Split into flakes + common colmena file
This commit is contained in:
parent
9504c73ca9
commit
00db3ff974
8 changed files with 185 additions and 195 deletions
33
colmena.nix
Normal file
33
colmena.nix
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
|
||||
};
|
||||
outputs = { nixpkgs, ... }: {
|
||||
colmena = {
|
||||
meta = {
|
||||
nixpkgs = import nixpkgs {
|
||||
system = "x86_64-linux";
|
||||
overlays = [];
|
||||
};
|
||||
};
|
||||
|
||||
# needed ?
|
||||
#
|
||||
# deployment = {
|
||||
# targetHost = "somehost.tld";
|
||||
# targetPort = 1234;
|
||||
# targetUser = "luser";
|
||||
# };
|
||||
|
||||
git-system = { name, nodes, pkgs, ... }: {
|
||||
import = "git_system.nix";
|
||||
};
|
||||
runner-system = { name, nodes, pkgs, ... }: {
|
||||
import = "runner_system.nix";
|
||||
};
|
||||
dev-system = { name, nodes, pkgs, ... }: {
|
||||
import = "dev_system.nix";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -7,55 +7,25 @@
|
|||
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
in
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
imports = [
|
||||
"shared/system.nix"
|
||||
"shared/dev_user.nix"
|
||||
"shared/docker.nix"
|
||||
"shared/ssh.nix"
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
users.users = {
|
||||
# connection only via ssh key
|
||||
pipeline = {
|
||||
isNormalUser = true;
|
||||
home = "/home/pipeline";
|
||||
description = "User used by forgejo runners to connect to this system";
|
||||
extraGroups = [ "docker" ];
|
||||
openssh.authorizedKeys.keys = [ "TODO" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
# connection only via ssh key
|
||||
pipeline = {
|
||||
isNormalUser = true;
|
||||
home = "/home/pipeline";
|
||||
description = "User used by forgejo runners to connect to this system";
|
||||
extraGroups = [ "docker" ];
|
||||
openssh.authorizedKeys.keys = [ "TODO" ];
|
||||
};
|
||||
|
||||
# connection only via hashed password;
|
||||
dev = {
|
||||
isNormalUser = true;
|
||||
home = "/home/dev";
|
||||
description = "User used to manually connect to this system (e.g. for maintenance)";
|
||||
extraGroups = [ "docker" "wheel" ];
|
||||
hashesPassword = "TODO";
|
||||
}
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
];
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
endlessh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = [ 23 ];
|
||||
};
|
||||
};
|
||||
}
|
||||
156
git_system.nix
156
git_system.nix
|
|
@ -7,107 +7,77 @@
|
|||
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
in
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
imports = [
|
||||
"shared/system.nix"
|
||||
"shared/dev_user.nix"
|
||||
"shared/docker.nix"
|
||||
"shared/ssh.nix"
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
];
|
||||
|
||||
users.users = {
|
||||
# connection only via hashed password;
|
||||
dev = {
|
||||
isNormalUser = true;
|
||||
home = "/home/dev";
|
||||
description = "User used to manually connect to this system (e.g. for maintenance)";
|
||||
extraGroups = [ "docker" "wheel" ];
|
||||
hashesPassword = "TODO";
|
||||
}
|
||||
};
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
defaults.email = "michael.huebner@ptspaper.de";
|
||||
acceptTerms = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
endlessh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
security.acme = {
|
||||
defaults.email = "michael.huebner@ptspaper.de";
|
||||
acceptTerms = true;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = [ 23 ];
|
||||
};
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${srv.DOMAIN} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
|
||||
};
|
||||
};
|
||||
|
||||
forgejo = {
|
||||
enable = true;
|
||||
database.type = "postgres";
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "localhost";
|
||||
ROOT_URL = "https://${srv.DOMAIN}";
|
||||
HTTP_PORT = 3000;
|
||||
SSH_PORT = 62;
|
||||
services = {
|
||||
nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${srv.DOMAIN} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
|
||||
};
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
renovate = {
|
||||
enable = true;
|
||||
schedule = "TODO";
|
||||
credentials = {
|
||||
RENOVATE_TOKEN = "/etc/renovate/token";
|
||||
};
|
||||
settings = {
|
||||
endpoint = "http://<TODO>.de/api/v1/";
|
||||
persistRepoData = true;
|
||||
platform = "forgejo";
|
||||
autodiscover = true;
|
||||
onboardingConfig= {
|
||||
extends= ["config:recommended"];
|
||||
forgejo = {
|
||||
enable = true;
|
||||
database.type = "postgres";
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "localhost";
|
||||
ROOT_URL = "https://${srv.DOMAIN}";
|
||||
HTTP_PORT = 3000;
|
||||
SSH_PORT = 62;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
};
|
||||
};
|
||||
prCommitsPerRunLimit= 0;
|
||||
};
|
||||
};
|
||||
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
|
||||
];
|
||||
renovate = {
|
||||
enable = true;
|
||||
schedule = "TODO";
|
||||
credentials = {
|
||||
RENOVATE_TOKEN = "/etc/renovate/token";
|
||||
};
|
||||
settings = {
|
||||
endpoint = "http://<TODO>.de/api/v1/";
|
||||
persistRepoData = true;
|
||||
platform = "forgejo";
|
||||
autodiscover = true;
|
||||
onboardingConfig= {
|
||||
extends= ["config:recommended"];
|
||||
};
|
||||
prCommitsPerRunLimit= 0;
|
||||
};
|
||||
};
|
||||
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -7,63 +7,32 @@
|
|||
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
in
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
imports = [
|
||||
"shared/system.nix"
|
||||
"shared/dev_user.nix"
|
||||
"shared/docker.nix"
|
||||
"shared/ssh.nix"
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
services = {
|
||||
# TODO: forgejo runner
|
||||
gitea-actions-runner = {
|
||||
package = pkgs.forgejo-actions-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = "default-runner";
|
||||
url = "TODO";
|
||||
tokenFile = config.age.secrets.forgejo-runner-token.path;
|
||||
labels = [
|
||||
"ubuntu-latest:docker://node:16-bullseye"
|
||||
"ubuntu-22.04:docker://node:16-bullseye"
|
||||
"ubuntu-20.04:docker://node:16-bullseye"
|
||||
];
|
||||
}
|
||||
}
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
forgejo-runner
|
||||
];
|
||||
|
||||
users.users = {
|
||||
# connection only via hashed password;
|
||||
dev = {
|
||||
isNormalUser = true;
|
||||
home = "/home/dev";
|
||||
description = "User used to manually connect to this system (e.g. for maintenance)";
|
||||
extraGroups = [ "docker" "wheel" ];
|
||||
hashesPassword = "TODO";
|
||||
}
|
||||
};
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
endlessh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = [ 23 ];
|
||||
};
|
||||
|
||||
# TODO: forgejo runner
|
||||
gitea-actions-runner = {
|
||||
package = pkgs.forgejo-actions-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = "default-runner";
|
||||
url = "TODO";
|
||||
tokenFile = config.age.secrets.forgejo-runner-token.path;
|
||||
labels = [
|
||||
"ubuntu-latest:docker://node:16-bullseye"
|
||||
"ubuntu-22.04:docker://node:16-bullseye"
|
||||
"ubuntu-20.04:docker://node:16-bullseye"
|
||||
];
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
13
shared/dev_user.nix
Normal file
13
shared/dev_user.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
users.users = {
|
||||
# connection only via hashed password;
|
||||
dev = {
|
||||
isNormalUser = true;
|
||||
home = "/home/dev";
|
||||
description = "User used to manually connect to this system (e.g. for maintenance)";
|
||||
extraGroups = [ "docker" "wheel" ];
|
||||
hashesPassword = "TODO";
|
||||
}
|
||||
};
|
||||
}
|
||||
6
shared/docker.nix
Normal file
6
shared/docker.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
};
|
||||
}
|
||||
14
shared/ssh.nix
Normal file
14
shared/ssh.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
services = {
|
||||
endlessh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = [ 23 ];
|
||||
};
|
||||
};
|
||||
}
|
||||
15
shared/system.nix
Normal file
15
shared/system.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
system = "x86_64-linux";
|
||||
system.stateVersion = "24.11";
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
];
|
||||
}
|
||||
Loading…
Reference in a new issue