diff --git a/.forgejo/workflows/build-modules.yml b/.forgejo/workflows/build-modules.yml deleted file mode 100644 index 96e45c0..0000000 --- a/.forgejo/workflows/build-modules.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: Build Nix modules (dry-run) - -on: - push: - branches: - - main - -jobs: - build-modules: - runs-on: docker - container: - image: lix:latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Run Dry Run (dry-run) - env: - NIX_CONFIG: experimental-features = nix-command flakes - run: | - set -eux - ./dry_run.zsh - diff --git a/.sops.yaml b/.sops.yaml index 4fdecd4..df91613 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -3,7 +3,6 @@ keys: - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86 - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p - &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m - - &server_build_machine age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca - &server_christine age1kzsrlz86y5nqe4vaufv8chupq2hrf3avlmxsp3d5p9t5xj593deszslkmp creation_rules: - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$ @@ -29,9 +28,4 @@ creation_rules: - path_regex: nix-system-configs/secrets/wireguard/[^/]+\.(yaml|json|env|ini)$ key_groups: - age: - - *admin_christine - - path_regex: nix-system-configs/secrets/build_machine/[^/]+\.(yaml|json|env|ini)$ - key_groups: - - age: - - *admin_christine - - *server_build_machine \ No newline at end of file + - *admin_christine \ No newline at end of file diff --git a/documentation_titlepage.md b/documentation_titlepage.md index eb7dbd6..ee020cf 100644 --- a/documentation_titlepage.md +++ b/documentation_titlepage.md @@ -171,46 +171,6 @@ Synchronizes local system changes back to the repository. This script: 5. Syncs changes from `/etc/nixos/modules` back to the repository 6. Stages, commits, and pushes changes to the remote git repository with a timestamped commit message -## Adding New Systems - -To add a new system configuration to the infrastructure: - -1. **Create the configuration file** in `nix-system-configs/modules/system/`: - ```bash - cp nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix \ - nix-system-configs/modules/system/your-new-system.nix - ``` - -2. **Edit the configuration** to set your system's unique properties: - ```nix - config = { - local.hostname = "nixos-your-system"; - local.username = "yourusername"; - local.userDescription = "Your System Description"; - local.address = "10.XXX.XXX.XXX"; # Choose an available IP - - system.stateVersion = "25.11"; - }; - ``` - -3. **Register in `flake.nix`** to make it available for builds: - ```nix - nixosConfigurations = { - # ...existing configurations... - - "nixos-your-system" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/your-new-system.nix ]; - }; - }; - ``` -4. ***IF YOU WANT TO CHECK IT MANUALLY*** - **Test the configuration** before deploying, change the `nixos-your-system` accordingly: - ```bash - nix build .#nixosConfigurations.nixos-your-system.config.system.build.toplevel - ``` - -Once the build succeeds, the configuration is ready for deployment using the `pull.zsh` script on the target machine. - ## How to maintain the local machines > [!NOTE] The following maintenance scripts should be made less unwieldy to use, so they will be changed in the next diff --git a/dry_run.zsh b/dry_run.zsh deleted file mode 100755 index 9fe02d0..0000000 --- a/dry_run.zsh +++ /dev/null @@ -1,28 +0,0 @@ -#!/usr/bin/env zsh - -export NIX_CONFIG="experimental-features = nix-command flakes" - -echo "=== nix --version ===" -nix --version -echo - -configs=( - "nixos-local-wireguard-server" - "nixos-blank" - "nixos-songsheet" - "nixos-database" - "nixos-forgejo" - "nixos-teamspeak" - "nixos-traefik" - "nixos-build-machine" -) - -if [[ -n "$1" ]]; then - configs=("$1") -fi - -for config in "${configs[@]}"; do - echo "=== Dry-run: $config ===" - nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" || true - echo -done diff --git a/flake.lock b/flake.lock deleted file mode 100644 index f732214..0000000 --- a/flake.lock +++ /dev/null @@ -1,27 +0,0 @@ -{ - "nodes": { - "nixpkgs": { - "locked": { - "lastModified": 1770770419, - "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-25.11", - "repo": "nixpkgs", - "type": "github" - } - }, - "root": { - "inputs": { - "nixpkgs": "nixpkgs" - } - } - }, - "root": "root", - "version": 7 -} diff --git a/flake.nix b/flake.nix deleted file mode 100644 index ad1ebd7..0000000 --- a/flake.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ - description = "PRG Server Infrastructure - NixOS Configurations"; - - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; - }; - - outputs = { - self, - nixpkgs, - ... - }: let - system = "x86_64-linux"; - in { - nixosConfigurations = { - "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/wireguard_server.nix]; - }; - - "nixos-blank" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix]; - }; - - "nixos-songsheet" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/compose-songsheet.nix]; - }; - - "nixos-database" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/database.nix]; - }; - - "nixos-forgejo" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/forgejo.nix]; - }; - - "nixos-teamspeak" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/teamspeak.nix]; - }; - - "nixos-traefik" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/traefik.nix]; - }; - - "nixos-build-machine" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [./nix-system-configs/modules/system/build_machine.nix]; - }; - }; - }; -} diff --git a/nix-system-configs/build-deprecated/configuration.nix b/nix-system-configs/build/configuration.nix similarity index 100% rename from nix-system-configs/build-deprecated/configuration.nix rename to nix-system-configs/build/configuration.nix diff --git a/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix b/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix index cd34a7d..efe791b 100644 --- a/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix +++ b/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix @@ -4,10 +4,7 @@ lib, ... }: let - home-manager = builtins.fetchTarball { - url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; - sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy"; - }; + home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; cfg = config.services.forgejo; srv = cfg.settings.server; in { diff --git a/nix-system-configs/modules/secrets-config/notes.md b/nix-system-configs/modules/secrets-config/notes.md index 9218e2a..a0c2863 100644 --- a/nix-system-configs/modules/secrets-config/notes.md +++ b/nix-system-configs/modules/secrets-config/notes.md @@ -1,7 +1,6 @@ To generate the keys beforehand ```ssh nix-shell -p age -sudo mkdir /var/lib/sops-nix -age-keygen -o /var/lib/sops-nix/key.txt +/var/lib/sops-nix/key.txt ``` And then update the .sops.yaml in the project directory accordingly. \ No newline at end of file diff --git a/nix-system-configs/modules/secrets-config/sops-build-machine.nix b/nix-system-configs/modules/secrets-config/sops-build-machine.nix deleted file mode 100644 index d66aeda..0000000 --- a/nix-system-configs/modules/secrets-config/sops-build-machine.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: { - imports = let - # replace this with an actual commit id or tag - commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; - in [ - "${builtins.fetchTarball { - url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; - # replace this with an actual hash - sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; - }}/modules/sops" - ]; - - # This will add secrets.yml to the nix store - # You can avoid this by adding a string to the full path instead, i.e. - # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; - sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml; - # This will automatically import SSH keys as age keys - #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"]; - # This is using an age key that is expected to already be in the filesystem - sops.age.keyFile = "/var/lib/sops-nix/key.txt"; - # This will generate a new key if the key specified above does not exist - sops.age.generateKey = true; - - # Export individual WireGuard keys from the SOPS YAML as text secrets so they - # are available both as strings and as files (.path) - sops.secrets."runner_token" = { - format = "yaml"; - sopsFile = ../../secrets/build_machine/secrets.yaml; - owner = "root"; - mode = "0400"; - }; - -} diff --git a/nix-system-configs/modules/secrets-config/sops-wireguard.nix b/nix-system-configs/modules/secrets-config/sops-wireguard.nix deleted file mode 100644 index 35d48c6..0000000 --- a/nix-system-configs/modules/secrets-config/sops-wireguard.nix +++ /dev/null @@ -1,51 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: { - imports = let - # replace this with an actual commit id or tag - commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; - in [ - "${builtins.fetchTarball { - url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; - # replace this with an actual hash - sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; - }}/modules/sops" - ]; - - # This will add secrets.yml to the nix store - # You can avoid this by adding a string to the full path instead, i.e. - # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; - sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml; - # This will automatically import SSH keys as age keys - #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"]; - # This is using an age key that is expected to already be in the filesystem - sops.age.keyFile = "/var/lib/sops-nix/key.txt"; - # This will generate a new key if the key specified above does not exist - sops.age.generateKey = true; - - # Export individual WireGuard keys from the SOPS YAML as text secrets so they - # are available both as strings and as files (.path) - sops.secrets."wireguard_private" = { - format = "yaml"; - sopsFile = ../../secrets/wireguard/secrets.yaml; - owner = "root"; - mode = "0400"; - }; - - sops.secrets."wireguard_preshared" = { - format = "yaml"; - sopsFile = ../../secrets/wireguard/secrets.yaml; - owner = "root"; - mode = "0400"; - }; - - sops.secrets."wireguard_public" = { - format = "yaml"; - sopsFile = ../../secrets/wireguard/secrets.yaml; - owner = "root"; - mode = "0444"; - }; -} diff --git a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix index 6a5afa3..6fa22ea 100644 --- a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix +++ b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix @@ -3,9 +3,7 @@ pkgs, lib, ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { +}: { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -30,11 +28,14 @@ in { }; imports = [ - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - (choose [ ./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix ]) + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/bootloader/seabios-assigned-iso-at-birth.nix + ./modules/lix-default.nix + # Optionally to enable remote building: ./modules/toolsets/remote_building.nix + #./modules/songsheet/wavelog/docker-compose.nix + #./modules/secrets-config/sops-the-blank-system.nix ]; config = { diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix deleted file mode 100644 index 4aeb41c..0000000 --- a/nix-system-configs/modules/system/build_machine.nix +++ /dev/null @@ -1,262 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { - options.local = { - hostname = lib.mkOption { - type = lib.types.str; - default = "nixos-build-machine"; - description = "System hostname"; - }; - username = lib.mkOption { - type = lib.types.str; - default = "nixosbm"; - description = "Primary user username"; - }; - userDescription = lib.mkOption { - type = lib.types.str; - default = "NixOS Build Machine"; - description = "Primary user description"; - }; - address = lib.mkOption { - type = lib.types.str; - default = "10.1.1.3"; - description = "Static IP address"; - }; - }; - - imports = [ - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ]) - ## TODO: Make this more elegant and less risky for unexpected errors happening. - ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix; - - config = { - # Local metadata - local.hostname = "nixos-build-machine"; - local.username = "nixosbm"; - local.userDescription = "NixOS Build Machine"; - local.address = "10.1.1.3"; - - # Enable Rsync - services.rsync.enable = true; - - # Passwordless sudo for wheel group - security.sudo.wheelNeedsPassword = false; - - # Hardware U2F support - Passwordless sudo with hardware key - security.pam.u2f = { - enable = true; - settings = { - authfile = "/etc/u2f_keys"; - cue = true; - pinverification = 0; # No PIN verification - userpresence = 1; # Require user presence (touch) - }; - }; - - # Optimize builds - nix.settings = { - # Enable parallel building - max-jobs = "auto"; - cores = 0; # Use all available cores - - # Optimize store operations - auto-optimise-store = true; - - # Build settings - sandbox = true; - keep-outputs = true; - keep-derivations = true; - }; - - # Enable distributed builds (optional, for your VM setup) - nix.buildMachines = []; - nix.distributedBuilds = false; - - # Optimize garbage collection - nix.gc = { - automatic = true; - dates = "weekly"; - options = "--delete-older-than 30d"; - }; - - # Increase build speed with tmpfs for builds (if you have enough RAM) - # Comment out if low on memory - systemd.services.nix-daemon.environment = { - TMPDIR = "/tmp"; - }; - boot.tmp.useTmpfs = true; - boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM - - # SSH Agent authentication - security.pam.sshAgentAuth.enable = true; - - # Automatic upgrades - system.autoUpgrade = { - enable = true; # Set to true for automatic updates - dates = "daily"; - allowReboot = false; - }; - - # Bootloader fallback settings are provided by the seabios import - # (seabios-assigned-iso-at-birth.nix) - - # Replicate systemd-boot configuration from the deprecated configuration - # so the system is bootable (matches build-deprecated/configuration.nix). - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - # Enable Tailscale - services.tailscale.enable = true; - - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.nixosbm = { - isNormalUser = true; - description = "NixOS Build Machine"; - extraGroups = ["networkmanager" "wheel"]; - packages = with pkgs; []; - }; - - # Remote builder server setup - users.users.nixremote = { - isNormalUser = true; - description = "Nix Remote Builder"; - home = "/home/nixremote"; - createHome = true; - - # SSH key for remote builds - openssh.authorizedKeys.keys = [ - # Add the public key from your client machines here - # Example: "ssh-ed25519 AAAAC3... root@client-machine" - ]; - }; - - systemd.tmpfiles.rules = [ - "z /home/nixremote 0555 nixremote nixremote - -" - "z /home/nixremote/.ssh 0555 nixremote nixremote - -" - ]; - - # Allow unfree packages - nixpkgs.config.allowUnfree = true; - - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - wget - fastfetch - hyfetch - helix - ]; - - programs.gnupg.agent = { - enable = true; - enableSSHSupport = true; - }; - - # Enable the OpenSSH daemon. - services.openssh.enable = true; - -# Enable Podman for Gitea Actions Runner - virtualisation.podman = { - enable = true; - dockerCompat = true; - defaultNetwork.settings.dns_enabled = true; - }; - - - # Network configuration for the build machine on the Proxmox bridge - networking.interfaces.ens18.ipv4.addresses = [ - { - address = config.local.address; - #dns = "10.1.1.2"; - prefixLength = 24; - } - ]; - networking.defaultGateway = "10.1.1.1"; - environment.etc."resolv.conf".text = '' - nameserver 10.1.1.2 - ''; - - services.gitea-actions-runner = { - package = pkgs.forgejo-runner; - instances.default = { - enable = true; - name = "monolith"; - url = "https://git.prg-radio.org"; - # Obtaining the path to the runner token file may differ - # tokenFile should be in format TOKEN=, since it's EnvironmentFile for systemd - tokenFile = config.sops.secrets.runner_token.path; - labels = [ - "lix:docker://git.lix.systems/lix-project/lix:latest" - "nix:docker://git.lix.systems/lix-project/lix:latest" - "ubuntu-bleeding-edge:docker://ubuntu:resolute" - "ubuntu-latest:docker://ubuntu:plucky" - "ubuntu-24.04:docker://ubuntu:noble" - "alpine:docker://alpine:edge" - "rust:docker://rust:trixie" - "python-315:docker://python:3.15.0a6-slim-trixie" - ]; - }; - }; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "25.11"; # Did you read the comment? - - # Helpful commented examples for remote-build configuration retained from original - # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE - # nix.distributedBuilds = true; - # nix.buildMachines = [ - # { - # hostName = "nixos-build-machine"; - # system = "x86_64-linux"; - # sshUser = "nixremote"; - # sshKey = "/root/.ssh/nixremote"; - # maxJobs = 4; - # speedFactor = 2; - # supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; - # } - # ]; - # - # Generate SSH key for remote building - #systemd.services.generate-nixremote-key = { - # description = "Generate SSH key for remote Nix builds"; - # wantedBy = [ "multi-user.target" ]; - # serviceConfig = { - # Type = "oneshot"; - # RemainAfterExit = true; - # }; - # script = '' - # if [ ! -f /root/.ssh/nixremote ]; then - # ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder" - # fi - # ''; - #}; - # - #programs.ssh.extraConfig = '' - # Host nixos-build-machine - # HostName 192.168.1.175 - # IdentitiesOnly yes; - # IdentityFile /root/.ssh/nixremote - # User nixremoteStrictHostKeyChecking accept-new - #''; - # - # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub - # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list, - # then rebuild the build machine. - # i.e on the client: run "cat /root.ssh/nixremote.pub" - # and copy the output to the build machine's configuration.nix - }; -} - diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix index 95fd8fc..2a83324 100644 --- a/nix-system-configs/modules/system/compose-songsheet.nix +++ b/nix-system-configs/modules/system/compose-songsheet.nix @@ -3,9 +3,7 @@ pkgs, lib, ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { +}: { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -30,16 +28,17 @@ in { }; imports = [ - (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) - + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/bootloader/seabios-assigned-iso-at-birth.nix + ./modules/lix-default.nix + # Optionally: ./modules/toolsets/remote_building.nix + # + # ## Compose modules for Portainer service - (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ]) - (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ]) + ./modules/songsheet/wavelog/docker-compose.nix + ./modules/secrets-config/sops-composesongsheet.nix ]; config = { diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index f22ec06..fdac7b9 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -3,9 +3,7 @@ pkgs, lib, ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { +}: { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -30,15 +28,14 @@ in { }; imports = [ - (choose [ ./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix ]) - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - (choose [ ./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix ]) - (choose [ ./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix ]) - ## TODO: Make this more elegant and less risky for unexpected errors happening. - ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix; + ./modules/desktop-manager/gnome.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/lix-default.nix + ./modules/secrets-config/sops-database.nix + ./modules/system_scripts/gcloud_backup.nix + ./hardware-configuration.nix + ]; config = { local.hostname = "nixosdd"; diff --git a/nix-system-configs/modules/system/forgejo.nix b/nix-system-configs/modules/system/forgejo.nix index 5a1a6da..f000f9f 100644 --- a/nix-system-configs/modules/system/forgejo.nix +++ b/nix-system-configs/modules/system/forgejo.nix @@ -7,7 +7,6 @@ home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; cfg = config.services.forgejo; srv = cfg.settings.server; - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); in { options.local = { hostname = lib.mkOption { @@ -33,12 +32,12 @@ in { }; imports = [ - (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/toolsets/remote_building.nix + ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix + ./modules/lix-default.nix ]; config = { diff --git a/nix-system-configs/modules/system/teamspeak.nix b/nix-system-configs/modules/system/teamspeak.nix index fc57454..7427647 100644 --- a/nix-system-configs/modules/system/teamspeak.nix +++ b/nix-system-configs/modules/system/teamspeak.nix @@ -3,9 +3,7 @@ pkgs, lib, ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { +}: { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -30,15 +28,17 @@ in { }; imports = [ - (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/bootloader/seabios-assigned-iso-at-birth.nix + ./modules/lix-default.nix + # Optionally: ./modules/toolsets/remote_building.nix + # + # ## Compose modules for Portainer service - (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ]) - (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ]) + ./modules/songsheet/wavelog/docker-compose.nix + ./modules/secrets-config/sops-composesongsheet.nix ]; config = { diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index 28b6d7c..3613882 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -3,9 +3,7 @@ pkgs, lib, ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { +}: { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -30,12 +28,12 @@ in { }; imports = [ - (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/bootloader/seabios-assigned-iso-at-birth.nix + ./modules/lix-default.nix + # Optionally: ./modules/toolsets/remote_building.nix ]; config = { diff --git a/nix-system-configs/modules/system/wireguard_server.nix b/nix-system-configs/modules/system/wireguard_server.nix index 32ee0fb..71be160 100644 --- a/nix-system-configs/modules/system/wireguard_server.nix +++ b/nix-system-configs/modules/system/wireguard_server.nix @@ -3,9 +3,7 @@ pkgs, lib, ... -}: let - choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); -in { +}: { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -30,12 +28,11 @@ in { }; imports = [ - (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) - (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) - (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) - (choose [ ./modules/lix-default.nix ../lix-default.nix ]) - (choose [ ./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix ]) + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/bootloader/seabios-assigned-iso-at-birth.nix + ./modules/lix-default.nix # Optionally to enable remote building: ./modules/toolsets/remote_building.nix #./modules/songsheet/wavelog/docker-compose.nix #./modules/secrets-config/sops-the-blank-system.nix @@ -79,19 +76,18 @@ in { # Why 5182(0)? WireGuard server is running on port 51820, # thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion # with other local network services in the future. - postSetup = '' + postUp = '' ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE ''; # Undo the above - postShutdown = '' + preDown = '' ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE ''; privateKeyFile = config.sops.secrets.wireguard_private.path; - #presharedKeyFile = config.sops.secrets.wireguard_preshared.path; }; }; diff --git a/nix-system-configs/secrets/build_machine/secrets.yaml b/nix-system-configs/secrets/build_machine/secrets.yaml deleted file mode 100644 index 019b967..0000000 --- a/nix-system-configs/secrets/build_machine/secrets.yaml +++ /dev/null @@ -1,25 +0,0 @@ -runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str] -sops: - age: - - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq - LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3 - M3l2WXpQVnZjYmtNSEJIWVR5cWlUbEEKLS0tIDNtVHRnRVl5RWdmRmNXYVFRbkNq - TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz - zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW - M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn - UXgzNmVhbWh3MytRNXlJdkJ0ak4vQXcKLS0tIGZ1eEU2UjIxcmw1ZnVwTFVZSHMx - U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN - mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-12T17:12:42Z" - mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.11.0