Split into flakes + common colmena file

colmena.nix

@@ -0,0 +1,33 @@
+{
+    inputs = {
+        nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    };
+    outputs = { nixpkgs, ... }: {
+        colmena = {
+            meta = {
+                nixpkgs = import nixpkgs {
+                    system = "x86_64-linux";
+                    overlays = [];
+                };
+            };
+
+            # needed ?
+            #
+            # deployment = {
+            #   targetHost = "somehost.tld";
+            #   targetPort = 1234;
+            #   targetUser = "luser";
+            # };
+
+            git-system = { name, nodes, pkgs, ... }: {
+                import = "git_system.nix";
+            };
+            runner-system = { name, nodes, pkgs, ... }: {
+                import = "runner_system.nix";
+            };
+            dev-system = { name, nodes, pkgs, ... }: {
+                import = "dev_system.nix";
+            };
+        };
+    };
+}

dev_system.nix

@@ -7,55 +7,25 @@
 
 { config, lib, pkgs, ... }:
 let
-  cfg = config.services.forgejo;
+    cfg = config.services.forgejo;
-  srv = cfg.settings.server;
+    srv = cfg.settings.server;
 in
 {
-  system.stateVersion = "24.11";
+    imports = [
+        "shared/system.nix"
+        "shared/dev_user.nix"
+        "shared/docker.nix"
+        "shared/ssh.nix"
+    ];
 
-  nix = {
+    users.users = {
-    settings = {
+        # connection only via ssh key
-      experimental-features = [ "nix-command" "flakes" ];
+        pipeline = {
+            isNormalUser = true;
+            home = "/home/pipeline";
+            description = "User used by forgejo runners to connect to this system";
+            extraGroups = [ "docker" ];
+            openssh.authorizedKeys.keys = [ "TODO" ];
+        };
     };
-  };
-
-  users.users = {
-    # connection only via ssh key
-    pipeline = {
-      isNormalUser = true;
-      home = "/home/pipeline";
-      description = "User used by forgejo runners to connect to this system";
-      extraGroups = [ "docker" ];
-      openssh.authorizedKeys.keys = [ "TODO" ];
-    };
-
-    # connection only via hashed password;
-    dev = {
-      isNormalUser = true;
-      home = "/home/dev";
-      description = "User used to manually connect to this system (e.g. for maintenance)";
-      extraGroups = [ "docker" "wheel" ];
-      hashesPassword = "TODO";
-    }
-  };
-
-  environment.systemPackages = with pkgs; [
-    git
-  ];
-
-  virtualisation.docker = {
-    enable = true;
-  };
-
-  services = {
-    endlessh = {
-      enable = true;
-      port = 22;
-    };
-
-    openssh = {
-      enable = true;
-      ports = [ 23 ];
-    };
-  };
 }

git_system.nix

@@ -7,107 +7,77 @@
 
 { config, lib, pkgs, ... }:
 let
-  cfg = config.services.forgejo;
+    cfg = config.services.forgejo;
-  srv = cfg.settings.server;
+    srv = cfg.settings.server;
 in
 {
-  system.stateVersion = "24.11";
+    imports = [
+        "shared/system.nix"
+        "shared/dev_user.nix"
+        "shared/docker.nix"
+        "shared/ssh.nix"
+    ];
 
-  nix = {
+    security.acme = {
-    settings = {
+        defaults.email = "michael.huebner@ptspaper.de";
-      experimental-features = [ "nix-command" "flakes" ];
+        acceptTerms = true;
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    git
-  ];
-
-  users.users = {
-    # connection only via hashed password;
-    dev = {
-      isNormalUser = true;
-      home = "/home/dev";
-      description = "User used to manually connect to this system (e.g. for maintenance)";
-      extraGroups = [ "docker" "wheel" ];
-      hashesPassword = "TODO";
-    }
-  };
-
-  virtualisation.docker = {
-    enable = true;
-  };
-
-  security.acme = {
-    defaults.email = "michael.huebner@ptspaper.de";
-    acceptTerms = true;
-  };
-
-  services = {
-    endlessh = {
-      enable = true;
-      port = 22;
     };
 
-    openssh = {
+    services = {
-      enable = true;
+        nginx = {
-      ports = [ 23 ];
+            enable = true;
-    };
+            virtualHosts.${srv.DOMAIN} = {
-
+                forceSSL = true;
-    nginx = {
+                enableACME = true;
-      enable = true;
+                extraConfig = ''
-      virtualHosts.${srv.DOMAIN} = {
+                client_max_body_size 512M;
-        forceSSL = true;
+                '';
-        enableACME = true;
+                locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
-        extraConfig = ''
+            };
-          client_max_body_size 512M;
-        '';
-        locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
-      };
-    };
-
-    forgejo = {
-      enable = true;
-      database.type = "postgres";
-      lfs.enable = true;
-      settings = {
-        server = {
-          DOMAIN = "localhost";
-          ROOT_URL = "https://${srv.DOMAIN}";
-          HTTP_PORT = 3000;
-          SSH_PORT = 62;
         };
-        service.DISABLE_REGISTRATION = true;
-        actions = {
-          ENABLED = true;
-          DEFAULT_ACTIONS_URL = "github";
-        };
-      };
-    };
 
-    renovate = {
+        forgejo = {
-      enable = true;
+            enable = true;
-      schedule = "TODO";
+            database.type = "postgres";
-      credentials = {
+            lfs.enable = true;
-        RENOVATE_TOKEN = "/etc/renovate/token";
+            settings = {
-      };
+                server = {
-      settings = {
+                    DOMAIN = "localhost";
-        endpoint = "http://<TODO>.de/api/v1/";
+                    ROOT_URL = "https://${srv.DOMAIN}";
-        persistRepoData = true;
+                    HTTP_PORT = 3000;
-        platform = "forgejo";
+                    SSH_PORT = 62;
-        autodiscover = true;
+                };
-        onboardingConfig= {
+                service.DISABLE_REGISTRATION = true;
-          extends= ["config:recommended"];
+                actions = {
+                    ENABLED = true;
+                    DEFAULT_ACTIONS_URL = "github";
+                };
+            };
         };
-        prCommitsPerRunLimit= 0;
-      };
-    };
 
-    cron = {
+        renovate = {
-      enable = true;
+            enable = true;
-      systemCronJobs = [
+            schedule = "TODO";
-        "00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
+            credentials = {
-      ];
+                RENOVATE_TOKEN = "/etc/renovate/token";
+            };
+            settings = {
+            endpoint = "http://<TODO>.de/api/v1/";
+            persistRepoData = true;
+            platform = "forgejo";
+            autodiscover = true;
+            onboardingConfig= {
+                extends= ["config:recommended"];
+            };
+            prCommitsPerRunLimit= 0;
+            };
+        };
+
+        cron = {
+            enable = true;
+            systemCronJobs = [
+                "00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
+            ];
+        };
     };
-  };
 }

runner_system.nix

@@ -7,63 +7,32 @@
 
 { config, lib, pkgs, ... }:
 let
-  cfg = config.services.forgejo;
+    cfg = config.services.forgejo;
-  srv = cfg.settings.server;
+    srv = cfg.settings.server;
 in
 {
-  system.stateVersion = "24.11";
+    imports = [
+        "shared/system.nix"
+        "shared/dev_user.nix"
+        "shared/docker.nix"
+        "shared/ssh.nix"
+    ];
 
-  nix = {
+    services = {
-    settings = {
+        # TODO: forgejo runner
-      experimental-features = [ "nix-command" "flakes" ];
+        gitea-actions-runner = {
+        package = pkgs.forgejo-actions-runner;
+        instances.default = {
+            enable = true;
+            name = "default-runner";
+            url = "TODO";
+            tokenFile = config.age.secrets.forgejo-runner-token.path;
+            labels = [
+                "ubuntu-latest:docker://node:16-bullseye"
+                "ubuntu-22.04:docker://node:16-bullseye"
+                "ubuntu-20.04:docker://node:16-bullseye"
+                ];
+            }
+        }
     };
-  };
-
-  environment.systemPackages = with pkgs; [
-    git
-    forgejo-runner
-  ];
-
-  users.users = {
-    # connection only via hashed password;
-    dev = {
-      isNormalUser = true;
-      home = "/home/dev";
-      description = "User used to manually connect to this system (e.g. for maintenance)";
-      extraGroups = [ "docker" "wheel" ];
-      hashesPassword = "TODO";
-    }
-  };
-
-  virtualisation.docker = {
-    enable = true;
-  };
-
-  services = {
-    endlessh = {
-      enable = true;
-      port = 22;
-    };
-
-    openssh = {
-      enable = true;
-      ports = [ 23 ];
-    };
-
-    # TODO: forgejo runner
-    gitea-actions-runner = {
-      package = pkgs.forgejo-actions-runner;
-      instances.default = {
-        enable = true;
-        name = "default-runner";
-        url = "TODO";
-        tokenFile = config.age.secrets.forgejo-runner-token.path;
-        labels = [
-          "ubuntu-latest:docker://node:16-bullseye"
-          "ubuntu-22.04:docker://node:16-bullseye"
-          "ubuntu-20.04:docker://node:16-bullseye"
-        ];
-      }
-    }
-  };
 }

shared/dev_user.nix

@@ -0,0 +1,13 @@
+{ config, lib, pkgs, modulesPath, ... }:
+{
+    users.users = {
+        # connection only via hashed password;
+        dev = {
+            isNormalUser = true;
+            home = "/home/dev";
+            description = "User used to manually connect to this system (e.g. for maintenance)";
+            extraGroups = [ "docker" "wheel" ];
+            hashesPassword = "TODO";
+        }
+    };
+}

shared/docker.nix

@@ -0,0 +1,6 @@
+{ config, lib, pkgs, modulesPath, ... }:
+{
+    virtualisation.docker = {
+        enable = true;
+    };
+}

shared/ssh.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, modulesPath, ... }:
+{
+    services = {
+        endlessh = {
+            enable = true;
+            port = 22;
+        };
+
+        openssh = {
+            enable = true;
+            ports = [ 23 ];
+        };
+    };
+}

shared/system.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, modulesPath, ... }:
+{
+    system = "x86_64-linux";
+    system.stateVersion = "24.11";
+
+    nix = {
+        settings = {
+            experimental-features = [ "nix-command" "flakes" ];
+        };
+    };
+
+    environment.systemPackages = with pkgs; [
+        git
+    ];
+}