feat(inventory): declaration of nixin machine wip
This commit is contained in:
Florian Schmitt
parent
9a04ca03a3
commit
30384e6485
1 changed files with 185 additions and 0 deletions
185
inventory/nixin.nix
Normal file
185
inventory/nixin.nix
Normal file
|
|
@ -0,0 +1,185 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
|
||||||
|
{
|
||||||
|
networking.hosts = {
|
||||||
|
"127.0.0.1" = [ "nixin.chmok.net" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.hostName = "nixin";
|
||||||
|
networking.domain = "chmok.net";
|
||||||
|
networking.firewall = {
|
||||||
|
allowedUDPPorts = [
|
||||||
|
53 # forgejo
|
||||||
|
8098 # wireguard
|
||||||
|
];
|
||||||
|
allowedTCPPorts = [
|
||||||
|
22 # ssh
|
||||||
|
80 # http
|
||||||
|
443 # https
|
||||||
|
];
|
||||||
|
};
|
||||||
|
networking.nameservers = [
|
||||||
|
"80.67.169.12"
|
||||||
|
"2001:910:800::12"
|
||||||
|
"80.67.169.40"
|
||||||
|
"2001:910:800::40"
|
||||||
|
];
|
||||||
|
networking.wg-quick.interfaces = {
|
||||||
|
wg0 = {
|
||||||
|
address = [ "10.42.0.9/32" ];
|
||||||
|
privateKey = "2M0w52jHmX5AgPw4V7Kq1hoZaEWa7H6NBoPfy/RbanQ=";
|
||||||
|
peers = [
|
||||||
|
{
|
||||||
|
publicKey = "2MZzEGJzA3HrwkHf91TaKJEHwCNyVvsTLWoIYHrCxhY=";
|
||||||
|
presharedKey = "DjbQfcvrc1cfk0nQNGqak4QZr46MW9WEovNK170mg+A=";
|
||||||
|
allowedIPs = [ "10.42.0.0/24" ];
|
||||||
|
endpoint = "195.201.63.240:8098";
|
||||||
|
persistentKeepalive = 15;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
time.timeZone = "UTC";
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
|
||||||
|
users.users.operator = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" ];
|
||||||
|
initialPassword = "CHANGE ME !!!";
|
||||||
|
};
|
||||||
|
|
||||||
|
security.sudo.extraRules = [
|
||||||
|
{
|
||||||
|
users = [ "operator" ];
|
||||||
|
commands = [
|
||||||
|
{
|
||||||
|
command = "ALL";
|
||||||
|
options = [ "NOPASSWD" ]; # "SETENV" # Adding the following could be a good idea
|
||||||
|
}
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
services.forgejo = {
|
||||||
|
enable = true;
|
||||||
|
database.type = "postgres";
|
||||||
|
# Enable support for Git Large File Storage
|
||||||
|
lfs.enable = true;
|
||||||
|
settings = {
|
||||||
|
server = {
|
||||||
|
DOMAIN = "forge.chmok.net";
|
||||||
|
# You need to specify this to remove the port from URLs in the web UI.
|
||||||
|
ROOT_URL = "https://forge.chmok.net/";
|
||||||
|
HTTP_PORT = 3000;
|
||||||
|
};
|
||||||
|
# You can temporarily allow registration to create an admin user.
|
||||||
|
service.DISABLE_REGISTRATION = true;
|
||||||
|
# Add support for actions, based on act: https://github.com/nektos/act
|
||||||
|
actions = {
|
||||||
|
ENABLED = true;
|
||||||
|
DEFAULT_ACTIONS_URL = "github";
|
||||||
|
};
|
||||||
|
# Sending emails is completely optional
|
||||||
|
# You can send a test email from the web UI at:
|
||||||
|
# Profile Picture > Site Administration > Configuration > Mailer Configuration
|
||||||
|
mailer = {
|
||||||
|
ENABLED = true;
|
||||||
|
SMTP_ADDR = "mail.chmok.net";
|
||||||
|
FROM = "noreply@${config.services.forgejo.settings.server.DOMAIN}";
|
||||||
|
USER = "noreply@${config.services.forgejo.settings.server.DOMAIN}";
|
||||||
|
PASSWD = "CHANGE ME !!!";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.containers.enable = true;
|
||||||
|
virtualisation.podman = {
|
||||||
|
enable = true;
|
||||||
|
# Create a `docker` alias for podman, to use it as a drop-in replacement
|
||||||
|
dockerCompat = true;
|
||||||
|
# Required for containers under podman-compose to be able to talk to each other.
|
||||||
|
defaultNetwork.settings.dns_enabled = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.gitea-actions-runner = {
|
||||||
|
package = pkgs.forgejo-runner;
|
||||||
|
instances.default = {
|
||||||
|
enable = true;
|
||||||
|
name = "nixinrunner";
|
||||||
|
url = "https://forge.chmok.net";
|
||||||
|
token = "S3uBKr4HsnxILAVA40ikLCNdAdKYxqcIGoqH1ihA";
|
||||||
|
labels = [
|
||||||
|
# provide a debian base with nodejs for actions
|
||||||
|
"debian-latest:docker://node:20-bookworm"
|
||||||
|
# fake the ubuntu name, because node provides no ubuntu builds
|
||||||
|
"ubuntu-latest:docker://node:20-bookworm"
|
||||||
|
# nixos
|
||||||
|
"nixos:docker://nixos/nix:latest"
|
||||||
|
# provide native execution on the host
|
||||||
|
#"native:host"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.openssh.enable = true;
|
||||||
|
services.openssh.ports = [ 22 ];
|
||||||
|
services.openssh.settings = {
|
||||||
|
PermitRootLogin = "no";
|
||||||
|
PasswordAuthentication = false;
|
||||||
|
KbdInteractiveAuthentication = false;
|
||||||
|
};
|
||||||
|
security.acme.defaults.email = "contact@nixin.local";
|
||||||
|
security.acme.acceptTerms = true;
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
# Use recommended settings
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
|
||||||
|
# Only allow PFS-enabled ciphers with AES256
|
||||||
|
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
||||||
|
|
||||||
|
virtualHosts."forge.chmok.net" = {
|
||||||
|
extraConfig = ''
|
||||||
|
client_max_body_size 512M;
|
||||||
|
'';
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/".proxyPass =
|
||||||
|
"http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.forgejo.preStart =
|
||||||
|
let
|
||||||
|
adminCmd = "${lib.getExe config.services.forgejo.package} admin user";
|
||||||
|
pwd = "CHANGE ME !!!";
|
||||||
|
user = "operator";
|
||||||
|
mail = "root@forge.chmok.net";
|
||||||
|
in
|
||||||
|
''
|
||||||
|
${adminCmd} create --admin --email "${mail}" --username ${user} --password "${pwd}" || true
|
||||||
|
## uncomment this line to change an admin user which was already created
|
||||||
|
# ${adminCmd} change-password --username ${user} --password "${pwd}" || true
|
||||||
|
'';
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
git
|
||||||
|
wget
|
||||||
|
tmux
|
||||||
|
mosh
|
||||||
|
htop
|
||||||
|
];
|
||||||
|
|
||||||
|
system.stateVersion = "24.05";
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue