forked from CCCHH/nix-infra
Compare commits
72 commits
Author | SHA1 | Date | |
---|---|---|---|
christian | c78c278627 | ||
jopejoe1 | e3c677ea9b | ||
christian | ecd9fe4adf | ||
jopejoe1 | 2003367108 | ||
christian | 53e33a6641 | ||
jopejoe1 | e404d4740f | ||
jopejoe1 | f7ebe660fe | ||
jopejoe1 | 6c85b91efb | ||
jopejoe1 | 7d58a3db4a | ||
christian | c25d6c6326 | ||
June | d98aa099e1 | ||
June | cf46da9df7 | ||
fi | c84d9e7d0a | ||
christian | 33b2cbf5d0 | ||
christian | afb4fc71ce | ||
christian | 1fcd8c6421 | ||
christian | ff1a12846a | ||
June | 2ba371f8cd | ||
June | c8e7bd1ccf | ||
jopejoe1 | 4fc8e31df0 | ||
9d9b8ede02 | |||
June | 4f789adb21 | ||
June | ec64eebfd6 | ||
June | fefff391b7 | ||
dequis | 9d1521c485 | ||
June | accd31173b | ||
June | 8165d22159 | ||
June | ecdaa2d5f6 | ||
Stefan Bethke | de2390c78d | ||
June | 2fe65b0513 | ||
June | 804094aaeb | ||
christian | da8e2bbbf4 | ||
June | 05b96b8fae | ||
June | c54b655b0e | ||
June | 68f11ad955 | ||
June | 445bf05842 | ||
cd8108fc9b | |||
June | 1b755b4eab | ||
June | b26320f999 | ||
June | 0395484ea9 | ||
dequis | 9b751fa1ed | ||
5bbc8aa03e | |||
June | 178777007f | ||
June | faffcb7d54 | ||
June | 1ffc959ce3 | ||
June | 028b5dc9e8 | ||
June | 35e5fbc8a2 | ||
June | b30015fee1 | ||
June | e88982d7c7 | ||
June | a2102b064f | ||
christian | 59b540c9e3 | ||
June | a271fddff8 | ||
June | 1185f9bb41 | ||
June | 9f56692222 | ||
June | 7058ec3582 | ||
June | 026e47d055 | ||
June | be7f6e4917 | ||
June | f5432bd682 | ||
June | 1aff46745a | ||
June | df17b25009 | ||
June | dfcb961fd3 | ||
June | 3059843e1a | ||
June | f3f5d5a611 | ||
June | 33599951ef | ||
June | 6411ae8b80 | ||
christian | b30952a049 | ||
fi | 8a2d406d4e | ||
June | bb2f1e1252 | ||
June | d08007fd1c | ||
echtnurich | 22eff92488 | ||
June | bc98327cda | ||
June | 06e52eed74 |
23
.editorconfig
Normal file
23
.editorconfig
Normal file
|
@ -0,0 +1,23 @@
|
||||||
|
root = true
|
||||||
|
|
||||||
|
[*]
|
||||||
|
end_of_line = lf
|
||||||
|
insert_final_newline = true
|
||||||
|
indent_style = space
|
||||||
|
charset = utf-8
|
||||||
|
|
||||||
|
[*.nix]
|
||||||
|
indent_size = 2
|
||||||
|
trim_trailing_whitespace = true
|
||||||
|
|
||||||
|
[*.md]
|
||||||
|
indent_size = 2
|
||||||
|
trim_trailing_whitespace = false
|
||||||
|
|
||||||
|
[*.json]
|
||||||
|
indent_size = 2
|
||||||
|
trim_trailing_whitespace = true
|
||||||
|
|
||||||
|
[*.yaml]
|
||||||
|
indent_size = 2
|
||||||
|
trim_trailing_whitespace = true
|
51
.sops.yaml
51
.sops.yaml
|
@ -15,6 +15,9 @@ keys:
|
||||||
- &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk
|
- &host_age_matrix age1f7ams0n2zy994pzt0u30h8tex6xdcernj59t4d70z4kjsyzrr3wsy87xzk
|
||||||
- &host_age_netbox age13fqs76z2vl5l84dvmmlqjj5xkfsfe85xls8uueul7re9j3ksjs0sw2xc9e
|
- &host_age_netbox age13fqs76z2vl5l84dvmmlqjj5xkfsfe85xls8uueul7re9j3ksjs0sw2xc9e
|
||||||
- &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
|
- &host_age_public_web_static age19s7r8sf7j6zk24x9vumawgxpd2q8epyv7p9qsjntw7v9s3v045mqhmsfp0
|
||||||
|
- &host_age_mjolnir age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
|
||||||
|
- &host_age_woodpecker age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
|
||||||
|
- &host_age_penpot age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
|
||||||
creation_rules:
|
creation_rules:
|
||||||
- path_regex: config/hosts/git/.*
|
- path_regex: config/hosts/git/.*
|
||||||
key_groups:
|
key_groups:
|
||||||
|
@ -96,6 +99,54 @@ creation_rules:
|
||||||
- *admin_gpg_dante
|
- *admin_gpg_dante
|
||||||
age:
|
age:
|
||||||
- *host_age_public_web_static
|
- *host_age_public_web_static
|
||||||
|
- path_regex: config/hosts/mjolnir/.*
|
||||||
|
key_groups:
|
||||||
|
- pgp:
|
||||||
|
- *admin_gpg_djerun
|
||||||
|
- *admin_gpg_stb
|
||||||
|
- *admin_gpg_jtbx
|
||||||
|
- *admin_gpg_yuri
|
||||||
|
- *admin_gpg_june
|
||||||
|
- *admin_gpg_haegar
|
||||||
|
- *admin_gpg_dario
|
||||||
|
- *admin_gpg_echtnurich
|
||||||
|
- *admin_gpg_max
|
||||||
|
- *admin_gpg_c6ristian
|
||||||
|
- *admin_gpg_dante
|
||||||
|
age:
|
||||||
|
- *host_age_mjolnir
|
||||||
|
- path_regex: config/hosts/woodpecker/.*
|
||||||
|
key_groups:
|
||||||
|
- pgp:
|
||||||
|
- *admin_gpg_djerun
|
||||||
|
- *admin_gpg_stb
|
||||||
|
- *admin_gpg_jtbx
|
||||||
|
- *admin_gpg_yuri
|
||||||
|
- *admin_gpg_june
|
||||||
|
- *admin_gpg_haegar
|
||||||
|
- *admin_gpg_dario
|
||||||
|
- *admin_gpg_echtnurich
|
||||||
|
- *admin_gpg_max
|
||||||
|
- *admin_gpg_c6ristian
|
||||||
|
- *admin_gpg_dante
|
||||||
|
age:
|
||||||
|
- *host_age_woodpecker
|
||||||
|
- path_regex: config/hosts/penpot/.*
|
||||||
|
key_groups:
|
||||||
|
- pgp:
|
||||||
|
- *admin_gpg_djerun
|
||||||
|
- *admin_gpg_stb
|
||||||
|
- *admin_gpg_jtbx
|
||||||
|
- *admin_gpg_yuri
|
||||||
|
- *admin_gpg_june
|
||||||
|
- *admin_gpg_haegar
|
||||||
|
- *admin_gpg_dario
|
||||||
|
- *admin_gpg_echtnurich
|
||||||
|
- *admin_gpg_max
|
||||||
|
- *admin_gpg_c6ristian
|
||||||
|
- *admin_gpg_dante
|
||||||
|
age:
|
||||||
|
- *host_age_penpot
|
||||||
- key_groups:
|
- key_groups:
|
||||||
- pgp:
|
- pgp:
|
||||||
- *admin_gpg_djerun
|
- *admin_gpg_djerun
|
||||||
|
|
21
LICENSE
Normal file
21
LICENSE
Normal file
|
@ -0,0 +1,21 @@
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) CCCHH
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
59
README.md
59
README.md
|
@ -18,3 +18,62 @@ infra-rebuild switch git matrix
|
||||||
By default infra-rebuild tries to use the FQDN from the nixosConfiguration of the host for deployment.
|
By default infra-rebuild tries to use the FQDN from the nixosConfiguration of the host for deployment.
|
||||||
However to override individual parts of the deployment target, a [`deployment_configuration.json`](./deployment_configuration.json) can be used.
|
However to override individual parts of the deployment target, a [`deployment_configuration.json`](./deployment_configuration.json) can be used.
|
||||||
This is exactly what we're doing to set the default deployment user to `colmena-deploy` and have custom target hostnames for Chaosknoten hosts, since they don't have an FQDN defined in their nixosConfiguration.
|
This is exactly what we're doing to set the default deployment user to `colmena-deploy` and have custom target hostnames for Chaosknoten hosts, since they don't have an FQDN defined in their nixosConfiguration.
|
||||||
|
|
||||||
|
## Setting up secrets with sops-nix for a host
|
||||||
|
|
||||||
|
1. Convert the hosts SSH host public key to an age public key.
|
||||||
|
This can be done by connecting to the host and running:
|
||||||
|
```
|
||||||
|
cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
|
||||||
|
```
|
||||||
|
2. Add the resulting age public key to the `.sops.yaml` as a YAML anchor in keys.
|
||||||
|
It should be named something like: `host_age_hostname`
|
||||||
|
3. Add a new creation rule for the hosts config directory.
|
||||||
|
It should probably have all admin keys and the hosts age key. \
|
||||||
|
You can use existing creation rules as a reference.
|
||||||
|
4. Create a file containing the relevant secrets in the hosts config directory.
|
||||||
|
This can be accomplished with a command similar to this:
|
||||||
|
```
|
||||||
|
sops config/hosts/hostname/secrets.yaml
|
||||||
|
```
|
||||||
|
Note: Nested keys don't seem to be compatible with sops-nix.
|
||||||
|
5. Add the following entry to the modules of the hosts `nixosConfiguration`:
|
||||||
|
```nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
```
|
||||||
|
6. Create a `sops.nix` in the hosts config directory containing the following content to include the `secrets.yaml`:
|
||||||
|
```nix
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
sops = {
|
||||||
|
defaultSopsFile = ./secrets.yaml;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
```
|
||||||
|
7. Make sure the `sops.nix` gets imported. For example in the `default.nix`.
|
||||||
|
8. To use a secret stored under e.g. `forgejo_git_smtp_password`, you can then do something like the following:
|
||||||
|
```nix
|
||||||
|
sops.secrets."forgejo_git_smtp_password" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "forgejo";
|
||||||
|
group = "forgejo";
|
||||||
|
restartUnits = [ "forgejo.service" ];
|
||||||
|
};
|
||||||
|
```
|
||||||
|
This secret would then be available under `/run/secrets/forgejo_git_smtp_password` on the host.
|
||||||
|
|
||||||
|
## Build NixOS Proxmox VE Template
|
||||||
|
|
||||||
|
Build a new NixOS Proxmox VE Template for the thinkcccore's:
|
||||||
|
```shell
|
||||||
|
nix build .#proxmox-nixos-template
|
||||||
|
```
|
||||||
|
Build a new NixOS Proxmox VE Template for the chaosknoten:
|
||||||
|
```shell
|
||||||
|
nix build .#proxmox-chaosknoten-nixos-template
|
||||||
|
```
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
This CCCHH nix-infra repository is licensed under the [MIT License](./LICENSE).
|
||||||
|
|
|
@ -13,6 +13,7 @@
|
||||||
git
|
git
|
||||||
curl
|
curl
|
||||||
rsync
|
rsync
|
||||||
|
ssh-to-age
|
||||||
usbutils
|
usbutils
|
||||||
nix-tree
|
nix-tree
|
||||||
# For kitty terminfo.
|
# For kitty terminfo.
|
||||||
|
|
|
@ -13,5 +13,5 @@
|
||||||
# this value at the release version of the first install of this system.
|
# this value at the release version of the first install of this system.
|
||||||
# Before changing this value read the documentation for this option
|
# Before changing this value read the documentation for this option
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
system.stateVersion = lib.mkDefault "23.05";
|
system.stateVersion = lib.mkDefault "24.05";
|
||||||
}
|
}
|
||||||
|
|
|
@ -6,14 +6,9 @@
|
||||||
# - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
|
# - https://git.grzb.de/yuri/nix-infra/-/blob/342a2f732da042d04e579d98e9f834418b7ebf25/users/colmena-deploy/default.nix
|
||||||
# - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings
|
# - https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#available-settings
|
||||||
|
|
||||||
{ config, pkgs, lib, ... }:
|
{ config, pkgs, lib, authorizedKeysRepo, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
authorizedKeysRepo = builtins.fetchGit {
|
|
||||||
url = "forgejo@git.hamburg.ccc.de:CCCHH/infrastructure-authorized-keys.git";
|
|
||||||
ref = "trunk";
|
|
||||||
rev = "da9d3ead9d97ce0fef7538638326264957e2f1b4";
|
|
||||||
};
|
|
||||||
authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
|
authorizedKeys = builtins.filter (item: item != "") (lib.strings.splitString "\n" (builtins.readFile "${authorizedKeysRepo}/authorized_keys"));
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
|
8
config/extra/prometheus-exporter.nix
Normal file
8
config/extra/prometheus-exporter.nix
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.prometheus.exporters.node = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
}
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking = {
|
networking = {
|
||||||
|
@ -11,10 +11,9 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
defaultGateway = "10.31.210.1";
|
defaultGateway = "10.31.210.1";
|
||||||
nameservers = [
|
nameservers = [ "10.31.210.1" ];
|
||||||
"10.31.210.1"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "1E:EF:2D:92:81:DA";
|
matchConfig.MACAddress = "1E:EF:2D:92:81:DA";
|
||||||
linkConfig.Name = "net0";
|
linkConfig.Name = "net0";
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking = {
|
networking = {
|
||||||
|
@ -11,10 +11,9 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
defaultGateway = "10.31.210.1";
|
defaultGateway = "10.31.210.1";
|
||||||
nameservers = [
|
nameservers = [ "10.31.210.1" ];
|
||||||
"10.31.210.1"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "D2:10:33:B1:72:C3";
|
matchConfig.MACAddress = "D2:10:33:B1:72:C3";
|
||||||
linkConfig.Name = "net0";
|
linkConfig.Name = "net0";
|
||||||
|
|
|
@ -21,7 +21,8 @@ let
|
||||||
app = "dokuwiki";
|
app = "dokuwiki";
|
||||||
domain = "eh22.easterhegg.eu";
|
domain = "eh22.easterhegg.eu";
|
||||||
dataDir = "/srv/www/${domain}";
|
dataDir = "/srv/www/${domain}";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
systemd.tmpfiles.rules = [
|
systemd.tmpfiles.rules = [
|
||||||
"d ${dataDir} 0755 ${app} ${app}"
|
"d ${dataDir} 0755 ${app} ${app}"
|
||||||
];
|
];
|
||||||
|
@ -57,16 +58,16 @@ in {
|
||||||
; Checked with NixOS 23.11 on 2024-05-02.
|
; Checked with NixOS 23.11 on 2024-05-02.
|
||||||
extension = ${pkgs.phpExtensions.bz2}/lib/php/extensions/bz2.so
|
extension = ${pkgs.phpExtensions.bz2}/lib/php/extensions/bz2.so
|
||||||
'';
|
'';
|
||||||
extraConfig = ''
|
settings = {
|
||||||
listen.owner = ${config.services.nginx.user};
|
"listen.owner" = "${config.services.nginx.user}";
|
||||||
listen.group = ${config.services.nginx.group};
|
"listen.group" = "${config.services.nginx.group}";
|
||||||
pm = dynamic
|
"pm" = "dynamic";
|
||||||
pm.max_children = 32
|
"pm.max_children" = 32;
|
||||||
pm.start_servers = 2
|
"pm.start_servers" = 2;
|
||||||
pm.min_spare_servers = 2
|
"pm.min_spare_servers" = 2;
|
||||||
pm.max_spare_servers = 4
|
"pm.max_spare_servers" = 4;
|
||||||
pm.max_requests = 500
|
"pm.max_requests" = 500;
|
||||||
'';
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
|
|
|
@ -1,20 +1,19 @@
|
||||||
# Sources for this configuration:
|
|
||||||
# - https://nixos.wiki/wiki/Networking
|
|
||||||
|
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "172.31.17.159";
|
{
|
||||||
prefixLength = 25;
|
address = "172.31.17.159";
|
||||||
}
|
prefixLength = 25;
|
||||||
];
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "172.31.17.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "BC:24:11:37:F0:AB";
|
matchConfig.MACAddress = "BC:24:11:37:F0:AB";
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
imports = [
|
imports = [
|
||||||
./configuration.nix
|
./configuration.nix
|
||||||
./esphome.nix
|
./esphome.nix
|
||||||
|
./networking.nix
|
||||||
./nginx.nix
|
./nginx.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
29
config/hosts/esphome/networking.nix
Normal file
29
config/hosts/esphome/networking.nix
Normal file
|
@ -0,0 +1,29 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "10.31.208.24";
|
||||||
|
prefixLength = 23;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv6.addresses = [
|
||||||
|
{
|
||||||
|
address = "2a07:c480:0:1d0::66";
|
||||||
|
prefixLength = 64;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "10.31.208.1";
|
||||||
|
defaultGateway6 = "2a07:c480:0:1d0::1";
|
||||||
|
nameservers = [ "10.31.208.1" "2a07:c480:0:1d0::1" ];
|
||||||
|
search = [ "z9.ccchh.net" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "7E:3C:F0:77:8A:F4";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
|
@ -1,35 +1,34 @@
|
||||||
{ config, ... }:
|
{ config, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
"acme-esphome.ccchh.net" = {
|
|
||||||
enableACME = true;
|
|
||||||
serverName = "esphome.ccchh.net";
|
|
||||||
|
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
port = 31820;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
"esphome.ccchh.net" = {
|
"esphome.ccchh.net" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
useACMEHost = "esphome.ccchh.net";
|
enableACME = true;
|
||||||
|
serverName = "esphome.ccchh.net";
|
||||||
|
|
||||||
listen = [
|
listen = [
|
||||||
{
|
{
|
||||||
addr = "0.0.0.0";
|
addr = "0.0.0.0";
|
||||||
port = 80;
|
port = 80;
|
||||||
}
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
{
|
{
|
||||||
addr = "0.0.0.0";
|
addr = "0.0.0.0";
|
||||||
port = 443;
|
port = 443;
|
||||||
ssl = true;
|
ssl = true;
|
||||||
}
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
|
@ -37,9 +36,38 @@
|
||||||
proxyWebsockets = true;
|
proxyWebsockets = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
"esphome.z9.ccchh.net" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "esphome.ccchh.net";
|
||||||
|
serverName = "esphome.z9.ccchh.net";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
globalRedirect = "esphome.ccchh.net";
|
||||||
|
redirectCode = 307;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
security.acme.certs."esphome.ccchh.net".extraDomainNames = [ "esphome.z9.ccchh.net" ];
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 31820 ];
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,17 +1,19 @@
|
||||||
{ config, pkgs, ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "172.31.17.155";
|
{
|
||||||
prefixLength = 25;
|
address = "172.31.17.155";
|
||||||
}
|
prefixLength = 25;
|
||||||
];
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "172.31.17.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE";
|
matchConfig.MACAddress = "1E:E0:4E:D0:DA:BE";
|
||||||
|
|
|
@ -12,7 +12,6 @@
|
||||||
{
|
{
|
||||||
services.forgejo = {
|
services.forgejo = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs-unstable.forgejo;
|
|
||||||
database.type = "postgres";
|
database.type = "postgres";
|
||||||
mailerPasswordFile = "/run/secrets/forgejo_git_smtp_password";
|
mailerPasswordFile = "/run/secrets/forgejo_git_smtp_password";
|
||||||
|
|
||||||
|
@ -46,6 +45,9 @@
|
||||||
DEFAULT_USER_VISIBILITY = "limited";
|
DEFAULT_USER_VISIBILITY = "limited";
|
||||||
DEFAULT_KEEP_EMAIL_PRIVATE = true;
|
DEFAULT_KEEP_EMAIL_PRIVATE = true;
|
||||||
ENABLE_BASIC_AUTHENTICATION = false;
|
ENABLE_BASIC_AUTHENTICATION = false;
|
||||||
|
ENABLE_NOTIFY_MAIL = true;
|
||||||
|
AUTO_WATCH_NEW_REPOS = false;
|
||||||
|
AUTO_WATCH_ON_CHANGES = false;
|
||||||
};
|
};
|
||||||
repo = {
|
repo = {
|
||||||
DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
|
DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
|
||||||
|
|
|
@ -4,27 +4,30 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "212.12.51.136";
|
{
|
||||||
prefixLength = 28;
|
address = "212.12.51.136";
|
||||||
}
|
prefixLength = 28;
|
||||||
];
|
}
|
||||||
|
{
|
||||||
|
address = "172.31.17.154";
|
||||||
|
prefixLength = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv6.addresses = [
|
||||||
|
{
|
||||||
|
address = "2a00:14b0:f000:23:51:136::1";
|
||||||
|
prefixLength = 64;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "212.12.51.129";
|
||||||
|
defaultGateway6 = "2a00:14b0:f000:23::1";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "212.12.51.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
networking.interfaces.net0 = {
|
|
||||||
ipv6.addresses = [
|
|
||||||
{
|
|
||||||
address = "2a00:14b0:f000:23:51:136::1";
|
|
||||||
prefixLength = 64;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
networking.defaultGateway6 = "2a00:14b0:f000:23::1";
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "92:7B:E6:12:A4:FA";
|
matchConfig.MACAddress = "92:7B:E6:12:A4:FA";
|
||||||
|
|
|
@ -34,6 +34,10 @@
|
||||||
return = "200 \"User-agent: *\\nDisallow: /*/*/archive/\\n\"";
|
return = "200 \"User-agent: *\\nDisallow: /*/*/archive/\\n\"";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Disable checking of client request body size to make container registry
|
||||||
|
# image uploads work.
|
||||||
|
clientMaxBodySize = "0";
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
|
9
config/hosts/hydra/configuration.nix
Normal file
9
config/hosts/hydra/configuration.nix
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
hostName = "hydra";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
11
config/hosts/hydra/default.nix
Normal file
11
config/hosts/hydra/default.nix
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./configuration.nix
|
||||||
|
./hydra.nix
|
||||||
|
./networking.nix
|
||||||
|
./nginx.nix
|
||||||
|
./nix.nix
|
||||||
|
];
|
||||||
|
}
|
15
config/hosts/hydra/hydra.nix
Normal file
15
config/hosts/hydra/hydra.nix
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.hydra = {
|
||||||
|
enable = true;
|
||||||
|
listenHost = "localhost";
|
||||||
|
port = 3000;
|
||||||
|
hydraURL = "https://hydra.hamburg.ccc.de/";
|
||||||
|
# E-Mail configuration requires some work/investigation still.
|
||||||
|
notificationSender = "no-reply@hydra.hamburg.ccc.de";
|
||||||
|
useSubstitutes = true;
|
||||||
|
minimumDiskFree = 8;
|
||||||
|
minimumDiskFreeEvaluator = 2;
|
||||||
|
};
|
||||||
|
}
|
22
config/hosts/hydra/networking.nix
Normal file
22
config/hosts/hydra/networking.nix
Normal file
|
@ -0,0 +1,22 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "172.31.17.163";
|
||||||
|
prefixLength = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "BC:24:11:45:7C:D6";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
58
config/hosts/hydra/nginx.nix
Normal file
58
config/hosts/hydra/nginx.nix
Normal file
|
@ -0,0 +1,58 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "hydra.hamburg.ccc.de";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
default = true;
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
default = true;
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://${config.services.hydra.listenHost}:${builtins.toString config.services.hydra.port}";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 8443 31820 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 8443 ];
|
||||||
|
}
|
10
config/hosts/hydra/nix.nix
Normal file
10
config/hosts/hydra/nix.nix
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
# Allow Hydra to fetch flake inputs.
|
||||||
|
nix.settings.allowed-uris = [
|
||||||
|
"github:"
|
||||||
|
"https://github.com/"
|
||||||
|
"https://git.hamburg.ccc.de/"
|
||||||
|
];
|
||||||
|
}
|
|
@ -1,17 +1,19 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "172.31.17.150";
|
{
|
||||||
prefixLength = 25;
|
address = "172.31.17.150";
|
||||||
}
|
prefixLength = 25;
|
||||||
];
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "172.31.17.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "2A:A5:80:C3:8E:32";
|
matchConfig.MACAddress = "2A:A5:80:C3:8E:32";
|
||||||
|
|
9
config/hosts/mjolnir/configuration.nix
Normal file
9
config/hosts/mjolnir/configuration.nix
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
hostName = "mjolnir";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
10
config/hosts/mjolnir/default.nix
Normal file
10
config/hosts/mjolnir/default.nix
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./configuration.nix
|
||||||
|
./mjolnir.nix
|
||||||
|
./networking.nix
|
||||||
|
./sops.nix
|
||||||
|
];
|
||||||
|
}
|
36
config/hosts/mjolnir/mjolnir.nix
Normal file
36
config/hosts/mjolnir/mjolnir.nix
Normal file
|
@ -0,0 +1,36 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://github.com/matrix-org/mjolnir/blob/main/docs/setup.md
|
||||||
|
# - https://github.com/matrix-org/mjolnir/blob/main/config/default.yaml
|
||||||
|
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
# Allow deprecated, apparently somewhat insecure libolm to be able to update
|
||||||
|
# the moderation bot.
|
||||||
|
# The security issues aren't real world exploitable apparently:
|
||||||
|
# https://matrix.org/blog/2024/08/libolm-deprecation/
|
||||||
|
nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
|
||||||
|
services.mjolnir = {
|
||||||
|
enable = true;
|
||||||
|
homeserverUrl = "https://matrix.hamburg.ccc.de";
|
||||||
|
managementRoom = "#moderation-management:hamburg.ccc.de";
|
||||||
|
settings = {
|
||||||
|
verboseLogging = false;
|
||||||
|
};
|
||||||
|
pantalaimon = {
|
||||||
|
enable = true;
|
||||||
|
username = "moderation";
|
||||||
|
passwordFile = "/run/secrets/matrix_moderation_user_password";
|
||||||
|
options = {
|
||||||
|
ssl = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets."matrix_moderation_user_password" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "mjolnir";
|
||||||
|
group = "mjolnir";
|
||||||
|
restartUnits = [ "mjolnir.service" ];
|
||||||
|
};
|
||||||
|
}
|
22
config/hosts/mjolnir/networking.nix
Normal file
22
config/hosts/mjolnir/networking.nix
Normal file
|
@ -0,0 +1,22 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "172.31.17.161";
|
||||||
|
prefixLength = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "BC:24:11:C9:F8:C5";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
233
config/hosts/mjolnir/secrets.yaml
Normal file
233
config/hosts/mjolnir/secrets.yaml
Normal file
|
@ -0,0 +1,233 @@
|
||||||
|
matrix_moderation_user_password: ENC[AES256_GCM,data:NXJrbRh0A+NQh6Jy9iVAfYhsGR1BSOSuk1LjmArSiVF6jnuJAP9f750cRP7bu7Ai8xgxTlhjAtv9ck6SqlJ6Vw==,iv:IN/siIPCFKE+Nfl/aogYRYAHVgEGhMtTbmEZKZWQYgM=,tag:xxlnl5GU+uusSeh1OvoU1g==,type:str]
|
||||||
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
|
age:
|
||||||
|
- recipient: age1ej52kwuj8xraxdq685eejj4dmxpfmpgt4d8jka98rtpal6xcueqq9a6wae
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTEhUMThoY3Nuc253NnBX
|
||||||
|
ZkplNmRzOGZFNWlQNDVpL08yRk5VTHZDUkZNCnIxMUJoUHJBYlJpbUViMW9GUmhR
|
||||||
|
V1F6SWh2NjRGWk9RWjMycGZYZXFZbkkKLS0tIE5MNk0xekwxY0NYYm9mc1ZGZFlH
|
||||||
|
NDN2dUpuQWFFMTZQRzFIS0ZieTRzQm8KUDRpPJwcWwePKMp6KQMnQLhqqyvuhgQh
|
||||||
|
rXpKW5fjxyT0Sh2u3FM2ET/9U0TUfpBVYBJojAJBFs1ntI8kFmqSYg==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2024-06-20T20:02:16Z"
|
||||||
|
mac: ENC[AES256_GCM,data:5BhSo3YpF3QNqgGnx6YnymaEQB6pchMhokaJqk4rHg22xhbUAzOhWg4BQepT7vrCQlfOZIq4o//dGO+NQxqliiyyywrSYm3CBWD4xfZ9cdfinHC7Pc9lj6Dd4uPNxRjgTRNFuMyC+ATIABI2mHKpg+T2bxSalroIlvNr4vXWZo4=,iv:yPHJZ5PvI5zJlQIMRdbJ6eKGe1xN+teKF5GluD2pyK8=,tag:s4hO9RCdkHDsQ1W+KfXq7A==,type:str]
|
||||||
|
pgp:
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAxK/JaB2/SdtAQ//Y/GVthqtuK7bY8Ne5CNfn/CD1RUTdX1+KwX1zy3YsgUC
|
||||||
|
CGxhoFFy1UoXR3QB4Hxnk8R/vaFVHezCWKWY45MAuPtwM1VGwjVsuknrJnSs8k7/
|
||||||
|
jrzVO9xXgTd26H6DLmPVfH1hKB0/lh84hwVgF5rlPS/P7l92LL0hDIIwZz3dB0kU
|
||||||
|
d6jLa1Fajqd4MSdLWbZRBPcioC5v1Ip/SXYAJp7IGLDgXm5MN+MnAdybAFsl1K5p
|
||||||
|
dCUmGqK5IjyPVP564TqL0ZEIXMxSSwex47in3cTYPaOO0L8P3kbKDNWxZQLaqZkn
|
||||||
|
4RZC4/aBqlfD2STxMez/ksi6kCcPuC7UPRzuq4oH3kOcJHxwIN8Df+DZYA4PJKsl
|
||||||
|
T9QDL1EylHBhsPIZCoxpmnGl3j+hVmONj2V1awlCaOagbgDlClEUEMyw7QCVVbtK
|
||||||
|
CW4DOgVnnTxcUaLHep8BgHxKkYjIDIbDMmg315h2ekT86gGgZavL8IiFTWSLzSrK
|
||||||
|
XChIjUdjpKZhanmSWpj4w8ZpdGOOjernL2EBWtSC23AibBZmQe9OB/QzMpLTdCvV
|
||||||
|
9t9mMoSayP61oJylBtOKhDnEW0Xib0U7tqzwpaow2V+CU2dr27qie1jh5GqMaoJR
|
||||||
|
qpu1KT3Z9eqpF3Dl8aI3dEovbmvDMVXErU3pmFu2zRJtm6TOXp4NNOYWCetUfxPU
|
||||||
|
aAEJAhCFerTI/ow/LWkCQ78cCMFjgKrYabA3lHu11Mr/PiHirwJ/vCmsUMiOhdRw
|
||||||
|
49lsyqJlO3IA79yW4exG5tYXvPgeJMTdz36fseUEKsewfrPEqMUa2T4onet2+GN6
|
||||||
|
GALPdepytjg+
|
||||||
|
=v+qv
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: EF643F59E008414882232C78FFA8331EEB7D6B70
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQILA6EyPtWBEI+2AQ/2L7fbbhBH3BfgD7IbgtVn+nEhNJw5tWR2+0z1k72TIr9j
|
||||||
|
rPAvV6NQY8oVV2+uNLa4fMl+ueqYTFd3/E4IsRXkmexjx+vos27LjDNSu6w0OPJU
|
||||||
|
BSq5TFqZWYIPiWaivQz4+rt+vbxvpv4Lh3FAXlV9YubprJ4GRrlwyheve/l3F0BN
|
||||||
|
3vCDLsfXijZjxaptb9nf7WiT9vvWrY0sD4g71ARZdWi7Lb+TgCxzbQMue+4VC0Zu
|
||||||
|
y/AWIymVo13BD+apoYltVYYvkn7yz3REzsx3NN4bkJyoCAevr6UeO2fGvlT7b7eG
|
||||||
|
F7CN/TusFlOqWV9M0VbiOGLfL7Q9tGAG3xDAyFh+yMQNadp0M3m9UiYUlHps5DRT
|
||||||
|
CVsIPnPUr3V/oycRm3s+UeVyBg3rpdzWyNtETOjNY/AqVmRQ0toqZOm//ZOg609U
|
||||||
|
6+EX1Oc/GosfNoHWJuFmfKJRhPpy2gXZX2rQuLWaVJUXzzKM5sbLnycCV03S24PU
|
||||||
|
Fi7Z5lIu334QTLG8PV6agO5UprZb946qPmW+b/QnUol23XXcgh1GIgMV+lEK8+83
|
||||||
|
UPT0aUkdtOTaKbWUg5xokx+0Ni9syJ4Nl7naQq57qOGiecMnBbeE3TYxaNOcjTBh
|
||||||
|
CY0/hdcrZYH6VPeDye4yghSDF9WCaNUvzZNePGzdqKK3F9O/NmBSiYd/cToyDdJe
|
||||||
|
AZMZCKxSw0/HyBqTRd3wC/VhC9uO2I4HWE3LuqBPUXYFWc4W1buJs+P8pFjqT5rZ
|
||||||
|
puHPH8IxIeIiVNO5SFhdL8ecSu/nawakvih65aMGSa102e6B2HfP6tD4SmarmA==
|
||||||
|
=tr5G
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAz5uSgHG2iMJARAA02rGmKxyQkvxoXM1i2dLOiH6Gw/pUcdDxYSwKfdkNU3X
|
||||||
|
zc0He4FNG8CAURVq5jARD066VecamkBmlr+rwFJlaeqDPEiITfkz7DEGO8pPxKG0
|
||||||
|
GBnFVA9r/+OU351yLjHYB+72jvw1ey0PPHvKg6/sKjovssYvQLipUcktH33kPqVQ
|
||||||
|
yJzuQWFMWA7Jn/wTa/TP/53o0e//Kw9df69J3BSmnw9F6rKHGsIXLBmyR9HpQsLR
|
||||||
|
KAuClMzjPqHszCICND7vUDEzUvCcOVyizZAcRzWfDi/llwKGUanvEGUVXvyDXw/E
|
||||||
|
Q/FyR+VJXCzRlhsFTTuavjy6nhDsRf/N8N0Vsd9euDXOPQ4wuPAgpvdi58CPBmzP
|
||||||
|
8jU3xpFSXStYBIMt5u7t+UJT4IwdbjnClyIrSuyaV/7N5UQdYTv0fBy1mRrYLBAj
|
||||||
|
VhlRDa1y79n22Kg8mvDqJ16rC3VypkkQ6DaPvyDwlrG8iRLG/xi3Zz8HHnXxAGAm
|
||||||
|
SzliIolwEDHJZHI9ZE3YzpFJkB6UyOpXS1zMsDycupFvQ4jd2fQ0C7w5OaJHCkeQ
|
||||||
|
3zTKgtufjJGo7R2Nf0bTWTfi85GU3jpMsOHCEcChgBVXcO32ZZ/zzmqtXa/u3m5v
|
||||||
|
sjUstyBXEmG9eyIaiEtRAMAblwRsJPMszLaCUuBpzQw+mm9uTCsIaf5Xdud7GFzS
|
||||||
|
XgH+whlmbv/UeUC7bo65uxrG8SgTVAaPZpcQ2dP3rXYs45zYmYGKJaZuW+Hrl+nZ
|
||||||
|
pd6zT6rb6R8TMmXkNA1TjhvZ/A+ONlza1fH0dmsh7U9oqINXNFJU7Qm2r7imFvg=
|
||||||
|
=ZIDr
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAw5vwmoEJHQ1AQ//f51KkC9oViW/0EA0TLdWgXa76ZXMeu4b3UhWaQvYDT9+
|
||||||
|
8wuWE+slGEWsRnFZ+pgWZoV3HIv2p+xisX2lmBvepOufaRh6cyNpQaZNl0kFtpBo
|
||||||
|
ShQ66SmkorunYyM+OIh3ceI4PC7ca4KsRKB8nWkA935NWssFN9zMlkVW6GjqzTft
|
||||||
|
2JVJFL8GRlhIRMhJwSzp8zZ3XiYD0sB/2y+ffCMAOSCnDVcDjANyiSds6MPxfPy0
|
||||||
|
/kaNTXuUI7H50tHQP6vzJ3q1mRpAhUTIxubnmBTdvAQz/kaD0qPt55z+Q0xSXsLa
|
||||||
|
yfb+Zd2g/2o+IFiCrwqcki5yX49Ol89l69JRyIWe1T2VtqBSUVIiiYreX5OnmWPQ
|
||||||
|
OjJ1mAn9tpIlVSHzlaONtmJEmAJ+n55rP0itBMs1CrIBiQleLaCbSWqp6q3RfaJr
|
||||||
|
gpXnfHQpsU7cKEDQeyvxmH8qgrSR9AVh/knyGOJy8LnJQ93aQpr3xr/2MiFPYiKz
|
||||||
|
dcSrxHesrfx2Zl7bNB5OZ7VZTWFSunZQUnOn3F3+7yaaT9ePsvWsyTKBOSGUiA7s
|
||||||
|
VMxT5+P8QM6UOC8KxJj/q1eAVrWvN7vYbCA25+SzbdTtr1RweOVHzNgqZH5/Q2ZY
|
||||||
|
fguwHlCGg5Q7UKYKBk4QJFg6oClDgzBYCFL76K4aymtR7rxKl4sJxWoug84oP6DS
|
||||||
|
XgEZvNS3xsY8Pxm0bAmor93Q08Mii1svnNZ74Eqmbo9GxBjHReIGKDDZ08SaPhbc
|
||||||
|
NJxAP2C2sRUda2R4GvsNYmXHzGYfFTrfe+AXqEV42ZSD9vHDJMCiX9JrY/r4uSM=
|
||||||
|
=+F4l
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA4HMJd/cQYrVARAAq/cP9y/7kxSXDFOD/xhI/3RjGzIN5dyHlfrmEQWJ8J7z
|
||||||
|
ov0VfBCJp6gFht37dGWuLtWi1qqWRgN+9hiBnkj2zONoph0SRGP9uNfadBSzYSD4
|
||||||
|
wvlOFrWeM9cswnk4i0q8Go+qdCC6U0g1szjirdifF7I9KdqKpOFwXzjnzsPTF42o
|
||||||
|
9oFCP32esOYv++DfTBgrSv8/STublJYABcs+lzjvURqBsFvdz7PBphH66++yxt7v
|
||||||
|
bTTmu8O9WHC8/5QTfUzOBAfgyu4CwF3YLRZd81ERtzO/udNYgGO3bifofCfpv+nY
|
||||||
|
MMyCbGxoiAfBWcAHhka+8nMnBj0as+ln220O99N6zH1rTmqqDxRQkEiYek1MqEU1
|
||||||
|
f319u3KqB6STWmZvjlwQ5AhwSLCLT2VpIJX4CpMClWlLb3E2rpZ+B1uBRMQQ3fMe
|
||||||
|
jSynatL2vXn3rKWzxIEIxA/BkVKQ8zXgOT9JyqyCZdHTvjEmWuQitILi7wKWJb7/
|
||||||
|
qhTGEBoQbjIKP2Bpso286RKhS3erE0wqLeXXFb7e6bkEEHXa/jVHCZk8/qDcAAIB
|
||||||
|
3eIb5SNnLxQwo07JlWdDPzCvqeC4fx5AWxXmHsKWI+91PA0jdNjcEPt2sxwAEQYq
|
||||||
|
LWBW6BL22Hqo/VOBXhM1T5mFKomqySLSrxTYeWXtJLZwh0aHbm6RyGGMjHpCiU3S
|
||||||
|
XgE8EQeKefLHoTixb1Rl/amIvtOUUcTtdqlyat9hhIdMl/7ZMesmNuD1ZsEzdCJd
|
||||||
|
20/DgHzFE7WvZKrjt73GDETUjwLHZSl5fydQMgcNFgzU2mdV6nYNhF18gE/af74=
|
||||||
|
=UA8K
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAxjNhCKPP69fAQ//RVzQX4Ua5XZHTIe7ffYiqMxy/KoJdbCxpgjbdD0sx2ou
|
||||||
|
zCB13t13UkLjLo5GkTE7kRGtyKOdhQ/7NUA7tOZ+rwWOq3NehOTLfU0wMkgT7tOh
|
||||||
|
byWwNHrY9VHz3ndFnya5nNcnrqILA1rEn32PnioNyWcU6832jyUWvtRqwF+JRrKr
|
||||||
|
yRJMvz4T8vmLwrxqarB1uqU0OVHXy8bq8d9/pVrAmk6+C/H5FINFlApD0dKYftd2
|
||||||
|
phoTSA5WG8j1e0v5p4+r9cRHlYXFMinMMkpzD/JMyNB1WVZ9aGQxU7WiuYzuv1bh
|
||||||
|
PKN/LEgfh3ypI8W960NHv/OMRjVs/VxA+G3ml3Lw6acRnaLr++MhF2G7ZBTx8rgi
|
||||||
|
fjyF6m4XtacwIKYZ7SNt9eQewGI8VU30o8np33qb9KeOt7v8PrMH1G3X+bTLnJGw
|
||||||
|
VjxjvaBaePmPplYYS7xaPuUnzFNabDXTE8XCQpdJMy26ef77gaWr6TQwXbRlZXrx
|
||||||
|
S60EecMLwUj+daR0PkVBkCDxXkW8+0uPkt6EEn5rmPdMXoh4DUw+4A14t7yyUU50
|
||||||
|
j3M9tv6DuYs/KhgZYfLe+6hVD7fY4lAs5Ge6QGLA/TljAatE3zpSZQK+b7C4HKJS
|
||||||
|
3eRpcAt6CJFhXaCBwl4+gigrg3voX1ykh62oqY/4ecKbAiiVXLIrcflv9kx2Ht7S
|
||||||
|
XgEDhoIRIvXoOUy6j/qjp/OFxwu5y6MpBX4vHxlpL36daL2yShMkCYyY3ajea4eX
|
||||||
|
9k7B9fpRu3sjbDTNr1heffI+5n/HKc8j9a52hzu5eF0e+v+vKY32uk1jlUhZdj4=
|
||||||
|
=R/pX
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA1Hthzn+T1OoAQ/+OHZshi2zBfbVQ91WKLqei7bT4CZGiPxQsl7aogv8JkyL
|
||||||
|
D8p+VgIReMvq4F5QFaIsA8yqMSnjxfIi5bFd9SKjuhOKvuQjyh1rSsFb0t8ESuYi
|
||||||
|
fHBnVw4tDNfTEGQa9YhNJPTq60TwR4P2xYFEgc//AQqfs9XH0cTbvkFS9dkug092
|
||||||
|
u4yJfB2aZEJa0Eh0AenUYzP13bFH0sJwL1hQop1v9gF44JeKHpRNd0Yixlp0Yucs
|
||||||
|
Ccww+WaNFVQ4+zvyW7MnI8/D27/SQGRXXqQE6sOQlsg5SUzF2vIpYbIeuu1NR5WK
|
||||||
|
v1ZB0DlWVuOshIB7M9WUCZcAS5cMAWKc1vvZ/K0l+6tNskZvGE4p/lv1bmZ5zfc3
|
||||||
|
gT/2L6ENuoKW7RoF071SsG9Xn7VJync+iNTtg0m7Je7HRAZAGGc8vfIkrTXAmoIE
|
||||||
|
QkGuog0R+EZxq9L1WMbppV/bnbBxiutFxwWOGTxzsn+DksVrVLvyI/EbHJvcEwzN
|
||||||
|
hISPFmAiCEKzGAGfaO24F5Xcs+U6AgumS5V5kwY6zA/kZpJEdQm38rcC12ZpXR9C
|
||||||
|
oHGs9ACtgf+g8H3/Ks5DL48FTbYuZADamVA5+pV97B7xCS8TxYChuFNPLwU2s52G
|
||||||
|
liiZV9NevlFlbsXFZS/EWgR8b0aH9Nhjl5TAPOajBOu0Nm/83XEP9nbbbjJjGRHS
|
||||||
|
XgHop/OMkJRuZZ35JQjUS6dIBzSivqplpr51wHbyilxbvOHdvuu6w9kqGY9VhuVt
|
||||||
|
nCszg+IQ0SM8YFuu1M5UPO4txYQTHx8zO5SD/d8kh5HEu9fmTNyJXblRcyAzYZc=
|
||||||
|
=TxDz
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA46L6MuPqfJqAQ//co7jg6v5QUB7eHXJPMLxsgtbC/VYp7C7QqXQda5qhohW
|
||||||
|
t0F9lysBybhIGoYuvfZGzNMYqqkVpFxzlOO2vFlcYFsQhjCpJrHBWYT4XOmIBR64
|
||||||
|
6Az/iKqNLS+cG+rFIIuc8BqRk3r4lrM32dCqz0a+3qRkdmbff4yKuzg8FTPlv1RI
|
||||||
|
O9SzRqfptcKDXItnQF+8CAziqcGyy4jL2wnl1Q2I2Pksr+Zw1eZVbFfHmCpG7A5C
|
||||||
|
TVihozz51jeXlggDp9/NPJOQDsmV+KdpvNx2Eqj6PQ6aGWtyYv5YZG3X/eRKW90+
|
||||||
|
qUOJxwpW5KGcROnuvQt1AggcXquOTLHFyJ85M8tpJcl+JYVZsIeNDo+LO8sbrCTA
|
||||||
|
cjp/YSLOms+GullbGAwrJh4TYtwJE9sEKr9OAFUvd+AxVFWj08BqMe1eN5YBbwwB
|
||||||
|
vNurVdvjE8jaTCmZgPPOIP5KXSrsG8bA02YlZ4MnzodYidIhTudJ8VB4NYCtNgOL
|
||||||
|
G/x7h/KA5KYgDWEtr21z2oy0QkGijtrcNa02GpslirjufZ6TPGCbJjAeEsPbYBm7
|
||||||
|
mDXm5+PzZpb1pbcSVNlVG5Ry73JrZxBpYCPGnxLs5yAmWOlNa/xcgDHBU+iXyVg0
|
||||||
|
Wm8pHRAVNfbvL7NB8yeaxSDoTSE7/BsisL6tUHoV+bdlpVsTF26bQZBc/zhxiZrS
|
||||||
|
XgGJ8ChRZbpi2qUzP4nA2jPkYtQ4cquA+ftDx4i+ZqVNtAhVSnTiBZoYu/21+BUB
|
||||||
|
oxDa5m2vD0s0t0fGfmmIvpLZKZIF7NcwnCdNVQve/D3qNNa4T3YnXb8JTGH0PYc=
|
||||||
|
=mu1s
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA4EEKdYEzV0pAQ/8D4mAcC6vsHLkSryz1yIYoBqqtJnG62pITFEbafhVLR6V
|
||||||
|
nWAw/zP9DqNj15MsrM67xaQxlMVgkVM7QTchgp0CjXsyZ/gWPgDl0NaC92Uj93Ov
|
||||||
|
Gi2OpkfHQFaAW6JsAFl5NrF0ZBw/flx8X0l2klIxBV+ztpkLADEtXWsoGsmz5L4m
|
||||||
|
n41icEp9+nb9nwy7p+Je0s4jZCBB0sVlbkX9i4IpMOgEhA0HcWemc940VJp3UyRg
|
||||||
|
LkOs5C0J4Y4qjS12248y16gV/IhNaJ4PCPgVwSj1Xzz6VXauQosmWhnUbnqJbi3F
|
||||||
|
KWEV0IJJO+dlj5VShzFDnkN2bM1GeyQx1S+FkNp+Mmm6JNrUK+CZL8fUYka06O0V
|
||||||
|
DD/sg1Pyq8VawNG5RxwAWA5F1F1SIrJzF0T4HyIN1UFRCjWC466sdrBTQLtx472k
|
||||||
|
NdBCvabHS/bx5miPKF5iglJYzz4biUdevc3EU7q4hwgMYM2oep3m2EsaTbKWzjnY
|
||||||
|
PLB4d0bCsRlya0YfHaFX5f3xSNb/FzBcUlTHzX2asyB2DolMug1VqS3jCEkWGbk/
|
||||||
|
vfNfR5yRuwkwNlJRqHbGIfH7fYEgwSTW+VW2iUdY7Dra7xjgTzqZgLi5W8QwKJqq
|
||||||
|
1V5H4KlRQNYwloVJzQZCwoPcY+tBfTZ4LsDKtjyJzFY9vdTGGGqb9lAG7YBUdubS
|
||||||
|
XgE72UuZvbPQZuI7uVKMEORGVssQjwZFhs4InR/Ixe03a7hb8fdRHfu/ueS/3KQx
|
||||||
|
mRXVino/iVQ6M936mtibfeH9TpBpjqH8sBKNHv2hgnoap9QpkrVn1yWqrOcpht8=
|
||||||
|
=+sXL
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hF4DQrf1tCqiJxoSAQdA/tIZCvQv0E4dHN5jBHsAGclKEeLFhyf4lIQx+xa+uwQw
|
||||||
|
/VGCdNT8U13EawRC66KLXRrRgsNPpwUg15wAoTzQ8gW/tLpgvL5nsEYPfaowYwBD
|
||||||
|
0l4BmNV4o4J+NHF7Tk1af2kx0pp6kF9eJynn6irr336tGzY004lZfZlqwgeOk+qN
|
||||||
|
93XcSfdAOlIktfex1q1oTPrSpGIv32zsLPoRNVa50dO+IKu1tmYAxi9N9sQgbWa4
|
||||||
|
=rnF9
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
|
||||||
|
- created_at: "2024-06-20T20:01:32Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAzdAjw8ldn6CAQ/9HNG41mTgq8VavF9DBX7+upnsmoDtwblck18l3rurJ1mo
|
||||||
|
k2ki7tWwIxRyLLHtsUxJ9S55cmXuhhPJK8Kzc32SnY5irDkqK/4JZnDvofg+z68B
|
||||||
|
8pQOunN1BQp50k8vd4Mha43re8s24iqrM+fj59uHM2YYsQYt9TCR/NvUopOdi6l2
|
||||||
|
8OnKI2KdRvYhtzzCY3wmQKhG7p0hc8y8pP/0DmPW5IGQ6OP4zO+Qnc4EbVnA9Uhr
|
||||||
|
tZ4sTNn0o80kfvILKANkAm81v86KdSRXdd3+1IpH1c7rTqm9o+DEm8nKnwWOF63O
|
||||||
|
P0klsYLlfqiZyQ0AyS67RHPTw/y57mAyWVFbABDLtXQQHWcIkADMLKTJLpnhKkRn
|
||||||
|
Cp94EXBBBwViAUBUzzskE4lgKXncl1h5ogLum8btU+cLky0qa8Hzie5QqszlErf8
|
||||||
|
fci0AEHV8u+Kf5EARf1FiY6K2aVnFOJchdeL98qllwRu6f8zz7+bfLq1UXcGBlQS
|
||||||
|
JnbAlXiL4vEBxQyW5awYYzpaMUTW1ejjujZUitdaUeIQJdv/IJvHe9y6/F0uukdt
|
||||||
|
AMrDI7E+JKa6hLPe4g6H1hUzh6GcaHuNU9z2NSDfzxcOHkqALsCDLVDxsjPhahCc
|
||||||
|
UZkSn8ebyqv7/jpTgWnsls0Fx8XqvKKJNoqXfK81oIvWlJsEwqSaBczkq9HQbO7S
|
||||||
|
XgH2N8XPOJWmqDc+xS26eERNJ8ZlhYaODWwatgqt2si6EdBpVRZL4PXsOrOlI8Xi
|
||||||
|
Uaag1/Uljqbk5mN18+CtSfSt0ded79d44B9zAbc70hgvkRrpcotDBnO8YQ9MxB0=
|
||||||
|
=O0Sg
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
|
||||||
|
unencrypted_suffix: _unencrypted
|
||||||
|
version: 3.8.1
|
7
config/hosts/mjolnir/sops.nix
Normal file
7
config/hosts/mjolnir/sops.nix
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
sops = {
|
||||||
|
defaultSopsFile = ./secrets.yaml;
|
||||||
|
};
|
||||||
|
}
|
10
config/hosts/mqtt/configuration.nix
Normal file
10
config/hosts/mqtt/configuration.nix
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
hostName = "mqtt";
|
||||||
|
domain = "z9.ccchh.net";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = "23.11";
|
||||||
|
}
|
9
config/hosts/mqtt/default.nix
Normal file
9
config/hosts/mqtt/default.nix
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./configuration.nix
|
||||||
|
./networking.nix
|
||||||
|
./mosquitto.nix
|
||||||
|
];
|
||||||
|
}
|
33
config/hosts/mqtt/mosquitto.nix
Normal file
33
config/hosts/mqtt/mosquitto.nix
Normal file
|
@ -0,0 +1,33 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://search.nixos.org/options?sort=relevance&type=packages&query=services.mosquitto
|
||||||
|
# - https://mosquitto.org/man/mosquitto-conf-5.html
|
||||||
|
# - https://winkekatze24.de
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.mosquitto = {
|
||||||
|
enable = true;
|
||||||
|
persistence = true;
|
||||||
|
|
||||||
|
# set config for all listeners
|
||||||
|
listeners = [{
|
||||||
|
settings.allow_anonymous = true;
|
||||||
|
omitPasswordAuth = true;
|
||||||
|
acl = [ "topic readwrite #" ];
|
||||||
|
}];
|
||||||
|
|
||||||
|
bridges.winkekatz = {
|
||||||
|
addresses = [
|
||||||
|
{ address = "mqtt.winkekatze24.de"; }
|
||||||
|
];
|
||||||
|
topics = [
|
||||||
|
"winkekatze/allcats/eye/set in 2"
|
||||||
|
"winkekatze/allcats in 2"
|
||||||
|
"+/status out 2 winkekatze/ \"\""
|
||||||
|
"+/connected out 2 winkekatze/ \"\""
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1883 ];
|
||||||
|
}
|
21
config/hosts/mqtt/networking.nix
Normal file
21
config/hosts/mqtt/networking.nix
Normal file
|
@ -0,0 +1,21 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "10.31.208.14";
|
||||||
|
prefixLength = 23;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "10.31.208.1";
|
||||||
|
nameservers = [ "10.31.210.1" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "BC:24:11:48:85:73";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
|
@ -11,9 +11,19 @@
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.netbox;
|
package = pkgs.netbox;
|
||||||
secretKeyFile = "/run/secrets/netbox_secret_key";
|
secretKeyFile = "/run/secrets/netbox_secret_key";
|
||||||
|
keycloakClientSecret = "/run/secrets/netbox_keycloak_secret";
|
||||||
settings = {
|
settings = {
|
||||||
ALLOWED_HOSTS = [ "netbox.hamburg.ccc.de" ];
|
ALLOWED_HOSTS = [ "netbox.hamburg.ccc.de" ];
|
||||||
SESSION_COOKIE_SECURE = true;
|
SESSION_COOKIE_SECURE = true;
|
||||||
|
# CCCHH ID (Keycloak) integration.
|
||||||
|
# https://github.com/python-social-auth/social-core/blob/0925304a9e437f8b729862687d3a808c7fb88a95/social_core/backends/keycloak.py#L7
|
||||||
|
# https://python-social-auth.readthedocs.io/en/latest/backends/keycloak.html
|
||||||
|
REMOTE_AUTH_BACKEND = "social_core.backends.keycloak.KeycloakOAuth2";
|
||||||
|
SOCIAL_AUTH_KEYCLOAK_KEY = "netbox";
|
||||||
|
# SOCIAL_AUTH_KEYCLOAK_SECRET set via keycloakClientSecret option.
|
||||||
|
SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAi/Shi+b2OyYNGVFPsa6qf9SesEpRl5U5rpwgmt8H7NawMvwpPUYVW9o46QW0ulYcDmysT3BzpP3tagO/SFNoOjZdYe0D9nJ7vEp8KHbzR09KCfkyQIi0wLssKnDotVHL5JeUY+iKk+gjiwF9FSFSHPBqsST7hXVAut9LkOvs2aDod9AzbTH/uYbt4wfUm5l/1Ii8D+K7YcsFGUIqxv4XS/ylKqObqN4M2dac69iIwapoh6reaBQEm66vrOzJ+3yi4DZuPrkShJqi2hddtoyZihyCkF+eJJKEI5LrBf1KZB3Ec2YUrqk93ZGUGs/XY6R87QSfR3hJ82B1wnF+c2pw+QIDAQAB";
|
||||||
|
SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = "https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/auth";
|
||||||
|
SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = "https://id.hamburg.ccc.de/realms/ccchh/protocol/openid-connect/token";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -21,6 +31,12 @@
|
||||||
mode = "0440";
|
mode = "0440";
|
||||||
owner = "netbox";
|
owner = "netbox";
|
||||||
group = "netbox";
|
group = "netbox";
|
||||||
restartUnits = [ "netbox.service" ];
|
restartUnits = [ "netbox.service" "netbox-rq.service" ];
|
||||||
|
};
|
||||||
|
sops.secrets."netbox_keycloak_secret" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "netbox";
|
||||||
|
group = "netbox";
|
||||||
|
restartUnits = [ "netbox.service" "netbox-rq.service" ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,23 +1,19 @@
|
||||||
# Networking configuration for the host.
|
{ ... }:
|
||||||
# Sources for this configuration:
|
|
||||||
# - https://nixos.org/manual/nixos/stable/#sec-networking
|
|
||||||
# - https://nixos.wiki/wiki/Systemd-networkd
|
|
||||||
# - https://wiki.archlinux.org/title/Systemd-networkd
|
|
||||||
|
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "172.31.17.149";
|
{
|
||||||
prefixLength = 25;
|
address = "172.31.17.149";
|
||||||
}
|
prefixLength = 25;
|
||||||
];
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "172.31.17.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "62:ED:44:20:7C:C1";
|
matchConfig.MACAddress = "62:ED:44:20:7C:C1";
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
netbox_secret_key: ENC[AES256_GCM,data:7cVGSlrCo3MEjeLjfeZrL0VZi3+yZqsC3qI+rx+xadic78H0egWCCNaYEHIgtilgFjw=,iv:gnearzPduWcrVLU/FuzS05eNPZ5srX0hqZyElq+19ek=,tag:9MKgFb4eVYE6a5ncx9sgpw==,type:str]
|
netbox_secret_key: ENC[AES256_GCM,data:7cVGSlrCo3MEjeLjfeZrL0VZi3+yZqsC3qI+rx+xadic78H0egWCCNaYEHIgtilgFjw=,iv:gnearzPduWcrVLU/FuzS05eNPZ5srX0hqZyElq+19ek=,tag:9MKgFb4eVYE6a5ncx9sgpw==,type:str]
|
||||||
|
netbox_keycloak_secret: ENC[AES256_GCM,data:WLPCwl6KmHhyGwpqchZUmTr0XwA1T9asAEXNOSQMfGU=,iv:fsO+Ho18Uz6+y2iohbve1bUKhCR/c2zNrbODR2Jrh3Q=,tag:MWeh7GhdyUJnSzrndA3l3Q==,type:str]
|
||||||
sops:
|
sops:
|
||||||
kms: []
|
kms: []
|
||||||
gcp_kms: []
|
gcp_kms: []
|
||||||
|
@ -14,8 +15,8 @@ sops:
|
||||||
V1lQK3YzTWI5ZGdyeGtFQ0E3QXQ3YnMK8sBStC8xBKwpeWkF/HrryWi0hZA69nuw
|
V1lQK3YzTWI5ZGdyeGtFQ0E3QXQ3YnMK8sBStC8xBKwpeWkF/HrryWi0hZA69nuw
|
||||||
a73HiZuED8KEp5OPME3yC6Ode71uEEaE/av2zp7WUYbCqVpWnwcjSg==
|
a73HiZuED8KEp5OPME3yC6Ode71uEEaE/av2zp7WUYbCqVpWnwcjSg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2024-05-26T01:07:35Z"
|
lastmodified: "2024-10-08T23:54:23Z"
|
||||||
mac: ENC[AES256_GCM,data:0zWNPrUqpuC/qXOaTE8ayrTbnZdg9VA2NqxSNnV0bogqxVkg8zhbx8OKYfNQ0DswjxKNEnKsqjp62gA678VfRfGHJU5ZoHfAC7kBbrkDy+pMzS6LRwT+7n0C1AbaaG7hienGJQsx2gUUYqu7OSQuS722lXAw65deFvZGtL6lt8E=,iv:mOLkzF5pJFazmH9XX94Hjd04FcgSh0hY4juEO3vKNBc=,tag:lSk0lnVONQCmuO0KmxlL0Q==,type:str]
|
mac: ENC[AES256_GCM,data:6KwBwJ1uTuOaCTcBs9sgvX+E/bV37ylJmDqYupa3545ba5Y3VMuF2Hx72zzRYPmh5/DmwzDxc/f7TZUheO5jwwwMGGNCYuX2c+nkzLgtovT/yCXTo8vPHNf03fQRHlOq28ztQIG8Ug1s/t4XkA+iuqPdbvyNKLbsJfJBqg4SF44=,iv:SUXPFtW3/pSTBnjAh77G6pJTucHy4VEhUVkELiMJ4JU=,tag:SfLCwPpJuvL7RrIRmN5PGg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2024-05-26T01:07:22Z"
|
- created_at: "2024-05-26T01:07:22Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
|
|
|
@ -1,19 +1,19 @@
|
||||||
# Networking configuration for the host.
|
{ ... }:
|
||||||
|
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "172.31.17.158";
|
{
|
||||||
prefixLength = 25;
|
address = "172.31.17.158";
|
||||||
}
|
prefixLength = 25;
|
||||||
];
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "172.31.17.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "BC:24:11:6A:33:5F";
|
matchConfig.MACAddress = "BC:24:11:6A:33:5F";
|
||||||
|
|
7
config/hosts/penpot/configuration.nix
Normal file
7
config/hosts/penpot/configuration.nix
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking.hostName = "penpot";
|
||||||
|
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
11
config/hosts/penpot/default.nix
Normal file
11
config/hosts/penpot/default.nix
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./configuration.nix
|
||||||
|
./networking.nix
|
||||||
|
./nginx.nix
|
||||||
|
./penpot.nix
|
||||||
|
./sops.nix
|
||||||
|
];
|
||||||
|
}
|
20
config/hosts/penpot/networking.nix
Normal file
20
config/hosts/penpot/networking.nix
Normal file
|
@ -0,0 +1,20 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking.interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "172.31.17.162";
|
||||||
|
prefixLength = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
networking.defaultGateway = "172.31.17.129";
|
||||||
|
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
networking.search = [ "hamburg.ccc.de" ];
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "BC:24:11:26:1C:8A";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
63
config/hosts/penpot/nginx.nix
Normal file
63
config/hosts/penpot/nginx.nix
Normal file
|
@ -0,0 +1,63 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "design.hamburg.ccc.de";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
default = true;
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
default = true;
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:9001";
|
||||||
|
};
|
||||||
|
|
||||||
|
locations."/ws/notifications" = {
|
||||||
|
proxyPass = "http://127.0.0.1:9001";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 8443 31820 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 8443 ];
|
||||||
|
}
|
198
config/hosts/penpot/penpot.nix
Normal file
198
config/hosts/penpot/penpot.nix
Normal file
|
@ -0,0 +1,198 @@
|
||||||
|
# Sources used for this configuration:
|
||||||
|
# - https://github.com/penpot/penpot/blob/2.1.0/docker/images/docker-compose.yaml
|
||||||
|
# - https://raw.githubusercontent.com/penpot/penpot/2.1.0/docker/images/docker-compose.yaml
|
||||||
|
# - https://help.penpot.app/technical-guide/configuration/
|
||||||
|
# - https://medium.com/@social.iodols/managing-docker-containers-in-nixos-fbda0f666dd1
|
||||||
|
# - https://madison-technologies.com/take-your-nixos-container-config-and-shove-it/
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
# Flags for both frontend and backend.
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#common
|
||||||
|
# https://github.com/penpot/penpot/commit/ea7ad2aaa096f8d190d740f693f22f3ed1f05088
|
||||||
|
commonPenpotFlags = "disable-registration enable-oidc-registration disable-login-with-password enable-login-with-oidc";
|
||||||
|
penpotVersion = "2.1.3";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
virtualisation.docker.enable = true;
|
||||||
|
virtualisation.oci-containers = {
|
||||||
|
backend = "docker";
|
||||||
|
containers = {
|
||||||
|
"penpot-frontend" = {
|
||||||
|
autoStart = true;
|
||||||
|
image = "docker.io/penpotapp/frontend:${penpotVersion}";
|
||||||
|
extraOptions = [ "--network=penpot" ];
|
||||||
|
ports = [ "9001:80" ];
|
||||||
|
volumes = [ "penpot_assets:/opt/data/assets" ];
|
||||||
|
dependsOn = [
|
||||||
|
"penpot-backend"
|
||||||
|
"penpot-exporter"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#frontend
|
||||||
|
# https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L78
|
||||||
|
|
||||||
|
PENPOT_FLAGS = "${commonPenpotFlags} disable-onboarding";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
"penpot-backend" = {
|
||||||
|
autoStart = true;
|
||||||
|
image = "docker.io/penpotapp/backend:${penpotVersion}";
|
||||||
|
extraOptions = [ "--network=penpot" ];
|
||||||
|
volumes = [ "penpot_assets:/opt/data/assets" ];
|
||||||
|
dependsOn = [
|
||||||
|
"penpot-postgres"
|
||||||
|
"penpot-redis"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#backend
|
||||||
|
# https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L112
|
||||||
|
|
||||||
|
PENPOT_FLAGS = "${commonPenpotFlags} enable-smtp";
|
||||||
|
|
||||||
|
# PENPOT_SECRET_KEY st via environmentFile.
|
||||||
|
PENPOT_TELEMETRY_ENABLED = "false";
|
||||||
|
|
||||||
|
# OpenID Connect configuration.
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#openid-connect
|
||||||
|
PENPOT_OIDC_CLIENT_ID = "penpot";
|
||||||
|
PENPOT_OIDC_BASE_URI = "https://id.hamburg.ccc.de/realms/ccchh/";
|
||||||
|
# PENPOT_OIDC_CLIENT_SECRET set via environmentFile.
|
||||||
|
PENPOT_OIDC_ROLES = "user";
|
||||||
|
PENPOT_OIDC_ROLES_ATTR = "roles";
|
||||||
|
|
||||||
|
# Database configuration.
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#database
|
||||||
|
PENPOT_DATABASE_USERNAME = "penpot";
|
||||||
|
# PENPOT_DATABASE_PASSWORD set via environmentFile.
|
||||||
|
PENPOT_DATABASE_URI = "postgresql://penpot-postgres/penpot";
|
||||||
|
|
||||||
|
# Email configuration.
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#email-(smtp)
|
||||||
|
PENPOT_SMTP_HOST = "cow.hamburg.ccc.de";
|
||||||
|
PENPOT_SMTP_PORT = "465";
|
||||||
|
PENPOT_SMTP_USERNAME = "no-reply@design.hamburg.ccc.de";
|
||||||
|
# PENPOT_SMTP_PASSWORD set via environmentFile.
|
||||||
|
PENPOT_SMTP_SSL = "true";
|
||||||
|
PENPOT_SMTP_DEFAULT_REPLY_TO = "Penpot <no-reply@design.hamburg.ccc.de>";
|
||||||
|
PENPOT_SMTP_DEFAULT_FROM = "Penpot <no-reply@design.hamburg.ccc.de>";
|
||||||
|
|
||||||
|
# Storage
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#storage
|
||||||
|
PENPOT_ASSETS_STORAGE_BACKEND = "assets-fs";
|
||||||
|
PENPOT_STORAGE_ASSETS_FS_DIRECTORY = "/opt/data/assets";
|
||||||
|
|
||||||
|
# Redis
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#redis
|
||||||
|
PENPOT_REDIS_URI = "redis://penpot-redis/0";
|
||||||
|
|
||||||
|
PENPOT_PUBLIC_URI = "https://design.hamburg.ccc.de";
|
||||||
|
};
|
||||||
|
environmentFiles = [ "/run/secrets/penpot_backend_environment_file" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
"penpot-exporter" = {
|
||||||
|
autoStart = true;
|
||||||
|
image = "docker.io/penpotapp/exporter:${penpotVersion}";
|
||||||
|
extraOptions = [ "--network=penpot" ];
|
||||||
|
environment = {
|
||||||
|
# https://help.penpot.app/technical-guide/configuration/#exporter
|
||||||
|
# https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L221
|
||||||
|
PENPOT_PUBLIC_URI = "http://penpot-frontend";
|
||||||
|
PENPOT_REDIS_URI = "redis://penpot-redis/0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
"penpot-postgres" = {
|
||||||
|
autoStart = true;
|
||||||
|
image = "docker.io/library/postgres:15";
|
||||||
|
extraOptions = [ "--stop-signal=SIGINT" "--network=penpot" ];
|
||||||
|
volumes = [ "penpot_postgres_v15:/var/lib/postgresql/data" ];
|
||||||
|
environment = {
|
||||||
|
# https://github.com/penpot/penpot/blob/develop/docker/images/docker-compose.yaml#L240
|
||||||
|
|
||||||
|
POSTGRES_INITDB_ARGS = "--data-checksums";
|
||||||
|
POSTGRES_DB = "penpot";
|
||||||
|
POSTGRES_USER = "penpot";
|
||||||
|
# POSTGRES_PASSWORD set via environmentFile.
|
||||||
|
};
|
||||||
|
environmentFiles = [ "/run/secrets/penpot_postgres_environment_file" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
"penpot-redis" = {
|
||||||
|
autoStart = true;
|
||||||
|
image = "docker.io/library/redis:7";
|
||||||
|
extraOptions = [ "--network=penpot" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Docker networks.
|
||||||
|
systemd.services."docker-network-penpot" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
ExecStop = "${pkgs.docker}/bin/docker network rm -f penpot";
|
||||||
|
};
|
||||||
|
script = "${pkgs.docker}/bin/docker network inspect penpot || ${pkgs.docker}/bin/docker network create penpot";
|
||||||
|
requiredBy = [
|
||||||
|
"docker-penpot-frontend.service"
|
||||||
|
"docker-penpot-backend.service"
|
||||||
|
"docker-penpot-exporter.service"
|
||||||
|
"docker-penpot-postgres.service"
|
||||||
|
"docker-penpot-redis.service"
|
||||||
|
];
|
||||||
|
before = [
|
||||||
|
"docker-penpot-frontend.service"
|
||||||
|
"docker-penpot-backend.service"
|
||||||
|
"docker-penpot-exporter.service"
|
||||||
|
"docker-penpot-postgres.service"
|
||||||
|
"docker-penpot-redis.service"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Pull docker images prior to starting container services, so that a container
|
||||||
|
# service isn't considered up, if it actually is still just pulling the
|
||||||
|
# relevant image.
|
||||||
|
systemd.services."docker-images-penpot" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
};
|
||||||
|
script = ''
|
||||||
|
${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-frontend".image}
|
||||||
|
${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-backend".image}
|
||||||
|
${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-exporter".image}
|
||||||
|
${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-postgres".image}
|
||||||
|
${pkgs.docker}/bin/docker pull ${config.virtualisation.oci-containers.containers."penpot-redis".image}
|
||||||
|
'';
|
||||||
|
requiredBy = [
|
||||||
|
"docker-penpot-frontend.service"
|
||||||
|
"docker-penpot-backend.service"
|
||||||
|
"docker-penpot-exporter.service"
|
||||||
|
"docker-penpot-postgres.service"
|
||||||
|
"docker-penpot-redis.service"
|
||||||
|
];
|
||||||
|
before = [
|
||||||
|
"docker-penpot-frontend.service"
|
||||||
|
"docker-penpot-backend.service"
|
||||||
|
"docker-penpot-exporter.service"
|
||||||
|
"docker-penpot-postgres.service"
|
||||||
|
"docker-penpot-redis.service"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets."penpot_backend_environment_file" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "root";
|
||||||
|
group = "root";
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets."penpot_postgres_environment_file" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "root";
|
||||||
|
group = "root";
|
||||||
|
};
|
||||||
|
}
|
234
config/hosts/penpot/secrets.yaml
Normal file
234
config/hosts/penpot/secrets.yaml
Normal file
|
@ -0,0 +1,234 @@
|
||||||
|
penpot_backend_environment_file: ENC[AES256_GCM,data:+MJbbAjzslBIYlQ9xe0VzM8ON2U5dktJGGHmoUu0HW0mvU4pRYrQXlWdW85RXAyYU9yOiL6TNAHOWUQyqOdo23whuer2jL/Qe17DEhapE4b9W9JqBX7H0VZZKHS70AgGZdWmbj/bWAROg/qGPVKjZLhgKxoVTVbvAIJEXUDAbGfvHlY3BP67yUTXvbmtd/Rdhn6i1HafY7YHFNAW8SkikglW6wR5igEZMFAefMOMgq7aYmNXOr1bImjCPEko0DvumJZM4YMjmb3Wc97wL7OMP9G/V0k9fRclhOj9+lNpeeCKL+VL3Bgo8vqgrB+WIi4a0EwerT8srx351txrU+ITxoHciRQtOpeXVHWL1snW9o7xCoOcil0NS93D9GhW+Hd75Is/xHN08UHmahF1r71nbDK4CmSiUzZzFLl1oWkSTU/31zBUnllHOt5nDMKT42xiniAJcQ==,iv:vtIlNGIh9+e9W+OebTac+UUQp9glBIolC6KQwQMzDn4=,tag:kBBTu7LVp+3xJ/MstLyomw==,type:str]
|
||||||
|
penpot_postgres_environment_file: ENC[AES256_GCM,data:VT36kHkRH8ghnU1oyPpAQZW2LR8GNmG1cQXVjU4f+rGy9hViTivd7qxzMusisy7IcWfVaQuXFvUCT+pCMD/fhSAQZOY/1Rs8LBXJtsuPButOG9Q=,iv:pUjAkvvHjsnzn0xRRmdZXatOgLm9dx8Ggt7lEfiQllQ=,tag:FZRqlcxQWu/FgnJfoukIcA==,type:str]
|
||||||
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
|
age:
|
||||||
|
- recipient: age10ku5rphtsf2lcxg78za7f2dad5cx5x9urgkce0d7tyqwq2enva9sqf7g8r
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZVA5WE9JcDBOQVdPbGkz
|
||||||
|
SnNkWEJvaUtGaWVOajd6SzJ6aGNxSXZQaVhnCmgwT01kNFRZa09Gd1o2ZURyZUJQ
|
||||||
|
N0dwK21vUmk1N1duOVNtV2wrVmlyNDQKLS0tIEJtUENHdXhGcXhRRjM5VkhpdEVG
|
||||||
|
Z3UzOGFFUDhwUndoQWtCdHlMenZETW8KI0FjoFG4E1fhOxYiCIxY2BnLOmGcpoyK
|
||||||
|
EbDdNFQEMngwppEm9r1KzG/1cGMoIij2qpmK4Jz1Hzgk/6dZwvGxzw==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2024-08-10T15:40:27Z"
|
||||||
|
mac: ENC[AES256_GCM,data:hxVxH/BBwYcvbtOH4aOUnI9NnbCfAGnnwE3VQBJBJliOWo9WHm/hx4Eol4vaS+AA2t6AUU7UmzjofX2wSTbqQliDCFCSgbpMofDXP7tmlat+M9Du91fQmfOibzCd84tkqS+TRTFCFX83LmQ7/Bb2mHl77uGVAFYyHX9+IPPEUMw=,iv:w2Rdl2+o7bZRQsOogU6U5DK1UuHn+bL4Ouh3XbByYHA=,tag:6sqJal6+kzk0stP6vK6oOw==,type:str]
|
||||||
|
pgp:
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAxK/JaB2/SdtAQ/+JKe4fsuAKMJr6kuDt5vjv+hrXamWEwRLBfYPHHZHEUeK
|
||||||
|
AQBs9fG9Ni7Qpelv8RIbxWyophgt2TCEqP2d+7EcGTgDZkdLxx5s2LJuCh+tEZwT
|
||||||
|
bm0sPt+8eYY077MxA1ZtlBgkslMugvdnJaDckGc8xRPldUa7gRp0j3yaLULRxjA6
|
||||||
|
T0nyALAqAaDa2uHgB7mTB3pXJYk4GxZpYbVc+wxAWXEDRLR/bpT18ywAcA6iSerd
|
||||||
|
KGDzWKjgOr1TTJqUxsguqDjnVp1c+xRPirC9uENGqW8mxI7h1+4B//dJvuXV/cYh
|
||||||
|
LKi0aDUTnma78mo2v9faUSJl23LkIehWZwbVG/+Mpkk3yxscLV124Vbwj56IFCzI
|
||||||
|
AiJ7m2QVxY5eXoVLodw6Po2S62gkwg7H5Aw3J4pppNuIAIr/8mJBpJoBy6poTsG3
|
||||||
|
QhbQdEdsF5ikoLu/OV/H7mp86zJt42Q+74xGjKYx/qvLq6SDmDA03kqk9N71URyu
|
||||||
|
FRTEDysEkeAzreFFkxn3Q+K/cXvtv/2Knte1lmDTfpmhg4cFwsLPLPH37A2veaxJ
|
||||||
|
JTyWDLHgrJ8NFgii3gLrwj+XLOZOwmCY0puJKtdAnPaaQiLfyqYfeLVlt7Se4MMJ
|
||||||
|
8XaFWcaQHBxL9nRZnx7WkE9LfHIG0e+414hT0F/aER+8iKboIbt6rdEHpEMGDWnU
|
||||||
|
aAEJAhD/TpW7E+yYjFVi/xSQ3kCAruHcm6x4BDTE7by0VeTLiRFW+culxiInOYiD
|
||||||
|
kdp+dATm5f7IrQp/qemL02/Me5yqURZlZrDHra7AiCI+MVBJiCRIY/x6xZSew7PX
|
||||||
|
HC+p9sB+PBFL
|
||||||
|
=1qbt
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: EF643F59E008414882232C78FFA8331EEB7D6B70
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA6EyPtWBEI+2AQ/+Ijn18W+K2je/hpolpY6HmQMTTRpQJZ8YtJ5G35o5WoVP
|
||||||
|
hH+znQMrBBAtnTWeFBeIuIzk4CHjPS0yfnsE4/rP7/lSa177A2xaeiCb74F6k/Es
|
||||||
|
MtDE/TApSlNdPFruN5nkd2I8jAWh1k37nS+/NUhszReR39NNmgA+aCSc2OK04aAz
|
||||||
|
dpPXmaJ+d3zMr7eFoL2NyhNI3A/ZdVP3UmZCp12juckDRl8oeei4PBlw2T6ODJP4
|
||||||
|
tY08I9EyK/5K4auhYJyvayl1RWwRuShFV732ZjztkawLw152W0Rrg75Qoukhs9mr
|
||||||
|
TdyF0zcnVxAcOV4e5wRe13dDV6Ue7zeWFc9bb577thGzUm2Oue0u+oisty16qt9K
|
||||||
|
0vw0tVSDtT/suodG8HpvSwGQ+/xcV7w8XCH8Yx28N9iO49VZCB1ZYXQBxTHVDl2b
|
||||||
|
J/8AivaK4OOFvPWNr4u6oLaO9nz1aaX6Qsap5zn0Qa2Ls2SSBwWk2Fp/f1dq3KOy
|
||||||
|
/jGR89ocuEuImVacr2G6zxPnbukfa4S8q/FUUDbswQUqmWMcDDq3dOQ1fFPRd7vy
|
||||||
|
5a9u3P8LFW+ZPPHop3kgozgZ9pBGDOlw3nkjGjFl39lE33E+049gLE6I6+1+umG0
|
||||||
|
EWkNI9y8X+HmHMthVuYapq23Ix09H6Wa452hZmEUxNgp33M8Zx+l3s6D7o7jfrjS
|
||||||
|
XgElPJuUWyGKPoUY9mFaINyVqjOJGEtEOYRP7jvCpFWDq/xQ8jbJvvv7qBy8+i0b
|
||||||
|
cpqRrMJrvMB2PSLeD6cNWymrNhKilLLFOcG9yaIEudDhiuv3L4/ub08QMroDmo8=
|
||||||
|
=80AM
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAz5uSgHG2iMJAQ//Vv7IVqc9ReeFgo8RWbYpl1W5atAHerZuUh0oYc4otGpb
|
||||||
|
UseJ2JInyykcUeQWlOGvTK+eauBVNET0E/6jylCoWb8lzffhSMJ4FFpvpsoYjPG9
|
||||||
|
Q8s3r8soOCYB0xscfhinZwJg5to+I2MSd8mppWIp4UCQhxv7MqQpbqEzNTfVP7YO
|
||||||
|
QEUZ/lesVovLvxMzKc2YVWyZFSW2G6HK3LTaJIg8gy5ym/crlUB+awd2ZDePGk6F
|
||||||
|
Y7DcKwL1EpCL+hoPWGF9PclYKrOBIZVznYQuwHAqG+Bxr9Ln/NmS/OoCrJDMN6gG
|
||||||
|
2YMZ3Q7GQ82zZESxYA7g+ef9/lGCm7DIkt80or72x7eS6/OP7c1bjGFgKLQNyHFU
|
||||||
|
Th6cOy/TzK8Sq2g1mWB2zyV3xk6mb9C0ETAFD5vvPGVC3Sb4549Y+epe1T3ZLFTA
|
||||||
|
t09nUIpTC05PEdGsWs5Z5MDp8ZCsPZpipbVrWENesNOfaFYG+p7aM0LjgTqZcadD
|
||||||
|
B/Foejayc3XYI0T/NoP43mAZ2nEOw2Bz9lBpwz0PeTfzyrhz9XlJ7Dw462XTFA3i
|
||||||
|
voTHA5+DzGNPf6zC1fH9GcESmpC2nqXit8ZV+Y7Zb9/cAsx3E05S8ayxdBZUrOtJ
|
||||||
|
JSWGOAfPuzGXgL6Ht3iKcmCxQ/pSi1aH0h+bYqlrxTvP9IMyNCrxmP6+YsXCv8XS
|
||||||
|
XgE0NjzRMClq4/HhQ5X0ANGHWxbZJLAbm8yfgK5rnnmvi53RNJhRUHDnNca93brF
|
||||||
|
n27gnVLKM+2FdwRjwNIznkbZV/iNM6zIfRWwmJs9gHRuX/J/XWzD1KjDsn2rmiQ=
|
||||||
|
=bAYZ
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAw5vwmoEJHQ1ARAAkdXjf9h4iyYtKPwR9V8hgIfpt3s3zMduuJN3u76ZHdfE
|
||||||
|
87t5K8eL2yIVN2DeOqtXRG28Broy3LLwMlLOJhxVxS5LAOEjT4ScZyb9H7MLnDsp
|
||||||
|
boW210SLkeQ5vTW9hgjAU9V6wbemxoiNPYTcBUsuirI8a+jpnALLY0jeOILBEmHQ
|
||||||
|
c+wbeo+VnlTQkTKCFI7TwlG1JnRnv3DMATVkOjC2PXmXPNkhr04Ivvf0+yBELY/1
|
||||||
|
hLirTfk/W6vFodPaoaRaeWjGJOo+FbqKLxr2xYzVu6SkF+i4CvDPb1x0t/laTpPA
|
||||||
|
qC6KJ1wyVwG4k7ZBLgRcf5Scn1zgGFzZexUAhdIYp0tKPycphUQxEMOI8/OeBP1V
|
||||||
|
68gBcilvv42zs+ed2RUK4j1e9YklxazZgaUhPfdrBrw/HiDJ8ILaq6LQQZSNrxZx
|
||||||
|
koAV/qw8ylU7vkciyA8bGLOiWc/Ub9vkRSuEi5TMOhmT7bVZ+W/26bWgDcAMmCpa
|
||||||
|
13H1uLXLuHnfDavdesh+RAxRgEavPTMz+HFbqhvkv8sy0RPCodyJv69J7dsS7a2C
|
||||||
|
71Ub7jyZIQyRtTGGZH5EjMQVStBMccE2KrJRzZCKbCmQDofKb4M67caaHBnVrs7D
|
||||||
|
vyx8V7JQGkNOWIgWFb23dtCtRiMzFaRk31mihFmFF2tSgg6XMqNmTp0pc3zQBarS
|
||||||
|
XgFZKRlYE7H1tMUCDwyKB7G3r1jsxBlUSbH1J6XjUBWKkTD4iMHI/4YStvghLjm2
|
||||||
|
0qqgKH/Njd9xBXc3x4Ut7kh8tFMMa07xF7/V0Pgwq+7J7EgckEfKHKA5vcQt17Q=
|
||||||
|
=23io
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA4HMJd/cQYrVAQ//RH/jOrYE9MD9IjkUfsQZ79rjEwDdtmsXs+gS/XUr0MpI
|
||||||
|
f/aDyw/vfvD7ZgY86yqp68x0OQLIyRIx9O05FNB3giVN4YFvZpFblLotpMzCFa2d
|
||||||
|
5xKLIQ1oviDSnE0kKpNM+QKITKjCxyke7MgW/laXvF0zMaVdPj0qo3Zn07MUKULs
|
||||||
|
btxZgPhzwWLjveZGn+72QiBGTF0ce49TWoh6y/l7PDsXhojau2KP556hI3rp/nC0
|
||||||
|
PunbLVRntpz+bOoyOk+xvKen+8b/Vwp+GYA2NBDbZSEY9H3YF5ugZBR/jUc8da7D
|
||||||
|
9EBA35udmQVKtD2XZrIyfhETC1eqLXORo0JKld5oC03JPkqvV+QpMF+8JBjXe1Cy
|
||||||
|
qI4pBmdhTJYFoJHpvMH7eC4CWgZZRMD5mB2nk1hYd9oIiYUPABfdeGxKiFnC8zHH
|
||||||
|
cEY3jgGzetZTxnpk2mxZvFMMwFqyOJA2PnwMTv3IraARkFrLxGzUIG4uOjo+l2fp
|
||||||
|
igOKsw9p46RR1gkuKF4u3yB3/1RloDyqGCU1/n4BCWy5/UkjSQpWKShZt3qMd2G2
|
||||||
|
A6si2zgSHIQ+ubR7MPB3Q3U/Rnw7pSbTbdDc73pZ2SPZfUuJplPSDUvXICGlj8cO
|
||||||
|
jO8s926qp4X9C4mi5um6EX5nLG+pfuKowIBdB2HWmxu2idwyrmNdlIgAcWcteazS
|
||||||
|
XgF9W6THXau4lEmrBqWEiC0K/9NA0cDJqRdvj6wqZ/OIAo86q3yRlm8yY8U7D00j
|
||||||
|
wNS8WSHq+EX0K9LpwQiHAJoxNXABEx/DbRqVeuLn2FaCocZigbvu3k/pePuOsK0=
|
||||||
|
=ZLl2
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAxjNhCKPP69fAQ//dCKpiens8kqp+I9HtwP2CQOVMLLAle1VYB7pJ5pfcyzI
|
||||||
|
/3tAmwcxBmg+jhkFiqheBQYV2yNmBMHc5ulx+MxSDKd9mzCTavlGlE+intPjON8k
|
||||||
|
sis68RnU5OFsnGVXSmJji1vN37cCY4jHkf2vYzz6HJ6FLPrda/W3ZfXI+ZnOCao5
|
||||||
|
wGYrqPcYUj+7gnN1S42HM492oqeCNLcENDvegf8AxtBEgfp7UQ0V3ZC0wZEYhz0V
|
||||||
|
p9bdivFoEZ3Zo0sJTWKj3Df3IA5T6c4dbSPj8r7IZ5iNDguKAjvegXujco7pow51
|
||||||
|
fNNJB02hnYHLMRAbeRqaWyJ7qUQSWbQEgb8NuonspnXnajKc/OddgoTN91gTRgMb
|
||||||
|
op2T3HOFv3lKZPA/xIeDZpIm6GqOW6eJLjqiLP39VGvvNRYg+zxhNg/ZBVkFuSAf
|
||||||
|
U5uDPUyIAr10zdm7NqJKL8wKRbQzBg5OYovrXqSl96+KNenJqbMNv1N7kfSF6FuF
|
||||||
|
x8joEDXIaBSwINE4oXD5SN7Z5L2SuuMJ2nvuXFmmXKerRlrBiGsBzUVMt1bGqKEU
|
||||||
|
KoAAwbInZ9SprSxqJ1EkSVXpNGnFFNlbBB1j2u9BoGygOkVM4ZxIS19DBDLG0Tls
|
||||||
|
Fq6GI5d3axcf7t024UmwcU9yaP1BzrV0bDvDg3X+Azuo5JqpT3pSUvqv+Sy1C3nS
|
||||||
|
XgHK1C7XTOfcvmcxJ1f++xELwRkgNo1OqSG3cIZ8i1tKZFKTyYCiNHa/ajSr+wER
|
||||||
|
4phM7Tdr6ubjLkqvDkMeXvtiGyUoAvbtLC0wqSaE8sEZ28eFGEAaECV/uOW81X0=
|
||||||
|
=0jv9
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA1Hthzn+T1OoAQ/9GTEI65w8icqppqTuvQD50vaR+lCY1NjWT0HekgvNuCLV
|
||||||
|
4gL1cYv7tJ5UU6jOnREoScamWnUTYf/sLINIfa+FgvH+apswQeQCFrdCb8/61/Xc
|
||||||
|
3hsJ8gwmguP1zJabKFI6/Yo3vPPa+kpj0Am6M7dUUxEKw4Lqy6Hc32O6ULNJOvdo
|
||||||
|
56oqr6KoemrpU0TzqkKTpgAZaQjFfVzPWfC8moUL1pvxrHm7rqDPiYcl7fZP3JFD
|
||||||
|
gQMZokH205u1elxiFxuQGtW8jbeBqCZUm1UorEgD2EJYEPfyphIaHaQnCpW8zXkI
|
||||||
|
gt9QT3cqJpGJAobCPbh6vKPtbGPEqZOzOaCMFl07pkOSGPAVGMVfV+FdsfszPYY6
|
||||||
|
Rqsk7zlCFv/iNFWKpkdfI66JLvhmgNwXRv+rkYzH3QrQikjLmAeTzyL69SPujgDK
|
||||||
|
qXBRZiAPwEDScr2Qcum36jDVrT3jRfC1opzwpRxM2ompJ0F6caBPNVjY10BScl7Y
|
||||||
|
RWVmkFrPL9MdEelFLscG17K+y5S/50sLcU+sGbMkmPsmizA0boK5XBXJz3cTadYy
|
||||||
|
Asr2b4aWTqBS5iW1vbWIGJVrUUk3U1S4fFaSvsL3I6O0E+sOB3eEEpQZqpF9Genr
|
||||||
|
hCE8GVE5yQWb3YYK0ZA7j4u+dwA+QfRIuQuMWFoRKp8oqEitjjix3je2R3u8/ILS
|
||||||
|
XgFcAp8Jh+VbnQg/pq92u3dX6afGv6nENpMVPn73yob+sfE5xUFEfEzE1E1WCWdR
|
||||||
|
HiLZVOgpVOYmo2s8/UW60hLNBULpqyf6ZTQsr7IqaGw4g+Ew116cwDawywRSJMg=
|
||||||
|
=T0nI
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA46L6MuPqfJqARAApsnPRzTCIkbKT6jaVHixgP6wyCjfVmvgb0NnMrN2Ygup
|
||||||
|
pafb6GNWoFq9WdiSqwFIJPZlZxJFiIgSxplDI63Wj1MgfvQBEnKUQvnvR+UtnB22
|
||||||
|
bGr9mIrq/wKgslhPLFB0qT81RK/GqJKvRNpI3trGmB1pBnDdb5jiFeDHStv41XrP
|
||||||
|
hezAvmDGBKlM74fehu0pKOanIspyvFAjs31NULSHGJGzBxyM6OGcg/XLt9ea6bI5
|
||||||
|
jHwu3+M/7nixjtaIdCtEFPv/Mdimq9p64+c6AvbEVikUH/omRebRFIRrJCotYENT
|
||||||
|
ak6/2F+Fze2cof6pJPaq1KTF7LQHi1ZaQ/N+YNDsMJIYYuX3lVg/ClEjeo5k1HJ4
|
||||||
|
Jc+ul2KF/dAh8UsJPIdhJDlxIPdnof7xBLax1xmOQTHpqsfhZe5BP/0KMeeXzG6s
|
||||||
|
TlozMaCY0ok4JiQmiJcs+TjHX+uiiih6Wi756v7qwpCk5u3/BM+veHB/slD5Xezn
|
||||||
|
KmuHzwcbaP1n5JlOtv1PLAPfqX9EDsAVr2xhYTBISZiIKXyfagUWzPNX6toYtBfV
|
||||||
|
cQ/m9nfc5/STna7XGucnKkYFG5U2a+olIqCcbbNkN4NcW5ly0M5g1VW3oh02NO8r
|
||||||
|
A/4aU8ECj+79XXx0XCuVojnkGdTT3SQex7bkV2stBpuc5xfESbuOMWXgK0qZrYrS
|
||||||
|
XgEfX0ySVVrCxhtJgsQvZl0zrOwIttomV6hlQgo+n23HNPwjEf4nf1p2sje0uPvb
|
||||||
|
bPC7u5y1eDdy5E0XyWkAg4hxPLg7yOj7ET84Bg9S3NE8cE0nM50qL0N6aCAb4II=
|
||||||
|
=Is94
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA4EEKdYEzV0pAQ/7Bx/s7WlB9TE30vyqVWw6H4DoZS8s03Z21tDAtrUEK+k5
|
||||||
|
QtMPvAIE0SG4lXersM3L6VMmhvPQlwZf+zSzBnO0J5vacvMG8dch4/ZH7YTM0VX6
|
||||||
|
T0Ix9ScamEI8J5Fr1LAeBoqtTa8n1/3N2ILBVPRTTX5Wu4lSUw/voeePXAYxSSMv
|
||||||
|
9vzrxJNcRgzbd/8Fbo3i2vzn4GvrP1JzsprLrUMVFaek5khD0hRDJMM0IhBWFRRh
|
||||||
|
L241zX/IBZDQVz0x1QVUBFmkoUjyNn94CTezTmGvqCXfkLRmcKzTZXd0dhORBPFa
|
||||||
|
LygVSLdor0v5ru70rMds6YN5WvqbmG7KUY8M3gcVXutvID58vw6ZE83T8ZAYj9S5
|
||||||
|
r9hXegeb2e03tCvSrHmQFf37+298/E8/kBrBQgoevnHmm3p0yN3ZbrWLIRhbx2iF
|
||||||
|
NzL5s17PnGzmuSigoZERsN2Flx2fzUbtwVDP3AyLVpQ7NoqTZkJTcGQuvkYawnEa
|
||||||
|
3RxUQySR+a7bED38wJ6zEpVg10ye7c8mVkzQnda1Qp3lnPZxz+1qg1n25I9hjNO6
|
||||||
|
X1E8gtXx2EcwaoWcPO0W/sNBwE09SCM68KWSykwOLvZb5tq/HnhrwSisps5sAg9V
|
||||||
|
Z1c0OCwgJvYoTY46rqk7scN9YkE16LDCtAzgppZerli179E/f/7O3d59CA1mCEXS
|
||||||
|
XgHbdM2nxaBPCPgXXNRVq13R8JXiOokuxUZofwl6FaG8A6yc9z5F4Ygr/KKDeT0i
|
||||||
|
YMBezxQtQ5uKY0jIx5g2r6aSdly3QPNKiFS/rxDCrmtaBqw+OvhvLrnCn6IaRVY=
|
||||||
|
=XAoN
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hF4DQrf1tCqiJxoSAQdAFvRDMKG3Vjs98kRqcs4ep+bYoUcBHbMA7WgzI7CcaGQw
|
||||||
|
FjdmSwvWaHJZQGEbGk4uDHKPHqXRD3HnD9d75Azu2HXnCA29aU2c0zn0PziIi7Aa
|
||||||
|
0l4BbcavPKNBkZpJNgW0uII7xMYJWJ/9vStTxXG/WzNia6nk/Cv7PMJW7EwIeUga
|
||||||
|
+PWB4yGfPXgqJGnJj0H1EdCVPrM/+f19GcFxNKKzkGaKTyVTW9NxntlsFl1vbmRx
|
||||||
|
=YRc6
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
|
||||||
|
- created_at: "2024-08-09T01:28:41Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAzdAjw8ldn6CAQ/5ARLA8sAZHMwNhHJycVof+ZergR58hXCBjbIy5zgyAwYU
|
||||||
|
IJ5OwhTpWqniZjt0b9pvlzU4JO1k73B1WrF7mAYEOKET32GPVatrQ64yInQbORSZ
|
||||||
|
zNQgX3aQ8tEtyBsKAWqwqRjOaP6Plee6G0RCksJBAkjIZik0diTOBwi+ZhgYSRLE
|
||||||
|
G1NAETqMKkLleYQbUWCFNveJOd/7pfhE4xhAEaSxL3dgXNPV2TOngvjCqMXvz0K2
|
||||||
|
hEz6OYC8idpmAJv+S+HOaZbKV+giCopsPyFnbeu8jf1UpbsBRbHPnLOO6lLby2gf
|
||||||
|
2P9MhwSeMjjCZFX/ys8vHQ2jUwXK8jfW3xfVie4hVJgh6vO+uHcomjnk2b+34SRk
|
||||||
|
7ttoozLbMFxwrcP9trV0TgT2uzjFCe4fHccpY1VLTCX/O0eYtlhDhur0Wojp1z9v
|
||||||
|
h5mcqySEtJfHXJbTXkgMA2+QSyUaTTfvZ6oJqX3yAoq5eIzC0CcF+IMa6NS1XkY0
|
||||||
|
TNd3FEhwe7TvKGCy/3bJx6jMUnhT71r6KW/w7RVIHgdp1hfUS9JBhxVB+agQVyRv
|
||||||
|
+HBmvWHqUdwnFzotGRzLU1g6soWa+fRVQQ80qAi1U8e+u9IX3EG0KoIXLjpkvXxK
|
||||||
|
y520NcOdN4wR0xILPP/+47QDN+kM6lunm/EMgrff4YDE8J83qMhH2IP5s/tV023S
|
||||||
|
XgH1hiB0U4SYt0Rp6OGDV+CjBCFaCkPPlync/SVuXddfLC1owGlY9L3jwu7j2PR7
|
||||||
|
jy2jPPTWrOvT0wZKEh4k501LRb0n6LGqW6gDTgOnZKNg2iQ6jybv2HeyyExYllg=
|
||||||
|
=1o5H
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
|
||||||
|
unencrypted_suffix: _unencrypted
|
||||||
|
version: 3.8.1
|
7
config/hosts/penpot/sops.nix
Normal file
7
config/hosts/penpot/sops.nix
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
sops = {
|
||||||
|
defaultSopsFile = ./secrets.yaml;
|
||||||
|
};
|
||||||
|
}
|
|
@ -11,9 +11,7 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
defaultGateway = "10.31.208.1";
|
defaultGateway = "10.31.208.1";
|
||||||
nameservers = [
|
nameservers = [ "10.31.208.1" ];
|
||||||
"10.31.208.1"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
|
|
|
@ -90,9 +90,7 @@ in
|
||||||
# pam_deny.so # deny (order 12400)" for pam.d/sshd, so enable
|
# pam_deny.so # deny (order 12400)" for pam.d/sshd, so enable
|
||||||
# PasswordAuthentication to have it not do that.
|
# PasswordAuthentication to have it not do that.
|
||||||
services.openssh.settings.PasswordAuthentication = lib.mkForce true;
|
services.openssh.settings.PasswordAuthentication = lib.mkForce true;
|
||||||
# The following doesn't need to be set in order for empty passwords to work
|
security.pam.services.sshd.allowNullPassword = true;
|
||||||
# apparently:
|
|
||||||
# security.pam.services.sshd.allowNullPassword = true;
|
|
||||||
services.openssh.extraConfig = ''
|
services.openssh.extraConfig = ''
|
||||||
Match User print
|
Match User print
|
||||||
PubkeyAuthentication no
|
PubkeyAuthentication no
|
||||||
|
|
|
@ -9,6 +9,7 @@
|
||||||
services.nginx.streamConfig = ''
|
services.nginx.streamConfig = ''
|
||||||
map $ssl_preread_server_name $address {
|
map $ssl_preread_server_name $address {
|
||||||
status.ccchh.net 10.31.206.15:8443;
|
status.ccchh.net 10.31.206.15:8443;
|
||||||
|
status.hamburg.ccc.de 10.31.206.15:8443;
|
||||||
}
|
}
|
||||||
|
|
||||||
# Listen on port 443 as a reverse proxy and use PROXY Protocol for the
|
# Listen on port 443 as a reverse proxy and use PROXY Protocol for the
|
||||||
|
|
|
@ -1,17 +1,19 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.interfaces.net0 = {
|
networking = {
|
||||||
ipv4.addresses = [
|
interfaces.net0 = {
|
||||||
{
|
ipv4.addresses = [
|
||||||
address = "172.31.17.151";
|
{
|
||||||
prefixLength = 25;
|
address = "172.31.17.151";
|
||||||
}
|
prefixLength = 25;
|
||||||
];
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
};
|
};
|
||||||
networking.defaultGateway = "172.31.17.129";
|
|
||||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
|
||||||
networking.search = [ "hamburg.ccc.de" ];
|
|
||||||
|
|
||||||
systemd.network.links."10-net0" = {
|
systemd.network.links."10-net0" = {
|
||||||
matchConfig.MACAddress = "86:72:08:F6:C0:D6";
|
matchConfig.MACAddress = "86:72:08:F6:C0:D6";
|
||||||
|
|
|
@ -2,26 +2,6 @@
|
||||||
"dynamic": {
|
"dynamic": {
|
||||||
"sensors": {
|
"sensors": {
|
||||||
"temperature": [
|
"temperature": [
|
||||||
{
|
|
||||||
"sensor_data": {
|
|
||||||
"unit": "°C",
|
|
||||||
"location": "Hauptraum",
|
|
||||||
"description": "Sensor im Hauptraum"
|
|
||||||
},
|
|
||||||
"allowed_credentials": [
|
|
||||||
"club-assistant"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"sensor_data": {
|
|
||||||
"unit": "°C",
|
|
||||||
"location": "Loetschlauch",
|
|
||||||
"description": "Sensor im Lötschlauch (Teil der Werkstatt)"
|
|
||||||
},
|
|
||||||
"allowed_credentials": [
|
|
||||||
"club-assistant"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"sensor_data": {
|
"sensor_data": {
|
||||||
"unit": "°C",
|
"unit": "°C",
|
||||||
|
@ -34,26 +14,6 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"humidity": [
|
"humidity": [
|
||||||
{
|
|
||||||
"sensor_data": {
|
|
||||||
"unit": "%",
|
|
||||||
"location": "Hauptraum",
|
|
||||||
"description": "Sensor im Hauptraum"
|
|
||||||
},
|
|
||||||
"allowed_credentials": [
|
|
||||||
"club-assistant"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"sensor_data": {
|
|
||||||
"unit": "%",
|
|
||||||
"location": "Loetschlauch",
|
|
||||||
"description": "Sensor im Lötschlauch (Teil der Werkstatt)"
|
|
||||||
},
|
|
||||||
"allowed_credentials": [
|
|
||||||
"club-assistant"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"sensor_data": {
|
"sensor_data": {
|
||||||
"unit": "%",
|
"unit": "%",
|
||||||
|
@ -65,12 +25,13 @@
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"CO2": [
|
"ext_3d_printer_busy_state": [
|
||||||
{
|
{
|
||||||
"sensor_data": {
|
"sensor_data": {
|
||||||
"unit": "ppm",
|
"unit": "bool",
|
||||||
"location": "Hauptraum",
|
"location": "Loetschlauch",
|
||||||
"description": "Sensor im Hauptraum (Typ: SCD41)"
|
"name": "mk4",
|
||||||
|
"description": "Prusa mk4 busy state"
|
||||||
},
|
},
|
||||||
"allowed_credentials": [
|
"allowed_credentials": [
|
||||||
"club-assistant"
|
"club-assistant"
|
||||||
|
@ -78,9 +39,34 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"sensor_data": {
|
"sensor_data": {
|
||||||
"unit": "ppm",
|
"unit": "bool",
|
||||||
"location": "Loetschlauch",
|
"location": "Loetschlauch",
|
||||||
"description": "Sensor im Lötschlauch (Teil der Werkstatt, Typ: SCD41)"
|
"name": "mk3.5",
|
||||||
|
"description": "Prusa mk3.5 busy state"
|
||||||
|
},
|
||||||
|
"allowed_credentials": [
|
||||||
|
"club-assistant"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"ext_3d_printer_minutes_remaining": [
|
||||||
|
{
|
||||||
|
"sensor_data": {
|
||||||
|
"unit": "minutes_remaining",
|
||||||
|
"location": "Loetschlauch",
|
||||||
|
"name": "mk4",
|
||||||
|
"description": "Prusa mk4 minutes remaining"
|
||||||
|
},
|
||||||
|
"allowed_credentials": [
|
||||||
|
"club-assistant"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"sensor_data": {
|
||||||
|
"unit": "minutes_remaining",
|
||||||
|
"location": "Loetschlauch",
|
||||||
|
"name": "mk3.5",
|
||||||
|
"description": "Prusa mk3.5 minutes remaining"
|
||||||
},
|
},
|
||||||
"allowed_credentials": [
|
"allowed_credentials": [
|
||||||
"club-assistant"
|
"club-assistant"
|
||||||
|
|
|
@ -1,19 +1,20 @@
|
||||||
{ pkgs, ... }:
|
{ pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
spaceapidSrc = builtins.fetchGit {
|
version = "v0.1.0";
|
||||||
|
spaceapidSrc = pkgs.fetchgit {
|
||||||
url = "https://git.hamburg.ccc.de/CCCHH/spaceapid.git";
|
url = "https://git.hamburg.ccc.de/CCCHH/spaceapid.git";
|
||||||
ref = "main";
|
rev = version;
|
||||||
rev = "17753f535c68157e80f30f50deb488133cc98258";
|
hash = "sha256-2SDhliltzyydPPZdNn/htDydiK/SHQcYyG/dQ0EyFrY=";
|
||||||
};
|
};
|
||||||
spaceapid = pkgs.buildGoModule rec {
|
spaceapid = pkgs.buildGoModule rec {
|
||||||
pname = "spaceapid";
|
pname = "spaceapid";
|
||||||
version = "main";
|
inherit version;
|
||||||
|
|
||||||
src = spaceapidSrc;
|
src = spaceapidSrc;
|
||||||
|
|
||||||
ldflags = [
|
ldflags = [
|
||||||
"-X main.version=${version}-${spaceapidSrc.rev}"
|
"-X main.version=${version}"
|
||||||
];
|
];
|
||||||
|
|
||||||
# Since spaceapid doesn't have any dependencies, we can set this to null and
|
# Since spaceapid doesn't have any dependencies, we can set this to null and
|
||||||
|
|
|
@ -1,10 +1,19 @@
|
||||||
{ pkgs, ... }:
|
{ pkgs, ... }:
|
||||||
|
|
||||||
{
|
let
|
||||||
|
domain = "c3cat.de";
|
||||||
|
dataDir = "/var/www/${domain}";
|
||||||
|
deployUser = "c3cat-website-deploy";
|
||||||
|
in {
|
||||||
|
security.acme.certs."${domain}".extraDomainNames = [ "www.${domain}" ];
|
||||||
|
|
||||||
services.nginx.virtualHosts = {
|
services.nginx.virtualHosts = {
|
||||||
"acme-c3cat.de" = {
|
"acme-${domain}" = {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
serverName = "c3cat.de";
|
serverName = "${domain}";
|
||||||
|
serverAliases = [
|
||||||
|
"www.${domain}"
|
||||||
|
];
|
||||||
|
|
||||||
listen = [
|
listen = [
|
||||||
{
|
{
|
||||||
|
@ -14,9 +23,9 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
"c3cat.de" = {
|
"$www.${domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
useACMEHost = "c3cat.de";
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
listen = [
|
listen = [
|
||||||
{
|
{
|
||||||
|
@ -28,7 +37,7 @@
|
||||||
];
|
];
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
return = "302 https://wiki.hamburg.ccc.de/club:c3cat:start";
|
return = "302 https://c3cat.de$request_uri";
|
||||||
};
|
};
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
|
@ -42,5 +51,45 @@
|
||||||
real_ip_header proxy_protocol;
|
real_ip_header proxy_protocol;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
root = "${dataDir}";
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||||
|
];
|
||||||
|
|
||||||
|
users.users."${deployUser}" = {
|
||||||
|
isNormalUser = true;
|
||||||
|
group = "${deployUser}";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcZJzQO4RYinJm6YDUgCELe8OJA/DYOss+8xp7TtxM0 deploy key for c3cat.de"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
users.groups."${deployUser}" = { };
|
||||||
}
|
}
|
||||||
|
|
|
@ -5,8 +5,13 @@
|
||||||
./branding-resources.hamburg.ccc.de.nix
|
./branding-resources.hamburg.ccc.de.nix
|
||||||
./c3cat.de.nix
|
./c3cat.de.nix
|
||||||
./element.hamburg.ccc.de.nix
|
./element.hamburg.ccc.de.nix
|
||||||
|
./hacker.tours.nix
|
||||||
|
./hackertours.hamburg.ccc.de.nix
|
||||||
./hamburg.ccc.de.nix
|
./hamburg.ccc.de.nix
|
||||||
./spaceapi.hamburg.ccc.de.nix
|
./spaceapi.hamburg.ccc.de.nix
|
||||||
|
./staging.c3cat.de.nix
|
||||||
|
./staging.hacker.tours.nix
|
||||||
|
./staging.hackertours.hamburg.ccc.de.nix
|
||||||
./staging.hamburg.ccc.de.nix
|
./staging.hamburg.ccc.de.nix
|
||||||
./www.hamburg.ccc.de.nix
|
./www.hamburg.ccc.de.nix
|
||||||
./historic-easterhegg
|
./historic-easterhegg
|
||||||
|
|
|
@ -1,10 +1,10 @@
|
||||||
{ pkgs, ... }:
|
{ pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
elementWebVersion = "1.11.59";
|
elementWebVersion = "1.11.84";
|
||||||
element-web = pkgs.fetchzip {
|
element-web = pkgs.fetchzip {
|
||||||
url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
|
url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
|
||||||
sha256 = "sha256-iVTd5zWUJh9wkbKMh+5hq0ucQaLLY29w1xCLxDIdQ18=";
|
sha256 = "sha256-z2qaKKyUq2S/r3xUUU3ym0FgFbiQr6bcltuKvUMPbH4=";
|
||||||
};
|
};
|
||||||
elementSecurityHeaders = ''
|
elementSecurityHeaders = ''
|
||||||
# Configuration best practices
|
# Configuration best practices
|
||||||
|
|
64
config/hosts/public-web-static/virtualHosts/hacker.tours.nix
Normal file
64
config/hosts/public-web-static/virtualHosts/hacker.tours.nix
Normal file
|
@ -0,0 +1,64 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "hacker.tours";
|
||||||
|
dataDir = "/var/www/${domain}";
|
||||||
|
deployUser = "hackertours-website-deploy";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
root = "${dataDir}";
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
|
error_page 404 /404.html;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||||
|
];
|
||||||
|
|
||||||
|
users.users."${deployUser}" = {
|
||||||
|
isNormalUser = true;
|
||||||
|
group = "${deployUser}";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrDTANfPMkcf+V7zkypzaeX2fxkfStPHmZKqC29xyqy deploy key for hacker.tours"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
users.groups."${deployUser}" = { };
|
||||||
|
}
|
|
@ -0,0 +1,69 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "hackertours.hamburg.ccc.de";
|
||||||
|
dataDir = "/var/www/${domain}";
|
||||||
|
deployUser = "ht-ccchh-website-deploy";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
root = "${dataDir}";
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
|
error_page 404 /404.html;
|
||||||
|
|
||||||
|
port_in_redirect off;
|
||||||
|
|
||||||
|
rewrite ^/(de|en)/tours$ /$1/37c3 redirect;
|
||||||
|
rewrite ^/(de|en)/tours/(.*)$ /$1/37c3/$2 redirect;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||||
|
];
|
||||||
|
|
||||||
|
users.users."${deployUser}" = {
|
||||||
|
isNormalUser = true;
|
||||||
|
group = "${deployUser}";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxMnllgRD6W85IQ0WrVJSwr7dKM8PLNK4pmGaJRu0OR deploy key for hackertours.hamburg.ccc.de"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
users.groups."${deployUser}" = { };
|
||||||
|
}
|
|
@ -94,6 +94,8 @@
|
||||||
real_ip_header proxy_protocol;
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
error_page 404 /404.html;
|
error_page 404 /404.html;
|
||||||
|
|
||||||
|
port_in_redirect off;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{...}:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
|
@ -7,5 +7,6 @@
|
||||||
./eh07.nix
|
./eh07.nix
|
||||||
./eh09.nix
|
./eh09.nix
|
||||||
./eh11.nix
|
./eh11.nix
|
||||||
|
./eh20.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
|
@ -0,0 +1,91 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
eh20 = pkgs.fetchgit {
|
||||||
|
url = "https://git.hamburg.ccc.de/CCCHH/easterhegg-eh20-website.git";
|
||||||
|
rev = "026932ef2f1fb85c99269e0fb547589a25d3687c";
|
||||||
|
hash = "sha256-YYxHhPYIioJgyHXNieoX6ibasHcNw/AFk+qCNSOxke4=";
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
security.acme.certs."eh20.easterhegg.eu".extraDomainNames = [
|
||||||
|
"www.eh20.easterhegg.eu"
|
||||||
|
"eh20.hamburg.ccc.de"
|
||||||
|
];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"acme-eh20.easterhegg.eu" = {
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "eh20.easterhegg.eu";
|
||||||
|
serverAliases = [
|
||||||
|
"www.eh20.easterhegg.eu"
|
||||||
|
"eh20.hamburg.ccc.de"
|
||||||
|
];
|
||||||
|
listen = [{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
|
||||||
|
"www.eh20.easterhegg.eu" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "eh20.easterhegg.eu";
|
||||||
|
serverAliases = [
|
||||||
|
"eh20.hamburg.ccc.de"
|
||||||
|
];
|
||||||
|
|
||||||
|
listen = [{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}];
|
||||||
|
|
||||||
|
locations."/".return = "302 https://eh20.easterhegg.eu";
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
"eh20.easterhegg.eu" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "eh20.easterhegg.eu";
|
||||||
|
|
||||||
|
listen = [{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
index = "start.html";
|
||||||
|
root = "${eh20}/wiki_siteexport";
|
||||||
|
};
|
||||||
|
|
||||||
|
# redirect doku.php?id=$pagename to /$pagename.html
|
||||||
|
locations."/doku.php" = {
|
||||||
|
return = "301 $scheme://$host/$arg_id.html";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -0,0 +1,60 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "staging.c3cat.de";
|
||||||
|
dataDir = "/var/www/${domain}";
|
||||||
|
deployUser = "c3cat-website-deploy";
|
||||||
|
in {
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
root = "${dataDir}";
|
||||||
|
|
||||||
|
# Disallow *, since this is staging and doesn't need to be in any search
|
||||||
|
# results.
|
||||||
|
locations."/robots.txt" = {
|
||||||
|
return = "200 \"User-agent: *\\nDisallow: *\\n\"";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||||
|
];
|
||||||
|
|
||||||
|
# c3cat deploy user already defined in c3cat.de.nix.
|
||||||
|
}
|
|
@ -0,0 +1,61 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "staging.hacker.tours";
|
||||||
|
dataDir = "/var/www/${domain}";
|
||||||
|
deployUser = "hackertours-website-deploy";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
root = "${dataDir}";
|
||||||
|
|
||||||
|
# Disallow *, since this is staging and doesn't need to be in any search
|
||||||
|
# results.
|
||||||
|
locations."/robots.txt" = {
|
||||||
|
return = "200 \"User-agent: *\\nDisallow: *\\n\"";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||||
|
];
|
||||||
|
|
||||||
|
# Hackertours deploy user already defined in hacker.tours.nix.
|
||||||
|
}
|
|
@ -0,0 +1,63 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
domain = "staging.hackertours.hamburg.ccc.de";
|
||||||
|
dataDir = "/var/www/${domain}";
|
||||||
|
deployUser = "ht-ccchh-website-deploy";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"acme-${domain}" = {
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "${domain}";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
root = "${dataDir}";
|
||||||
|
|
||||||
|
# Disallow *, since this is staging and doesn't need to be in any search
|
||||||
|
# results.
|
||||||
|
locations."/robots.txt" = {
|
||||||
|
return = "200 \"User-agent: *\\nDisallow: *\\n\"";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
|
error_page 404 /404.html;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
|
||||||
|
];
|
||||||
|
|
||||||
|
# Hackertours CCCHH deploy user already defined in hackertours.hamburg.ccc.de.nix.
|
||||||
|
}
|
|
@ -44,6 +44,8 @@
|
||||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
# header.
|
# header.
|
||||||
real_ip_header proxy_protocol;
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
|
port_in_redirect off;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
10
config/hosts/status/configuration.nix
Normal file
10
config/hosts/status/configuration.nix
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
hostName = "status";
|
||||||
|
domain = "z9.ccchh.net";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
10
config/hosts/status/default.nix
Normal file
10
config/hosts/status/default.nix
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./configuration.nix
|
||||||
|
./networking.nix
|
||||||
|
./nginx.nix
|
||||||
|
./uptime-kuma.nix
|
||||||
|
];
|
||||||
|
}
|
29
config/hosts/status/networking.nix
Normal file
29
config/hosts/status/networking.nix
Normal file
|
@ -0,0 +1,29 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "10.31.206.15";
|
||||||
|
prefixLength = 23;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv6.addresses = [
|
||||||
|
{
|
||||||
|
address = "2a07:c480:0:1ce::f";
|
||||||
|
prefixLength = 64;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "10.31.206.1";
|
||||||
|
defaultGateway6 = "2a07:c480:0:1ce::1";
|
||||||
|
nameservers = [ "10.31.206.1" "2a07:c480:0:1ce::1" ];
|
||||||
|
search = [ "z9.ccchh.net" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "BC:24:11:79:D3:E1";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
149
config/hosts/status/nginx.nix
Normal file
149
config/hosts/status/nginx.nix
Normal file
|
@ -0,0 +1,149 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://github.com/louislam/uptime-kuma/wiki/Reverse-Proxy
|
||||||
|
|
||||||
|
{ config, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
virtualHosts = {
|
||||||
|
"status.hamburg.ccc.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "status.hamburg.ccc.de";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost:3001";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"status-proxyprotocol.hamburg.ccc.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "status.hamburg.ccc.de";
|
||||||
|
serverName = "status.hamburg.ccc.de";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost:3001";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 10.31.206.11;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"status.ccchh.net" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "status.hamburg.ccc.de";
|
||||||
|
serverName = "status.ccchh.net";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
globalRedirect = "status.hamburg.ccc.de";
|
||||||
|
redirectCode = 307;
|
||||||
|
};
|
||||||
|
"status-proxyprotocol.ccchh.net" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "status.hamburg.ccc.de";
|
||||||
|
serverName = "status.ccchh.net";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
globalRedirect = "status.hamburg.ccc.de";
|
||||||
|
redirectCode = 307;
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 10.31.206.11;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"status.z9.ccchh.net" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "status.hamburg.ccc.de";
|
||||||
|
serverName = "status.z9.ccchh.net";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 80;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 443;
|
||||||
|
ssl = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
globalRedirect = "status.hamburg.ccc.de";
|
||||||
|
redirectCode = 307;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
security.acme.certs."status.hamburg.ccc.de".extraDomainNames = [
|
||||||
|
"status.ccchh.net"
|
||||||
|
"status.z9.ccchh.net"
|
||||||
|
];
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 80 443 8443 ];
|
||||||
|
}
|
7
config/hosts/status/uptime-kuma.nix
Normal file
7
config/hosts/status/uptime-kuma.nix
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.uptime-kuma = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
}
|
7
config/hosts/woodpecker/configuration.nix
Normal file
7
config/hosts/woodpecker/configuration.nix
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking.hostName = "woodpecker";
|
||||||
|
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
11
config/hosts/woodpecker/default.nix
Normal file
11
config/hosts/woodpecker/default.nix
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./woodpecker-agent
|
||||||
|
./woodpecker-server
|
||||||
|
./configuration.nix
|
||||||
|
./networking.nix
|
||||||
|
./sops.nix
|
||||||
|
];
|
||||||
|
}
|
22
config/hosts/woodpecker/networking.nix
Normal file
22
config/hosts/woodpecker/networking.nix
Normal file
|
@ -0,0 +1,22 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
interfaces.net0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "172.31.17.160";
|
||||||
|
prefixLength = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
defaultGateway = "172.31.17.129";
|
||||||
|
nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||||
|
search = [ "hamburg.ccc.de" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."10-net0" = {
|
||||||
|
matchConfig.MACAddress = "BC:24:11:5F:A9:B7";
|
||||||
|
linkConfig.Name = "net0";
|
||||||
|
};
|
||||||
|
}
|
234
config/hosts/woodpecker/secrets.yaml
Normal file
234
config/hosts/woodpecker/secrets.yaml
Normal file
|
@ -0,0 +1,234 @@
|
||||||
|
woodpecker_server_environment_file: ENC[AES256_GCM,data:68Wu0UOHBAGZHSJ0x4wbeDLm626jpumv9w6A65FNKsmzYp6P4/c4g1MF1agQd7l9nKMTRrgyJyfoEZYFQRX6lYSmcsQLfn++uh1JpFoClT5p/5hBkiDq4owUFU+NGUiyl6yjYlEiaxLwC4ZdyISHeEYpbrvGyIXLsFgdrQ0rVX3cCRwIMxFcyCG6d3MZVoqAw1A=,iv:y/+X02aRPBOoR57P9s7y/SijvXVLuiBBfFYqeJLvQEU=,tag:DNwK+M6s3moglkMkrWccyA==,type:str]
|
||||||
|
woodpecker_agent_environment_file: ENC[AES256_GCM,data:rwp6TYYFJ/IZH+3pGhPxjdZMLoyPMr/W1RXm4IkUGn+SmIjHZcdFZ8nEhvOfnkfrXNPc2MR+X6NXUmVOcBjSCbcBjh9sC653UpKimt9I3/Ec,iv:X9JH7dmTayw8BaEsXYil3PrykCdd+/ANGHVfEyRvc7A=,tag:/ErkX1WnruanNgTTBUT6LA==,type:str]
|
||||||
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
|
age:
|
||||||
|
- recipient: age1klxtcr23hers0lh4f5zdd53tyrtg0jud35rhydstyjq9fjymf9hsn2a8ch
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQlN5NmlaUjR5dGJ3Y3BP
|
||||||
|
bW4rWm1KaVFsbytwZDQ1QjV1d1VEOEZlSTJ3Cmgxc1BmMnBmWjRyNmNDWmpWcnJt
|
||||||
|
Q3lBZUFOY3FtREFUYmhJNCtKcTUxY0kKLS0tIHhKbVVBYjN4WHRzdERNbkRQeHlS
|
||||||
|
UExiNFNCdkQ4YTNMdEdoWTdxOFZOZVEKZZbNpbyH31z5tyXeINqoNyqy8zvS3mp0
|
||||||
|
YFq6P8kO8CaqUG7KH6yWV0Vq4DryQ9vMcQBnboZOfPf9pZUvhacE/Q==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2024-06-22T15:55:25Z"
|
||||||
|
mac: ENC[AES256_GCM,data:UmDbmxSRj8YfCkKEelQNMJ8mzbu5aQdB9yOr9JfUh5TB9r5Z5ttZ1wgJDJqHNtsII3JGXUvbgHbsmbPikkrj4Ege1rrgr4UttN1rtgeaAKlZIlqb9pOnV4//GJL8jbxCgFp2h2O80G05nAXG54DaY//4Y5hfTyPzgyDlGQ6jlhg=,iv:5e8lpFfGAJh8lTFcY4MlZG7PgnzM0UycsU0tB2KN+zQ=,tag:4xUEHg04wjDbhc9MOItzuQ==,type:str]
|
||||||
|
pgp:
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAxK/JaB2/SdtAQ//QR84p3zGjW2CtPcPxlmdYui5nx8FV3MHog4R24s4RKNK
|
||||||
|
y4n9993z8m3y2at4yIWDi4LBKrhm/6mSLBHfoxnuiptoaSXSWXfaXebXkYiinkyP
|
||||||
|
GMvwegN6KkRZh4stJMD7W0g7w/trkNEAvPDoInqCnvT4NomrKIV+ZrZuCBLd1tXn
|
||||||
|
JRd2tsH8yYzoZr/PJBBDTZtke/nbosb6drjgG6ow/eHyF++HxKNTWfjCiWn4AWSb
|
||||||
|
c/E1VWsigYdBs8XSTbBkfSLr/b5FcXYb8tyy4gpGe9zOrxc7cW5diK5+x4bM8FHz
|
||||||
|
85ShPA5S3PXXEnuifuk/ZK8+CEYWUS3MXUhuEFUo7F3Pt/Eb+5CtfTX6kvMe1xe9
|
||||||
|
iqFAsRce/qm9Evns4ygZ4+LoI2ro2HFwgQ2fu1gi7PyZsDyW5eRL5P+vfxPUOxYY
|
||||||
|
z9cXXo+U1NEzWMDEBWt4mgoW9URye6O3k+WLQmYbQIhDkftUYmvRrPYQvP282m4k
|
||||||
|
NMucRIRUMkx7rpRQQP8yU6AlgZ1LsOmruV4XJYVxsTpSZq7YgTQP4kd3wMgBhwOV
|
||||||
|
j3hGc9gI9Sq06SdyU0C8PuUHt+mZGkVnYIOTw6BXHgY1tK8X5XnWK4NJXL9bR0pY
|
||||||
|
kfzDWLjD0hiiM3QYqieTbnDUiVTDGyf7Cop+EifYvy7um+CPjlYLLkDkEsWcy/HU
|
||||||
|
aAEJAhDEzP5eiU1e01GSNbWL49ghD7DqZiYdo0F/BGMk6jQloM1HUDnkhgBhVSZo
|
||||||
|
TjNPV3UFBxeRnT5DvouD6uJ8SDs42ARdb4F80vJVHknt0yBvGWfCQsXqKwuRDd1j
|
||||||
|
zkj4zG7btJRv
|
||||||
|
=sgSP
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: EF643F59E008414882232C78FFA8331EEB7D6B70
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA6EyPtWBEI+2AQ//V6IIW3Hr3xuQWOWitDGn1bo+x95jePPpXNayKGJuaSMf
|
||||||
|
00gaOyMpqP5hRd3lEQRyqHgPtmszlGrxq2y77CxnnZMbE6n+axwQQLoMzROBGyGF
|
||||||
|
iqe6hNbNFZPjWv5BTAl3iOHWrw3x/TpgcNmSBDfctU+CZlMWzCMuXJw1bK57wQd4
|
||||||
|
B6xcoBxidK55Ubc7GQ8mlAEuZ89fYorTRBfv2rBgUh8ZAAsUmn1jEz7HsQMMd2a8
|
||||||
|
5V4TzicdzXO2cZ+0DqU8Xqt5U9C0IjGgZRPzDYkh7slkbyYomAIfCq+zN5ieecz9
|
||||||
|
Mp8vvuMYfT66P+heNRZ7w/sgmGlarcmNKlOcXlakVYm5qVddPMx6M5Ovl4O5sABz
|
||||||
|
V4O4NRehYx0XFbjzXr59LCzpusS9xQoh49288dLTFudOInHUYq6ss0TbGfFJMDYU
|
||||||
|
mjHokzdG3ds8C9/lMR82X9rbyZDchUytHUwX4eGxUDMmhydFpgJko0bbozPbE2ll
|
||||||
|
NTlWegCc1yrkSGn6U9EYKtibitJnIMdas5HapcErMH2vYILsJOl9ifG1GIsuWe1+
|
||||||
|
ipPyZy7jqP7p18WCcDnUhgaGdQ67UjSLqX2zz0SZDcfI46SUeyeSelFVpTlmKriS
|
||||||
|
4bW6hC1FSe+bLkPZ0y5aRLgL5ipK6jdlZepAj/DNXdKAtchLHcddF3rKdBdzsxrS
|
||||||
|
XgFvvZPgj1JleYr+q/+ju4k1d4cE0HnQZIBnkAfKXZHwSPCw1d9vbeLipuRTJrEH
|
||||||
|
2CpOjtiXl3S2ZcCS1ama9lgAqPBOOoH7jgHvoCzqfkBsi3/QlIpQs+C8ro4hXE8=
|
||||||
|
=KZWk
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAz5uSgHG2iMJARAA5+vcORn/YX2bHcAno9KCUGTzeiCP/DOoSePMdsCAmABj
|
||||||
|
P8XoYJOyZoZgW3qgvtKZ4pLGB26FuJXC2y6Z3yyQ4Xj2PeBj1og9xM8p7GnF6T6n
|
||||||
|
7wqALwJOamyer3A+OXx2Gc8kZ0ObqgBbbn5QTPnHzsRljC3Irgk+ZZE8ZRshoPmu
|
||||||
|
6TEuMW0NT5INmijtPAxer/eaAor3KKxMTf+sqqr/VGNopAyFUCGZynlnjcei6X+T
|
||||||
|
tVKh6zqr/eaTlnhoP2kr4u+wKcHvLV8an8sfsyIGL90O11LNcX8Sf4EyPDYSXOe7
|
||||||
|
AXTFcvfw9+ALu3cbTVPN0aI2e8fCir2S00F8x28Ffc2xDSrXjWEDCXLuRNVXz5KA
|
||||||
|
Mjq4afyQN6mtVZ6ZmtvaLQoG8D2f2sGzvrsBjaXwxPLHKPpUFZVBiiP0C08yokUR
|
||||||
|
7FrYaOjnvQVALLxGJMAhMf02g2dYDFxMw18cY2a+bLrYUVd9EMbuFwCJNzmU0of7
|
||||||
|
EpSvXrA0wTKddk+vL3JoJgIrOxz2IQbaC24NiCUzbyakhT+qDX/oXXILxL2x0GfR
|
||||||
|
RaTL1inkTQO//ooAjlPeMA3OIDQo5CdoV4VlvSUgagYfDvMfDCAO04Xxvezh1uvz
|
||||||
|
//4Jz13+LFoUgbtVUYiT4oqWyfTKOV0D8ILYWKZJtjJt4TeYpEfbQFEzIYyF3OHS
|
||||||
|
XgE7aGyB0ArPBovSr55eQGmW+FaeG1VtH7TRLU367FyQmGep5O2SUxQXqFFiWyDy
|
||||||
|
bseIYdRqNsmlgdXBnADdkVCFJtF4C/VA2DOk+wOO8XtQoMQ8zrIl+0Viq1s66OY=
|
||||||
|
=xc00
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAw5vwmoEJHQ1AQ//abtgoFEWd+zbeSbiwey8nCNQUSklHV9kbLuBK8+ipX/Q
|
||||||
|
qjweWnnPVN6ODhgfXm93k1tSqeJjYqjqfxVsAEUiXC61UhvS6JBZuVUt4nRUWHk2
|
||||||
|
cdu3eKlBx7Nhm6th1gZ+Wf7PcryT5fmJQP5a8VEM/nUuRjnAmG7RuSiWbNzBbTDx
|
||||||
|
4jh4GTvlFkupxZvLsXYf2T+7qn0eHymdQI8+5WSHQH6kApBvINYoq1m55it5ilEp
|
||||||
|
M0tYNFMzi10OjKVbNRQXuKhROzzYGtW8qWGtc33WBB5rvkRVelSDmleTbRywWjE0
|
||||||
|
rNo7vj97SbmGdCHydzcEwPIBOd11ZgFWpamX/36ALeKCxgHgc3HsnjIkDsEffpoN
|
||||||
|
SFHAhyYqXTDRqq5/HuBQBDBJLVVcIbqlJo3us47gI3rhojjSayzTBd5TnGOZt5N0
|
||||||
|
rFOqoZ1i3vf3C5sjKivTzCJ/P3yFgD271hQjv49jSqXgSF8ZIvzaDr0xLiy+XnZ+
|
||||||
|
EsUyqxZBKWy246BtyZ4qBvRjVKbezpxQFh6MzxccY+toUaG2v2I5muvFJRHe7qEA
|
||||||
|
fT6XDl7W6aQ/RBL/Ij9OWYvCMWS27mzkLQi0uBH5gyA1t6Bg9O6+CjGpK6Mmd8fx
|
||||||
|
1Q2Ml5ClzLnEq94FX3f2hpqLdSlwREPoBYULeJNr+WhayDvfRjuh5+MvN+wjbs/S
|
||||||
|
XgGYwgGCrFmzXN1mWElNGc3+3sMEpiuvJp6Z1nRfr17YvIPUrtCU7zVHWR1lWFKU
|
||||||
|
gjJacBX/Qw9Kly+5jADM0UorWkZxaby+q+j8rN43nPatjDlDRI+BrNta0l0ulOA=
|
||||||
|
=2cbn
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA4HMJd/cQYrVARAAu8l79uJlVLz++foLhk83zrPSZsX+1TQduJl06Kx2VrJ+
|
||||||
|
dZX/0okzpHmHeZGhGH+e1Gv7MpyM4UxAGwE03NIk32p43LF/biad0zc4TB8yr9r6
|
||||||
|
N3Sr/ZbaB0oYC/K4r1Sj8W1XWmuYZB8lc1dyfwhf96KIXGutvG22O5XI0pOA9yHL
|
||||||
|
x4AWt8OHYsaWCt941M6pbFtBsJEl/TaKgYF7YNITvsfj/oG7cPESKLOkcJdmhN1r
|
||||||
|
ADpJRcs6rVvMLWxUBjZICqZvDlwnXK5gCu30MmLs/oQbFmHjBRB01Ird+Mb5e6l4
|
||||||
|
vrYC+zO3RG3dZ+VXJD0rBn+56nDMtiKISJCy4I4Vz/ekwx94cIci+BlD9/3YYix7
|
||||||
|
HVgR6flBgInZEvaBxyj2e0G5i2gKvYTfea5+6bwPpszLUaYba/YLQQ2mSXcwWPsV
|
||||||
|
ipuNSjJ8swK2OpOFTfzs7Ua1OZChCOhhduxiKCwASYrbncfexObsQfeobj3wrwXH
|
||||||
|
N4M+h5ghm+y7UFKDW+gfN79WGfltWiMdy9vZNwwEYF0NE8jkwPfIt2dLvyU73MFU
|
||||||
|
NivYWp6kUj+gbLkb3gLClAi4CyYqNQyBjbKEbt+470UIMZ44WWMEJy7bMwAVzLBk
|
||||||
|
VxBHphqSuP04pgb5a+PHPApCZC6KEntnW1zX+DKrCn3/+NhoD6COhCvetWxq4f7S
|
||||||
|
XgFop4XZPWYJb6ypqkFLbkHIg7tCbr/xae4HABncVj0BaS1Z7TBdMiGi8SQvHti5
|
||||||
|
70rNGZIpQe/59DmBrLT06VdQRY5rt20bDoN+DaUrE2tc0k5h+uwI71TG4//Db2A=
|
||||||
|
=m4ec
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 91213ABAA73B0B73D3C02B5B4E5F372D17BBE67C
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAxjNhCKPP69fAQ//Tz2g90bOkkY942MaLO5/k8MFMf4QEDMZAiw9tVZ39Rqf
|
||||||
|
udMTcGyOX6zLzr+xxNX3gwn8X+bl0yw4Tg/FiyOzl9RjMZDxvzUaj1gYZI9kKPne
|
||||||
|
aEmAYcP2mv+ITUDnApZonDZE5hUnLGAyfEZMU6ExF9XkU94dXFdU4nd+gF5XHzou
|
||||||
|
STiNryBYaxWP1WMkW4SlZqdJiCfrkI0Z7iTF86QtXN5S8qLSIyjP3hIv5QxJg5Xo
|
||||||
|
NwK5IXQhV/0ZHp1Wl8Xys2iUw3iuwPga7sBrMHdJ0PHVBg3Wg/bG7YtrfEAfUbcr
|
||||||
|
UHt9rNGFZluuqNctvcvkSUjv5DISCgl8lSSbzC8DK/vT9o0DQYWvySNpVwXO3tqs
|
||||||
|
9aCxKc8trCXrd9qePnO259Ni0ALRjyh/GHZipzhZo/mgyUWc5nAdTLM49MsmAKHc
|
||||||
|
PnBBSntXnVHfFoFvgyBAmyISVuH/L5j8mezQ/37AevcTfuWemjDRGWIiIJZ73CyF
|
||||||
|
tG6ida5En9QouMO18gKBBzfR/2s6tt60bEp4bE3j2rRgEhwblBfl1NtGSw2WGVVZ
|
||||||
|
bU8KormLDT8aurMIp/Rd1pzAxDpEhDa13TV1IfRECOQvY35aBC59upt+XLwJ83ch
|
||||||
|
Zgi5cRGtSoj1G9OziQGCtJjGqkZoFy7Htou6AyFUEln+2Px0EKGJC3yCUcOF0orS
|
||||||
|
XgEtK2wEJNnJ84LctjrRM4ZSeb/8nycfWiR9riJi1lq6J+WSeiGME3cvhgObDTtG
|
||||||
|
EwuAjG6vhwUdr3aovsENQhvHnQWID844CeBtB9jMHbFJy41vbt0rC0JJG/6RoRg=
|
||||||
|
=5Ijl
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA1Hthzn+T1OoAQ//dwisvTFgYUCFICbaNZ+8jttF4lTQ2fjdP6UHb0evav84
|
||||||
|
PUYpqUfmMF1BUvxDx0rwzzP1OaSKuesxAG46i1Nha1Tq/LOURtzZtXPW4+xSHWge
|
||||||
|
ifbcbGTBkACviKkRuVUqaQBAbzDnFIHtcQy7nbILmzM0aRwm1IC1WzKpPRBgzAy0
|
||||||
|
o/UE4geZjPuNqkix4mcLz8sXvKMz11FE3QpZ44JqiRhmAITTDVo2ymhbvA6R2C1w
|
||||||
|
AL0tjJwKRb0qfoBegyPbuUW399l3CCtEE7voW8AxZ3Y6EGO8DQ1i/MkR81zymFep
|
||||||
|
PUDVYDmhqmh38Z79v5iKqnruzS+rOaitzMRqsUfOJfa4UoFkjO6tYdi5cOY8T4cD
|
||||||
|
w0rgCpvWriaGKGHDuRIdu031GFyf26+SvOWEbiOhMv+h18Hj5P7uT+Is+VuEhHEo
|
||||||
|
i7EYTqzsRwyIfybNkb0mBVluvXb4CpZRdRq5AzC49qu4IezvKoAT99KG1yf7XJvI
|
||||||
|
Ijc/ZITFqCBxE7REA4JBDuivPHfML4CgxG+5PiBJ3JDdaP+xRuoVQQv5E55Y4YwF
|
||||||
|
NM+NTNcvsTv2vKXJ8mmWLBn9xMxN32gmDyy7jW0elW46AQidIL6C+W2Zhxn6GNvc
|
||||||
|
2faDhNQ3yV0A9mIsgQjdWeQemqhsiVU6Sg4Mmattm/b6plGCM1DIcJgMV2RRAobS
|
||||||
|
XgGt7zD15Ju4S+fQqL7MVGGD3y5v0C5eLx78MScygpNQKS0vfTfTE2+wRCzCjZAG
|
||||||
|
/6HU85E6ru1VeXc0TwQBrpX3Wi2ga/momalsCGoh3oHBd+jRqzwpRxojKLy65qU=
|
||||||
|
=g4RA
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA46L6MuPqfJqARAAmTOXbn+qa0wgjSvK3juGqVemxKvaD2zFG57ivYdC1Jdn
|
||||||
|
PIVi5aBCvZ8KY/0W9k83LVcGUY1f8eRkCU8ohJU+rmRbiTvT0qo1hfLzxrqaNbke
|
||||||
|
gN+YsYW8bgXioF6nHVWI158GvqNfmvRl4WyJzBQ41cAyMpdGXiIzUoCba3Y6f+1N
|
||||||
|
muljMhgvEtWUddf4zheZX89xV+aLa9Mga6aQbwRcL451UcKxmE2nk4+00rMn7R7R
|
||||||
|
vmsC677/RrKkI7RxubzCVFFlzaH+ZZ1Ott6ozKUWs2vCcB6vTzwwvmrJwmr760lC
|
||||||
|
pozfNp/+WzLZOkA3rO2qAvIUc1DxYA6CgukrAAObCbvmcgMeLtVR29wwWs01qxI+
|
||||||
|
cTxmH+btbiM0PL8+/sW2KlC19hfMmeryiJXxbUN30a3fMDJz1wVor54DsaqG9kIJ
|
||||||
|
zIxGsQ6t8fzfaVfeQwoxODnTWqUClWCY4is251O4Gxw3C0oPWZvzoPvxljaPrYYY
|
||||||
|
SE3dcktWmGoOxLj56lLfceKq0qAtYmJD4Q5k2GDYYU+8dwp95UTf0lbRwauMBROT
|
||||||
|
OMe4r/emH4Z1LiG2/HLoM4QuV5VVQGSAqoE3c42YjjS9uh/aOtmeNNLehwS93F5E
|
||||||
|
J/bXNY6VnHcALRGMZF60g5OxM3QUioNkGqcCWGjSaRPcKhwaXvvIaTCdz8apnBHS
|
||||||
|
XgHeuszpU9/O1nCsNPF2vQUjcNxz+KsL39RwHCVJBVJskxd4HcJQUM7uArV1Fjbk
|
||||||
|
fl4nQuueBrZ4tXzimRK2QOjgy8F2n/Kxpjlr4rXn+Pi9jyhx0Jq4Blu3wrR4LAg=
|
||||||
|
=4Xvm
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA4EEKdYEzV0pAQ//fo1yfBspyD2O84d8UCHWoUJTNYql2p26H/vC2BsVzAmL
|
||||||
|
6nylQACeslISLlXbrW+ILPOFZ5x21THOFcJdvCGAQAkY+jC7Ry3D2gwsZi/RLFpP
|
||||||
|
wbEgbzk9hcimmvuHW/NJtrqvXiTJy7GH7el5Zwqe6rtUkTW5IUtaOmZjn2fQBVoq
|
||||||
|
9mMT86vOYlqgIISG1o5x4pciRd+fb3JPiPeJiLcyUBEXYqg2THlyYwwp2paFomYf
|
||||||
|
a6Ls/pVT9ICSblFlnfILOexDpqhxcPH+V2nwlbSlOETq3ACcVIgufIRndTkGhDzi
|
||||||
|
HS3GlD5nIb/ep12Gj+qOgKZBsbUdNIAVojNY2qlK2yQJpE5B1aDjmkAZUkk/LqF3
|
||||||
|
76ZRBDzigU0jfYKh2iGDY3F8cWDsRqjqcTjVB9KF32+1SeUAO4NqDnDpMZgBh2i5
|
||||||
|
rvDOJCJfTgo7DfPqWPyeFM58sow9EEglygASA/XTaDV+CmLzRlqxwlJwpbRrz3OV
|
||||||
|
Mp1gewfGASLPS4xh6gtROac9DAuokmN5VgNg2g+emN8lUNJ/7V7u30TvCEfGP0j0
|
||||||
|
1Sd6RrNn/ZDMJtOoE8gDua6njbOi9Zk/RN4Y4NKWcmiNZxz/Xi/8XU7F0yk0yEL1
|
||||||
|
DUxYsCEHImib+lAESQ0fF4VMXx3DSXq2/Yt5z782ZvgNrGoGw3B9qVA5FyG5Bt3S
|
||||||
|
XgGgfz/6fGZ0DEtTv3B8Rhqbm6TvwPFgIg+3WuQRXxf3rjjoX1AN0jcuz8OIIfGk
|
||||||
|
o1GuRG0/sYg7P32ysgQMvS1F+rX2PR/myHsz4YMM10soG7OduHgXmiJ0eUq8EtM=
|
||||||
|
=WLCQ
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hF4DQrf1tCqiJxoSAQdAUMjy8rV2Zy5nmeMOBsANIUVyhAvVBUF1yunc+EgVeVQw
|
||||||
|
yd4hPHMnQSkasXmcMDS0y2gwixgTOeQbG5PaOr0FA7eGEItLlqwSxz3+GnuD/gEw
|
||||||
|
0l4BFrUbimEX+/tfI8aymapMVYXFXWe4dUZw9foKN5HqkpPKhusozd9bqPPNKggZ
|
||||||
|
09tvIJViKP/QufK0WyLYZGWrG+leogDX39GBtAU1SOllFqtq2G0X1qH+s88GVpaO
|
||||||
|
=hxWV
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
|
||||||
|
- created_at: "2024-06-21T22:42:59Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMAzdAjw8ldn6CAQ//SK6MVXhRsRxYV8jL9HrVTovc84kNFr24nbHHi5z6fuCA
|
||||||
|
6ZjPr5Btx5Xxi716mEmdDBUSGfeJOOSt6hw4fCqj5ehnCeMLr9GvmJdZx9s2n88m
|
||||||
|
h4Fzd1XF67NMbSAYMPrXpk5dlxBNsgmsAWTaEet9gqGWWYsrZHWPvae7z+GaJJzz
|
||||||
|
h3dix5oVV3tM2OVP9hFhRtu9tv9a0sj5Eu6mz8UsDFwEPynlSDPKUQA0jFTXJnYo
|
||||||
|
yT8UTPSZAUlwnU88JPIhHKCmU8nqUIgDURVNgK4BsuoKSAZ27ueSHr/4IzBiavVD
|
||||||
|
6V1b1Ttt8usKFp21OCqfNuoiIeEipUdLMFSTjSXqOp38QTaqoDaCsAPc6j3HCvlV
|
||||||
|
vMm1lbSKK+Llpk9WOmqvHQriL50lQGYpa2X/jS8FtlotKFm0uGJoJXZ5Ujc4Wmy9
|
||||||
|
J79/cXLULGFCxdPsoxmd8wJFqz0eiVPHIBFB2Y8Tan+Mg44WeBuY8sAWGzYPp+kB
|
||||||
|
sEOIQ5I9N1Gt+58i1hDTRlqO4I8ihusqKeRemJa954rlzz8YTmZL+JAD5gsMtzuH
|
||||||
|
gMjnfBnNJKw3UmnHMMQm348CRB6SuF6rmjc7Xk1qsnie87HtYbM3dJYh7ixddr/a
|
||||||
|
kTHy66zDX4j3e/y2JdEPQw8/WhhdGnyj6eDioQLNFfvApI7doi5C+XDCR08YxJnS
|
||||||
|
XgG0kP/bfDBkwzzHkr3khuvdtmUEmsxGbR/3abyjLfvM+g3HM6Eqq0uDwuGgYinR
|
||||||
|
DYfWUZTas5uWrgxAWYbBCbhPcevu7CsyJFsBtG4ExTXPSsP2c79+LwtmJjbLQqo=
|
||||||
|
=9C2P
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: 3D70F61E07F64EC4E4EF417BEFCD9D20F58784EF
|
||||||
|
unencrypted_suffix: _unencrypted
|
||||||
|
version: 3.8.1
|
7
config/hosts/woodpecker/sops.nix
Normal file
7
config/hosts/woodpecker/sops.nix
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
sops = {
|
||||||
|
defaultSopsFile = ./secrets.yaml;
|
||||||
|
};
|
||||||
|
}
|
8
config/hosts/woodpecker/woodpecker-agent/default.nix
Normal file
8
config/hosts/woodpecker/woodpecker-agent/default.nix
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./docker.nix
|
||||||
|
./woodpecker-agent.nix
|
||||||
|
];
|
||||||
|
}
|
12
config/hosts/woodpecker/woodpecker-agent/docker.nix
Normal file
12
config/hosts/woodpecker/woodpecker-agent/docker.nix
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/deployment/nixos
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/backends/docker
|
||||||
|
# - https://nixos.wiki/wiki/Docker
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
virtualisation.docker = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
}
|
|
@ -0,0 +1,29 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/deployment/nixos
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/agent-config
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/backends/docker
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.woodpecker-agents.agents."docker" = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.woodpecker-agent;
|
||||||
|
extraGroups = [ "docker" ];
|
||||||
|
environment = {
|
||||||
|
WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
|
||||||
|
WOODPECKER_MAX_WORKFLOWS = "4";
|
||||||
|
WOODPECKER_BACKEND = "docker";
|
||||||
|
# Set via enviornmentFile:
|
||||||
|
# WOODPECKER_AGENT_SECRET
|
||||||
|
};
|
||||||
|
environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets."woodpecker_agent_environment_file" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "root";
|
||||||
|
group = "root";
|
||||||
|
restartUnits = [ "woodpecker-agent-docker.service" ];
|
||||||
|
};
|
||||||
|
}
|
9
config/hosts/woodpecker/woodpecker-server/default.nix
Normal file
9
config/hosts/woodpecker/woodpecker-server/default.nix
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./nginx.nix
|
||||||
|
./postgresql.nix
|
||||||
|
./woodpecker-server.nix
|
||||||
|
];
|
||||||
|
}
|
57
config/hosts/woodpecker/woodpecker-server/nginx.nix
Normal file
57
config/hosts/woodpecker/woodpecker-server/nginx.nix
Normal file
|
@ -0,0 +1,57 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/deployment/nixos
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/proxy
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
virtualHosts."acme-woodpecker.hamburg.ccc.de" = {
|
||||||
|
default = true;
|
||||||
|
enableACME = true;
|
||||||
|
serverName = "woodpecker.hamburg.ccc.de";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 31820;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualHosts."woodpecker.hamburg.ccc.de" = {
|
||||||
|
default = true;
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "woodpecker.hamburg.ccc.de";
|
||||||
|
|
||||||
|
listen = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 8443;
|
||||||
|
ssl = true;
|
||||||
|
proxyProtocol = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost${config.services.woodpecker-server.environment.WOODPECKER_SERVER_ADDR}";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 172.31.17.140;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 8443 31820 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 8443 ];
|
||||||
|
}
|
18
config/hosts/woodpecker/woodpecker-server/postgresql.nix
Normal file
18
config/hosts/woodpecker/woodpecker-server/postgresql.nix
Normal file
|
@ -0,0 +1,18 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://github.com/NixOS/nixpkgs/blob/dce84c46d780b20c064d5dfb10d0686e0584a198/nixos/modules/services/web-apps/nextcloud.nix#L1069
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.postgresql_15;
|
||||||
|
ensureDatabases = [ "woodpecker-server" ];
|
||||||
|
ensureUsers = [
|
||||||
|
{
|
||||||
|
name = "woodpecker-server";
|
||||||
|
ensureDBOwnership = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
|
@ -0,0 +1,44 @@
|
||||||
|
# Sources for this configuration:
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/deployment/nixos
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/server-config
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/database
|
||||||
|
# - https://woodpecker-ci.org/docs/administration/forges/forgejo
|
||||||
|
# - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.woodpecker-server = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.woodpecker-server;
|
||||||
|
environment = {
|
||||||
|
WOODPECKER_HOST = "https://woodpecker.hamburg.ccc.de";
|
||||||
|
WOODPECKER_SERVER_ADDR = ":8001";
|
||||||
|
WOODPECKER_GRPC_ADDR = ":9000";
|
||||||
|
WOODPECKER_ADMIN = "june";
|
||||||
|
WOODPECKER_OPEN = "true";
|
||||||
|
WOODPECKER_ORGS = "CCCHH";
|
||||||
|
WOODPECKER_DATABASE_DRIVER = "postgres";
|
||||||
|
WOODPECKER_DATABASE_DATASOURCE = "postgresql://woodpecker-server@/woodpecker-server?host=/run/postgresql";
|
||||||
|
WOODPECKER_FORGEJO = "true";
|
||||||
|
WOODPECKER_FORGEJO_URL = "https://git.hamburg.ccc.de";
|
||||||
|
WOODPECKER_LIMIT_MEM = "6442450944"; # 6GB
|
||||||
|
# Set via enviornmentFile:
|
||||||
|
# WOODPECKER_FORGEJO_CLIENT
|
||||||
|
# WOODPECKER_FORGEJO_SECRET
|
||||||
|
};
|
||||||
|
environmentFile = [ "/run/secrets/woodpecker_server_environment_file" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.woodpecker-server.serviceConfig = {
|
||||||
|
User = "woodpecker-server";
|
||||||
|
Group = "woodpecker-server";
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets."woodpecker_server_environment_file" = {
|
||||||
|
mode = "0440";
|
||||||
|
owner = "root";
|
||||||
|
group = "root";
|
||||||
|
restartUnits = [ "woodpecker-server.service" ];
|
||||||
|
};
|
||||||
|
}
|
|
@ -5,5 +5,6 @@
|
||||||
./configuration.nix
|
./configuration.nix
|
||||||
./networking.nix
|
./networking.nix
|
||||||
./yate.nix
|
./yate.nix
|
||||||
|
./service.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking = {
|
networking = {
|
||||||
|
|
21
config/hosts/yate/service.nix
Normal file
21
config/hosts/yate/service.nix
Normal file
|
@ -0,0 +1,21 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
systemd.services.yate = {
|
||||||
|
enable = true;
|
||||||
|
description = "Yate telehony engine";
|
||||||
|
unitConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
After = "network.target";
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${pkgs.yate}/bin/yate -c /yate -e /yate/share -Do";
|
||||||
|
Type = "simple";
|
||||||
|
Restart = "always";
|
||||||
|
# ...
|
||||||
|
};
|
||||||
|
wantedBy = [ "default.target" ];
|
||||||
|
requiredBy = [ "network.target" ];
|
||||||
|
# ...
|
||||||
|
};
|
||||||
|
}
|
|
@ -3,6 +3,9 @@
|
||||||
{
|
{
|
||||||
environment.systemPackages = [
|
environment.systemPackages = [
|
||||||
pkgs.yate
|
pkgs.yate
|
||||||
|
pkgs.git
|
||||||
|
pkgs.tcpdump
|
||||||
|
pkgs.tmux
|
||||||
];
|
];
|
||||||
|
|
||||||
# Just disable it for now.
|
# Just disable it for now.
|
||||||
|
|
|
@ -23,6 +23,18 @@
|
||||||
},
|
},
|
||||||
"nix-box-june": {
|
"nix-box-june": {
|
||||||
"targetHostname": "nix-box-june-intern.hamburg.ccc.de"
|
"targetHostname": "nix-box-june-intern.hamburg.ccc.de"
|
||||||
|
},
|
||||||
|
"mjolnir": {
|
||||||
|
"targetHostname": "mjolnir-intern.hamburg.ccc.de"
|
||||||
|
},
|
||||||
|
"woodpecker": {
|
||||||
|
"targetHostname": "woodpecker-intern.hamburg.ccc.de"
|
||||||
|
},
|
||||||
|
"penpot": {
|
||||||
|
"targetHostname": "penpot-intern.hamburg.ccc.de"
|
||||||
|
},
|
||||||
|
"hydra": {
|
||||||
|
"targetHostname": "hydra-intern.hamburg.ccc.de"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
77
flake.lock
77
flake.lock
|
@ -1,12 +1,26 @@
|
||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
|
"authorizedKeysRepo": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1731276342,
|
||||||
|
"narHash": "sha256-plTYjM6zPzoBE/dp6EUrk9mCqmab278p8FqBCTX8Grc=",
|
||||||
|
"rev": "686a6af22f6696f0c0595c56f463c078550049fc",
|
||||||
|
"type": "tarball",
|
||||||
|
"url": "https://git.hamburg.ccc.de/api/v1/repos/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz?rev=686a6af22f6696f0c0595c56f463c078550049fc"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"type": "tarball",
|
||||||
|
"url": "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz"
|
||||||
|
}
|
||||||
|
},
|
||||||
"nixlib": {
|
"nixlib": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712450863,
|
"lastModified": 1731200463,
|
||||||
"narHash": "sha256-K6IkdtMtq9xktmYPj0uaYc8NsIqHuaAoRBaMgu9Fvrw=",
|
"narHash": "sha256-qDaAweJjdFbVExqs8aG27urUgcgKufkIngHW3Rzustg=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nixpkgs.lib",
|
"repo": "nixpkgs.lib",
|
||||||
"rev": "3c62b6a12571c9a7f65ab037173ee153d539905f",
|
"rev": "e04234d263750db01c78a412690363dc2226e68a",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -18,16 +32,14 @@
|
||||||
"nixos-generators": {
|
"nixos-generators": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixlib": "nixlib",
|
"nixlib": "nixlib",
|
||||||
"nixpkgs": [
|
"nixpkgs": "nixpkgs"
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716210724,
|
"lastModified": 1731546190,
|
||||||
"narHash": "sha256-iqQa3omRcHGpWb1ds75jS9ruA5R39FTmAkeR3J+ve1w=",
|
"narHash": "sha256-kJix8nLyFIJ3EC7VtoXK/85C4ZN2dC5oWoS8+ErehqI=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nixos-generators",
|
"repo": "nixos-generators",
|
||||||
"rev": "d14b286322c7f4f897ca4b1726ce38cb68596c94",
|
"rev": "06ffce1a8d95e95c06a4bcfa117dd960b14a7101",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -38,57 +50,41 @@
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716408408,
|
"lastModified": 1731245184,
|
||||||
"narHash": "sha256-e4pjcLqe1Dexz7enk/+ui0aVdcoSiWnrTGjk7KLtAPw=",
|
"narHash": "sha256-vmLS8+x+gHRv1yzj3n+GTAEObwmhxmkkukB2DwtJRdU=",
|
||||||
"owner": "nixos",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"rev": "dff68ababdd2c2616d03f26546ba632f5f09d3c6",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nixos",
|
|
||||||
"ref": "nixos-23.11-small",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"nixpkgs-stable": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1716061101,
|
|
||||||
"narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
|
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
|
"rev": "aebe249544837ce42588aa4b2e7972222ba12e8f",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"ref": "release-23.11",
|
"ref": "nixpkgs-unstable",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs_2": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716479278,
|
"lastModified": 1731842749,
|
||||||
"narHash": "sha256-2eh7rYxQOntkUjFXtlPH7lBuUDd4isu/YHRjNJW7u1Q=",
|
"narHash": "sha256-aNc8irVBH7sM5cGDvqdOueg8S+fGakf0rEMRGfGwWZw=",
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "2ee89d5a0167a8aa0f2a5615d2b8aefb1f299cd4",
|
"rev": "bf6132dc791dbdff8b6894c3a85eb27ad8255682",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"ref": "nixos-unstable-small",
|
"ref": "nixos-24.05-small",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
|
"authorizedKeysRepo": "authorizedKeysRepo",
|
||||||
"nixos-generators": "nixos-generators",
|
"nixos-generators": "nixos-generators",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs_2",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
|
||||||
"sops-nix": "sops-nix"
|
"sops-nix": "sops-nix"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
@ -96,15 +92,14 @@
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
]
|
||||||
"nixpkgs-stable": "nixpkgs-stable"
|
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716400300,
|
"lastModified": 1731862312,
|
||||||
"narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=",
|
"narHash": "sha256-NVUTFxKrJp/hjehlF1IvkPnlRYg/O9HFVutbxOM8zNM=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "b549832718b8946e875c016a4785d204fcfc2e53",
|
"rev": "472741cf3fee089241ac9ea705bb2b9e0bfa2978",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
242
flake.nix
242
flake.nix
|
@ -5,14 +5,13 @@
|
||||||
# Use the NixOS small channels for nixpkgs.
|
# Use the NixOS small channels for nixpkgs.
|
||||||
# https://nixos.org/manual/nixos/stable/#sec-upgrading
|
# https://nixos.org/manual/nixos/stable/#sec-upgrading
|
||||||
# https://github.com/NixOS/nixpkgs
|
# https://github.com/NixOS/nixpkgs
|
||||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11-small";
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
|
||||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
|
|
||||||
|
|
||||||
# Add nixos-generators as an input.
|
# Add nixos-generators as an input.
|
||||||
# See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
|
# See here: https://github.com/nix-community/nixos-generators#using-in-a-flake
|
||||||
nixos-generators = {
|
nixos-generators = {
|
||||||
url = "github:nix-community/nixos-generators";
|
url = "github:nix-community/nixos-generators";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
#inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Add sops-nix as an input for secret management.
|
# Add sops-nix as an input for secret management.
|
||||||
|
@ -21,205 +20,260 @@
|
||||||
url = "github:Mic92/sops-nix";
|
url = "github:Mic92/sops-nix";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
authorizedKeysRepo = {
|
||||||
|
url = "https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/archive/686a6af22f6696f0c0595c56f463c078550049fc.tar.gz";
|
||||||
|
flake = false;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { nixpkgs, nixpkgs-unstable, nixos-generators, sops-nix, ... }:
|
outputs = { self, nixpkgs, nixos-generators, sops-nix, authorizedKeysRepo, ... }:
|
||||||
let
|
let
|
||||||
system = "x86_64-linux";
|
specialArgs = {
|
||||||
# Shairport Sync 4.3.1 (with nqptp 1.2.4) with metadata, MQTT and AirPlay 2 support.
|
inherit authorizedKeysRepo;
|
||||||
shairportSync431ExtendedNixpkgsUnstableOverlay = final: prev: {
|
|
||||||
shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
|
|
||||||
# See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
|
|
||||||
configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
|
|
||||||
buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
|
|
||||||
# Use specific Shairport Sync and nqptp versions, since with those the
|
|
||||||
# following error doesn't happen:
|
|
||||||
# fatal error: The nqptp service on this system, which is required for
|
|
||||||
# Shairport Sync to operate, does not seem to be initialised.
|
|
||||||
#
|
|
||||||
# Also use a more recent dev version to fix Pipewire stuttering issue.
|
|
||||||
# See:
|
|
||||||
# https://github.com/mikebrady/shairport-sync/issues/1736
|
|
||||||
# https://github.com/mikebrady/shairport-sync/blob/a65ec2d7f1f380bbae196d7f8f1cd6a88ef5777b/RELEASENOTES-DEVELOPMENT.md#version-432-dev-51-g98679bbb
|
|
||||||
src = final.fetchFromGitHub {
|
|
||||||
owner = "mikebrady";
|
|
||||||
repo = finalAttr.pname;
|
|
||||||
rev = "98679bbb54f5aaeda859e34aa28425647b8d179e";
|
|
||||||
hash = "sha256-k0kcgtWk2xlG34lP0ryEaqdskYMNM68YnIRLwFR3jaY=";
|
|
||||||
};
|
|
||||||
});
|
|
||||||
nqptp = prev.nqptp.overrideAttrs (finalAttr: previousAttr: {
|
|
||||||
# See Shairport Sync version note.
|
|
||||||
src = final.fetchFromGitHub {
|
|
||||||
owner = "mikebrady";
|
|
||||||
repo = finalAttr.pname;
|
|
||||||
rev = "1.2.4";
|
|
||||||
hash = "sha256-roTNcr3v2kzE6vQ5plAVtlw1+2yJplltOYsGGibtoZo=";
|
|
||||||
};
|
|
||||||
# Custom install phase to avoid setcap.
|
|
||||||
# See:
|
|
||||||
# https://github.com/mikebrady/nqptp/blob/1.2.4/Makefile.am#L23
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out/bin
|
|
||||||
cp nqptp $out/bin/
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
};
|
};
|
||||||
pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
overlays = {
|
||||||
|
shairportSyncAirplay2 = final: prev: {
|
||||||
|
shairport-sync = (prev.shairport-sync.override { enableMetadata = true; enableAirplay2 = true; }).overrideAttrs (finalAttr: previousAttr: {
|
||||||
|
# See: https://github.com/mikebrady/shairport-sync/blob/e78a88b64adfe7b5f88fd6faedf55c57445bb240/CONFIGURATION%20FLAGS.md
|
||||||
|
configureFlags = previousAttr.configureFlags ++ [ "--with-mqtt-client" ];
|
||||||
|
buildInputs = previousAttr.buildInputs ++ [ final.mosquitto ];
|
||||||
|
});
|
||||||
|
};
|
||||||
|
};
|
||||||
|
nixosModules = {
|
||||||
|
common = ./config/common;
|
||||||
|
proxmox-vm = ./config/proxmox-vm;
|
||||||
|
prometheus-exporter = ./config/extra/prometheus-exporter.nix;
|
||||||
|
};
|
||||||
nixosConfigurations = {
|
nixosConfigurations = {
|
||||||
audio-hauptraum-kueche = nixpkgs-unstable.lib.nixosSystem {
|
audio-hauptraum-kueche = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
{ nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
|
{ nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
|
||||||
./config/hosts/audio-hauptraum-kueche
|
./config/hosts/audio-hauptraum-kueche
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
audio-hauptraum-tafel = nixpkgs-unstable.lib.nixosSystem {
|
audio-hauptraum-tafel = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
{ nixpkgs.overlays = [ shairportSync431ExtendedNixpkgsUnstableOverlay ]; }
|
{ nixpkgs.overlays = [ self.overlays.shairportSyncAirplay2 ]; }
|
||||||
./config/hosts/audio-hauptraum-tafel
|
./config/hosts/audio-hauptraum-tafel
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
esphome = nixpkgs.lib.nixosSystem {
|
esphome = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
./config/hosts/esphome
|
./config/hosts/esphome
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
public-reverse-proxy = nixpkgs.lib.nixosSystem {
|
public-reverse-proxy = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
./config/hosts/public-reverse-proxy
|
./config/hosts/public-reverse-proxy
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
netbox = nixpkgs.lib.nixosSystem {
|
netbox = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/netbox
|
./config/hosts/netbox
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
matrix = nixpkgs.lib.nixosSystem {
|
matrix = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/matrix
|
./config/hosts/matrix
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
public-web-static = nixpkgs.lib.nixosSystem {
|
public-web-static = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/public-web-static
|
./config/hosts/public-web-static
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
git = nixpkgs.lib.nixosSystem {
|
git = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/git
|
./config/hosts/git
|
||||||
];
|
];
|
||||||
specialArgs = {
|
|
||||||
inherit pkgs-unstable;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
forgejo-actions-runner = nixpkgs.lib.nixosSystem {
|
forgejo-actions-runner = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/forgejo-actions-runner
|
./config/hosts/forgejo-actions-runner
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
ptouch-print-server = nixpkgs.lib.nixosSystem {
|
ptouch-print-server = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
./config/hosts/ptouch-print-server
|
./config/hosts/ptouch-print-server
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
eh22-wiki = nixpkgs.lib.nixosSystem {
|
eh22-wiki = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/eh22-wiki
|
./config/hosts/eh22-wiki
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
nix-box-june = nixpkgs.lib.nixosSystem {
|
nix-box-june = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
./config/hosts/nix-box-june
|
./config/hosts/nix-box-june
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
yate = nixpkgs.lib.nixosSystem {
|
yate = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system specialArgs;
|
||||||
modules = [
|
modules = [
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
./config/hosts/yate
|
./config/hosts/yate
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
mqtt = nixpkgs.lib.nixosSystem {
|
||||||
|
inherit system specialArgs;
|
||||||
|
modules = [
|
||||||
|
self.nixosModules.common
|
||||||
|
self.nixosModules.proxmox-vm
|
||||||
|
./config/hosts/mqtt
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
mjolnir = nixpkgs.lib.nixosSystem {
|
||||||
|
inherit system specialArgs;
|
||||||
|
modules = [
|
||||||
|
self.nixosModules.common
|
||||||
|
self.nixosModules.proxmox-vm
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
|
./config/hosts/mjolnir
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
woodpecker = nixpkgs.lib.nixosSystem {
|
||||||
|
inherit system specialArgs;
|
||||||
|
modules = [
|
||||||
|
self.nixosModules.common
|
||||||
|
self.nixosModules.proxmox-vm
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
|
./config/hosts/woodpecker
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
status = nixpkgs.lib.nixosSystem {
|
||||||
|
inherit system specialArgs;
|
||||||
|
modules = [
|
||||||
|
self.nixosModules.common
|
||||||
|
self.nixosModules.proxmox-vm
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
./config/hosts/status
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
penpot = nixpkgs.lib.nixosSystem {
|
||||||
|
inherit system specialArgs;
|
||||||
|
modules = [
|
||||||
|
self.nixosModules.common
|
||||||
|
self.nixosModules.proxmox-vm
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
|
./config/hosts/penpot
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
hydra = nixpkgs.lib.nixosSystem {
|
||||||
|
inherit system specialArgs;
|
||||||
|
modules = [
|
||||||
|
self.nixosModules.common
|
||||||
|
self.nixosModules.proxmox-vm
|
||||||
|
self.nixosModules.prometheus-exporter
|
||||||
|
./config/hosts/hydra
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
packages.x86_64-linux = {
|
packages.x86_64-linux = {
|
||||||
proxmox-nixos-template = nixos-generators.nixosGenerate {
|
proxmox-nixos-template = nixos-generators.nixosGenerate {
|
||||||
|
inherit specialArgs;
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
modules = [
|
modules = [
|
||||||
./config/nixos-generators/proxmox.nix
|
./config/nixos-generators/proxmox.nix
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
];
|
];
|
||||||
format = "proxmox";
|
format = "proxmox";
|
||||||
};
|
};
|
||||||
|
|
||||||
proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
|
proxmox-chaosknoten-nixos-template = nixos-generators.nixosGenerate {
|
||||||
|
inherit specialArgs;
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
modules = [
|
modules = [
|
||||||
./config/nixos-generators/proxmox-chaosknoten.nix
|
./config/nixos-generators/proxmox-chaosknoten.nix
|
||||||
./config/proxmox-chaosknoten-additional-initial-config.nix
|
./config/proxmox-chaosknoten-additional-initial-config.nix
|
||||||
./config/common
|
self.nixosModules.common
|
||||||
./config/proxmox-vm
|
self.nixosModules.proxmox-vm
|
||||||
];
|
];
|
||||||
format = "proxmox";
|
format = "proxmox";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
|
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
|
||||||
|
|
||||||
|
hydraJobs = {
|
||||||
|
inherit (self) packages;
|
||||||
|
nixosConfigurations = builtins.mapAttrs (name: value: value.config.system.build.toplevel) self.nixosConfigurations;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -12,7 +12,6 @@ in
|
||||||
imports = [
|
imports = [
|
||||||
./librespot.nix
|
./librespot.nix
|
||||||
./mpd.nix
|
./mpd.nix
|
||||||
./networking.nix
|
|
||||||
./pipewire.nix
|
./pipewire.nix
|
||||||
./shairport-sync.nix
|
./shairport-sync.nix
|
||||||
];
|
];
|
||||||
|
|
|
@ -23,7 +23,7 @@ in
|
||||||
After = [ "network-online.target" "pipewire.service" ];
|
After = [ "network-online.target" "pipewire.service" ];
|
||||||
};
|
};
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = "${pkgs.librespot}/bin/librespot --name '${config.ccchh.services.audio.name}' --device-type speaker --bitrate 320 --enable-volume-normalisation --disable-audio-cache --disable-credential-cache --quiet";
|
ExecStart = "${pkgs.librespot}/bin/librespot --name '${config.ccchh.services.audio.name}' --device-type speaker --bitrate 320 --enable-volume-normalisation --disable-audio-cache --disable-credential-cache";
|
||||||
User = "librespot";
|
User = "librespot";
|
||||||
Group = "librespot";
|
Group = "librespot";
|
||||||
};
|
};
|
||||||
|
@ -34,7 +34,7 @@ in
|
||||||
users.librespot = {
|
users.librespot = {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = "librespot";
|
group = "librespot";
|
||||||
extraGroups = [ "pipewire" ];
|
extraGroups = [ "pipewire" "audio" ];
|
||||||
};
|
};
|
||||||
groups.librespot = { };
|
groups.librespot = { };
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,16 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
|
|
||||||
cfg = config.ccchh.services.audio;
|
|
||||||
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
|
||||||
config = mkIf cfg.enable {
|
|
||||||
# Disable IPv6, since Shairport-Sync doesn't work with IPv6. Unclear why.
|
|
||||||
networking.enableIPv6 = false;
|
|
||||||
};
|
|
||||||
}
|
|
|
@ -20,7 +20,7 @@ in
|
||||||
arguments = "-o pw -v";
|
arguments = "-o pw -v";
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users.shairport.extraGroups = [ "pipewire" ];
|
users.users.shairport.extraGroups = [ "pipewire" "audio" ];
|
||||||
|
|
||||||
environment.etc.shairport-sync-config = {
|
environment.etc.shairport-sync-config = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
Loading…
Reference in a new issue