xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra
Some checks failed
Test Nix flake / Test nix flake (push) Has been cancelled
Details

Browse source
This commit is contained in:
XenGi 2026-10-20 20:34:02 +02:00
commit cd82a0facd
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
5 changed files with 27 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

89
flake.lock generated
View file

@ -2,59 +2,34 @@
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": [
"nixpkgs"
],
"systems": "systems"
},
"locked": {
"lastModified": 1770165109,
"narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
"owner": "ryantm",
"repo": "agenix",
"rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1744478979,
"narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "43975d782b418ebf4969e9ccba82466728c2851b",
"lastModified": 1790734419,
"narHash": "sha256-n7wew722m1OTBT9DOIMxNX/NF4zfsSUABAO5eW3wikE=",
"owner": "ryantm",
"repo": "agenix",
"rev": "3daa710894355fa2fad8243380af373a2b4046ef",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems_2"
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"lastModified": 1791914995,
"narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544",
"type": "github"
},
"original": {
@ -63,34 +38,13 @@
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1745494811,
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1790328731,
"narHash": "sha256-Rvx1gJOPmsXVvislwhD16OSbqYjYD/jnLEdY4w77few=",
"lastModified": 1791935857,
"narHash": "sha256-Zrhxwe8+HMRiDpjsOIoOIUvK6b8HCp3FL5R50N901hU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "392b320636af0527be6f300a8f57e5ab5f43ba38",
"rev": "952dd4355e1932709b993aa31de5e5b7bbe114f7",
"type": "github"
},
"original": {
@ -121,21 +75,6 @@
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",

8
flake.nix
View file

@ -21,7 +21,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
matrix_registration_shared_secret = {
@ -57,7 +56,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets.hedgedoc_db_password = {
file = ./secrets/hedgedoc_db_password.age;
@ -73,7 +71,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
www-staging-htpasswd = {
@ -97,7 +94,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
grafana_secret_key = {
@ -139,7 +135,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
postgres-matrix-synapse = {
@ -181,7 +176,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
#radicale-htpasswd = {
@ -199,7 +193,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
postgres-forgejo = {
@ -247,7 +240,6 @@
system = "x86_64-linux";
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
{
age.secrets = {
forgejo-runner-token = {

2
hosts/forgejo-runner/forgejo-runner.nix
View file

@ -45,7 +45,7 @@
};
container = {
enable_ipv6 = true;
network = "forgejo";
network = "default";
privileged = true;
force_pull = true;
docker_host = "unix:///run/podman/podman.sock";

23
hosts/www/nginx.nix
View file

@ -2,6 +2,12 @@
let
# TODO: mkVHost
aliasDir = url: path: {
"${url}" = {
return = "301 ${url}/";
};
"${url}/".alias = "${path}/";
};
in
{
imports = [
@ -42,13 +48,6 @@ in
index = "index.html";
tryFiles = "$uri $uri/ $uri.html =404";
};
"/twentyyears/".alias = "/srv/http/twentyyears/";
"/thirtytwoyears/".alias = "/srv/http/thirtytwoyears/";
# RFC8805
"/noc/".alias = "/srv/http/noc/";
"/static/".alias = "/srv/http/static/";
# RFC8805 new location
"/.well-known/loc/".alias = "/srv/http/noc/";
"= /.well-known/security.txt" = {
alias = "/srv/http/security.txt";
extraConfig = ''
@ -90,7 +89,15 @@ in
default_type text/calendar;
'';
};
};
}
// aliasDir "/twentyyears" "/srv/http/twentyyears"
// aliasDir "/thirtytwoyears" "/srv/http/thirtytwoyears"
// aliasDir "/kik" "/srv/http/kik"
# RFC8805
// aliasDir "/noc" "/srv/http/noc"
// aliasDir "/static" "/srv/http/static"
# RFC8805 new location
// aliasDir "/.well-known/loc" "/srv/http/noc";
};
"staging.${config.networking.domain}" = {
quic = true;

93
secrets/agenix-rules.nix Normal file
View file

@ -0,0 +1,93 @@
let
kanae = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09";
kota = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16";
lucy = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08";
mayu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11";
nana = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16";
nyu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11";
xengi = [
kanae
kota
lucy
mayu
nana
nyu
];
kaythxbye = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
];
_matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIApAkkhHLj918co/wUGuyW8WCPYHxsNM4uo32XDEu7VV root@matrix";
_md = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdFkdEEDXo8+k5YZpI1O2GqZlxcpCDtxqVun35duITm root@md";
_sql = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcSXjDSyVVVdJbpheOhT0fIuOGFk+jsHhjrAVnBNLQV root@sql";
_www = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@www";
_monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
_dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
_git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
_runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner";
in
{
"matrix_admin_password.age".publicKeys = xengi;
"draupnir_access_token.age".publicKeys = xengi ++ [ _matrix ];
"matrix_signing_key.age".publicKeys = xengi ++ [ _matrix ];
"matrix_registration_shared_secret.age".publicKeys = xengi ++ [ _matrix ];
"matrix_db_password.age".publicKeys = xengi ++ [ _matrix ];
"pushover_app_token.age".publicKeys = xengi ++ [ _matrix ];
"pushover_user_key.age".publicKeys = xengi ++ [ _matrix ];
"hedgedoc_db_password.age".publicKeys = xengi ++ [ _md ];
"grafana_admin_password.age".publicKeys = xengi ++ [ _monitoring ];
"grafana_secret_key.age".publicKeys = xengi ++ [ _monitoring ];
"grafana_basic_auth.age".publicKeys = xengi ++ [ _monitoring ];
"pve-exporter.age".publicKeys = xengi ++ [ _monitoring ];
"postgres-matrix-synapse.age".publicKeys = xengi ++ [
_sql
_matrix
];
"postgres-hedgedoc.age".publicKeys = xengi ++ [
_sql
_md
];
"postgres-grafana.age".publicKeys = xengi ++ [
_sql
_monitoring
];
"postgres-forgejo.age".publicKeys =
xengi
++ kaythxbye
++ [
_sql
_git
];
"postgres-extkuma.age".publicKeys = xengi ++ [ _sql ];
"postgres-baikal.age".publicKeys = xengi ++ [
_sql
_dav
];
"www-staging-htpasswd.age".publicKeys = xengi ++ [ _www ];
"id_ed25519_www-staging.age".publicKeys = xengi;
"id_ed25519_www-production.age".publicKeys = xengi;
"caldav-export-config.age".publicKeys = xengi ++ [ _www ];
"radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
"forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-runner-token-snowden-env.age".publicKeys =
xengi
++ kaythxbye
++ [
_git
_runner
];
"forgejo-runner-token-snowden.age".publicKeys =
xengi
++ kaythxbye
++ [
_git
_runner
];
"forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
"forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
}