This commit is contained in:
parent
f7c03f7fe7
commit
bb37ae5907
SSH key fingerprint:
SHA256:EvLbWxFCtfmd+8Xa6RkzkhIga+wFkKCekfFacYVn63M
4 changed files with 413 additions and 306 deletions
579
flake.nix
579
flake.nix
|
|
@ -2,7 +2,7 @@
|
|||
description = "CCCB services";
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small";
|
||||
#flake-utils.url = "github:numtide/flake-utils";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
|
@ -12,313 +12,302 @@
|
|||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
#flake-utils,
|
||||
flake-utils,
|
||||
agenix,
|
||||
}:
|
||||
#flake-utils.lib.eachDefaultSystem (
|
||||
# system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
system = "x86_64-linux";
|
||||
in
|
||||
{
|
||||
formatter.${system} = pkgs.nixfmt-tree;
|
||||
apps.${system} = {
|
||||
nixos-diff = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
|
||||
${pkgs.git}/bin/git checkout flake.lock
|
||||
${pkgs.git}/bin/git pull --ff-only
|
||||
${pkgs.nix}/bin/nix flake update
|
||||
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
|
||||
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
|
||||
''}";
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
in
|
||||
{
|
||||
formatter = pkgs.nixfmt-tree;
|
||||
apps = {
|
||||
nixos-diff = {
|
||||
meta.description = "Compare the current system with the configuration from the updated flake";
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
|
||||
${pkgs.git}/bin/git checkout flake.lock
|
||||
${pkgs.git}/bin/git pull --ff-only
|
||||
${pkgs.nix}/bin/nix flake update
|
||||
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
|
||||
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
|
||||
''}";
|
||||
};
|
||||
deploy = {
|
||||
meta.description = "Deploy a NixOS configuration to a remote host";
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy.sh" ''
|
||||
set -e
|
||||
host="''${1:?usage: nix run .#deploy -- <host>}"
|
||||
${pkgs.openssh}/bin/ssh -tt "$host" 'bash -s' <<'EOF'
|
||||
set -e
|
||||
cd /etc/nixos
|
||||
nix run .#nixos-diff && nixos-rebuild switch
|
||||
EOF
|
||||
''}";
|
||||
};
|
||||
};
|
||||
deploy = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy.sh" ''
|
||||
set -e
|
||||
host="''${1:?usage: nix run .#apps.deploy -- <host>}"
|
||||
${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
|
||||
set -e
|
||||
cd /etc/nixos
|
||||
nix run .#apps.nixos-diff && nixos-rebuild switch
|
||||
EOF
|
||||
''}";
|
||||
devShells.default = pkgs.mkShell {
|
||||
packages = [
|
||||
(agenix.packages.${system}.default)
|
||||
pkgs.age
|
||||
];
|
||||
};
|
||||
};
|
||||
devShells.${system}.default = pkgs.mkShell {
|
||||
packages = [
|
||||
(agenix.packages.${system}.default)
|
||||
pkgs.age
|
||||
];
|
||||
};
|
||||
nixosConfigurations."matrix" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";d
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
matrix_registration_shared_secret = {
|
||||
file = ./secrets/matrix_registration_shared_secret.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
}
|
||||
)
|
||||
// {
|
||||
nixosConfigurations = {
|
||||
matrix = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
matrix_registration_shared_secret = {
|
||||
file = ./secrets/matrix_registration_shared_secret.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
matrix_signing_key = {
|
||||
file = ./secrets/matrix_signing_key.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
matrix_db_password = {
|
||||
file = ./secrets/matrix_db_password.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
draupnir_access_token = {
|
||||
file = ./secrets/draupnir_access_token.age;
|
||||
mode = "440";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
};
|
||||
matrix_signing_key = {
|
||||
file = ./secrets/matrix_signing_key.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
matrix_db_password = {
|
||||
file = ./secrets/matrix_db_password.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
draupnir_access_token = {
|
||||
file = ./secrets/draupnir_access_token.age;
|
||||
mode = "440";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/matrix
|
||||
];
|
||||
};
|
||||
nixosConfigurations."md" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets.hedgedoc_db_password = {
|
||||
file = ./secrets/hedgedoc_db_password.age;
|
||||
owner = "hedgedoc";
|
||||
group = "hedgedoc";
|
||||
mode = "0440";
|
||||
};
|
||||
}
|
||||
./hosts/md
|
||||
];
|
||||
};
|
||||
nixosConfigurations."www" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
www-staging-htpasswd = {
|
||||
file = ./secrets/www-staging-htpasswd.age;
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
}
|
||||
./hosts/matrix
|
||||
];
|
||||
};
|
||||
md = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets.hedgedoc_db_password = {
|
||||
file = ./secrets/hedgedoc_db_password.age;
|
||||
owner = "hedgedoc";
|
||||
group = "hedgedoc";
|
||||
mode = "0440";
|
||||
};
|
||||
caldav-export-config = {
|
||||
file = ./secrets/caldav-export-config.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0440";
|
||||
}
|
||||
./hosts/md
|
||||
];
|
||||
};
|
||||
www = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
www-staging-htpasswd = {
|
||||
file = ./secrets/www-staging-htpasswd.age;
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
mode = "0440";
|
||||
};
|
||||
caldav-export-config = {
|
||||
file = ./secrets/caldav-export-config.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0440";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/www
|
||||
];
|
||||
};
|
||||
nixosConfigurations."monitoring" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
grafana_secret_key = {
|
||||
file = ./secrets/grafana_secret_key.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
}
|
||||
./hosts/www
|
||||
];
|
||||
};
|
||||
monitoring = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
grafana_secret_key = {
|
||||
file = ./secrets/grafana_secret_key.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
grafana_admin_password = {
|
||||
file = ./secrets/grafana_admin_password.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
grafana_basic_auth = {
|
||||
file = ./secrets/grafana_basic_auth.age;
|
||||
mode = "440";
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
pve-exporter = {
|
||||
file = ./secrets/pve-exporter.age;
|
||||
mode = "440";
|
||||
owner = "prometheus";
|
||||
group = "prometheus";
|
||||
};
|
||||
};
|
||||
grafana_admin_password = {
|
||||
file = ./secrets/grafana_admin_password.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
}
|
||||
./hosts/monitoring
|
||||
];
|
||||
};
|
||||
sql = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-matrix-synapse = {
|
||||
file = ./secrets/postgres-matrix-synapse.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-hedgedoc = {
|
||||
file = ./secrets/postgres-hedgedoc.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-baikal = {
|
||||
file = ./secrets/postgres-baikal.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
grafana_basic_auth = {
|
||||
file = ./secrets/grafana_basic_auth.age;
|
||||
mode = "440";
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
}
|
||||
./hosts/sql
|
||||
];
|
||||
};
|
||||
dav = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
#radicale-htpasswd = {
|
||||
# file = ./secrets/radicale_htpasswd.age;
|
||||
# owner = "radicale";
|
||||
# group = "radicale";
|
||||
# mode = "0400";
|
||||
#};
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
}
|
||||
./hosts/dav
|
||||
];
|
||||
};
|
||||
git = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0400";
|
||||
};
|
||||
forgejo-internal-token = {
|
||||
file = ./secrets/forgejo-internal-token.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-secret-key = {
|
||||
file = ./secrets/forgejo-secret-key.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-oauth2-jwt-secret = {
|
||||
file = ./secrets/forgejo-oauth2-jwt-secret.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-runner-token-snowden = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-snowden-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
pve-exporter = {
|
||||
file = ./secrets/pve-exporter.age;
|
||||
mode = "440";
|
||||
owner = "prometheus";
|
||||
group = "prometheus";
|
||||
}
|
||||
./hosts/git
|
||||
];
|
||||
};
|
||||
forgejo-runner = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
forgejo-runner-token = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/monitoring
|
||||
];
|
||||
};
|
||||
nixosConfigurations."sql" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-matrix-synapse = {
|
||||
file = ./secrets/postgres-matrix-synapse.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-hedgedoc = {
|
||||
file = ./secrets/postgres-hedgedoc.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-baikal = {
|
||||
file = ./secrets/postgres-baikal.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/sql
|
||||
];
|
||||
};
|
||||
nixosConfigurations."dav" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
#radicale-htpasswd = {
|
||||
# file = ./secrets/radicale_htpasswd.age;
|
||||
# owner = "radicale";
|
||||
# group = "radicale";
|
||||
# mode = "0400";
|
||||
#};
|
||||
};
|
||||
}
|
||||
./hosts/dav
|
||||
];
|
||||
};
|
||||
nixosConfigurations."git" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0400";
|
||||
};
|
||||
forgejo-internal-token = {
|
||||
file = ./secrets/forgejo-internal-token.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-secret-key = {
|
||||
file = ./secrets/forgejo-secret-key.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-oauth2-jwt-secret = {
|
||||
file = ./secrets/forgejo-oauth2-jwt-secret.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-runner-token-snowden = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-snowden-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/git
|
||||
];
|
||||
};
|
||||
nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
forgejo-runner-token = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/forgejo-runner
|
||||
];
|
||||
}
|
||||
./hosts/forgejo-runner
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
#);
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue