From d60d2f7276d0f230dbeecdcb56610b5edb34cfec Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Tue, 18 Aug 2026 19:13:59 +0200 Subject: [PATCH 01/31] disable 2fa requirement --- hosts/git/forgejo.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index f48ec7f..60af999 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -26,7 +26,6 @@ in oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path; }; settings = { - security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all"; session.COOKIE_SECURE = true; log.LEVEL = "Warn"; server = { From ee0fea854cb80fcfc8e143895840fc719e3e0efe Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Tue, 18 Aug 2026 19:14:42 +0200 Subject: [PATCH 02/31] fix state version --- hosts/git/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/git/default.nix b/hosts/git/default.nix index 5ccac8b..3d01d5c 100644 --- a/hosts/git/default.nix +++ b/hosts/git/default.nix @@ -40,5 +40,5 @@ ''; services.openssh.settings.Banner = "/etc/ssh/banner"; - system.stateVersion = "25.11"; + system.stateVersion = "26.05"; } From b16ceb22ee61fd89dcddfb0b70df689ae0ccc7d3 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 21:56:36 +0200 Subject: [PATCH 03/31] add mqtt host --- flake.nix | 10 ++++++++++ hosts/mqtt/default.nix | 39 +++++++++++++++++++++++++++++++++++++++ hosts/mqtt/mosquitto.nix | 36 ++++++++++++++++++++++++++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 hosts/mqtt/default.nix create mode 100644 hosts/mqtt/mosquitto.nix diff --git a/flake.nix b/flake.nix index c03d5d2..989ca94 100644 --- a/flake.nix +++ b/flake.nix @@ -273,6 +273,16 @@ ./hosts/git ]; }; + nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem { + #system = "x86_64-linux"; + #pkgs = import nixpkgs { inherit system; }; + inherit system; + modules = [ + agenix.nixosModules.default + { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } + ./hosts/mqtt + ]; + }; }; #); } diff --git a/hosts/mqtt/default.nix b/hosts/mqtt/default.nix new file mode 100644 index 0000000..d21dfdc --- /dev/null +++ b/hosts/mqtt/default.nix @@ -0,0 +1,39 @@ +{ ... }: + +{ + imports = [ + ../common.nix + ../../services/openssh.nix + ../../services/prometheus-node.nix + ./mqtt.nix + ]; + + networking = { + hostName = "mqtt"; + firewall = { + allowedTCPPorts = [ + 22 # SSH + 80 # HTTP/1 + 443 # HTTP/2 + ]; + allowedUDPPorts = [ + 443 # HTTP/3 + ]; + }; + }; + + environment.etc."ssh/banner".text = '' + __ __ + /\ \__/\ \__ + ___ ___ __\ \ ,_\ \ ,_\ + /' __` __`\ /'__`\ \ \/\ \ \/ + /\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_ + \ \_\ \_\ \_\ \___, \ \__\\ \__\ + \/_/\/_/\/_/\/___/\ \/__/ \/__/ + \ \_\ + \/_/ + ''; + services.openssh.settings.Banner = "/etc/ssh/banner"; + + system.stateVersion = "26.05"; +} diff --git a/hosts/mqtt/mosquitto.nix b/hosts/mqtt/mosquitto.nix new file mode 100644 index 0000000..862f93d --- /dev/null +++ b/hosts/mqtt/mosquitto.nix @@ -0,0 +1,36 @@ +{ ... }: + +{ + services.mosquitto = { + enable = true; + listeners = [ + { + port = 1883; + settings = { + ptotocol = "mqtt"; + }; + } + { + port = 8083; + settings = { + protocol = "websockets"; + }; + } + ]; + settings = { + allow_zero_length_clientid = true; + autosave_interval = 1800; + autosave_on_changes = true; + connection_messages = true; + allow_anonymous = true; + }; + logDest = "stdout"; + logType = [ + "error" + "warning" + "notice" + "information" + ]; + }; +} + From 6628ed9789202a722d0e0456f4a573ba293c0a69 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 22:54:48 +0200 Subject: [PATCH 04/31] add forgejo runner --- flake.nix | 14 +++++- hosts/forgejo-runner/default.nix | 34 +++++++++++++++ hosts/forgejo-runner/forgejo-runner.nix | 52 +++++++++++++++++++++++ hosts/mqtt/default.nix | 39 ----------------- hosts/mqtt/mosquitto.nix | 36 ---------------- secrets/forgejo-runner-token-snowden.age | Bin 1023 -> 1133 bytes secrets/secrets.nix | 3 +- 7 files changed, 100 insertions(+), 78 deletions(-) create mode 100644 hosts/forgejo-runner/default.nix create mode 100644 hosts/forgejo-runner/forgejo-runner.nix delete mode 100644 hosts/mqtt/default.nix delete mode 100644 hosts/mqtt/mosquitto.nix diff --git a/flake.nix b/flake.nix index 989ca94..b31dcbf 100644 --- a/flake.nix +++ b/flake.nix @@ -273,14 +273,24 @@ ./hosts/git ]; }; - nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem { + nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem { #system = "x86_64-linux"; #pkgs = import nixpkgs { inherit system; }; inherit system; modules = [ agenix.nixosModules.default { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } - ./hosts/mqtt + { + age.secrets = { + forgejo-runner-token-snowden = { + file = ./secrets/forgejo-runner-token-snowden.age; + owner = "root"; + group = "root"; + mode = "0444"; + }; + }; + } + ./hosts/forgejo-runner ]; }; }; diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix new file mode 100644 index 0000000..774d39a --- /dev/null +++ b/hosts/forgejo-runner/default.nix @@ -0,0 +1,34 @@ +{ ... }: + +{ + imports = [ + ../common.nix + ../../services/openssh.nix + ../../services/prometheus-node.nix + ./forgejo-runner.nix + ]; + + networking = { + hostName = "forgejo-runner"; + firewall = { + allowedTCPPorts = [ + 22 # SSH + ]; + }; + }; + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto" + ]; + + environment.etc."ssh/banner".text = '' + _ __ __ __ ___ ___ __ _ __ + /\`'__\/\ \/\ \ /' _ `\ /' _ `\ /'__`\/\`'__\ + \ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\ __/\ \ \/ + \ \_\ \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\ + \/_/ \/___/ \/_/\/_/\/_/\/_/\/____/ \/_/ + ''; + services.openssh.settings.Banner = "/etc/ssh/banner"; + + system.stateVersion = "26.05"; +} diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix new file mode 100644 index 0000000..bc17c77 --- /dev/null +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -0,0 +1,52 @@ +{ config, pkgs, ... }: + +{ + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.snowden = { + enable = true; + name = "snowden"; + url = "https://git.berlin.ccc.de"; + labels = [ + "debian-stable:docker://docker.io/debian:stable-slim" + "alpine-latest:docker://docker.io/alpine:latest" + "buildkit:docker://docker.io/moby/buildkit:rootless" + ]; + tokenFile = config.age.secrets.forgejo-runner-token-env.path; + settings = { + runner.labels = { + debian-stable = { + backend = "docker"; + backend-options = { + image = "docker.io/debian:stable-slim"; + platform = "linux/amd64"; + }; + }; + alpine-latest = { + backend = "docker"; + backend-options = { + image = "docker.io/alpine:latest"; + platform = "linux/amd64"; + }; + }; + buildkit = { + backend = "docker"; + backend-options = { + image = "docker.io/moby/buildkit:rootless"; + platform = "linux/amd64"; + }; + }; + }; + server.connections.forgejo = { + url = "https://git.berlin.ccc.de/"; + uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91"; + token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; + }; + container = { + enable_ipv6 = true; + docker_host = "unix:///run/podman/podman.sock"; + }; + }; + }; + }; +} diff --git a/hosts/mqtt/default.nix b/hosts/mqtt/default.nix deleted file mode 100644 index d21dfdc..0000000 --- a/hosts/mqtt/default.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ ... }: - -{ - imports = [ - ../common.nix - ../../services/openssh.nix - ../../services/prometheus-node.nix - ./mqtt.nix - ]; - - networking = { - hostName = "mqtt"; - firewall = { - allowedTCPPorts = [ - 22 # SSH - 80 # HTTP/1 - 443 # HTTP/2 - ]; - allowedUDPPorts = [ - 443 # HTTP/3 - ]; - }; - }; - - environment.etc."ssh/banner".text = '' - __ __ - /\ \__/\ \__ - ___ ___ __\ \ ,_\ \ ,_\ - /' __` __`\ /'__`\ \ \/\ \ \/ - /\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_ - \ \_\ \_\ \_\ \___, \ \__\\ \__\ - \/_/\/_/\/_/\/___/\ \/__/ \/__/ - \ \_\ - \/_/ - ''; - services.openssh.settings.Banner = "/etc/ssh/banner"; - - system.stateVersion = "26.05"; -} diff --git a/hosts/mqtt/mosquitto.nix b/hosts/mqtt/mosquitto.nix deleted file mode 100644 index 862f93d..0000000 --- a/hosts/mqtt/mosquitto.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ ... }: - -{ - services.mosquitto = { - enable = true; - listeners = [ - { - port = 1883; - settings = { - ptotocol = "mqtt"; - }; - } - { - port = 8083; - settings = { - protocol = "websockets"; - }; - } - ]; - settings = { - allow_zero_length_clientid = true; - autosave_interval = 1800; - autosave_on_changes = true; - connection_messages = true; - allow_anonymous = true; - }; - logDest = "stdout"; - logType = [ - "error" - "warning" - "notice" - "information" - ]; - }; -} - diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age index 33ec88e84957aa7ee8eebc00cbdb1e8e14538528..cbe40ad0d258e2e3abc2f8a444107c7c6021b579 100644 GIT binary patch literal 1133 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELX@6FH7@w zDR473Oi#=<%c^uTGJwT@$fUv z^w-aEN%0K~FEjCrN)9p$NjJ_8ODhS>E%h?12t~Kewah0eyj;O3BFtYqFfrHI)HgIe z*F-x%yEHpH-7(2A&$&Fs$1gm@$5-3WGAzQ_z?I9zBhRHEy~NqqwJg)Myu>X#!$3dE z)ZNsgG}J9CImI`>9cK7u0)h{nLH_?vDHFx*)%t>;qD98;6@Gf;V3r@{-PI50# zEYx-~3NPle@H95_a0|%}H7+#v%uOoysz}Ys4~Q~z&Gypwa}UbbP6;ZC2rDis$}2{< z&CR{Q)G%Ek)Xcx!Dc3v5INUud+qKj^D!I%x)zv8?%QB_X$RpIqFWkqoAj-2MxYC5n zKfBPSBFU{FpfbbLC(EED&^sbODI%kw(l;p2tR&bX*;L=NTstY)xXb|Ewj@*k%#c8Z zh(L44B#&}$qudI|0>khUN0&;I$VdxsmwdOh$RbN)!^)_jw5*T-{q$_E;4(7{!|?K4 zOV@wp*{Su>$&~!(1+dLBeoDT!NxPGmX>o5)$W5y74RJH8D9s6qNDIk! z_c5(3H?~Z7in7oS&oNHQ_Af0hu*|6{DM~NrGRbl;GBDFOvo!EDaW(TW%?&E{Gz`qh zsY*4=ws4AcbM`eZF!6Q`@u`gD($&>faEi<*t+a3}_6P~C2rc$Cs&uT#cMQub@Tn{e zcXtla4-78L3lB*T^QemC%1Hg2?(@Z~ce?P}DJj)+W9LWs^0vMe+E{V%yqY05>kqA0 tyiSf~7iB`u*JaIhzWd-dYlPQSw{L=F=?BFa`fK%E?mw2zIilWE4gg_IaTx#r delta 936 zcmaFM@t=KyPJL*Jv6ok*p>~c@g}Zk~d5M8d0<&kuA6UqXlY`Vv1wj;a;c}8c6d^dS7oYEaaNgUq_=xnAeXM4LUD11 zZfc5=si~o*f@_&iQh2#Sj&``eML}+ue^zLLftPbdhFd{Vo@b(|Wnhp;sdGwdq=|Q6 zK~kQ(ky}nSmqm6-wz+FrrbT2xVnAl8WoE8Ps9$7$dQwSbN?AmSYjT!$K}mQ)M7U|_ z#E;_PsfAvth2`Z*Nv;;*nIZb+9;v})g_-__Rff6cY5K+aiDenyj>Sf#1f zf=vv}$|~HQ{GD8ltFpBX^_`2%UA0XN142^V)4Ymv!_r;3%#9;_vx3dNz1*FW9Mkjk zjs3E7Ow05`eO!Hlf^&R*LY<;ae0@Em%%V&tpJf!U&+{$PkFp3X^+-!ib1E^>PRdKS zG|ves&q{VQE(=diw1~D0j^)Fith` z^hozN%J=m!bSW$F&Uf}ij{!IL0#n0ug}k)nV1v?-z(VKTM19LN-@GGFrwkBC&KWG=(VAP=JeUw!RTBNP3?vShPtbMMRw{SYIsj0%rT!vZgF z6OZ(a^o&qL19a<>O#L%M0u{1?ee(T-Eh{~XJcC`lOLDVKJ$;gs^OHk@^UVzOOT4Q} z>O6@!($&>f zNOf~HNJ&d~G0e;|_o?*rt~84Z*Y+?9D9S1_4^MLT@-QyV7c{;)MU|GnzCx X#OD0o`#E3EX$9l#&C^^~3orrz*5Ef& diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 14e5f9c..42f11a6 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -24,6 +24,7 @@ let _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring"; _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav"; _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git"; + _runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner"; in { "matrix_admin_password.age".publicKeys = xengi; @@ -66,7 +67,7 @@ in "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; } From 0ff9ab0f59bc1b5c8e0508b324e91e4aadd7efc8 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 23:03:12 +0200 Subject: [PATCH 05/31] add last secret --- flake.nix | 6 +++ secrets/forgejo-runner-token-snowden-env.age | 40 +++++++++++--------- secrets/secrets.nix | 2 +- 3 files changed, 29 insertions(+), 19 deletions(-) diff --git a/flake.nix b/flake.nix index 904b08d..510479c 100644 --- a/flake.nix +++ b/flake.nix @@ -308,6 +308,12 @@ group = "root"; mode = "0444"; }; + forgejo-runner-token-snowden-env = { + file = ./secrets/forgejo-runner-token-snowden-env.age; + owner = "root"; + group = "root"; + mode = "0444"; + }; }; } ./hosts/forgejo-runner diff --git a/secrets/forgejo-runner-token-snowden-env.age b/secrets/forgejo-runner-token-snowden-env.age index 07ec4ac..e3e4909 100644 --- a/secrets/forgejo-runner-token-snowden-env.age +++ b/secrets/forgejo-runner-token-snowden-env.age @@ -1,19 +1,23 @@ age-encryption.org/v1 --> ssh-ed25519 uH+n1w +KvGqAaNROyE3bbbjwH5UlsC8EEuJsVkvCx58ac+sE4 -E+ZptaFcETE4hYPeHeLTN6Nv15dURwEyvpnkTAZC3y0 --> ssh-ed25519 EvLbWw 7SaKZybSLPBWWR5c7x+77I+3o2VSoAWXEkM402guJzw -i/2BmlC/w4AwQ9FXRPkUF4IqWjDrQIYupNtwa5FTr48 --> ssh-ed25519 dM+fLQ ihhDunwhNoIzkgFu+GlyFXmpFnh7CPUdbqHZG1GrBk0 -2kuiVHb5xR2dZR2K3hnxEE27W8ZTULKSg7jI7Tq1AR0 --> ssh-ed25519 jxWM2Q v6m2gYWR59bnMT0+5bJ6is0n1v+erNJIIdReaxzdYiI -IYL86COa5MQG9hFGadaMbr7tphadgsckYvchf3B1rVU --> ssh-ed25519 /yCUCg z1FrBS/4kUxxOQl1BWcSQczVhrQ3r/zswGhR1MIBNWo -8Ivi+R3gThGkSQe4QmyFIurExpRZCyDjwVNKSYe/fDo --> ssh-ed25519 FGp51g afHNk8lS2oJWDa5YmokpE+kD30eeSZfGb8VFc0r/H2A -pDaCkHvgFeNn3X/wDPe3yAPRV+L/g64dXEEpN+85h10 --> ssh-ed25519 b5OiTQ I9iDVd4KcKpH+nwFNeyGSMIegsux2rDzuB+LnIYCBgk -BbptMjkV3HIisjidsfPBYLU1J1vna2QpWPiR+hkiBe0 --> ssh-ed25519 HaNCag BUbf27o6Ph2p78kpaZO7CsCtpd6wxcBIGk4kUidsrzE -VoFu53x9AGdLDFei5C6D3Oa9UKBEdfxNh+5Nc3gGANw ---- yCHltWgEm8iJbqSTj4sd6MEkUc/KCSQCOvCqWoYgxl8 -vSZ#FY fʋʤp%I熥ESj8NMdm5NdD RВ`d\7컒 \ No newline at end of file +-> ssh-ed25519 uH+n1w 4tK3FMRdPKHv44P532Rz/tcX6q8miYJrgcVB3cxz23w +uXs62N4xtDVr+H1fkZG60vUU84HYdR1kexnIHqtgkdo +-> ssh-ed25519 EvLbWw thiH3XUShIvuJer+juwSO12cNaFOUOyIXhX5SXL1bEU +eMGzE/yPqXOpicH8ltvsgcAKqYcuiYFB/plw36IUjFg +-> ssh-ed25519 dM+fLQ 5U0VVjoa1twnM0E4avwxSiwkEEDqoxRm1lWUUwACtkk +ffCOUuLOkV5ggtoagr0JARDe+pULoxMaJdArJPKVi/Y +-> ssh-ed25519 jxWM2Q ojc8Y/RBIFTDHDjcRw1qDSifpWTIFQYC0Ql1dn6abxM +diQxGCvmWBbFIjhKjPGZvrQyBgWA3INNhVoKcvG6bAc +-> ssh-ed25519 /yCUCg JqVEwPtSOTzSVmOST9sC5NPO0HEvxXe/RpOBIGWsgAw +bAbq4R+5wZWB6cDmsjFtIYwoyqcwEf9UQSFmOhSKqD8 +-> ssh-ed25519 FGp51g oqnuxzMu0HlPwzXLwBAf6us1NwhF77LETuWBAQEQDE8 +I1stznwLmISvL1G+62HAQBAux1zIYV8dEp+jz5KjH7o +-> ssh-ed25519 b5OiTQ /NOtrSFwwJfH96h1PlJRWY31z1bB+P7FIZlDVHhQESw +T8cxnwSROdciAFuMVrfX95IaKWxVVJMWWxZNJVlatAI +-> ssh-ed25519 HaNCag BAO4uDUuZzqnH0PFB23AA/eMWNMZ0cjKqYsNgamVLVA +4FVo/AGOIsdwf4QIxZi9MG+vSGy5YFvFvteqeq8tOD4 +-> ssh-ed25519 cToZIA /FUBnZiOVbZHi0ODkUdABrQUW9HMEH7KYA/PLNJloEU +wKZnt/U+f/4SxKxKol2nmK9x92NF4VK9hB18rTBs/MY +--- m7Kd/PyobnOIdz7O0yh+E9fRdQmxbf3PAPlH3+0X6Mg +Uv :EXJl[$ + + p3hYVǃ}x#4'S ) nڣ0z{O \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 42f11a6..91c10ac 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -66,7 +66,7 @@ in "caldav-export-config.age".publicKeys = xengi ++ [ _www ]; "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; From 2bfd892131d721b1a377af781ad1a5756af8ef1b Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 23:10:22 +0200 Subject: [PATCH 06/31] typo --- flake.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 510479c..48d95b0 100644 --- a/flake.nix +++ b/flake.nix @@ -302,13 +302,13 @@ { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } { age.secrets = { - forgejo-runner-token-snowden = { + forgejo-runner-token = { file = ./secrets/forgejo-runner-token-snowden.age; owner = "root"; group = "root"; mode = "0444"; }; - forgejo-runner-token-snowden-env = { + forgejo-runner-token-env = { file = ./secrets/forgejo-runner-token-snowden-env.age; owner = "root"; group = "root"; From d01553ebfe476439b3fdbc903f356ad3630180f8 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 20 Aug 2026 23:13:33 +0200 Subject: [PATCH 07/31] add podman --- hosts/forgejo-runner/default.nix | 1 + hosts/forgejo-runner/forgejo-runner.nix | 34 +++++++++++++++++++++++++ hosts/forgejo-runner/podman.nix | 26 +++++++++++++++++++ 3 files changed, 61 insertions(+) create mode 100644 hosts/forgejo-runner/podman.nix diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix index 774d39a..e1b9140 100644 --- a/hosts/forgejo-runner/default.nix +++ b/hosts/forgejo-runner/default.nix @@ -5,6 +5,7 @@ ../common.nix ../../services/openssh.nix ../../services/prometheus-node.nix + ./podman.nix ./forgejo-runner.nix ]; diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index bc17c77..00689a7 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -49,4 +49,38 @@ }; }; }; + + systemd = { + services."forgejo-runner-container-updater" = { + description = "Update forgejo runner container images"; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + serviceConfig.Type = "oneshot"; + script = '' + set -uo pipefail + failed=0 + images=( + docker.io/library/debian:stable-slim + docker.io/library/alpine:latest + docker.io/moby/buildkit:latest + ) + for image in "''${images[@]}"; do + echo "Pulling $image..." + if ! ${pkgs.podman}/bin/podman pull "$image"; then + echo "Failed to pull $image" + failed=1 + fi + done + exit $failed + ''; + }; + timers."forgejo-runner-container-updater" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "daily"; + RandomizedDelaySec = "30m"; + Persistent = true; + }; + }; + }; } diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix new file mode 100644 index 0000000..462cadc --- /dev/null +++ b/hosts/forgejo-runner/podman.nix @@ -0,0 +1,26 @@ +{ ... }: + +{ + virtualisation.podman = { + enable = true; + dockerSocket.enable = true; + autoPrune = { + enable = true; + dates = "weekly"; + }; + defaultNetwork.settings = { + dns_enabled = true; + ipv6_enabled = true; + subnets = [ + { + gateway = "10.88.0.1"; + subnet = "10.88.0.0/16"; + } + { + gateway = "fd10:88::1"; + subnet = "fd10:88::/64"; + } + ]; + }; + }; +} From e8afa7c2578c9366f186a3e4fe245a580c0f0f18 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Fri, 21 Aug 2026 09:28:47 +0200 Subject: [PATCH 08/31] remove mqtt --- hosts/monitoring/prometheus.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/hosts/monitoring/prometheus.nix b/hosts/monitoring/prometheus.nix index 64c85a2..f913373 100644 --- a/hosts/monitoring/prometheus.nix +++ b/hosts/monitoring/prometheus.nix @@ -7,7 +7,6 @@ { networking.extraHosts = '' - 2001:678:560:23:3036:24ff:fecf:965b mqtt.club.berlin.ccc.de 2001:678:560:23:be24:11ff:fe37:a49a forgejo-runner.club.berlin.ccc.de ''; @@ -50,7 +49,6 @@ "www.${config.networking.domain}:${toString config.services.prometheus.exporters.node.port}" "dav.${config.networking.domain}:${toString config.services.prometheus.exporters.node.port}" "git.${config.networking.domain}:${toString config.services.prometheus.exporters.node.port}" - "mqtt.club.berlin.ccc.de:9100" "forgejo-runner.club.berlin.ccc.de:9100" ]; } From 01fe415777fb1e293c2a76752bc82aeec27085a2 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Fri, 21 Aug 2026 21:11:40 +0200 Subject: [PATCH 09/31] switch --- hosts/forgejo-runner/forgejo-runner.nix | 2 +- secrets/forgejo-runner-token-snowden-env.age | 42 +++++++++---------- secrets/forgejo-runner-token-snowden.age | Bin 1133 -> 1133 bytes 3 files changed, 21 insertions(+), 23 deletions(-) diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index 00689a7..15cb895 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -39,7 +39,7 @@ }; server.connections.forgejo = { url = "https://git.berlin.ccc.de/"; - uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91"; + uuid = "78cbc26a-09d3-4226-b239-9c2ee146a63f"; token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; }; container = { diff --git a/secrets/forgejo-runner-token-snowden-env.age b/secrets/forgejo-runner-token-snowden-env.age index e3e4909..d101a62 100644 --- a/secrets/forgejo-runner-token-snowden-env.age +++ b/secrets/forgejo-runner-token-snowden-env.age @@ -1,23 +1,21 @@ age-encryption.org/v1 --> ssh-ed25519 uH+n1w 4tK3FMRdPKHv44P532Rz/tcX6q8miYJrgcVB3cxz23w -uXs62N4xtDVr+H1fkZG60vUU84HYdR1kexnIHqtgkdo --> ssh-ed25519 EvLbWw thiH3XUShIvuJer+juwSO12cNaFOUOyIXhX5SXL1bEU -eMGzE/yPqXOpicH8ltvsgcAKqYcuiYFB/plw36IUjFg --> ssh-ed25519 dM+fLQ 5U0VVjoa1twnM0E4avwxSiwkEEDqoxRm1lWUUwACtkk -ffCOUuLOkV5ggtoagr0JARDe+pULoxMaJdArJPKVi/Y --> ssh-ed25519 jxWM2Q ojc8Y/RBIFTDHDjcRw1qDSifpWTIFQYC0Ql1dn6abxM -diQxGCvmWBbFIjhKjPGZvrQyBgWA3INNhVoKcvG6bAc --> ssh-ed25519 /yCUCg JqVEwPtSOTzSVmOST9sC5NPO0HEvxXe/RpOBIGWsgAw -bAbq4R+5wZWB6cDmsjFtIYwoyqcwEf9UQSFmOhSKqD8 --> ssh-ed25519 FGp51g oqnuxzMu0HlPwzXLwBAf6us1NwhF77LETuWBAQEQDE8 -I1stznwLmISvL1G+62HAQBAux1zIYV8dEp+jz5KjH7o --> ssh-ed25519 b5OiTQ /NOtrSFwwJfH96h1PlJRWY31z1bB+P7FIZlDVHhQESw -T8cxnwSROdciAFuMVrfX95IaKWxVVJMWWxZNJVlatAI --> ssh-ed25519 HaNCag BAO4uDUuZzqnH0PFB23AA/eMWNMZ0cjKqYsNgamVLVA -4FVo/AGOIsdwf4QIxZi9MG+vSGy5YFvFvteqeq8tOD4 --> ssh-ed25519 cToZIA /FUBnZiOVbZHi0ODkUdABrQUW9HMEH7KYA/PLNJloEU -wKZnt/U+f/4SxKxKol2nmK9x92NF4VK9hB18rTBs/MY ---- m7Kd/PyobnOIdz7O0yh+E9fRdQmxbf3PAPlH3+0X6Mg -Uv :EXJl[$ - - p3hYVǃ}x#4'S ) nڣ0z{O \ No newline at end of file +-> ssh-ed25519 uH+n1w bp1EvLVub9v6ppLzHkYez8PgU1Mlnm/2GaYn+tVdjgE +4bbbmYqqIkYB3uug+Y2MTlW2r7URu3QYRjfHs6JppDs +-> ssh-ed25519 EvLbWw QWeFZk5fNASwR3iIutHhQp1zO4LFMjc4ZaiM7ch7yiU +LI7VFU5xlzYJO7AEzxFSBJTLjG3IKy0wcRIZ4m2m5rw +-> ssh-ed25519 dM+fLQ 1U6xgX/S5KLO5H/bgd5yQphWcUbnvOgiPrYHPMzIdHc +Tdy1HWJsH06d+g568JG5t76Lj0VISk3XX4/Jxt2FsvY +-> ssh-ed25519 jxWM2Q A9AVs+ovW2czIBXjVMB0urdHk66jlAXD0L3TjVmdtk4 +BR+3DIrI162I3AJv5JSYwxmANoxfqe+E54ESnAfufSA +-> ssh-ed25519 /yCUCg C7Qv+0ZX1+G2aikHtqnw22DUB1MDXsI8tQY/JdwZ7h4 +PpVG78Ob9RNC9KF0OOtsvciwTWhpAU3lXyfsjLUTFl8 +-> ssh-ed25519 FGp51g Xx+aciETooUoFrACeRGHrJH3E7onCLIC+aKWnLiUDXI +kdOUehdreH4UMXB2feOM1hD18uyRQ8223woqfEMkFmc +-> ssh-ed25519 b5OiTQ 7fREKJIt+m6WDc20ouEFkLWWmcYPBVafKRHt4niu1w8 +q3Vs8wKlVLfqtPIe/dUteXxTADOOq0vcjGtIQe4PO8Q +-> ssh-ed25519 HaNCag WZfGqjFrLiEhDPDPrQsbAkdI1A1G6mygFEMvDwJSEDI ++lhQOzJbxIrRWcmSiC9Po6M+NKFrErEB2ZHpFKyQ70U +-> ssh-ed25519 cToZIA QqrOxRVOxcrAU4nOoNVhvn9veQk8jSeJ+uYOMlq3+Hw +p+uPIgeZ/kegqQzufkWNk35ZfglE+63KOOYT/VDA1pw +--- WYlIa+76j+TDCYx9LhYRfwNIw1JNLe7HxsSvEeFmDS4 +lM|Sá놆c|2R d-،z7㗥s\A"vz,.]ܹ{A٩ \ No newline at end of file diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age index cbe40ad0d258e2e3abc2f8a444107c7c6021b579..5ad8cbe22b83316d8c4a763b6ae0d9a57bddc85c 100644 GIT binary patch literal 1133 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELSKiHuH-L zb+;%ja?#fI56Y|X53wah0eyj-E&yD%&xJ25ic*SsJk zBEq;xyRtMjG%qjT&pFJoC_FXY$-m6U*x%5&DwL}@urwk&D%dH~%-G#D%Be6=zdWiq zCqKO;valpQ$|$J3BGA9suQ1aq)Dhjb6kqK$pFoAM5O1HNuv9}Ii!vkabYJ&iFIT7B z5>tQA#IUpqH?y*m%D{4`j3g7Es&Xz<(^ z)2bpu-3`!f)30<6bxv0>@+~wmFwZuR@(Q#_ipZ(-EDtnrOfHRb%C7P;G)plw)Gsef zi3m3}cJ|~7%`LZZ4b=8@4A-v+&xk5dc2D%qHmb-sEcFVj$_UBK%8$&;3JCW~HN&vY z&Aq_XFkQhoAUWST*TTXu+_)^yPv1Geu*BH6tkO8!EX6X&JtM>CncmjFfGR`($k_O%00;=wJ6)%C&?|*FEqFyOFJpbHy_<^Nv8gpA%O~& zIfX_h`iZ5^fu0#2C8^rw?rtu@mfB?*hEXn_`Ua)N72!F_85X%&q3K-O6=fkAPGOE7 z;em8JUJ@MQL6ZhDF|%ImQ)W`=TkRJx`6mgM+klobaSREA|l z_?aaqd3b22MLAVghB;*gmv|&5=31mi1!ClYYDFjF6I zLyHWLqQHDh?J$4+a!0O(hu;5DZT9>2?$aj;HJ^vaSAIC1H0i|u&ZXIMX;C@W$?Y$H sZMgcv>Wi@A-;?P{d+Zi2>e<6!s#x;uoDHj5uf0EqkL1*?EmH(r075x=cmMzZ literal 1133 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELX@6FH7@w zDR473Oi#=<%c^uTGJwT@$fUv z^w-aEN%0K~FEjCrN)9p$NjJ_8ODhS>E%h?12t~Kewah0eyj;O3BFtYqFfrHI)HgIe z*F-x%yEHpH-7(2A&$&Fs$1gm@$5-3WGAzQ_z?I9zBhRHEy~NqqwJg)Myu>X#!$3dE z)ZNsgG}J9CImI`>9cK7u0)h{nLH_?vDHFx*)%t>;qD98;6@Gf;V3r@{-PI50# zEYx-~3NPle@H95_a0|%}H7+#v%uOoysz}Ys4~Q~z&Gypwa}UbbP6;ZC2rDis$}2{< z&CR{Q)G%Ek)Xcx!Dc3v5INUud+qKj^D!I%x)zv8?%QB_X$RpIqFWkqoAj-2MxYC5n zKfBPSBFU{FpfbbLC(EED&^sbODI%kw(l;p2tR&bX*;L=NTstY)xXb|Ewj@*k%#c8Z zh(L44B#&}$qudI|0>khUN0&;I$VdxsmwdOh$RbN)!^)_jw5*T-{q$_E;4(7{!|?K4 zOV@wp*{Su>$&~!(1+dLBeoDT!NxPGmX>o5)$W5y74RJH8D9s6qNDIk! z_c5(3H?~Z7in7oS&oNHQ_Af0hu*|6{DM~NrGRbl;GBDFOvo!EDaW(TW%?&E{Gz`qh zsY*4=ws4AcbM`eZF!6Q`@u`gD($&>faEi<*t+a3}_6P~C2rc$Cs&uT#cMQub@Tn{e zcXtla4-78L3lB*T^QemC%1Hg2?(@Z~ce?P}DJj)+W9LWs^0vMe+E{V%yqY05>kqA0 tyiSf~7iB`u*JaIhzWd-dYlPQSw{L=F=?BFa`fK%E?mw2zIilWE4gg_IaTx#r From 37d87ae1dc25e492563b8a55fb7c3dcb79f86580 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Fri, 21 Aug 2026 22:27:53 +0200 Subject: [PATCH 10/31] update ssh keys --- hosts/www/openssh.nix | 4 ++-- secrets/id_ed25519_www-production.age | Bin 0 -> 1194 bytes secrets/id_ed25519_www-staging.age | Bin 0 -> 1194 bytes secrets/secrets.nix | 2 ++ 4 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 secrets/id_ed25519_www-production.age create mode 100644 secrets/id_ed25519_www-staging.age diff --git a/hosts/www/openssh.nix b/hosts/www/openssh.nix index 288b5d3..a16c870 100644 --- a/hosts/www/openssh.nix +++ b/hosts/www/openssh.nix @@ -8,8 +8,8 @@ isSystemUser = true; group = "deploy"; openssh.authorizedKeys.keys = [ - "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35LG+xuDaoHQ2bYD4eRc3P6Cl3JVYntoP5Gu9R+mZC deploy@www.berlin.ccc.de production" - "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjjLtnGf7w5D/ON+P2HpMZ5HA2fWp5YSQMGMuu5CjUt deploy@www.berlin.ccc.de staging" + "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTUmrD0RMS0atfreGYjobnxBhppqo5XDEOUkLgUMWpD deploy@www.berlin.ccc.de production" + "command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIenjEIMaOclgb+vg/LZf2P/eF9J1MaAHpSlYpmtKToB deploy@www.berlin.ccc.de staging" ]; }; groups.deploy = { }; diff --git a/secrets/id_ed25519_www-production.age b/secrets/id_ed25519_www-production.age new file mode 100644 index 0000000000000000000000000000000000000000..d0388d24fb1c0933b30894afe9944da078f5d970 GIT binary patch literal 1194 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELZRiDfcza zF)l66(>4vsEGhRY@^`8z4t3QJ_tbYTv<&u2uP6=*&D8b{jpQ;YNHj~UswnexE~)en z%FD_za&plQ3JfrbaPZdEVHz%$}-)#FtNlb(;&6V$h*+P z->0OcD8R!bx7gJzC@91{#3C&`qZr+`6kqK$pFjntGH36cQcKg+`~ahT$I!@}z`#(m zwB%%y2m}AH9M3Y}sLa4pHw(|w5JxV9N&~}8laR`wsEmSQzqAzBGM^BaVE=UQ(4xSC z%rr|Q|Dx1zZSSmf$8vPrvMR!TjRF;lGD93qjC}*W+)GQd)3XBgs|*YMLM_eA96j_4 z9E-d&1IqpLE%cMivwXR{0~4LK%S)0{EwaPIit_@J(%q6RgB{IEBPs%OvnpK@y-Q2{ zD!jF|4KZxfuXGM|PFHaCuT0G>3(5Bn3-FaW1yeAk!4A+WmRQ*RE0rSWO1sSNoh``VToCAu_KqRuC79$YmP;6 zR=IOPRIW*yacE_Rg^9LNNs42!ca~|YNs&cpVU@3Iig8J0S|Ha7&jodF-W@cw*}Tjz z^;P7XI|n0t>WtXlRI}+EuS>GN?dvVn(YXA#U1g}Ngl3hn?ZnjbPtmj2+uPauF<7;* zy65eQWv%+lE~;6ied(o(%&M)6-4gzasvdi<&GusYQt`ri*_UB|j~;z+?T%c}T&DT9 z%?gfo=Hls5%Qb^LFQgqh|C-^~o{!UyZd(wRR&ZeR34uaOpS#~q?wYB-E)=?4 zF=5*3F4o}di3%d?RibB|&?E*vqEdXTQb0cE{7pQ8QkorR(Jv zx%>28;gOi&XyZC5+wHPTXvOOOLf?;XZ=Ts3|2}WJn3Q9FbWZUdgraXwCnDTPoA9)obM#w_vW-&zU8g2s_*tJEtb_wYhGhH zvFexn#M-4l|1%aV-E6++Gt+I$HMh!xCBls_DsMiUy|;l$y;m`YZNkmsjt3GbJ@8%T>G3DA+qQ!_X-`ESt-s)Fd@Kzs$(cxyZxOvmnz_KO;HF zqC7AxyE3ZG!>~BbCnH=x!_v*N1jDuzU+pxXKn49$^K|`;A~Vxm?bNVhw{pi6b8~kW zuTrl-&-Bd5piq+vQ*B=_chB5(S1#j<+)(HARM+yXlBg`>R0Hp*0R4dUO8rV#lS)5h z^Ypw*?*aqusEqV<3v|C_RfPK*1u8@Z1{H;eI|uqEmt|`k`xu&em}WT#l$2+h`)3B` zxaauhrj!}@dF6XK6?0{WXPc!s6&m_vc)R5#dj#hhCi(b=mwS{HmIoGwlp2@h=ah$- z6}W^L_@djUU+Em`oUTxqXjod{n^bO^?BZ|kot+*Q8sbvmYM2?3Y?7Ddmz+_Rn&cZ9 zYGCN%?#ks6UJ@Fat?d>VuAQCi=k4v4ml7D{4k66&AlmYh{euT23lIW2z7o zm6&+s*WvRH2~80uh24RTIf+8Pr=xD{xF&t|2TSaX>`3$I%9r{ISN~0}_W3BT7d1i9R8X2>I|7YiN3!D3u7If5}dw$ zPq@Rd;>pGbQH=Ue-YFaS{(rzO7RxQW-}kAGS5N(pGctxz4nO$Zr+F#42Uq3YI?%V^ zf|%m9C`-n>@2=Z^bTUoR6%pBf+wZ+uFw5Mz@tnyM{=YraRduOKRqxDBP5Df3o`mWd z*EX6do$6tI%W;S+cjx<%Y1t(^-!%P;&Jzedsp-$l;U~Y*a#_dL+zp14wU!HnBL>|NJVgbLWDBURS@|AHMGFo~qd&gIwDhUM&+^pcJ&W)i%8;raN$h L(XoB Date: Fri, 21 Aug 2026 23:43:55 +0200 Subject: [PATCH 11/31] fix network --- hosts/forgejo-runner/forgejo-runner.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index 15cb895..708158b 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -44,6 +44,9 @@ }; container = { enable_ipv6 = true; + network = "podman"; + privileged = true; + force_pull = true; docker_host = "unix:///run/podman/podman.sock"; }; }; From 51c20a6579d92183486d1f1fc11997c1caffb5d4 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Fri, 21 Aug 2026 23:52:29 +0200 Subject: [PATCH 12/31] fix ipv6 --- hosts/forgejo-runner/podman.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix index 462cadc..ed956b1 100644 --- a/hosts/forgejo-runner/podman.nix +++ b/hosts/forgejo-runner/podman.nix @@ -1,6 +1,8 @@ { ... }: { + boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true; + virtualisation.podman = { enable = true; dockerSocket.enable = true; From 3d3dff4f2718ffe5439b20e504ad30346c3aa230 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 00:42:35 +0200 Subject: [PATCH 13/31] ipv6 is broken for now --- hosts/forgejo-runner/forgejo-runner.nix | 2 +- hosts/forgejo-runner/podman.nix | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index 708158b..6248170 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -43,7 +43,7 @@ token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; }; container = { - enable_ipv6 = true; + #enable_ipv6 = true; network = "podman"; privileged = true; force_pull = true; diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix index ed956b1..eaefd40 100644 --- a/hosts/forgejo-runner/podman.nix +++ b/hosts/forgejo-runner/podman.nix @@ -1,7 +1,7 @@ { ... }: { - boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true; + #boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true; virtualisation.podman = { enable = true; @@ -12,16 +12,16 @@ }; defaultNetwork.settings = { dns_enabled = true; - ipv6_enabled = true; + #ipv6_enabled = true; subnets = [ { gateway = "10.88.0.1"; subnet = "10.88.0.0/16"; } - { - gateway = "fd10:88::1"; - subnet = "fd10:88::/64"; - } + #{ + # gateway = "fd10:88::1"; + # subnet = "fd10:88::/64"; + #} ]; }; }; From 5ab92fc676b973097549f4f4d2d9851b39b2928c Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 12:12:39 +0200 Subject: [PATCH 14/31] add ipv6 --- hosts/forgejo-runner/forgejo-runner.nix | 4 ++-- hosts/forgejo-runner/podman.nix | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index 6248170..7b77981 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -43,8 +43,8 @@ token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; }; container = { - #enable_ipv6 = true; - network = "podman"; + enable_ipv6 = true; + network = "forgejo"; privileged = true; force_pull = true; docker_host = "unix:///run/podman/podman.sock"; diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix index eaefd40..ed956b1 100644 --- a/hosts/forgejo-runner/podman.nix +++ b/hosts/forgejo-runner/podman.nix @@ -1,7 +1,7 @@ { ... }: { - #boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true; + boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true; virtualisation.podman = { enable = true; @@ -12,16 +12,16 @@ }; defaultNetwork.settings = { dns_enabled = true; - #ipv6_enabled = true; + ipv6_enabled = true; subnets = [ { gateway = "10.88.0.1"; subnet = "10.88.0.0/16"; } - #{ - # gateway = "fd10:88::1"; - # subnet = "fd10:88::/64"; - #} + { + gateway = "fd10:88::1"; + subnet = "fd10:88::/64"; + } ]; }; }; From 316dcc2c953c891c05727d3e89cd8d2a5b0cfb04 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 15:19:57 +0200 Subject: [PATCH 15/31] fix dns --- hosts/forgejo-runner/podman.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/hosts/forgejo-runner/podman.nix b/hosts/forgejo-runner/podman.nix index ed956b1..c116012 100644 --- a/hosts/forgejo-runner/podman.nix +++ b/hosts/forgejo-runner/podman.nix @@ -1,7 +1,15 @@ { ... }: { - boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true; + boot.kernel.sysctl = { + "net.ipv6.conf.all.forwarding" = true; + "net.ipv4.conf.all.forwarding" = true; + }; + + networking.firewall.interfaces.podman1 = { + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 ]; + }; virtualisation.podman = { enable = true; From dfc2574653f4ccb37c0dee1fb6aa13ca23306a4e Mon Sep 17 00:00:00 2001 From: xengi Date: Sat, 22 Aug 2026 15:25:24 +0200 Subject: [PATCH 16/31] Add .forgejo/workflows/forgejo-tests.yaml Signed-off-by: xengi --- .forgejo/workflows/forgejo-tests.yaml | 38 +++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .forgejo/workflows/forgejo-tests.yaml diff --git a/.forgejo/workflows/forgejo-tests.yaml b/.forgejo/workflows/forgejo-tests.yaml new file mode 100644 index 0000000..e752b3a --- /dev/null +++ b/.forgejo/workflows/forgejo-tests.yaml @@ -0,0 +1,38 @@ +name: Test Forgejo setup + +on: + push: + workflow_dispatch: + +env: + TEST_URL: berlin.ccc.de + +jobs: + build: + runs-on: debian-stable + name: Test setup + steps: + - name: Check env + run: env + - name: Install tools + run: | + apt-get update + apt-get install -y --no-install-recommends curl ca-certificates inetutils-ping iproute2 git + - name: Check resolv.conf + run: cat /etc/resolv.conf + - name: Check IP config + run: ip address + - name: Check IPv4 route + run: ip -4 route + - name: Check IPv6 route + run: ip -6 route + - name: Check IPv4 internet + run: ping -c4 1.1.1.1 + - name: Check IPv6 internet + run: ping6 -c4 2606:4700:4700::1111 + - name: Check IPv4 HTTP + run: curl -4 -vfSLo /dev/null ${{ env.TEST_URL }} + - name: Check IPv6 HTTP + run: curl -6 -vfSLo /dev/null ${{ env.TEST_URL }} + - name: Check out the repository + run: git clone ${{ env.FORGEJO_SERVER_URL }}/${{ env.FORGEJO_REPOSITORY }} . \ No newline at end of file From 1759ef44b0428736c7426a6c2e37948b003139fa Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 15:28:56 +0200 Subject: [PATCH 17/31] add nix --- hosts/forgejo-runner/forgejo-runner.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix index 7b77981..6c97af6 100644 --- a/hosts/forgejo-runner/forgejo-runner.nix +++ b/hosts/forgejo-runner/forgejo-runner.nix @@ -10,6 +10,7 @@ labels = [ "debian-stable:docker://docker.io/debian:stable-slim" "alpine-latest:docker://docker.io/alpine:latest" + "nix-latest:docker://docker.io/nixos/nix:latest" "buildkit:docker://docker.io/moby/buildkit:rootless" ]; tokenFile = config.age.secrets.forgejo-runner-token-env.path; @@ -65,6 +66,7 @@ images=( docker.io/library/debian:stable-slim docker.io/library/alpine:latest + docker.io/nixos/nix:latest docker.io/moby/buildkit:latest ) for image in "''${images[@]}"; do From 7beec0aa55d94c7d569cab2f7b6655c48ed80173 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 15:29:03 +0200 Subject: [PATCH 18/31] fmt --- hosts/monitoring/prometheus.nix | 4 +++- secrets/secrets.nix | 24 +++++++++++++++++++++--- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/hosts/monitoring/prometheus.nix b/hosts/monitoring/prometheus.nix index f913373..c14b3a9 100644 --- a/hosts/monitoring/prometheus.nix +++ b/hosts/monitoring/prometheus.nix @@ -32,7 +32,9 @@ scrape_interval = "15s"; static_configs = [ { - targets = [ "sql.${config.networking.domain}:${toString config.services.prometheus.exporters.postgres.port}" ]; + targets = [ + "sql.${config.networking.domain}:${toString config.services.prometheus.exporters.postgres.port}" + ]; } ]; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index f343c2c..60673b9 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -56,7 +56,13 @@ in _sql _monitoring ]; - "postgres-forgejo.age".publicKeys = xengi ++ kaythxbye ++ [ _sql _git ]; + "postgres-forgejo.age".publicKeys = + xengi + ++ kaythxbye + ++ [ + _sql + _git + ]; "postgres-extkuma.age".publicKeys = xengi ++ [ _sql ]; "postgres-baikal.age".publicKeys = xengi ++ [ _sql @@ -68,8 +74,20 @@ in "caldav-export-config.age".publicKeys = xengi ++ [ _www ]; "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; - "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; - "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ]; + "forgejo-runner-token-snowden-env.age".publicKeys = + xengi + ++ kaythxbye + ++ [ + _git + _runner + ]; + "forgejo-runner-token-snowden.age".publicKeys = + xengi + ++ kaythxbye + ++ [ + _git + _runner + ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; } From bbd4c893d9f21cedbcc108985153d6a5f8e17b8d Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 15:37:28 +0200 Subject: [PATCH 19/31] add more tests --- .forgejo/workflows/nix-tests.yaml | 22 ++++++++++++++++++++++ flake.nix | 2 +- 2 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 .forgejo/workflows/nix-tests.yaml diff --git a/.forgejo/workflows/nix-tests.yaml b/.forgejo/workflows/nix-tests.yaml new file mode 100644 index 0000000..65e4709 --- /dev/null +++ b/.forgejo/workflows/nix-tests.yaml @@ -0,0 +1,22 @@ +name: Test Nix flake + +on: + push: + workflow_dispatch: + +jobs: + nix: + runs-on: nix-latest + name: Test nix flake + steps: + - name: Checkout repository + run: git clone ${{ env.FORGEJO_SERVER_URL }}/${{ env.FORGEJO_REPOSITORY }} . + - name: Run formatter + run: nix fmt + - name: Check flake + run: nix flake check + - name: Show metadata + run: nix flake metadata + - name: Show content + run: nix flake show + diff --git a/flake.nix b/flake.nix index 48d95b0..0d97273 100644 --- a/flake.nix +++ b/flake.nix @@ -23,7 +23,7 @@ in { formatter.${system} = pkgs.nixfmt-tree; - apps = { + apps.${system} = { nixos-diff = { type = "app"; program = "${pkgs.writeShellScript "nixos-diff.sh" '' From 4a9e9a6c44d4b26b469fcfd38c445a56e0628c8c Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sat, 22 Aug 2026 15:41:42 +0200 Subject: [PATCH 20/31] badges --- .forgejo/workflows/{forgejo-tests.yaml => forgejo.yaml} | 0 .forgejo/workflows/{nix-tests.yaml => nix.yaml} | 0 README.md | 2 ++ 3 files changed, 2 insertions(+) rename .forgejo/workflows/{forgejo-tests.yaml => forgejo.yaml} (100%) rename .forgejo/workflows/{nix-tests.yaml => nix.yaml} (100%) diff --git a/.forgejo/workflows/forgejo-tests.yaml b/.forgejo/workflows/forgejo.yaml similarity index 100% rename from .forgejo/workflows/forgejo-tests.yaml rename to .forgejo/workflows/forgejo.yaml diff --git a/.forgejo/workflows/nix-tests.yaml b/.forgejo/workflows/nix.yaml similarity index 100% rename from .forgejo/workflows/nix-tests.yaml rename to .forgejo/workflows/nix.yaml diff --git a/README.md b/README.md index d3e2506..8638831 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,6 @@ [![Please don't upload to GitHub](https://nogithub.codeberg.page/badge.svg)](https://nogithub.codeberg.page) +[![Forgejo](https://git.berlin.ccc.de/xengi/infra/actions/workflows/forgejo.yaml/badge.svg)](https://git.berlin.ccc.de/xengi/infra/actions/workflows/forgejo.yaml) +[![Nix](https://git.berlin.ccc.de/xengi/infra/actions/workflows/nix.yaml/badge.svg)](https://git.berlin.ccc.de/xengi/infra/actions/workflows/nix.yaml) # Nix based CCCB infra From 4b148118e1636463069fd284bb8c53659dc80073 Mon Sep 17 00:00:00 2001 From: xengi Date: Sat, 22 Aug 2026 15:42:34 +0200 Subject: [PATCH 21/31] Update .forgejo/workflows/forgejo.yaml --- .forgejo/workflows/forgejo.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.forgejo/workflows/forgejo.yaml b/.forgejo/workflows/forgejo.yaml index e752b3a..ac48511 100644 --- a/.forgejo/workflows/forgejo.yaml +++ b/.forgejo/workflows/forgejo.yaml @@ -1,7 +1,6 @@ name: Test Forgejo setup on: - push: workflow_dispatch: env: From 0c25d416c6e0e76f71358bef538a2019771b8989 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Tue, 25 Aug 2026 09:35:12 +0200 Subject: [PATCH 22/31] fix calendar export --- hosts/www/caldav-export.py | 80 ++++++++++++++++++++++++++++++++------ 1 file changed, 69 insertions(+), 11 deletions(-) diff --git a/hosts/www/caldav-export.py b/hosts/www/caldav-export.py index 8ef1130..814a54b 100644 --- a/hosts/www/caldav-export.py +++ b/hosts/www/caldav-export.py @@ -1,5 +1,4 @@ import argparse -import os import re from pathlib import Path @@ -12,7 +11,12 @@ def safe_filename(name: str) -> str: return re.sub(r"[^a-zA-Z0-9._-]+", "_", name) -def export_calendar(url: str, username: str, password: str, calendar: str) -> Calendar: +def export_calendar( + url: str, + username: str, + password: str, + calendar: str, +) -> Calendar: client = DAVClient( url=url, username=username, @@ -58,13 +62,45 @@ def export_calendar(url: str, username: str, password: str, calendar: str) -> Ca cal = Calendar.from_ical(data) - for component in cal.walk(): - if component.name != "VCALENDAR": - result.add_component(component) + # Only copy top-level components. + # + # Do NOT use cal.walk() here. walk() also returns the + # STANDARD/DAYLIGHT components inside VTIMEZONE. + for component in cal.subcomponents: + result.add_component(component) return result +def add_normalized_components( + target: Calendar, + source: Calendar, + timezones: dict[str, object], +) -> None: + """ + Add components from source to target while collecting VTIMEZONE + components separately. + + Exactly one VTIMEZONE is retained for each TZID. + """ + + for component in source.subcomponents: + if component.name == "VTIMEZONE": + tzid = component.get("TZID") + + if tzid is None: + print(" warning: ignoring VTIMEZONE without TZID") + continue + + tzid = str(tzid) + + if tzid not in timezones: + timezones[tzid] = component + + else: + target.add_component(component) + + def main(): parser = argparse.ArgumentParser() parser.add_argument("config") @@ -81,12 +117,16 @@ def main(): output_dir = Path(args.output) output_dir.mkdir(parents=True, exist_ok=True) + username = config["username"] + password = config["password"] + combined = Calendar() combined.add("prodid", "-//Combined calendar//") combined.add("version", "2.0") - username = config["username"] - password = config["password"] + # TZID -> VTIMEZONE component + timezones = {} + for entry in config["calendars"]: cal = export_calendar( entry["url"], @@ -97,19 +137,37 @@ def main(): filename = output_dir / f"{safe_filename(entry['calendar'])}.ics" + # Individual calendar export stays as-is. with open(filename, "wb") as f: f.write(cal.to_ical()) print(f" -> {filename}") - for component in cal.walk(): - if component.name != "VCALENDAR": - combined.add_component(component) + # Normalize components for the combined calendar. + add_normalized_components( + combined, + cal, + timezones, + ) + + # Add each VTIMEZONE exactly once. + # + # Put them before events/components in the resulting VCALENDAR. + normalized = Calendar() + normalized.add("prodid", "-//Combined calendar//") + normalized.add("version", "2.0") + + for tzid, timezone in timezones.items(): + print(f" timezone: {tzid}") + normalized.add_component(timezone) + + for component in combined.subcomponents: + normalized.add_component(component) combined_file = output_dir / "all.ics" with open(combined_file, "wb") as f: - f.write(combined.to_ical()) + f.write(normalized.to_ical()) print() print(f"Combined export: {combined_file}") From be2558af316c7578408602f545b0199c9c553633 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Wed, 26 Aug 2026 00:13:42 +0200 Subject: [PATCH 23/31] no dump --- hosts/git/forgejo.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index 60af999..79df826 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -61,11 +61,6 @@ in metrics.ENABLED = true; }; lfs.enable = true; - dump = { - enable = true; - type = "tar.zst"; - interval = "daily"; - }; database = { createDatabase = false; host = "sql.${config.networking.domain}"; From b4728aba3fa466660fec59bc12d6164d2f12bdcf Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Wed, 26 Aug 2026 10:11:32 +0200 Subject: [PATCH 24/31] prevent robots from crawling archives --- hosts/git/forgejo.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index 79df826..11490d6 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -98,6 +98,12 @@ in deny all; ''; }; + "= /robots.txt" = { + extraConfig = '' + default_type text/plain; + return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; + ''; + }; }; }; }; From b5f32d956470d107a2f7ec96b96fbfe7a2e361cd Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Wed, 26 Aug 2026 10:36:45 +0200 Subject: [PATCH 25/31] archive cleanup --- hosts/git/forgejo.nix | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index 11490d6..7938e52 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -53,12 +53,13 @@ in SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp"; SENDMAIL_ARGS = "--"; }; - cors = { - ENABLED = false; - ALLOW_DOMAIN = "https://git.berlin.ccc.de"; - ALLOW_CREDENTIALS = true; - }; metrics.ENABLED = true; + "cron.archive_cleanup" = { + ENABLED = true; + RUN_AT_START = true; + SCHEDULE = "@every 4h"; + OLDER_THAN = "4h"; + }; }; lfs.enable = true; database = { @@ -98,12 +99,13 @@ in deny all; ''; }; - "= /robots.txt" = { - extraConfig = '' - default_type text/plain; - return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; - ''; - }; + "~ ^/[^/]+/[^/]+/archive/".extraConfig = '' + limit_req zone=forgejo_archive burst=10 nodelay; + ''; + "= /robots.txt".extraConfig = '' + default_type text/plain; + return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; + ''; }; }; }; From 26cb48327e9c837d75a90fc0ccba81dc525bb6ce Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Wed, 26 Aug 2026 10:39:34 +0200 Subject: [PATCH 26/31] fix nginx --- hosts/git/forgejo.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index 7938e52..a4cb3d0 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -73,7 +73,11 @@ in }; }; - nginx.virtualHosts."${fqdn}" = { + nginx = { + appendHttpConfig = '' + limit_req_zone $binary_remote_addr zone=forgejo_archive:10m rate=2r/s; + ''; + virtualHosts."${fqdn}" = { quic = true; kTLS = true; forceSSL = true; From 1c3c8710da07623c6e5329edbb1e7d6d2da051df Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Wed, 26 Aug 2026 10:40:21 +0200 Subject: [PATCH 27/31] typo --- hosts/git/forgejo.nix | 61 ++++++++++++++++++++++--------------------- 1 file changed, 31 insertions(+), 30 deletions(-) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index a4cb3d0..e111592 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -78,38 +78,39 @@ in limit_req_zone $binary_remote_addr zone=forgejo_archive:10m rate=2r/s; ''; virtualHosts."${fqdn}" = { - quic = true; - kTLS = true; - forceSSL = true; - enableACME = true; - extraConfig = '' - merge_slashes off; # Required to handle URL-encoded slashes - ''; - locations = { - "/" = { - recommendedProxySettings = true; - proxyWebsockets = true; - proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; - extraConfig = '' - client_max_body_size 512M; + quic = true; + kTLS = true; + forceSSL = true; + enableACME = true; + extraConfig = '' + merge_slashes off; # Required to handle URL-encoded slashes + ''; + locations = { + "/" = { + recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; + extraConfig = '' + client_max_body_size 512M; + ''; + }; + "/metrics" = { + recommendedProxySettings = true; + proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; + extraConfig = '' + allow 195.160.173.14; + allow 2001:678:760:cccb::14; + deny all; + ''; + }; + "~ ^/[^/]+/[^/]+/archive/".extraConfig = '' + limit_req zone=forgejo_archive burst=10 nodelay; + ''; + "= /robots.txt".extraConfig = '' + default_type text/plain; + return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; ''; }; - "/metrics" = { - recommendedProxySettings = true; - proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; - extraConfig = '' - allow 195.160.173.14; - allow 2001:678:760:cccb::14; - deny all; - ''; - }; - "~ ^/[^/]+/[^/]+/archive/".extraConfig = '' - limit_req zone=forgejo_archive burst=10 nodelay; - ''; - "= /robots.txt".extraConfig = '' - default_type text/plain; - return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; - ''; }; }; }; From 8e909686eeba4837fa9900b8c5e5e7a8ab4152b3 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sun, 6 Sep 2026 01:43:06 +0200 Subject: [PATCH 28/31] migrate to new server --- services/prometheus-nginx.nix | 4 ++-- services/prometheus-node.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/services/prometheus-nginx.nix b/services/prometheus-nginx.nix index be4bed0..bba40a4 100644 --- a/services/prometheus-nginx.nix +++ b/services/prometheus-nginx.nix @@ -6,9 +6,9 @@ openFirewall = true; firewallRules = '' ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a03:4000:3b:28b::1/128 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 185.163.117.133/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; }; } diff --git a/services/prometheus-node.nix b/services/prometheus-node.nix index bc93dcc..a840d3e 100644 --- a/services/prometheus-node.nix +++ b/services/prometheus-node.nix @@ -6,9 +6,9 @@ openFirewall = true; firewallRules = '' ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a03:4000:3b:28b::1/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 185.163.117.133/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; enabledCollectors = [ ]; disabledCollectors = [ ]; From 409b6e09f57d0a7ed629837ddfdeda9223da28fe Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sun, 6 Sep 2026 01:43:06 +0200 Subject: [PATCH 29/31] migrate to new server --- hosts/sql/prometheus-postgres.nix | 4 ++-- services/prometheus-nginx.nix | 4 ++-- services/prometheus-node.nix | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/hosts/sql/prometheus-postgres.nix b/hosts/sql/prometheus-postgres.nix index d5418c5..5e68a7a 100644 --- a/hosts/sql/prometheus-postgres.nix +++ b/hosts/sql/prometheus-postgres.nix @@ -7,9 +7,9 @@ runAsLocalSuperUser = true; firewallRules = '' ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a03:4000:3b:28b::1/128 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 185.163.117.133/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; }; } diff --git a/services/prometheus-nginx.nix b/services/prometheus-nginx.nix index be4bed0..bba40a4 100644 --- a/services/prometheus-nginx.nix +++ b/services/prometheus-nginx.nix @@ -6,9 +6,9 @@ openFirewall = true; firewallRules = '' ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a03:4000:3b:28b::1/128 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 185.163.117.133/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; }; } diff --git a/services/prometheus-node.nix b/services/prometheus-node.nix index bc93dcc..a840d3e 100644 --- a/services/prometheus-node.nix +++ b/services/prometheus-node.nix @@ -6,9 +6,9 @@ openFirewall = true; firewallRules = '' ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a03:4000:3b:28b::1/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 185.163.117.133/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; enabledCollectors = [ ]; disabledCollectors = [ ]; From fdd6569d3f24f017fbe3840d3a527ccd0eee3a78 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Mon, 7 Sep 2026 23:31:29 +0200 Subject: [PATCH 30/31] add Forwarded header --- hosts/git/forgejo.nix | 1 + hosts/matrix/synapse.nix | 1 + hosts/md/hedgedoc.nix | 4 ++++ hosts/monitoring/grafana.nix | 6 ++++++ services/nginx.nix | 21 +++++++++++++++++++++ 5 files changed, 33 insertions(+) diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index e111592..f8ba6e3 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -92,6 +92,7 @@ in proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; extraConfig = '' client_max_body_size 512M; + proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme"; ''; }; "/metrics" = { diff --git a/hosts/matrix/synapse.nix b/hosts/matrix/synapse.nix index 9a633e5..0d51d8e 100644 --- a/hosts/matrix/synapse.nix +++ b/hosts/matrix/synapse.nix @@ -82,6 +82,7 @@ client_max_body_size 64M; proxy_set_header X-Request-ID $request_id; proxy_http_version 1.1; + proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme"; ''; }; "/_synapse/metrics" = { diff --git a/hosts/md/hedgedoc.nix b/hosts/md/hedgedoc.nix index c33ca1e..78e48e4 100644 --- a/hosts/md/hedgedoc.nix +++ b/hosts/md/hedgedoc.nix @@ -34,12 +34,16 @@ in recommendedProxySettings = true; extraConfig = '' add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always; + proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme"; ''; }; "/socket.io/" = { proxyPass = "http://${cfg.host}:${toString cfg.port}"; proxyWebsockets = true; recommendedProxySettings = true; + extraConfig = '' + proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme"; + ''; }; "/metrics" = { proxyPass = "http://${cfg.host}:${toString cfg.port}"; diff --git a/hosts/monitoring/grafana.nix b/hosts/monitoring/grafana.nix index a8af09b..8dc908c 100644 --- a/hosts/monitoring/grafana.nix +++ b/hosts/monitoring/grafana.nix @@ -83,11 +83,17 @@ in basicAuthFile = config.age.secrets.grafana_basic_auth.path; proxyPass = "http://unix:/run/grafana/grafana.sock"; recommendedProxySettings = true; + extraConfig = '' + proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme"; + ''; }; "/api/live/" = { proxyPass = "http://unix:/run/grafana/grafana.sock"; recommendedProxySettings = true; proxyWebsockets = true; + extraConfig = '' + proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme"; + ''; }; }; }; diff --git a/services/nginx.nix b/services/nginx.nix index 21b7e66..8574a0d 100644 --- a/services/nginx.nix +++ b/services/nginx.nix @@ -17,5 +17,26 @@ recommendedOptimisation = true; recommendedGzipSettings = true; recommendedBrotliSettings = true; + commonHttpConfig = '' + map $remote_addr $proxy_forwarded_for_element { + # IPv4 addresses can be sent as-is + ~^[0-9.]+$ "for=$remote_addr:$remote_port"; + + # IPv6 addresses need to be bracketed and quoted + ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]:$remote_port\""; + + default "for=unknown"; + } + + map $server_addr $proxy_forwarded_by_element { + # IPv4 addresses can be sent as-is + ~^[0-9.]+$ "by=$server_addr:$server_port"; + + # IPv6 addresses need to be bracketed and quoted + ~^[0-9A-Fa-f:.]+$ "by=\"[$server_addr]:$server_port\""; + + default "by=unknown"; + } + ''; }; } From 8b513ac9219513f2b67332afa37f613c82ac79f8 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Fri, 11 Sep 2026 10:31:22 +0200 Subject: [PATCH 31/31] gc every 7d --- hosts/common.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/common.nix b/hosts/common.nix index 248fccb..732be6b 100644 --- a/hosts/common.nix +++ b/hosts/common.nix @@ -37,7 +37,7 @@ gc = { automatic = true; dates = "weekly"; - options = "--delete-older-than 14d"; + options = "--delete-older-than 7d"; }; };