hodasemi/nixos-server-conf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity Actions

feat: fix things mentioned by statix (nix linter)

Browse source
This commit is contained in:
aviac 2025-04-24 17:23:51 +02:00
parent e0f3e2fe79
commit 7600b36484
No known key found for this signature in database
GPG key ID: 644781002BDEA982
6 changed files with 190 additions and 153 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
dev_system.nix
View file

@ -5,27 +5,33 @@
# NixOS-WSL specific options are documented on the NixOS-WSL repository:
# https://github.com/nix-community/NixOS-WSL
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.forgejo;
srv = cfg.settings.server;
cfg = config.services.forgejo;
srv = cfg.settings.server;
in
{
imports = [
"shared/system.nix"
"shared/dev_user.nix"
"shared/docker.nix"
"shared/ssh.nix"
];
imports = [
./shared/system.nix
./shared/dev_user.nix
./shared/docker.nix
./shared/ssh.nix
];
users.users = {
# connection only via ssh key
pipeline = {
isNormalUser = true;
home = "/home/pipeline";
description = "User used by forgejo runners to connect to this system";
extraGroups = [ "docker" ];
openssh.authorizedKeys.keys = [ "TODO" ];
};
users.users = {
# connection only via ssh key
pipeline = {
isNormalUser = true;
home = "/home/pipeline";
description = "User used by forgejo runners to connect to this system";
extraGroups = [ "docker" ];
openssh.authorizedKeys.keys = [ "TODO" ];
};
}
};
}

2
execute.sh
View file

@ -2,4 +2,4 @@
openssl passwd -6 $1 > dev_user_password.pw
colmena apply -f colmena.nix
colmena apply

176
git_system.nix
View file

@ -5,99 +5,105 @@
# NixOS-WSL specific options are documented on the NixOS-WSL repository:
# https://github.com/nix-community/NixOS-WSL
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.forgejo;
srv = cfg.settings.server;
cfg = config.services.forgejo;
srv = cfg.settings.server;
in
{
imports = [
"shared/system.nix"
"shared/dev_user.nix"
"shared/docker.nix"
"shared/ssh.nix"
];
imports = [
./shared/system.nix
./shared/dev_user.nix
./shared/docker.nix
./shared/ssh.nix
];
programs = {
msmtp = {
enable = true;
defaults = {
tls = true;
};
accounts = {
default = {
auth = true;
host = "TODO: e.g. smtp.strato.de";
port = 587;
tls_starttls = true;
from = "TODO: email";
user = "TODO: email";
password = "TODO";
};
};
programs = {
msmtp = {
enable = true;
defaults = {
tls = true;
};
accounts = {
default = {
auth = true;
host = "TODO: e.g. smtp.strato.de";
port = 587;
tls_starttls = true;
from = "TODO: email";
user = "TODO: email";
password = "TODO";
};
};
};
};
security.acme = {
defaults.email = "michael.huebner@ptspaper.de";
acceptTerms = true;
};
services = {
nginx = {
enable = true;
virtualHosts.${srv.DOMAIN} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
client_max_body_size 512M;
'';
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
};
};
security.acme = {
defaults.email = "michael.huebner@ptspaper.de";
acceptTerms = true;
forgejo = {
enable = true;
database.type = "postgres";
lfs.enable = true;
settings = {
server = {
DOMAIN = "localhost";
ROOT_URL = "https://${srv.DOMAIN}";
HTTP_PORT = 3000;
SSH_PORT = 62;
};
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
};
};
services = {
nginx = {
enable = true;
virtualHosts.${srv.DOMAIN} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
client_max_body_size 512M;
'';
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
};
};
forgejo = {
enable = true;
database.type = "postgres";
lfs.enable = true;
settings = {
server = {
DOMAIN = "localhost";
ROOT_URL = "https://${srv.DOMAIN}";
HTTP_PORT = 3000;
SSH_PORT = 62;
};
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
};
};
renovate = {
enable = true;
schedule = "TODO";
credentials = {
RENOVATE_TOKEN = "/etc/renovate/token";
};
settings = {
endpoint = "http://<TODO>.de/api/v1/";
persistRepoData = true;
platform = "forgejo";
autodiscover = true;
onboardingConfig= {
extends= ["config:recommended"];
};
prCommitsPerRunLimit= 0;
};
};
cron = {
enable = true;
systemCronJobs = [
"00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
];
renovate = {
enable = true;
schedule = "TODO";
credentials = {
RENOVATE_TOKEN = "/etc/renovate/token";
};
settings = {
endpoint = "http://<TODO>.de/api/v1/";
persistRepoData = true;
platform = "forgejo";
autodiscover = true;
onboardingConfig = {
extends = [ "config:recommended" ];
};
prCommitsPerRunLimit = 0;
};
};
}
cron = {
enable = true;
systemCronJobs = [
"00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
];
};
};
}

58
runner_system.nix
View file

@ -5,34 +5,40 @@
# NixOS-WSL specific options are documented on the NixOS-WSL repository:
# https://github.com/nix-community/NixOS-WSL
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.forgejo;
srv = cfg.settings.server;
cfg = config.services.forgejo;
srv = cfg.settings.server;
in
{
imports = [
"shared/system.nix"
"shared/dev_user.nix"
"shared/docker.nix"
"shared/ssh.nix"
];
imports = [
./shared/system.nix
./shared/dev_user.nix
./shared/docker.nix
./shared/ssh.nix
];
services = {
# TODO: forgejo runner
gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = "default-runner";
url = "TODO";
tokenFile = config.age.secrets.forgejo-runner-token.path;
labels = [
"ubuntu-latest:docker://node:16-bullseye"
"ubuntu-22.04:docker://node:16-bullseye"
"ubuntu-20.04:docker://node:16-bullseye"
];
}
}
services = {
# TODO: forgejo runner
gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = "default-runner";
url = "TODO";
tokenFile = config.age.secrets.forgejo-runner-token.path;
labels = [
"ubuntu-latest:docker://node:16-bullseye"
"ubuntu-22.04:docker://node:16-bullseye"
"ubuntu-20.04:docker://node:16-bullseye"
];
};
};
}
};
}

32
shared/dev_user.nix
View file

@ -1,13 +1,23 @@
{ config, lib, pkgs, modulesPath, ... }:
{
users.users = {
# connection only via hashed password;
dev = {
isNormalUser = true;
home = "/home/dev";
description = "User used to manually connect to this system (e.g. for maintenance)";
extraGroups = [ "docker" "wheel" ];
hashedPasswordFile = "dev_user_password.pw";
}
config,
lib,
pkgs,
modulesPath,
...
}:
{
users.users = {
# connection only via hashed password;
dev = {
isNormalUser = true;
home = "/home/dev";
description = "User used to manually connect to this system (e.g. for maintenance)";
extraGroups = [
"docker"
"wheel"
];
hashedPasswordFile = ./.;
};
}
};
}

31
shared/system.nix
View file

@ -1,15 +1,24 @@
{ config, lib, pkgs, modulesPath, ... }:
{
system = "x86_64-linux";
system.stateVersion = "24.11";
config,
lib,
pkgs,
modulesPath,
...
}:
{
system.stateVersion = "24.11";
nix = {
settings = {
experimental-features = [ "nix-command" "flakes" ];
};
nix = {
settings = {
experimental-features = [
"nix-command"
"flakes"
];
};
};
environment.systemPackages = with pkgs; [
git
];
}
environment.systemPackages = with pkgs; [
git
];
}