xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-08-20 22:55:08 +02:00
commit 2972bf312e
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
4 changed files with 52 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

38
flake.nix
View file

@ -23,15 +23,29 @@
in in
{ {
formatter.${system} = pkgs.nixfmt-tree; formatter.${system} = pkgs.nixfmt-tree;
apps.nixos-diff = { apps = {
type = "app"; nixos-diff = {
program = "${pkgs.writeShellScript "nixos-diff.sh" '' type = "app";
${pkgs.git}/bin/git checkout flake.lock program = "${pkgs.writeShellScript "nixos-diff.sh" ''
${pkgs.git}/bin/git pull --ff-only ${pkgs.git}/bin/git checkout flake.lock
${pkgs.nix}/bin/nix flake update ${pkgs.git}/bin/git pull --ff-only
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json ${pkgs.nix}/bin/nix flake update
${pkgs.nvd}/bin/nvd diff /run/current-system ./result ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
''}"; ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
''}";
};
deploy = {
type = "app";
program = "${pkgs.writeShellScript "deploy.sh" ''
set -e
host="''${1:?usage: nix run .#apps.deploy -- <host>}"
${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
set -e
cd /etc/nixos
nix run .#apps.nixos-diff && nixos-rebuild switch
EOF
''}";
};
}; };
devShells.${system}.default = pkgs.mkShell { devShells.${system}.default = pkgs.mkShell {
packages = [ packages = [
@ -256,6 +270,12 @@
group = "forgejo"; group = "forgejo";
mode = "0440"; mode = "0440";
}; };
forgejo-oauth2-jwt-secret = {
file = ./secrets/forgejo-oauth2-jwt-secret.age;
owner = "forgejo";
group = "forgejo";
mode = "0440";
};
forgejo-runner-token-snowden = { forgejo-runner-token-snowden = {
file = ./secrets/forgejo-runner-token-snowden.age; file = ./secrets/forgejo-runner-token-snowden.age;
owner = "root"; owner = "root";

2
hosts/git/default.nix
View file

@ -40,5 +40,5 @@
''; '';
services.openssh.settings.Banner = "/etc/ssh/banner"; services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11"; system.stateVersion = "26.05";
} }

9
hosts/git/forgejo.nix
View file

@ -23,10 +23,9 @@ in
SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path; SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path; INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
}; };
oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path; oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
}; };
settings = { settings = {
security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
session.COOKIE_SECURE = true; session.COOKIE_SECURE = true;
log.LEVEL = "Warn"; log.LEVEL = "Warn";
server = { server = {
@ -78,12 +77,6 @@ in
}; };
}; };
openssh.extraConfig = ''
Match User forgejo
AcceptEnv GIT_PROTOCOL
PerSourcePenalties no
'';
nginx.virtualHosts."${fqdn}" = { nginx.virtualHosts."${fqdn}" = {
quic = true; quic = true;
kTLS = true; kTLS = true;

27
hosts/www/nginx.nix
View file

@ -78,7 +78,7 @@ in
''; '';
}; };
"/all.ics" = { "/all.ics" = {
return = "301 https://www.berlin.ccc.de/calendars/all.ics"; return = "301 https://$host/calendars/all.ics";
}; };
"~ ^/calendars/([^/]+\.ics)$" = { "~ ^/calendars/([^/]+\.ics)$" = {
alias = "/srv/http/calendars/$1"; alias = "/srv/http/calendars/$1";
@ -97,11 +97,26 @@ in
kTLS = true; kTLS = true;
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
locations."/" = { locations = {
basicAuthFile = config.age.secrets.www-staging-htpasswd.path; "/" = {
root = "/srv/http/www-staging"; basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
index = "index.html"; root = "/srv/http/www-staging";
tryFiles = "$uri $uri/ $uri.html =404"; index = "index.html";
tryFiles = "$uri $uri/ $uri.html =404";
};
"/all.ics" = {
return = "301 https://$host/calendars/all.ics";
};
"~ ^/calendars/([^/]+\.ics)$" = {
alias = "/srv/http/calendars/$1";
extraConfig = ''
add_header Cache-Control "no-cache";
types {
text/calendar ics;
}
default_type text/calendar;
'';
};
}; };
}; };
}; };