mirror of
https://codeberg.org/polyteknisk-radiogruppe/the_prg_server_configuration.git
synced 2026-10-21 11:25:46 +02:00
Compare commits
No commits in common. "dca2e4ffbf780a9c5e6c919809aa2f0326ca3d5e" and "dac2e0b8cfcc5fa2c3cf135501b7524a715b4a6a" have entirely different histories.
dca2e4ffbf
...
dac2e0b8cf
20 changed files with 64 additions and 635 deletions
|
|
@ -1,23 +0,0 @@
|
|||
name: Build Nix modules (dry-run)
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
build-modules:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: lix:latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Run Dry Run (dry-run)
|
||||
env:
|
||||
NIX_CONFIG: experimental-features = nix-command flakes
|
||||
run: |
|
||||
set -eux
|
||||
./dry_run.zsh
|
||||
|
||||
|
|
@ -3,7 +3,6 @@ keys:
|
|||
- &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86
|
||||
- &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
|
||||
- &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m
|
||||
- &server_build_machine age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
|
||||
- &server_christine age1kzsrlz86y5nqe4vaufv8chupq2hrf3avlmxsp3d5p9t5xj593deszslkmp
|
||||
creation_rules:
|
||||
- path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$
|
||||
|
|
@ -30,8 +29,3 @@ creation_rules:
|
|||
key_groups:
|
||||
- age:
|
||||
- *admin_christine
|
||||
- path_regex: nix-system-configs/secrets/build_machine/[^/]+\.(yaml|json|env|ini)$
|
||||
key_groups:
|
||||
- age:
|
||||
- *admin_christine
|
||||
- *server_build_machine
|
||||
|
|
@ -171,46 +171,6 @@ Synchronizes local system changes back to the repository. This script:
|
|||
5. Syncs changes from `/etc/nixos/modules` back to the repository
|
||||
6. Stages, commits, and pushes changes to the remote git repository with a timestamped commit message
|
||||
|
||||
## Adding New Systems
|
||||
|
||||
To add a new system configuration to the infrastructure:
|
||||
|
||||
1. **Create the configuration file** in `nix-system-configs/modules/system/`:
|
||||
```bash
|
||||
cp nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix \
|
||||
nix-system-configs/modules/system/your-new-system.nix
|
||||
```
|
||||
|
||||
2. **Edit the configuration** to set your system's unique properties:
|
||||
```nix
|
||||
config = {
|
||||
local.hostname = "nixos-your-system";
|
||||
local.username = "yourusername";
|
||||
local.userDescription = "Your System Description";
|
||||
local.address = "10.XXX.XXX.XXX"; # Choose an available IP
|
||||
|
||||
system.stateVersion = "25.11";
|
||||
};
|
||||
```
|
||||
|
||||
3. **Register in `flake.nix`** to make it available for builds:
|
||||
```nix
|
||||
nixosConfigurations = {
|
||||
# ...existing configurations...
|
||||
|
||||
"nixos-your-system" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [ ./nix-system-configs/modules/system/your-new-system.nix ];
|
||||
};
|
||||
};
|
||||
```
|
||||
4. ***IF YOU WANT TO CHECK IT MANUALLY*** - **Test the configuration** before deploying, change the `nixos-your-system` accordingly:
|
||||
```bash
|
||||
nix build .#nixosConfigurations.nixos-your-system.config.system.build.toplevel
|
||||
```
|
||||
|
||||
Once the build succeeds, the configuration is ready for deployment using the `pull.zsh` script on the target machine.
|
||||
|
||||
## How to maintain the local machines
|
||||
|
||||
> [!NOTE] The following maintenance scripts should be made less unwieldy to use, so they will be changed in the next
|
||||
|
|
|
|||
28
dry_run.zsh
28
dry_run.zsh
|
|
@ -1,28 +0,0 @@
|
|||
#!/usr/bin/env zsh
|
||||
|
||||
export NIX_CONFIG="experimental-features = nix-command flakes"
|
||||
|
||||
echo "=== nix --version ==="
|
||||
nix --version
|
||||
echo
|
||||
|
||||
configs=(
|
||||
"nixos-local-wireguard-server"
|
||||
"nixos-blank"
|
||||
"nixos-songsheet"
|
||||
"nixos-database"
|
||||
"nixos-forgejo"
|
||||
"nixos-teamspeak"
|
||||
"nixos-traefik"
|
||||
"nixos-build-machine"
|
||||
)
|
||||
|
||||
if [[ -n "$1" ]]; then
|
||||
configs=("$1")
|
||||
fi
|
||||
|
||||
for config in "${configs[@]}"; do
|
||||
echo "=== Dry-run: $config ==="
|
||||
nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" || true
|
||||
echo
|
||||
done
|
||||
27
flake.lock
generated
27
flake.lock
generated
|
|
@ -1,27 +0,0 @@
|
|||
{
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1770770419,
|
||||
"narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-25.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
57
flake.nix
57
flake.nix
|
|
@ -1,57 +0,0 @@
|
|||
{
|
||||
description = "PRG Server Infrastructure - NixOS Configurations";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
|
||||
};
|
||||
|
||||
outputs = {
|
||||
self,
|
||||
nixpkgs,
|
||||
...
|
||||
}: let
|
||||
system = "x86_64-linux";
|
||||
in {
|
||||
nixosConfigurations = {
|
||||
"nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/wireguard_server.nix];
|
||||
};
|
||||
|
||||
"nixos-blank" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix];
|
||||
};
|
||||
|
||||
"nixos-songsheet" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/compose-songsheet.nix];
|
||||
};
|
||||
|
||||
"nixos-database" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/database.nix];
|
||||
};
|
||||
|
||||
"nixos-forgejo" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/forgejo.nix];
|
||||
};
|
||||
|
||||
"nixos-teamspeak" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/teamspeak.nix];
|
||||
};
|
||||
|
||||
"nixos-traefik" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/traefik.nix];
|
||||
};
|
||||
|
||||
"nixos-build-machine" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [./nix-system-configs/modules/system/build_machine.nix];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -4,10 +4,7 @@
|
|||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball {
|
||||
url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy";
|
||||
};
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
in {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
To generate the keys beforehand
|
||||
```ssh
|
||||
nix-shell -p age
|
||||
sudo mkdir /var/lib/sops-nix
|
||||
age-keygen -o /var/lib/sops-nix/key.txt
|
||||
/var/lib/sops-nix/key.txt
|
||||
```
|
||||
And then update the .sops.yaml in the project directory accordingly.
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
imports = let
|
||||
# replace this with an actual commit id or tag
|
||||
commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
|
||||
in [
|
||||
"${builtins.fetchTarball {
|
||||
url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
|
||||
# replace this with an actual hash
|
||||
sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
|
||||
}}/modules/sops"
|
||||
];
|
||||
|
||||
# This will add secrets.yml to the nix store
|
||||
# You can avoid this by adding a string to the full path instead, i.e.
|
||||
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
|
||||
sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
|
||||
# This will automatically import SSH keys as age keys
|
||||
#sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
|
||||
# This is using an age key that is expected to already be in the filesystem
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
# This will generate a new key if the key specified above does not exist
|
||||
sops.age.generateKey = true;
|
||||
|
||||
# Export individual WireGuard keys from the SOPS YAML as text secrets so they
|
||||
# are available both as strings and as files (.path)
|
||||
sops.secrets."runner_token" = {
|
||||
format = "yaml";
|
||||
sopsFile = ../../secrets/build_machine/secrets.yaml;
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
imports = let
|
||||
# replace this with an actual commit id or tag
|
||||
commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
|
||||
in [
|
||||
"${builtins.fetchTarball {
|
||||
url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
|
||||
# replace this with an actual hash
|
||||
sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
|
||||
}}/modules/sops"
|
||||
];
|
||||
|
||||
# This will add secrets.yml to the nix store
|
||||
# You can avoid this by adding a string to the full path instead, i.e.
|
||||
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
|
||||
sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml;
|
||||
# This will automatically import SSH keys as age keys
|
||||
#sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
|
||||
# This is using an age key that is expected to already be in the filesystem
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
# This will generate a new key if the key specified above does not exist
|
||||
sops.age.generateKey = true;
|
||||
|
||||
# Export individual WireGuard keys from the SOPS YAML as text secrets so they
|
||||
# are available both as strings and as files (.path)
|
||||
sops.secrets."wireguard_private" = {
|
||||
format = "yaml";
|
||||
sopsFile = ../../secrets/wireguard/secrets.yaml;
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
sops.secrets."wireguard_preshared" = {
|
||||
format = "yaml";
|
||||
sopsFile = ../../secrets/wireguard/secrets.yaml;
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
sops.secrets."wireguard_public" = {
|
||||
format = "yaml";
|
||||
sopsFile = ../../secrets/wireguard/secrets.yaml;
|
||||
owner = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
}
|
||||
|
|
@ -3,9 +3,7 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
|
@ -30,11 +28,14 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
(choose [ ./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix ])
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/bootloader/seabios-assigned-iso-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix
|
||||
#./modules/songsheet/wavelog/docker-compose.nix
|
||||
#./modules/secrets-config/sops-the-blank-system.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
|
|
|
|||
|
|
@ -1,262 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "nixos-build-machine";
|
||||
description = "System hostname";
|
||||
};
|
||||
username = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "nixosbm";
|
||||
description = "Primary user username";
|
||||
};
|
||||
userDescription = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "NixOS Build Machine";
|
||||
description = "Primary user description";
|
||||
};
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.1.1.3";
|
||||
description = "Static IP address";
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
(choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ])
|
||||
## TODO: Make this more elegant and less risky for unexpected errors happening.
|
||||
] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
|
||||
|
||||
config = {
|
||||
# Local metadata
|
||||
local.hostname = "nixos-build-machine";
|
||||
local.username = "nixosbm";
|
||||
local.userDescription = "NixOS Build Machine";
|
||||
local.address = "10.1.1.3";
|
||||
|
||||
# Enable Rsync
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# Optimize builds
|
||||
nix.settings = {
|
||||
# Enable parallel building
|
||||
max-jobs = "auto";
|
||||
cores = 0; # Use all available cores
|
||||
|
||||
# Optimize store operations
|
||||
auto-optimise-store = true;
|
||||
|
||||
# Build settings
|
||||
sandbox = true;
|
||||
keep-outputs = true;
|
||||
keep-derivations = true;
|
||||
};
|
||||
|
||||
# Enable distributed builds (optional, for your VM setup)
|
||||
nix.buildMachines = [];
|
||||
nix.distributedBuilds = false;
|
||||
|
||||
# Optimize garbage collection
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
# Increase build speed with tmpfs for builds (if you have enough RAM)
|
||||
# Comment out if low on memory
|
||||
systemd.services.nix-daemon.environment = {
|
||||
TMPDIR = "/tmp";
|
||||
};
|
||||
boot.tmp.useTmpfs = true;
|
||||
boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# Bootloader fallback settings are provided by the seabios import
|
||||
# (seabios-assigned-iso-at-birth.nix)
|
||||
|
||||
# Replicate systemd-boot configuration from the deprecated configuration
|
||||
# so the system is bootable (matches build-deprecated/configuration.nix).
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Enable Tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.nixosbm = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Build Machine";
|
||||
extraGroups = ["networkmanager" "wheel"];
|
||||
packages = with pkgs; [];
|
||||
};
|
||||
|
||||
# Remote builder server setup
|
||||
users.users.nixremote = {
|
||||
isNormalUser = true;
|
||||
description = "Nix Remote Builder";
|
||||
home = "/home/nixremote";
|
||||
createHome = true;
|
||||
|
||||
# SSH key for remote builds
|
||||
openssh.authorizedKeys.keys = [
|
||||
# Add the public key from your client machines here
|
||||
# Example: "ssh-ed25519 AAAAC3... root@client-machine"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"z /home/nixremote 0555 nixremote nixremote - -"
|
||||
"z /home/nixremote/.ssh 0555 nixremote nixremote - -"
|
||||
];
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
wget
|
||||
fastfetch
|
||||
hyfetch
|
||||
helix
|
||||
];
|
||||
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Enable Podman for Gitea Actions Runner
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
};
|
||||
|
||||
|
||||
# Network configuration for the build machine on the Proxmox bridge
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = config.local.address;
|
||||
#dns = "10.1.1.2";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
environment.etc."resolv.conf".text = ''
|
||||
nameserver 10.1.1.2
|
||||
'';
|
||||
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = "monolith";
|
||||
url = "https://git.prg-radio.org";
|
||||
# Obtaining the path to the runner token file may differ
|
||||
# tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
|
||||
tokenFile = config.sops.secrets.runner_token.path;
|
||||
labels = [
|
||||
"lix:docker://git.lix.systems/lix-project/lix:latest"
|
||||
"nix:docker://git.lix.systems/lix-project/lix:latest"
|
||||
"ubuntu-bleeding-edge:docker://ubuntu:resolute"
|
||||
"ubuntu-latest:docker://ubuntu:plucky"
|
||||
"ubuntu-24.04:docker://ubuntu:noble"
|
||||
"alpine:docker://alpine:edge"
|
||||
"rust:docker://rust:trixie"
|
||||
"python-315:docker://python:3.15.0a6-slim-trixie"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
|
||||
# Helpful commented examples for remote-build configuration retained from original
|
||||
# THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
|
||||
# nix.distributedBuilds = true;
|
||||
# nix.buildMachines = [
|
||||
# {
|
||||
# hostName = "nixos-build-machine";
|
||||
# system = "x86_64-linux";
|
||||
# sshUser = "nixremote";
|
||||
# sshKey = "/root/.ssh/nixremote";
|
||||
# maxJobs = 4;
|
||||
# speedFactor = 2;
|
||||
# supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
||||
# }
|
||||
# ];
|
||||
#
|
||||
# Generate SSH key for remote building
|
||||
#systemd.services.generate-nixremote-key = {
|
||||
# description = "Generate SSH key for remote Nix builds";
|
||||
# wantedBy = [ "multi-user.target" ];
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# RemainAfterExit = true;
|
||||
# };
|
||||
# script = ''
|
||||
# if [ ! -f /root/.ssh/nixremote ]; then
|
||||
# ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
|
||||
# fi
|
||||
# '';
|
||||
#};
|
||||
#
|
||||
#programs.ssh.extraConfig = ''
|
||||
# Host nixos-build-machine
|
||||
# HostName 192.168.1.175
|
||||
# IdentitiesOnly yes;
|
||||
# IdentityFile /root/.ssh/nixremote
|
||||
# User nixremoteStrictHostKeyChecking accept-new
|
||||
#'';
|
||||
#
|
||||
# Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
|
||||
# from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
|
||||
# then rebuild the build machine.
|
||||
# i.e on the client: run "cat /root.ssh/nixremote.pub"
|
||||
# and copy the output to the build machine's configuration.nix
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -3,9 +3,7 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
|
@ -30,16 +28,17 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
# Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
|
||||
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/bootloader/seabios-assigned-iso-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
# Optionally: ./modules/toolsets/remote_building.nix
|
||||
#
|
||||
#
|
||||
## Compose modules for Portainer service
|
||||
(choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
|
||||
(choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
|
||||
./modules/songsheet/wavelog/docker-compose.nix
|
||||
./modules/secrets-config/sops-composesongsheet.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
|
|
|
|||
|
|
@ -3,9 +3,7 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
|
@ -30,15 +28,14 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix ])
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
(choose [ ./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix ])
|
||||
(choose [ ./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix ])
|
||||
## TODO: Make this more elegant and less risky for unexpected errors happening.
|
||||
] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
|
||||
./modules/desktop-manager/gnome.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/lix-default.nix
|
||||
./modules/secrets-config/sops-database.nix
|
||||
./modules/system_scripts/gcloud_backup.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
local.hostname = "nixosdd";
|
||||
|
|
|
|||
|
|
@ -7,7 +7,6 @@
|
|||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
|
|
@ -33,12 +32,12 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/toolsets/remote_building.nix
|
||||
./modules/bootloader/seabios-assigned-proxmox-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
|
|
|
|||
|
|
@ -3,9 +3,7 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
|
@ -30,15 +28,17 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
# Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/bootloader/seabios-assigned-iso-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
# Optionally: ./modules/toolsets/remote_building.nix
|
||||
#
|
||||
#
|
||||
## Compose modules for Portainer service
|
||||
(choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ])
|
||||
(choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ])
|
||||
./modules/songsheet/wavelog/docker-compose.nix
|
||||
./modules/secrets-config/sops-composesongsheet.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
|
|
|
|||
|
|
@ -3,9 +3,7 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
|
@ -30,12 +28,12 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
# Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ])
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/bootloader/seabios-assigned-iso-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
# Optionally: ./modules/toolsets/remote_building.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
|
|
|
|||
|
|
@ -3,9 +3,7 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths);
|
||||
in {
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
|
@ -30,12 +28,11 @@ in {
|
|||
};
|
||||
|
||||
imports = [
|
||||
(choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ])
|
||||
(choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ])
|
||||
(choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ])
|
||||
(choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ])
|
||||
(choose [ ./modules/lix-default.nix ../lix-default.nix ])
|
||||
(choose [ ./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix ])
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/bootloader/seabios-assigned-iso-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix
|
||||
#./modules/songsheet/wavelog/docker-compose.nix
|
||||
#./modules/secrets-config/sops-the-blank-system.nix
|
||||
|
|
@ -79,19 +76,18 @@ in {
|
|||
# Why 5182(0)? WireGuard server is running on port 51820,
|
||||
# thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion
|
||||
# with other local network services in the future.
|
||||
postSetup = ''
|
||||
postUp = ''
|
||||
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
|
||||
'';
|
||||
|
||||
# Undo the above
|
||||
postShutdown = ''
|
||||
preDown = ''
|
||||
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
|
||||
'';
|
||||
|
||||
privateKeyFile = config.sops.secrets.wireguard_private.path;
|
||||
#presharedKeyFile = config.sops.secrets.wireguard_preshared.path;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,25 +0,0 @@
|
|||
runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq
|
||||
LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3
|
||||
M3l2WXpQVnZjYmtNSEJIWVR5cWlUbEEKLS0tIDNtVHRnRVl5RWdmRmNXYVFRbkNq
|
||||
TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz
|
||||
zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW
|
||||
M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn
|
||||
UXgzNmVhbWh3MytRNXlJdkJ0ak4vQXcKLS0tIGZ1eEU2UjIxcmw1ZnVwTFVZSHMx
|
||||
U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN
|
||||
mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-02-12T17:12:42Z"
|
||||
mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.11.0
|
||||
Loading…
Add table
Add a link
Reference in a new issue