WIP: ptouch-print-server

.editorconfig

@@ -1,23 +0,0 @@
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-indent_style = space
-charset = utf-8
-
-[*.nix]
-indent_size = 2
-trim_trailing_whitespace = true
-
-[*.md]
-indent_size = 2
-trim_trailing_whitespace = false
-
-[*.json]
-indent_size = 2
-trim_trailing_whitespace = true
-
-[*.yaml]
-indent_size = 2
-trim_trailing_whitespace = true

.sops.yaml

@@ -1,66 +0,0 @@
-keys:
-  admins: &admin_keys
-    pgp: &admin_pgp_keys
-      - &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
-      - &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
-      - &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-      - &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
-      - &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-      # - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
-      - &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-      - &admin_pgp_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
-      - &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-      - &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-      - &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
-    age: &admin_age_keys
-      - &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk
-      - &admin_age_lilly age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d
-  hosts:
-    - &host_age_git age18zaq9xg9nhqyl8g7mvrqhsx4qstay5l9cekq2g80vx4920pswdfqpeafd7
-    - &host_age_forgejo_actions_runner age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t
-    - &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk
-    - &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
-    - &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
-    - &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
-creation_rules:
-  - path_regex: config/hosts/git/.*
-    key_groups:
-      - age:
-          - *host_age_git
-        merge:
-          - *admin_keys
-  - path_regex: config/hosts/forgejo-actions-runner/.*
-    key_groups:
-      - age:
-          - *host_age_forgejo_actions_runner
-        merge:
-          - *admin_keys
-  - path_regex: config/hosts/matrix/.*
-    key_groups:
-      - age:
-          - *host_age_matrix
-        merge:
-          - *admin_keys
-  - path_regex: config/hosts/public-web-static/.*
-    key_groups:
-      - age:
-          - *host_age_public_web_static
-        merge:
-          - *admin_keys
-  - path_regex: config/hosts/woodpecker/.*
-    key_groups:
-      - age:
-          - *host_age_woodpecker
-        merge:
-          - *admin_keys
-  - path_regex: config/hosts/penpot/.*
-    key_groups:
-      - age:
-          - *host_age_penpot
-        merge:
-          - *admin_keys
-  - key_groups:
-      - *admin_keys
-stores:
-  yaml:
-    indent: 2

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) CCCHH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

README.md

@@ -1,80 +0,0 @@
-# nix-infra
-
-nix infrastructure configuration for CCCHH.
-
-For deployment we're using [infra-rebuild](https://git.hamburg.ccc.de/CCCHH/infra-rebuild). \
-To easily get a shell with `infra-rebuild` going, use the following command:
-
-```
-nix shell git+https://git.hamburg.ccc.de/CCCHH/infra-rebuild#infra-rebuild
-```
-
-After that you can simply run the following to deploy e.g. the git and matrix hosts:
-
-```
-infra-rebuild switch git matrix
-```
-
-By default infra-rebuild tries to use the FQDN from the nixosConfiguration of the host for deployment.
-However to override individual parts of the deployment target, a [`deployment_configuration.json`](./deployment_configuration.json) can be used.
-This is exactly what we're doing to set the default deployment user to `colmena-deploy` and have custom target hostnames for Chaosknoten hosts, since they don't have an FQDN defined in their nixosConfiguration.
-
-## Setting up secrets with sops-nix for a host
-
-1. Convert the hosts SSH host public key to an age public key.
-   This can be done by connecting to the host and running:
-   ```
-   cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
-   ``` 
-2. Add the resulting age public key to the `.sops.yaml` as a YAML anchor in keys.
-   It should be named something like: `host_age_hostname`
-3. Add a new creation rule for the hosts config directory.
-   It should probably have all admin keys and the hosts age key. \
-   You can use existing creation rules as a reference.
-4. Create a file containing the relevant secrets in the hosts config directory.
-   This can be accomplished with a command similar to this:
-   ```
-   sops config/hosts/hostname/secrets.yaml
-   ```
-   Note: Nested keys don't seem to be compatible with sops-nix.
-5. Add the following entry to the modules of the hosts `nixosConfiguration`:
-   ```nix
-   sops-nix.nixosModules.sops
-   ```
-6. Create a `sops.nix` in the hosts config directory containing the following content to include the `secrets.yaml`:
-   ```nix
-   { ... }:
-
-   {
-     sops = {
-       defaultSopsFile = ./secrets.yaml;
-     };
-   }
-   ```
-7. Make sure the `sops.nix` gets imported. For example in the `default.nix`.
-8. To use a secret stored under e.g. `forgejo_git_smtp_password`, you can then do something like the following:
-   ```nix
-   sops.secrets."forgejo_git_smtp_password" = {
-     mode = "0440";
-     owner = "forgejo";
-     group = "forgejo";
-     restartUnits = [ "forgejo.service" ];
-   };
-   ```
-   This secret would then be available under `/run/secrets/forgejo_git_smtp_password` on the host.
-
-## Build NixOS Proxmox VE Template
-
-Build a new NixOS Proxmox VE Template for the thinkcccore's:
-```shell
-nix build .#proxmox-nixos-template
-```
-Build a new NixOS Proxmox VE Template for the chaosknoten:
-```shell
-nix build .#proxmox-chaosknoten-nixos-template
-```
-
-## License
-
-This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).  
-[`librespot_PR1528_conflicts_resolved.patch`](patches/librespot_PR1528_conflicts_resolved.patch) is a modified version of [librespot PR 1528](https://github.com/librespot-org/librespot/pull/1528) and is licensed under the [MIT license](https://github.com/librespot-org/librespot/blob/dev/LICENSE).

config/common/admin-environment.nix

@@ -1,22 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    vim
-    joe
-    nano
-    htop
-    btop
-    ripgrep
-    fd
-    tmux
-    git
-    curl
-    rsync
-    ssh-to-age
-    usbutils
-    nix-tree
-    # For kitty terminfo.
-    kitty
-  ];
-}

config/common/default-state-version.nix

@@ -13,5 +13,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = lib.mkDefault "24.05";
+  system.stateVersion = lib.mkDefault "23.05";
 }

config/common/default.nix

@@ -3,7 +3,6 @@
 {
   imports = [
     ./acme.nix
-    ./admin-environment.nix
     ./default-host-platform.nix
     ./default-state-version.nix
     ./localization.nix

config/common/ssh.nix

@@ -20,7 +20,6 @@
         "ecdh-sha2-nistp384"
         "ecdh-sha2-nistp256"
         "diffie-hellman-group-exchange-sha256"
-        "mlkem768x25519-sha256"
       ];
       # Macs seem reasonable as the default of NixOS 23.05 is a subset of the Mozilla Modern guideline as of 2023-09-09.
       # Ciphers seem reasonable as the default of NixOS 23.05 matches the Mozilla Modern guideline as of 2023-09-09.

config/common/users.nix

@@ -6,9 +6,14 @@
 # - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
 # - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings
 
-{ config, pkgs, lib, authorizedKeysRepo, ... }:
+{ config, pkgs, lib, ... }:
 
 let
+  authorizedKeysRepo = builtins.fetchGit {
+    url = "forgejo@git.hamburg.ccc.de:CCCHH/infrastructure-authorized-keys.git";
+    ref = "trunk";
+    rev = "0db6df46b68c07edbefe2a5f9ce4002fb6462980";
+  };
   authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
 in
 {

config/hosts/audio-hauptraum-kueche/audio.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../../modules/services/audio
+  ];
+
+  ccchh.services.audio = {
+    enable = true;
+    name = "Audio Hauptraum Küche";
+  };
+
+  users.users.chaos.extraGroups = [ "pipewire" ];
+}

config/hosts/audio-hauptraum-kueche/configuration.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  networking = {
+    hostName = "audio-hauptraum-kueche";
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/audio-hauptraum-kueche/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./audio.nix
+    ./configuration.nix
+    ./networking.nix
+  ];
+}

config/hosts/audio-hauptraum-kueche/networking.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "10.31.210.10";
+          prefixLength = 23;
+        }
+      ];
+    };
+    defaultGateway = "10.31.210.1";
+    nameservers = [
+      "10.31.210.1"
+    ];
+  };
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "1E:EF:2D:92:81:DA";
+    linkConfig.Name = "net0";
+  };
+}

config/hosts/audio-hauptraum-tafel/audio.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../../modules/services/audio
+  ];
+
+  ccchh.services.audio = {
+    enable = true;
+    name = "Audio Hauptraum Tafel";
+  };
+
+  users.users.chaos.extraGroups = [ "pipewire" ];
+}

config/hosts/audio-hauptraum-tafel/configuration.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  networking = {
+    hostName = "audio-hauptraum-tafel";
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/audio-hauptraum-tafel/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./audio.nix
+    ./configuration.nix
+    ./networking.nix
+  ];
+}

config/hosts/audio-hauptraum-tafel/networking.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+
+{
+  networking = {
+    interfaces.net0 = {
+      ipv4.addresses = [
+        {
+          address = "10.31.210.13";
+          prefixLength = 23;
+        }
+      ];
+    };
+    defaultGateway = "10.31.210.1";
+    nameservers = [
+      "10.31.210.1"
+    ];
+  };
+  systemd.network.links."10-net0" = {
+    matchConfig.MACAddress = "D2:10:33:B1:72:C3";
+    linkConfig.Name = "net0";
+  };
+}

config/hosts/esphome/configuration.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  networking = {
+    hostName = "esphome";
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/esphome/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./esphome.nix
+    ./nginx.nix
+  ];
+}

config/hosts/esphome/esphome.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.esphome = {
+    enable = true;
+    openFirewall = true;
+  };
+}