342 lines
12 KiB
Nix
342 lines
12 KiB
Nix
{
|
|
description = "CCCB services";
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
agenix = {
|
|
url = "github:ryantm/agenix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
outputs =
|
|
{
|
|
self,
|
|
nixpkgs,
|
|
flake-utils,
|
|
agenix,
|
|
}:
|
|
let
|
|
nixosConfigurations = {
|
|
matrix = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
matrix_registration_shared_secret = {
|
|
file = ./secrets/matrix_registration_shared_secret.age;
|
|
mode = "440";
|
|
owner = "matrix-synapse";
|
|
group = "matrix-synapse";
|
|
};
|
|
matrix_signing_key = {
|
|
file = ./secrets/matrix_signing_key.age;
|
|
mode = "440";
|
|
owner = "matrix-synapse";
|
|
group = "matrix-synapse";
|
|
};
|
|
matrix_db_password = {
|
|
file = ./secrets/matrix_db_password.age;
|
|
mode = "440";
|
|
owner = "matrix-synapse";
|
|
group = "matrix-synapse";
|
|
};
|
|
draupnir_access_token = {
|
|
file = ./secrets/draupnir_access_token.age;
|
|
mode = "440";
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
};
|
|
}
|
|
./hosts/matrix
|
|
];
|
|
};
|
|
md = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets.hedgedoc_db_password = {
|
|
file = ./secrets/hedgedoc_db_password.age;
|
|
owner = "hedgedoc";
|
|
group = "hedgedoc";
|
|
mode = "0440";
|
|
};
|
|
}
|
|
./hosts/md
|
|
];
|
|
};
|
|
www = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
www-staging-htpasswd = {
|
|
file = ./secrets/www-staging-htpasswd.age;
|
|
owner = "nginx";
|
|
group = "nginx";
|
|
mode = "0440";
|
|
};
|
|
caldav-export-config = {
|
|
file = ./secrets/caldav-export-config.age;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0440";
|
|
};
|
|
};
|
|
}
|
|
./hosts/www
|
|
];
|
|
};
|
|
monitoring = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
grafana_secret_key = {
|
|
file = ./secrets/grafana_secret_key.age;
|
|
mode = "440";
|
|
owner = "grafana";
|
|
group = "grafana";
|
|
};
|
|
grafana_admin_password = {
|
|
file = ./secrets/grafana_admin_password.age;
|
|
mode = "440";
|
|
owner = "grafana";
|
|
group = "grafana";
|
|
};
|
|
grafana_basic_auth = {
|
|
file = ./secrets/grafana_basic_auth.age;
|
|
mode = "440";
|
|
owner = "nginx";
|
|
group = "nginx";
|
|
};
|
|
postgres-grafana = {
|
|
file = ./secrets/postgres-grafana.age;
|
|
mode = "440";
|
|
owner = "grafana";
|
|
group = "grafana";
|
|
};
|
|
pve-exporter = {
|
|
file = ./secrets/pve-exporter.age;
|
|
mode = "440";
|
|
owner = "prometheus";
|
|
group = "prometheus";
|
|
};
|
|
};
|
|
}
|
|
./hosts/monitoring
|
|
];
|
|
};
|
|
sql = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
postgres-matrix-synapse = {
|
|
file = ./secrets/postgres-matrix-synapse.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0400";
|
|
};
|
|
postgres-hedgedoc = {
|
|
file = ./secrets/postgres-hedgedoc.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0400";
|
|
};
|
|
postgres-grafana = {
|
|
file = ./secrets/postgres-grafana.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0400";
|
|
};
|
|
postgres-forgejo = {
|
|
file = ./secrets/postgres-forgejo.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0400";
|
|
};
|
|
postgres-baikal = {
|
|
file = ./secrets/postgres-baikal.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
mode = "0400";
|
|
};
|
|
};
|
|
}
|
|
./hosts/sql
|
|
];
|
|
};
|
|
dav = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
#radicale-htpasswd = {
|
|
# file = ./secrets/radicale_htpasswd.age;
|
|
# owner = "radicale";
|
|
# group = "radicale";
|
|
# mode = "0400";
|
|
#};
|
|
};
|
|
}
|
|
./hosts/dav
|
|
];
|
|
};
|
|
git = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
postgres-forgejo = {
|
|
file = ./secrets/postgres-forgejo.age;
|
|
owner = "forgejo";
|
|
group = "forgejo";
|
|
mode = "0400";
|
|
};
|
|
forgejo-internal-token = {
|
|
file = ./secrets/forgejo-internal-token.age;
|
|
owner = "forgejo";
|
|
group = "forgejo";
|
|
mode = "0440";
|
|
};
|
|
forgejo-secret-key = {
|
|
file = ./secrets/forgejo-secret-key.age;
|
|
owner = "forgejo";
|
|
group = "forgejo";
|
|
mode = "0440";
|
|
};
|
|
forgejo-oauth2-jwt-secret = {
|
|
file = ./secrets/forgejo-oauth2-jwt-secret.age;
|
|
owner = "forgejo";
|
|
group = "forgejo";
|
|
mode = "0440";
|
|
};
|
|
forgejo-runner-token-snowden = {
|
|
file = ./secrets/forgejo-runner-token-snowden.age;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0444";
|
|
};
|
|
forgejo-runner-token-snowden-env = {
|
|
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0444";
|
|
};
|
|
};
|
|
}
|
|
./hosts/git
|
|
];
|
|
};
|
|
forgejo-runner = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
{ environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
|
|
{
|
|
age.secrets = {
|
|
forgejo-runner-token = {
|
|
file = ./secrets/forgejo-runner-token-snowden.age;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0444";
|
|
};
|
|
forgejo-runner-token-env = {
|
|
file = ./secrets/forgejo-runner-token-snowden-env.age;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0444";
|
|
};
|
|
};
|
|
}
|
|
./hosts/forgejo-runner
|
|
];
|
|
};
|
|
};
|
|
in
|
|
(flake-utils.lib.eachDefaultSystem (
|
|
system:
|
|
let
|
|
pkgs = import nixpkgs { inherit system; };
|
|
remoteDiffApps = nixpkgs.lib.mapAttrs' (hostname: _: {
|
|
name = "remote-diff-${hostname}";
|
|
value = {
|
|
meta.description = "Build ${hostname} locally and compare remotely to current system";
|
|
type = "app";
|
|
program = "${pkgs.writeShellScript "remote-diff-${hostname}.sh" ''
|
|
set -euo pipefail
|
|
result=$(NIX_SSHOPTS="-o VisualHostKey=no" \
|
|
${pkgs.nixos-rebuild}/bin/nixos-rebuild build \
|
|
--flake ${self}#${hostname} \
|
|
--target-host ${hostname} \
|
|
--use-substitutes \
|
|
--log-format internal-json -v 2> >(${pkgs.nix-output-monitor}/bin/nom --json))
|
|
${pkgs.openssh}/bin/ssh -t ${hostname} \
|
|
nix run nixpkgs#nvd -- diff /run/current-system "$result"
|
|
''}";
|
|
};
|
|
}) nixosConfigurations;
|
|
remoteApplyApps = nixpkgs.lib.mapAttrs' (hostname: _: {
|
|
name = "remote-apply-${hostname}";
|
|
value = {
|
|
meta.description = "Build ${hostname} locally and apply remotely";
|
|
type = "app";
|
|
program = "${pkgs.writeShellScript "remote-apply-${hostname}.sh" ''
|
|
set -euo pipefail
|
|
NIX_SSHOPTS="-o VisualHostKey=no" \
|
|
${pkgs.nixos-rebuild}/bin/nixos-rebuild switch \
|
|
--flake ${self}#${hostname} \
|
|
--target-host ${hostname} \
|
|
--use-substitutes \
|
|
--log-format internal-json -v \
|
|
|& ${pkgs.nix-output-monitor}/bin/nom --json
|
|
''}";
|
|
};
|
|
}) nixosConfigurations;
|
|
in
|
|
{
|
|
formatter = pkgs.nixfmt-tree;
|
|
apps = {
|
|
deploy = {
|
|
meta.description = "Deploy a NixOS configuration to a remote host";
|
|
type = "app";
|
|
program = "${pkgs.writeShellScript "deploy.sh" ''
|
|
set -e
|
|
host="''${1:?usage: nix run .#deploy -- <host>}"
|
|
${pkgs.openssh}/bin/ssh -tt "$host" 'bash -s' <<'EOF'
|
|
set -e
|
|
cd /etc/nixos
|
|
nix run .#nixos-diff && nixos-rebuild switch
|
|
EOF
|
|
''}";
|
|
};
|
|
}
|
|
// remoteDiffApps
|
|
// remoteApplyApps;
|
|
devShells.default = pkgs.mkShell {
|
|
packages = [
|
|
agenix.packages.${system}.default
|
|
pkgs.age
|
|
];
|
|
};
|
|
}
|
|
))
|
|
// {
|
|
inherit nixosConfigurations;
|
|
};
|
|
}
|