ANTHROPIC_ITEM = "e122fd08-3506-4f21-9c6a-b42b00fe5be1";
|
||||
};
|
||||
username = username;
|
||||
homeDirectory = "/Users/${username}";
|
||||
};
|
||||
@@ -97,5 +108,6 @@
|
||||
"web4"
|
||||
]
|
||||
);
|
||||
tmux.shell = (lib.getExe x);
|
||||
};
|
||||
}
|
||||
@@ -1,80 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
pkgs',
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
python = pkgs.python312.withPackages (
|
||||
p: with p; [
|
||||
ipython
|
||||
]
|
||||
);
|
||||
in
|
||||
{
|
||||
# Disables hitting local cache
|
||||
_module.args.cache = lib.mkForce false;
|
||||
|
||||
greg = {
|
||||
development = true;
|
||||
gui = true;
|
||||
nix.cache = false;
|
||||
zed = true;
|
||||
};
|
||||
|
||||
home = {
|
||||
packages = with pkgs; [
|
||||
ansible
|
||||
awscli2
|
||||
cargo
|
||||
clippy
|
||||
direnv
|
||||
docker
|
||||
docker-compose
|
||||
docker-buildx
|
||||
go
|
||||
home-manager
|
||||
just
|
||||
mcp-grafana
|
||||
nil
|
||||
nixVersions.stable
|
||||
poetry
|
||||
pre-commit
|
||||
(pulumi.withPackages (
|
||||
p: with p; [
|
||||
pulumi-aws-native
|
||||
pulumi-command
|
||||
pulumi-go
|
||||
pulumi-nodejs
|
||||
pulumi-python
|
||||
]
|
||||
))
|
||||
python
|
||||
rustc
|
||||
rustfmt
|
||||
terraform
|
||||
];
|
||||
};
|
||||
|
||||
programs = {
|
||||
direnv = {
|
||||
enable = true;
|
||||
enableNushellIntegration = true;
|
||||
};
|
||||
nushell = {
|
||||
enable = true;
|
||||
};
|
||||
starship = {
|
||||
enable = true;
|
||||
enableNushellIntegration = true;
|
||||
settings = {
|
||||
directory = {
|
||||
home_symbol = "~";
|
||||
truncate_to_repo = false;
|
||||
truncation_length = 0;
|
||||
use_os_path_sep = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
greg.vscodium.enable = false;
|
||||
|
||||
home.packages = with pkgs; [ brew ];
|
||||
}
|
||||
+12
-44
@@ -3,24 +3,19 @@
|
||||
lib,
|
||||
metadata,
|
||||
pkgs,
|
||||
top,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
../modules/nix-conf.nix
|
||||
top.niks3.nixosModules.niks3-auto-upload
|
||||
];
|
||||
|
||||
age.secrets.niks3-api-token.file = ../secrets/niks3/api_token.age;
|
||||
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
top.niks3.packages.${pkgs.stdenv.hostPlatform.system}.niks3
|
||||
agenix
|
||||
bitwarden-cli
|
||||
bmon
|
||||
@@ -31,9 +26,10 @@
|
||||
efibootmgr
|
||||
findutils
|
||||
file
|
||||
gcc-tune
|
||||
git
|
||||
gnupatch
|
||||
top.self.packages.${pkgs.stdenv.hostPlatform.system}.hms # My own home manager switcher
|
||||
hms # My own home manager switcher
|
||||
iperf
|
||||
killall
|
||||
nano
|
||||
@@ -57,25 +53,9 @@
|
||||
|
||||
# Network Manager pulls in too many deps
|
||||
networking = {
|
||||
extraHosts =
|
||||
let
|
||||
onNetwork =
|
||||
attr: _k: v:
|
||||
(builtins.hasAttr attr v) && v.${attr} != null;
|
||||
getIPs =
|
||||
attr: domain:
|
||||
(lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") (
|
||||
lib.filterAttrs (onNetwork attr) metadata.hosts
|
||||
));
|
||||
in
|
||||
builtins.concatStringsSep "\n" (
|
||||
(getIPs "ts" "shire-zebra.ts.net")
|
||||
++ (getIPs "nebulaIp" "nebula.thehellings.com")
|
||||
++ (getIPs "nebulaIp" "nebula")
|
||||
++ (getIPs "ip" "thehellings.lan")
|
||||
);
|
||||
search = [
|
||||
"nebula.thehellings.com"
|
||||
"thehellings.lan"
|
||||
"home"
|
||||
];
|
||||
networkmanager.enable = false;
|
||||
};
|
||||
@@ -101,12 +81,6 @@
|
||||
# Enable the OpenSSH daemon for remote control
|
||||
services = {
|
||||
locate.enable = true;
|
||||
niks3-auto-upload = {
|
||||
enable = config.greg.nix.cache;
|
||||
authTokenFile = config.age.secrets.niks3-api-token.path;
|
||||
serverUrl = "http://hosea.nebula.thehellings.com:5751";
|
||||
verifyS3Integrity = true;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.X11Forwarding = true;
|
||||
@@ -140,23 +114,17 @@
|
||||
};
|
||||
};
|
||||
|
||||
security = {
|
||||
sudo-rs = {
|
||||
enable = true;
|
||||
extraRules = [
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "greg" ];
|
||||
commands = [
|
||||
{
|
||||
users = [ "greg" ];
|
||||
commands = [
|
||||
{
|
||||
command = "ALL";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
command = "ALL";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
sudo.enable = false;
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
|
||||
+33
-9
@@ -1,6 +1,5 @@
|
||||
{
|
||||
top,
|
||||
lib',
|
||||
metadata,
|
||||
nixpkgs,
|
||||
}:
|
||||
@@ -15,22 +14,15 @@ let
|
||||
}:
|
||||
let
|
||||
inherit (metadata.hosts.${name}) system;
|
||||
pkgs' = top.self.packages.${system};
|
||||
in
|
||||
channel.lib.nixosSystem {
|
||||
pkgs = nixpkgs.${system};
|
||||
specialArgs = {
|
||||
inherit
|
||||
metadata
|
||||
top
|
||||
lib'
|
||||
pkgs'
|
||||
;
|
||||
inherit metadata top;
|
||||
};
|
||||
modules = [
|
||||
{
|
||||
nixpkgs.hostPlatform = system;
|
||||
networking.hostName = name;
|
||||
}
|
||||
# Imported ones
|
||||
top.agenix.nixosModules.default
|
||||
@@ -52,6 +44,16 @@ in
|
||||
})
|
||||
)
|
||||
)
|
||||
// (lib.genAttrs
|
||||
(builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
|
||||
(
|
||||
name:
|
||||
(unstable {
|
||||
inherit name;
|
||||
extraMods = [ ./vm/${name} ];
|
||||
})
|
||||
)
|
||||
)
|
||||
// {
|
||||
# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
|
||||
#nixos = wsl { name = "wsl"; };
|
||||
@@ -60,4 +62,26 @@ in
|
||||
# name = "wsl";
|
||||
# system = "aarch64-linux";
|
||||
#};
|
||||
|
||||
builder-aarch = lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
modules = [
|
||||
"${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
|
||||
{
|
||||
virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
|
||||
boot.loader.grub.devices = [ "/dev/vda" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
builder-x86 = lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
"${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
|
||||
{
|
||||
virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
|
||||
boot.loader.grub.devices = [ "/dev/vda" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -9,16 +9,16 @@
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
|
||||
top.nix-hardware.nixosModules.framework-11th-gen-intel
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
compose-attic.file = ../../../secrets/compose/attic.env.age;
|
||||
};
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
memtest86.enable = true;
|
||||
netbootxyz.enable = true;
|
||||
};
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
binfmt.emulatedSystems = [
|
||||
@@ -30,15 +30,16 @@
|
||||
greg = {
|
||||
home = true;
|
||||
gnome.enable = true;
|
||||
nebula = {
|
||||
enable = true;
|
||||
};
|
||||
podman.enable = true;
|
||||
print.enable = true;
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "mobile" ];
|
||||
};
|
||||
runner = {
|
||||
enable = true;
|
||||
qemu = true;
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
|
||||
@@ -2,18 +2,34 @@
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{
|
||||
top,
|
||||
pkgs,
|
||||
pkgs',
|
||||
...
