.gitignore

@@ -62,3 +62,6 @@ $RECYCLE.BIN/
 *.lnk
 
 # End of https://www.toptal.com/developers/gitignore/api/visualstudiocode,windows,linux
+
+
+*.pw

colmena.nix

@@ -0,0 +1,33 @@
+{
+    inputs = {
+        nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    };
+    outputs = { nixpkgs, ... }: {
+        colmena = {
+            meta = {
+                nixpkgs = import nixpkgs {
+                    system = "x86_64-linux";
+                    overlays = [];
+                };
+            };
+
+            # needed ?
+            #
+            # deployment = {
+            #   targetHost = "somehost.tld";
+            #   targetPort = 1234;
+            #   targetUser = "luser";
+            # };
+
+            git-system = { name, nodes, pkgs, ... }: {
+                import = "git_system.nix";
+            };
+            runner-system = { name, nodes, pkgs, ... }: {
+                import = "runner_system.nix";
+            };
+            dev-system = { name, nodes, pkgs, ... }: {
+                import = "dev_system.nix";
+            };
+        };
+    };
+}

dev_system.nix

@@ -5,35 +5,27 @@
 # NixOS-WSL specific options are documented on the NixOS-WSL repository:
 # https://github.com/nix-community/NixOS-WSL
 
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
-  cfg = config.services.forgejo;
+    cfg = config.services.forgejo;
-  srv = cfg.settings.server;
+    srv = cfg.settings.server;
 in
 {
-  imports = [
+    imports = [
-    ./shared/system.nix
+        "shared/system.nix"
-    ./shared/dev_user.nix
+        "shared/dev_user.nix"
-    ./shared/docker.nix
+        "shared/docker.nix"
-    ./shared/ssh.nix
+        "shared/ssh.nix"
+    ];
 
-    ./dummy-hardware.nix
+    users.users = {
-  ];
+        # connection only via ssh key
-
+        pipeline = {
-  users.users = {
+            isNormalUser = true;
-    # connection only via ssh key
+            home = "/home/pipeline";
-    pipeline = {
+            description = "User used by forgejo runners to connect to this system";
-      isNormalUser = true;
+            extraGroups = [ "docker" ];
-      home = "/home/pipeline";
+            openssh.authorizedKeys.keys = [ "TODO" ];
-      description = "User used by forgejo runners to connect to this system";
+        };
-      extraGroups = [ "docker" ];
-      openssh.authorizedKeys.keys = [ "TODO" ];
     };
-  };
+}
-}
-

dummy-hardware.nix

@@ -1,14 +0,0 @@
-# TODO: Copy paste after install nixos, this should include `hardware-configuration.nix`s contents
-{
-  boot.loader.systemd-boot.enable = true;
-
-  fileSystems."/" = {
-    device = "/dev/disk/bazqux";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/foobar";
-    fsType = "vfat";
-  };
-}

execute.sh

@@ -2,4 +2,4 @@
 
 openssl passwd -6 $1 > dev_user_password.pw
 
-colmena apply
+colmena apply -f colmena.nix

flake.lock

@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1745279238,
-        "narHash": "sha256-AQ7M9wTa/Pa/kK5pcGTgX/DGqMHyzsyINfN7ktsI7Fo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9684b53175fc6c09581e94cc85f05ab77464c7e3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,54 +0,0 @@
-{
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-  };
-
-  outputs =
-    { nixpkgs, ... }:
-    {
-      colmena = {
-        meta = {
-          nixpkgs = import nixpkgs {
-            system = "x86_64-linux";
-            overlays = [ ];
-          };
-        };
-
-        git-system =
-          {
-            name,
-            nodes,
-            pkgs,
-            ...
-          }:
-          {
-            deployment = {
-              targetHost = "somehost.tld";
-              targetPort = 1234;
-              targetUser = "luser";
-            };
-            imports = [ ./git_system.nix ];
-          };
-        runner-system =
-          {
-            name,
-            nodes,
-            pkgs,
-            ...
-          }:
-          {
-            imports = [ ./runner_system.nix ];
-          };
-        dev-system =
-          {
-            name,
-            nodes,
-            pkgs,
-            ...
-          }:
-          {
-            imports = [ ./dev_system.nix ];
-          };
-      };
-    };
-}

git_system.nix

@@ -5,105 +5,99 @@
 # NixOS-WSL specific options are documented on the NixOS-WSL repository:
 # https://github.com/nix-community/NixOS-WSL
 
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
-  cfg = config.services.forgejo;
+    cfg = config.services.forgejo;
-  srv = cfg.settings.server;
+    srv = cfg.settings.server;
 in
 {
-  imports = [
+    imports = [
-    ./shared/system.nix
+        "shared/system.nix"
-    ./shared/dev_user.nix
+        "shared/dev_user.nix"
-    ./shared/docker.nix
+        "shared/docker.nix"
-    ./shared/ssh.nix
+        "shared/ssh.nix"
-  ];
+    ];
 
-  programs = {
+    programs = {
-    msmtp = {
+        msmtp = {
-      enable = true;
+            enable = true;
-      defaults = {
+            defaults = {
-        tls = true;
+                tls = true;
-      };
+            };
-      accounts = {
+            accounts = {
-        default = {
+                default = {
-          auth = true;
+                    auth = true;
-          host = "TODO: e.g. smtp.strato.de";
+                    host = "TODO: e.g. smtp.strato.de";
-          port = 587;
+                    port = 587;
-          tls_starttls = true;
+                    tls_starttls = true;
-          from = "TODO: email";
+                    from = "TODO: email";
-          user = "TODO: email";
+                    user = "TODO: email";
-          password = "TODO";
+                    password = "TODO";
+                };
+            };
         };
-      };
-    };
-  };
-
-  security.acme = {
-    defaults.email = "michael.huebner@ptspaper.de";
-    acceptTerms = true;
-  };
-
-  services = {
-    nginx = {
-      enable = true;
-      virtualHosts.${srv.DOMAIN} = {
-        forceSSL = true;
-        enableACME = true;
-        extraConfig = ''
-          client_max_body_size 512M;
-        '';
-        locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
-      };
     };
 
-    forgejo = {
+    security.acme = {
-      enable = true;
+        defaults.email = "michael.huebner@ptspaper.de";
-      database.type = "postgres";
+        acceptTerms = true;
-      lfs.enable = true;
+    };
-      settings = {
+
-        server = {
+    services = {
-          DOMAIN = "localhost";
+        nginx = {
-          ROOT_URL = "https://${srv.DOMAIN}";
+            enable = true;
-          HTTP_PORT = 3000;
+            virtualHosts.${srv.DOMAIN} = {
-          SSH_PORT = 62;
+                forceSSL = true;
+                enableACME = true;
+                extraConfig = ''
+                client_max_body_size 512M;
+                '';
+                locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+            };
         };
-        service.DISABLE_REGISTRATION = true;
+
-        actions = {
+        forgejo = {
-          ENABLED = true;
+            enable = true;
-          DEFAULT_ACTIONS_URL = "github";
+            database.type = "postgres";
+            lfs.enable = true;
+            settings = {
+                server = {
+                    DOMAIN = "localhost";
+                    ROOT_URL = "https://${srv.DOMAIN}";
+                    HTTP_PORT = 3000;
+                    SSH_PORT = 62;
+                };
+                service.DISABLE_REGISTRATION = true;
+                actions = {
+                    ENABLED = true;
+                    DEFAULT_ACTIONS_URL = "github";
+                };
+            };
         };
-      };
-    };
 
-    renovate = {
+        renovate = {
-      enable = true;
+            enable = true;
-      schedule = "TODO";
+            schedule = "TODO";
-      credentials = {
+            credentials = {
-        RENOVATE_TOKEN = "/etc/renovate/token";
+                RENOVATE_TOKEN = "/etc/renovate/token";
-      };
+            };
-      settings = {
+            settings = {
-        endpoint = "http://<TODO>.de/api/v1/";
+            endpoint = "http://<TODO>.de/api/v1/";
-        persistRepoData = true;
+            persistRepoData = true;
-        platform = "forgejo";
+            platform = "forgejo";
-        autodiscover = true;
+            autodiscover = true;
-        onboardingConfig = {
+            onboardingConfig= {
-          extends = [ "config:recommended" ];
+                extends= ["config:recommended"];
+            };
+            prCommitsPerRunLimit= 0;
+            };
         };
-        prCommitsPerRunLimit = 0;
-      };
-    };
 
-    cron = {
+        cron = {
-      enable = true;
+            enable = true;
-      systemCronJobs = [
+            systemCronJobs = [
-        "00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
+                "00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
-      ];
+            ];
+        };
     };
-  };
+}
-}
-

runner_system.nix

@@ -5,40 +5,34 @@
 # NixOS-WSL specific options are documented on the NixOS-WSL repository:
 # https://github.com/nix-community/NixOS-WSL
 
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
-  cfg = config.services.forgejo;
+    cfg = config.services.forgejo;
-  srv = cfg.settings.server;
+    srv = cfg.settings.server;
 in
 {
-  imports = [
+    imports = [
-    ./shared/system.nix
+        "shared/system.nix"
-    ./shared/dev_user.nix
+        "shared/dev_user.nix"
-    ./shared/docker.nix
+        "shared/docker.nix"
-    ./shared/ssh.nix
+        "shared/ssh.nix"
-  ];
+    ];
 
-  services = {
+    services = {
-    # TODO: forgejo runner
+        # TODO: forgejo runner
-    gitea-actions-runner = {
+        gitea-actions-runner = {
-      package = pkgs.forgejo-actions-runner;
+        package = pkgs.forgejo-actions-runner;
-      instances.default = {
+        instances.default = {
-        enable = true;
+            enable = true;
-        name = "default-runner";
+            name = "default-runner";
-        url = "TODO";
+            url = "TODO";
-        tokenFile = config.age.secrets.forgejo-runner-token.path;
+            tokenFile = config.age.secrets.forgejo-runner-token.path;
-        labels = [
+            labels = [
-          "ubuntu-latest:docker://node:16-bullseye"
+                "ubuntu-latest:docker://node:16-bullseye"
-          "ubuntu-22.04:docker://node:16-bullseye"
+                "ubuntu-22.04:docker://node:16-bullseye"
-          "ubuntu-20.04:docker://node:16-bullseye"
+                "ubuntu-20.04:docker://node:16-bullseye"
-        ];
+                ];
-      };
+            }
+        }
     };
-  };
+}
-}
-

shared/dev_user.nix

@@ -1,23 +1,13 @@
+{ config, lib, pkgs, modulesPath, ... }:
 {
-  config,
+    users.users = {
-  lib,
+        # connection only via hashed password;
-  pkgs,
+        dev = {
-  modulesPath,
+            isNormalUser = true;
-  ...
+            home = "/home/dev";
-}:
+            description = "User used to manually connect to this system (e.g. for maintenance)";
-{
+            extraGroups = [ "docker" "wheel" ];
-  users.users = {
+            hashedPasswordFile = "dev_user_password.pw";
-    # connection only via hashed password;
+        }
-    dev = {
-      isNormalUser = true;
-      home = "/home/dev";
-      description = "User used to manually connect to this system (e.g. for maintenance)";
-      extraGroups = [
-        "docker"
-        "wheel"
-      ];
-      hashedPassword = "${builtins.readFile ./../dev_user_password.pw}";
     };
-  };
+}
-}
-

shared/system.nix

@@ -1,24 +1,15 @@
+{ config, lib, pkgs, modulesPath, ... }:
 {
-  config,
+    system = "x86_64-linux";
-  lib,
+    system.stateVersion = "24.11";
-  pkgs,
-  modulesPath,
-  ...
-}:
-{
-  system.stateVersion = "24.11";
 
-  nix = {
+    nix = {
-    settings = {
+        settings = {
-      experimental-features = [
+            experimental-features = [ "nix-command" "flakes" ];
-        "nix-command"
+        };
-        "flakes"
-      ];
     };
-  };
-
-  environment.systemPackages = with pkgs; [
-    git
-  ];
-}
 
+    environment.systemPackages = with pkgs; [
+        git
+    ];
+}