From 121dd0a1ec96947e2a97c7bb7ebdb63f51d514c2 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 9 Jun 2026 21:42:26 +0200 Subject: [PATCH 1/9] add ueberwachungs-frei kundgebung site --- .../virtualHosts/default.nix | 1 + .../ueberwachungsfrei-kundgebung.nix | 77 +++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index d1c1355..61008d2 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -27,5 +27,6 @@ ./diday.org.nix ./staging.diday.org.nix ./historic-easterhegg + ./ueberwachungsfrei-kundgebung.nix ]; } diff --git a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix new file mode 100644 index 0000000..ddc5182 --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix @@ -0,0 +1,77 @@ +{ pkgs, ... }: + +let + domain = "ueberwachungsfrei-kundgebung.hamburg.ccc.de"; + dataDir = "/var/www/${domain}"; + deployUser = "ueberwachungsfrei-deploy"; +in { + # TODO: Add proper domain once that is available + security.acme.certs."${domain}".extraDomainNames = [ ]; + + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + serverAliases = [ + # TODO: Add proper domains here too + ]; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + # TODO: Maybe add a deploy key if we want CI/CD + ]; + }; + users.groups."${deployUser}" = { }; +} From 0f22b1158ecbac1c6977e7729addaf637b2b34da Mon Sep 17 00:00:00 2001 From: lilly Date: Thu, 11 Jun 2026 14:45:19 +0200 Subject: [PATCH 2/9] move ueberwachungsfrei kundgebung page to own domain --- .../virtualHosts/ueberwachungsfrei-kundgebung.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix index ddc5182..ce87788 100644 --- a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix +++ b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix @@ -1,19 +1,20 @@ { pkgs, ... }: let - domain = "ueberwachungsfrei-kundgebung.hamburg.ccc.de"; + domain = "ueberwachungsfrei.eu"; dataDir = "/var/www/${domain}"; deployUser = "ueberwachungsfrei-deploy"; in { - # TODO: Add proper domain once that is available - security.acme.certs."${domain}".extraDomainNames = [ ]; + security.acme.certs."${domain}".extraDomainNames = [ + "xn--berwachungsfrei-yvb.eu" + ]; services.nginx.virtualHosts = { "acme-${domain}" = { enableACME = true; serverName = "${domain}"; serverAliases = [ - # TODO: Add proper domains here too + "xn--berwachungsfrei-yvb.eu" ]; listen = [ @@ -31,6 +32,10 @@ in { "${domain}" = { forceSSL = true; useACMEHost = "${domain}"; + serverAliases = [ + "überwachungsfrei.eu" + "xn--berwachungsfrei-yvb.eu" + ]; listen = [ { From 8d41dcf7ca3e4e4bccce9c3045bc95f6ff6e2b70 Mon Sep 17 00:00:00 2001 From: June Date: Fri, 3 Jul 2026 04:10:27 +0200 Subject: [PATCH 3/9] remove forgejo-actions-runner (replaced by ansible-infra host) --- .../forgejo-actions-runner/configuration.nix | 10 -- .../hosts/forgejo-actions-runner/default.nix | 11 -- .../hosts/forgejo-actions-runner/docker.nix | 16 -- .../forgejo-actions-runner.nix | 66 -------- .../forgejo-actions-runner/networking.nix | 27 ---- .../hosts/forgejo-actions-runner/secrets.yaml | 149 ------------------ config/hosts/forgejo-actions-runner/sops.nix | 7 - flake.nix | 14 -- 8 files changed, 300 deletions(-) delete mode 100644 config/hosts/forgejo-actions-runner/configuration.nix delete mode 100644 config/hosts/forgejo-actions-runner/default.nix delete mode 100644 config/hosts/forgejo-actions-runner/docker.nix delete mode 100644 config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix delete mode 100644 config/hosts/forgejo-actions-runner/networking.nix delete mode 100644 config/hosts/forgejo-actions-runner/secrets.yaml delete mode 100644 config/hosts/forgejo-actions-runner/sops.nix diff --git a/config/hosts/forgejo-actions-runner/configuration.nix b/config/hosts/forgejo-actions-runner/configuration.nix deleted file mode 100644 index 713e795..0000000 --- a/config/hosts/forgejo-actions-runner/configuration.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ config, pkgs, ... }: - -{ - networking = { - hostName = "forgejo-actions-runner"; - domain = "hosts.hamburg.ccc.de"; - }; - - system.stateVersion = "23.11"; -} diff --git a/config/hosts/forgejo-actions-runner/default.nix b/config/hosts/forgejo-actions-runner/default.nix deleted file mode 100644 index f5a8ddd..0000000 --- a/config/hosts/forgejo-actions-runner/default.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ ... }: - -{ - imports = [ - ./configuration.nix - ./docker.nix - ./forgejo-actions-runner.nix - ./networking.nix - ./sops.nix - ]; -} diff --git a/config/hosts/forgejo-actions-runner/docker.nix b/config/hosts/forgejo-actions-runner/docker.nix deleted file mode 100644 index 043f272..0000000 --- a/config/hosts/forgejo-actions-runner/docker.nix +++ /dev/null @@ -1,16 +0,0 @@ -# Sources for this configuration: -# - https://nixos.wiki/wiki/Docker -{ config, pkgs, ... }: - -{ - virtualisation.docker = { - enable = true; - autoPrune = { - enable = true; - dates = "weekly"; - }; - daemon.settings = { - ipv6 = true; - }; - }; -} diff --git a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix b/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix deleted file mode 100644 index 2efeefe..0000000 --- a/config/hosts/forgejo-actions-runner/forgejo-actions-runner.nix +++ /dev/null @@ -1,66 +0,0 @@ -# Sources for this configuration: -# - https://forgejo.org/docs/latest/admin/actions/ -# - https://forgejo.org/docs/latest/user/actions/ -# - https://docs.gitea.com/next/usage/actions/act-runner - -{ config, pkgs, ... }: - -{ - services.gitea-actions-runner = { - package = pkgs.forgejo-runner; - instances.ccchh-forgejo-global-docker = { - enable = true; - name = "Global Docker Forgejo Actions Runner"; - url = "https://git.hamburg.ccc.de/"; - tokenFile = "/run/secrets/forgejo_actions_runner_registration_token"; - labels = [ "docker:docker://node:current-bookworm" ]; - settings = { - container = { - enable_ipv6 = true; - }; - cache = { - proxy_port = 45540; - }; - runner = { - capacity = 4; - }; - }; - }; - - instances.ccchh-codeberg-org-diday = { - enable = true; - name = "ccchh runner for codeberg.org/di-day"; - url = "https://codeberg.org/"; - tokenFile = "/run/secrets/codeberg_org_diday_runner_registration_token"; - labels = [ - "docker:docker://node:current-bookworm" - "debian-latest:docker://node:current-bookworm" - "alpine-latest:docker://node:current-alpine" - ]; - settings = { - container = { - enable_ipv6 = true; - }; - cache = { - proxy_port = 45541; - }; - runner = { - capacity = 4; - }; - }; - }; - }; - - sops.secrets."forgejo_actions_runner_registration_token" = { - mode = "0440"; - owner = "root"; - group = "root"; - restartUnits = [ "gitea-runner-ccchh\\x2dforgejo\\x2dglobal\\x2ddocker.service" ]; - }; - sops.secrets."codeberg_org_diday_runner_registration_token" = { - mode = "0440"; - owner = "root"; - group = "root"; - restartUnits = [ "gitea-runner-ccchh\\x2dcodeberg\\x2dorg\\x2ddiday.service" ]; - }; -} diff --git a/config/hosts/forgejo-actions-runner/networking.nix b/config/hosts/forgejo-actions-runner/networking.nix deleted file mode 100644 index 0c09eda..0000000 --- a/config/hosts/forgejo-actions-runner/networking.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ lib, config, ... }: -let - runnerInstances = lib.attrValues config.services.gitea-actions-runner.instances; - runnerCachePorts = lib.map (i: i.settings.cache.proxy_port) runnerInstances; -in { - networking = { - interfaces.net0 = { - ipv6.addresses = [ - { - address = "2a00:14b0:42:102::18"; - prefixLength = 64; - } - ]; - }; - defaultGateway6 = "2a00:14b0:42:102::1"; - nameservers = [ "212.12.50.158" "192.76.134.90" ]; - search = [ "hamburg.ccc.de" ]; - }; - - systemd.network.links."10-net0" = { - matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE"; - linkConfig.Name = "net0"; - }; - - # open ports for runner cache proxy so that we can use the cache action - networking.firewall.allowedTCPPorts = runnerCachePorts; -} diff --git a/config/hosts/forgejo-actions-runner/secrets.yaml b/config/hosts/forgejo-actions-runner/secrets.yaml deleted file mode 100644 index 79df4d5..0000000 --- a/config/hosts/forgejo-actions-runner/secrets.yaml +++ /dev/null @@ -1,149 +0,0 @@ -forgejo_actions_runner_registration_token: ENC[AES256_GCM,data:gAR2ffrffeuuaOwO6mWcif2e6csKIVoLqrux19iBlrTkFHgo/IlHVL0eSUGqnw==,iv:i12yx/quwT9kj6fPECszo/iG9cVhKX+7dAA6/N09URc=,tag:eO+mWhumgvWzQxYqiRUXbA==,type:str] -codeberg_org_diday_runner_registration_token: ENC[AES256_GCM,data:thTsLo/eXVPbXt4b8ldae+kGnOR4GbYKOqr1hVJgaL7wZ5GgqWSPcOuhow96Jw==,iv:Fzi+DsKj+4PrwQGEosUntm9l7s78NwzhkmF6e/sfF+s=,tag:oa7mnbGR0J5xi9ruCgRJtQ==,type:str] -sops: - age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZEpMZkt6OU5nMEtYcHc0 - OGdsVDZBcE5nK2ZLbDhaWEVMM2lJcllLVnlzCmNUTXpaVHBLMjlILzJwdDFLMVky - ZXdEVmE3aTFMZDJnQ2tqWGRMb1NnZUkKLS0tIDhGWGpoYWNtL24wRnVRejQ5ZkVN - YjZFMTh3OTNkOUE0SmZTQXpKSmdGWlEK+Xb6blAdiWoKvffLEQagu5tFpWALJaXm - F65M+RNNkJ/YsSJGAWFJepw3ncCMFbmQgGXw5XnyqTlYFhrQ8x5qJg== - -----END AGE ENCRYPTED FILE----- - - recipient: age10xz2l7ghul7023awcydf4q3wurmszy2tafnadlarj0tvm7kl033sjw5f8t - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQblJIdFAwOFRqbWEvQzVF - ODVpQ04xTVpxTERGU3BOMjV4KytBU21neEYwCmoraHhlNjhDelAzR0VxcVNlekhT - QkI5ckd1dVFjMHBoTVFTQjlzbTdnTzgKLS0tIGlTY1p0bWxrQWoyM0RwSmx1aDhy - TklLZWM0cDBKaGJJM2tQQWRLZXhFYU0Ko7cyvzMvwlGCCP3UAX1+5uTI4srhZ5l9 - DPaHySiC+rLy+8R9UqEuTKbP4/Aw4NZ/UcfjNnVkqqqNJIODmLoOhg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-18T09:51:37Z" - mac: ENC[AES256_GCM,data:4fWsE3U6WxRqlKHKC4ipE+RQ7MPjiZZcTFMSblxty7JjJHAdKUHbthFB+R8gIWxZEjX5WG+IPgUP+AcCLSI9fdcXMqIFMuDun2hiktwqxzLPGYAoCXdTBAd1uCUagvB/rFty6y8umD4J5ITgEGba9pvGdUcng9WVRV+LGDftS1g=,iv:tD9tlcylQWapNCARxPXrKofZXf2BHTt2c4PQqFNj6X8=,tag:pQ8lOqJEFCcCcJot3BYTmQ==,type:str] - pgp: - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAz5uSgHG2iMJAQ/7BFboCbCEG1DY5Twf+1cRSAmXs8CSrnoJcmyxrF9daqTB - GAqItZcym6I7YbtYMb33jTZDAMFcexvJ+V7+WVBK/v/TISzinJ3m5BafE0DrgsB5 - HQT8tsFzxIdu/KsUp0C5VQg6gsb2u2T7aFG0wTS4vas2FjcsoJRKNWTv7a1sNWYZ - dFRxeyklWEX14kCHeKIxO7+Qe3NVV+6MuwYR8X3YJaAyLtVMIdBp/poE+7Gcsa58 - rOewheWW/FROTxLZIk3sren6z7M0ZrOz5res2evRDMI9noN3pYMnkNCL/XIvRf9U - GqFSruzDoC0a2JcEvSmthSmEHA6wXeOY/EuzXKLoW4luZDsSXshFgBxK0qqGvzbd - jIXXYvBWPCMYWRMSqQenLkjfhOQXuSXcywGfKpuQblUL8RiflIqia2o68Vbd9Hq4 - x9Od+qkauMHZUzsKQoym9pkbrEWpjckg6FevZ1W4o5Qhe9i+JMmE2KIvoYH8tK9F - 5KQ87jktx4i9df9TJy3n/xbbrWXpo76y5Aoa2LaiD9Nc6lo7sFs3Pegq4wKmYSIh - 6uaZxa5sto/5kywHrJQGqEyh/fDdNmsh5FlDW7gfFEm9Ti2KSE3m9IvIwppFD4j0 - xFkHiwHvNn/WMLciVh9qG8auGyxjoXnRRx61QHF31RIYprxWgDoyH/rVz95IuxzS - XgEIJk7MnHv9tYCy/lOjbgqLAUGO0+xuO+IfmsvtiD4nfrnaEJAh0+SW3wuCKzaF - tx1ZHCYH9j3s50Q624pUgtzDad5QV5IIEgCRyr0NvEvrXvG6U0aXkOEbOcFSZsk= - =v3FY - -----END PGP MESSAGE----- - fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAw5vwmoEJHQ1AQ/9H+Kn4rF7yUsIdTp5rYhG6EkYkJ/jCeUBJvaOuA95b8HM - 6csTXj+ttVcFvbU1hQVbOsd7J8Wpmuj/TqMrpFvu/0EYUW5n04y1YI8kpNXDMrFF - X/0gk+I+w2eF2X3gJQasVY39DNx56KSRJ0BwGYw287rdeKh8cbiFw64r0rs6zX5j - 2nqrWgSqxXtWcjhC7Y4Rq8ysWv7dEF2E9Tt2cHYVjn5cs9Vb52PWUA0TxzBzUUqa - M1YWat3fwLah6qEs6/9c89LB66SbgH088lEzQHtRIXdOZ9tPOu7/E3iNqYExuIKB - eMV0bdW0/tZlnWxAwXrL4rptxjGDqB+Ynv36IeLKZ86ljqSPqaQA7ihCVXnMo2TW - IfdlbOtAJiE3IliQf8C1Ajyn32epePBAUyw8o0k2D6UyNyvk8fe0z9++H6Uz+Z7G - oLRrxzOHjh6oWK9WBwJQhZ9dnb1n1UYZfvCDwFZBTmUkhIs6UQllIiF5ZjMy4/cc - E3FEouu/6VPPjq9d8pGEFcjOvXkLtUErhXP+A8Xvl/fHmtfM0/o1e6gPnMmxGn4k - 0yXvU+pNO/ID6fc6qMs0nBZRAKGraaeH+wTjpm1exUhhNB2yJviySnElJFyq9vtr - AfacrbuW//JQ+19rSKViV9xStRG//xfW7EpknOh3juB7WfnyOXqdfZqT2zQwrvjS - XgEoHXmbR7aiDvBCc4CGTmBhWD4An+p3m3m7iSOp27kBqJ3+YSKdVA7mdIo0tpTn - 9p5Pgz6GHBA5eMwZCb/z3Y7+20PuuEb4/tEBAniw9/Rp0sDJ+9C+V1SdHtbYq8k= - =kkQW - -----END PGP MESSAGE----- - fp: 87AB00D45D37C9E9167B5A5A333448678B60E505 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hF4DerEtaFuTeewSAQdAdgME/v0CVfcRZ1zr9SRZksN7vDHDk63g+5k5a/FOvmow - 0l/6kH1l7p4aOKaAGFbMHzDzljuACB1a4IOJypRA2DokYWRUgqBKwvcHplgXr4l0 - 0l4B2vxPl9W1kcbAg4m+V4PlvXTBGhPUglljtjWy80TisUL1zCXpl3PEvmrypZs7 - NM47K09RsDiicwTKjxd0Oii2Evz8riLFIth8IWOKXPHoKhiYwN891g1qLSvsrDzE - =6B/b - -----END PGP MESSAGE----- - fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAxjNhCKPP69fARAAjz8RObyKYVAmNwiBsNVNGt0qSIexSYpsMR5SyuBMKShJ - NSD4yA6B7Tj+h/ik4VyggOT+9Qfr7zFvFyEHYFXI7k/r+Noyw4uscqr9gNnz0t9N - rx4/ZNowsW/3dL+Gab3hjDKObHF41Y1lzojNwcieU8qZmssHZMjIIzyAUePL210f - 2i87hix9PkK6kKuisORDShnFifEOEPOcijXFL4kH9DilVoZ0Ut5fJoiA+QkQQpaa - uHd+Q7F6u9jZrzRLN1SJkb76ElxQAvJYcgTN2s3+c4002DkKVdwCW0qyPlF9wOxT - xTngl46NyZ1MH3ByW2xeOgaDYUcBt8qUF4gTMmIaDTIZ+K5XWGu3hmCzNZHD5Nxi - bhVKJ8jGENUhM/IfT8CjppRIg5wwU0K/EQE/QQHhIykpz9NaIjikDCxcraBa9DkA - rgjp74W9vgR3pBwXJIAsylOZZHy+35rca/JvWWxm2tdeao2WxTA9jdsNdsUOhNyz - 3xQGGM63ZSUcV0ZgCyhEYeKBzCyRWpFX+GQHboZDp7IaYK68qYZgxnQtoSwl3lJR - Qc1IaADnncIDyGEIDTciLbjbDx7TId4wrpRWUPxVY2FVY+hV+oRNaoYMuT2jiDVw - PimQ5iVUhl/ThHWPLqok6d3ypROZtVS6EUFzd4ASUrYRYB5Twvoujr7Yg7jSZV/S - XgFcxQ31/i/Vi9owjwX7u0/eclU/3XE2/MqUCcoMntnq2dCN/IpF3rROit5Tzs+W - BT7i57cpGh9ZXf1dbNSyRwydp/C8tjnwDqf3RJ5hj4fmlK6zLJqtPFPdusOO4SU= - =z1tc - -----END PGP MESSAGE----- - fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA1Hthzn+T1OoAQ/+K1+QTZ8N3Ha0nErrRWClBu5Cxec5/eb2Q/n4dfNGkrxx - xBk0thoGAyoYpifSqhXbVi/MA8+tzHdtPlKJFCn5NETrnEdu84+sJQE4zfDljLiX - fXZZ/+YQ0P3VosR2NI3W1r/hJWs4oJ9oPz4FfMlfPK+/UOOdQEtGkx9rjYaus9Ax - VI6s5qvYM6XD5rkLxTqZZhEa+CjLtSjD5WqNbCT/8fX5ErnU06jW6jXvRNQSq1Mt - hpqMIBygUE39K2apEuphE9RRD3bS1M2VjCB882yVSM2QZyepilRBjS5ryyQhKK/9 - Q0mdIw9mxhdgaCzoglN2k1c6WjddZ409osdnYcMtsH4+NlHDtNfSFLIk6JrxAXIQ - bNR8gtr4D85LoQki/RvEweUd4M40DneIO1dTK4/WG71Lcle3B6p0ynDMjmXq1coY - Qn0c4KAh1RIX/eEJGS23Wle/XZbp89yaFFEF667+HmwL0CY6I5pcVEn/iuXLoNHI - 93y/9h7mhB8ZGICPbF7nXBfQQTrxjfc9vZq0PVdjlXPIMRjZcbZOzlKByYLsQIW0 - UtzLScfFyKsogcUGJIlGrcQyAmLb3dr7i1elVWlanggCXdKnecBRbSkEfK7SmwiN - t8hRaaM06P3kRbTHWxt+4sjTQWofo+C76qsMZYHFpI0TTOP/jwnn/h3E9dQxdaHS - XgHzVEsJkQiQ51w7pPP1LcKkCxQv1KA9QC+LAFGhmWXnQ1m8E3whao2S07UjlTVw - XMAtuOVT2r09dYGgpcEaMiK2Hb9UNg/ma9o29fSm+2rLuxw3qSldgNNx/s8hyzc= - =0kev - -----END PGP MESSAGE----- - fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA46L6MuPqfJqAQ//ZYw2qRn+YhiEoBpbUsW95NJpZJFizwssh1dC/Lda5qFs - 55G1Jls9FHHQ+LmRnE6wyx26bbpQ257FNzCsxsfwAuiznx31j1yHc6LZbuJ3+DsJ - slRaad13RdLyGgo2psaXbBMEgr22FAFDm+S98aYnyv8yvtOZvutEljGm9yhHLGKy - XnFf8LwvvqdT4RolfxiPncGsd9hbFYZh7/zcJTSzfYSnHI30Ly5Na74vSaamuIwR - oPnSxlf8jIX5RUzssjyOHGLQLd327fKuveVxX9CUK/PGWLgQYuTL5PWZwQGhzgSY - E+2EerpGLVJzSQB0TUU5xGwOQkDlPveSSUg0IoDlivMnrphWUFd+bcIMbipVXolf - qpiJeO1t0YW1WAQBzkQ3J+uXgX0dJqWfzfMsbn3j4/WZq5ZlEX6x+ovHv6Z7ZXTz - 6lcF6Gn0dH/omhkqduK3bLwBWAkmh7gWNssEXdPQWGWA8j3WM+IPZKIegpecflKN - pv7jOyD95othMUul/iiH/E3aSbCggN5maoZHG2Cp1TGXkGOLFCNs143LGTVligOU - yD8n0uAQ8e50J7YwytSi2g0pzFkZyriLmrZqKFt9UUOfANivrO9p8J0Bo9wEHjY0 - OdKKu8ASgjYk0t4VHGeZF3GPSaGE/k7LaUb9+5t02sxypxeVqQXpvjU/D8c/0wPS - XgGQs2bjszJIyRwcTmUHD8YAvuxf0MkyKCKpJSsnbJ4XmgkI+gGQpg0GLQROXjZ4 - 8GqLzKb+3d3QDUPQmh+z5Ur1nFcVS214wycICWSTsIUyam59+4rVxV1i33DcAs4= - =BJfi - -----END PGP MESSAGE----- - fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-02-17T22:21:57Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hF4DQrf1tCqiJxoSAQdA7rerN+IVKpzyAdXVuAN19+CIjQ6DnHatGr92/YhAEiQw - J913tdR+Yb/FdPWQrn0NR2eTUuKm/Es0NRvJY/YEnhQble+3qYvxFP6dI+vm1cmz - 0l4BNxMhGqyOmsDFf58yrJmrHdnapBOmiqCkJBTc9gAQH534di0Ps+grV04jzkXW - DUO/sIPANPpvqqCJNt1uekKNH2J57OMaagnBTivMBTq0HAuRN1RhcrjGof9ttCj1 - =desh - -----END PGP MESSAGE----- - fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - unencrypted_suffix: _unencrypted - version: 3.11.0 diff --git a/config/hosts/forgejo-actions-runner/sops.nix b/config/hosts/forgejo-actions-runner/sops.nix deleted file mode 100644 index b4548ed..0000000 --- a/config/hosts/forgejo-actions-runner/sops.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ ... }: - -{ - sops = { - defaultSopsFile = ./secrets.yaml; - }; -} diff --git a/flake.nix b/flake.nix index f16409b..886024b 100644 --- a/flake.nix +++ b/flake.nix @@ -127,20 +127,6 @@ ]; }; - forgejo-actions-runner = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - self.nixosModules.common - self.nixosModules.proxmox-vm - sops-nix.nixosModules.sops - self.nixosModules.prometheus-exporter - ./config/hosts/forgejo-actions-runner - ]; - specialArgs = { - inherit authorizedKeysRepo; - }; - }; - ptouch-print-server = nixpkgs.lib.nixosSystem { inherit system specialArgs; modules = [ From 61cf87f12bf7cdedf1b628df9f48e96137c23f70 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 9 Jul 2026 21:14:09 +0200 Subject: [PATCH 4/9] deploy didays.de and didays.de staging on public-web-static --- .../virtualHosts/default.nix | 2 + .../virtualHosts/didays.de.nix | 73 +++++++++++++++++++ .../virtualHosts/staging.didays.de.nix | 72 ++++++++++++++++++ 3 files changed, 147 insertions(+) create mode 100644 config/hosts/public-web-static/virtualHosts/didays.de.nix create mode 100644 config/hosts/public-web-static/virtualHosts/staging.didays.de.nix diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index 61008d2..de252b3 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -28,5 +28,7 @@ ./staging.diday.org.nix ./historic-easterhegg ./ueberwachungsfrei-kundgebung.nix + ./didays.de.nix + ./staging.didays.de.nix ]; } diff --git a/config/hosts/public-web-static/virtualHosts/didays.de.nix b/config/hosts/public-web-static/virtualHosts/didays.de.nix new file mode 100644 index 0000000..6874e4f --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/didays.de.nix @@ -0,0 +1,73 @@ +{ pkgs, ... }: + +let + domain = "didays.de"; + dataDir = "/var/www/${domain}"; + deployUser = "didays-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + users.users."${deployUser}" = { + isNormalUser = true; + group = "${deployUser}"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEcEfs6qiUwjlqsHwzS1WvaVQOPEhRRup5RE+K1wZ72 deploy key for didays" + ]; + }; + users.groups."${deployUser}" = { }; +} diff --git a/config/hosts/public-web-static/virtualHosts/staging.didays.de.nix b/config/hosts/public-web-static/virtualHosts/staging.didays.de.nix new file mode 100644 index 0000000..82d84a9 --- /dev/null +++ b/config/hosts/public-web-static/virtualHosts/staging.didays.de.nix @@ -0,0 +1,72 @@ +{ pkgs, ... }: + +let + domain = "staging.didays.de"; + dataDir = "/var/www/${domain}"; + deployUser = "didays-deploy"; +in { + services.nginx.virtualHosts = { + "acme-${domain}" = { + enableACME = true; + serverName = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 31820; + } + { + addr = "0.0.0.0"; + port = 31820; + } + ]; + }; + + "${domain}" = { + forceSSL = true; + useACMEHost = "${domain}"; + + listen = [ + { + addr = "[::]"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + { + addr = "0.0.0.0"; + port = 8443; + ssl = true; + proxyProtocol = true; + } + ]; + + root = "${dataDir}"; + + # Disallow *, since this is staging and doesn't need to be in any search + # results. + locations."/robots.txt" = { + return = "200 \"User-agent: *\\nDisallow: *\\n\""; + }; + + extraConfig = '' + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + port_in_redirect off; + ''; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${dataDir} 0755 ${deployUser} ${deployUser}" + ]; + + # didays deploy user already defined in didays.de.nix. +} From 876fdbc4dd747c6830a1b535085928e7399056cf Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 15:24:37 +0200 Subject: [PATCH 5/9] rename "dooris-hauptraum" credentials to "dooris" in spaceapid --- config/hosts/public-web-static/secrets.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/config/hosts/public-web-static/secrets.yaml b/config/hosts/public-web-static/secrets.yaml index e1f1a5b..20d09f1 100644 --- a/config/hosts/public-web-static/secrets.yaml +++ b/config/hosts/public-web-static/secrets.yaml @@ -1,10 +1,9 @@ -spaceapid_config_ccchh_credentials: ENC[AES256_GCM,data:5IClrKKMO/AztQuGabrnoRFItYNeEmVWGeafomVO94pL1RKzL1sCxBxnmzvJFPb/8Y+6FXMh+Mim4DP8B2RaJMLpmqCv+76N/5+527SZ6gn9i2Klg6q0kD9RzJv40qHq/NYLCa24tpcZDt7eB0EOgqLsKUmtX2LrQjjnN3NzjAevJGKQ5ypnb7xygjft2KrpvlR1hMnZ0XpSLDTNR1AmImxE24JtDaJKzwXbptr2IZvm1UFkNslxdqHPjN+N8+MSSLhqHy/FdcY2ADvsTX1jtjnjkb+9E30QOeCiFPKSmWtSGiQ9sPcQna1yr717Vk0EiNSAWDQ2fMZyJUgBXG6w3wiZbxfJmxvshLPs5KguF9NHER+Seps1QiE0p16c0IS/0Y24UYrK2GyUIcSReGufjxUFGTJHFSsNANac34H/RTs7BkoZ,iv:8WzTRaXVeH5GKmigMVTLVBnhy6nXZnTZHLAYHcqDs2s=,tag:jTdgz0gmruMWWDBQ3h70vw==,type:str] +spaceapid_config_ccchh_credentials: ENC[AES256_GCM,data:0fOL/gFCazBqRG2QuuRiUN/xQsfAFY+5xx5Y9PUIRMn7yh+kZjC3zrjOKyP/98x1cqwBjXTSJX9IZCiNTDS4drjhCleKTX7zsL3KluWhZwS0bey8iUYLjhaXuH2gE5h7kk18S6acpBF75JAdwmfP5Tw+ewggIt3AHtDoDWLxSHbRYsHACeyb5BC7ftAOSpqhqQTBP756XfUe+dPrvsECD6YzYRgU4JGaKKm69M97yoeghvkLgKYSxN4urelZTLGhe1tqgA6eCSznRV7+lWHcKfocjqCsbruxB4711/p7FlFD/miohT78SFe+scTLM0o7t2o2Kz4n05gJHp+1X3mp5bfyZaRceyceWkwEgxg58zjlhA3oC9CJjNAa3fPFolMVHzZJMGPVnn0t0OPTsr7VxoIJewOm/zlPxN0=,iv:5Dep+oBqAnvKiowbRbRkMGrpTEbTEbzv0tVXz6lKVdU=,tag:qOkqNCkvWrmXZ6bAtBkjSw==,type:str] staging.diday.org: lego.env: ENC[AES256_GCM,data:FHCHBrjapNGSAtUnDTMZfeAZJqZV65d8COBJF8lzZmNBiw0jXyrmJ6rnUbYmnPN54T+1e8V0dzkdqmYX708tpFWagOPPQ9Ko+D+lV5yJ4hj/lhunuPSetWC/5dGBfN6CbA==,iv:WZ8CWu40ToF2mbpSUR6pDdUa6jcWPIUsWhVaGGBwx1E=,tag:8CohD3CwcUm2LzAJ8Lfimg==,type:str] sops: age: - - recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaEZqOHRMMko4S1loUXdm aTlsS1RDNHdjdkZWSG1aR0d4Vmh4dVVZQWo0CmJUbm9hZzJqaDBOMTVObG9HWFF1 @@ -12,8 +11,8 @@ sops: OUJkei9zWmhyazc5T2FVbElFRG9RaFkKu4lZrg8UWVVk75eY8HBdLIT4BNw2UcyV +7X2L7ltv2z31T4cKnnZrsyeG6fBGCLvuI5EQBd09OCZEUZ4u7qPOA== -----END AGE ENCRYPTED FILE----- - - recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 - enc: | + recipient: age19h7xtfmt3py3ydgl8d8fgh8uakxqxjr74flrxev3pgmvvx94kvtq5d932d + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMkdGQ0tpSUlWQ25ERTMy QXhNdUYzdlBPUXR0V0NyOHpZbDY5RVd1ZXg0Cm40TjQvMXVGamM1akMzRUFuc3NO @@ -21,8 +20,9 @@ sops: ZE9rN3R4aHRXR0dBc2oxcEYrL1lxZncKuVocF84+ge1gyzfNjIxhwNgd8+kJIpxh yREbS2mrQ2zvSMtw9OoA0KJSpoHZfIiCwn2uYkQDPiGB/721JmA12Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-27T20:40:06Z" - mac: ENC[AES256_GCM,data:Nsburro0nSV8CLZsxLaFrwsE5EIz8qQOlclNynbRT03XkfaPN2Pup8UWg9QL34KGcGUweqtytxZvLWjwfJYEsIkLqi4ZfrpXpEfBowq5aNbWHzDJDW5QqZKaUPmMQxiPVm1EhXmyvfVdFEueOhfFLbuNUSvNWaFk/7l2utTeLrs=,iv:dSJDVYGdaunvRqj+EkPGy3qxR9suV0s2Mm26silX24M=,tag:hqA+4FpP2PwatRMnZUcUqw==,type:str] + recipient: age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0 + lastmodified: "2026-08-11T13:23:00Z" + mac: ENC[AES256_GCM,data:jZ9G+EcoGBfWv3uYVkk6DF3HJxHpxMYZQW/4BQd4V/YrluZp5dg4Bw/coRb3ka8n1EBLj+hxPSJyCtXwRlW1sMUvl4mbKpMTe5dtd67lpDMXbQ/3AA53cD/52Mlvv76Ywff7kjx4XhbBCnYEdBfMABcVLPd/rgmKtMKRtaYLjmQ=,iv:yPwKgsg2JgqB3QT7GG2+UlPlP+REOjlo/FKYwgmctZw=,tag:944RbdkitJ37aEmcrX7iQQ==,type:str] pgp: - created_at: "2026-02-17T22:22:02Z" enc: |- @@ -147,4 +147,4 @@ sops: -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.13.3 From b167ee51b9e230fd8b86bcb915306c1918f3e610 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 15:59:13 +0200 Subject: [PATCH 6/9] fix permission mistake in spaceapid config --- .../hosts/public-web-static/spaceapid-config/ccchh-dynamic.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json b/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json index 2b1309f..fbadbf2 100644 --- a/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json +++ b/config/hosts/public-web-static/spaceapid-config/ccchh-dynamic.json @@ -77,7 +77,7 @@ "state": { "open": { "allowed_credentials": [ - "dooris-hauptraum" + "dooris" ] } } From 309c763d158102bb68f4b82c8c8a93d018b87480 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 21:20:43 +0200 Subject: [PATCH 7/9] update git to nixos 26.05 --- flake.lock | 37 +++++++++++++++++++++++++++---------- flake.nix | 5 +++-- 2 files changed, 30 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index b2142ed..21a71d5 100644 --- a/flake.lock +++ b/flake.lock @@ -19,11 +19,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1778430510, - "narHash": "sha256-Ti+ZBvW6yrWWAg2szExVTwCd4qOJ3KlVr1tFHfyfi8Q=", + "lastModified": 1782847189, + "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8fd9daa3db09ced9700431c5b7ad0e8ba199b575", + "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", "type": "github" }, "original": { @@ -33,13 +33,29 @@ "type": "github" } }, - "nixpkgs-unstable": { + "nixpkgs-2605": { "locked": { - "lastModified": 1778672786, - "narHash": "sha256-Blg88K1jwG+P0Mr27+rKMFCufdrWkV3wWh9AdYtz0FQ=", + "lastModified": 1786313170, + "narHash": "sha256-9BG7OgUWdu0ONDO5X2q6+K4bsuBITkX/3W4nNJu1Ito=", "owner": "nixos", "repo": "nixpkgs", - "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1", + "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-26.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1786348146, + "narHash": "sha256-we5zDEFfn8TgzeWKjKDMIjeQZ59omEPl23NIF+13/ys=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "d482ef84049d9b7276b83a06e4e4d76983830097", "type": "github" }, "original": { @@ -53,6 +69,7 @@ "inputs": { "authorizedKeysRepo": "authorizedKeysRepo", "nixpkgs": "nixpkgs", + "nixpkgs-2605": "nixpkgs-2605", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix" } @@ -64,11 +81,11 @@ ] }, "locked": { - "lastModified": 1777944972, - "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", + "lastModified": 1786375908, + "narHash": "sha256-G7qDAT98nywA4EFmJCwIRO5wKvDlBBN3BWpsOnjAto8=", "owner": "Mic92", "repo": "sops-nix", - "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", + "rev": "d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 886024b..f802368 100644 --- a/flake.nix +++ b/flake.nix @@ -7,6 +7,7 @@ # https://github.com/NixOS/nixpkgs nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11"; nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable"; + nixpkgs-2605.url = "github:nixos/nixpkgs?ref=nixos-26.05"; # # Add nixos-generators as an input. # # See here: https://github.com/nix-community/nixos-generators#using-in-a-flake @@ -28,7 +29,7 @@ }; }; - outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, authorizedKeysRepo, ... }: + outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-2605, sops-nix, authorizedKeysRepo, ... }: let specialArgs = { inherit authorizedKeysRepo; @@ -116,7 +117,7 @@ ]; }; - git = nixpkgs.lib.nixosSystem { + git = nixpkgs-2605.lib.nixosSystem { inherit system specialArgs; modules = [ self.nixosModules.common From 8e8b465eca5553860b75dec33d8f6140780100ae Mon Sep 17 00:00:00 2001 From: chris Date: Fri, 14 Aug 2026 21:31:10 +0200 Subject: [PATCH 8/9] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs-2605': 'github:nixos/nixpkgs/fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d' (2026-08-09) → 'github:nixos/nixpkgs/9f78f44a87948854445dae0b6bf82b2e87e4efb5' (2026-08-12) • Updated input 'nixpkgs-unstable': 'github:nixos/nixpkgs/d482ef84049d9b7276b83a06e4e4d76983830097' (2026-08-10) → 'github:nixos/nixpkgs/6b5e5b7a6631f065bf6908986990b37d845f847f' (2026-08-13) • Updated input 'sops-nix': 'github:Mic92/sops-nix/d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4' (2026-08-10) → 'github:Mic92/sops-nix/a8627b21b9107c5711c96b84f32a9a4b3d45295f' (2026-08-13) --- flake.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/flake.lock b/flake.lock index 21a71d5..76cad77 100644 --- a/flake.lock +++ b/flake.lock @@ -35,11 +35,11 @@ }, "nixpkgs-2605": { "locked": { - "lastModified": 1786313170, - "narHash": "sha256-9BG7OgUWdu0ONDO5X2q6+K4bsuBITkX/3W4nNJu1Ito=", + "lastModified": 1786535285, + "narHash": "sha256-rG5HKMAgAhMgydvKGtco6rqTxRq4EDZQCx9USLvVqYw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d", + "rev": "9f78f44a87948854445dae0b6bf82b2e87e4efb5", "type": "github" }, "original": { @@ -51,11 +51,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1786348146, - "narHash": "sha256-we5zDEFfn8TgzeWKjKDMIjeQZ59omEPl23NIF+13/ys=", + "lastModified": 1786593342, + "narHash": "sha256-smTKQXMLLStzc8zJevMCckbk3My7SvbbLmPYZUJJKW4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "d482ef84049d9b7276b83a06e4e4d76983830097", + "rev": "6b5e5b7a6631f065bf6908986990b37d845f847f", "type": "github" }, "original": { @@ -81,11 +81,11 @@ ] }, "locked": { - "lastModified": 1786375908, - "narHash": "sha256-G7qDAT98nywA4EFmJCwIRO5wKvDlBBN3BWpsOnjAto8=", + "lastModified": 1786629091, + "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=", "owner": "Mic92", "repo": "sops-nix", - "rev": "d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4", + "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f", "type": "github" }, "original": { From ed89e6263c06f8a1564354974e19c1753ede666b Mon Sep 17 00:00:00 2001 From: chris Date: Fri, 14 Aug 2026 21:59:03 +0200 Subject: [PATCH 9/9] git: fix git disable download function --- config/hosts/git/forgejo.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/config/hosts/git/forgejo.nix b/config/hosts/git/forgejo.nix index 89f83c9..9938832 100644 --- a/config/hosts/git/forgejo.nix +++ b/config/hosts/git/forgejo.nix @@ -60,6 +60,9 @@ repo = { DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls"; }; + repository = { + DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true; + }; actions = { ENABLED = true; ARTIFACT_RETENTION_DAYS = 30; @@ -84,6 +87,12 @@ REPO_INDEXER_TYPE = "elasticsearch"; REPO_INDEXER_CONN_STR = "http://127.0.0.1:9200"; }; + "cron.archive_cleanup" = { + ENABLED = true; + RUN_AT_START = true; + SCHEDULE = "@every 1h"; + OLDER_THAN = "2h"; + }; }; };