root/the_prg_server_configuration_old
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Created preliminary foundation of testing the nix systems by Flakes.

Browse source
This commit is contained in:
Root User 2026-02-12 15:00:54 +01:00
parent dac2e0b8cf
commit 6a5e8a2dc5
Signed by: root
GPG key ID: 087F0A95E5766D72
12 changed files with 200 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix
View file

@ -4,7 +4,10 @@
lib,
...
}: let
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
home-manager = builtins.fetchTarball {
url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy";
};
cfg = config.services.forgejo;
srv = cfg.settings.server;
in {

54
nix-system-configs/modules/secrets-config/sops-wireguard.nix Normal file
View file

@ -0,0 +1,54 @@
{
config,
pkgs,
lib,
...
}: {
imports = let
# replace this with an actual commit id or tag
commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
in [
"${builtins.fetchTarball {
url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
# replace this with an actual hash
sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
}}/modules/sops"
];
# This will add secrets.yml to the nix store
# You can avoid this by adding a string to the full path instead, i.e.
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml;
# This will automatically import SSH keys as age keys
#sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
# This is using an age key that is expected to already be in the filesystem
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# This will generate a new key if the key specified above does not exist
sops.age.generateKey = true;
# Export individual WireGuard keys from the SOPS YAML as text secrets so they
# are available both as strings and as files (.path)
sops.secrets."wireguard_private" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0400";
};
sops.secrets."wireguard_preshared" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0400";
};
sops.secrets."wireguard_public" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0444";
};
}

10
nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix
View file

@ -28,11 +28,11 @@
};
imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix
../desktop-manager/sway_greetd_homemanager.nix
../local/hostname_username.nix
../local/networking_local.nix
../bootloader/seabios-assigned-iso-at-birth.nix
../lix-default.nix
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix
#./modules/songsheet/wavelog/docker-compose.nix
#./modules/secrets-config/sops-the-blank-system.nix

19
nix-system-configs/modules/system/compose-songsheet.nix
View file

@ -28,17 +28,16 @@
};
imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix
# Optionally: ./modules/toolsets/remote_building.nix
#
#
../desktop-manager/sway_greetd_homemanager.nix
../local/hostname_username.nix
../local/networking_local.nix
../bootloader/seabios-assigned-iso-at-birth.nix
../lix-default.nix
# Optionally: ../toolsets/remote_building.nix
## Compose modules for Portainer service
./modules/songsheet/wavelog/docker-compose.nix
./modules/secrets-config/sops-composesongsheet.nix
../songsheet/wavelog/docker-compose.nix
../secrets-config/sops-composesongsheet.nix
];
config = {

13
nix-system-configs/modules/system/database.nix
View file

@ -28,12 +28,13 @@
};
imports = [
./modules/desktop-manager/gnome.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/lix-default.nix
./modules/secrets-config/sops-database.nix
./modules/system_scripts/gcloud_backup.nix
../desktop-manager/gnome.nix
../local/hostname_username.nix
../local/networking_local.nix
../bootloader/seabios-assigned-iso-at-birth.nix
../lix-default.nix
../secrets-config/sops-database.nix
../system_scripts/gcloud_backup.nix
./hardware-configuration.nix
];

12
nix-system-configs/modules/system/forgejo.nix
View file

@ -32,12 +32,12 @@ in {
};
imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/toolsets/remote_building.nix
./modules/bootloader/seabios-assigned-proxmox-at-birth.nix
./modules/lix-default.nix
../desktop-manager/sway_greetd_homemanager.nix
../local/hostname_username.nix
../local/networking_local.nix
../toolsets/remote_building.nix
../bootloader/seabios-assigned-proxmox-at-birth.nix
../lix-default.nix
];
config = {

16
nix-system-configs/modules/system/teamspeak.nix
View file

@ -28,17 +28,15 @@
};
imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix
../desktop-manager/sway_greetd_homemanager.nix
../local/hostname_username.nix
../local/networking_local.nix
../bootloader/seabios-assigned-iso-at-birth.nix
../lix-default.nix
# Optionally: ./modules/toolsets/remote_building.nix
#
#
## Compose modules for Portainer service
./modules/songsheet/wavelog/docker-compose.nix
./modules/secrets-config/sops-composesongsheet.nix
../songsheet/wavelog/docker-compose.nix
../secrets-config/sops-composesongsheet.nix
];
config = {

10
nix-system-configs/modules/system/traefik.nix
View file

@ -28,11 +28,11 @@
};
imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix
../desktop-manager/sway_greetd_homemanager.nix
../local/hostname_username.nix
../local/networking_local.nix
../bootloader/seabios-assigned-iso-at-birth.nix
../lix-default.nix
# Optionally: ./modules/toolsets/remote_building.nix
];

16
nix-system-configs/modules/system/wireguard_server.nix
View file

@ -28,11 +28,12 @@
};
imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix
./modules/local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix
../desktop-manager/sway_greetd_homemanager.nix
../local/hostname_username.nix
../local/networking_local.nix
../bootloader/seabios-assigned-iso-at-birth.nix
../lix-default.nix
../secrets-config/sops-wireguard.nix
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix
#./modules/songsheet/wavelog/docker-compose.nix
#./modules/secrets-config/sops-the-blank-system.nix
@ -76,18 +77,19 @@
# Why 5182(0)? WireGuard server is running on port 51820,
# thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion
# with other local network services in the future.
postUp = ''
postSetup = ''
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
'';
# Undo the above
preDown = ''
postShutdown = ''
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
'';
privateKeyFile = config.sops.secrets.wireguard_private.path;
#presharedKeyFile = config.sops.secrets.wireguard_preshared.path;
};
};