Overhaul
This commit is contained in:
parent
b89303566a
commit
f9132abd53
12 changed files with 332 additions and 30 deletions
117
flake.lock
generated
117
flake.lock
generated
|
|
@ -1,5 +1,48 @@
|
|||
{
|
||||
"nodes": {
|
||||
"agenix": {
|
||||
"inputs": {
|
||||
"darwin": "darwin",
|
||||
"home-manager": "home-manager",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1754433428,
|
||||
"narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1744478979,
|
||||
"narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "43975d782b418ebf4969e9ccba82466728c2851b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lnl7",
|
||||
"ref": "master",
|
||||
"repo": "nix-darwin",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
@ -17,6 +60,27 @@
|
|||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1745494811,
|
||||
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
|
|
@ -39,40 +103,55 @@
|
|||
"nixos-wsl": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1744290088,
|
||||
"narHash": "sha256-/X9XVEl0EiyisNbF5srrxXRSVoRqdwExuqyspYqqEjQ=",
|
||||
"lastModified": 1760536587,
|
||||
"narHash": "sha256-wfWqt+igns/VazjPLkyb4Z/wpn4v+XIjUeI3xY/1ENg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NixOS-WSL",
|
||||
"rev": "60b4904a1390ac4c89e93d95f6ed928975e525ed",
|
||||
"rev": "f98ee1de1fa36eca63c67b600f5d617e184e82ea",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "main",
|
||||
"repo": "NixOS-WSL",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1742937945,
|
||||
"narHash": "sha256-lWc+79eZRyvHp/SqMhHTMzZVhpxkRvthsP1Qx6UCq0E=",
|
||||
"lastModified": 1754028485,
|
||||
"narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "d02d88f8de5b882ccdde0465d8fa2db3aa1169f7",
|
||||
"rev": "59e69648d345d6e8fef86158c555730fa12af9de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.11",
|
||||
"ref": "nixos-25.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1760524057,
|
||||
"narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1746141548,
|
||||
"narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
|
||||
|
|
@ -90,9 +169,25 @@
|
|||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager",
|
||||
"agenix": "agenix",
|
||||
"home-manager": "home-manager_2",
|
||||
"nixos-wsl": "nixos-wsl",
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
|
|||
30
flake.nix
30
flake.nix
|
|
@ -2,8 +2,8 @@
|
|||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
|
||||
nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
|
||||
|
||||
nixos-wsl.url = "github:nix-community/NixOS-WSL";
|
||||
agenix.url = "github:ryantm/agenix";
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
|
@ -20,7 +20,7 @@
|
|||
formatter.${system} = nixpkgs.legacyPackages.${system}.nixfmt-tree;
|
||||
|
||||
nixosConfigurations = {
|
||||
wsl = nixpkgs.lib.nixosSystem {
|
||||
"wsl" = nixpkgs.lib.nixosSystem {
|
||||
specialArgs = {
|
||||
inherit inputs outputs;
|
||||
};
|
||||
|
|
@ -30,6 +30,30 @@
|
|||
modules = [
|
||||
./hosts/wsl/configuration.nix
|
||||
inputs.nixos-wsl.nixosModules.default
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.home-manager.nixosModules.default
|
||||
{
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
users = {
|
||||
nixos = import ./home/nixos/home.nix;
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
"homelab" = nixpkgs.lib.nixosSystem {
|
||||
specialArgs = {
|
||||
inherit inputs outputs;
|
||||
};
|
||||
|
||||
inherit system;
|
||||
|
||||
modules = [
|
||||
./hosts/homelab/configuration.nix
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.home-manager.nixosModules.default
|
||||
{
|
||||
home-manager = {
|
||||
|
|
|
|||
|
|
@ -1,10 +1,5 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
# Home Manager needs a bit of information about you and the paths it should
|
||||
# manage.
|
||||
home.username = "nixos";
|
||||
home.homeDirectory = "/home/nixos";
|
||||
|
||||
# This value determines the Home Manager release that your configuration is
|
||||
# compatible with. This helps avoid breakage when a new Home Manager release
|
||||
# introduces backwards incompatible changes.
|
||||
|
|
@ -67,7 +62,7 @@
|
|||
# /etc/profiles/per-user/nixos/etc/profile.d/hm-session-vars.sh
|
||||
#
|
||||
home.sessionVariables = {
|
||||
# EDITOR = "emacs";
|
||||
EDITOR = "nvim";
|
||||
};
|
||||
|
||||
# Let Home Manager install and manage itself.
|
||||
|
|
@ -141,6 +136,7 @@
|
|||
|
||||
];
|
||||
};
|
||||
|
||||
programs.git = {
|
||||
enable = true;
|
||||
userName = "ktkk";
|
||||
|
|
@ -151,6 +147,7 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
};
|
||||
|
|
|
|||
32
hosts/homelab/configuration.nix
Normal file
32
hosts/homelab/configuration.nix
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
pkgs,
|
||||
outputs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../shared
|
||||
../../modules/forgejo
|
||||
../../modules/nginx
|
||||
../../modules/grafana
|
||||
];
|
||||
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
time.timeZone = "Europe/Brussels";
|
||||
|
||||
networking = {
|
||||
hostName = "homelab";
|
||||
|
||||
firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
};
|
||||
}
|
||||
40
hosts/homelab/hardware-configuration.nix
Normal file
40
hosts/homelab/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/b743f428-9a9a-46e9-a536-7197b89e71c6";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/358C-11CA";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/77c5668b-fb30-4864-ad93-5357fb8363b4"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
|
@ -6,14 +6,22 @@
|
|||
...
|
||||
}:
|
||||
{
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
inputs.agenix.packages."${system}".default
|
||||
home-manager
|
||||
neovim
|
||||
git
|
||||
tree
|
||||
wget
|
||||
tmux
|
||||
];
|
||||
|
||||
users.users."nixos" = {
|
||||
isNormalUser = true;
|
||||
};
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
};
|
||||
|
|
@ -24,8 +32,9 @@
|
|||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 22 ];
|
||||
enable = true;
|
||||
|
||||
allowedTCPPorts = [ 22 ];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,6 @@
|
|||
}:
|
||||
{
|
||||
imports = [
|
||||
../../modules/grafana
|
||||
../shared
|
||||
];
|
||||
|
||||
|
|
|
|||
44
modules/forgejo/default.nix
Normal file
44
modules/forgejo/default.nix
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
{ pkgs, config, ... }:
|
||||
{
|
||||
services.nginx.virtualHosts.${config.services.forgejo.settings.server.DOMAIN} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://${toString config.services.forgejo.settings.server.ROOT_URL}:${toString config.services.forgejo.settings.server.HTTP_PORT}";
|
||||
|
||||
proxyWebsockets = true;
|
||||
|
||||
extraConfig = ''
|
||||
proxy_pass_header Authorization;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
|
||||
database.type = "postgres";
|
||||
|
||||
lfs.enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.katkak.dev";
|
||||
ROOT_URL = "127.0.0.1";
|
||||
HTTP_PORT = 3000;
|
||||
};
|
||||
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,13 +1,21 @@
|
|||
{ pkgs, config, ... }:
|
||||
{
|
||||
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
|
||||
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
domain = "grafana.katkak.dev";
|
||||
http_addr = "127.0.0.1";
|
||||
http_port = 2342;
|
||||
domain = "grafana.pele";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -22,21 +30,17 @@
|
|||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
|
||||
port = 9001;
|
||||
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
|
||||
enabledCollectors = [ "systemd" ];
|
||||
|
||||
port = 9002;
|
||||
};
|
||||
};
|
||||
|
|
@ -44,6 +48,7 @@
|
|||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "nixos";
|
||||
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
|
|
|
|||
43
modules/nginx/default.nix
Normal file
43
modules/nginx/default.nix
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
{ pkgs, config, ... }:
|
||||
{
|
||||
# These ports need to be open for acme
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
age.secrets.acme = {
|
||||
file = ../../secrets/acme.age;
|
||||
owner = "acme";
|
||||
group = "acme";
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
|
||||
defaults = {
|
||||
group = config.services.nginx.group;
|
||||
|
||||
dnsProvider = "cloudflare";
|
||||
|
||||
email = "dezuttereluka@gmail.com";
|
||||
|
||||
credentialFiles = {
|
||||
"CLOUDFLARE_DNS_API_TOKEN_FILE" = config.age.secrets.acme.path;
|
||||
};
|
||||
};
|
||||
|
||||
certs = {
|
||||
"katkak.dev" = {
|
||||
extraDomainNames = [ "*.katkak.dev" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
7
secrets/acme.age
Normal file
7
secrets/acme.age
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 Sx3nIg B3GVZwTAE7FS5EiTaVwXM+6WierwBvdQmIQyb7wRWjQ
|
||||
SH0XI9bGYe53fFxU2e0mjMNJsXGodDgYtBPmrBCdQfc
|
||||
-> ssh-ed25519 M7s3oA rBDzxpuxZC5OWQH/SoiGDUKZEgR25GeqhtERmHqkh1g
|
||||
1cfOKvp9S+CKwbkirfLg3rwB3eQrxW6oFpoa5DBfnXk
|
||||
--- fZYGCWbZOMyhTk2HA1woA+mF17td3EcmY3lB58zcKzg
|
||||
Å—GD;„DµFZ‹Plåk€½ä#•|Kœ u·‹Ü0ãÒ¥Ê6 ú sÜâmEB‰SrÐ&ãª+új4DÖÀ ƒ#Èÿ”<C3BF>8
|
||||
7
secrets/secrets.nix
Normal file
7
secrets/secrets.nix
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
let
|
||||
wsl = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAO0tSdhGRmrfdDTMAvrIOmE2po8yIMJHmcGsTv30bmx";
|
||||
homelab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5EJk+SpGvAErMl/145ZchmGVRGACjgk8RjQOi5kcQi";
|
||||
in
|
||||
{
|
||||
"acme.age".publicKeys = [ homelab wsl ];
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue