Server, deploy-rs
This commit is contained in:
parent
8468556385
commit
df711fbbe6
13 changed files with 828 additions and 39 deletions
4
checks/deploy/default.nix
Normal file
4
checks/deploy/default.nix
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
{inputs}:
|
||||||
|
builtins.mapAttrs
|
||||||
|
(system: deploy-lib: deploy-lib.deployChecks inputs.self.deploy)
|
||||||
|
inputs.deploy-rs.lib
|
||||||
11
checks/fmt/default.nix
Normal file
11
checks/fmt/default.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
{
|
||||||
|
inputs,
|
||||||
|
system,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
inputs.pre-commit-hooks.lib.${system}.run {
|
||||||
|
src = ../..;
|
||||||
|
hooks = {
|
||||||
|
alejandra.enable = true;
|
||||||
|
};
|
||||||
|
}
|
||||||
196
flake.lock
generated
196
flake.lock
generated
|
|
@ -309,6 +309,28 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"deploy-rs": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-compat": "flake-compat_5",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
],
|
||||||
|
"utils": "utils"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1749105467,
|
||||||
|
"narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
|
||||||
|
"owner": "serokell",
|
||||||
|
"repo": "deploy-rs",
|
||||||
|
"rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "serokell",
|
||||||
|
"repo": "deploy-rs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"devenv": {
|
"devenv": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"cachix": "cachix_2",
|
"cachix": "cachix_2",
|
||||||
|
|
@ -464,6 +486,38 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"flake-compat_10": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1650374568,
|
||||||
|
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-compat_11": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1747046372,
|
||||||
|
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"flake-compat_2": {
|
"flake-compat_2": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -516,11 +570,11 @@
|
||||||
"flake-compat_5": {
|
"flake-compat_5": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1747046372,
|
"lastModified": 1733328505,
|
||||||
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
|
"narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
|
||||||
"owner": "edolstra",
|
"owner": "edolstra",
|
||||||
"repo": "flake-compat",
|
"repo": "flake-compat",
|
||||||
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
|
"rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -548,37 +602,20 @@
|
||||||
"flake-compat_7": {
|
"flake-compat_7": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1696426674,
|
"lastModified": 1747046372,
|
||||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
|
||||||
"owner": "edolstra",
|
"owner": "edolstra",
|
||||||
"repo": "flake-compat",
|
"repo": "flake-compat",
|
||||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "edolstra",
|
"owner": "edolstra",
|
||||||
"ref": "v1.0.1",
|
|
||||||
"repo": "flake-compat",
|
"repo": "flake-compat",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-compat_8": {
|
"flake-compat_8": {
|
||||||
"flake": false,
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1650374568,
|
|
||||||
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
|
|
||||||
"owner": "edolstra",
|
|
||||||
"repo": "flake-compat",
|
|
||||||
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "edolstra",
|
|
||||||
"repo": "flake-compat",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-compat_9": {
|
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1747046372,
|
"lastModified": 1747046372,
|
||||||
|
|
@ -594,6 +631,23 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"flake-compat_9": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1696426674,
|
||||||
|
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "edolstra",
|
||||||
|
"ref": "v1.0.1",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"flake-parts": {
|
"flake-parts": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs-lib": [
|
"nixpkgs-lib": [
|
||||||
|
|
@ -790,7 +844,7 @@
|
||||||
},
|
},
|
||||||
"flake-utils_2": {
|
"flake-utils_2": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems_2"
|
"systems": "systems_3"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1731533236,
|
"lastModified": 1731533236,
|
||||||
|
|
@ -823,7 +877,7 @@
|
