Set WOODPECKER_LIMIT_MEM to 6 GB for woodpecker

so pipelines don't get killed by OOM.
fix: use tar file
2024-11-17 22:43:51 +01:00 · 2024-11-17 21:15:05 +01:00 · 2024-11-17 21:06:27 +01:00 · 2024-11-17 20:33:38 +01:00 · 2024-11-17 20:25:16 +01:00 · 2024-11-17 19:33:00 +01:00
28 changed files with 360 additions and 220 deletions
--- a/21
+++ b/21
@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) CCCHH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/README.md
+++ b/README.md
@ -73,3 +73,7 @@ Build a new NixOS Proxmox VE Template for the chaosknoten:
 ```shell
 nix build .#proxmox-chaosknoten-nixos-template
 ```
+
+## License
+
+This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).
--- a/config/common/users.nix
+++ b/config/common/users.nix
@ -6,14 +6,9 @@
 # - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
 # - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings

-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, authorizedKeysRepo, ... }:

 let
-  authorizedKeysRepo = pkgs.fetchgit {
-    url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys";
-    rev = "b6a29dc7af0a45a8c0b4904290c7cb0c5bc51413";
-    hash = "sha256-c0aH0wQeJtfXJG5wAbS6aO8yILLI1NNkFAHAeOm8RXA=";
-  };
  authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
 in
 {
--- a/config/hosts/eh22-wiki/dokuwiki.nix
+++ b/config/hosts/eh22-wiki/dokuwiki.nix
@ -21,7 +21,8 @@ let
  app = "dokuwiki";
  domain = "eh22.easterhegg.eu";
  dataDir = "/srv/www/${domain}";
-in {
+in
+{
  systemd.tmpfiles.rules = [
    "d ${dataDir} 0755 ${app} ${app}"
  ];
@ -76,7 +77,7 @@ in {
      default = true;
      enableACME = true;
      serverName = "${domain}";
-      
+
      listen = [
        {
          addr = "0.0.0.0";
--- a/config/hosts/mqtt/configuration.nix
+++ b/config/hosts/mqtt/configuration.nix
@ -1,10 +1,10 @@
 { ... }:

 {
-	networking = {
-        hostName = "mqtt";
-        domain = "z9.ccchh.net";
-	};
+  networking = {
+    hostName = "mqtt";
+    domain = "z9.ccchh.net";
+  };

-	system.stateVersion = "23.11";
-}
+  system.stateVersion = "23.11";
+}
--- a/config/hosts/mqtt/default.nix
+++ b/config/hosts/mqtt/default.nix
@ -1,9 +1,9 @@
 { pkgs, ... }:

 {
-	imports = [
-		./configuration.nix
-		./networking.nix
-		./mosquitto.nix
-	];
-}
+  imports = [
+    ./configuration.nix
+    ./networking.nix
+    ./mosquitto.nix
+  ];
+}
--- a/config/hosts/mqtt/mosquitto.nix
+++ b/config/hosts/mqtt/mosquitto.nix
@ -5,29 +5,29 @@
 { ... }:

 {
-    services.mosquitto = {
-        enable = true;
-        persistence = true;
+  services.mosquitto = {
+    enable = true;
+    persistence = true;

-        # set config for all listeners
-        listeners = [ {
-            settings.allow_anonymous = true;
-            omitPasswordAuth = true;
-            acl = ["topic readwrite #"];
-        } ];
+    # set config for all listeners
+    listeners = [{
+      settings.allow_anonymous = true;
+      omitPasswordAuth = true;
+      acl = [ "topic readwrite #" ];
+    }];

-        bridges.winkekatz = {
-            addresses = [
-                { address = "mqtt.winkekatze24.de"; }
-            ];
-            topics = [
-                "winkekatze/allcats/eye/set in 2"
-                "winkekatze/allcats in 2"
-                "+/status out 2 winkekatze/ \"\""
-                "+/connected out 2 winkekatze/ \"\""
-            ];
-        };
+    bridges.winkekatz = {
+      addresses = [
+        { address = "mqtt.winkekatze24.de"; }
+      ];
+      topics = [
+        "winkekatze/allcats/eye/set in 2"
+        "winkekatze/allcats in 2"
+        "+/status out 2 winkekatze/ \"\""
+        "+/connected out 2 winkekatze/ \"\""
+      ];
    };
+  };

-    networking.firewall.allowedTCPPorts = [ 1883 ];
-}
+  networking.firewall.allowedTCPPorts = [ 1883 ];
+}
--- a/config/hosts/nix-box-june/users.nix
+++ b/config/hosts/nix-box-june/users.nix
@ -26,7 +26,7 @@
    };
    yuri = {
      isNormalUser = true;
-      openssh.authorizedKeys.keys = [ 
+      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdk3FLQRoCWxdOxg4kHcPqAu3QQOs/rY9na2Al2ilGl yuri@violet"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJEvM35w+UaSpDTuaG5pGPgfHcfwscr+wSZN9Z5Jle82 yuri@kiara"
      ];
--- a/config/hosts/public-web-static/spaceapid-config/ccchh-response.json
+++ b/config/hosts/public-web-static/spaceapid-config/ccchh-response.json
@ -27,7 +27,7 @@
      },
      "calendar": {
        "type": "ical",
-        "url": "https://cloud.hamburg.ccc.de/remote.php/dav/public-calendars/QJAdExziSnNJEz5g/?export"
+        "url": "webcal://cloud.hamburg.ccc.de/remote.php/dav/public-calendars/QJAdExziSnNJEz5g/?export"
      }
    },
    "links": [
--- a/config/hosts/public-web-static/virtualHosts/c3cat.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/c3cat.de.nix
@ -1,10 +1,19 @@
 { pkgs, ... }:

-{
+let
+  domain = "c3cat.de";
+  dataDir = "/var/www/${domain}";
+  deployUser = "c3cat-website-deploy";
+in {
+  security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
+
  services.nginx.virtualHosts = {
-    "acme-c3cat.de" = {
+    "acme-${domain}" = {
      enableACME = true;
-      serverName = "c3cat.de";
+      serverName = "${domain}";
+      serverAliases = [
+        "www.${domain}"
+      ];

      listen = [
        {
@ -14,9 +23,9 @@
      ];
    };

-    "c3cat.de" = {
+    "$www.${domain}" = {
      forceSSL = true;
-      useACMEHost = "c3cat.de";
+      useACMEHost = "${domain}";

      listen = [
        {
@ -28,7 +37,7 @@
      ];

      locations."/" = {
-        return = "302 https://wiki.hamburg.ccc.de/club:c3cat:start";
+        return = "302 https://c3cat.de$request_uri";
      };

      extraConfig = ''
@ -42,5 +51,45 @@
        real_ip_header proxy_protocol;
      '';
    };
+
+    "${domain}" = {
+      forceSSL = true;
+      useACMEHost = "${domain}";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+          proxyProtocol = true;
+        }
+      ];
+
+      root = "${dataDir}";
+
+      extraConfig = ''
+        # Make use of the ngx_http_realip_module to set the $remote_addr and
+        # $remote_port to the client address and client port, when using proxy
+        # protocol.
+        # First set our proxy protocol proxy as trusted.
+        set_real_ip_from 172.31.17.140;
+        # Then tell the realip_module to get the addreses from the proxy protocol
+        # header.
+        real_ip_header proxy_protocol;
+      '';
+    };
  };
+
+  systemd.tmpfiles.rules = [
+    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
+  ];
+
+  users.users."${deployUser}" = {
+    isNormalUser = true;
+    group = "${deployUser}";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcZJzQO4RYinJm6YDUgCELe8OJA/DYOss+8xp7TtxM0 deploy key for c3cat.de"
+    ];
+  };
+  users.groups."${deployUser}" = { };
 }
--- a/config/hosts/public-web-static/virtualHosts/default.nix
+++ b/config/hosts/public-web-static/virtualHosts/default.nix
@ -9,6 +9,7 @@
    ./hackertours.hamburg.ccc.de.nix
    ./hamburg.ccc.de.nix
    ./spaceapi.hamburg.ccc.de.nix
+    ./staging.c3cat.de.nix
    ./staging.hacker.tours.nix
    ./staging.hackertours.hamburg.ccc.de.nix
    ./staging.hamburg.ccc.de.nix
--- a/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/element.hamburg.ccc.de.nix
@ -1,10 +1,10 @@
 { pkgs, ... }:

 let
-  elementWebVersion = "1.11.80";
+  elementWebVersion = "1.11.84";
  element-web = pkgs.fetchzip {
    url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
-    sha256 = "sha256-sudWmNehxGsbZTNirTkoWQ/Bln1DC1CI30wocw9VoH8=";
+    sha256 = "sha256-z2qaKKyUq2S/r3xUUU3ym0FgFbiQr6bcltuKvUMPbH4=";
  };
  elementSecurityHeaders = ''
    # Configuration best practices
--- a/config/hosts/public-web-static/virtualHosts/hacker.tours.nix
+++ b/config/hosts/public-web-static/virtualHosts/hacker.tours.nix
@ -4,7 +4,8 @@ let
  domain = "hacker.tours";
  dataDir = "/var/www/${domain}";
  deployUser = "hackertours-website-deploy";
-in {
+in
+{
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/hackertours.hamburg.ccc.de.nix
@ -4,7 +4,8 @@ let
  domain = "hackertours.hamburg.ccc.de";
  dataDir = "/var/www/${domain}";
  deployUser = "ht-ccchh-website-deploy";
-in {
+in
+{
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/default.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/default.nix
@ -1,4 +1,4 @@
-{...}:
+{ ... }:

 {
  imports = [
@ -9,4 +9,4 @@
    ./eh11.nix
    ./eh20.nix
  ];
-}
+}
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh03.nix
@ -6,7 +6,7 @@ let
    rev = "74977c56486cd060566bf06678a936e801952f9e";
    hash = "sha256-ded/NO+Jex2Sa4yWAIRpqANsv8i0vKmJSkM5r9KxaVk=";
  };
-in 
+in
 {
  security.acme.certs."eh03.easterhegg.eu".extraDomainNames = [
    "eh2003.hamburg.ccc.de"
@ -48,7 +48,7 @@ in
      }];

      locations."/".return = "302 https://eh03.easterhegg.eu";
-      
+
      extraConfig = ''
        # Make use of the ngx_http_realip_module to set the $remote_addr and
        # $remote_port to the client address and client port, when using proxy
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh05.nix
@ -48,7 +48,7 @@ in
      }];

      locations."/".return = "302 https://eh05.easterhegg.eu";
-      
+
      extraConfig = ''
        # Make use of the ngx_http_realip_module to set the $remote_addr and
        # $remote_port to the client address and client port, when using proxy
@ -60,7 +60,7 @@ in
        real_ip_header proxy_protocol;
      '';
    };
-    
+
    "eh05.easterhegg.eu" = {
      forceSSL = true;
      useACMEHost = "eh05.easterhegg.eu";
@ -71,7 +71,7 @@ in
        ssl = true;
        proxyProtocol = true;
      }];
-      
+
      locations."/" = {
        index = "index.shtml";
        root = eh05;
@ -80,7 +80,7 @@ in
          default_type text/html;
          # Enable SSI
          ssi on;
-        ''; 
+        '';
      };

      extraConfig = ''
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh07.nix
@ -54,7 +54,7 @@ in
      }];

      locations."/".return = "302 https://eh07.easterhegg.eu";
-      
+
      extraConfig = ''
        # Make use of the ngx_http_realip_module to set the $remote_addr and
        # $remote_port to the client address and client port, when using proxy
@ -86,7 +86,7 @@ in
          default_type text/html;
          # Enable SSI
          ssi on;
-        ''; 
+        '';
      };

      extraConfig = ''
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh09.nix
@ -54,7 +54,7 @@ in
      }];

      locations."/".return = "302 https://eh09.easterhegg.eu";
-      
+
      extraConfig = ''
        # Make use of the ngx_http_realip_module to set the $remote_addr and
        # $remote_port to the client address and client port, when using proxy
@ -86,7 +86,7 @@ in
          default_type text/html;
          # Enable SSI
          ssi on;
-        ''; 
+        '';
      };
      extraConfig = ''
        # Make use of the ngx_http_realip_module to set the $remote_addr and
--- a/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix
+++ b/config/hosts/public-web-static/virtualHosts/historic-easterhegg/eh11.nix
@ -54,7 +54,7 @@ in
      }];

      locations."/".return = "302 https://eh11.easterhegg.eu";
-      
+
      extraConfig = ''
        # Make use of the ngx_http_realip_module to set the $remote_addr and
        # $remote_port to the client address and client port, when using proxy
@ -86,7 +86,7 @@ in
          default_type text/html;
          # Enable SSI
          ssi on;
-        ''; 
+        '';
      };

      extraConfig = ''
--- a/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.c3cat.de.nix
@ -0,0 +1,60 @@
+{ pkgs, ... }:
+
+let
+  domain = "staging.c3cat.de";
+  dataDir = "/var/www/${domain}";
+  deployUser = "c3cat-website-deploy";
+in {
+  services.nginx.virtualHosts = {
+    "acme-${domain}" = {
+      enableACME = true;
+      serverName = "${domain}";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 31820;
+        }
+      ];
+    };
+
+    "${domain}" = {
+      forceSSL = true;
+      useACMEHost = "${domain}";
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+          proxyProtocol = true;
+        }
+      ];
+
+      root = "${dataDir}";
+
+      # Disallow *, since this is staging and doesn't need to be in any search
+      # results.
+      locations."/robots.txt" = {
+        return = "200 \"User-agent: *\\nDisallow: *\\n\"";
+      };
+
+      extraConfig = ''
+        # Make use of the ngx_http_realip_module to set the $remote_addr and
+        # $remote_port to the client address and client port, when using proxy
+        # protocol.
+        # First set our proxy protocol proxy as trusted.
+        set_real_ip_from 172.31.17.140;
+        # Then tell the realip_module to get the addreses from the proxy protocol
+        # header.
+        real_ip_header proxy_protocol;
+      '';
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${dataDir} 0755 ${deployUser} ${deployUser}"
+  ];
+
+  # c3cat deploy user already defined in c3cat.de.nix.
+}
--- a/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.hacker.tours.nix
@ -4,7 +4,8 @@ let
  domain = "staging.hacker.tours";
  dataDir = "/var/www/${domain}";
  deployUser = "hackertours-website-deploy";
-in {
+in
+{
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.hackertours.hamburg.ccc.de.nix
@ -4,7 +4,8 @@ let
  domain = "staging.hackertours.hamburg.ccc.de";
  dataDir = "/var/www/${domain}";
  deployUser = "ht-ccchh-website-deploy";
-in {
+in
+{
  services.nginx.virtualHosts = {
    "acme-${domain}" = {
      enableACME = true;
--- a/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix
+++ b/config/hosts/woodpecker/woodpecker-agent/woodpecker-agent.nix
@ -3,13 +3,12 @@
 # - https://woodpecker-ci.org/docs/administration/agent-config
 # - https://woodpecker-ci.org/docs/administration/backends/docker

-{ config, pkgs, pkgs-unstable, ... }:
+{ config, pkgs, ... }:

 {
  services.woodpecker-agents.agents."docker" = {
    enable = true;
-    # Since we use woodpecker-server from unstable, use the agent from unstable as well.
-    package = pkgs-unstable.woodpecker-agent;
+    package = pkgs.woodpecker-agent;
    extraGroups = [ "docker" ];
    environment = {
      WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
--- a/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix
+++ b/config/hosts/woodpecker/woodpecker-server/woodpecker-server.nix
@ -5,14 +5,12 @@
 # - https://woodpecker-ci.org/docs/administration/forges/forgejo
 # - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING

-{ config, pkgs, pkgs-unstable, ... }:
+{ config, pkgs, ... }:

 {
  services.woodpecker-server = {
    enable = true;
-    # Use package from unstable to get at least version 2.6.0 for native Forgejo support.
-    # https://github.com/woodpecker-ci/woodpecker/releases/tag/v2.6.0
-    package = pkgs-unstable.woodpecker-server;
+    package = pkgs.woodpecker-server;
    environment = {
      WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
      WOODPECKER_SERVER_ADDR = ":8001";
@ -24,6 +22,7 @@
      WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
      WOODPECKER_FORGEJO = "true";
      WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
+      WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB
      # Set via enviornmentFile:
      # WOODPECKER_FORGEJO_CLIENT
      # WOODPECKER_FORGEJO_SECRET
--- a/config/hosts/yate/service.nix
+++ b/config/hosts/yate/service.nix
@ -6,16 +6,16 @@
    description = "Yate telehony engine";
    unitConfig = {
      Type = "simple";
-      After="network.target";
+      After = "network.target";
    };
    serviceConfig = {
      ExecStart = "${pkgs.yate}/bin/yate -c /yate -e /yate/share -Do";
-      Type="simple";
-      Restart="always";
+      Type = "simple";
+      Restart = "always";
      # ...
    };
    wantedBy = [ "default.target" ];
-    requiredBy = [ "network.target" ]; 
+    requiredBy = [ "network.target" ];
    # ...
  };
 }
--- a/flake.lock
+++ b/flake.lock
@ -1,12 +1,26 @@
 {
  "nodes": {
+    "authorizedKeysRepo": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731276342,
+        "narHash": "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=",
+        "rev": "686a6af22f6696f0c0595c56f463c078550049fc",
+        "type": "tarball",
+        "url": "https://git.hamburg.ccc.de/api/v1/repos/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz?rev=686a6af22f6696f0c0595c56f463c078550049fc"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz"
+      }
+    },
    "nixlib": {
      "locked": {
-        "lastModified": 1729386149,
-        "narHash": "sha256-hUP9oxmnOmNnKcDOf5Y55HQ+NnoT0+bLWHLQWLLw9Ks=",
+        "lastModified": 1731200463,
+        "narHash": "sha256-qDaAweJjdFbVExqs8aG27urUgcgKufkIngHW3Rzustg=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "cce4521b6df014e79a7b7afc58c703ed683c916e",
+        "rev": "e04234d263750db01c78a412690363dc2226e68a",
        "type": "github"
      },
      "original": {
@ -18,16 +32,14 @@
    "nixos-generators": {
      "inputs": {
        "nixlib": "nixlib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1729472750,
-        "narHash": "sha256-s93LPHi5BN7I2xSGNAFWiYb8WRsPvT1LE9ZjZBrpFlg=",
+        "lastModified": 1731546190,
+        "narHash": "sha256-kJix8nLyFIJ3EC7VtoXK/85C4ZN2dC5oWoS8+ErehqI=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "7c60ba4bc8d6aa2ba3e5b0f6ceb9fc07bc261565",
+        "rev": "06ffce1a8d95e95c06a4bcfa117dd960b14a7101",
        "type": "github"
      },
      "original": {
@ -38,11 +50,27 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1730428893,
-        "narHash": "sha256-fLLUd2dO/Vnf96UDr8YPzerYi+n99l3S5yIUDnmcPBE=",
+        "lastModified": 1731245184,
+        "narHash": "sha256-vmLS8+x+gHRv1yzj3n+GTAEObwmhxmkkukB2DwtJRdU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "aebe249544837ce42588aa4b2e7972222ba12e8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1731842749,
+        "narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "38edd08881ce4dc24056eec173b43587a93c990f",
+        "rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682",
        "type": "github"
      },
      "original": {
@ -52,43 +80,11 @@
        "type": "github"
      }
    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1729973466,
-        "narHash": "sha256-knnVBGfTCZlQgxY1SgH0vn2OyehH9ykfF8geZgS95bk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "cd3e8833d70618c4eea8df06f95b364b016d4950",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1730449684,
-        "narHash": "sha256-Hlv3rTPxnO+DpKRXw9yjzERLdk05h7+fEbZxWM2taCw=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ab464abbeb3a2833288c6e907488c49c2e599f88",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
+        "authorizedKeysRepo": "authorizedKeysRepo",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs": "nixpkgs_2",
        "sops-nix": "sops-nix"
      }
    },
@ -96,15 +92,14 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
+        ]
      },
      "locked": {
-        "lastModified": 1729999681,
-        "narHash": "sha256-qm0uCtM9bg97LeJTKQ8dqV/FvqRN+ompyW4GIJruLuw=",
+        "lastModified": 1731862312,
+        "narHash": "sha256-NVUTFxKrJp/hjehlF1IvkPnlRYg/O9HFVutbxOM8zNM=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "1666d16426abe79af5c47b7c0efa82fd31bf4c56",
+        "rev": "472741cf3fee089241ac9ea705bb2b9e0bfa2978",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -6,13 +6,12 @@
    # https://nixos.org/manual/nixos/stable/#sec-upgrading
    # https://github.com/NixOS/nixpkgs
    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";

    # Add nixos-generators as an input.
    # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
    nixos-generators = {
      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgs";
+      #inputs.nixpkgs.follows = "nixpkgs";
    };

    # Add sops-nix as an input for secret management.
@ -21,214 +20,225 @@
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+
+    authorizedKeysRepo = {
+      url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz";
+      flake = false;
+    };
  };

-  outputs = { self, nixpkgs, nixpkgs-unstable, nixos-generators, sops-nix, ... }:
+  outputs = { self, nixpkgs, nixos-generators, sops-nix, authorizedKeysRepo, ... }:
    let
-      system = "x86_64-linux";
-      shairportSync431ExtendedNixpkgsUnstableOverlay = final: prev: {
-        shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
-          # See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
-          configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
-          buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
-        });
+      specialArgs = {
+        inherit authorizedKeysRepo;
      };
-      pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
+      system = "x86_64-linux";
    in
    {
+      overlays = {
+        shairportSyncAirplay2 = final: prev: {
+          shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
+            # See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
+            configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
+            buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
+          });
+        };
+      };
+      nixosModules = {
+        common = ./config/common;
+        proxmox-vm = ./config/proxmox-vm;
+        prometheus-exporter = ./config/extra/prometheus-exporter.nix;
+      };
      nixosConfigurations = {
        audio-hauptraum-kueche = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
-            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
            ./config/hosts/audio-hauptraum-kueche
          ];
        };

        audio-hauptraum-tafel = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
-            { nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            { nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
            ./config/hosts/audio-hauptraum-tafel
          ];
        };

        esphome = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            ./config/hosts/esphome
          ];
        };

        public-reverse-proxy = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            ./config/hosts/public-reverse-proxy
          ];
        };

        netbox = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/netbox
          ];
        };

        matrix = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/matrix
          ];
        };

        public-web-static = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/public-web-static
          ];
        };

        git = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/git
          ];
        };

        forgejo-actions-runner = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/forgejo-actions-runner
          ];
        };

        ptouch-print-server = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            ./config/hosts/ptouch-print-server
          ];
        };

        eh22-wiki = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            self.nixosModules.prometheus-exporter
            ./config/hosts/eh22-wiki
          ];
        };

        nix-box-june = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            self.nixosModules.prometheus-exporter
            ./config/hosts/nix-box-june
          ];
        };

        yate = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            ./config/hosts/yate
          ];
        };

        mqtt = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            ./config/hosts/mqtt
          ];
        };

        mjolnir = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/mjolnir
          ];
        };

        woodpecker = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/woodpecker
          ];
-          specialArgs = {
-            inherit pkgs-unstable;
-          };
        };

        status = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
            ./config/hosts/status
          ];
        };

        penpot = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
            sops-nix.nixosModules.sops
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.prometheus-exporter
            ./config/hosts/penpot
          ];
        };

        hydra = nixpkgs.lib.nixosSystem {
-          inherit system;
+          inherit system specialArgs;
          modules = [
-            ./config/common
-            ./config/proxmox-vm
-            ./config/extra/prometheus-exporter.nix
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
+            self.nixosModules.prometheus-exporter
            ./config/hosts/hydra
          ];
        };
@ -236,22 +246,24 @@

      packages.x86_64-linux = {
        proxmox-nixos-template = nixos-generators.nixosGenerate {
+          inherit specialArgs;
          system = "x86_64-linux";
          modules = [
            ./config/nixos-generators/proxmox.nix
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
          ];
          format = "proxmox";
        };

        proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
+          inherit specialArgs;
          system = "x86_64-linux";
          modules = [
            ./config/nixos-generators/proxmox-chaosknoten.nix
            ./config/proxmox-chaosknoten-additional-initial-config.nix
-            ./config/common
-            ./config/proxmox-vm
+            self.nixosModules.common
+            self.nixosModules.proxmox-vm
          ];
          format = "proxmox";
        };
Author	SHA1	Message	Date
christian	c78c278627	Set WOODPECKER_LIMIT_MEM to 6 GB for woodpecker so pipelines don't get killed by OOM.	2024-11-17 22:43:51 +01:00
jopejoe1	e3c677ea9b	fix: use tar file	2024-11-17 21:15:05 +01:00
christian	ecd9fe4adf	fix: use http clone url from forgejo	2024-11-17 21:06:27 +01:00
jopejoe1	2003367108	move authorized keys to flake input	2024-11-17 20:33:38 +01:00
christian	53e33a6641	flake.lock: Update Flake lock file updates: • Updated input 'nixos-generators': 'github:nix-community/nixos-generators/7c60ba4bc8d6aa2ba3e5b0f6ceb9fc07bc261565' (2024-10-21) → 'github:nix-community/nixos-generators/06ffce1a8d95e95c06a4bcfa117dd960b14a7101' (2024-11-14) • Updated input 'nixos-generators/nixlib': 'github:nix-community/nixpkgs.lib/cce4521b6df014e79a7b7afc58c703ed683c916e' (2024-10-20) → 'github:nix-community/nixpkgs.lib/e04234d263750db01c78a412690363dc2226e68a' (2024-11-10) • Updated input 'nixos-generators/nixpkgs': follows 'nixpkgs' → 'github:NixOS/nixpkgs/aebe249544837ce42588aa4b2e7972222ba12e8f' (2024-11-10) • Updated input 'nixpkgs': 'github:nixos/nixpkgs/11f65b4b0405cff5b54c813626bddcf5435d7ad2' (2024-11-09) → 'github:nixos/nixpkgs/bf6132dc791dbdff8b6894c3a85eb27ad8255682' (2024-11-17) • Updated input 'sops-nix': 'github:Mic92/sops-nix/f1675e3b0e1e663a4af49be67ecbc9e749f85eb7' (2024-11-10) → 'github:Mic92/sops-nix/472741cf3fee089241ac9ea705bb2b9e0bfa2978' (2024-11-17) • Removed input 'sops-nix/nixpkgs-stable'	2024-11-17 20:25:16 +01:00
jopejoe1	e404d4740f	remove nixpkgs-unstable the current version of woodpecker-server in stable now has the features this was original used for, not other usages of unstable are in tree left so removing it.	2024-11-17 19:33:00 +01:00
jopejoe1	f7ebe660fe	format files with `nix fmt`	2024-11-17 19:33:00 +01:00
jopejoe1	6c85b91efb	make use of nixosModules output	2024-11-17 19:33:00 +01:00
jopejoe1	7d58a3db4a	move overlay to overlays output	2024-11-17 19:32:59 +01:00
christian	c25d6c6326	revert: useing pkgs.fetchGit for authorized keys reverts the changes from `ec64eebfd6` it brakes some of the flake process we use, setting 'allow-import-from-derivation' doesn't seem like a good fix to me and doesn't work in all cases. I couldn't find any other solution to fix it for now, so we will revert it for now, until we have a better solution.	2024-11-17 19:24:25 +01:00
June	d98aa099e1	license this repo under the MIT license All previous contributors are asked to sign off on licensing this repo under the MIT license in PR 12 (#12). Once all contributors signed-off, this commit will be merged into the main branch and this repo will be licensed under the MIT license. Don't track copyright years in the license, as that is cumbersome and also not done in other projects anymore: https://daniel.haxx.se/blog/2023/01/08/copyright-without-years/ https://github.com/rails/rails/pull/47467 MIT License: https://opensource.org/license/MIT https://choosealicense.com/licenses/mit/	2024-11-14 22:56:50 +01:00
June	cf46da9df7	public-web-static: make c3cat.de and www work as well as staging	2024-11-12 23:06:01 +01:00
fi	c84d9e7d0a	Update element to 1.11.84	2024-11-11 02:43:08 +01:00
christian	33b2cbf5d0	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs': 'github:nixos/nixpkgs/38edd08881ce4dc24056eec173b43587a93c990f' (2024-11-01) → 'github:nixos/nixpkgs/11f65b4b0405cff5b54c813626bddcf5435d7ad2' (2024-11-09) • Updated input 'nixpkgs-unstable': 'github:nixos/nixpkgs/ab464abbeb3a2833288c6e907488c49c2e599f88' (2024-11-01) → 'github:nixos/nixpkgs/8aed22ecd71e5b67e5299efae8b9dc580dec711c' (2024-11-10) • Updated input 'sops-nix': 'github:Mic92/sops-nix/1666d16426abe79af5c47b7c0efa82fd31bf4c56' (2024-10-27) → 'github:Mic92/sops-nix/f1675e3b0e1e663a4af49be67ecbc9e749f85eb7' (2024-11-10) • Updated input 'sops-nix/nixpkgs-stable': 'github:NixOS/nixpkgs/cd3e8833d70618c4eea8df06f95b364b016d4950' (2024-10-26) → 'github:NixOS/nixpkgs/3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c' (2024-11-03)	2024-11-10 23:14:58 +01:00
christian	afb4fc71ce	Update infrastructure-authorized-keys rev	2024-11-10 23:10:50 +01:00