|
||||
}:
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
adblockUpdate = pkgs.writeShellApplication {
|
||||
name = "adblock-update";
|
||||
runtimeInputs = with pkgs; [
|
||||
curl
|
||||
gnused
|
||||
systemd
|
||||
];
|
||||
text = ''
|
||||
curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
|
||||
curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
|
||||
|
||||
# Custom domains that I need to preserve for some reason
|
||||
for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do
|
||||
sed -i -e "/''${f}/d" /etc/adblock_hosts # Blocks Trelly content for house investors
|
||||
done
|
||||
|
||||
systemctl restart dnsmasq
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./networking.nix
|
||||
top.minecraft.nixosModules.minecraft-servers
|
||||
];
|
||||
|
||||
greg = {
|
||||
@@ -36,121 +52,26 @@
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
pkgs'.create_ssl
|
||||
create_ssl
|
||||
step-ca
|
||||
];
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
|
||||
services = {
|
||||
minecraft-servers = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
|
||||
servers = {
|
||||
maya = {
|
||||
enable = true;
|
||||
operators = {
|
||||
Almec = {
|
||||
bypassesPlayerLimit = true;
|
||||
uuid = "7884dc5a-ae21-43d5-9506-a934d59be19a";
|
||||
};
|
||||
};
|
||||
package = pkgs.fabricServers.fabric.override { jre_headless = pkgs.openjdk25_headless; };
|
||||
|
||||
serverProperties = {
|
||||
allow-flight = true;
|
||||
motd = "Maya's Minecraft World";
|
||||
online-mode = true;
|
||||
};
|
||||
whitelist = { };
|
||||
|
||||
jvmOpts = "-Xms4092M -Xmx4092M";
|
||||
|
||||
symlinks = {
|
||||
mods = pkgs.linkFarmFromDrvs "mods" (
|
||||
builtins.attrValues {
|
||||
# Health info
|
||||
appleskin = pkgs.fetchurl {
|
||||
url = "https://cdn.modrinth.com/data/EsAfCjCV/versions/HwaLJe3v/appleskin-fabric-mc26.1-3.0.9.jar";
|
||||
hash = "sha256-iNCycR/oxqFpbPGfIcfgfWOm7PzPiIu5AmBWb8asTb4=";
|
||||
};
|
||||
# Needed by survivalfly
|
||||
balm = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7959/843/balm-fabric-26.1.2-26.1.2.4.jar";
|
||||
hash = "sha256-zDtDxkxOftpW0wUIap7l6abGCjXNczwrF2wLZDztyA0=";
|
||||
};
|
||||
# Adds more diverse biomes
|
||||
# https://www.curseforge.com/minecraft/mc-mods/biomes-o-plenty
|
||||
biomes = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7977/180/BiomesOPlenty-fabric-26.1.2-26.1.2.0.3.jar";
|
||||
hash = "sha256-0aPtsRep0ftbkKqbp69PgUnNJyOBLY9vcPsB1mhOy/M=";
|
||||
};
|
||||
# Automation engines
|
||||
# https://www.curseforge.com/minecraft/mc-mods/create
|
||||
#create = pkgs.fetchurl {
|
||||
# url = "https://mediafilez.forgecdn.net/files/7963/363/create-1.21.1-6.0.10.jar";
|
||||
# hash = "sha256-74f+Vwnxuh9bi7IKKSW1r7RmnheP1ti/EMFndZ7v43o=";
|
||||
#};
|
||||
fabric_api = pkgs.fetchurl {
|
||||
url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/tnmuHGZA/fabric-api-0.146.1%2B26.1.2.jar";
|
||||
hash = "sha256-8Jy/xmxRtw4z4GJ+38wwbXHVn4NGYp4w/mFvW9cmvKg=";
|
||||
};
|
||||
# Required by biomes-o-plenty
|
||||
# https://www.curseforge.com/minecraft/mc-mods/glitchcore
|
||||
glitchcore = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7975/608/GlitchCore-fabric-26.1.2-26.1.2.0.0.jar";
|
||||
hash = "sha256-IDz+TblWvgt4UxFg3L3DhFMEESoX7y5cTOvXhyccQm8=";
|
||||
};
|
||||
# Tooltips
|
||||
# https://www.curseforge.com/minecraft/mc-mods/jade/
|
||||
jade = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7886/518/Jade-mc26.1-Fabric-26.0.8.jar";
|
||||
hash = "sha256-Pc3R5eO4Jf+94mNMPtY/vvpbomp+S+qnAUAVbQk1r2Y=";
|
||||
};
|
||||
# Gives info on crafting recipes
|
||||
# https://www.curseforge.com/minecraft/mc-mods/jei
|
||||
jei = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7920/925/jei-26.1.2-fabric-29.5.0.26.jar";
|
||||
hash = "sha256-7nF7fXYPIg9the/mxi6pUYEmKtosZO6yL2b0Dgf8+fI=";
|
||||
};
|
||||
# Machines
|
||||
# https://www.curseforge.com/minecraft/mc-mods/mekanism
|
||||
#mekanism = pkgs.fetchurl {
|
||||
# url = "https://mediafilez.forgecdn.net/files/7904/58/Mekanism-1.21.1-10.7.19.85.jar";
|
||||
# hash = "sha256-AE28nzEG9NGSrqoe4RkN0W7JyoBZ7T0JO4ADT0xXT0M=";
|
||||
#};
|
||||
# Shows installed mods
|
||||
modmenu = pkgs.fetchurl {
|
||||
url = "https://cdn.modrinth.com/data/mOgUt4GM/versions/jvjwXH6l/modmenu-18.0.0-alpha.8.jar";
|
||||
hash = "sha256-u0gtCOVAnNxyHcslo+y9l/jCGsFb+U/Y8soiUilhZDA=";
|
||||
};
|
||||
# Better storage engines
|
||||
# https://www.curseforge.com/minecraft/mc-mods/refined-storage
|
||||
refined-storage = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
|
||||
hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
|
||||
};
|
||||
# https://www.curseforge.com/minecraft/mc-mods/storage-drawers
|
||||
#storagedrawers = pkgs.fetchurl {
|
||||
#url = "https://mediafilez.forgecdn.net/files/7352/799/StorageDrawers-fabric-1.21.11-20.0.0.jar";
|
||||
#hash = "sha256-eBKCmAtjAhdAjOyLMRneu/NZnNt+orIezxPy6V8g/S8=";
|
||||
#};
|
||||
survivalfly = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
|
||||
hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";
|
||||
};
|
||||
# Also needed by biomes
|
||||
# https://www.curseforge.com/minecraft/mc-mods/terrablender-fabric
|
||||
terrablender = pkgs.fetchurl {
|
||||
url = "https://mediafilez.forgecdn.net/files/7933/873/TerraBlender-fabric-26.1.2-26.1.2.0.1.jar";
|
||||
hash = "sha256-lUrkmMIod54Qj78H0rzT4EYoEeiBG7w6sVOJlRvsnQ4=";
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
};
|
||||
systemd = {
|
||||
services.adblock-update = {
|
||||
after = [ "network-online.target" ];
|
||||
requires = [ "network-online.target" ];
|
||||
script = lib.getExe adblockUpdate;
|
||||
serviceConfig.Type = "oneshot";
|
||||
};
|
||||
timers.adblock-update = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
requires = [ "network-online.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Unit = "adblock-update.service";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan
|
||||
10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan
|
||||
10.42.1.7 hosea hosea.thehellings.lan jellyfin jellyfin.thehellings.lan grafana grafana.thehellings.lan
|
||||
10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan buildbot.thehellings.lan
|
||||
10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
|
||||
10.42.1.9 ivr ivr.thehellings.lan
|
||||
# 10 - monitor
|
||||
# 11 - old jude
|
||||
@@ -22,6 +22,8 @@
|
||||
|
||||
# VMs
|
||||
10.42.4.1 matrix matrix.thehellings.lan
|
||||
#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
|
||||
10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
|
||||
|
||||
# VIP
|
||||
10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
|
||||
@@ -33,13 +35,14 @@
|
||||
# Tailscale hosts
|
||||
100.119.228.115 nas.home chronicles.shire-zebra.ts.net
|
||||
100.88.91.27 dns.home
|
||||
100.70.99.91 exodus.home exodus.shire-zebra.ts.net
|
||||
100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
|
||||
100.80.99.48 exodus.home
|
||||
100.96.198.104 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
|
||||
100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
|
||||
100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
|
||||
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
|
||||
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home
|
||||
100.90.74.19 zeke.home zeke.shire-zebra.ts.net
|
||||
100.109.86.8 linode.home linode.shire-zebra.ts.net
|
||||
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes
|
||||
100.90.74.19 zeke.home
|
||||
100.115.57.8 linode.home
|
||||
100.65.5.38 matrix.home matrix.shire-zebra.ts.net
|
||||
#100.127.55.22 jellyfin.home
|
||||
100.114.187.61 nas1.home nas1.shire-zebra.ts.net
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
lib',
|
||||
metadata,
|
||||
pkgs,
|
||||
metadata,
|
||||
...
|
||||
}:
|
||||
let
|
||||
@@ -11,6 +9,7 @@ let
|
||||
lanIP = metadata.hosts.${config.networking.hostName}.ip;
|
||||
iot = "enp2s0";
|
||||
iotIP = "192.168.66.250";
|
||||
routerIP = metadata.infra.gw;
|
||||
extraHosts = builtins.readFile ./net/hosts;
|
||||
|
||||
proxyPort = 3128;
|
||||
@@ -22,24 +21,12 @@ let
|
||||
#"1.0.0.1" # Cloudflare
|
||||
#"149.112.112.112" # Quad 9
|
||||
metadata.infra.gw # Currently using our UniFi router for DNS as well
|
||||
"100.100.100.100"
|
||||
];
|
||||
in
|
||||
{
|
||||
greg = {
|
||||
nebula = {
|
||||
enable = true;
|
||||
# genesis IS the routing node for the home LAN — it does not route through itself.
|
||||
# Override the module default (which points at genesis) to avoid a routing loop.
|
||||
unsafeRoutes = [ ];
|
||||
# genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
|
||||
# Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
|
||||
routesSubnet = "10.42.0.0/16";
|
||||
};
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
greg.tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
|
||||
# Really, why do I still have to force-disable this crap?
|
||||
@@ -77,7 +64,7 @@ in
|
||||
};
|
||||
};
|
||||
firewall = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
allowedUDPPorts = [
|
||||
dhcpPort
|
||||
dnsPort
|
||||
@@ -88,57 +75,55 @@ in
|
||||
80
|
||||
];
|
||||
};
|
||||
nftables.enable = true;
|
||||
nftables.enable = false;
|
||||
};
|
||||
|
||||
environment.etc."hosts.d/local".text = extraHosts;
|
||||
|
||||
services = {
|
||||
kea = {
|
||||
dhcp4 = (
|
||||
import ./networking/dhcp.nix {
|
||||
inherit
|
||||
iot
|
||||
lan
|
||||
lanIP
|
||||
routerIP
|
||||
;
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
#########
|
||||
# dnsmasq config
|
||||
########
|
||||
bind = {
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
cacheNetworks = [
|
||||
metadata.infra.lan
|
||||
metadata.infra.tailscale
|
||||
metadata.infra.nebula
|
||||
"127.0.0.0/8"
|
||||
];
|
||||
zones =
|
||||
let
|
||||
makeZoneFile =
|
||||
hosts: domain:
|
||||
let
|
||||
preamble = [
|
||||
"$ORIGIN\t${domain}."
|
||||
"$TTL\t1h"
|
||||
"@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
|
||||
"\tIN\tNS\t${config.networking.hostName}"
|
||||
];
|
||||
makeHost =
|
||||
host:
|
||||
[ "${host.name}\tIN\tA\t${host.address}" ]
|
||||
++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
|
||||
if builtins.hasAttr "aliases" host then host.aliases else [ ]
|
||||
);
|
||||
in
|
||||
pkgs.writeText "${domain}" (
|
||||
builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
|
||||
);
|
||||
in
|
||||
lib.mapAttrs
|
||||
(domain: net: {
|
||||
master = true;
|
||||
file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
|
||||
})
|
||||
{
|
||||
"shire-zebra.ts.net" = "tailscale";
|
||||
"nebula.thehellings.com" = "nebula";
|
||||
nebula = "nebula";
|
||||
"thehellings.lan" = "lan";
|
||||
lan = "lan";
|
||||
};
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
expand-hosts = true;
|
||||
log-queries = true;
|
||||
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
hostsdir = "/etc/hosts.d/";
|
||||
server = dnsServers;
|
||||
};
|
||||
};
|
||||
|
||||
prometheus.exporters = {
|
||||
dnsmasq.enable = true;
|
||||
blackbox = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
configFile = pkgs.writeText "blackbox.yml" ''
|
||||
modules:
|
||||
icmp:
|
||||
prober: icmp
|
||||
timeout: 5s
|
||||
icmp:
|
||||
preferred_ip_protocol: ip4
|
||||
'';
|
||||
};
|
||||
};
|
||||
}; # End of services configuration
|
||||
|
||||
|
||||
@@ -0,0 +1,70 @@
|
||||
{
|
||||
lib,
|
||||
metadata,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
|
||||
tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
|
||||
get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
|
||||
getTS = get "ts" tps;
|
||||
getIP = get "ip" ips;
|
||||
whitelists = builtins.concatStringsSep "," (
|
||||
[
|
||||
"localhost"
|
||||
"127.0.0.1"
|
||||
]
|
||||
++ getTS
|
||||
++ getIP
|
||||
);
|
||||
in
|
||||
{
|
||||
services = {
|
||||
prowlarr = {
|
||||
enable = true;
|
||||
dataDir = "/arr/prowlarr";
|
||||
openFirewall = true;
|
||||
};
|
||||
radarr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
transmission = {
|
||||
enable = true;
|
||||
openPeerPorts = true;
|
||||
openRPCPort = true;
|
||||
package = pkgs.transmission_4;
|
||||
settings = {
|
||||
download-dir = "/arr/transmission/downloads";
|
||||
rpc-bind-address = "0.0.0.0";
|
||||
rpc-host-whitelist = whitelists;
|
||||
rpc-host-whitelist-enabled = false;
|
||||
rpc-whitelist = whitelists;
|
||||
rpc-whitelist-enabled = false;
|
||||
watch-dir-enabled = true;
|
||||
watch-dir = "/arr/transmission/incoming";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.mounts =
|
||||
let
|
||||
nfs = name: {
|
||||
what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
|
||||
type = "nfs";
|
||||
name = "${name}.mount";
|
||||
where = "/${name}";
|
||||
requires = [ "tailscaled-autoconnect.service" ];
|
||||
after = [ "tailscaled-autoconnect.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
|
||||
};
|
||||
in
|
||||
[
|
||||
(nfs "arr")
|
||||
(nfs "music")
|
||||
(nfs "photos")
|
||||
(nfs "video")
|
||||
];
|
||||
}
|
||||
@@ -6,7 +6,6 @@
|
||||
config,
|
||||
metadata,
|
||||
pkgs,
|
||||
top,
|
||||
...
|
||||
}:
|
||||
let
|
||||
@@ -18,31 +17,13 @@ in
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./arr.nix
|
||||
./hardware-configuration.nix
|
||||
top.niks3.nixosModules.niks3
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
cache-private-key = {
|
||||
file = ../../../secrets/cache-private-key.age;
|
||||
owner = "niks3";
|
||||
};
|
||||
grafana-secret-key = {
|
||||
file = ../../../secrets/grafana-secret-key.age;
|
||||
owner = "grafana";
|
||||
};
|
||||
niks3-access-key-id = {
|
||||
file = ../../../secrets/niks3/access_key_id.age;
|
||||
owner = "niks3";
|
||||
};
|
||||
niks3-api-token = {
|
||||
file = ../../../secrets/niks3/api_token.age;
|
||||
owner = "niks3";
|
||||
};
|
||||
niks3-secret-access-key = {
|
||||
file = ../../../secrets/niks3/secret_access_key.age;
|
||||
owner = "niks3";
|
||||
};
|
||||
age.secrets.grafana-secret-key = {
|
||||
file = ../../../secrets/grafana-secret-key.age;
|
||||
owner = "grafana";
|
||||
};
|
||||
|
||||
# Bootloader
|
||||
@@ -68,7 +49,6 @@ in
|
||||
|
||||
greg = {
|
||||
home = true;
|
||||
nebula.enable = true;
|
||||
proxies = {
|
||||
"jellyfin.home".target = "http://localhost:8096/";
|
||||
"jellyfin.thehellings.lan".target = "http://localhost:8096/";
|
||||
@@ -79,12 +59,6 @@ in
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
backup.jobs.albyhub = {
|
||||
src = "/chain/alby";
|
||||
dest = "albyhub";
|
||||
pre = "systemctl stop albyhub || true";
|
||||
post = "systemctl start albyhub";
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
@@ -117,7 +91,6 @@ in
|
||||
];
|
||||
};
|
||||
};
|
||||
firewall.interfaces.nebula0.allowedTCPPorts = [ 5751 ];
|
||||
nameservers = [ metadata.infra.dns ];
|
||||
};
|
||||
|
||||
@@ -170,27 +143,6 @@ in
|
||||
analytics.reporting_enabled = false;
|
||||
};
|
||||
};
|
||||
niks3 = {
|
||||
enable = true;
|
||||
|
||||
apiTokenFile = config.age.secrets.niks3-api-token.path;
|
||||
gc.enable = false;
|
||||
httpAddr = "${metadata.hosts.hosea.nebulaIp}:5751";
|
||||
nginx = {
|
||||
enable = true;
|
||||
domain = "hosea.nebula";
|
||||
enableACME = false;
|
||||
forceSSL = false;
|
||||
};
|
||||
s3 = {
|
||||
accessKeyFile = config.age.secrets.niks3-access-key-id.path;
|
||||
bucket = "niks3";
|
||||
endpoint = "nas1.shire-zebra.ts.net:30188";
|
||||
secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
|
||||
useSSL = false;
|
||||
};
|
||||
signKeyFiles = [ config.age.secrets.cache-private-key.path ];
|
||||
};
|
||||
prometheus.exporters.graphite.enable = true;
|
||||
# Configure keymap
|
||||
xserver.xkb = {
|
||||
@@ -199,25 +151,6 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
systemd.mounts =
|
||||
let
|
||||
nfs = name: {
|
||||
what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
|
||||
type = "nfs";
|
||||
name = "${name}.mount";
|
||||
where = "/${name}";
|
||||
requires = [ "tailscaled-autoconnect.service" ];
|
||||
after = [ "tailscaled-autoconnect.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
|
||||
};
|
||||
in
|
||||
[
|
||||
(nfs "music")
|
||||
(nfs "photos")
|
||||
(nfs "video")
|
||||
];
|
||||
|
||||
# After first deploy: create a Grafana service account + API token for Klaatu
|
||||
# via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
|
||||
age.secrets.grafana-api-token = {
|
||||
@@ -352,7 +285,7 @@ in
|
||||
"uid": "kubernetes-overview",
|
||||
"title": "Kubernetes Overview",
|
||||
"schemaVersion": 38,
|
||||
"version": 3,
|
||||
"version": 2,
|
||||
"refresh": "30s",
|
||||
"time": {"from": "now-3h", "to": "now"},
|
||||
"panels": [
|
||||
@@ -457,41 +390,6 @@ in
|
||||
"title": "Node Memory Usage %",
|
||||
"gridPos": {"x": 12, "y": 38, "w": 12, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 12,
|
||||
"type": "bargauge",
|
||||
"title": "Top 5 Fullest PersistentVolumes",
|
||||
"gridPos": {"x": 0, "y": 46, "w": 24, "h": 8},
|
||||
"targets": [
|
||||
{
|
||||
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
||||
"expr": "topk(5, kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes * 100)",
|
||||
"legendFormat": "{{namespace}}/{{persistentvolumeclaim}}",
|
||||
"refId": "A",
|
||||
"instant": true
|
||||
}
|
||||
],
|
||||
"options": {
|
||||
"reduceOptions": {"calcs": ["lastNotNull"]},
|
||||
"orientation": "horizontal",
|
||||
"displayMode": "gradient"
|
||||
},
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"unit": "percent",
|
||||
"min": 0,
|
||||
"max": 100,
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{"color": "green", "value": null},
|
||||
{"color": "yellow", "value": 70},
|
||||
{"color": "red", "value": 90}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -502,44 +400,44 @@ in
|
||||
"uid": "network-overview",
|
||||
"title": "Network & UniFi",
|
||||
"schemaVersion": 38,
|
||||
"version": 3,
|
||||
"version": 2,
|
||||
"refresh": "30s",
|
||||
"time": {"from": "now-3h", "to": "now"},
|
||||
"panels": [
|
||||
{
|
||||
"id": 1,
|
||||
"type": "timeseries",
|
||||
"title": "DNS Queries",
|
||||
"type": "stat",
|
||||
"title": "DNS Queries/s",
|
||||
"gridPos": {"x": 0, "y": 0, "w": 6, "h": 4},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(dnsmasq_servers_queries[5m]) or vector(0)", "refId": "A"}]
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(dnsmasq_queries_total[5m]) or vector(0)", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"type": "stat",
|
||||
"title": "UniFi Devices",
|
||||
"gridPos": {"x": 6, "y": 0, "w": 6, "h": 4},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(unpoller_device_uptime_seconds) or vector(0)", "refId": "A"}]
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(unifipoller_device_uptime_seconds) or vector(0)", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 7,
|
||||
"type": "stat",
|
||||
"title": "WiFi Clients",
|
||||
"gridPos": {"x": 12, "y": 0, "w": 6, "h": 4},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(unpoller_client_uptime_seconds{wired=\"false\"}) or vector(0)", "refId": "A"}]
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(unifipoller_client_wifi_tx_rate_bps) or vector(0)", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 8,
|
||||
"type": "stat",
|
||||
"title": "Wired Clients",
|
||||
"gridPos": {"x": 18, "y": 0, "w": 6, "h": 4},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(unpoller_client_uptime_seconds{wired=\"true\"}) or vector(0)", "refId": "A"}]
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(unifipoller_client_wired_tx_rate_bps) or vector(0)", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 9,
|
||||
"type": "timeseries",
|
||||
"title": "WAN RX (bytes/s)",
|
||||
"gridPos": {"x": 0, "y": 4, "w": 12, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "unpoller_device_wan_receive_rate_bytes", "legendFormat": "{{name}}", "refId": "A"}],
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(unifipoller_device_wan_receive_bytes_total[5m])", "legendFormat": "{{name}}", "refId": "A"}],
|
||||
"fieldConfig": {"defaults": {"unit": "Bps"}}
|
||||
},
|
||||
{
|
||||
@@ -547,7 +445,7 @@ in
|
||||
"type": "timeseries",
|
||||
"title": "WAN TX (bytes/s)",
|
||||
"gridPos": {"x": 12, "y": 4, "w": 12, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "unpoller_device_wan_transmit_rate_bytes", "legendFormat": "{{name}}", "refId": "A"}],
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(unifipoller_device_wan_transmit_bytes_total[5m])", "legendFormat": "{{name}}", "refId": "A"}],
|
||||
"fieldConfig": {"defaults": {"unit": "Bps"}}
|
||||
},
|
||||
{
|
||||
@@ -555,23 +453,21 @@ in
|
||||
"type": "timeseries",
|
||||
"title": "UniFi Port RX (bytes/s)",
|
||||
"gridPos": {"x": 0, "y": 12, "w": 12, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(unpoller_device_port_receive_bytes_total[5m])", "legendFormat": "{{port_id}} {{name}}", "refId": "A"}],
|
||||
"fieldConfig": {"defaults": {"unit": "Bps"}}
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(unifipoller_port_receive_bytes_total[5m])", "legendFormat": "{{port_id}} {{name}}", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 5,
|
||||
"type": "timeseries",
|
||||
"title": "UniFi Port TX (bytes/s)",
|
||||
"gridPos": {"x": 12, "y": 12, "w": 12, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(unpoller_device_port_transmit_bytes_total[5m])", "legendFormat": "{{port_id}} {{name}}", "refId": "A"}],
|
||||
"fieldConfig": {"defaults": {"unit": "Bps"}}
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "rate(unifipoller_port_transmit_bytes_total[5m])", "legendFormat": "{{port_id}} {{name}}", "refId": "A"}]
|
||||
},
|
||||
{
|
||||
"id": 11,
|
||||
"type": "timeseries",
|
||||
"title": "Top Client Throughput (bytes/s)",
|
||||
"gridPos": {"x": 0, "y": 20, "w": 24, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "topk(10, rate(unpoller_client_receive_bytes_total[5m]) + rate(unpoller_client_transmit_bytes_total[5m]))", "legendFormat": "{{name}} {{ip}}", "refId": "A"}],
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "topk(10, rate(unifipoller_client_receive_bytes_total[5m]) + rate(unifipoller_client_transmit_bytes_total[5m]))", "legendFormat": "{{name}} {{ip}}", "refId": "A"}],
|
||||
"fieldConfig": {"defaults": {"unit": "Bps"}}
|
||||
},
|
||||
{
|
||||
@@ -586,7 +482,7 @@ in
|
||||
"type": "table",
|
||||
"title": "Device Status",
|
||||
"gridPos": {"x": 12, "y": 28, "w": 12, "h": 8},
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "unpoller_device_uptime_seconds", "instant": true, "refId": "A"}],
|
||||
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "unifipoller_device_uptime_seconds", "instant": true, "refId": "A"}],
|
||||
"fieldConfig": {"defaults": {"unit": "s"}}
|
||||
}
|
||||
]
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
# Bootloader.
|
||||
boot = {
|
||||
loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/sda";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./boot.nix
|
||||
./filesystem.nix
|
||||
./location.nix
|
||||
./networking.nix
|
||||
./wiki.nix
|
||||
];
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
description = "Gregory Hellings";
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
packages = with pkgs; [ ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{ ... }:
|
||||
|
||||
let
|
||||
in
|
||||
{
|
||||
fileSystems."serve" = {
|
||||
#device = "10.42.1.4:/volume1/icdm-mysql/";
|
||||
#fsType = "nfs";
|
||||
device = "/dev/sdb1";
|
||||
fsType = "auto";
|
||||
mountPoint = "/srv";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ehci_pci"
|
||||
"ahci"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/var" = {
|
||||
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
{ ... }:
|
||||
let
|
||||
dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
|
||||
in
|
||||
{
|
||||
# If we have to do proxying in Bayonnais, we can start to work on that here
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
networking = {
|
||||
hostName = "icdm-root";
|
||||
useDHCP = false;
|
||||
defaultGateway = "10.42.1.1";
|
||||
nameservers = [
|
||||
"100.100.100.100"
|
||||
"10.42.1.2"
|
||||
];
|
||||
enableIPv6 = false;
|
||||
|
||||
interfaces = {
|
||||
eno1.ipv4.addresses = [
|
||||
{
|
||||
address = "10.42.101.1";
|
||||
prefixLength = 16;
|
||||
}
|
||||
{
|
||||
address = "10.77.1.2";
|
||||
prefixLength = 16;
|
||||
}
|
||||
];
|
||||
};
|
||||
# Allow traffic through
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
67
|
||||
];
|
||||
};
|
||||
|
||||
extraHosts = "${dnsHosts}";
|
||||
};
|
||||
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "icdm.lan";
|
||||
dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
|
||||
dhcp-option = [
|
||||
"eno1,option:router,10.77.1.1"
|
||||
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
|
||||
"eno1,option:domain-search,icdm.lan"
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
# Upstream servers
|
||||
server = [
|
||||
"1.1.1.1"
|
||||
"8.8.4.4"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
wikiHost = "wiki.icdm.lan";
|
||||
kiwixport = 8080;
|
||||
in
|
||||
{
|
||||
services.kiwix-serve = {
|
||||
enable = true;
|
||||
port = kiwixport;
|
||||
library = {
|
||||
inherit (pkgs) zim;
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
}
|
||||
@@ -9,6 +9,12 @@
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
|
||||
gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
|
||||
runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
|
||||
};
|
||||
|
||||
boot = {
|
||||
binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
extraModprobeConfig = "options kvm_amd nested=1";
|
||||
@@ -36,20 +42,15 @@
|
||||
vip = metadata.hosts.${config.networking.hostName}.ip;
|
||||
priority = 255;
|
||||
};
|
||||
nebula.enable = true;
|
||||
podman.enable = true;
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
remote-builder.enable = true;
|
||||
gitea-runner = {
|
||||
runner = {
|
||||
enable = true;
|
||||
extraLabels = [ "bare-metal:host" ];
|
||||
};
|
||||
vmdev = {
|
||||
enable = true;
|
||||
host = "libvirt";
|
||||
qemu = true;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -65,6 +66,41 @@
|
||||
};
|
||||
|
||||
services = {
|
||||
gitea-actions-runner.instances.podman = {
|
||||
enable = true;
|
||||
labels = [
|
||||
"debian-latest:docker://node:25-trixie"
|
||||
|
||||
"ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
|
||||
"ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
||||
"ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
||||
|
||||
"ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
|
||||
"ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
|
||||
"ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
|
||||
|
||||
"ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
|
||||
"ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
|
||||
"ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
|
||||
|
||||
"ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
|
||||
"ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
|
||||
"ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
|
||||
|
||||
"ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
|
||||
"ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
|
||||
"ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
|
||||
|
||||
"nix-latest:docker://src.thehellings.com/greg/builder:latest"
|
||||
];
|
||||
name = "isaiah-podman";
|
||||
settings = {
|
||||
container.force_pull = true;
|
||||
runner.capacity = 7;
|
||||
};
|
||||
tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
|
||||
url = "https://gitea.shire-zebra.ts.net";
|
||||
};
|
||||
k3s.clusterInit = true; # This is the first node in the cluster
|
||||
openssh = {
|
||||
enable = true;
|
||||
|
||||
@@ -22,6 +22,8 @@ in
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
|
||||
|
||||
gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
|
||||
gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
|
||||
gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
|
||||
@@ -76,10 +78,6 @@ in
|
||||
};
|
||||
|
||||
greg = {
|
||||
gitea-runner = {
|
||||
enable = true;
|
||||
extraLabels = [ "bare-metal:host" ];
|
||||
};
|
||||
home = true;
|
||||
kubernetes = {
|
||||
enable = true;
|
||||
@@ -87,13 +85,16 @@ in
|
||||
vip = ip;
|
||||
priority = 254;
|
||||
};
|
||||
nebula.enable = true;
|
||||
proxies."buildbot.nebula.thehellings.com".target = "http://buildbot.nebula.thehellings.com:8010/";
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
remote-builder.enable = true;
|
||||
runner = {
|
||||
enable = true;
|
||||
threads = 3;
|
||||
qemu = true;
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
@@ -114,7 +115,6 @@ in
|
||||
interface = "br0";
|
||||
};
|
||||
firewall.allowedTCPPorts = [
|
||||
8010
|
||||
3389
|
||||
9989 # buildbot communications port
|
||||
];
|
||||
@@ -143,7 +143,7 @@ in
|
||||
updateOutputs = false;
|
||||
};
|
||||
};
|
||||
domain = "buildbot.nebula.thehellings.com:8010";
|
||||
domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
|
||||
evalMaxMemorySize = 8192;
|
||||
evalWorkerCount = 4;
|
||||
gitea = {
|
||||
@@ -156,7 +156,7 @@ in
|
||||
webhookSecretFile = config.age.secrets.gitea-webhookSecret.path;
|
||||
};
|
||||
showTrace = true;
|
||||
#webhookBaseUrl = "http://${config.networking.hostName}.nebula.thehellings.com:8010";
|
||||
#webhookBaseUrl = "http://${config.networking.hostName}.shire-zebra.ts.net:8010";
|
||||
workersFile = config.age.secrets.gitea-buildbotWorkersFile.path;
|
||||
};
|
||||
worker = {
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
{
|
||||
config,
|
||||
metadata,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
|
||||
greg = {
|
||||
home = true;
|
||||
nebula.enable = true;
|
||||
proxies =
|
||||
let
|
||||
tgt = {
|
||||
target = "http://localhost:${config.services.uptime-kuma.settings.PORT}";
|
||||
genAliases = false;
|
||||
};
|
||||
in
|
||||
{
|
||||
"kuma.nebula.thehellings.com" = tgt;
|
||||
"kuma.thehellings.lan" = tgt;
|
||||
"kuma.shire-zebra.ts.net" = tgt;
|
||||
};
|
||||
};
|
||||
nix.settings = {
|
||||
sandbox = false;
|
||||
};
|
||||
networking = {
|
||||
defaultGateway = metadata.infra.gw;
|
||||
nameservers = [ metadata.infra.dns ];
|
||||
interfaces.ens18 = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = metadata.hosts."${config.networking.hostName}".ip;
|
||||
prefixLength = 16;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
proxmox.cloudInit.enable = false;
|
||||
services = {
|
||||
fstrim.enable = true;
|
||||
mysql = {
|
||||
enable = true;
|
||||
ensureDatabases = [
|
||||
config.services.uptime-kuma.settings.UPTIME_KUMA_DB_NAME
|
||||
];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = config.services.uptime-kuma.settings.UPTIME_KUMA_DB_USERNAME;
|
||||
ensurePermissions = {
|
||||
"uptimekuma.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
package = pkgs.mariadb;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
uptime-kuma = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PORT = "3001"; # Default, but this allows us to explicitly use it elsewhere
|
||||
UPTIME_KUMA_DB_TYPE = "mariadb";
|
||||
UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
|
||||
UPTIME_KUMA_DB_NAME = "uptimekuma";
|
||||
UPTIME_KUMA_DB_USERNAME = "uptimekuma";
|
||||
UPTIME_KUMA_DB_PASSWORD = "uptimekuma";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,100 +1,44 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
metadata,
|
||||
pkgs,
|
||||
pkgs',
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
homepage = "127.0.0.1:30080";
|
||||
nextcloudPort = 8080;
|
||||
sshPort = 2222;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./git.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./matrix.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
acme.file = ../../../secrets/acme.age;
|
||||
nextcloudadmin = {
|
||||
file = ../../../secrets/nextcloudadmin.age;
|
||||
owner = "nextcloud";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
graphviz
|
||||
nix-du
|
||||
pgloader
|
||||
podman-compose
|
||||
pkgs'.upgrade-pg-cluster
|
||||
];
|
||||
|
||||
greg = {
|
||||
backup.jobs = {
|
||||
nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
pre = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-pre";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --on";
|
||||
}
|
||||
);
|
||||
post = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-post";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --off";
|
||||
}
|
||||
);
|
||||
};
|
||||
greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
};
|
||||
};
|
||||
gitea-runner = {
|
||||
enable = true;
|
||||
labels = [
|
||||
"vps:host"
|
||||
"blog:host"
|
||||
"nixos-linode:host"
|
||||
];
|
||||
};
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
nebula = {
|
||||
enable = true;
|
||||
isLighthouse = true;
|
||||
unsafeRoutes = [
|
||||
{
|
||||
route = "10.42.0.0/16";
|
||||
via = metadata.hosts.genesis.nebulaIp;
|
||||
}
|
||||
];
|
||||
proxies."immich.thehellings.com" = {
|
||||
genAliases = false;
|
||||
target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
|
||||
ssl = true;
|
||||
};
|
||||
tailscale.enable = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
domain = "thehellings.com";
|
||||
firewall.allowedTCPPorts = [
|
||||
sshPort
|
||||
80
|
||||
443
|
||||
];
|
||||
hostName = "linode";
|
||||
nameservers = [
|
||||
"10.157.0.2"
|
||||
"100.96.198.104"
|
||||
];
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [ "100.88.91.27" ];
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
@@ -105,252 +49,26 @@ in
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
dnsPropagationCheck = false;
|
||||
dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
|
||||
email = "greg.hellings@gmail.com";
|
||||
extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
|
||||
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
};
|
||||
certs."thehellings.com" = {
|
||||
dnsProvider = "linode";
|
||||
environmentFile = config.age.secrets.acme.path;
|
||||
extraDomainNames = [
|
||||
"*.thehellings.com"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
|
||||
anubis = {
|
||||
instances = {
|
||||
git = {
|
||||
enable = true;
|
||||
settings = {
|
||||
BIND = "/run/anubis/anubis-git/anubis.sock";
|
||||
COOKIE_DOMAIN = "thehellings.com";
|
||||
SERVE_ROBOTS_TXT = true;
|
||||
SLOG_LEVEL = "DEBUG";
|
||||
TARGET = "http://git.k3s.thehellings.lan";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
haproxy = {
|
||||
enable = true;
|
||||
config = ''
|
||||
global
|
||||
nbthread 4
|
||||
maxconn 80
|
||||
log /dev/log local0
|
||||
|
||||
defaults
|
||||
timeout connect 500s
|
||||
timeout client 500s
|
||||
timeout server 1h
|
||||
|
||||
listen gitsshd
|
||||
bind *:${toString sshPort}
|
||||
timeout client 1h
|
||||
mode tcp
|
||||
server git-isaiah isaiah.thehellings.lan:32222
|
||||
server git-jeremiah jeremiah.thehellings.lan:32222
|
||||
server git-zeke zeke.thehellings.lan:32222
|
||||
|
||||
frontend https
|
||||
bind *:80
|
||||
bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
|
||||
|
||||
http-request redirect scheme https unless { ssl_fc }
|
||||
http-request add-header X-Forwarded-Proto https
|
||||
|
||||
http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
|
||||
|
||||
option http-server-close
|
||||
option http-keep-alive
|
||||
|
||||
#option httplog
|
||||
#declare capture response len 80
|
||||
#http-response capture res.hdr(Location) id 0
|
||||
|
||||
use_backend git if { hdr(host) -i src.thehellings.com }
|
||||
use_backend git if { req_ssl_sni -i src.thehellings.com }
|
||||
use_backend next if { hdr(host) -i next.thehellings.com }
|
||||
use_backend next if { req_ssl_sni -i next.thehellings.com }
|
||||
use_backend matrix if { hdr(host) -i matrix.thehellings.com }
|
||||
use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
|
||||
use_backend immich if { hdr(host) -i immich.thehellings.com }
|
||||
use_backend immich if { req_ssl_sni -i immich.thehellings.com }
|
||||
use_backend web if { hdr(host) -i thehellings.com }
|
||||
use_backend web if { req_ssl_sni -i thehellings.com }
|
||||
|
||||
backend git
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
http-request set-header Host git.k3s.thehellings.lan
|
||||
server git-isaiah isaiah.thehellings.lan:80
|
||||
server git-jeremiah jeremiah.thehellings.lan:80
|
||||
server git-zeke zeke.thehellings.lan:80
|
||||
|
||||
backend immich
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
server immich-proxy 127.0.0.1:${builtins.toString config.services.immich-public-proxy.port}
|
||||
|
||||
backend matrix
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
http-request set-header Host matrix.k3s.thehellings.lan
|
||||
server git-isaiah isaiah.thehellings.lan:80
|
||||
server git-jeremiah jeremiah.thehellings.lan:80
|
||||
server git-zeke zeke.thehellings.lan:80
|
||||
|
||||
backend web
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
server web-container ${homepage}
|
||||
|
||||
backend next
|
||||
log global
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
#http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
|
||||
server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
|
||||
'';
|
||||
};
|
||||
|
||||
immich-public-proxy = {
|
||||
enable = true;
|
||||
immichUrl = "http://immich.k3s.thehellings.lan";
|
||||
immichUrl = "https://immich.shire-zebra.ts.net";
|
||||
};
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud33;
|
||||
appstoreEnable = true;
|
||||
hostName = "localhost";
|
||||
https = false;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "http";
|
||||
trusted_domains = [ "next.thehellings.com" ];
|
||||
trusted_proxies = [
|
||||
"localhost"
|
||||
"127.0.0.1"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Move to :8080 so that we can run haproxy as the primary HTTP service
|
||||
nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
|
||||
{
|
||||
addr = "127.0.0.1";
|
||||
port = nextcloudPort;
|
||||
}
|
||||
];
|
||||
|
||||
openssh.settings.PasswordAuthentication = false;
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "gitlab-runner" ];
|
||||
commands = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
command = "/run/current-system/sw/bin/systemctl";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
{
|
||||
command = "/run/current-system/sw/bin/podman";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [ "nextcloud" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
haproxy = {
|
||||
after = [
|
||||
"nextcloud.service"
|
||||
"network-online.target"
|
||||
];
|
||||
wants = [
|
||||
"nextcloud.service"
|
||||
"network-online.target"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
|
||||
|
||||
# Actually serve the content from here
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
image = "src.thehellings.com/greg/homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
@@ -0,0 +1,122 @@
|
||||
{ ... }:
|
||||
|
||||
let
|
||||
srcDomain = "src.thehellings.com";
|
||||
sshPort = 2222;
|
||||
in
|
||||
{
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "https://gitea.shire-zebra.ts.net";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_ssl_verify off;
|
||||
proxy_ssl_server_name on;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
client_max_body_size 100000m;
|
||||
# Ultimate AI Block List v1.7 20250924
|
||||
# https://perishablepress.com/ultimate-ai-block-list/
|
||||
|
||||
if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
|
||||
return 444;
|
||||
}
|
||||
'';
|
||||
};
|
||||
#greg.proxies."registry.thehellings.com" = {
|
||||
#target = "https://gitea.shire-zebra.ts.net:5000";
|
||||
#ssl = true;
|
||||
#genAliases = false;
|
||||
#extraConfig = ''
|
||||
#proxy_set_header X-Forwarded-Proto https;
|
||||
#proxy_set_header X-Forwarded-Ssl on;
|
||||
#client_max_body_size 25000m;
|
||||
#'';
|
||||
#};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
systemd.services = {
|
||||
haproxy = {
|
||||
after = [
|
||||
"network-online.target"
|
||||
];
|
||||
wants = [
|
||||
"network-online.target"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = ''
|
||||
global
|
||||
daemon
|
||||
maxconn 20
|
||||
|
||||
defaults
|
||||
timeout connect 500s
|
||||
timeout client 500s
|
||||
timeout server 1h
|
||||
|
||||
listen gitsshd
|
||||
bind *:${toString sshPort}
|
||||
timeout client 1h
|
||||
mode tcp
|
||||
server git-isaiah isaiah.shire-zebra.ts.net:32222
|
||||
server git-jeremiah jeremiah.shire-zebra.ts.net:32222
|
||||
server git-zeke zeke.shire-zebra.ts.net:32222
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,88 @@
|
||||
# Registration of new users is disabled for the public, but I can create
|
||||
# them by the following commands:
|
||||
# nix run nixpkgs.matrix-synapse
|
||||
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
domain = "${config.networking.domain}";
|
||||
fqdn = "matrix.${domain}";
|
||||
in
|
||||
{
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
# Server the '.well-known' files to find the Matrix API server
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
# This is needed so that servers contacting hellings.com can find
|
||||
# the actual application server at matrix.thehellings.com
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = {
|
||||
"m.server" = "${fqdn}:443";
|
||||
};
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = {
|
||||
"base_url" = "https://${fqdn}";
|
||||
};
|
||||
"m.identity_server" = {
|
||||
"base_url" = "https://vector.im";
|
||||
};
|
||||
};
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
};
|
||||
|
||||
# Reverse proxy in front of the actual Matrix server
|
||||
"${fqdn}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
extraConfig = ''
|
||||
error_log /var/log/nginx/debug.log debug;
|
||||
'';
|
||||
|
||||
# Not the appropriate place for the chat client
|
||||
locations =
|
||||
(builtins.listToAttrs (
|
||||
builtins.map
|
||||
(
|
||||
val:
|
||||
lib.nameValuePair "/_${val}" {
|
||||
proxyPass = "http://matrix.kubernetes";
|
||||
}
|
||||
)
|
||||
[
|
||||
"matrix"
|
||||
"synapse"
|
||||
"dendrite"
|
||||
]
|
||||
))
|
||||
// {
|
||||
"/".extraConfig = "return 404;";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Open networking ports for the server
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
age.secrets.nextcloudadmin = {
|
||||
file = ../../../secrets/nextcloudadmin.age;
|
||||
owner = "nextcloud";
|
||||
};
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud32;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."next.thehellings.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
|
||||
# Otherwise nginx errors looking for the nextcloud sock file
|
||||
systemd.services.nginx.after = [ "nextcloud.service" ];
|
||||
|
||||
greg.backup.jobs.nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
pre = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-pre";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --on";
|
||||
}
|
||||
);
|
||||
post = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-post";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --off";
|
||||
}
|
||||
);
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{ ... }:
|
||||
let
|
||||
homepage = "127.0.0.1:30080";
|
||||
in
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
clientMaxBodySize = "25000m"; # To help with uploading container images
|
||||
# If there are recommended settings, let's use them!
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
# Actually serve the content from here
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
# needs explicit port to match what gitlab-runner sees when pulling
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies = {
|
||||
"thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
"doubles.thehellings.com" = {
|
||||
target = "http://localhost:8081";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
podman-compose
|
||||
];
|
||||
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [ "nextcloud" ];
|
||||
};
|
||||
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
greg = {
|
||||
home = true;
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "proxmoxtemplate"; # Define your hostname.
|
||||
# defaultGateway = {
|
||||
# address = " 10.42.1.2";
|
||||
# interface = "enp6s18";
|
||||
# };
|
||||
# interfaces = {
|
||||
# enp6s18 = {
|
||||
# ipv4.addresses = [
|
||||
# {
|
||||
# address = "10.42.1.8";
|
||||
# prefixLength = 16;
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
# };
|
||||
nameservers = [ "10.42.1.5" ];
|
||||
};
|
||||
|
||||
services.qemuGuest.enable = true;
|
||||
|
||||
system.stateVersion = "24.11"; # Did you read the comment?
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
description = "Greg Hellings";
|
||||
extraGroups = [ "wheel" ];
|
||||
packages = with pkgs; [ ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"uhci_hcd"
|
||||
"ehci_pci"
|
||||
"ahci"
|
||||
"virtio_pci"
|
||||
"virtio_scsi"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/7115-EFA6";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
|
||||
}
|
||||
@@ -14,28 +14,27 @@
|
||||
top.nix-hardware.nixosModules.system76
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
|
||||
};
|
||||
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
|
||||
|
||||
greg = {
|
||||
gitea-runner = {
|
||||
enable = true;
|
||||
extraLabels = [ "bare-metal:host" ];
|
||||
};
|
||||
kubernetes = {
|
||||
enable = true;
|
||||
vipInterface = "enp12s0";
|
||||
priority = 253;
|
||||
};
|
||||
nebula.enable = true;
|
||||
remote-builder.enable = true;
|
||||
runner = {
|
||||
enable = true;
|
||||
vbox = false;
|
||||
};
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
vmdev = {
|
||||
enable = true;
|
||||
host = "vbox";
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
@@ -75,4 +74,10 @@
|
||||
users.users.greg.extraGroups = [
|
||||
"podman"
|
||||
];
|
||||
|
||||
# virtualisation.virtualbox.host = {
|
||||
# enableExtensionPack = true;
|
||||
# headless = true;
|
||||
# enableWebService = true;
|
||||
# };
|
||||
}
|
||||
|
||||
@@ -35,11 +35,10 @@
|
||||
device = "/dev/nvme0n1p1";
|
||||
fsType = "auto";
|
||||
};
|
||||
"/mnt/disk1" = {
|
||||
device = "/dev/disk/by-uuid/bd04e868-034e-46e8-84ae-cd7347448bbd";
|
||||
fsType = "xfs";
|
||||
options = [ "nofail" ];
|
||||
};
|
||||
#"/mnt/disk1" = {
|
||||
#device = "/dev/disk/by-uuid/0bb64e76-8811-499a-b60e-cc97808f2b0e";
|
||||
#fsType = "btrfs";
|
||||
#};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
@@ -0,0 +1,273 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.117.28.111";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
age.secrets =
|
||||
let
|
||||
cfg = n: {
|
||||
file = ../../../secrets/gitlab/${n}.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
in
|
||||
{
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-db-password = cfg "db-password";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
gitlab-salt = cfg "salt";
|
||||
gitlab-primary-key = cfg "primary-key";
|
||||
gitlab-deterministic-key = cfg "deterministic-key";
|
||||
|
||||
minio_access_key_id = {
|
||||
file = ../../../secrets/minio_access_key_id.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
minio_secret_access_key = {
|
||||
file = ../../../secrets/minio_secret_access_key.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
|
||||
greg = {
|
||||
backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
};
|
||||
home = true;
|
||||
tailscale = {
|
||||
enable = true;
|
||||
tags = [ "home" ];
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "gitlab"; # Define your hostname.
|
||||
firewall.allowedTCPPorts = [
|
||||
80
|
||||
registryPort
|
||||
];
|
||||
};
|
||||
|
||||
services = {
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
databaseHost = "postgres.kubernetes";
|
||||
databaseName = "gitlab";
|
||||
databaseUsername = "gitlab";
|
||||
databasePasswordFile = config.age.secrets.gitlab-db-password.path;
|
||||
databaseCreateLocally = false;
|
||||
extraConfig = {
|
||||
registry.port = null;
|
||||
gitlab = {
|
||||
trustedProxies = [
|
||||
"${vpnIp}/32" # The system itself
|
||||
"100.109.86.8/32" # Public server's IP
|
||||
];
|
||||
};
|
||||
object_store = {
|
||||
enabled = true;
|
||||
proxy_download = true; # Tell them to reach out to object storage themselves!
|
||||
connection = {
|
||||
provider = "AWS";
|
||||
endpoint = "http://s3.thehellings.lan:9000";
|
||||
region = "us-east-1";
|
||||
aws_access_key_id = {
|
||||
_secret = config.age.secrets.minio_access_key_id.path;
|
||||
};
|
||||
aws_secret_access_key = {
|
||||
_secret = config.age.secrets.minio_secret_access_key.path;
|
||||
};
|
||||
path_style = true; # True for MinIO
|
||||
aws_signature_version = 2;
|
||||
};
|
||||
#storage_options = ...;
|
||||
objects = builtins.listToAttrs (
|
||||
builtins.map
|
||||
(
|
||||
x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
|
||||
)
|
||||
[
|
||||
"artifacts"
|
||||
"ci_secure_files"
|
||||
"dependency_proxy"
|
||||
"external_diffs"
|
||||
"lfs"
|
||||
"packages"
|
||||
"pages"
|
||||
"terraform_state"
|
||||
"uploads"
|
||||
]
|
||||
);
|
||||
};
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
port = 443;
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
|
||||
activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
|
||||
activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
};
|
||||
};
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
clientMaxBodySize = "25000m";
|
||||
virtualHosts = {
|
||||
"vm-gitlab.shire-zebra.ts.net" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = ''
|
||||
ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
|
||||
ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
|
||||
client_max_body_size 10000m ;
|
||||
'';
|
||||
};
|
||||
"registry" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:4567/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = ''
|
||||
ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
|
||||
ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
|
||||
client_max_body_size 25000m ;
|
||||
'';
|
||||
serverAliases = [
|
||||
"vm-gitlab.shire-zebra.ts.net"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh.enable = true;
|
||||
|
||||
postgresql.enable = true;
|
||||
|
||||
qemuGuest.enable = true;
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
#resolved.enable = true;
|
||||
};
|
||||
|
||||
# Do not start nginx until we have tailscaled up and running, so it can bind
|
||||
# to the 100.* addresses
|
||||
systemd = {
|
||||
services = {
|
||||
certRefresh =
|
||||
let
|
||||
script = pkgs.writeShellApplication {
|
||||
name = "cert-refresh";
|
||||
runtimeInputs = [ pkgs.tailscale ];
|
||||
|
||||
text = ''
|
||||
cd /etc/certs
|
||||
tailscale cert vm-gitlab.shire-zebra.ts.net
|
||||
chown nginx ./*
|
||||
systemctl reload nginx
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
script = lib.getExe script;
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
};
|
||||
};
|
||||
|
||||
nginx = rec {
|
||||
after = [ "network-online.target" ];
|
||||
requires = [ "network-online.target" ];
|
||||
wants = after;
|
||||
serviceConfig = {
|
||||
RestartMaxDelaySec = "30s";
|
||||
RestartSteps = "5";
|
||||
};
|
||||
};
|
||||
tailscaled.partOf = [ "network-online.target" ];
|
||||
};
|
||||
|
||||
timers = {
|
||||
"cert-refresh" = {
|
||||
wantedBy = [ "cert-refresh.service" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "monthly";
|
||||
Persistent = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.11";
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot = {
|
||||
extraModulePackages = [ ];
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
"uhci_hcd"
|
||||
"ehci_pci"
|
||||
"ahci"
|
||||
"virtio_pci"
|
||||
"virtio_scsi"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
systemd-boot.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/1E6A-C3BB";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
{ lib, ... }:
|
||||
{
|
||||
hostsByNet =
|
||||
net: hosts:
|
||||
let
|
||||
netAttr =
|
||||
{
|
||||
lan = "ip";
|
||||
nebula = "nebulaIp";
|
||||
tailscale = "ts";
|
||||
}
|
||||
.${net};
|
||||
in
|
||||
lib.mapAttrsToList
|
||||
(name: value: {
|
||||
inherit name;
|
||||
address = builtins.getAttr netAttr value;
|
||||
aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
|
||||
})
|
||||
(
|
||||
lib.filterAttrs (
|
||||
_host: settings: (builtins.hasAttr netAttr settings) && (builtins.getAttr netAttr settings) != null
|
||||
) hosts
|
||||
);
|
||||
}
|
||||
@@ -40,7 +40,7 @@ metadata:
|
||||
},
|
||||
{
|
||||
"path": "/mnt/disk1",
|
||||
"allowScheduling": true,
|
||||
"allowScheduling": false,
|
||||
"tags": ["hdd", "large"]
|
||||
}
|
||||
]
|
||||
|
||||
@@ -1,36 +1,3 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: tailscale
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: tailscale
|
||||
namespace: tailscale
|
||||
spec:
|
||||
interval: "24h"
|
||||
url: "https://pkgs.tailscale.com/helmcharts"
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: tailscale
|
||||
namespace: tailscale
|
||||
spec:
|
||||
interval: 10m
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
namespace: external-secrets
|
||||
chart:
|
||||
spec:
|
||||
chart: tailscale-operator
|
||||
version: "1.96.5"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: tailscale
|
||||
interval: "1h"
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
@@ -21,6 +21,9 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: bitwarden-cli