||||||
},
|
},
|
||||||
"flake-utils_4": {
|
"flake-utils_4": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems_4"
|
"systems": "systems_5"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1694529238,
|
"lastModified": 1694529238,
|
||||||
|
|
@ -928,6 +982,27 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"gitignore_3": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"pre-commit-hooks",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1709087332,
|
||||||
|
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "gitignore.nix",
|
||||||
|
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "gitignore.nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"gnome-shell": {
|
"gnome-shell": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -1027,7 +1102,7 @@
|
||||||
"lanzaboote": {
|
"lanzaboote": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"crane": "crane_3",
|
"crane": "crane_3",
|
||||||
"flake-compat": "flake-compat_5",
|
"flake-compat": "flake-compat_6",
|
||||||
"flake-parts": "flake-parts_3",
|
"flake-parts": "flake-parts_3",
|
||||||
"nixpkgs": "nixpkgs_9",
|
"nixpkgs": "nixpkgs_9",
|
||||||
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
|
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
|
||||||
|
|
@ -1474,7 +1549,7 @@
|
||||||
},
|
},
|
||||||
"nixos-wsl": {
|
"nixos-wsl": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_6",
|
"flake-compat": "flake-compat_7",
|
||||||
"nixpkgs": "nixpkgs_13"
|
"nixpkgs": "nixpkgs_13"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -2049,7 +2124,7 @@
|
||||||
"plugin-vim-repeat": "plugin-vim-repeat",
|
"plugin-vim-repeat": "plugin-vim-repeat",
|
||||||
"plugin-vim-startify": "plugin-vim-startify",
|
"plugin-vim-startify": "plugin-vim-startify",
|
||||||
"plugin-which-key": "plugin-which-key",
|
"plugin-which-key": "plugin-which-key",
|
||||||
"systems": "systems_3"
|
"systems": "systems_4"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736795850,
|
"lastModified": 1736795850,
|
||||||
|
|
@ -4019,6 +4094,28 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"pre-commit-hooks": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-compat": "flake-compat_8",
|
||||||
|
"gitignore": "gitignore_3",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1754416808,
|
||||||
|
"narHash": "sha256-c6yg0EQ9xVESx6HGDOCMcyRSjaTpNJP10ef+6fRcofA=",
|
||||||
|
"owner": "cachix",
|
||||||
|
"repo": "git-hooks.nix",
|
||||||
|
"rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "cachix",
|
||||||
|
"repo": "git-hooks.nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"pre-commit-hooks-nix": {
|
"pre-commit-hooks-nix": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": [
|
"flake-compat": [
|
||||||
|
|
@ -4068,6 +4165,7 @@
|
||||||
"beeengine": "beeengine",
|
"beeengine": "beeengine",
|
||||||
"chaotic": "chaotic",
|
"chaotic": "chaotic",
|
||||||
"conduwuit": "conduwuit",
|
"conduwuit": "conduwuit",
|
||||||
|
"deploy-rs": "deploy-rs",
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
"emacs-kylekrein": "emacs-kylekrein",
|
"emacs-kylekrein": "emacs-kylekrein",
|
||||||
"home-manager": "home-manager_2",
|
"home-manager": "home-manager_2",
|
||||||
|
|
@ -4084,6 +4182,7 @@
|
||||||
"nixos-hardware": "nixos-hardware",
|
"nixos-hardware": "nixos-hardware",
|
||||||
"nixos-wsl": "nixos-wsl",
|
"nixos-wsl": "nixos-wsl",
|
||||||
"nixpkgs": "nixpkgs_14",
|
"nixpkgs": "nixpkgs_14",
|
||||||
|
"pre-commit-hooks": "pre-commit-hooks",
|
||||||
"snowfall-flake": "snowfall-flake",
|
"snowfall-flake": "snowfall-flake",
|
||||||
"snowfall-lib": "snowfall-lib_2",
|
"snowfall-lib": "snowfall-lib_2",
|
||||||
"sops-nix": "sops-nix",
|
"sops-nix": "sops-nix",
|
||||||
|
|
@ -4191,7 +4290,7 @@
|
||||||
},
|
},
|
||||||
"snowfall-flake": {
|
"snowfall-flake": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_7",
|
"flake-compat": "flake-compat_9",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
|
|
@ -4213,7 +4312,7 @@
|
||||||
},
|
},
|
||||||
"snowfall-lib": {
|
"snowfall-lib": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_8",
|
"flake-compat": "flake-compat_10",
|
||||||
"flake-utils-plus": "flake-utils-plus",
|
"flake-utils-plus": "flake-utils-plus",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"snowfall-flake",
|
"snowfall-flake",
|
||||||
|
|
@ -4237,7 +4336,7 @@
|
||||||
},
|
},
|
||||||
"snowfall-lib_2": {
|
"snowfall-lib_2": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_9",
|
"flake-compat": "flake-compat_11",
|
||||||
"flake-utils-plus": "flake-utils-plus_2",
|
"flake-utils-plus": "flake-utils-plus_2",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
|
|
@ -4286,7 +4385,7 @@
|
||||||
"gnome-shell": "gnome-shell",
|
"gnome-shell": "gnome-shell",
|
||||||
"nixpkgs": "nixpkgs_16",
|
"nixpkgs": "nixpkgs_16",
|
||||||
"nur": "nur",
|
"nur": "nur",
|
||||||
"systems": "systems_5",
|
"systems": "systems_6",
|
||||||
"tinted-foot": "tinted-foot",
|
"tinted-foot": "tinted-foot",
|
||||||
"tinted-kitty": "tinted-kitty",
|
"tinted-kitty": "tinted-kitty",
|
||||||
"tinted-schemes": "tinted-schemes",
|
"tinted-schemes": "tinted-schemes",
|
||||||
|
|
@ -4383,6 +4482,21 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"systems_6": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1681028828,
|
||||||
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"tinted-foot": {
|
"tinted-foot": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -4523,6 +4637,24 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"utils": {
|
||||||
|
"inputs": {
|
||||||
|
"systems": "systems_2"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1731533236,
|
||||||
|
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"xwayland-satellite-stable": {
|
"xwayland-satellite-stable": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
|
||||||
17
flake.nix
17
flake.nix
|
|
@ -80,6 +80,14 @@
|
||||||
url = "github:snowfallorg/flake";
|
url = "github:snowfallorg/flake";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
deploy-rs = {
|
||||||
|
url = "github:serokell/deploy-rs";
|
||||||
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
|
pre-commit-hooks = {
|
||||||
|
url = "github:cachix/git-hooks.nix";
|
||||||
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = inputs:
|
outputs = inputs:
|
||||||
|
|
@ -121,6 +129,15 @@
|
||||||
|
|
||||||
templates = import ./templates {};
|
templates = import ./templates {};
|
||||||
|
|
||||||
|
deploy.nodes.server = {
|
||||||
|
hostname = "kylekrein.com";
|
||||||
|
interactiveSudo = false;
|
||||||
|
profiles.system = {
|
||||||
|
user = "kylekrein";
|
||||||
|
path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos inputs.self.nixosConfigurations.kylekrein-server;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
outputs-builder = channels: {
|
outputs-builder = channels: {
|
||||||
formatter = channels.nixpkgs.alejandra;
|
formatter = channels.nixpkgs.alejandra;
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -17,25 +17,30 @@ in
|
||||||
enable = true;
|
enable = true;
|
||||||
firstNixOSInstall = 1729112485;
|
firstNixOSInstall = 1729112485;
|
||||||
};
|
};
|
||||||
librewolf = enabled;
|
librewolf.enable = osConfig.custom.presets.wayland.enable;
|
||||||
prismlauncher.enable = osConfig.custom.presets.gaming.enable;
|
prismlauncher.enable = osConfig.custom.presets.gaming.enable;
|
||||||
bottles = enabled;
|
bottles.enable = osConfig.custom.presets.wayland.enable;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
home = {
|
home = {
|
||||||
packages = with pkgs;
|
packages = with pkgs;
|
||||||
[
|
[
|
||||||
|
neovim
|
||||||
|
]
|
||||||
|
++ lib.optionals osConfig.custom.presets.wayland.enable [
|
||||||
gdb
|
gdb
|
||||||
element-desktop
|
element-desktop
|
||||||
obs-studio
|
obs-studio
|
||||||
neovim
|
|
||||||
localsend
|
localsend
|
||||||
kdePackages.kdenlive
|
kdePackages.kdenlive
|
||||||
]
|
]
|
||||||
++ lib.optionals osConfig.custom.presets.gaming.enable [mcpelauncher-ui-qt];
|
++ lib.optionals osConfig.custom.presets.gaming.enable [mcpelauncher-ui-qt];
|
||||||
|
|
||||||
sessionVariables = {
|
sessionVariables = {
|
||||||
EDITOR = "emacsclient -c";
|
EDITOR =
|
||||||
|
if osConfig.custom.presets.wayland.enable
|
||||||
|
then "emacsclient -c"
|
||||||
|
else "nvim";
|
||||||
NH_OS_FLAKE = "${home}/nixos-config";
|
NH_OS_FLAKE = "${home}/nixos-config";
|
||||||
NH_HOME_FLAKE = "${home}/nixos-config";
|
NH_HOME_FLAKE = "${home}/nixos-config";
|
||||||
NH_DARWIN_FLAKE = "${home}/nixos-config";
|
NH_DARWIN_FLAKE = "${home}/nixos-config";
|
||||||
|
|
|
||||||
|
|
@ -2,15 +2,18 @@
|
||||||
pkgs,
|
pkgs,
|
||||||
system,
|
system,
|
||||||
inputs,
|
inputs,
|
||||||
|
osConfig,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
...
|
...
|
||||||
}: let
|
}: let
|
||||||
emacs = inputs.emacs-kylekrein.packages.${system}.with-lsps-native;
|
emacs = inputs.emacs-kylekrein.packages.${system}.with-lsps-native;
|
||||||
in {
|
in {
|
||||||
programs.emacs = {
|
programs.emacs = {
|
||||||
enable = true;
|
enable = osConfig.custom.presets.wayland.enable;
|
||||||
package = emacs;
|
package = emacs;
|
||||||
};
|
};
|
||||||
systemd.user.services.emacs = {
|
systemd.user.services.emacs = lib.mkIf config.programs.emacs.enable {
|
||||||
Unit = {
|
Unit = {
|
||||||
Description = "Launches (and relaunches) emacs";
|
Description = "Launches (and relaunches) emacs";
|
||||||
};
|
};
|
||||||
|
|
|
||||||
378
modules/nixos/services/conduwuit/default.nix
Normal file
378
modules/nixos/services/conduwuit/default.nix
Normal file
|
|
@ -0,0 +1,378 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
namespace,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
cfg = config.${namespace}.services.conduwuit;
|
||||||
|
defaultUser = "conduwuit";
|
||||||
|
defaultGroup = "conduwuit";
|
||||||
|
|
||||||
|
format = pkgs.formats.toml {};
|
||||||
|
configFile = format.generate "conduwuit.toml" cfg.settings;
|
||||||
|
in {
|
||||||
|
meta.maintainers = with lib.maintainers; [niklaskorz];
|
||||||
|
options.${namespace}.services.conduwuit = {
|
||||||
|
enable = lib.mkEnableOption "conduwuit";
|
||||||
|
|
||||||
|
user = lib.mkOption {
|
||||||
|
type = lib.types.nonEmptyStr;
|
||||||
|
description = ''
|
||||||
|
The user {command}`conduwuit` is run as.
|
||||||
|
'';
|
||||||
|
default = defaultUser;
|
||||||
|
};
|
||||||
|
|
||||||
|
group = lib.mkOption {
|
||||||
|
type = lib.types.nonEmptyStr;
|
||||||
|
description = ''
|
||||||
|
The group {command}`conduwuit` is run as.
|
||||||
|
'';
|
||||||
|
default = defaultGroup;
|
||||||
|
};
|
||||||
|
|
||||||
|
extraEnvironment = lib.mkOption {
|
||||||
|
type = lib.types.attrsOf lib.types.str;
|
||||||
|
description = "Extra Environment variables to pass to the conduwuit server.";
|
||||||
|
default = {};
|
||||||
|
example = {
|
||||||
|
RUST_BACKTRACE = "yes";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
package = lib.mkPackageOption pkgs "conduwuit" {};
|
||||||
|
|
||||||
|
settings = lib.mkOption {
|
||||||
|
type = lib.types.submodule {
|
||||||
|
freeformType = format.type;
|
||||||
|
options = {
|
||||||
|
global.server_name = lib.mkOption {
|
||||||
|
type = lib.types.nonEmptyStr;
|
||||||
|
example = "example.com";
|
||||||
|
description = "The server_name is the name of this server. It is used as a suffix for user and room ids.";
|
||||||
|
};
|
||||||
|
global.address = lib.mkOption {
|
||||||
|
type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr);
|
||||||
|
default = null;
|
||||||
|
example = [
|
||||||
|
"127.0.0.1"
|
||||||
|
"::1"
|
||||||
|
];
|
||||||
|
description = ''
|
||||||
|
Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
|
||||||
|
If set to `null`, conduwuit will listen on IPv4 and IPv6 localhost.
|
||||||
|
Must be `null` if `unix_socket_path` is set.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.port = lib.mkOption {
|
||||||
|
type = lib.types.listOf lib.types.port;
|
||||||
|
default = [6167];
|
||||||
|
description = ''
|
||||||
|
The port(s) conduwuit will be running on.
|
||||||
|
You need to set up a reverse proxy in your web server (e.g. apache or nginx),
|
||||||
|
so all requests to /_matrix on port 443 and 8448 will be forwarded to the conduwuit
|
||||||
|
instance running on this port.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.unix_socket_path = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
Listen on a UNIX socket at the specified path. If listening on a UNIX socket,
|
||||||
|
listening on an address will be disabled. The `address` option must be set to
|
||||||
|
`null` (the default value). The option {option}`services.conduwuit.group` must
|
||||||
|
be set to a group your reverse proxy is part of.
|
||||||
|
|
||||||
|
This will automatically add a system user "conduwuit" to your system if
|
||||||
|
{option}`services.conduwuit.user` is left at the default, and a "conduwuit"
|
||||||
|
group if {option}`services.conduwuit.group` is left at the default.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.unix_socket_perms = lib.mkOption {
|
||||||
|
type = lib.types.ints.positive;
|
||||||
|
default = 660;
|
||||||
|
description = "The default permissions (in octal) to create the UNIX socket with.";
|
||||||
|
};
|
||||||
|
global.max_request_size = lib.mkOption {
|
||||||
|
type = lib.types.ints.positive;
|
||||||
|
default = 20000000;
|
||||||
|
description = "Max request size in bytes. Don't forget to also change it in the proxy.";
|
||||||
|
};
|
||||||
|
global.allow_registration = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
Whether new users can register on this server.
|
||||||
|
|
||||||
|
Registration with token requires `registration_token` or `registration_token_file` to be set.
|
||||||
|
|
||||||
|
If set to true without a token configured, and
|
||||||
|
`yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
|
||||||
|
is set to true, users can freely register.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_encryption = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = true;
|
||||||
|
description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
|
||||||
|
};
|
||||||
|
global.allow_federation = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = true;
|
||||||
|
description = ''
|
||||||
|
Whether this server federates with other servers.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.trusted_servers = lib.mkOption {
|
||||||
|
type = lib.types.listOf lib.types.nonEmptyStr;
|
||||||
|
default = ["matrix.org"];
|
||||||
|
description = ''
|
||||||
|
Servers listed here will be used to gather public keys of other servers
|
||||||
|
(notary trusted key servers).
|
||||||
|
|
||||||
|
Currently, conduwuit doesn't support inbound batched key requests, so
|
||||||
|
this list should only contain other Synapse servers.
|
||||||
|
|
||||||
|
Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]`
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.database_path = lib.mkOption {
|
||||||
|
readOnly = true;
|
||||||
|
type = lib.types.path;
|
||||||
|
default = "/var/lib/conduwuit/";
|
||||||
|
description = ''
|
||||||
|
Path to the conduwuit database, the directory where conduwuit will save its data.
|
||||||
|
Note that database_path cannot be edited because of the service's reliance on systemd StateDir.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.database_backup_path = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
Path to the conduwuit database, the directory where conduwuit will backup its data.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.database_backups_to_keep = lib.mkOption {
|
||||||
|
type = lib.types.ints.positive;
|
||||||
|
default = 1;
|
||||||
|
description = "";
|
||||||
|
};
|
||||||
|
global.allow_check_for_updates = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
If enabled, conduwuit will send a simple GET request periodically to
|
||||||
|
<https://pupbrain.dev/check-for-updates/stable> for any new announcements made.
|
||||||
|
Despite the name, this is not an update check endpoint, it is simply an announcement check endpoint.
|
||||||
|
|
||||||
|
Disabled by default.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_local_presence = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = true;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_incoming_presence = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = true;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_outgoing_presence = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.require_auth_for_profile_requests = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.new_user_displayname_suffix = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "🏳️⚧️";
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.registration_token = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "";
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.registration_token_file = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_public_room_directory_over_federation = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_public_room_directory_without_auth = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_device_name_federation = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.allow_inbound_profile_lookup_federation_requests = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = true;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.turn_secret = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.str;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.turn_uris = lib.mkOption {
|
||||||
|
type = lib.types.listOf lib.types.nonEmptyStr;
|
||||||
|
default = [];
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.turn_secret_file = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.prevent_media_downloads_from = lib.mkOption {
|
||||||
|
type = lib.types.listOf lib.types.nonEmptyStr;
|
||||||
|
default = [];
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.well_known.client = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "";
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
global.well_known.server = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "";
|
||||||
|
description = ''
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
default = {};
|
||||||
|
# TOML does not allow null values, so we use null to omit those fields
|
||||||
|
apply = lib.filterAttrsRecursive (_: v: v != null);
|
||||||
|
description = ''
|
||||||
|
Generates the conduwuit.toml configuration file. Refer to
|
||||||
|
<https://conduwuit.puppyirl.gay/configuration.html>
|
||||||
|
for details on supported values.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
assertions = [
|
||||||
|
{
|
||||||
|
assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);
|
||||||
|
message = ''
|
||||||
|
In `services.conduwuit.settings.global`, `unix_socket_path` and `address` cannot be set at the
|
||||||
|
same time.
|
||||||
|
Leave one of the two options unset or explicitly set them to `null`.
|
||||||
|
'';
|
||||||
|
}
|
||||||
|
{
|
||||||
|
assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user};
|
||||||
|
message = "If `services.conduwuit.user` is changed, the configured user must already exist.";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
assertion = cfg.group != defaultGroup -> config ? users.groups.${cfg.group};
|
||||||
|
message = "If `services.conduwuit.group` is changed, the configured group must already exist.";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
users.users = lib.mkIf (cfg.user == defaultUser) {
|
||||||
|
${defaultUser} = {
|
||||||
|
group = cfg.group;
|
||||||
|
home = cfg.settings.global.database_path;
|
||||||
|
isSystemUser = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users.groups = lib.mkIf (cfg.group == defaultGroup) {
|
||||||
|
${defaultGroup} = {};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.conduwuit = {
|
||||||
|
description = "Conduwuit Matrix Server";
|
||||||
|
documentation = ["https://conduwuit.puppyirl.gay/"];
|
||||||
|
wantedBy = ["multi-user.target"];
|
||||||
|
wants = ["network-online.target"];
|
||||||
|
after = ["network-online.target"];
|
||||||
|
environment = lib.mkMerge [
|
||||||
|
{CONDUWUIT_CONFIG = configFile;}
|
||||||
|
cfg.extraEnvironment
|
||||||
|
];
|
||||||
|
startLimitBurst = 5;
|
||||||
|
startLimitIntervalSec = 60;
|
||||||
|
serviceConfig = {
|
||||||
|
DynamicUser = true;
|
||||||
|
User = cfg.user;
|
||||||
|
Group = cfg.group;
|
||||||
|
|
||||||
|
DevicePolicy = "closed";
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateMounts = true;
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
PrivateIPC = true;
|
||||||
|
RemoveIPC = true;
|
||||||
|
RestrictAddressFamilies = [
|
||||||
|
"AF_INET"
|
||||||
|
"AF_INET6"
|
||||||
|
"AF_UNIX"
|
||||||
|
];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [
|
||||||
|
"@system-service @resources"
|
||||||
|
"~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
|
||||||
|
];
|
||||||
|
SystemCallErrorNumber = "EPERM";
|
||||||
|
|
||||||
|
StateDirectory = "conduwuit";
|
||||||
|
StateDirectoryMode = "0700";
|
||||||
|
RuntimeDirectory = "conduwuit";
|
||||||
|
RuntimeDirectoryMode = "0750";
|
||||||
|
|
||||||
|
ExecStart = lib.getExe cfg.package;
|
||||||
|
Restart = "on-failure";
|
||||||
|
RestartSec = 10;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
3
overlays/conduwuit/default.nix
Normal file
3
overlays/conduwuit/default.nix
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
{inputs, ...}: final: prev: {
|
||||||
|
conduwuit = inputs.conduwuit.packages.${prev.system}.all-features;
|
||||||
|
}
|
||||||
3
overlays/deploy-rs/default.nix
Normal file
3
overlays/deploy-rs/default.nix
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
{inputs, ...}: final: prev: {
|
||||||
|
deploy-rs = inputs.deploy-rs.packages.${prev.system}.deploy-rs;
|
||||||
|
}
|
||||||
10
shells/default/default.nix
Normal file
10
shells/default/default.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
mkShell,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
mkShell {
|
||||||
|
packages = with pkgs; [
|
||||||
|
pkgs.deploy-rs
|
||||||
|
];
|
||||||
|
}
|
||||||
143
systems/x86_64-linux/kylekrein-server/default.nix
Normal file
143
systems/x86_64-linux/kylekrein-server/default.nix
Normal file
|
|
@ -0,0 +1,143 @@
|
||||||
|
{
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
inputs,
|
||||||
|
namespace,
|
||||||
|
system,
|
||||||
|
target,
|
||||||
|
format,
|
||||||
|
virtual,
|
||||||
|
systems,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib;
|
||||||
|
with lib.custom; {
|
||||||
|
imports = lib.snowfall.fs.get-non-default-nix-files ./.;
|
||||||
|
custom = {
|
||||||
|
presets.default = enabled;
|
||||||
|
users.kylekrein = {
|
||||||
|
enable = true;
|
||||||
|
config = {};
|
||||||
|
};
|
||||||
|
services.conduwuit = {
|
||||||
|
enable = true;
|
||||||
|
#user = "turnserver";
|
||||||
|
settings = {
|
||||||
|
global = {
|
||||||
|
server_name = "kylekrein.com";
|
||||||
|
well_known = {
|
||||||
|
server = "matrix.kylekrein.com:443";
|
||||||
|
client = "https://matrix.kylekrein.com";
|
||||||
|
};
|
||||||
|
port = [6167];
|
||||||
|
trusted_servers = ["matrix.org"];
|
||||||
|
allow_registration = false;
|
||||||
|
registration_token = ""; #nix shell nixpkgs#openssl -c openssl rand -base64 48 | tr -d '/+' | cut -c1-64
|
||||||
|
allow_federation = true;
|
||||||
|
allow_encryption = true;
|
||||||
|
|
||||||
|
allow_local_presence = true;
|
||||||
|
require_auth_for_profile_requests = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
extraEnvironment = {
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.caddy = {
|
||||||
|
enable = true;
|
||||||
|
#virtualHosts."kylekrein.com:8448".extraConfig = ''
|
||||||
|
# reverse_proxy http://localhost:6167
|
||||||
|
#'';
|
||||||
|
virtualHosts."kylekrein.com".extraConfig = ''
|
||||||
|
handle_path /.well-known/matrix/* {
|
||||||
|
|
||||||
|
header Access-Control-Allow-Origin *
|
||||||
|
|
||||||
|
## `Content-Type: application/json` isn't required by the matrix spec
|
||||||
|
## but some browsers (firefox) and some other tooling might preview json
|
||||||
|
## content prettier when they are made aware via Content-Type
|
||||||
|
header Content-Type application/json
|
||||||
|
|
||||||
|
respond /client `{ "m.homeserver": { "base_url": "https://matrix.kylekrein.com/" }, "org.matrix.msc3575.proxy": { "url": "https://matrix.kylekrein.com/"}, "org.matrix.msc4143.rtc_foci": [ { "type": "livekit", "livekit_service_url": "https://livekit-jwt.call.matrix.org" } ] }`
|
||||||
|
|
||||||
|
respond /server `{ "m.server": "https://matrix.kylekrein.com" }`
|
||||||
|
|
||||||
|
## return http/404 if nothing matches
|
||||||
|
respond 404
|
||||||
|
}
|
||||||
|
respond /.well-known/element/element.json `{"call":{"widget_url":"https://call.element.io"}}`
|
||||||
|
reverse_proxy * http://localhost:6167
|
||||||
|
'';
|
||||||
|
# reverse_proxy /.well-known/* http://localhost:6167
|
||||||
|
#'';
|
||||||
|
virtualHosts."matrix.kylekrein.com".extraConfig = ''
|
||||||
|
handle_path /.well-known/matrix/* {
|
||||||
|
|
||||||
|
header Access-Control-Allow-Origin *
|
||||||
|
|
||||||
|
## `Content-Type: application/json` isn't required by the matrix spec
|
||||||
|
## but some browsers (firefox) and some other tooling might preview json
|
||||||
|
## content prettier when they are made aware via Content-Type
|
||||||
|
header Content-Type application/json
|
||||||
|
|
||||||
|
respond /client `{ "m.homeserver": { "base_url": "https://matrix.kylekrein.com/" }, "org.matrix.msc3575.proxy": { "url": "https://matrix.kylekrein.com/"}, "org.matrix.msc4143.rtc_foci": [ { "type": "livekit", "livekit_service_url": "https://livekit-jwt.call.matrix.org" } ] }`
|
||||||
|
|
||||||
|
respond /server `{ "m.server": "https://matrix.kylekrein.com" }`
|
||||||
|
|
||||||
|
## return http/404 if nothing matches
|
||||||
|
respond 404
|
||||||
|
}
|
||||||
|
respond /.well-known/element/element.json `{"call":{"widget_url":"https://call.element.io"}}`
|
||||||
|
reverse_proxy * http://localhost:6167
|
||||||
|
'';
|
||||||
|
virtualHosts."gitlab.kylekrein.com".extraConfig = ''
|
||||||
|
reverse_proxy * unix//run/gitlab/gitlab-workhorse.socket
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
#Chat host
|
||||||
|
networking.firewall.allowedTCPPorts = [80 443 22 8448];
|
||||||
|
networking.firewall.allowedUDPPorts = [3478 5349];
|
||||||
|
#sops.secrets."services/conduwuit" = {mode = "0755";};
|
||||||
|
|
||||||
|
sops.secrets."services/gitlab/dbPassword" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/rootPassword" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/secret" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/otpsecret" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/dbsecret" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/oidcKeyBase" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/activeRecordSalt" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/activeRecordPrimaryKey" = {owner = "gitlab";};
