diff --git a/config/hosts/forgejo-actions-runner/configuration.nix b/config/hosts/forgejo-actions-runner/configuration.nix new file mode 100644 index 0000000..d2a52da --- /dev/null +++ b/config/hosts/forgejo-actions-runner/configuration.nix @@ -0,0 +1,7 @@ +{ config, pkgs, ... }: + +{ + networking.hostName = "forgejo-actions-runner"; + + system.stateVersion = "23.11"; +} diff --git a/config/hosts/forgejo-actions-runner/default.nix b/config/hosts/forgejo-actions-runner/default.nix new file mode 100644 index 0000000..f5a8ddd --- /dev/null +++ b/config/hosts/forgejo-actions-runner/default.nix @@ -0,0 +1,11 @@ +{ ... }: + +{ + imports = [ + ./configuration.nix + ./docker.nix + ./forgejo-actions-runner.nix + ./networking.nix + ./sops.nix + ]; +} diff --git a/config/hosts/forgejo-actions-runner/docker.nix b/config/hosts/forgejo-actions-runner/docker.nix new file mode 100644 index 0000000..b626e9f --- /dev/null +++ b/config/hosts/forgejo-actions-runner/docker.nix @@ -0,0 +1,13 @@ +# Sources for this configuration: +# - https://nixos.wiki/wiki/Docker +{ config, pkgs, ... }: + +{ + virtualisation.docker = { + enable = true; + autoPrune = { + enable = true; + dates = "weekly"; + }; + }; +} diff --git a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix b/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix new file mode 100644 index 0000000..d5a93c1 --- /dev/null +++ b/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix @@ -0,0 +1,60 @@ +# Sources for this configuration: +# - https://forgejo.org/docs/latest/admin/actions/ +# - https://forgejo.org/docs/latest/user/actions/ +# - https://docs.gitea.com/next/usage/actions/act-runner + +{ config, pkgs, ... }: + +{ + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.ccchh-forgejo-global-docker = { + enable = true; + name = "Global Docker Forgejo Actions Runner"; + url = "https://git.hamburg.ccc.de/"; + tokenFile = "/run/secrets/forgejo_actions_runner_registration_token"; + labels = [ "docker:docker://node:current-bookworm" ]; + settings = { + cache = { + proxy_port = 45540; + }; + runner = { + capacity = 4; + }; + }; + }; + + instances.ccchh-codeberg-org-diday = { + enable = true; + name = "ccchh runner for codeberg.org/di-day"; + url = "https://codeberg.org/"; + tokenFile = "/run/secrets/codeberg_org_diday_runner_registration_token"; + labels = [ + "docker:docker://node:current-bookworm" + "debian-latest:docker://node:current-bookworm" + "alpine-latest:docker://node:current-alpine" + ]; + settings = { + cache = { + proxy_port = 45541; + }; + runner = { + capacity = 4; + }; + }; + }; + }; + + sops.secrets."forgejo_actions_runner_registration_token" = { + mode = "0440"; + owner = "root"; + group = "root"; + restartUnits = [ "gitea-runner-ccchh\\x2dforgejo\\x2dglobal\\x2ddocker.service" ]; + }; + sops.secrets."codeberg_org_diday_runner_registration_token" = { + mode = "0440"; + owner = "root"; + group = "root"; + restartUnits = [ "gitea-runner-ccchh\\x2dcodeberg\\x2dorg\\x2ddiday.service" ]; + }; +} diff --git a/config/hosts/forgejo-actions-runner/networking.nix b/config/hosts/forgejo-actions-runner/networking.nix new file mode 100644 index 0000000..71aa47a --- /dev/null +++ b/config/hosts/forgejo-actions-runner/networking.nix @@ -0,0 +1,27 @@ +{ lib, config, ... }: +let + runnerInstances = lib.attrValues config.services.gitea-actions-runner.instances; + runnerCachePorts = lib.map (i: i.settings.cache.proxy_port) runnerInstances; +in { + networking = { + interfaces.net0 = { + ipv4.addresses = [ + { + address = "172.31.17.155"; + prefixLength = 25; + } + ]; + }; + defaultGateway = "172.31.17.129"; + nameservers = [ "212.12.50.158" "192.76.134.90" ]; + search = [ "hamburg.ccc.de" ]; + }; + + systemd.network.links."10-net0" = { + matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE"; + linkConfig.Name = "net0"; + }; + + # open ports for runner cache proxy so that we can use the cache action + networking.firewall.allowedTCPPorts = runnerCachePorts; +} diff --git a/config/hosts/forgejo-actions-runner/secrets.yaml b/config/hosts/forgejo-actions-runner/secrets.yaml new file mode 100644 index 0000000..79df4d5 --- /dev/null +++ b/config/hosts/forgejo-actions-runner/secrets.yaml @@ -0,0 +1,149 @@ +forgejo_actions_runner_registration_token: ENC[AES256_GCM,data:gAR2ffrffeuuaOwO6mWcif2e6csKIVoLqrux19iBlrTkFHgo/IlHVL0eSUGqnw==,iv:i12yx/quwT9kj6fPECszo/iG9cVhKX+7dAA6/N09URc=,tag:eO+mWhumgvWzQxYqiRUXbA==,type:str] +codeberg_org_diday_runner_registration_token: ENC[AES256_GCM,data:thTsLo/eXVPbXt4b8ldae+kGnOR4GbYKOqr1hVJgaL7wZ5GgqWSPcOuhow96Jw==,iv:Fzi+DsKj+4PrwQGEosUntm9l7s78NwzhkmF6e/sfF+s=,tag:oa7mnbGR0J5xi9ruCgRJtQ==,type:str] +sops: + age: + - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZEpMZkt6OU5nMEtYcHc0 + OGdsVDZBcE5nK2ZLbDhaWEVMM2lJcllLVnlzCmNUTXpaVHBLMjlILzJwdDFLMVky + ZXdEVmE3aTFMZDJnQ2tqWGRMb1NnZUkKLS0tIDhGWGpoYWNtL24wRnVRejQ5ZkVN + YjZFMTh3OTNkOUE0SmZTQXpKSmdGWlEK+Xb6blAdiWoKvffLEQagu5tFpWALJaXm + F65M+RNNkJ/YsSJGAWFJepw3ncCMFbmQgGXw5XnyqTlYFhrQ8x5qJg== + -----END AGE ENCRYPTED FILE----- + - recipient: age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQblJIdFAwOFRqbWEvQzVF + ODVpQ04xTVpxTERGU3BOMjV4KytBU21neEYwCmoraHhlNjhDelAzR0VxcVNlekhT + QkI5ckd1dVFjMHBoTVFTQjlzbTdnTzgKLS0tIGlTY1p0bWxrQWoyM0RwSmx1aDhy + TklLZWM0cDBKaGJJM2tQQWRLZXhFYU0Ko7cyvzMvwlGCCP3UAX1+5uTI4srhZ5l9 + DPaHySiC+rLy+8R9UqEuTKbP4/Aw4NZ/UcfjNnVkqqqNJIODmLoOhg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-02-18T09:51:37Z" + mac: ENC[AES256_GCM,data:4fWsE3U6WxRqlKHKC4ipE+RQ7MPjiZZcTFMSblxty7JjJHAdKUHbthFB+R8gIWxZEjX5WG+IPgUP+AcCLSI9fdcXMqIFMuDun2hiktwqxzLPGYAoCXdTBAd1uCUagvB/rFty6y8umD4J5ITgEGba9pvGdUcng9WVRV+LGDftS1g=,iv:tD9tlcylQWapNCARxPXrKofZXf2BHTt2c4PQqFNj6X8=,tag:pQ8lOqJEFCcCcJot3BYTmQ==,type:str] + pgp: + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJAQ/7BFboCbCEG1DY5Twf+1cRSAmXs8CSrnoJcmyxrF9daqTB + GAqItZcym6I7YbtYMb33jTZDAMFcexvJ+V7+WVBK/v/TISzinJ3m5BafE0DrgsB5 + HQT8tsFzxIdu/KsUp0C5VQg6gsb2u2T7aFG0wTS4vas2FjcsoJRKNWTv7a1sNWYZ + dFRxeyklWEX14kCHeKIxO7+Qe3NVV+6MuwYR8X3YJaAyLtVMIdBp/poE+7Gcsa58 + rOewheWW/FROTxLZIk3sren6z7M0ZrOz5res2evRDMI9noN3pYMnkNCL/XIvRf9U + GqFSruzDoC0a2JcEvSmthSmEHA6wXeOY/EuzXKLoW4luZDsSXshFgBxK0qqGvzbd + jIXXYvBWPCMYWRMSqQenLkjfhOQXuSXcywGfKpuQblUL8RiflIqia2o68Vbd9Hq4 + x9Od+qkauMHZUzsKQoym9pkbrEWpjckg6FevZ1W4o5Qhe9i+JMmE2KIvoYH8tK9F + 5KQ87jktx4i9df9TJy3n/xbbrWXpo76y5Aoa2LaiD9Nc6lo7sFs3Pegq4wKmYSIh + 6uaZxa5sto/5kywHrJQGqEyh/fDdNmsh5FlDW7gfFEm9Ti2KSE3m9IvIwppFD4j0 + xFkHiwHvNn/WMLciVh9qG8auGyxjoXnRRx61QHF31RIYprxWgDoyH/rVz95IuxzS + XgEIJk7MnHv9tYCy/lOjbgqLAUGO0+xuO+IfmsvtiD4nfrnaEJAh0+SW3wuCKzaF + tx1ZHCYH9j3s50Q624pUgtzDad5QV5IIEgCRyr0NvEvrXvG6U0aXkOEbOcFSZsk= + =v3FY + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAw5vwmoEJHQ1AQ/9H+Kn4rF7yUsIdTp5rYhG6EkYkJ/jCeUBJvaOuA95b8HM + 6csTXj+ttVcFvbU1hQVbOsd7J8Wpmuj/TqMrpFvu/0EYUW5n04y1YI8kpNXDMrFF + X/0gk+I+w2eF2X3gJQasVY39DNx56KSRJ0BwGYw287rdeKh8cbiFw64r0rs6zX5j + 2nqrWgSqxXtWcjhC7Y4Rq8ysWv7dEF2E9Tt2cHYVjn5cs9Vb52PWUA0TxzBzUUqa + M1YWat3fwLah6qEs6/9c89LB66SbgH088lEzQHtRIXdOZ9tPOu7/E3iNqYExuIKB + eMV0bdW0/tZlnWxAwXrL4rptxjGDqB+Ynv36IeLKZ86ljqSPqaQA7ihCVXnMo2TW + IfdlbOtAJiE3IliQf8C1Ajyn32epePBAUyw8o0k2D6UyNyvk8fe0z9++H6Uz+Z7G + oLRrxzOHjh6oWK9WBwJQhZ9dnb1n1UYZfvCDwFZBTmUkhIs6UQllIiF5ZjMy4/cc + E3FEouu/6VPPjq9d8pGEFcjOvXkLtUErhXP+A8Xvl/fHmtfM0/o1e6gPnMmxGn4k + 0yXvU+pNO/ID6fc6qMs0nBZRAKGraaeH+wTjpm1exUhhNB2yJviySnElJFyq9vtr + AfacrbuW//JQ+19rSKViV9xStRG//xfW7EpknOh3juB7WfnyOXqdfZqT2zQwrvjS + XgEoHXmbR7aiDvBCc4CGTmBhWD4An+p3m3m7iSOp27kBqJ3+YSKdVA7mdIo0tpTn + 9p5Pgz6GHBA5eMwZCb/z3Y7+20PuuEb4/tEBAniw9/Rp0sDJ+9C+V1SdHtbYq8k= + =kkQW + -----END PGP MESSAGE----- + fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAdgME/v0CVfcRZ1zr9SRZksN7vDHDk63g+5k5a/FOvmow + 0l/6kH1l7p4aOKaAGFbMHzDzljuACB1a4IOJypRA2DokYWRUgqBKwvcHplgXr4l0 + 0l4B2vxPl9W1kcbAg4m+V4PlvXTBGhPUglljtjWy80TisUL1zCXpl3PEvmrypZs7 + NM47K09RsDiicwTKjxd0Oii2Evz8riLFIth8IWOKXPHoKhiYwN891g1qLSvsrDzE + =6B/b + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fARAAjz8RObyKYVAmNwiBsNVNGt0qSIexSYpsMR5SyuBMKShJ + NSD4yA6B7Tj+h/ik4VyggOT+9Qfr7zFvFyEHYFXI7k/r+Noyw4uscqr9gNnz0t9N + rx4/ZNowsW/3dL+Gab3hjDKObHF41Y1lzojNwcieU8qZmssHZMjIIzyAUePL210f + 2i87hix9PkK6kKuisORDShnFifEOEPOcijXFL4kH9DilVoZ0Ut5fJoiA+QkQQpaa + uHd+Q7F6u9jZrzRLN1SJkb76ElxQAvJYcgTN2s3+c4002DkKVdwCW0qyPlF9wOxT + xTngl46NyZ1MH3ByW2xeOgaDYUcBt8qUF4gTMmIaDTIZ+K5XWGu3hmCzNZHD5Nxi + bhVKJ8jGENUhM/IfT8CjppRIg5wwU0K/EQE/QQHhIykpz9NaIjikDCxcraBa9DkA + rgjp74W9vgR3pBwXJIAsylOZZHy+35rca/JvWWxm2tdeao2WxTA9jdsNdsUOhNyz + 3xQGGM63ZSUcV0ZgCyhEYeKBzCyRWpFX+GQHboZDp7IaYK68qYZgxnQtoSwl3lJR + Qc1IaADnncIDyGEIDTciLbjbDx7TId4wrpRWUPxVY2FVY+hV+oRNaoYMuT2jiDVw + PimQ5iVUhl/ThHWPLqok6d3ypROZtVS6EUFzd4ASUrYRYB5Twvoujr7Yg7jSZV/S + XgFcxQ31/i/Vi9owjwX7u0/eclU/3XE2/MqUCcoMntnq2dCN/IpF3rROit5Tzs+W + BT7i57cpGh9ZXf1dbNSyRwydp/C8tjnwDqf3RJ5hj4fmlK6zLJqtPFPdusOO4SU= + =z1tc + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA1Hthzn+T1OoAQ/+K1+QTZ8N3Ha0nErrRWClBu5Cxec5/eb2Q/n4dfNGkrxx + xBk0thoGAyoYpifSqhXbVi/MA8+tzHdtPlKJFCn5NETrnEdu84+sJQE4zfDljLiX + fXZZ/+YQ0P3VosR2NI3W1r/hJWs4oJ9oPz4FfMlfPK+/UOOdQEtGkx9rjYaus9Ax + VI6s5qvYM6XD5rkLxTqZZhEa+CjLtSjD5WqNbCT/8fX5ErnU06jW6jXvRNQSq1Mt + hpqMIBygUE39K2apEuphE9RRD3bS1M2VjCB882yVSM2QZyepilRBjS5ryyQhKK/9 + Q0mdIw9mxhdgaCzoglN2k1c6WjddZ409osdnYcMtsH4+NlHDtNfSFLIk6JrxAXIQ + bNR8gtr4D85LoQki/RvEweUd4M40DneIO1dTK4/WG71Lcle3B6p0ynDMjmXq1coY + Qn0c4KAh1RIX/eEJGS23Wle/XZbp89yaFFEF667+HmwL0CY6I5pcVEn/iuXLoNHI + 93y/9h7mhB8ZGICPbF7nXBfQQTrxjfc9vZq0PVdjlXPIMRjZcbZOzlKByYLsQIW0 + UtzLScfFyKsogcUGJIlGrcQyAmLb3dr7i1elVWlanggCXdKnecBRbSkEfK7SmwiN + t8hRaaM06P3kRbTHWxt+4sjTQWofo+C76qsMZYHFpI0TTOP/jwnn/h3E9dQxdaHS + XgHzVEsJkQiQ51w7pPP1LcKkCxQv1KA9QC+LAFGhmWXnQ1m8E3whao2S07UjlTVw + XMAtuOVT2r09dYGgpcEaMiK2Hb9UNg/ma9o29fSm+2rLuxw3qSldgNNx/s8hyzc= + =0kev + -----END PGP MESSAGE----- + fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqAQ//ZYw2qRn+YhiEoBpbUsW95NJpZJFizwssh1dC/Lda5qFs + 55G1Jls9FHHQ+LmRnE6wyx26bbpQ257FNzCsxsfwAuiznx31j1yHc6LZbuJ3+DsJ + slRaad13RdLyGgo2psaXbBMEgr22FAFDm+S98aYnyv8yvtOZvutEljGm9yhHLGKy + XnFf8LwvvqdT4RolfxiPncGsd9hbFYZh7/zcJTSzfYSnHI30Ly5Na74vSaamuIwR + oPnSxlf8jIX5RUzssjyOHGLQLd327fKuveVxX9CUK/PGWLgQYuTL5PWZwQGhzgSY + E+2EerpGLVJzSQB0TUU5xGwOQkDlPveSSUg0IoDlivMnrphWUFd+bcIMbipVXolf + qpiJeO1t0YW1WAQBzkQ3J+uXgX0dJqWfzfMsbn3j4/WZq5ZlEX6x+ovHv6Z7ZXTz + 6lcF6Gn0dH/omhkqduK3bLwBWAkmh7gWNssEXdPQWGWA8j3WM+IPZKIegpecflKN + pv7jOyD95othMUul/iiH/E3aSbCggN5maoZHG2Cp1TGXkGOLFCNs143LGTVligOU + yD8n0uAQ8e50J7YwytSi2g0pzFkZyriLmrZqKFt9UUOfANivrO9p8J0Bo9wEHjY0 + OdKKu8ASgjYk0t4VHGeZF3GPSaGE/k7LaUb9+5t02sxypxeVqQXpvjU/D8c/0wPS + XgGQs2bjszJIyRwcTmUHD8YAvuxf0MkyKCKpJSsnbJ4XmgkI+gGQpg0GLQROXjZ4 + 8GqLzKb+3d3QDUPQmh+z5Ur1nFcVS214wycICWSTsIUyam59+4rVxV1i33DcAs4= + =BJfi + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-02-17T22:21:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdA7rerN+IVKpzyAdXVuAN19+CIjQ6DnHatGr92/YhAEiQw + J913tdR+Yb/FdPWQrn0NR2eTUuKm/Es0NRvJY/YEnhQble+3qYvxFP6dI+vm1cmz + 0l4BNxMhGqyOmsDFf58yrJmrHdnapBOmiqCkJBTc9gAQH534di0Ps+grV04jzkXW + DUO/sIPANPpvqqCJNt1uekKNH2J57OMaagnBTivMBTq0HAuRN1RhcrjGof9ttCj1 + =desh + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + unencrypted_suffix: _unencrypted + version: 3.11.0 diff --git a/config/hosts/forgejo-actions-runner/sops.nix b/config/hosts/forgejo-actions-runner/sops.nix new file mode 100644 index 0000000..b4548ed --- /dev/null +++ b/config/hosts/forgejo-actions-runner/sops.nix @@ -0,0 +1,7 @@ +{ ... }: + +{ + sops = { + defaultSopsFile = ./secrets.yaml; + }; +} diff --git a/config/hosts/public-web-static/configuration.nix b/config/hosts/public-web-static/configuration.nix index a8e5f29..9e2aebc 100644 --- a/config/hosts/public-web-static/configuration.nix +++ b/config/hosts/public-web-static/configuration.nix @@ -1,10 +1,7 @@ { ... }: { - networking = { - hostName = "public-web-static"; - domain = "hosts.hamburg.ccc.de"; - }; + networking.hostName = "public-web-static"; system.stateVersion = "23.05"; } diff --git a/config/hosts/public-web-static/networking.nix b/config/hosts/public-web-static/networking.nix index 2758338..cb22d40 100644 --- a/config/hosts/public-web-static/networking.nix +++ b/config/hosts/public-web-static/networking.nix @@ -3,14 +3,14 @@ { networking = { interfaces.net0 = { - ipv6.addresses = [ + ipv4.addresses = [ { - address = "2a00:14b0:42:102::17"; - prefixLength = 64; + address = "172.31.17.151"; + prefixLength = 25; } ]; }; - defaultGateway6 = "2a00:14b0:42:102::1"; + defaultGateway = "172.31.17.129"; nameservers = [ "212.12.50.158" "192.76.134.90" ]; search = [ "hamburg.ccc.de" ]; }; diff --git a/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix index edeca47..a28f77c 100644 --- a/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/branding-resources.hamburg.ccc.de.nix @@ -14,10 +14,6 @@ in serverName = "branding-resources.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -30,12 +26,6 @@ in useACMEHost = "branding-resources.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/c3cat.de.nix b/config/hosts/public-web-static/virtualHosts/c3cat.de.nix index 54b7462..95f9b59 100644 --- a/config/hosts/public-web-static/virtualHosts/c3cat.de.nix +++ b/config/hosts/public-web-static/virtualHosts/c3cat.de.nix @@ -16,10 +16,6 @@ in { ]; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -32,12 +28,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -71,12 +61,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/c3dog.de.nix b/config/hosts/public-web-static/virtualHosts/c3dog.de.nix index dcca75a..3589418 100644 --- a/config/hosts/public-web-static/virtualHosts/c3dog.de.nix +++ b/config/hosts/public-web-static/virtualHosts/c3dog.de.nix @@ -3,7 +3,7 @@ let domain = "c3dog.de"; dataDir = "/var/www/${domain}"; - deployUser = "c3dog-website-deploy"; + deployUser = "c3cat-website-deploy"; in { security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ]; @@ -16,10 +16,6 @@ in { ]; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -32,12 +28,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -67,12 +57,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -99,13 +83,4 @@ in { systemd.tmpfiles.rules = [ "d ${dataDir} 0755 ${deployUser} ${deployUser}" ]; - - users.users."${deployUser}" = { - isNormalUser = true; - group = "${deployUser}"; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB7iXsVArl4SbDczb4U3zGkZCiVO/lfn12gkOEOnKmEX deploy key for c3dog.de" - ]; - }; - users.groups."${deployUser}" = { }; } diff --git a/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix index 79f6fb4..d2e779a 100644 --- a/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/cpu.ccc.de.nix @@ -17,10 +17,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -34,12 +30,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -91,20 +81,12 @@ in "local.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://cpu.ccc.de"; diff --git a/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix b/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix index 59934eb..37d95b9 100644 --- a/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix +++ b/config/hosts/public-web-static/virtualHosts/cryptoparty-hamburg.de.nix @@ -16,10 +16,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -32,12 +28,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -65,12 +55,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index 61008d2..dfac565 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -13,20 +13,16 @@ ./hacker.tours.nix ./hackertours.hamburg.ccc.de.nix ./hamburg.ccc.de.nix - ./infra-docs.hamburg.ccc.de.nix ./spaceapi.hamburg.ccc.de.nix ./staging.c3cat.de.nix - ./staging.c3dog.de.nix ./staging.cryptoparty-hamburg.de.nix ./staging.docs.c3voc.de.nix ./staging.hacker.tours.nix ./staging.hackertours.hamburg.ccc.de.nix ./staging.hamburg.ccc.de.nix - ./staging.infra-docs.hamburg.ccc.de.nix ./www.hamburg.ccc.de.nix ./diday.org.nix ./staging.diday.org.nix ./historic-easterhegg - ./ueberwachungsfrei-kundgebung.nix ]; } diff --git a/config/hosts/public-web-static/virtualHosts/diday.org.nix b/config/hosts/public-web-static/virtualHosts/diday.org.nix index 3aff479..547c797 100644 --- a/config/hosts/public-web-static/virtualHosts/diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/diday.org.nix @@ -6,16 +6,16 @@ let deployUser = "diday-website-deploy"; in { + security.acme.certs."${domain}".extraDomainNames = [ + "did.hamburg.ccc.de" + ]; + services.nginx.virtualHosts = { "acme-${domain}" = { enableACME = true; serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -23,17 +23,33 @@ in ]; }; + "did.hamburg.ccc.de" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + basicAuth = { + "preview" = "liebe"; + }; + + extraConfig = '' + return 301 https://diday.org; + ''; + }; + "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -42,6 +58,10 @@ in } ]; + basicAuth = { + "preview" = "liebe"; + }; + root = "${dataDir}"; extraConfig = '' diff --git a/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix b/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix index 956baf4..a91edc1 100644 --- a/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/docs.c3voc.de.nix @@ -11,10 +11,6 @@ in { serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -27,12 +23,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -52,8 +42,6 @@ in { # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; - - port_in_redirect off; ''; }; }; diff --git a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix index 8ee4336..670b191 100644 --- a/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element-admin.hamburg.ccc.de.nix @@ -1,14 +1,14 @@ { config, pkgs, ... }: let - elementAdminVersion = "0.1.11"; + elementAdminVersion = "0.1.10"; elementAdmin = pkgs.stdenv.mkDerivation (finalAttrs: { pname = "element-admin"; version = elementAdminVersion; src = pkgs.fetchzip { url = "https://github.com/element-hq/element-admin/archive/refs/tags/v${elementAdminVersion}.zip"; - sha256 = "sha256-tSUTDPspQJjvP1KN4nUr4LYyjNQFj4pKMMA8JmavIxo="; + sha256 = "sha256-dh7tmzAaTfKB9FuOVhLHpOIsTZK1qMvNq16HeObHOqI="; }; nativeBuildInputs = [ @@ -19,7 +19,7 @@ let pnpmDeps = pkgs.pnpm.fetchDeps { inherit (finalAttrs) pname version src; fetcherVersion = 2; - hash = "sha256-Hf4PWey5bczSNbc3QQ9z9X3OVUZ7VHXw7BHGQqJWPac="; + hash = "sha256-S/MdfUv6q+PaAKWYHxVY80BcpL81dOfpPVhNxEPQVE4="; }; buildPhase = '' @@ -40,10 +40,6 @@ in serverName = "element-admin.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -56,12 +52,6 @@ in useACMEHost = "element-admin.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix index f781dc0..360fb76 100644 --- a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix @@ -1,10 +1,10 @@ { pkgs, ... }: let - elementWebVersion = "1.12.18"; + elementWebVersion = "1.12.0"; element-web = pkgs.fetchzip { url = "https://github.com/element-hq/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz"; - sha256 = "sha256-RvPJg28hgOgFs0GFZ9EPypQkUPkAns0alXYJeNst4Bk="; + sha256 = "sha256-2kXQFUhLYyEKuXYw+n94JGlTN2VJHRpjmu78u8gdaro="; }; elementSecurityHeaders = '' # Configuration best practices @@ -24,10 +24,6 @@ in serverName = "element.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -40,12 +36,6 @@ in useACMEHost = "element.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/hacker.tours.nix b/config/hosts/public-web-static/virtualHosts/hacker.tours.nix index dd6fc90..20bb644 100644 --- a/config/hosts/public-web-static/virtualHosts/hacker.tours.nix +++ b/config/hosts/public-web-static/virtualHosts/hacker.tours.nix @@ -12,10 +12,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -26,18 +22,12 @@ in "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; - + locations."/shop" = { return = "302 https://tickets.hamburg.ccc.de"; }; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix index 269aa92..eeb7778 100644 --- a/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix @@ -12,10 +12,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -28,12 +24,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix index 8b2177c..1c967c9 100644 --- a/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/hamburg.ccc.de.nix @@ -7,10 +7,6 @@ serverName = "hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -24,12 +20,6 @@ default = true; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -99,14 +89,6 @@ return = "302 https://cloud.hamburg.ccc.de/apps/calendar/embed/QJAdExziSnNJEz5g"; }; - # Redirects for blog post edits. - locations."/blog/2026/05/23/der-ccchh-sagt-nein-zu-olympia-in-hamburg" = { - return = "302 https://hamburg.ccc.de/blog/2026/05/31/der-ccchh-sagt-nein-zu-olympia-in-hamburg/"; - }; - locations."/blog/2026/05/23/der-ccchh-sagt-nein-zu-olympia-in-hamburg/" = { - return = "302 https://hamburg.ccc.de/blog/2026/05/31/der-ccchh-sagt-nein-zu-olympia-in-hamburg/"; - }; - extraConfig = '' # Make use of the ngx_http_realip_module to set the $remote_addr and # $remote_port to the client address and client port, when using proxy diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix index bb8bd6e..2c5dd86 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix @@ -25,16 +25,10 @@ in "easterhegg2003.hamburg.ccc.de" "www.easterhegg2003.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 31820; + }]; }; "easterhegg2003.hamburg.ccc.de" = { @@ -46,20 +40,12 @@ in "www.easterhegg2003.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://eh03.easterhegg.eu"; @@ -79,26 +65,18 @@ in forceSSL = true; useACMEHost = "eh03.easterhegg.eu"; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/" = { index = "index.html"; root = eh03; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix index a6b6f80..37cb893 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix @@ -25,16 +25,10 @@ in "easterhegg2005.hamburg.ccc.de" "www.easterhegg2005.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 31820; + }]; }; "easterhegg2005.hamburg.ccc.de" = { @@ -46,20 +40,12 @@ in "www.easterhegg2005.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://eh05.easterhegg.eu"; @@ -79,26 +65,18 @@ in forceSSL = true; useACMEHost = "eh05.easterhegg.eu"; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/" = { index = "index.shtml"; root = eh05; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix index 80a404b..ebfa712 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix @@ -29,16 +29,10 @@ in "easterhegg2007.hamburg.ccc.de" "www.easterhegg2007.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 31820; + }]; }; "easterhegg2007.hamburg.ccc.de" = { @@ -52,20 +46,12 @@ in "www.easterhegg2007.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://eh07.easterhegg.eu"; @@ -85,26 +71,18 @@ in forceSSL = true; useACMEHost = "eh07.easterhegg.eu"; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/" = { index = "index.shtml"; root = eh07; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix index f2720f4..ea274af 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix @@ -29,16 +29,10 @@ in "easterhegg2009.hamburg.ccc.de" "www.easterhegg2009.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 31820; + }]; }; "easterhegg2009.hamburg.ccc.de" = { @@ -52,20 +46,12 @@ in "www.easterhegg2009.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://eh09.easterhegg.eu"; @@ -85,26 +71,18 @@ in forceSSL = true; useACMEHost = "eh09.easterhegg.eu"; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/" = { index = "index.shtml"; root = eh09; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix index e44d0f5..39d7fad 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix @@ -29,16 +29,10 @@ in "easterhegg2011.hamburg.ccc.de" "www.easterhegg2011.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 31820; + }]; }; "easterhegg2011.hamburg.ccc.de" = { @@ -52,20 +46,12 @@ in "www.easterhegg2011.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://eh11.easterhegg.eu"; @@ -85,26 +71,18 @@ in forceSSL = true; useACMEHost = "eh11.easterhegg.eu"; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/" = { index = "index.shtml"; root = eh11; extraConfig = '' - # Set default_type to html + # Set default_type to html default_type text/html; # Enable SSI ssi on; diff --git a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix index c72a72b..afc93c1 100644 --- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix +++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh20.nix @@ -21,16 +21,10 @@ in "www.eh20.easterhegg.eu" "eh20.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 31820; + }]; }; "www.eh20.easterhegg.eu" = { @@ -40,20 +34,12 @@ in "eh20.hamburg.ccc.de" ]; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/".return = "302 https://eh20.easterhegg.eu"; @@ -73,20 +59,12 @@ in forceSSL = true; useACMEHost = "eh20.easterhegg.eu"; - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; + listen = [{ + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + }]; locations."/" = { index = "start.html"; diff --git a/config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix deleted file mode 100644 index 5bb565d..0000000 --- a/config/hosts/public-web-static/virtualHosts/infra-docs.hamburg.ccc.de.nix +++ /dev/null @@ -1,73 +0,0 @@ -{ pkgs, ... }: - -let - domain = "infra-docs.hamburg.ccc.de"; - dataDir = "/var/www/${domain}"; - deployUser = "infra-docs-deploy"; -in { - services.nginx.virtualHosts = { - "acme-${domain}" = { - enableACME = true; - serverName = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; - }; - - "${domain}" = { - forceSSL = true; - useACMEHost = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - root = "${dataDir}"; - - extraConfig = '' - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 172.31.17.140; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - - port_in_redirect off; - ''; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${deployUser} ${deployUser}" - ]; - - users.users."${deployUser}" = { - isNormalUser = true; - group = "${deployUser}"; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINfwfy9f3R/tDOiUeG5DA9oIGDDEAP270MqFG3V1P11L deploy key for infra-docs" - ]; - }; - users.groups."${deployUser}" = { }; -} diff --git a/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix index 105c0e5..7852639 100644 --- a/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/spaceapi.hamburg.ccc.de.nix @@ -7,10 +7,6 @@ serverName = "spaceapi.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -23,12 +19,6 @@ useACMEHost = "spaceapi.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix b/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix index 3f9f7a3..c91d283 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix @@ -11,10 +11,6 @@ in { serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -27,12 +23,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix b/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix deleted file mode 100644 index 697ac69..0000000 --- a/config/hosts/public-web-static/virtualHosts/staging.c3dog.de.nix +++ /dev/null @@ -1,70 +0,0 @@ -{ pkgs, ... }: - -let - domain = "staging.c3dog.de"; - dataDir = "/var/www/${domain}"; - deployUser = "c3dog-website-deploy"; -in { - services.nginx.virtualHosts = { - "acme-${domain}" = { - enableACME = true; - serverName = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; - }; - - "${domain}" = { - forceSSL = true; - useACMEHost = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - root = "${dataDir}"; - - # Disallow *, since this is staging and doesn't need to be in any search - # results. - locations."/robots.txt" = { - return = "200 \"User-agent: *\\nDisallow: *\\n\""; - }; - - extraConfig = '' - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 172.31.17.140; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - ''; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${deployUser} ${deployUser}" - ]; - - # c3dog deploy user already defined in c3dog.de.nix. -} diff --git a/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix b/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix index 21ef153..6733dad 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.cryptoparty-hamburg.de.nix @@ -16,10 +16,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -32,12 +28,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -65,12 +55,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix index c6afb80..b165348 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix @@ -21,12 +21,6 @@ in forceSSL = true; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -35,6 +29,10 @@ in } ]; + basicAuth = { + "preview" = "liebe"; + }; + extraConfig = '' # Make use of the ngx_http_realip_module to set the $remote_addr and # $remote_port to the client address and client port, when using proxy diff --git a/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix index b70af70..5b3d387 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.docs.c3voc.de.nix @@ -11,10 +11,6 @@ in { serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -27,12 +23,6 @@ in { useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; @@ -58,8 +48,6 @@ in { # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; - - port_in_redirect off; ''; }; }; diff --git a/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix b/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix index 7e44a84..14ede9b 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix @@ -12,10 +12,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -28,12 +24,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix index 0c7cd28..79ca38c 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix @@ -12,10 +12,6 @@ in serverName = "${domain}"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -28,12 +24,6 @@ in useACMEHost = "${domain}"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix index 624b632..f7e0752 100644 --- a/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/staging.hamburg.ccc.de.nix @@ -7,10 +7,6 @@ serverName = "staging.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -23,12 +19,6 @@ useACMEHost = "staging.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix deleted file mode 100644 index 7ed3d69..0000000 --- a/config/hosts/public-web-static/virtualHosts/staging.infra-docs.hamburg.ccc.de.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ pkgs, ... }: - -let - domain = "staging.infra-docs.hamburg.ccc.de"; - dataDir = "/var/www/${domain}"; - deployUser = "infra-docs-deploy"; -in { - services.nginx.virtualHosts = { - "acme-${domain}" = { - enableACME = true; - serverName = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; - }; - - "${domain}" = { - forceSSL = true; - useACMEHost = "${domain}"; - - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - root = "${dataDir}"; - - # Disallow *, since this is staging and doesn't need to be in any search - # results. - locations."/robots.txt" = { - return = "200 \"User-agent: *\\nDisallow: *\\n\""; - }; - - extraConfig = '' - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 172.31.17.140; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - - port_in_redirect off; - ''; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${deployUser} ${deployUser}" - ]; - - # infra-docs deploy user already defined in infra-docs.hamburg.ccc.de.nix. -} diff --git a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix deleted file mode 100644 index ce87788..0000000 --- a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix +++ /dev/null @@ -1,82 +0,0 @@ -{ pkgs, ... }: - -let - domain = "ueberwachungsfrei.eu"; - dataDir = "/var/www/${domain}"; - deployUser = "ueberwachungsfrei-deploy"; -in { - security.acme.certs."${domain}".extraDomainNames = [ - "xn--berwachungsfrei-yvb.eu" - ]; - - services.nginx.virtualHosts = { - "acme-${domain}" = { - enableACME = true; - serverName = "${domain}"; - serverAliases = [ - "xn--berwachungsfrei-yvb.eu" - ]; - - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; - }; - - "${domain}" = { - forceSSL = true; - useACMEHost = "${domain}"; - serverAliases = [ - "überwachungsfrei.eu" - "xn--berwachungsfrei-yvb.eu" - ]; - - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - root = "${dataDir}"; - - extraConfig = '' - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 172.31.17.140; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - ''; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${deployUser} ${deployUser}" - ]; - - users.users."${deployUser}" = { - isNormalUser = true; - group = "${deployUser}"; - openssh.authorizedKeys.keys = [ - # TODO: Maybe add a deploy key if we want CI/CD - ]; - }; - users.groups."${deployUser}" = { }; -} diff --git a/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix b/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix index 4f241f1..a29fbd2 100644 --- a/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix +++ b/config/hosts/public-web-static/virtualHosts/www.hamburg.ccc.de.nix @@ -7,10 +7,6 @@ serverName = "www.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 31820; - } { addr = "0.0.0.0"; port = 31820; @@ -23,12 +19,6 @@ useACMEHost = "www.hamburg.ccc.de"; listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } { addr = "0.0.0.0"; port = 8443; diff --git a/config/hosts/woodpecker/configuration.nix b/config/hosts/woodpecker/configuration.nix new file mode 100644 index 0000000..45e228e --- /dev/null +++ b/config/hosts/woodpecker/configuration.nix @@ -0,0 +1,7 @@ +{ config, pkgs, ... }: + +{ + networking.hostName = "woodpecker"; + + system.stateVersion = "24.05"; +} diff --git a/config/hosts/woodpecker/default.nix b/config/hosts/woodpecker/default.nix new file mode 100644 index 0000000..1db0c8c --- /dev/null +++ b/config/hosts/woodpecker/default.nix @@ -0,0 +1,11 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./woodpecker-agent + ./woodpecker-server + ./configuration.nix + ./networking.nix + ./sops.nix + ]; +} diff --git a/config/hosts/woodpecker/networking.nix b/config/hosts/woodpecker/networking.nix new file mode 100644 index 0000000..3301812 --- /dev/null +++ b/config/hosts/woodpecker/networking.nix @@ -0,0 +1,22 @@ +{ ... }: + +{ + networking = { + interfaces.net0 = { + ipv4.addresses = [ + { + address = "172.31.17.160"; + prefixLength = 25; + } + ]; + }; + defaultGateway = "172.31.17.129"; + nameservers = [ "212.12.50.158" "192.76.134.90" ]; + search = [ "hamburg.ccc.de" ]; + }; + + systemd.network.links."10-net0" = { + matchConfig.MACAddress = "BC:24:11:5F:A9:B7"; + linkConfig.Name = "net0"; + }; +} diff --git a/config/hosts/woodpecker/secrets.yaml b/config/hosts/woodpecker/secrets.yaml new file mode 100644 index 0000000..5fae897 --- /dev/null +++ b/config/hosts/woodpecker/secrets.yaml @@ -0,0 +1,149 @@ +woodpecker_server_environment_file: ENC[AES256_GCM,data:68Wu0UOHBAGZHSJ0x4wbeDLm626jpumv9w6A65FNKsmzYp6P4/c4g1MF1agQd7l9nKMTRrgyJyfoEZYFQRX6lYSmcsQLfn++uh1JpFoClT5p/5hBkiDq4owUFU+NGUiyl6yjYlEiaxLwC4ZdyISHeEYpbrvGyIXLsFgdrQ0rVX3cCRwIMxFcyCG6d3MZVoqAw1A=,iv:y/+X02aRPBOoR57P9s7y/SijvXVLuiBBfFYqeJLvQEU=,tag:DNwK+M6s3moglkMkrWccyA==,type:str] +woodpecker_agent_environment_file: ENC[AES256_GCM,data:rwp6TYYFJ/IZH+3pGhPxjdZMLoyPMr/W1RXm4IkUGn+SmIjHZcdFZ8nEhvOfnkfrXNPc2MR+X6NXUmVOcBjSCbcBjh9sC653UpKimt9I3/Ec,iv:X9JH7dmTayw8BaEsXYil3PrykCdd+/ANGHVfEyRvc7A=,tag:/ErkX1WnruanNgTTBUT6LA==,type:str] +sops: + age: + - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdUhjQUJIS2QvWk1Yc3pR + M1daYlRubnlsQk9tcytBNWdYMUU4bG1DVHhZCnVKK00ySDdBZFhzRXlaQ2xVaTBh + bVVVNzRraUpHSFFuRStzWFprUGRoMGcKLS0tIEVBUWh4STBIaGdTelFKcnB0TkNR + SEd1VTZQZWlkYXVKcVRPbVA1U3VWbFUKnuaPGc29kKE86nh+xEto0Jb6BQ0uH3pr + Q1QPgfiOCYGkuUewy3LlGnLTuMxHBBWAjg4zgaYPHU2F/HCS5DB5nw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdVJNK1ljNWwrTy9qc1p1 + N1MweERxdkNXZVZITWRRdGFQRHRQeTNFTTI4CjFkSVJQMFBKY2tRWE1DeXdMOUZY + Qm5oYTU1azFzVEpYZUptcTVhRCsxL28KLS0tIEI0czljekgvQlc1SlVGSUpGb1N3 + NytOaE5nQ3E4bFhCQ1ZDU3MyM3p5cmcK3LGva0vDjitqOBqBo6jHqRBaH8T8cOim + IF8ygc0i/dbaec59ZcCMhS0n8yv0lVHO2WiUwPaKTh5hkti9LhKlaA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-06-22T15:55:25Z" + mac: ENC[AES256_GCM,data:UmDbmxSRj8YfCkKEelQNMJ8mzbu5aQdB9yOr9JfUh5TB9r5Z5ttZ1wgJDJqHNtsII3JGXUvbgHbsmbPikkrj4Ege1rrgr4UttN1rtgeaAKlZIlqb9pOnV4//GJL8jbxCgFp2h2O80G05nAXG54DaY//4Y5hfTyPzgyDlGQ6jlhg=,iv:5e8lpFfGAJh8lTFcY4MlZG7PgnzM0UycsU0tB2KN+zQ=,tag:4xUEHg04wjDbhc9MOItzuQ==,type:str] + pgp: + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJAQ/+NzRul1VZa2BLnjCsdUP7YErHvLsJqc/KwEFgGX8yN1Bg + VOHgm0MBYC14KtMu0Zb+Cm6ypqyaa4j+MXNVWLDTOLt1aLibashBmyPbwHNr0XwO + 6tr9qYAPixaoWFeiCtATKLUzWzQ68eDv9JHNNQvKGNjet9E1yOIxWHj6RxyV/EeZ + 50nf+7AO7cFkqRGFxrGKAYchzetajNPLtbS2htFCc3Vt9m38jusafvYdjeG+HQHe + 6INzdNqvM7vhfWJlIiTPCXGKvx0NhLg6sVvcXpq5mKbMAhja80KyUdl772L8Kr6P + ZYvmj+Ey8+GM+opGGxcaSBmgw3ZLRIZ1tks3LlRf/UiAZD5MqJoRL1DEJMtHzYnp + IqxOEiuMLAL1/TxG4KhJfT5Gs9Kf3Cnr6djhhsYg3GYXSQdhiyaBDaLpu68nEIRN + JSdA/7pCjxhvlgFl9XvPaMzQD5GZNlVapJPn1c9Ambi9cs4kB8nds+Xx4KgIN3li + 85flJnEtQWRI2DL8qJgoYJ1cXevkPVzKLFnQEHfLuozIzfPl1Wq1Sb3EQk9YZer9 + yfVHRngBBhmfNMtFy9gq8FLod0Odas3KQDAa7ndPMMx6oL5DoNeI3DpuYW4eQIZK + EbT5iHLMrTXHb2XKTHfXdjl6ttED+12GAby69jdGXjt6UVAM6b0UorWfSLLoqabS + XgG1w128eegSl4tqdYO/KDL30c9J1K8LqaJmg+9eFAi9Da/zmPAck+DlS7XUkeiX + OqZiOXLul0N2Qe/tWkpJD8F3HV+K6Xt0MSx8VsmeliicG4Rpme1Xysau+7kht3U= + =KUjN + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAw5vwmoEJHQ1ARAAxH+TtzvFlUZfD3U7BNRr9SyWVxnkR3U2zvvDG5A3I28K + fI1U1am6Z+gSvYdId38hiMPxDmDIMl2wCYCXd17q+PSycsJ1Bbzy1zaht6KcpSJb + s9jmNmf+5mazSRZ/COBy4mMq+2mam4/vu+xS85IsgxyxK9ygnCurmzMqn3lxatm0 + ICxvoLMAamA+tAfxtw+a5lEMok7pHdKndZmrKvxO7nLXM0292sJ3VHp5Uy9k487W + PznpjM1st/f/0gTu1mgb8rnUkSszw1odBeQ+xw2JvcDHE6Ow7PpCk83oTWXil6c4 + bEsrtvaFLWXN9/gssnayoMWHb/TCHKVe4AGrMevFkRdEFDRV5FRZGqzuGDP++X10 + KYyMN0/Wo/XU7Rn3+7HmKvz0qeaAI/IRTrhdXUDtQQ13/waxGrJEquwS5Xuwea6l + LlA6hwnAERSVrVkMQ60ITOD6n7lvAPA7jD/HhI3P2Xy4mDFW9ZnfnWi0xI9pRCsk + w+ZnQ1Ckacv0gJUirvsVSdUYHwvEvpFEVSsZsv5QbNsaWi5jn5XDH0eqlXQE80aO + o3vPFTNCHNixspiaIO4V8etyv6nSh7BxwDvIH4nZVxr8HmxILs0Occw9anvA81md + roF3pyb+ZFRIwcBh72VSdAm1D/n4h14lnmMj+19HEA3zvbPnZQejtGFMY1Oe2VTS + XgHMI0aRJANXczMA7LSg9vxDYvWXE2KR526oBsC1E7otCNGkxj3hhmng25K3tmIU + E2AAaAIk/RukMnydb93XGciPquCZsWlmpwlTGXCqoqiNBilvIE1lXH6rhym78ko= + =nRW4 + -----END PGP MESSAGE----- + fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAPWizx2khKtlshnLwE5PRszAdTvTlsEEiWVV5xJx3PnAw + 9Gj2lZZX4F0AXoKInElg2N02FXpIo24ZZUPXGqpswfSv93NFNNK+FWwqUCRZhuCM + 0l4Blkyy4PthGwIAtXqZ8GGxjoDGBLIAE/zrY9tdNB5XAnkiy7J82kora0dphpkq + Llb1Jgh0+ZK8RQzaf5wcgWf867MhJLhv0N+qLsFVutGpqFy1W/1vaLQ5au5Ty2Tw + =460I + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fAQ//Rzcsq0Yay/3g/MzqHI1izkSWsdycz3LE6qM4qhX4f7wZ + 4Ymzu2jbSq43IavCjGPOLIKVJ4nlnPd7rcprYNV5DOcGAkXG5x7PbnVta3SPI300 + CXnSGQB1KHUCCYZN1BkL9ZSQyTx0ex19mnsSEtZh8NB97cCZx9zMowdHKd5ySu/O + +CMFkQ6Uoh2FxBtqM1y1YbDiuDJnAlAQSKlDIVdCdMssutWRs9Nf6eiLtcmb4U5l + sNyKQnPrr3vjkaTbVdBKQjjMSa8Z/1Tf95GxNhzrUGm2APLKVYdHkMVlQwcr/ZfH + jGiZqxgBmrtNe3EypdKCDnlPvlxs8mnO5whxzDZW2NFV3piMmOmvLI/Po1ASi/t1 + PW9h05Foh2764Jfp74BkRTvhBfi465wKkON0VOckwWBkl/n7w7POfHCXdK1/AnGj + 9ywj6P4zg50vKiTMkZStq6YKXAEkVcN6YzhVVDFwDwAE1VKFCMKlmwuYT1FuKXBp + 7maF578qVyb0lXP9jaX10Y9dhC4vU2rJB3vtRhxjqeMEe/WOyhEyalrC9phPfBKS + wVKzdd3vvaNGfQSAwseFAn1upvELFwccPw1aRIqqLhzWTY2m48yyW2aEN6+7SqkR + dOBJpZDE4NxOhbQl0rllZdeLUznIgeOKM2iNg/3kM7cWcsLZRm3+l1ZuiCEy5XPS + XgHbwfJlyZYoQyKCntbdA/5VRS/5s0oPJIjuofoBZb35fIqtYPIpUeNccpklXYsO + atiSRwJeiluCFUag0uV3nq0zltOlqdS6piEVqU6xiGLAZe04jkaMBxL6VQQHYU0= + =811X + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA1Hthzn+T1OoAQ/9EvULxQSjfO/V600iqRhsQsuuHWY5IfVN+XBCmzmeUX2a + 8qFN8L5gk3pYEoIu4khSCSeIpVyOdX1XeWMMNB15C/pAvgi7emH0y8UxAvCLfW5L + CzP3qLQsbpKUGntPlHaye/G16M/+m4QPc6Y7qwEtUThOei9haPhIU06Tb61IpfLk + AKticUro4ap3Xt/fjDH0NHZsGG33V6LprTt+8LaEcpcwZK/yOWdG4wTV4j6X8LbA + ueCmKunAr1skJrd+hVuwP2e8UkasYgo33pcupsS5jcyXJT9Kf3p/nqOJ3QGlwOtP + lf0DUifdd/QrEXWcMBu+zc9HgtUzpyU3KAoVrxo4JQLaoRlq3kwk3mOOFA0Fzd16 + neuJL2wp/RPuL47StHwA9HxQP+3znXkNxmt9yXGzeyeOBpK4O9qoQ9y7Rbd/FR2u + wEl5uAjhhH2xmAUnIKp5Y1UAFSLqZEaiJjjCHMHycaTpCucjEcChpaBGDAXYS1h+ + x/r6R46UgIzMvjpd2vy+C1aQg0p1Z6P65ifOkdAYIghpSkp+F6SUHHkL3w/kRRjE + dBF8YWFm/yl9P9qenakC5NsAA+bR4ZpNWpv32sYuVjIuoV20GdS7UIVQnvos8bBK + NfqoFmz4n8Eo1jLRcCJ376ow7bSEhRIJlJxdq7bFjZ/3Wtk9vt9dG6XV7wLdJwXS + XgGRxjv94TYLFowYA8/uu9fWxvf2i2lLqctjrvbZkW0Rdn2Ym5GXjg6St3Diug6r + y87PJPSN7CYE4jzCDPaSnGcBvwDHrQsLHLAmenfrAi2Jnweg/THpm9UAftoC7AY= + =Fxot + -----END PGP MESSAGE----- + fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqARAAnZq75P7GPcuBCBLUOVPK8w1IBxd4XzoEWW3+T80bFTZE + ZjPAvfiGcOqIfc8CPzpS1drviWiRkuEV4EKCuDmX9GReI0SUlvaoiddUA9V62f4b + akBrzqR0nNnWWvjph4/5PRAQO+xO4wQy2r9thCw4oej3QgvKtLRRRY35TkGqlS0t + ej4d80KaqGGsfIPQ5L9f+lqarrKvYx3DMK6CujN13Kot44Uom4L5TeIdPSAW14jS + 13fa/I1Irq56ME9kNctsuAkRkhrW+KchFJqkYXSS82SbXUDDNcVA7knXSzxVR+iU + NJXb8bQO4Ymi8sWPWKHW/GXUkReiTLl8MkLi+mCwL7qo5fMQcBg/KWo0hReQYCj3 + G9DZPs3xWYFcwcmrSV86LSqjMt5g8ZKjPm6ODQcZVA/ZsGlmdTkjsWNn6WRZI55m + 8kkg7BoRMq7p6b15tW4e/w2rr/bTmGQ9dV03KIpmBG6+OUzwgfB2/w2dGmB7Vor6 + JMzvt+1I/PSHsCC/7GurTurAP63x8NO/9HYX2Qg0qzsOusnTKrCoo4lX/tA5YfIt + OKr6zqy8s5Dv/lGUhofkJrhHr/QTRHFVrFtPNn4yfSzo+8uhomHGsmxBGOOiY83L + 3zwYm+9BlzO/ve7PIvs54hIHQaKsP9Ktsgq/+dM7PVlIb5qfwGNvgoS2QXFqCF/S + XgHWy41J0zTGoyEpooGkheVKvgEPvv6YIlm9oTucYP03AkKWxBr9MTNq/+JcLRvw + Zey10uVJnYPUuH2b9f8N8lNBZlkQCBq/AEu0MsygsK8bcVfQL1Qs58xh1uA7gL8= + =wduB + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-02-17T22:22:03Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdA4Y8j9A4ECAds0oJlP50Td1HpYIhywjXKi+pT7CTPXQ8w + 95+hUucTE8WQO/9u4HV2Y2nuyQPwmaYK0iGbNV3YxgI3Zdtf1T680hQxT4y55E1/ + 0l4B+70h9ojiHZkpVKVmFFZdY+tS/jQIFIRxqTW1AAfDf+chO3sUxbRe2qZhOXoY + b/QKU11wFpmOZmzznurOoxkqdNgGNcFm9+Ntb4ZSLSYzx7wrjzmWsaTdFd+coO1j + =V+rP + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/config/hosts/woodpecker/sops.nix b/config/hosts/woodpecker/sops.nix new file mode 100644 index 0000000..b4548ed --- /dev/null +++ b/config/hosts/woodpecker/sops.nix @@ -0,0 +1,7 @@ +{ ... }: + +{ + sops = { + defaultSopsFile = ./secrets.yaml; + }; +} diff --git a/config/hosts/woodpecker/woodpecker-agent/default.nix b/config/hosts/woodpecker/woodpecker-agent/default.nix new file mode 100644 index 0000000..279d2bb --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-agent/default.nix @@ -0,0 +1,8 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./docker.nix + ./woodpecker-agent.nix + ]; +} diff --git a/config/hosts/woodpecker/woodpecker-agent/docker.nix b/config/hosts/woodpecker/woodpecker-agent/docker.nix new file mode 100644 index 0000000..af13f4c --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-agent/docker.nix @@ -0,0 +1,12 @@ +# Sources for this configuration: +# - https://woodpecker-ci.org/docs/administration/deployment/nixos +# - https://woodpecker-ci.org/docs/administration/backends/docker +# - https://nixos.wiki/wiki/Docker + +{ config, pkgs, ... }: + +{ + virtualisation.docker = { + enable = true; + }; +} diff --git a/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix b/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix new file mode 100644 index 0000000..8c6847b --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix @@ -0,0 +1,29 @@ +# Sources for this configuration: +# - https://woodpecker-ci.org/docs/administration/deployment/nixos +# - https://woodpecker-ci.org/docs/administration/agent-config +# - https://woodpecker-ci.org/docs/administration/backends/docker + +{ config, pkgs, ... }: + +{ + services.woodpecker-agents.agents."docker" = { + enable = true; + package = pkgs.woodpecker-agent; + extraGroups = [ "docker" ]; + environment = { + WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}"; + WOODPECKER_MAX_WORKFLOWS = "4"; + WOODPECKER_BACKEND = "docker"; + # Set via enviornmentFile: + # WOODPECKER_AGENT_SECRET + }; + environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ]; + }; + + sops.secrets."woodpecker_agent_environment_file" = { + mode = "0440"; + owner = "root"; + group = "root"; + restartUnits = [ "woodpecker-agent-docker.service" ]; + }; +} diff --git a/config/hosts/woodpecker/woodpecker-server/default.nix b/config/hosts/woodpecker/woodpecker-server/default.nix new file mode 100644 index 0000000..a713746 --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-server/default.nix @@ -0,0 +1,9 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./nginx.nix + ./postgresql.nix + ./woodpecker-server.nix + ]; +} diff --git a/config/hosts/woodpecker/woodpecker-server/nginx.nix b/config/hosts/woodpecker/woodpecker-server/nginx.nix new file mode 100644 index 0000000..962183c --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-server/nginx.nix @@ -0,0 +1,57 @@ +# Sources for this configuration: +# - https://woodpecker-ci.org/docs/administration/deployment/nixos +# - https://woodpecker-ci.org/docs/administration/proxy + +{ config, pkgs, ... }: + +{ + services.nginx = { + enable = true; + + virtualHosts."acme-woodpecker.hamburg.ccc.de" = { + default = true; + enableACME = true; + serverName = "woodpecker.hamburg.ccc.de"; + + listen = [ + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + virtualHosts."woodpecker.hamburg.ccc.de" = { + default = true; + forceSSL = true; + useACMEHost = "woodpecker.hamburg.ccc.de"; + + listen = [ + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + locations."/" = { + proxyPass = "http://localhost${config.services.woodpecker-server.environment.WOODPECKER_SERVER_ADDR}"; + }; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + ''; + }; + }; + + networking.firewall.allowedTCPPorts = [ 8443 31820 ]; + networking.firewall.allowedUDPPorts = [ 8443 ]; +} diff --git a/config/hosts/woodpecker/woodpecker-server/postgresql.nix b/config/hosts/woodpecker/woodpecker-server/postgresql.nix new file mode 100644 index 0000000..e715650 --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-server/postgresql.nix @@ -0,0 +1,18 @@ +# Sources for this configuration: +# - https://github.com/NixOS/nixpkgs/blob/dce84c46d780b20c064d5dfb10d0686e0584a198/nixos/modules/services/web-apps/nextcloud.nix#L1069 + +{ config, pkgs, ... }: + +{ + services.postgresql = { + enable = true; + package = pkgs.postgresql_15; + ensureDatabases = [ "woodpecker-server" ]; + ensureUsers = [ + { + name = "woodpecker-server"; + ensureDBOwnership = true; + } + ]; + }; +} diff --git a/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix b/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix new file mode 100644 index 0000000..1836b73 --- /dev/null +++ b/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix @@ -0,0 +1,44 @@ +# Sources for this configuration: +# - https://woodpecker-ci.org/docs/administration/deployment/nixos +# - https://woodpecker-ci.org/docs/administration/server-config +# - https://woodpecker-ci.org/docs/administration/database +# - https://woodpecker-ci.org/docs/administration/forges/forgejo +# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING + +{ config, pkgs, ... }: + +{ + services.woodpecker-server = { + enable = true; + package = pkgs.woodpecker-server; + environment = { + WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de"; + WOODPECKER_SERVER_ADDR = ":8001"; + WOODPECKER_GRPC_ADDR = ":9000"; + WOODPECKER_ADMIN = "june"; + WOODPECKER_OPEN = "true"; + WOODPECKER_ORGS = "CCCHH"; + WOODPECKER_DATABASE_DRIVER = "postgres"; + WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql"; + WOODPECKER_FORGEJO = "true"; + WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de"; + WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB + # Set via enviornmentFile: + # WOODPECKER_FORGEJO_CLIENT + # WOODPECKER_FORGEJO_SECRET + }; + environmentFile = [ "/run/secrets/woodpecker_server_environment_file" ]; + }; + + systemd.services.woodpecker-server.serviceConfig = { + User = "woodpecker-server"; + Group = "woodpecker-server"; + }; + + sops.secrets."woodpecker_server_environment_file" = { + mode = "0440"; + owner = "root"; + group = "root"; + restartUnits = [ "woodpecker-server.service" ]; + }; +} diff --git a/deployment_configuration.json b/deployment_configuration.json index eddd7b0..3ae44cc 100644 --- a/deployment_configuration.json +++ b/deployment_configuration.json @@ -6,9 +6,15 @@ "matrix": { "targetHostname": "matrix-intern.hamburg.ccc.de" }, + "public-web-static": { + "targetHostname": "public-web-static-intern.hamburg.ccc.de" + }, "git": { "targetHostname": "git.hamburg.ccc.de" }, + "forgejo-actions-runner": { + "targetHostname": "forgejo-actions-runner-intern.hamburg.ccc.de" + }, "woodpecker": { "targetHostname": "woodpecker-intern.hamburg.ccc.de" }, diff --git a/flake.lock b/flake.lock index b2142ed..8f672b0 100644 --- a/flake.lock +++ b/flake.lock @@ -19,11 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1778430510, - "narHash": "sha256-Ti+ZBvW6yrWWAg2szExVTwCd4qOJ3KlVr1tFHfyfi8Q=", + "lastModified": 1775002709, + "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8fd9daa3db09ced9700431c5b7ad0e8ba199b575", + "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e", "type": "github" }, "original": { @@ -35,11 +35,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1778672786, - "narHash": "sha256-Blg88K1jwG+P0Mr27+rKMFCufdrWkV3wWh9AdYtz0FQ=", + "lastModified": 1775126147, + "narHash": "sha256-J0dZU4atgcfo4QvM9D92uQ0Oe1eLTxBVXjJzdEMQpD0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1", + "rev": "8d8c1fa5b412c223ffa47410867813290cdedfef", "type": "github" }, "original": { @@ -64,11 +64,11 @@ ] }, "locked": { - "lastModified": 1777944972, - "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", + "lastModified": 1775188331, + "narHash": "sha256-/0BoSi0Dg0ON7IW0oscM12WSPBaMSCn36XTt0lHZoy8=", "owner": "Mic92", "repo": "sops-nix", - "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", + "rev": "8f093d0d2f08f37317778bd94db5951d6cce6c46", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 886024b..3b28ef2 100644 --- a/flake.nix +++ b/flake.nix @@ -127,6 +127,20 @@ ]; }; + forgejo-actions-runner = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ + self.nixosModules.common + self.nixosModules.proxmox-vm + sops-nix.nixosModules.sops + self.nixosModules.prometheus-exporter + ./config/hosts/forgejo-actions-runner + ]; + specialArgs = { + inherit authorizedKeysRepo; + }; + }; + ptouch-print-server = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [ @@ -145,6 +159,17 @@ ]; }; + woodpecker = nixpkgs.lib.nixosSystem { + inherit system specialArgs; + modules = [ + self.nixosModules.common + self.nixosModules.proxmox-vm + sops-nix.nixosModules.sops + self.nixosModules.prometheus-exporter + ./config/hosts/woodpecker + ]; + }; + penpot = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [