This commit is contained in:
parent
f7c03f7fe7
commit
bb37ae5907
SSH key fingerprint:
SHA256:EvLbWxFCtfmd+8Xa6RkzkhIga+wFkKCekfFacYVn63M
4 changed files with 413 additions and 306 deletions
|
|
@ -10,4 +10,4 @@ charset = utf-8
|
|||
[*.nix]
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
|
||||
insert_final_newline = false
|
||||
|
|
|
|||
96
.gitignore
vendored
96
.gitignore
vendored
|
|
@ -1,7 +1,5 @@
|
|||
result
|
||||
|
||||
# Created by https://www.toptal.com/developers/gitignore/api/linux,windows,macos,vim,direnv
|
||||
# Edit at https://www.toptal.com/developers/gitignore?templates=linux,windows,macos,vim,direnv,nix
|
||||
# Created by https://www.toptal.com/developers/gitignore/api/linux,windows,macos,direnv,pycharm+all,vim
|
||||
# Edit at https://www.toptal.com/developers/gitignore?templates=linux,windows,macos,direnv,pycharm+all,vim
|
||||
|
||||
### direnv ###
|
||||
.direnv
|
||||
|
|
@ -54,7 +52,93 @@ Temporary Items
|
|||
# iCloud generated files
|
||||
*.icloud
|
||||
|
||||
#!! ERROR: nix is undefined. Use list command to see defined gitignore types !!#
|
||||
### PyCharm+all ###
|
||||
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
|
||||
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
|
||||
|
||||
# User-specific stuff
|
||||
.idea/**/workspace.xml
|
||||
.idea/**/tasks.xml
|
||||
.idea/**/usage.statistics.xml
|
||||
.idea/**/dictionaries
|
||||
.idea/**/shelf
|
||||
|
||||
# AWS User-specific
|
||||
.idea/**/aws.xml
|
||||
|
||||
# Generated files
|
||||
.idea/**/contentModel.xml
|
||||
|
||||
# Sensitive or high-churn files
|
||||
.idea/**/dataSources/
|
||||
.idea/**/dataSources.ids
|
||||
.idea/**/dataSources.local.xml
|
||||
.idea/**/sqlDataSources.xml
|
||||
.idea/**/dynamic.xml
|
||||
.idea/**/uiDesigner.xml
|
||||
.idea/**/dbnavigator.xml
|
||||
|
||||
# Gradle
|
||||
.idea/**/gradle.xml
|
||||
.idea/**/libraries
|
||||
|
||||
# Gradle and Maven with auto-import
|
||||
# When using Gradle or Maven with auto-import, you should exclude module files,
|
||||
# since they will be recreated, and may cause churn. Uncomment if using
|
||||
# auto-import.
|
||||
# .idea/artifacts
|
||||
# .idea/compiler.xml
|
||||
# .idea/jarRepositories.xml
|
||||
# .idea/modules.xml
|
||||
# .idea/*.iml
|
||||
# .idea/modules
|
||||
# *.iml
|
||||
# *.ipr
|
||||
|
||||
# CMake
|
||||
cmake-build-*/
|
||||
|
||||
# Mongo Explorer plugin
|
||||
.idea/**/mongoSettings.xml
|
||||
|
||||
# File-based project format
|
||||
*.iws
|
||||
|
||||
# IntelliJ
|
||||
out/
|
||||
|
||||
# mpeltonen/sbt-idea plugin
|
||||
.idea_modules/
|
||||
|
||||
# JIRA plugin
|
||||
atlassian-ide-plugin.xml
|
||||
|
||||
# Cursive Clojure plugin
|
||||
.idea/replstate.xml
|
||||
|
||||
# SonarLint plugin
|
||||
.idea/sonarlint/
|
||||
|
||||
# Crashlytics plugin (for Android Studio and IntelliJ)
|
||||
com_crashlytics_export_strings.xml
|
||||
crashlytics.properties
|
||||
crashlytics-build.properties
|
||||
fabric.properties
|
||||
|
||||
# Editor-based Rest Client
|
||||
.idea/httpRequests
|
||||
|
||||
# Android studio 3.1+ serialized cache file
|
||||
.idea/caches/build_file_checksums.ser
|
||||
|
||||
### PyCharm+all Patch ###
|
||||
# Ignore everything but code style settings and run configurations
|
||||
# that are supposed to be shared within teams.
|
||||
|
||||
.idea/*
|
||||
|
||||
!.idea/codeStyles
|
||||
!.idea/runConfigurations
|
||||
|
||||
### Vim ###
|
||||
# Swap
|
||||
|
|
@ -102,4 +186,4 @@ $RECYCLE.BIN/
|
|||
# Windows shortcuts
|
||||
*.lnk
|
||||
|
||||
# End of https://www.toptal.com/developers/gitignore/api/linux,windows,macos,vim,direnv,nix
|
||||
# End of https://www.toptal.com/developers/gitignore/api/linux,windows,macos,direnv,pycharm+all,vim
|
||||
|
|
|
|||
42
flake.lock
generated
42
flake.lock
generated
|
|
@ -45,6 +45,24 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -68,16 +86,16 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1784432872,
|
||||
"narHash": "sha256-n3gKTBIV4ZA5VQpUakffBe3KGu4+mhPoA34rrqS0GkA=",
|
||||
"lastModified": 1789233862,
|
||||
"narHash": "sha256-mka8SFIzRsHoxBh6LGCFizdp8N1B81clSSe3wzid6Yc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "fd1462031fdee08f65fd0b4c6b64e22239a77870",
|
||||
"rev": "6eb0f007b69f39ababe79d7025d8d0484553d163",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-26.05",
|
||||
"ref": "nixos-26.05-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
|
|
@ -85,6 +103,7 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
},
|
||||
|
|
@ -102,6 +121,21 @@
|
|||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
|
|
|||
579
flake.nix
579
flake.nix
|
|
@ -2,7 +2,7 @@
|
|||
description = "CCCB services";
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small";
|
||||
#flake-utils.url = "github:numtide/flake-utils";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
|
@ -12,313 +12,302 @@
|
|||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
#flake-utils,
|
||||
flake-utils,
|
||||
agenix,
|
||||
}:
|
||||
#flake-utils.lib.eachDefaultSystem (
|
||||
# system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
system = "x86_64-linux";
|
||||
in
|
||||
{
|
||||
formatter.${system} = pkgs.nixfmt-tree;
|
||||
apps.${system} = {
|
||||
nixos-diff = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
|
||||
${pkgs.git}/bin/git checkout flake.lock
|
||||
${pkgs.git}/bin/git pull --ff-only
|
||||
${pkgs.nix}/bin/nix flake update
|
||||
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
|
||||
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
|
||||
''}";
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
in
|
||||
{
|
||||
formatter = pkgs.nixfmt-tree;
|
||||
apps = {
|
||||
nixos-diff = {
|
||||
meta.description = "Compare the current system with the configuration from the updated flake";
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "nixos-diff.sh" ''
|
||||
${pkgs.git}/bin/git checkout flake.lock
|
||||
${pkgs.git}/bin/git pull --ff-only
|
||||
${pkgs.nix}/bin/nix flake update
|
||||
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
|
||||
${pkgs.nvd}/bin/nvd diff /run/current-system ./result
|
||||
''}";
|
||||
};
|
||||
deploy = {
|
||||
meta.description = "Deploy a NixOS configuration to a remote host";
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy.sh" ''
|
||||
set -e
|
||||
host="''${1:?usage: nix run .#deploy -- <host>}"
|
||||
${pkgs.openssh}/bin/ssh -tt "$host" 'bash -s' <<'EOF'
|
||||
set -e
|
||||
cd /etc/nixos
|
||||
nix run .#nixos-diff && nixos-rebuild switch
|
||||
EOF
|
||||
''}";
|
||||
};
|
||||
};
|
||||
deploy = {
|
||||
type = "app";
|
||||
program = "${pkgs.writeShellScript "deploy.sh" ''
|
||||
set -e
|
||||
host="''${1:?usage: nix run .#apps.deploy -- <host>}"
|
||||
${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
|
||||
set -e
|
||||
cd /etc/nixos
|
||||
nix run .#apps.nixos-diff && nixos-rebuild switch
|
||||
EOF
|
||||
''}";
|
||||
devShells.default = pkgs.mkShell {
|
||||
packages = [
|
||||
(agenix.packages.${system}.default)
|
||||
pkgs.age
|
||||
];
|
||||
};
|
||||
};
|
||||
devShells.${system}.default = pkgs.mkShell {
|
||||
packages = [
|
||||
(agenix.packages.${system}.default)
|
||||
pkgs.age
|
||||
];
|
||||
};
|
||||
nixosConfigurations."matrix" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";d
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
matrix_registration_shared_secret = {
|
||||
file = ./secrets/matrix_registration_shared_secret.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
}
|
||||
)
|
||||
// {
|
||||
nixosConfigurations = {
|
||||
matrix = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
matrix_registration_shared_secret = {
|
||||
file = ./secrets/matrix_registration_shared_secret.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
matrix_signing_key = {
|
||||
file = ./secrets/matrix_signing_key.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
matrix_db_password = {
|
||||
file = ./secrets/matrix_db_password.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
draupnir_access_token = {
|
||||
file = ./secrets/draupnir_access_token.age;
|
||||
mode = "440";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
};
|
||||
matrix_signing_key = {
|
||||
file = ./secrets/matrix_signing_key.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
matrix_db_password = {
|
||||
file = ./secrets/matrix_db_password.age;
|
||||
mode = "440";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
draupnir_access_token = {
|
||||
file = ./secrets/draupnir_access_token.age;
|
||||
mode = "440";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/matrix
|
||||
];
|
||||
};
|
||||
nixosConfigurations."md" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets.hedgedoc_db_password = {
|
||||
file = ./secrets/hedgedoc_db_password.age;
|
||||
owner = "hedgedoc";
|
||||
group = "hedgedoc";
|
||||
mode = "0440";
|
||||
};
|
||||
}
|
||||
./hosts/md
|
||||
];
|
||||
};
|
||||
nixosConfigurations."www" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
www-staging-htpasswd = {
|
||||
file = ./secrets/www-staging-htpasswd.age;
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
}
|
||||
./hosts/matrix
|
||||
];
|
||||
};
|
||||
md = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets.hedgedoc_db_password = {
|
||||
file = ./secrets/hedgedoc_db_password.age;
|
||||
owner = "hedgedoc";
|
||||
group = "hedgedoc";
|
||||
mode = "0440";
|
||||
};
|
||||
caldav-export-config = {
|
||||
file = ./secrets/caldav-export-config.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0440";
|
||||
}
|
||||
./hosts/md
|
||||
];
|
||||
};
|
||||
www = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
www-staging-htpasswd = {
|
||||
file = ./secrets/www-staging-htpasswd.age;
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
mode = "0440";
|
||||
};
|
||||
caldav-export-config = {
|
||||
file = ./secrets/caldav-export-config.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0440";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/www
|
||||
];
|
||||
};
|
||||
nixosConfigurations."monitoring" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
grafana_secret_key = {
|
||||
file = ./secrets/grafana_secret_key.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
}
|
||||
./hosts/www
|
||||
];
|
||||
};
|
||||
monitoring = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
grafana_secret_key = {
|
||||
file = ./secrets/grafana_secret_key.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
grafana_admin_password = {
|
||||
file = ./secrets/grafana_admin_password.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
grafana_basic_auth = {
|
||||
file = ./secrets/grafana_basic_auth.age;
|
||||
mode = "440";
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
pve-exporter = {
|
||||
file = ./secrets/pve-exporter.age;
|
||||
mode = "440";
|
||||
owner = "prometheus";
|
||||
group = "prometheus";
|
||||
};
|
||||
};
|
||||
grafana_admin_password = {
|
||||
file = ./secrets/grafana_admin_password.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
}
|
||||
./hosts/monitoring
|
||||
];
|
||||
};
|
||||
sql = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-matrix-synapse = {
|
||||
file = ./secrets/postgres-matrix-synapse.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-hedgedoc = {
|
||||
file = ./secrets/postgres-hedgedoc.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-baikal = {
|
||||
file = ./secrets/postgres-baikal.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
grafana_basic_auth = {
|
||||
file = ./secrets/grafana_basic_auth.age;
|
||||
mode = "440";
|
||||
owner = "nginx";
|
||||
group = "nginx";
|
||||
}
|
||||
./hosts/sql
|
||||
];
|
||||
};
|
||||
dav = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
#radicale-htpasswd = {
|
||||
# file = ./secrets/radicale_htpasswd.age;
|
||||
# owner = "radicale";
|
||||
# group = "radicale";
|
||||
# mode = "0400";
|
||||
#};
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
mode = "440";
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
}
|
||||
./hosts/dav
|
||||
];
|
||||
};
|
||||
git = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0400";
|
||||
};
|
||||
forgejo-internal-token = {
|
||||
file = ./secrets/forgejo-internal-token.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-secret-key = {
|
||||
file = ./secrets/forgejo-secret-key.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-oauth2-jwt-secret = {
|
||||
file = ./secrets/forgejo-oauth2-jwt-secret.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-runner-token-snowden = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-snowden-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
pve-exporter = {
|
||||
file = ./secrets/pve-exporter.age;
|
||||
mode = "440";
|
||||
owner = "prometheus";
|
||||
group = "prometheus";
|
||||
}
|
||||
./hosts/git
|
||||
];
|
||||
};
|
||||
forgejo-runner = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
forgejo-runner-token = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/monitoring
|
||||
];
|
||||
};
|
||||
nixosConfigurations."sql" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-matrix-synapse = {
|
||||
file = ./secrets/postgres-matrix-synapse.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-hedgedoc = {
|
||||
file = ./secrets/postgres-hedgedoc.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-grafana = {
|
||||
file = ./secrets/postgres-grafana.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
postgres-baikal = {
|
||||
file = ./secrets/postgres-baikal.age;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/sql
|
||||
];
|
||||
};
|
||||
nixosConfigurations."dav" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
#radicale-htpasswd = {
|
||||
# file = ./secrets/radicale_htpasswd.age;
|
||||
# owner = "radicale";
|
||||
# group = "radicale";
|
||||
# mode = "0400";
|
||||
#};
|
||||
};
|
||||
}
|
||||
./hosts/dav
|
||||
];
|
||||
};
|
||||
nixosConfigurations."git" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
postgres-forgejo = {
|
||||
file = ./secrets/postgres-forgejo.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0400";
|
||||
};
|
||||
forgejo-internal-token = {
|
||||
file = ./secrets/forgejo-internal-token.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-secret-key = {
|
||||
file = ./secrets/forgejo-secret-key.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-oauth2-jwt-secret = {
|
||||
file = ./secrets/forgejo-oauth2-jwt-secret.age;
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
mode = "0440";
|
||||
};
|
||||
forgejo-runner-token-snowden = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-snowden-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/git
|
||||
];
|
||||
};
|
||||
nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
|
||||
#system = "x86_64-linux";
|
||||
#pkgs = import nixpkgs { inherit system; };
|
||||
inherit system;
|
||||
modules = [
|
||||
agenix.nixosModules.default
|
||||
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
|
||||
{
|
||||
age.secrets = {
|
||||
forgejo-runner-token = {
|
||||
file = ./secrets/forgejo-runner-token-snowden.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
forgejo-runner-token-env = {
|
||||
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
}
|
||||
./hosts/forgejo-runner
|
||||
];
|
||||
}
|
||||
./hosts/forgejo-runner
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
#);
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue