From 3d3ae9c9b542e4a24a06ebddbe17123cae36ffa3 Mon Sep 17 00:00:00 2001 From: iofq Date: Thu, 25 Sep 2025 23:04:20 -0500 Subject: [PATCH] oracle rice --- .sops.yaml | 2 ++ flake.nix | 4 +-- home-manager/t14/home.nix | 8 ++++- nixos/oracle/configuration.nix | 42 +++++++++++++++++++++++-- nixos/oracle/forgejo.nix | 56 ++++++++++++++++++++++++++++++++++ secrets/cf-acme.yaml | 29 ++++++++++++------ 6 files changed, 125 insertions(+), 16 deletions(-) create mode 100644 nixos/oracle/forgejo.nix diff --git a/.sops.yaml b/.sops.yaml index c489e7e..df4e573 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -2,9 +2,11 @@ keys: - &t14 age14e2d2y8e2avzfrsyxg9dudxd36svm24t7skw6e969n0c42znlp3shffdtg - &consensus age16pdhm238k63uye3rf4cwwe7ddyzds6xj9jv4wpsfggkghyarjqtsjzkxna + - &oracle age12tz2r7clep9e450qhr5a6ctnx29ywmu0llq8uk9kcwhpp82zsa0sk9la9h creation_rules: - path_regex: secrets/[^/]+\.yaml$ key_groups: - age: - *t14 - *consensus + - *oracle diff --git a/flake.nix b/flake.nix index c25aaf3..97ad087 100755 --- a/flake.nix +++ b/flake.nix @@ -98,9 +98,9 @@ }; }; oracle = { - hostname = "129.213.119.29"; + hostname = "oracle"; sshUser = "root"; - remoteBuild = true; + remoteBuild = false; profiles.system = { user = "root"; path = inputs.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.oracle; diff --git a/home-manager/t14/home.nix b/home-manager/t14/home.nix index 6f5d011..2cfb1fd 100755 --- a/home-manager/t14/home.nix +++ b/home-manager/t14/home.nix @@ -2,7 +2,8 @@ pkgs, lib, ... -}: { +}: +{ imports = [ ../shared/programs/default.nix ../shared/wayland/default.nix @@ -49,6 +50,11 @@ hostname = "consensus.tailc353f.ts.net"; identityFile = "/home/e/.ssh/id_ed25519"; }; + "oracle" = { + port = 2022; + hostname = "129.213.119.29"; + identityFile = "/home/e/.ssh/id_ed25519"; + }; "10110110.xyz" = { port = 22; hostname = "10110110.xyz"; diff --git a/nixos/oracle/configuration.nix b/nixos/oracle/configuration.nix index acbbedd..3c3a21c 100644 --- a/nixos/oracle/configuration.nix +++ b/nixos/oracle/configuration.nix @@ -2,13 +2,18 @@ { imports = [ ./hardware-configuration.nix + ./forgejo.nix ]; boot.tmp.cleanOnBoot = true; + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + "net.ipv6.conf.all.forwarding" = 1; + }; zramSwap.enable = true; swapDevices = [ { device = "/swapfile"; - size = 16 * 1024; + size = 2 * 1024; } ]; services = { @@ -29,12 +34,43 @@ overalljails = true; }; tailscale.enable = true; - openssh.enable = true; + openssh = { + enable = true; + ports = [ + 2022 + ]; + settings = { + PasswordAuthentication = false; + PermitRootLogin = "prohibit-password"; + PermitEmptyPasswords = false; + UseDns = false; + KbdInteractiveAuthentication = false; + X11Forwarding = false; + AllowTcpForwarding = false; + AllowAgentForwarding = false; + }; + hostKeys = [ + { + path = "/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + } + ]; + }; }; networking = { domain = ""; hostId = "81238132"; - hostName = "iofq-oracle-x840"; + hostName = "oracle1"; + firewall = { + enable = true; + allowedTCPPorts = [ + 22 + 2022 + 80 + 443 + ]; + logRefusedConnections = true; + }; }; users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcL53Gdrj5V9YDwKlCBIcgqiS+zHtOQpJlnOHTevJCJ e@t14'' diff --git a/nixos/oracle/forgejo.nix b/nixos/oracle/forgejo.nix new file mode 100644 index 0000000..63442f4 --- /dev/null +++ b/nixos/oracle/forgejo.nix @@ -0,0 +1,56 @@ +{ config, ... }: +let + cfg = config.services.forgejo; + srv = cfg.settings.server; +in +{ + sops = { + secrets = { + "env" = { + sopsFile = ../../secrets/cf-acme.yaml; + }; + }; + }; + security.acme = { + acceptTerms = true; + defaults = { + email = "acme@10110110.xyz"; + dnsProvider = "cloudflare"; + environmentFile = config.sops.secrets."env".path; + }; + }; + services.nginx = { + enable = true; + virtualHosts.${cfg.settings.server.DOMAIN} = { + forceSSL = true; + enableACME = true; + acmeRoot = null; # use DNS + locations."/" = { + recommendedProxySettings = true; + proxyPass = "http://localhost:${toString srv.HTTP_PORT}"; + extraConfig = '' + client_max_body_size 512M; + ''; + }; + }; + }; + services.forgejo = { + enable = true; + database.type = "sqlite3"; + dump.enable = true; + settings = { + server = { + DOMAIN = "git.10110110.xyz"; + # You need to specify this to remove the port from URLs in the web UI. + ROOT_URL = "https://${srv.DOMAIN}/"; + HTTP_PORT = 3000; + }; + service.DISABLE_REGISTRATION = true; + session.COOKIE_SECURE = true; + actions = { + ENABLED = true; + DEFAULT_ACTIONS_URL = "github"; + }; + }; + }; +} diff --git a/secrets/cf-acme.yaml b/secrets/cf-acme.yaml index d8e00f3..53824cd 100644 --- a/secrets/cf-acme.yaml +++ b/secrets/cf-acme.yaml @@ -4,20 +4,29 @@ sops: - recipient: age14e2d2y8e2avzfrsyxg9dudxd36svm24t7skw6e969n0c42znlp3shffdtg enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ei9idzZZTmtXSHB5bnhB - WjdOeDJBc3l0MjEvbHlHczRtTCt3cG05M0JzCnMvM05SWWJsU1h6VXFxOWVlN21x - MmJxcFpVbEpKaUliRmJBM2FhN1d6cm8KLS0tIElibU4xUTNScWM2cEI2YXdWRzdr - cjFKUzJENlVUVlpoQ3RNelFUV2h3WkkKIOHlJ72UWGnOxvO6mm6f1wnWZ5acWQCX - AmG5ATn3WYvUt9nthMUMFpX3ICFiLHp73eKz1vMsA6DloVpi58FAlg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBITExOYlBkVlRKSHVpc2U2 + L3BJNUV1UER0M0JldzNMTm9qam1nWGIwa2pnCnptZ2I3SU5rV3pwQTcvV3E4YWVI + LzlQa1NxWVVDcHJma1lmSWt6ZUZuV3MKLS0tIFlXK3UzR2JDOEFOUmJYZFpkLzE1 + QVQ3MVpueENUTmdaNCtKcjhBVkRDUjAKSze6cNG0BfETuDylwUGZD02P/NL3O3O4 + LBIhQAyShgzAqqmus/aCoYPfVChuuH9sEspZHWFSQV8aTJL1kFX0yw== -----END AGE ENCRYPTED FILE----- - recipient: age16pdhm238k63uye3rf4cwwe7ddyzds6xj9jv4wpsfggkghyarjqtsjzkxna enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4M2ZNcndhUFdkT2JmYWxw - Sk14Sk1OWUQ1MzZ3SDZLdnR6TW9xK3h1bGpvCmlVUkRxbnFWc1gzRGduZURTOWNI - WDdsakRRelhId1RKSEIvRWJpQUozYk0KLS0tIDlrY1E0NG5ydWRoT1QyMXZmVXpN - TzlHa0h2SFlUZnAvcjJ1NGdFL3ppWWsKm/aU+oAbTH7kC/k+VbGoxBGQzWxe8SRD - 8Glhaq/ctBcr09dbkWl43GTXkNoEx8/wKA30HTvEq0yWEBworrSQ8w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTUtpYzJYbU1oRDlTc295 + YVQySmdvbjhwK2pBaU5XRlFsVDNJSHl5blE0Cjh1bjNrY0wrMUdvVExpMXJSVTc1 + R1ZKRGpQSmE1N09nYzZNTXFHT1pqbmcKLS0tIDRYYys3WUhTQnJkS0hMT2lRS01o + bUt2RVdUZzdFZFVOTWNOOHBkSlZ4bmsK350/b+SL+0TT1ZJ6AIB9iDibf4L5ySpg + P9ZkCmiDd3Le7ehlxJRBP+ynQOq+B0+zsoAUrS2AAcCo7nSKLnfZ0A== + -----END AGE ENCRYPTED FILE----- + - recipient: age12tz2r7clep9e450qhr5a6ctnx29ywmu0llq8uk9kcwhpp82zsa0sk9la9h + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSW5Fc3pUblI3dll6OEcx + NkVVcndybkZkOW93WmdjaE9zQnVFVGdHVkRBCnlZMWFLalloZ0xEOVVwVU9QTVd2 + TS9aRnpSdU9uTzV3SlVxL0tkQ3R2aFEKLS0tIE1PSEV4UnBCSXc1S1BQb3VNeVlt + c0pldlQ5UFN5NWh3QWRwSnZCejZXcVUKY7vVyf567eOBhwZvy1E8MyDtLo3ljwST + 5mgOLRaEU+G9bVOPGfClaBHK94sJMlHABa9M8bhd7Naws+OeUyKI4A== -----END AGE ENCRYPTED FILE----- lastmodified: "2025-06-02T00:02:47Z" mac: ENC[AES256_GCM,data:l3I8KNMoZGrUUS/RzY0fAr7DkvyhynOqPW/09IfI8sKYBP+gavdf3/OpW3uwhYzuS6pRWwCaUTa0F+HELu7rBG8FwpvyBpdeAgZb1hVFtKeBuaCjXDieuxKjj27IKLx3UbHx2iRm91oB7bIMZaXYMrlYVmrs/BkgoT8vHj5j7Rc=,iv:KaB9qaUTYbnS6ix297MjIHxl+LSazZnRW0Lu2bP/kmk=,tag:bbncBMsk/qOfz0LRmrqiUQ==,type:str]