|
||||||
|
sops.secrets."services/gitlab/activeRecordDeterministicKey" = {owner = "gitlab";};
|
||||||
|
services.gitlab = {
|
||||||
|
enable = true;
|
||||||
|
host = "gitlab.kylekrein.com";
|
||||||
|
port = 443;
|
||||||
|
#statePath = "/persist/gitlab/state";
|
||||||
|
backup.startAt = "3:00";
|
||||||
|
databasePasswordFile = config.sops.secrets."services/gitlab/dbPassword".path;
|
||||||
|
initialRootPasswordFile = config.sops.secrets."services/gitlab/rootPassword".path;
|
||||||
|
secrets = {
|
||||||
|
secretFile = config.sops.secrets."services/gitlab/secret".path;
|
||||||
|
otpFile = config.sops.secrets."services/gitlab/otpsecret".path;
|
||||||
|
dbFile = config.sops.secrets."services/gitlab/dbsecret".path;
|
||||||
|
jwsFile = config.sops.secrets."services/gitlab/oidcKeyBase".path; #pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
|
||||||
|
activeRecordSaltFile = config.sops.secrets."services/gitlab/activeRecordSalt".path;
|
||||||
|
activeRecordPrimaryKeyFile = config.sops.secrets."services/gitlab/activeRecordPrimaryKey".path;
|
||||||
|
activeRecordDeterministicKeyFile = config.sops.secrets."services/gitlab/activeRecordDeterministicKey".path;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.gitlab-backup.environment.BACKUP = "dump";
|
||||||
|
boot.tmp.cleanOnBoot = true;
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.device = "/dev/sda";
|
||||||
|
boot.loader.systemd-boot.enable = mkForce false;
|
||||||
|
|
||||||
|
# ======================== DO NOT CHANGE THIS ========================
|
||||||
|
system.stateVersion = "24.11";
|
||||||
|
# ======================== DO NOT CHANGE THIS ========================
|
||||||
|
}
|
||||||
32
systems/x86_64-linux/kylekrein-server/hardware.nix
Normal file
32
systems/x86_64-linux/kylekrein-server/hardware.nix
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
modulesPath,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
(modulesPath + "/profiles/qemu-guest.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
|
||||||
|
boot.initrd.kernelModules = [];
|
||||||
|
boot.kernelModules = [];
|
||||||
|
boot.extraModulePackages = [];
|
||||||
|
|
||||||
|
fileSystems."/" = {
|
||||||
|
device = "/dev/disk/by-uuid/4f7e141c-0fc7-415a-815d-944b36f93806";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.eth0.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
}
|
||||||
48
systems/x86_64-linux/kylekrein-server/networking.nix
Normal file
48
systems/x86_64-linux/kylekrein-server/networking.nix
Normal file
|
|
@ -0,0 +1,48 @@
|
||||||
|
{lib, ...}: {
|
||||||
|
# This file was populated at runtime with the networking
|
||||||
|
# details gathered from the active system.
|
||||||
|
networking = {
|
||||||
|
nameservers = [
|
||||||
|
"8.8.8.8"
|
||||||
|
];
|
||||||
|
defaultGateway = "172.31.1.1";
|
||||||
|
defaultGateway6 = {
|
||||||
|
address = "";
|
||||||
|
interface = "eth0";
|
||||||
|
};
|
||||||
|
dhcpcd.enable = false;
|
||||||
|
usePredictableInterfaceNames = lib.mkForce false;
|
||||||
|
interfaces = {
|
||||||
|
eth0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "91.99.0.169";
|
||||||
|
prefixLength = 32;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv6.addresses = [
|
||||||
|
{
|
||||||
|
address = "fe80::9400:4ff:fe30:830e";
|
||||||
|
prefixLength = 64;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv4.routes = [
|
||||||
|
{
|
||||||
|
address = "172.31.1.1";
|
||||||
|
prefixLength = 32;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv6.routes = [
|
||||||
|
{
|
||||||
|
address = "";
|
||||||
|
prefixLength = 128;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.udev.extraRules = ''
|
||||||
|
ATTR{address}=="96:00:04:30:83:0e", NAME="eth0"
|
||||||
|
|
||||||
|
'';
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue