root/the_prg_server_configuration
1
0
Fork 0
mirror of https://codeberg.org/polyteknisk-radiogruppe/the_prg_server_configuration.git synced 2026-10-21 03:15:46 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: root:387fb668b3d2fd32764608663417e6859ca6de8e
Branches Tags
root:main
..
compare: root:27f35b0fe53e1099ea254cd2d04a0ddd0ee98db3
Branches Tags
root:main

No commits in common. "387fb668b3d2fd32764608663417e6859ca6de8e" and "27f35b0fe53e1099ea254cd2d04a0ddd0ee98db3" have entirely different histories.
387fb668b3 ... 27f35b0fe5

11 changed files with 64 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -14,20 +14,19 @@ TODO HECK
- [x] Do a massive overhaul of the file structure, like there should be like modules where it is possible to call things to be packages. I.e. Calling the OVMF/SeaBIOS + Gnome/Plasma/Sway + Local changes, which two former would be separate .nix files. -> Probably will do a V3 or v2.1 later on when mature - [x] Do a massive overhaul of the file structure, like there should be like modules where it is possible to call things to be packages. I.e. Calling the OVMF/SeaBIOS + Gnome/Plasma/Sway + Local changes, which two former would be separate .nix files. -> Probably will do a V3 or v2.1 later on when mature
- [ ] Add the .env for the configurations so that we add the `git config --global user.email "you@example.com"` and `git config --global user.name "Your Name"` with the account custom made for this. - [ ] Add the .env for the configurations so that we add the `git config --global user.email "you@example.com"` and `git config --global user.name "Your Name"` with the account custom made for this.
- [ ] Clean up the hanging configurations -> PiHole DNS Stuff needs to be transferred over elegantly, don't want to touch it unless I am myself en-site. - [?] Clean up the hanging configurations -> PiHole DNS Stuff needs to be transferred over elegantly, don't want to touch it unless I am myself en-site.
- [x] Find a more clean way to store initial passwords (.env??) -> [nix-sops](https://github.com/Mic92/sops-nix) - [x] Find a more clean way to store initial passwords (.env??) -> [nix-sops](https://github.com/Mic92/sops-nix)
- [x] Create proper build automation scripts -> Needs to be properly done. - [?] Create proper build automation scripts -> Needs to be properly done.
- [ ] Attach more NixOS weblinks... - [ ] Attach more NixOS weblinks...
- [ ] Update Forgejo Styling - [ ] Update Forgejo Styling
- [x] Figure out what the ***hecc*** to do with SSL Certifications in the most elegant way -> Use Traefik - [x] Figure out what the ***hecc*** to do with SSL Certifications in the most elegant way -> Use Traefik
- [x] Add Git Actions to Forgejo -> It was already added, just need to setup the CI itself. - [x] Add Git Actions to Forgejo -> It was already added, just need to setup the CI itself.
- [x] Setup the CI backend. - [ ] Setup the CI backend.
- [x] Create the Podman x Portainer NixOS module -> See `Songsheet` - [x] Create the Podman x Portainer NixOS module -> See `Songsheet`
- [ ] Read up more about how to a backup machine stuff and making it Nix-y... - [ ] Read up more about how to a backup machine stuff and making it Nix-y...
- [ ] Figure out my life - [ ] Figure out my life
- [ ] Setup Hardware Keys - [ ] Setup Hardware Keys
- [x] Setup a VPN - [ ] Setup a VPN (Likely OpenVPN)
- [ ] Setup Alejandra pre-commit hook
## NOTES FOR FUTURE ## NOTES FOR FUTURE

39
dry_run.zsh
View file

@ -21,43 +21,8 @@ if [[ -n "$1" ]]; then
configs=("$1") configs=("$1")
fi fi
# Track results
passed_configs=()
failed_configs=()
for config in "${configs[@]}"; do for config in "${configs[@]}"; do
echo "Dry-run: $config ===" echo "=== Dry-run: $config ==="
if nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" 2>&1; then nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" || true
echo "[PASSED]: $config"
passed_configs+=("$config")
else
echo "[FAILED]: $config"
failed_configs+=("$config")
fi
echo echo
done done
# Print summary
echo "BUILD SUMMARY"
echo "Total: ${#configs[@]} | Passed: ${#passed_configs[@]} | Failed: ${#failed_configs[@]}"
echo
if [[ ${#passed_configs[@]} -gt 0 ]]; then
echo "Passed configs:"
for c in "${passed_configs[@]}"; do
echo " - $c"
done
echo
fi
if [[ ${#failed_configs[@]} -gt 0 ]]; then
echo "Failed configs:"
for c in "${failed_configs[@]}"; do
echo " - $c"
done
echo
exit 1
fi
echo "All configurations passed!"
exit 0

1
nix-system-configs/modules/secrets-config/sops-build-machine.nix
View file

@ -34,4 +34,5 @@
owner = "root"; owner = "root";
mode = "0400"; mode = "0400";
}; };
} }

10
nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix
View file

@ -30,11 +30,11 @@ in {
}; };
imports = lib.filter (x: x != null) [ imports = lib.filter (x: x != null) [
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix]) (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
(choose [./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix]) (choose [ ./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix ])
]; ];
config = { config = {

23
nix-system-configs/modules/system/build_machine.nix
View file

@ -13,6 +13,7 @@
fsType = "ext4"; fsType = "ext4";
}; };
}; };
in { in {
options.local = { options.local = {
hostname = lib.mkOption { hostname = lib.mkOption {
@ -37,16 +38,14 @@ in {
}; };
}; };
imports = imports = [
[ (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ])
(choose [./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix]) ## TODO: Make this more elegant and less risky for unexpected errors happening.
## TODO: Make this more elegant and less risky for unexpected errors happening. ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix
] ++ lib.optional (!builtins.pathExists ./hardware-configuration.nix) dummyFileSystems;
++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix
++ lib.optional (!builtins.pathExists ./hardware-configuration.nix) dummyFileSystems;
config = { config = {
# Local metadata # Local metadata
@ -174,13 +173,14 @@ in {
# Enable the OpenSSH daemon. # Enable the OpenSSH daemon.
services.openssh.enable = true; services.openssh.enable = true;
# Enable Podman for Gitea Actions Runner # Enable Podman for Gitea Actions Runner
virtualisation.podman = { virtualisation.podman = {
enable = true; enable = true;
dockerCompat = true; dockerCompat = true;
defaultNetwork.settings.dns_enabled = true; defaultNetwork.settings.dns_enabled = true;
}; };
# Network configuration for the build machine on the Proxmox bridge # Network configuration for the build machine on the Proxmox bridge
networking.interfaces.ens18.ipv4.addresses = [ networking.interfaces.ens18.ipv4.addresses = [
{ {
@ -204,7 +204,6 @@ in {
# tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
tokenFile = config.sops.secrets.runner_token.path; tokenFile = config.sops.secrets.runner_token.path;
labels = [ labels = [
"docker:docker://docker"
"lix:docker://git.lix.systems/lix-project/lix:latest" "lix:docker://git.lix.systems/lix-project/lix:latest"
"nix:docker://git.lix.systems/lix-project/lix:latest" "nix:docker://git.lix.systems/lix-project/lix:latest"
"ubuntu-bleeding-edge:docker://ubuntu:resolute" "ubuntu-bleeding-edge:docker://ubuntu:resolute"

14
nix-system-configs/modules/system/compose-songsheet.nix
View file

@ -30,16 +30,16 @@ in {
}; };
imports = [ imports = [
(choose [./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix]) (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix]) (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
# Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
## Compose modules for Portainer service ## Compose modules for Portainer service
(choose [./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix]) (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
(choose [./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix]) (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
]; ];
config = { config = {

22
nix-system-configs/modules/system/database.nix
View file

@ -29,18 +29,16 @@ in {
}; };
}; };
imports = imports = [
[ (choose [ ./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix ])
(choose [./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
(choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix ])
(choose [./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix]) (choose [ ./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix ])
(choose [./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix]) ## TODO: Make this more elegant and less risky for unexpected errors happening.
## TODO: Make this more elegant and less risky for unexpected errors happening. ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
]
++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
config = { config = {
local.hostname = "nixosdd"; local.hostname = "nixosdd";

12
nix-system-configs/modules/system/forgejo.nix
View file

@ -33,12 +33,12 @@ in {
}; };
imports = [ imports = [
(choose [./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix]) (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix]) (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
(choose [./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix]) (choose [ ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
]; ];
config = { config = {

14
nix-system-configs/modules/system/teamspeak.nix
View file

@ -30,15 +30,15 @@ in {
}; };
imports = [ imports = [
(choose [./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix]) (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix]) (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
# Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
## Compose modules for Portainer service ## Compose modules for Portainer service
(choose [./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix]) (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
(choose [./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix]) (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
]; ];
config = { config = {

10
nix-system-configs/modules/system/traefik.nix
View file

@ -30,11 +30,11 @@ in {
}; };
imports = [ imports = [
(choose [./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix]) (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix]) (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
# Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
]; ];

12
nix-system-configs/modules/system/wireguard_server.nix
View file

@ -30,12 +30,12 @@ in {
}; };
imports = [ imports = [
(choose [./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix]) (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
(choose [./modules/local/hostname_username.nix ../local/hostname_username.nix]) (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
(choose [./modules/local/networking_local.nix ../local/networking_local.nix]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
(choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix]) (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
(choose [./modules/lix-default.nix ../lix-default.nix]) (choose [ ./modules/lix-default.nix ../lix-default.nix ])
(choose [./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix]) (choose [ ./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix ])
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
#./modules/songsheet/wavelog/docker-compose.nix #./modules/songsheet/wavelog/docker-compose.nix
#./modules/secrets-config/sops-the-blank-system.nix #./modules/secrets-config/sops-the-blank-system.nix