root/the_prg_server_configuration_old
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Created preliminary foundation of testing the nix systems by Flakes.

Browse source
This commit is contained in:
Root User 2026-02-12 15:00:54 +01:00
parent dac2e0b8cf
commit 6a5e8a2dc5
Signed by: root
GPG key ID: 087F0A95E5766D72
12 changed files with 200 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

17
copy_pasta.zsh Normal file
View file

@ -0,0 +1,17 @@
export NIX_CONFIG="experimental-features = nix-command flakes"
echo "=== nix --version ==="
nix --version
echo
echo "=== nix flake show ==="
nix flake show .
echo
echo "=== nix eval (raw toplevel) ==="
nix eval --raw .#nixosConfigurations.nixos-local-wireguard-server.config.system.build.toplevel || true
echo
echo "=== nix build --dry-run ==="
nix build --dry-run .#nixosConfigurations.nixos-local-wireguard-server.config.system.build.toplevel || true

27
flake.lock generated Normal file
View file

@ -0,0 +1,27 @@
{
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1770770419,
"narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs"
}
}
},
"root": "root",
"version": 7
}

50
flake.nix Normal file
View file

@ -0,0 +1,50 @@
{
description = "PRG Server Infrastructure - NixOS Configurations";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
};
outputs = { self, nixpkgs, ... }:
let
system = "x86_64-linux";
in
{
nixosConfigurations = {
"nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/wireguard_server.nix ];
};
"nixos-blank" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix ];
};
"nixos-songsheet" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/compose-songsheet.nix ];
};
"nixos-database" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/database.nix ];
};
"nixos-forgejo" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/forgejo.nix ];
};
"nixos-teamspeak" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/teamspeak.nix ];
};
"nixos-traefik" = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nix-system-configs/modules/system/traefik.nix ];
};
};
};
}

5
nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix
View file

@ -4,7 +4,10 @@
lib, lib,
... ...
}: let }: let
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; home-manager = builtins.fetchTarball {
url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy";
};
cfg = config.services.forgejo; cfg = config.services.forgejo;
srv = cfg.settings.server; srv = cfg.settings.server;
in { in {

54
nix-system-configs/modules/secrets-config/sops-wireguard.nix Normal file
View file

@ -0,0 +1,54 @@
{
config,
pkgs,
lib,
...
}: {
imports = let
# replace this with an actual commit id or tag
commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
in [
"${builtins.fetchTarball {
url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
# replace this with an actual hash
sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
}}/modules/sops"
];
# This will add secrets.yml to the nix store
# You can avoid this by adding a string to the full path instead, i.e.
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml;
# This will automatically import SSH keys as age keys
#sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
# This is using an age key that is expected to already be in the filesystem
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# This will generate a new key if the key specified above does not exist
sops.age.generateKey = true;
# Export individual WireGuard keys from the SOPS YAML as text secrets so they
# are available both as strings and as files (.path)
sops.secrets."wireguard_private" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0400";
};
sops.secrets."wireguard_preshared" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0400";
};
sops.secrets."wireguard_public" = {
format = "yaml";
sopsFile = ../../secrets/wireguard/secrets.yaml;
owner = "root";
mode = "0444";
};
}

10
nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix
View file

@ -28,11 +28,11 @@
}; };
imports = [ imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix ../lix-default.nix
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
#./modules/songsheet/wavelog/docker-compose.nix #./modules/songsheet/wavelog/docker-compose.nix
#./modules/secrets-config/sops-the-blank-system.nix #./modules/secrets-config/sops-the-blank-system.nix

19
nix-system-configs/modules/system/compose-songsheet.nix
View file

@ -28,17 +28,16 @@
}; };
imports = [ imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix ../lix-default.nix
# Optionally: ./modules/toolsets/remote_building.nix # Optionally: ../toolsets/remote_building.nix
#
#
## Compose modules for Portainer service ## Compose modules for Portainer service
./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix
./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix
]; ];
config = { config = {

13
nix-system-configs/modules/system/database.nix
View file

@ -28,12 +28,13 @@
}; };
imports = [ imports = [
./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/lix-default.nix ../bootloader/seabios-assigned-iso-at-birth.nix
./modules/secrets-config/sops-database.nix ../lix-default.nix
./modules/system_scripts/gcloud_backup.nix ../secrets-config/sops-database.nix
../system_scripts/gcloud_backup.nix
./hardware-configuration.nix ./hardware-configuration.nix
]; ];

12
nix-system-configs/modules/system/forgejo.nix
View file

@ -32,12 +32,12 @@ in {
}; };
imports = [ imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix
./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix
./modules/lix-default.nix ../lix-default.nix
]; ];
config = { config = {

16
nix-system-configs/modules/system/teamspeak.nix
View file

@ -28,17 +28,15 @@
}; };
imports = [ imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix ../lix-default.nix
# Optionally: ./modules/toolsets/remote_building.nix # Optionally: ./modules/toolsets/remote_building.nix
#
#
## Compose modules for Portainer service ## Compose modules for Portainer service
./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix
./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix
]; ];
config = { config = {

10
nix-system-configs/modules/system/traefik.nix
View file

@ -28,11 +28,11 @@
}; };
imports = [ imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix ../lix-default.nix
# Optionally: ./modules/toolsets/remote_building.nix # Optionally: ./modules/toolsets/remote_building.nix
]; ];

16
nix-system-configs/modules/system/wireguard_server.nix
View file

@ -28,11 +28,12 @@
}; };
imports = [ imports = [
./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix
./modules/local/hostname_username.nix ../local/hostname_username.nix
./modules/local/networking_local.nix ../local/networking_local.nix
./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix
./modules/lix-default.nix ../lix-default.nix
../secrets-config/sops-wireguard.nix
# Optionally to enable remote building: ./modules/toolsets/remote_building.nix # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
#./modules/songsheet/wavelog/docker-compose.nix #./modules/songsheet/wavelog/docker-compose.nix
#./modules/secrets-config/sops-the-blank-system.nix #./modules/secrets-config/sops-the-blank-system.nix
@ -76,18 +77,19 @@
# Why 5182(0)? WireGuard server is running on port 51820, # Why 5182(0)? WireGuard server is running on port 51820,
# thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion # thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion
# with other local network services in the future. # with other local network services in the future.
postUp = '' postSetup = ''
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
''; '';
# Undo the above # Undo the above
preDown = '' postShutdown = ''
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
''; '';
privateKeyFile = config.sops.secrets.wireguard_private.path; privateKeyFile = config.sops.secrets.wireguard_private.path;
#presharedKeyFile = config.sops.secrets.wireguard_preshared.path;
}; };
}; };