hodasemi/nixos-server-conf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity Actions

feat: fix things mentioned by statix (nix linter)

Browse source
This commit is contained in:
aviac 2025-04-24 17:23:51 +02:00
parent e0f3e2fe79
commit 7600b36484
No known key found for this signature in database
GPG key ID: 644781002BDEA982
6 changed files with 190 additions and 153 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
dev_system.nix
View file

@ -5,27 +5,33 @@
# NixOS-WSL specific options are documented on the NixOS-WSL repository: # NixOS-WSL specific options are documented on the NixOS-WSL repository:
# https://github.com/nix-community/NixOS-WSL # https://github.com/nix-community/NixOS-WSL
{ config, lib, pkgs, ... }: {
config,
lib,
pkgs,
...
}:
let let
cfg = config.services.forgejo; cfg = config.services.forgejo;
srv = cfg.settings.server; srv = cfg.settings.server;
in in
{ {
imports = [ imports = [
"shared/system.nix" ./shared/system.nix
"shared/dev_user.nix" ./shared/dev_user.nix
"shared/docker.nix" ./shared/docker.nix
"shared/ssh.nix" ./shared/ssh.nix
]; ];
users.users = { users.users = {
# connection only via ssh key # connection only via ssh key
pipeline = { pipeline = {
isNormalUser = true; isNormalUser = true;
home = "/home/pipeline"; home = "/home/pipeline";
description = "User used by forgejo runners to connect to this system"; description = "User used by forgejo runners to connect to this system";
extraGroups = [ "docker" ]; extraGroups = [ "docker" ];
openssh.authorizedKeys.keys = [ "TODO" ]; openssh.authorizedKeys.keys = [ "TODO" ];
};
}; };
} };
}

2
execute.sh
View file

@ -2,4 +2,4 @@
openssl passwd -6 $1 > dev_user_password.pw openssl passwd -6 $1 > dev_user_password.pw
colmena apply -f colmena.nix colmena apply

176
git_system.nix
View file

@ -5,99 +5,105 @@
# NixOS-WSL specific options are documented on the NixOS-WSL repository: # NixOS-WSL specific options are documented on the NixOS-WSL repository:
# https://github.com/nix-community/NixOS-WSL # https://github.com/nix-community/NixOS-WSL
{ config, lib, pkgs, ... }: {
config,
lib,
pkgs,
...
}:
let let
cfg = config.services.forgejo; cfg = config.services.forgejo;
srv = cfg.settings.server; srv = cfg.settings.server;
in in
{ {
imports = [ imports = [
"shared/system.nix" ./shared/system.nix
"shared/dev_user.nix" ./shared/dev_user.nix
"shared/docker.nix" ./shared/docker.nix
"shared/ssh.nix" ./shared/ssh.nix
]; ];
programs = { programs = {
msmtp = { msmtp = {
enable = true; enable = true;
defaults = { defaults = {
tls = true; tls = true;
}; };
accounts = { accounts = {
default = { default = {
auth = true; auth = true;
host = "TODO: e.g. smtp.strato.de"; host = "TODO: e.g. smtp.strato.de";
port = 587; port = 587;
tls_starttls = true; tls_starttls = true;
from = "TODO: email"; from = "TODO: email";
user = "TODO: email"; user = "TODO: email";
password = "TODO"; password = "TODO";
};
};
}; };
};
};
};
security.acme = {
defaults.email = "michael.huebner@ptspaper.de";
acceptTerms = true;
};
services = {
nginx = {
enable = true;
virtualHosts.${srv.DOMAIN} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
client_max_body_size 512M;
'';
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
};
}; };
security.acme = { forgejo = {
defaults.email = "michael.huebner@ptspaper.de"; enable = true;
acceptTerms = true; database.type = "postgres";
lfs.enable = true;
settings = {
server = {
DOMAIN = "localhost";
ROOT_URL = "https://${srv.DOMAIN}";
HTTP_PORT = 3000;
SSH_PORT = 62;
};
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
};
}; };
services = { renovate = {
nginx = { enable = true;
enable = true; schedule = "TODO";
virtualHosts.${srv.DOMAIN} = { credentials = {
forceSSL = true; RENOVATE_TOKEN = "/etc/renovate/token";
enableACME = true; };
extraConfig = '' settings = {
client_max_body_size 512M; endpoint = "http://<TODO>.de/api/v1/";
''; persistRepoData = true;
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}"; platform = "forgejo";
}; autodiscover = true;
}; onboardingConfig = {
extends = [ "config:recommended" ];
forgejo = {
enable = true;
database.type = "postgres";
lfs.enable = true;
settings = {
server = {
DOMAIN = "localhost";
ROOT_URL = "https://${srv.DOMAIN}";
HTTP_PORT = 3000;
SSH_PORT = 62;
};
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
};
};
renovate = {
enable = true;
schedule = "TODO";
credentials = {
RENOVATE_TOKEN = "/etc/renovate/token";
};
settings = {
endpoint = "http://<TODO>.de/api/v1/";
persistRepoData = true;
platform = "forgejo";
autodiscover = true;
onboardingConfig= {
extends= ["config:recommended"];
};
prCommitsPerRunLimit= 0;
};
};
cron = {
enable = true;
systemCronJobs = [
"00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
];
}; };
prCommitsPerRunLimit = 0;
};
}; };
}
cron = {
enable = true;
systemCronJobs = [
"00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
];
};
};
}

58
runner_system.nix
View file

@ -5,34 +5,40 @@
# NixOS-WSL specific options are documented on the NixOS-WSL repository: # NixOS-WSL specific options are documented on the NixOS-WSL repository:
# https://github.com/nix-community/NixOS-WSL # https://github.com/nix-community/NixOS-WSL
{ config, lib, pkgs, ... }: {
config,
lib,
pkgs,
...
}:
let let
cfg = config.services.forgejo; cfg = config.services.forgejo;
srv = cfg.settings.server; srv = cfg.settings.server;
in in
{ {
imports = [ imports = [
"shared/system.nix" ./shared/system.nix
"shared/dev_user.nix" ./shared/dev_user.nix
"shared/docker.nix" ./shared/docker.nix
"shared/ssh.nix" ./shared/ssh.nix
]; ];
services = { services = {
# TODO: forgejo runner # TODO: forgejo runner
gitea-actions-runner = { gitea-actions-runner = {
package = pkgs.forgejo-actions-runner; package = pkgs.forgejo-actions-runner;
instances.default = { instances.default = {
enable = true; enable = true;
name = "default-runner"; name = "default-runner";
url = "TODO"; url = "TODO";
tokenFile = config.age.secrets.forgejo-runner-token.path; tokenFile = config.age.secrets.forgejo-runner-token.path;
labels = [ labels = [
"ubuntu-latest:docker://node:16-bullseye" "ubuntu-latest:docker://node:16-bullseye"
"ubuntu-22.04:docker://node:16-bullseye" "ubuntu-22.04:docker://node:16-bullseye"
"ubuntu-20.04:docker://node:16-bullseye" "ubuntu-20.04:docker://node:16-bullseye"
]; ];
} };
}
}; };
} };
}

32
shared/dev_user.nix
View file

@ -1,13 +1,23 @@
{ config, lib, pkgs, modulesPath, ... }:
{ {
users.users = { config,
# connection only via hashed password; lib,
dev = { pkgs,
isNormalUser = true; modulesPath,
home = "/home/dev"; ...
description = "User used to manually connect to this system (e.g. for maintenance)"; }:
extraGroups = [ "docker" "wheel" ]; {
hashedPasswordFile = "dev_user_password.pw"; users.users = {
} # connection only via hashed password;
dev = {
isNormalUser = true;
home = "/home/dev";
description = "User used to manually connect to this system (e.g. for maintenance)";
extraGroups = [
"docker"
"wheel"
];
hashedPasswordFile = ./.;
}; };
} };
}

31
shared/system.nix
View file

@ -1,15 +1,24 @@
{ config, lib, pkgs, modulesPath, ... }:
{ {
system = "x86_64-linux"; config,
system.stateVersion = "24.11"; lib,
pkgs,
modulesPath,
...
}:
{
system.stateVersion = "24.11";
nix = { nix = {
settings = { settings = {
experimental-features = [ "nix-command" "flakes" ]; experimental-features = [
}; "nix-command"
"flakes"
];
}; };
};
environment.systemPackages = with pkgs; [
git
];
}
environment.systemPackages = with pkgs; [
git
];
}