|
||||
# Since my gitlab instance depends on the database hosted in k3s, and
|
||||
# the database depends on this image, I need a way to bootstrap the
|
||||
# system if # I am doing disaster recovery. And this is it.
|
||||
image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
|
||||
#image: >-
|
||||
# registry.thehellings.com/greg/nixos-config/img-bitwarden:latest
|
||||
|
||||
@@ -1,21 +1,32 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: headlamp
|
||||
name: kubernetes-dashboard
|
||||
spec:
|
||||
url: "https://kubernetes-sigs.github.io/headlamp/"
|
||||
url: https://kubernetes.github.io/dashboard/
|
||||
interval: "24h"
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: headlamp
|
||||
name: kubernetes-dashboard
|
||||
spec:
|
||||
interval: "24h"
|
||||
chart:
|
||||
spec:
|
||||
chart: headlamp
|
||||
chart: kubernetes-dashboard
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: headlamp
|
||||
name: kubernetes-dashboard
|
||||
interval: "24h"
|
||||
values:
|
||||
app:
|
||||
settings:
|
||||
global:
|
||||
clusterName: Hellings Home
|
||||
itemsPerPage: 25
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- dashboard.shire-zebra.ts.net
|
||||
ingressClassName: tailscale
|
||||
|
||||
@@ -4,4 +4,3 @@ resources:
|
||||
- namespace.yaml
|
||||
- chart.yaml
|
||||
- user.yaml
|
||||
- ingress.yaml
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: immich
|
||||
spec:
|
||||
imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration"
|
||||
#imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
|
||||
#postgresUID: 1
|
||||
instances: 1
|
||||
storage:
|
||||
size: 60Gi
|
||||
primaryUpdateStrategy: unsupervised
|
||||
postgresql:
|
||||
shared_preload_libraries:
|
||||
- vectors.so
|
||||
- vchord.so
|
||||
|
||||
bootstrap:
|
||||
recovery:
|
||||
source: origin
|
||||
# initdb:
|
||||
# database: immich
|
||||
# owner: immich
|
||||
# secret:
|
||||
# name: postgres-user-immich
|
||||
# dataChecksums: true
|
||||
# postInitApplicationSQL:
|
||||
# - ALTER SYSTEM SET search_path TO "$user", public, vectors;
|
||||
# - SET search_path TO "$user", public, vectors;
|
||||
# - CREATE EXTENSION IF NOT EXISTS "cube";
|
||||
# - CREATE EXTENSION IF NOT EXISTS "earthdistance";
|
||||
# - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
|
||||
|
||||
externalClusters:
|
||||
- name: origin
|
||||
plugin:
|
||||
name: barman-cloud.cloudnative-pg.io
|
||||
parameters:
|
||||
barmanObjectName: k3sbackup-objectstore
|
||||
serverName: pgvector
|
||||
|
||||
managed:
|
||||
roles:
|
||||
- name: immich
|
||||
ensure: present
|
||||
comment: Immich DB user
|
||||
login: true
|
||||
superuser: true
|
||||
passwordSecret:
|
||||
name: postgres-user-immich
|
||||
|
||||
plugins:
|
||||
- name: barman-cloud.cloudnative-pg.io
|
||||
isWALArchiver: true
|
||||
parameters:
|
||||
barmanObjectName: k3sbackup-objectstore
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Database
|
||||
metadata:
|
||||
name: database-immich
|
||||
spec:
|
||||
name: immich
|
||||
owner: immich
|
||||
cluster:
|
||||
name: immich
|
||||
extensions:
|
||||
- name: vectors
|
||||
ensure: present
|
||||
- name: vectorchord
|
||||
ensure: present
|
||||
- name: cube
|
||||
ensure: present
|
||||
- name: earthdistance
|
||||
ensure: present
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: ScheduledBackup
|
||||
metadata:
|
||||
name: immich-backup
|
||||
spec:
|
||||
immediate: true # Create one when this is added to the cluster
|
||||
schedule: "0 2 0 * * *" # 1AM, nightly
|
||||
backupOwnerReference: self
|
||||
cluster:
|
||||
name: immich
|
||||
method: plugin
|
||||
pluginConfiguration:
|
||||
name: barman-cloud.cloudnative-pg.io
|
||||
@@ -14,12 +14,14 @@ spec:
|
||||
- 100.88.91.27 # dns?
|
||||
- 100.80.99.48 # exodus
|
||||
- 100.88.91.27 # genesis
|
||||
- 100.117.28.111 # gitlab
|
||||
- 100.68.203.1 # hosea
|
||||
- 100.84.183.79 # isaiah
|
||||
- 100.102.186.39 # jeremiah
|
||||
- 100.90.74.19 # zeke
|
||||
- 100.115.57.8 # linode
|
||||
- 100.65.5.38 # matrix
|
||||
#- 100.127.55.22 # jellyfin
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRouteTCP
|
||||
|
||||
@@ -4,6 +4,8 @@ resources:
|
||||
- namespace.yaml
|
||||
- secrets.yaml
|
||||
- postgres-cluster.yaml
|
||||
- postgres-gitlab.yaml
|
||||
- postgres-pgadmin.yaml
|
||||
- postgres-matrix.yaml
|
||||
- immich.yaml
|
||||
- ingress.yaml
|
||||
|
||||
@@ -11,6 +11,13 @@ spec:
|
||||
|
||||
managed:
|
||||
roles:
|
||||
- name: gitlab
|
||||
ensure: present
|
||||
comment: Gitlab user
|
||||
login: true
|
||||
superuser: false
|
||||
passwordSecret:
|
||||
name: postgres-user-gitlab
|
||||
- name: pgadmin
|
||||
ensure: present
|
||||
comment: PG Admin user
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Database
|
||||
metadata:
|
||||
name: database-gitlab
|
||||
spec:
|
||||
name: gitlab
|
||||
owner: gitlab
|
||||
cluster:
|
||||
name: postgres
|
||||
@@ -1,5 +1,39 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: postgres-user-gitlab
|
||||
namespace: db
|
||||
spec:
|
||||
target:
|
||||
name: postgres-user-gitlab
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
username: |-
|
||||
{{ .username }}
|
||||
password: |-
|
||||
{{ .password }}
|
||||
data:
|
||||
- secretKey: username
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
|
||||
property: username
|
||||
- secretKey: password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
|
||||
property: password
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: postgres-user-matrix
|
||||
namespace: db
|
||||
@@ -99,3 +133,37 @@ spec:
|
||||
remoteRef:
|
||||
key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
|
||||
property: password
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: postgres-user-immich
|
||||
namespace: db
|
||||
spec:
|
||||
target:
|
||||
name: postgres-user-immich
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
username: |-
|
||||
{{ .username }}
|
||||
password: |-
|
||||
{{ .password }}
|
||||
data:
|
||||
- secretKey: username
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
|
||||
property: username
|
||||
- secretKey: password
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
|
||||
property: password
|
||||
|
||||
@@ -0,0 +1,79 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: donetick-config
|
||||
namespace: donetick
|
||||
data:
|
||||
# Value pulled from
|
||||
# https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
|
||||
selfhosted.yaml: |-
|
||||
name: "selfhosted"
|
||||
is_done_tick_dot_com: false
|
||||
is_user_creation_disabled: false
|
||||
telegram:
|
||||
token: ""
|
||||
pushover:
|
||||
token: ""
|
||||
database:
|
||||
type: "sqlite"
|
||||
migration: true
|
||||
# these are only required for postgres
|
||||
host: "secret"
|
||||
port: 5432
|
||||
user: "secret"
|
||||
password: "secret"
|
||||
name: "secret"
|
||||
jwt:
|
||||
secret: "This is really a secure JWT secret now!"
|
||||
session_time: 168h
|
||||
max_refresh: 168h
|
||||
server:
|
||||
port: 2021
|
||||
read_timeout: 10s
|
||||
write_timeout: 10s
|
||||
rate_period: 60s
|
||||
rate_limit: 300
|
||||
cors_allow_origins:
|
||||
- "http://localhost:5173"
|
||||
- "http://localhost:7926"
|
||||
# the below are required for the android app to work
|
||||
- "https://localhost"
|
||||
- "capacitor://localhost"
|
||||
serve_frontend: true
|
||||
logging:
|
||||
level: "info"
|
||||
encoding: "json"
|
||||
development: false
|
||||
scheduler_jobs:
|
||||
due_job: 30m
|
||||
overdue_job: 3h
|
||||
pre_due_job: 3h
|
||||
email:
|
||||
host:
|
||||
port:
|
||||
key:
|
||||
email:
|
||||
appHost:
|
||||
oauth2:
|
||||
client_id:
|
||||
client_secret:
|
||||
auth_url:
|
||||
token_url:
|
||||
user_info_url:
|
||||
redirect_url:
|
||||
name:
|
||||
# Real-time configuration
|
||||
realtime:
|
||||
enabled: true
|
||||
sse_enabled: true
|
||||
heartbeat_interval: 60s
|
||||
connection_timeout: 120s
|
||||
max_connections: 1000
|
||||
max_connections_per_user: 5
|
||||
event_queue_size: 2048
|
||||
cleanup_interval: 2m
|
||||
stale_threshold: 5m
|
||||
enable_compression: true
|
||||
enable_stats: true
|
||||
allowed_origins:
|
||||
- "*"
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: donetick
|
||||
namespace: donetick
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: donetick
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: donetick
|
||||
spec:
|
||||
containers:
|
||||
- name: donetick
|
||||
image: donetick/donetick
|
||||
ports:
|
||||
- containerPort: 2021
|
||||
name: http
|
||||
env:
|
||||
- name: DT_ENV
|
||||
value: "selfhosted"
|
||||
- name: DT_SQLITE_PATH
|
||||
value: "/data/donetick.db"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: data
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: donetick-config
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: donetick-data
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: donetick-tailscale
|
||||
namespace: donetick
|
||||
spec:
|
||||
ingressClassName: tailscale
|
||||
defaultBackend:
|
||||
service:
|
||||
name: donetick
|
||||
port:
|
||||
number: 2021
|
||||
tls:
|
||||
- hosts:
|
||||
- todo
|
||||
@@ -0,0 +1,9 @@
|
||||
namespace: donetick
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- configmap.yaml
|
||||
- pvc.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: donetick
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: donetick-data
|
||||
namespace: donetick
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: donetick
|
||||
namespace: donetick
|
||||
spec:
|
||||
selector:
|
||||
app: donetick
|
||||
ports:
|
||||
- name: http
|
||||
port: 2021
|
||||
targetPort: 2021
|
||||
protocol: TCP
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: gitea
|
||||
version: "12.7.0"
|
||||
version: "12.5.0"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitea-repository
|
||||
@@ -35,7 +35,7 @@ spec:
|
||||
storageClass: longhorn-default
|
||||
|
||||
image:
|
||||
tag: "1.27.1"
|
||||
tag: "1.25.4"
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
@@ -66,8 +66,8 @@ spec:
|
||||
APP_NAME: "Gitea: Greg's Cup of Git"
|
||||
RUN_MODE: dev
|
||||
server:
|
||||
DOMAIN: "shire-zebra.ts.net"
|
||||
ROOT_URL: "https://gitea.shire-zebra.ts.net"
|
||||
DOMAIN: "thehellings.com"
|
||||
ROOT_URL: "https://src.thehellings.com"
|
||||
SSH_PORT: "2222"
|
||||
database:
|
||||
DB_TYPE: postgres
|
||||
@@ -85,15 +85,13 @@ spec:
|
||||
DISABLE_REGISTRATION: "true"
|
||||
storage:
|
||||
STORAGE_TYPE: minio
|
||||
MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
|
||||
MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
|
||||
MINIO_BUCKET: gitea
|
||||
MINIO_LOCATION: garage
|
||||
MINIO_LOCATION: us-east-1
|
||||
# MINIO_ACCESS_KEY_ID: ""
|
||||
# MINIO_SECRET_ACCESS_KEY: ""
|
||||
MINIO_USE_SSL: "false"
|
||||
MINIO_INSECURE_SKIP_VERIFY: "true"
|
||||
security:
|
||||
ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com,*.thehellings.lan
|
||||
|
||||
metrics:
|
||||
enabled: false
|
||||
@@ -102,8 +100,8 @@ spec:
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
create: false
|
||||
claimName: gitea-new
|
||||
storageClass: longhorn-default
|
||||
size: "50Gi"
|
||||
|
||||
# I will manage my Postgres externally
|
||||
postgresql:
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: gitea-dump
|
||||
spec:
|
||||
schedule: "0 3 * * *"
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
volumes:
|
||||
- name: gitea-data
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-new
|
||||
- name: dump-staging
|
||||
emptyDir: {}
|
||||
initContainers:
|
||||
- name: gitea-dump
|
||||
image: "gitea/gitea:1.27.1"
|
||||
command:
|
||||
- /bin/sh
|
||||
- "-c"
|
||||
- |
|
||||
set -e
|
||||
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
|
||||
OUTFILE="/dump-staging/gitea-dump-${TIMESTAMP}.zip"
|
||||
gitea dump \
|
||||
--config /data/gitea/conf/app.ini \
|
||||
--file "${OUTFILE}" \
|
||||
--type zip
|
||||
echo "Dump written to ${OUTFILE}"
|
||||
volumeMounts:
|
||||
- name: gitea-data
|
||||
mountPath: /data
|
||||
readOnly: true
|
||||
- name: dump-staging
|
||||
mountPath: /dump-staging
|
||||
containers:
|
||||
- name: upload-to-s3
|
||||
image: "minio/mc:latest"
|
||||
command:
|
||||
- /bin/sh
|
||||
- "-c"
|
||||
- |
|
||||
set -e
|
||||
# Configure mc alias for MinIO
|
||||
mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
|
||||
"${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
|
||||
# Upload dump to backup-gitea bucket
|
||||
DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
|
||||
mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
|
||||
echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
|
||||
# Set 30-day lifecycle on the bucket (idempotent)
|
||||
mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
|
||||
volumeMounts:
|
||||
- name: dump-staging
|
||||
mountPath: /dump-staging
|
||||
readOnly: true
|
||||
env:
|
||||
- name: MC_CONFIG_DIR
|
||||
value: /tmp/.mc
|
||||
- name: MINIO_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-backup
|
||||
key: minio_key
|
||||
- name: MINIO_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-backup
|
||||
key: minio_secret
|
||||
@@ -12,20 +12,3 @@ spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- gitea
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-direct
|
||||
spec:
|
||||
rules:
|
||||
- host: git.k3s.thehellings.lan
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: gitea-release-http
|
||||
port:
|
||||
name: http
|
||||
|
||||
@@ -6,4 +6,3 @@ resources:
|
||||
- chart.yaml
|
||||
- ingress.yaml
|
||||
- secrets.yaml
|
||||
- dump-cronjob.yaml
|
||||
|
||||
@@ -1,32 +1,5 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-backup
|
||||
spec:
|
||||
target:
|
||||
name: gitea-backup
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
minio_key: "{{ .minio_key }}"
|
||||
minio_secret: "{{ .minio_secret }}"
|
||||
secretStoreRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
data:
|
||||
# MinIO credentials
|
||||
- secretKey: minio_key
|
||||
remoteRef:
|
||||
key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
|
||||
property: username
|
||||
- secretKey: minio_secret
|
||||
remoteRef:
|
||||
key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
|
||||
property: password
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-config
|
||||
spec:
|
||||
@@ -40,22 +13,20 @@ spec:
|
||||
USER={{ .dbuser }}
|
||||
PASSWD="""{{ .dbpass }}"""
|
||||
storage: |-
|
||||
MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
|
||||
MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
|
||||
#minio_key: "{{ .minio_nas1_key }}"
|
||||
#minio_secret: "{{ .minio_nas1_secret }}"
|
||||
MINIO_ACCESS_KEY_ID={{ .minio_key }}
|
||||
MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
|
||||
secretStoreRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
data:
|
||||
# MinIO credentials for NAS1
|
||||
- secretKey: minio_nas1_key
|
||||
# MinIO credentials
|
||||
- secretKey: minio_key
|
||||
remoteRef:
|
||||
key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
|
||||
key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
|
||||
property: username
|
||||
- secretKey: minio_nas1_secret
|
||||
- secretKey: minio_secret
|
||||
remoteRef:
|
||||
key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
|
||||
key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
|
||||
property: password
|
||||
# Postgres credentials
|
||||
- secretKey: dbuser
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
spec:
|
||||
interval: "24h"
|
||||
url: https://charts.gitlab.io
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
spec:
|
||||
interval: 10m
|
||||
chart:
|
||||
spec:
|
||||
chart: gitlab-runner
|
||||
version: "0.83.1"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-runner
|
||||
interval: "1h"
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
namespace: external-secrets
|
||||
- name: tailscae
|
||||
namespace: tailscale
|
||||
values:
|
||||
crds:
|
||||
create: true
|
||||
includeCRDs: true
|
||||
gitlabUrl: https://src.thehellings.com
|
||||
runners:
|
||||
secret: gitlab-runner
|
||||
imagePullSecrets:
|
||||
- name: image-pull-secrets
|
||||
rbac:
|
||||
create: true
|
||||
serviceAccount:
|
||||
create: true
|
||||
metrics:
|
||||
enabled: true
|
||||
extraEnv:
|
||||
CACHE_TYPE: s3
|
||||
CACHE_SHARED: "true"
|
||||
CACHE_S3_BUCKET_NAME: gitlab-runner-cache
|
||||
CACHE_S3_INSECURE: "true"
|
||||
extraEnvFrom:
|
||||
PACKER_GITHUB_API_TOKEN:
|
||||
secretKeyRef:
|
||||
name: gitlab-runner
|
||||
key: PACKER_GITHUB_API_TOKEN
|
||||
CACHE_S3_SERVER_ADDRESS:
|
||||
secretKeyRef:
|
||||
name: gitlab-runner
|
||||
key: CACHE_S3_SERVER_ADDRESS
|
||||
CACHE_S3_ACCESS_KEY:
|
||||
secretKeyRef:
|
||||
name: s3-access
|
||||
key: username
|
||||
CACHE_S3_SECRET_KEY:
|
||||
secretKeyRef:
|
||||
name: s3-access
|
||||
key: password
|
||||
@@ -0,0 +1,6 @@
|
||||
namespace: gitlab-runner
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- secrets.yaml
|
||||
- chart.yaml
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
@@ -0,0 +1,101 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: gitlab-runner
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: bitwarden-fields
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: gitlab-runner
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
runner-registration-token: ""
|
||||
runner-token: "{{ .runnerToken }}"
|
||||
PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
|
||||
CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
|
||||
data:
|
||||
- secretKey: runnerToken
|
||||
remoteRef:
|
||||
key: &key 53719920-b100-4355-8c80-b2f9002fad22
|
||||
property: CI_SERVER_TOKEN
|
||||
- secretKey: PACKER_GITHUB_API_TOKEN
|
||||
remoteRef:
|
||||
key: *key
|
||||
property: PACKER_GITHUB_API_TOKEN
|
||||
- secretKey: CACHE_S3_SERVER_ADDRESS
|
||||
remoteRef:
|
||||
key: *key
|
||||
property: CACHE_S3_SERVER_ADDRESS
|
||||
# Includes
|
||||
# CI_SERVER_TOKEN
|
||||
# PACKER_GITHUB_API_TOKEN
|
||||
# CACHE_S3_SERVER_ADDRESS
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: s3-access
|
||||
namespace: gitlab-runner
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: s3-access
|
||||
deletionPolicy: Delete
|
||||
data:
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: *key
|
||||
property: password
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: image-pull-secrets
|
||||
namespace: gitlab-runner
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
.dockerconfigjson: >-
|
||||
{
|
||||
"auths": {
|
||||
"https://index.docker.io/v1/": {
|
||||
"username": "{{ .user }}",
|
||||
"password": "{{ .password }}",
|
||||
"email": "greg.hellings@gmail.com",
|
||||
"auth": "{{ .auth }}"
|
||||
}
|
||||
}
|
||||
}
|
||||
data:
|
||||
- secretKey: user
|
||||
remoteRef:
|
||||
key: &key f560ae38-368c-4e58-898c-aeb90012d597
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: *key
|
||||
property: password
|
||||
- secretKey: auth
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: bitwarden-fields
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: *key
|
||||
property: auth
|
||||
@@ -1,36 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: external-secrets
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
spec:
|
||||
interval: "24h"
|
||||
url: "https://charts.external-secrets.io/"
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
spec:
|
||||
interval: 10m
|
||||
chart:
|
||||
spec:
|
||||
chart: external-secrets
|
||||
version: "2.3.0"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: external-secrets
|
||||
interval: "1h"
|
||||
values:
|
||||
crds:
|
||||
create: true
|
||||
includeCRDs: true
|
||||
webhook:
|
||||
certManager:
|
||||
enable: true
|
||||
@@ -1,6 +1,3 @@
|
||||
resources:
|
||||
- kyverno.yaml
|
||||
- external-secrets.yaml
|
||||
- tailscale.yaml
|
||||
- longhorn.yaml # Needed for storage
|
||||
- traefik.yaml
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kyverno-system
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: kyverno
|
||||
namespace: kyverno-system
|
||||
spec:
|
||||
interval: "24h"
|
||||
url: "https://kyverno.github.io/kyverno/"
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kyverno
|
||||
namespace: kyverno-system
|
||||
spec:
|
||||
interval: 10m
|
||||
chart:
|
||||
spec:
|
||||
chart: kyverno
|
||||
version: "3.7.1"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: kyverno
|
||||
interval: "1h"
|
||||
values:
|
||||
admissionController:
|
||||
replicas: 3
|
||||
backgroundController:
|
||||
replicas: 3
|
||||
cleanupController:
|
||||
replicas: 2
|
||||
reportsController:
|
||||
replicas: 2
|
||||
crds:
|
||||
install: true
|
||||
@@ -19,15 +19,10 @@ metadata:
|
||||
namespace: longhorn-system
|
||||
spec:
|
||||
interval: 10m
|
||||
dependsOn:
|
||||
- name: tailscale
|
||||
namespace: tailscale
|
||||
- name: kyverno
|
||||
namespace: kyverno-system
|
||||
chart:
|
||||
spec:
|
||||
chart: longhorn
|
||||
version: "1.11.3"
|
||||
version: "1.10.2"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: longhorn
|
||||
@@ -141,10 +136,6 @@ spec:
|
||||
number: 80
|
||||
- <<: *host
|
||||
host: longhorn.kubernetes
|
||||
- <<: *host
|
||||
host: longhorn.k3s.nebula.thehellings.com
|
||||
- <<: *host
|
||||
host: longhorn.k3s.thehellings.lan
|
||||
---
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user