iofq/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dec
Some checks are pending
/ check (push) Waiting to run
Details

Browse source
This commit is contained in:
iofq 2025-09-28 14:49:19 -05:00
parent 3f81a20e87
commit 77164adab6
12 changed files with 412 additions and 485 deletions
Download patch file Download diff file Expand all files Collapse all files

85
nixos/consensus/configuration.nix
View file

@ -8,7 +8,6 @@
imports = [
./hardware-configuration.nix
./backups.nix
./forgejo-runner.nix
];
sops = {
secrets = {
@ -95,49 +94,55 @@
mediaLocation = "/srv/immich";
};
nginx = {
enable = false;
virtualHosts."img.10110110.xyz" = {
enable = true;
# virtualHosts."img.10110110.xyz" = {
# forceSSL = true;
# useACMEHost = "10110110.xyz";
# locations."/" = {
# proxyPass = "http://localhost:${toString config.services.immich.port}";
# proxyWebsockets = true;
# recommendedProxySettings = true;
# extraConfig = ''
# client_max_body_size 50000M;
# proxy_read_timeout 600s;
# proxy_send_timeout 600s;
# send_timeout 600s;
# '';
# };
# };
virtualHosts."fs.10110110.xyz" = {
forceSSL = true;
useACMEHost = "10110110.xyz";
locations."/" = {
proxyPass = "http://localhost:${toString config.services.immich.port}";
proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
client_max_body_size 50000M;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;
'';
};
root = "/var/www/nginx";
extraConfig = "autoindex on;";
};
};
};
boot = {
kernel.sysctl = {
"vm.swappiness" = 6;
};
tmp.cleanOnBoot = true;
# supportedFilesystems = ["zfs"];
# zfs.forceImportRoot = false;
# zfs.extraPools = ["rice"];
};
networking.hostId = "91238132";
zramSwap.enable = false;
swapDevices = [
{
device = "/swapfile";
size = 16 * 1024;
}
];
virtualisation.docker.enable = true;
networking = {
hostId = "91238132";
hostName = "consensus";
firewall = {
enable = true;
allowedTCPPorts = [
22
80
443
2022
8080
8443
10001
6443
25565
25566
9001
30303
];
@ -147,7 +152,17 @@
];
logRefusedConnections = true;
};
};
zramSwap.enable = false;
swapDevices = [
{
device = "/swapfile";
size = 16 * 1024;
}
];
virtualisation.docker.enable = true;
users.users = {
root = {
openssh.authorizedKeys.keys = [
@ -165,18 +180,18 @@
};
};
security.sudo-rs.wheelNeedsPassword = false;
# security.acme = {
# acceptTerms = true;
# defaults.email = "acme@10110110.xyz";
# certs = {
# "10110110.xyz" = {
# domain = "*.10110110.xyz";
# group = config.services.nginx.group;
# dnsProvider = "cloudflare";
# environmentFile = config.sops.secrets."env".path;
# };
# };
# };
security.acme = {
acceptTerms = true;
defaults.email = "acme@10110110.xyz";
certs = {
"10110110.xyz" = {
domain = "*.10110110.xyz";
group = config.services.nginx.group;
dnsProvider = "cloudflare";
environmentFile = config.sops.secrets."env".path;
};
};
};
nix.settings.trusted-users = [ "e" ];
system.stateVersion = "23.11";
}

24
nixos/consensus/forgejo-runner.nix
View file

@ -1,24 +0,0 @@
{ pkgs, config, ... }:
{
sops = {
secrets = {
"forgejo-runner" = {
sopsFile = ../../secrets/forgejo-runner.yaml;
};
};
};
services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = "runner-1";
url = "https://git.10110110.xyz";
tokenFile = config.sops.secrets."forgejo-runner".path;
labels = [
"ubuntu-latest:docker://node:20-bullseye"
"nix-upstream-latest:docker://nixos/nix:latest"
"native:host"
];
};
};
}

43
nixos/consensus/hypervisor/configuration.nix Normal file
View file

@ -0,0 +1,43 @@
{ name, attrs, ... }:
{
systemd.network = {
enable = true;
networks."20-lan" = {
matchConfig.Type = "ether";
networkConfig = {
Address = [ (attrs.${name}.ipv4 + attrs.${name}.subnet) ];
Gateway = "10.0.0.1";
DNS = [ "1.1.1.1" ];
IPv6AcceptRA = true;
DHCP = "no";
};
};
};
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
};
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 ];
allowedUDPPorts = [ ];
logRefusedConnections = true;
};
users.users = {
root = {
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
];
};
e = {
isNormalUser = true;
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
];
};
};
}

37
nixos/consensus/hypervisor/default.nix Normal file
View file

@ -0,0 +1,37 @@
{ lib, pkgs, ... }:
let
attrs = {
forgejo-runner = {
ipv4 = "10.0.0.2";
subnet = "/24";
mac = "02:00:00:00:00:01";
};
};
genVMConfig = name: addr: {
restartIfChanged = true;
pkgs = pkgs;
config = {
microvm = {
shares = lib.mkIf (addr.ro-store == true) [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
];
interfaces = [
{
type = "tap";
id = name;
mac = attrs.${name}.mac;
}
];
};
}
// import ./configuration.nix { inherit name attrs; };
};
in
{
microvm.vms = lib.mapAttrs genVMConfig attrs;
}

35
nixos/consensus/hypervisor/forgejo-runner.nix Normal file
View file

@ -0,0 +1,35 @@
{
inputs,
pkgs,
...
}:
{
pkgs = pkgs;
config =
{ config, ... }:
{
imports = [
inputs.sops-nix.nixosModules.sops
];
sops = {
secrets = {
forgejo-runner = {
sopsFile = ../../secrets/forgejo-runner.yaml;
};
};
};
services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = "runner-1";
url = "https://git.10110110.xyz";
tokenFile = config.sops.secrets.forgejo-runner.path;
labels = [
"ubuntu-latest:docker://node:20-bullseye"
"nix-upstream-latest:docker://nixos/nix:latest"
];
};
};
};
}