xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions 1

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-08-20 22:55:08 +02:00
commit 2972bf312e
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
4 changed files with 52 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

38
flake.nix
View file

@ -23,15 +23,29 @@
in
{
formatter.${system} = pkgs.nixfmt-tree;
apps.nixos-diff = {
type = "app";
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
${pkgs.git}/bin/git checkout flake.lock
${pkgs.git}/bin/git pull --ff-only
${pkgs.nix}/bin/nix flake update
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
''}";
apps = {
nixos-diff = {
type = "app";
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
${pkgs.git}/bin/git checkout flake.lock
${pkgs.git}/bin/git pull --ff-only
${pkgs.nix}/bin/nix flake update
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
''}";
};
deploy = {
type = "app";
program = "${pkgs.writeShellScript "deploy.sh" ''
set -e
host="''${1:?usage: nix run .#apps.deploy -- <host>}"
${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
set -e
cd /etc/nixos
nix run .#apps.nixos-diff && nixos-rebuild switch
EOF
''}";
};
};
devShells.${system}.default = pkgs.mkShell {
packages = [
@ -256,6 +270,12 @@
group = "forgejo";
mode = "0440";
};
forgejo-oauth2-jwt-secret = {
file = ./secrets/forgejo-oauth2-jwt-secret.age;
owner = "forgejo";
group = "forgejo";
mode = "0440";
};
forgejo-runner-token-snowden = {
file = ./secrets/forgejo-runner-token-snowden.age;
owner = "root";

2
hosts/git/default.nix
View file

@ -40,5 +40,5 @@
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11";
system.stateVersion = "26.05";
}

9
hosts/git/forgejo.nix
View file

@ -23,10 +23,9 @@ in
SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
};
oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
};
settings = {
security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
session.COOKIE_SECURE = true;
log.LEVEL = "Warn";
server = {
@ -78,12 +77,6 @@ in
};
};
openssh.extraConfig = ''
Match User forgejo
AcceptEnv GIT_PROTOCOL
PerSourcePenalties no
'';
nginx.virtualHosts."${fqdn}" = {
quic = true;
kTLS = true;

27
hosts/www/nginx.nix
View file

@ -78,7 +78,7 @@ in
'';
};
"/all.ics" = {
return = "301 https://www.berlin.ccc.de/calendars/all.ics";
return = "301 https://$host/calendars/all.ics";
};
"~ ^/calendars/([^/]+\.ics)$" = {
alias = "/srv/http/calendars/$1";
@ -97,11 +97,26 @@ in
kTLS = true;
forceSSL = true;
enableACME = true;
locations."/" = {
basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
root = "/srv/http/www-staging";
index = "index.html";
tryFiles = "$uri $uri/ $uri.html =404";
locations = {
"/" = {
basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
root = "/srv/http/www-staging";
index = "index.html";
tryFiles = "$uri $uri/ $uri.html =404";
};
"/all.ics" = {
return = "301 https://$host/calendars/all.ics";
};
"~ ^/calendars/([^/]+\.ics)$" = {
alias = "/srv/http/calendars/$1";
extraConfig = ''
add_header Cache-Control "no-cache";
types {
text/calendar ics;
}
default_type text/calendar;
'';
};
};
};
};