oracle rice

.sops.yaml

@@ -2,9 +2,11 @@
 keys:
   - &t14 age14e2d2y8e2avzfrsyxg9dudxd36svm24t7skw6e969n0c42znlp3shffdtg
   - &consensus age16pdhm238k63uye3rf4cwwe7ddyzds6xj9jv4wpsfggkghyarjqtsjzkxna
+  - &oracle age12tz2r7clep9e450qhr5a6ctnx29ywmu0llq8uk9kcwhpp82zsa0sk9la9h
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
       - age:
           - *t14
           - *consensus
+          - *oracle

flake.nix

@@ -98,9 +98,9 @@
           };
         };
         oracle = {
-          hostname = "129.213.119.29";
+          hostname = "oracle";
           sshUser = "root";
-          remoteBuild = true;
+          remoteBuild = false;
           profiles.system = {
             user = "root";
             path = inputs.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.oracle;

home-manager/t14/home.nix

@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   imports = [
     ../shared/programs/default.nix
     ../shared/wayland/default.nix
@@ -49,6 +50,11 @@
         hostname = "consensus.tailc353f.ts.net";
         identityFile = "/home/e/.ssh/id_ed25519";
       };
+      "oracle" = {
+        port = 2022;
+        hostname = "129.213.119.29";
+        identityFile = "/home/e/.ssh/id_ed25519";
+      };
       "10110110.xyz" = {
         port = 22;
         hostname = "10110110.xyz";

nixos/oracle/configuration.nix

@@ -2,13 +2,18 @@
 {
   imports = [
     ./hardware-configuration.nix
+    ./forgejo.nix
   ];
   boot.tmp.cleanOnBoot = true;
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
   zramSwap.enable = true;
   swapDevices = [
     {
       device = "/swapfile";
-      size = 16 * 1024;
+      size = 2 * 1024;
     }
   ];
   services = {
@@ -29,12 +34,43 @@
       overalljails = true;
     };
     tailscale.enable = true;
-    openssh.enable = true;
+    openssh = {
+      enable = true;
+      ports = [
+        2022
+      ];
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+        PermitEmptyPasswords = false;
+        UseDns = false;
+        KbdInteractiveAuthentication = false;
+        X11Forwarding = false;
+        AllowTcpForwarding = false;
+        AllowAgentForwarding = false;
+      };
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
+    };
   };
   networking = {
     domain = "";
     hostId = "81238132";
-    hostName = "iofq-oracle-x840";
+    hostName = "oracle1";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        2022
+        80
+        443
+      ];
+      logRefusedConnections = true;
+    };
   };
   users.users.root.openssh.authorizedKeys.keys = [
     ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcL53Gdrj5V9YDwKlCBIcgqiS+zHtOQpJlnOHTevJCJ e@t14''

nixos/oracle/forgejo.nix

@@ -0,0 +1,56 @@
+{ config, ... }:
+let
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+in
+{
+  sops = {
+    secrets = {
+      "env" = {
+        sopsFile = ../../secrets/cf-acme.yaml;
+      };
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "acme@10110110.xyz";
+      dnsProvider = "cloudflare";
+      environmentFile = config.sops.secrets."env".path;
+    };
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts.${cfg.settings.server.DOMAIN} = {
+      forceSSL = true;
+      enableACME = true;
+      acmeRoot = null; # use DNS
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+        extraConfig = ''
+          client_max_body_size 512M;
+        '';
+      };
+    };
+  };
+  services.forgejo = {
+    enable = true;
+    database.type = "sqlite3";
+    dump.enable = true;
+    settings = {
+      server = {
+        DOMAIN = "git.10110110.xyz";
+        # You need to specify this to remove the port from URLs in the web UI.
+        ROOT_URL = "https://${srv.DOMAIN}/";
+        HTTP_PORT = 3000;
+      };
+      service.DISABLE_REGISTRATION = true;
+      session.COOKIE_SECURE = true;
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "github";
+      };
+    };
+  };
+}

secrets/cf-acme.yaml

@@ -4,20 +4,29 @@ sops:
         - recipient: age14e2d2y8e2avzfrsyxg9dudxd36svm24t7skw6e969n0c42znlp3shffdtg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ei9idzZZTmtXSHB5bnhB
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBITExOYlBkVlRKSHVpc2U2
-            WjdOeDJBc3l0MjEvbHlHczRtTCt3cG05M0JzCnMvM05SWWJsU1h6VXFxOWVlN21x
+            L3BJNUV1UER0M0JldzNMTm9qam1nWGIwa2pnCnptZ2I3SU5rV3pwQTcvV3E4YWVI
-            MmJxcFpVbEpKaUliRmJBM2FhN1d6cm8KLS0tIElibU4xUTNScWM2cEI2YXdWRzdr
+            LzlQa1NxWVVDcHJma1lmSWt6ZUZuV3MKLS0tIFlXK3UzR2JDOEFOUmJYZFpkLzE1
-            cjFKUzJENlVUVlpoQ3RNelFUV2h3WkkKIOHlJ72UWGnOxvO6mm6f1wnWZ5acWQCX
+            QVQ3MVpueENUTmdaNCtKcjhBVkRDUjAKSze6cNG0BfETuDylwUGZD02P/NL3O3O4
-            AmG5ATn3WYvUt9nthMUMFpX3ICFiLHp73eKz1vMsA6DloVpi58FAlg==
+            LBIhQAyShgzAqqmus/aCoYPfVChuuH9sEspZHWFSQV8aTJL1kFX0yw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age16pdhm238k63uye3rf4cwwe7ddyzds6xj9jv4wpsfggkghyarjqtsjzkxna
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4M2ZNcndhUFdkT2JmYWxw
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTUtpYzJYbU1oRDlTc295
-            Sk14Sk1OWUQ1MzZ3SDZLdnR6TW9xK3h1bGpvCmlVUkRxbnFWc1gzRGduZURTOWNI
+            YVQySmdvbjhwK2pBaU5XRlFsVDNJSHl5blE0Cjh1bjNrY0wrMUdvVExpMXJSVTc1
-            WDdsakRRelhId1RKSEIvRWJpQUozYk0KLS0tIDlrY1E0NG5ydWRoT1QyMXZmVXpN
+            R1ZKRGpQSmE1N09nYzZNTXFHT1pqbmcKLS0tIDRYYys3WUhTQnJkS0hMT2lRS01o
-            TzlHa0h2SFlUZnAvcjJ1NGdFL3ppWWsKm/aU+oAbTH7kC/k+VbGoxBGQzWxe8SRD
+            bUt2RVdUZzdFZFVOTWNOOHBkSlZ4bmsK350/b+SL+0TT1ZJ6AIB9iDibf4L5ySpg
-            8Glhaq/ctBcr09dbkWl43GTXkNoEx8/wKA30HTvEq0yWEBworrSQ8w==
+            P9ZkCmiDd3Le7ehlxJRBP+ynQOq+B0+zsoAUrS2AAcCo7nSKLnfZ0A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12tz2r7clep9e450qhr5a6ctnx29ywmu0llq8uk9kcwhpp82zsa0sk9la9h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSW5Fc3pUblI3dll6OEcx
+            NkVVcndybkZkOW93WmdjaE9zQnVFVGdHVkRBCnlZMWFLalloZ0xEOVVwVU9QTVd2
+            TS9aRnpSdU9uTzV3SlVxL0tkQ3R2aFEKLS0tIE1PSEV4UnBCSXc1S1BQb3VNeVlt
+            c0pldlQ5UFN5NWh3QWRwSnZCejZXcVUKY7vVyf567eOBhwZvy1E8MyDtLo3ljwST
+            5mgOLRaEU+G9bVOPGfClaBHK94sJMlHABa9M8bhd7Naws+OeUyKI4A==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-06-02T00:02:47Z"
     mac: ENC[AES256_GCM,data:l3I8KNMoZGrUUS/RzY0fAr7DkvyhynOqPW/09IfI8sKYBP+gavdf3/OpW3uwhYzuS6pRWwCaUTa0F+HELu7rBG8FwpvyBpdeAgZb1hVFtKeBuaCjXDieuxKjj27IKLx3UbHx2iRm91oB7bIMZaXYMrlYVmrs/BkgoT8vHj5j7Rc=,iv:KaB9qaUTYbnS6ix297MjIHxl+LSazZnRW0Lu2bP/kmk=,tag:bbncBMsk/qOfz0LRmrqiUQ==,type:str]