Compare commits
1 commit
| Author | SHA1 | Date | |
|---|---|---|---|
 jopejoe1
|
db5e86e4c0
|
21
LICENSE
21
LICENSE
|
|
@ -1,21 +0,0 @@
|
|||
MIT License
|
||||
|
||||
Copyright (c) CCCHH
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
|
@ -73,7 +73,3 @@ Build a new NixOS Proxmox VE Template for the chaosknoten:
|
|||
```shell
|
||||
nix build .#proxmox-chaosknoten-nixos-template
|
||||
```
|
||||
|
||||
## License
|
||||
|
||||
This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).
|
||||
|
|
|
|||
|
|
@ -6,9 +6,14 @@
|
|||
# - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
|
||||
# - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings
|
||||
|
||||
{ config, pkgs, lib, authorizedKeysRepo, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
authorizedKeysRepo = pkgs.fetchgit {
|
||||
url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys";
|
||||
rev = "b6a29dc7af0a45a8c0b4904290c7cb0c5bc51413";
|
||||
hash = "sha256-c0aH0wQeJtfXJG5wAbS6aO8yILLI1NNkFAHAeOm8RXA=";
|
||||
};
|
||||
authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -21,8 +21,7 @@ let
|
|||
app = "dokuwiki";
|
||||
domain = "eh22.easterhegg.eu";
|
||||
dataDir = "/srv/www/${domain}";
|
||||
in
|
||||
{
|
||||
in {
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${dataDir} 0755 ${app} ${app}"
|
||||
];
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
networking = {
|
||||
hostName = "mqtt";
|
||||
domain = "z9.ccchh.net";
|
||||
};
|
||||
networking = {
|
||||
hostName = "mqtt";
|
||||
domain = "z9.ccchh.net";
|
||||
};
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
|
|
@ -1,9 +1,9 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./networking.nix
|
||||
./mosquitto.nix
|
||||
];
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./networking.nix
|
||||
./mosquitto.nix
|
||||
];
|
||||
}
|
||||
|
|
@ -5,29 +5,29 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
services.mosquitto = {
|
||||
enable = true;
|
||||
persistence = true;
|
||||
services.mosquitto = {
|
||||
enable = true;
|
||||
persistence = true;
|
||||
|
||||
# set config for all listeners
|
||||
listeners = [{
|
||||
settings.allow_anonymous = true;
|
||||
omitPasswordAuth = true;
|
||||
acl = [ "topic readwrite #" ];
|
||||
}];
|
||||
# set config for all listeners
|
||||
listeners = [ {
|
||||
settings.allow_anonymous = true;
|
||||
omitPasswordAuth = true;
|
||||
acl = ["topic readwrite #"];
|
||||
} ];
|
||||
|
||||
bridges.winkekatz = {
|
||||
addresses = [
|
||||
{ address = "mqtt.winkekatze24.de"; }
|
||||
];
|
||||
topics = [
|
||||
"winkekatze/allcats/eye/set in 2"
|
||||
"winkekatze/allcats in 2"
|
||||
"+/status out 2 winkekatze/ \"\""
|
||||
"+/connected out 2 winkekatze/ \"\""
|
||||
];
|
||||
bridges.winkekatz = {
|
||||
addresses = [
|
||||
{ address = "mqtt.winkekatze24.de"; }
|
||||
];
|
||||
topics = [
|
||||
"winkekatze/allcats/eye/set in 2"
|
||||
"winkekatze/allcats in 2"
|
||||
"+/status out 2 winkekatze/ \"\""
|
||||
"+/connected out 2 winkekatze/ \"\""
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 1883 ];
|
||||
networking.firewall.allowedTCPPorts = [ 1883 ];
|
||||
}
|
||||
|
|
@ -27,7 +27,7 @@
|
|||
},
|
||||
"calendar": {
|
||||
"type": "ical",
|
||||
"url": "webcal://cloud.hamburg.ccc.de/remote.php/dav/public-calendars/QJAdExziSnNJEz5g/?export"
|
||||
"url": "https://cloud.hamburg.ccc.de/remote.php/dav/public-calendars/QJAdExziSnNJEz5g/?export"
|
||||
}
|
||||
},
|
||||
"links": [
|
||||
|
|
|
|||
|
|
@ -1,19 +1,10 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "c3cat.de";
|
||||
dataDir = "/var/www/${domain}";
|
||||
deployUser = "c3cat-website-deploy";
|
||||
in {
|
||||
security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
|
||||
|
||||
{
|
||||
services.nginx.virtualHosts = {
|
||||
"acme-${domain}" = {
|
||||
"acme-c3cat.de" = {
|
||||
enableACME = true;
|
||||
serverName = "${domain}";
|
||||
serverAliases = [
|
||||
"www.${domain}"
|
||||
];
|
||||
serverName = "c3cat.de";
|
||||
|
||||
listen = [
|
||||
{
|
||||
|
|
@ -23,9 +14,9 @@ in {
|
|||
];
|
||||
};
|
||||
|
||||
"$www.${domain}" = {
|
||||
"c3cat.de" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "${domain}";
|
||||
useACMEHost = "c3cat.de";
|
||||
|
||||
listen = [
|
||||
{
|
||||
|
|
@ -37,7 +28,7 @@ in {
|
|||
];
|
||||
|
||||
locations."/" = {
|
||||
return = "302 https://c3cat.de$request_uri";
|
||||
return = "302 https://wiki.hamburg.ccc.de/club:c3cat:start";
|
||||
};
|
||||
|
||||
extraConfig = ''
|
||||
|
|
@ -51,45 +42,5 @@ in {
|
|||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
|
||||
"${domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "${domain}";
|
||||
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8443;
|
||||
ssl = true;
|
||||
proxyProtocol = true;
|
||||
}
|
||||
];
|
||||
|
||||
root = "${dataDir}";
|
||||
|
||||
extraConfig = ''
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||
];
|
||||
|
||||
users.users."${deployUser}" = {
|
||||
isNormalUser = true;
|
||||
group = "${deployUser}";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcZJzQO4RYinJm6YDUgCELe8OJA/DYOss+8xp7TtxM0 deploy key for c3cat.de"
|
||||
];
|
||||
};
|
||||
users.groups."${deployUser}" = { };
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,7 +9,6 @@
|
|||
./hackertours.hamburg.ccc.de.nix
|
||||
./hamburg.ccc.de.nix
|
||||
./spaceapi.hamburg.ccc.de.nix
|
||||
./staging.c3cat.de.nix
|
||||
./staging.hacker.tours.nix
|
||||
./staging.hackertours.hamburg.ccc.de.nix
|
||||
./staging.hamburg.ccc.de.nix
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
elementWebVersion = "1.11.84";
|
||||
elementWebVersion = "1.11.80";
|
||||
element-web = pkgs.fetchzip {
|
||||
url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
|
||||
sha256 = "sha256-z2qaKKyUq2S/r3xUUU3ym0FgFbiQr6bcltuKvUMPbH4=";
|
||||
sha256 = "sha256-sudWmNehxGsbZTNirTkoWQ/Bln1DC1CI30wocw9VoH8=";
|
||||
};
|
||||
elementSecurityHeaders = ''
|
||||
# Configuration best practices
|
||||
|
|
|
|||
|
|
@ -4,8 +4,7 @@ let
|
|||
domain = "hacker.tours";
|
||||
dataDir = "/var/www/${domain}";
|
||||
deployUser = "hackertours-website-deploy";
|
||||
in
|
||||
{
|
||||
in {
|
||||
services.nginx.virtualHosts = {
|
||||
"acme-${domain}" = {
|
||||
enableACME = true;
|
||||
|
|
|
|||
|
|
@ -4,8 +4,7 @@ let
|
|||
domain = "hackertours.hamburg.ccc.de";
|
||||
dataDir = "/var/www/${domain}";
|
||||
deployUser = "ht-ccchh-website-deploy";
|
||||
in
|
||||
{
|
||||
in {
|
||||
services.nginx.virtualHosts = {
|
||||
"acme-${domain}" = {
|
||||
enableACME = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ ... }:
|
||||
{...}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
|
|
|
|||
|
|
@ -1,60 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "staging.c3cat.de";
|
||||
dataDir = "/var/www/${domain}";
|
||||
deployUser = "c3cat-website-deploy";
|
||||
in {
|
||||
services.nginx.virtualHosts = {
|
||||
"acme-${domain}" = {
|
||||
enableACME = true;
|
||||
serverName = "${domain}";
|
||||
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 31820;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
"${domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "${domain}";
|
||||
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8443;
|
||||
ssl = true;
|
||||
proxyProtocol = true;
|
||||
}
|
||||
];
|
||||
|
||||
root = "${dataDir}";
|
||||
|
||||
# Disallow *, since this is staging and doesn't need to be in any search
|
||||
# results.
|
||||
locations."/robots.txt" = {
|
||||
return = "200 \"User-agent: *\\nDisallow: *\\n\"";
|
||||
};
|
||||
|
||||
extraConfig = ''
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||
];
|
||||
|
||||
# c3cat deploy user already defined in c3cat.de.nix.
|
||||
}
|
||||
|
|
@ -4,8 +4,7 @@ let
|
|||
domain = "staging.hacker.tours";
|
||||
dataDir = "/var/www/${domain}";
|
||||
deployUser = "hackertours-website-deploy";
|
||||
in
|
||||
{
|
||||
in {
|
||||
services.nginx.virtualHosts = {
|
||||
"acme-${domain}" = {
|
||||
enableACME = true;
|
||||
|
|
|
|||
|
|
@ -4,8 +4,7 @@ let
|
|||
domain = "staging.hackertours.hamburg.ccc.de";
|
||||
dataDir = "/var/www/${domain}";
|
||||
deployUser = "ht-ccchh-website-deploy";
|
||||
in
|
||||
{
|
||||
in {
|
||||
services.nginx.virtualHosts = {
|
||||
"acme-${domain}" = {
|
||||
enableACME = true;
|
||||
|
|
|
|||
|
|
@ -3,12 +3,13 @@
|
|||
# - https://woodpecker-ci.org/docs/administration/agent-config
|
||||
# - https://woodpecker-ci.org/docs/administration/backends/docker
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
{ config, pkgs, pkgs-unstable, ... }:
|
||||
|
||||
{
|
||||
services.woodpecker-agents.agents."docker" = {
|
||||
enable = true;
|
||||
package = pkgs.woodpecker-agent;
|
||||
# Since we use woodpecker-server from unstable, use the agent from unstable as well.
|
||||
package = pkgs-unstable.woodpecker-agent;
|
||||
extraGroups = [ "docker" ];
|
||||
environment = {
|
||||
WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
|
||||
|
|
|
|||
|
|
@ -5,12 +5,14 @@
|
|||
# - https://woodpecker-ci.org/docs/administration/forges/forgejo
|
||||
# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
{ config, pkgs, pkgs-unstable, ... }:
|
||||
|
||||
{
|
||||
services.woodpecker-server = {
|
||||
enable = true;
|
||||
package = pkgs.woodpecker-server;
|
||||
# Use package from unstable to get at least version 2.6.0 for native Forgejo support.
|
||||
# https://github.com/woodpecker-ci/woodpecker/releases/tag/v2.6.0
|
||||
package = pkgs-unstable.woodpecker-server;
|
||||
environment = {
|
||||
WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
|
||||
WOODPECKER_SERVER_ADDR = ":8001";
|
||||
|
|
@ -22,7 +24,6 @@
|
|||
WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
|
||||
WOODPECKER_FORGEJO = "true";
|
||||
WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
|
||||
WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB
|
||||
# Set via enviornmentFile:
|
||||
# WOODPECKER_FORGEJO_CLIENT
|
||||
# WOODPECKER_FORGEJO_SECRET
|
||||
|
|
|
|||
|
|
@ -6,12 +6,12 @@
|
|||
description = "Yate telehony engine";
|
||||
unitConfig = {
|
||||
Type = "simple";
|
||||
After = "network.target";
|
||||
After="network.target";
|
||||
};
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.yate}/bin/yate -c /yate -e /yate/share -Do";
|
||||
Type = "simple";
|
||||
Restart = "always";
|
||||
Type="simple";
|
||||
Restart="always";
|
||||
# ...
|
||||
};
|
||||
wantedBy = [ "default.target" ];
|
||||
|
|
|
|||
97
flake.lock
97
flake.lock
|
|
@ -1,26 +1,12 @@
|
|||
{
|
||||
"nodes": {
|
||||
"authorizedKeysRepo": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1731276342,
|
||||
"narHash": "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=",
|
||||
"rev": "686a6af22f6696f0c0595c56f463c078550049fc",
|
||||
"type": "tarball",
|
||||
"url": "https://git.hamburg.ccc.de/api/v1/repos/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz?rev=686a6af22f6696f0c0595c56f463c078550049fc"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz"
|
||||
}
|
||||
},
|
||||
"nixlib": {
|
||||
"locked": {
|
||||
"lastModified": 1731200463,
|
||||
"narHash": "sha256-qDaAweJjdFbVExqs8aG27urUgcgKufkIngHW3Rzustg=",
|
||||
"lastModified": 1729386149,
|
||||
"narHash": "sha256-hUP9oxmnOmNnKcDOf5Y55HQ+NnoT0+bLWHLQWLLw9Ks=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "e04234d263750db01c78a412690363dc2226e68a",
|
||||
"rev": "cce4521b6df014e79a7b7afc58c703ed683c916e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -32,14 +18,16 @@
|
|||
"nixos-generators": {
|
||||
"inputs": {
|
||||
"nixlib": "nixlib",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731546190,
|
||||
"narHash": "sha256-kJix8nLyFIJ3EC7VtoXK/85C4ZN2dC5oWoS8+ErehqI=",
|
||||
"lastModified": 1729472750,
|
||||
"narHash": "sha256-s93LPHi5BN7I2xSGNAFWiYb8WRsPvT1LE9ZjZBrpFlg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-generators",
|
||||
"rev": "06ffce1a8d95e95c06a4bcfa117dd960b14a7101",
|
||||
"rev": "7c60ba4bc8d6aa2ba3e5b0f6ceb9fc07bc261565",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -50,27 +38,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1731245184,
|
||||
"narHash": "sha256-vmLS8+x+gHRv1yzj3n+GTAEObwmhxmkkukB2DwtJRdU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "aebe249544837ce42588aa4b2e7972222ba12e8f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1731842749,
|
||||
"narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=",
|
||||
"lastModified": 1730428893,
|
||||
"narHash": "sha256-fLLUd2dO/Vnf96UDr8YPzerYi+n99l3S5yIUDnmcPBE=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682",
|
||||
"rev": "38edd08881ce4dc24056eec173b43587a93c990f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -80,11 +52,43 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1729973466,
|
||||
"narHash": "sha256-knnVBGfTCZlQgxY1SgH0vn2OyehH9ykfF8geZgS95bk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "cd3e8833d70618c4eea8df06f95b364b016d4950",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-24.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1730449684,
|
||||
"narHash": "sha256-Hlv3rTPxnO+DpKRXw9yjzERLdk05h7+fEbZxWM2taCw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "ab464abbeb3a2833288c6e907488c49c2e599f88",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"authorizedKeysRepo": "authorizedKeysRepo",
|
||||
"nixos-generators": "nixos-generators",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"sops-nix": "sops-nix"
|
||||
}
|
||||
},
|
||||
|
|
@ -92,14 +96,15 @@
|
|||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
],
|
||||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731862312,
|
||||
"narHash": "sha256-NVUTFxKrJp/hjehlF1IvkPnlRYg/O9HFVutbxOM8zNM=",
|
||||
"lastModified": 1729999681,
|
||||
"narHash": "sha256-qm0uCtM9bg97LeJTKQ8dqV/FvqRN+ompyW4GIJruLuw=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "472741cf3fee089241ac9ea705bb2b9e0bfa2978",
|
||||
"rev": "1666d16426abe79af5c47b7c0efa82fd31bf4c56",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
188
flake.nix
188
flake.nix
|
|
@ -6,12 +6,13 @@
|
|||
# https://nixos.org/manual/nixos/stable/#sec-upgrading
|
||||
# https://github.com/NixOS/nixpkgs
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
|
||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
|
||||
|
||||
# Add nixos-generators as an input.
|
||||
# See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
|
||||
nixos-generators = {
|
||||
url = "github:nix-community/nixos-generators";
|
||||
#inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# Add sops-nix as an input for secret management.
|
||||
|
|
@ -20,225 +21,214 @@
|
|||
url = "github:Mic92/sops-nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
authorizedKeysRepo = {
|
||||
url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz";
|
||||
flake = false;
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixos-generators, sops-nix, authorizedKeysRepo, ... }:
|
||||
outputs = { self, nixpkgs, nixpkgs-unstable, nixos-generators, sops-nix, ... }:
|
||||
let
|
||||
specialArgs = {
|
||||
inherit authorizedKeysRepo;
|
||||
};
|
||||
system = "x86_64-linux";
|
||||
shairportSync431ExtendedNixpkgsUnstableOverlay = final: prev: {
|
||||
shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
|
||||
# See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
|
||||
configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
|
||||
buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
|
||||
});
|
||||
};
|
||||
pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
|
||||
in
|
||||
{
|
||||
overlays = {
|
||||
shairportSyncAirplay2 = final: prev: {
|
||||
shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
|
||||
# See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
|
||||
configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
|
||||
buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
|
||||
});
|
||||
};
|
||||
};
|
||||
nixosModules = {
|
||||
common = ./config/common;
|
||||
proxmox-vm = ./config/proxmox-vm;
|
||||
prometheus-exporter = ./config/extra/prometheus-exporter.nix;
|
||||
};
|
||||
nixosConfigurations = {
|
||||
audio-hauptraum-kueche = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
{ nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
{ nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
|
||||
./config/hosts/audio-hauptraum-kueche
|
||||
];
|
||||
};
|
||||
|
||||
audio-hauptraum-tafel = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
{ nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
{ nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
|
||||
./config/hosts/audio-hauptraum-tafel
|
||||
];
|
||||
};
|
||||
|
||||
esphome = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/hosts/esphome
|
||||
];
|
||||
};
|
||||
|
||||
public-reverse-proxy = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/hosts/public-reverse-proxy
|
||||
];
|
||||
};
|
||||
|
||||
netbox = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/netbox
|
||||
];
|
||||
};
|
||||
|
||||
matrix = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/matrix
|
||||
];
|
||||
};
|
||||
|
||||
public-web-static = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/public-web-static
|
||||
];
|
||||
};
|
||||
|
||||
git = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/git
|
||||
];
|
||||
};
|
||||
|
||||
forgejo-actions-runner = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/forgejo-actions-runner
|
||||
];
|
||||
};
|
||||
|
||||
ptouch-print-server = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/hosts/ptouch-print-server
|
||||
];
|
||||
};
|
||||
|
||||
eh22-wiki = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/eh22-wiki
|
||||
];
|
||||
};
|
||||
|
||||
nix-box-june = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/nix-box-june
|
||||
];
|
||||
};
|
||||
|
||||
yate = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/hosts/yate
|
||||
];
|
||||
};
|
||||
|
||||
mqtt = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/hosts/mqtt
|
||||
];
|
||||
};
|
||||
|
||||
mjolnir = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/mjolnir
|
||||
];
|
||||
};
|
||||
|
||||
woodpecker = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/woodpecker
|
||||
];
|
||||
specialArgs = {
|
||||
inherit pkgs-unstable;
|
||||
};
|
||||
};
|
||||
|
||||
status = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
./config/hosts/status
|
||||
];
|
||||
};
|
||||
|
||||
penpot = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
sops-nix.nixosModules.sops
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/penpot
|
||||
];
|
||||
};
|
||||
|
||||
hydra = nixpkgs.lib.nixosSystem {
|
||||
inherit system specialArgs;
|
||||
inherit system;
|
||||
modules = [
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
self.nixosModules.prometheus-exporter
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
./config/extra/prometheus-exporter.nix
|
||||
./config/hosts/hydra
|
||||
];
|
||||
};
|
||||
|
|
@ -246,24 +236,22 @@
|
|||
|
||||
packages.x86_64-linux = {
|
||||
proxmox-nixos-template = nixos-generators.nixosGenerate {
|
||||
inherit specialArgs;
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
./config/nixos-generators/proxmox.nix
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
];
|
||||
format = "proxmox";
|
||||
};
|
||||
|
||||
proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
|
||||
inherit specialArgs;
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
./config/nixos-generators/proxmox-chaosknoten.nix
|
||||
./config/proxmox-chaosknoten-additional-initial-config.nix
|
||||
self.nixosModules.common
|
||||
self.nixosModules.proxmox-vm
|
||||
./config/common
|
||||
./config/proxmox-vm
|
||||
];
|
||||
format = "proxmox";
|
||||
};
|
||||
|
|
|
|||
Loading…
Reference in a new issue