fix: password errors that popped up

we write the contents of the hashedPasswordFile into a string to prevent
issues with paths that are used from the host and are invalid on the
deployment target

.gitignore

@@ -62,6 +62,3 @@ $RECYCLE.BIN/
 *.lnk
 
 # End of https://www.toptal.com/developers/gitignore/api/visualstudiocode,windows,linux
-
-
-*.pw

colmena.nix

@@ -1,33 +0,0 @@
-{
-    inputs = {
-        nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    };
-    outputs = { nixpkgs, ... }: {
-        colmena = {
-            meta = {
-                nixpkgs = import nixpkgs {
-                    system = "x86_64-linux";
-                    overlays = [];
-                };
-            };
-
-            # needed ?
-            #
-            # deployment = {
-            #   targetHost = "somehost.tld";
-            #   targetPort = 1234;
-            #   targetUser = "luser";
-            # };
-
-            git-system = { name, nodes, pkgs, ... }: {
-                import = "git_system.nix";
-            };
-            runner-system = { name, nodes, pkgs, ... }: {
-                import = "runner_system.nix";
-            };
-            dev-system = { name, nodes, pkgs, ... }: {
-                import = "dev_system.nix";
-            };
-        };
-    };
-}

dev_system.nix

@@ -5,27 +5,35 @@
 # NixOS-WSL specific options are documented on the NixOS-WSL repository:
 # https://github.com/nix-community/NixOS-WSL
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-    cfg = config.services.forgejo;
+  cfg = config.services.forgejo;
-    srv = cfg.settings.server;
+  srv = cfg.settings.server;
 in
 {
-    imports = [
+  imports = [
-        "shared/system.nix"
+    ./shared/system.nix
-        "shared/dev_user.nix"
+    ./shared/dev_user.nix
-        "shared/docker.nix"
+    ./shared/docker.nix
-        "shared/ssh.nix"
+    ./shared/ssh.nix
-    ];
 
-    users.users = {
+    ./dummy-hardware.nix
-        # connection only via ssh key
+  ];
-        pipeline = {
+
-            isNormalUser = true;
+  users.users = {
-            home = "/home/pipeline";
+    # connection only via ssh key
-            description = "User used by forgejo runners to connect to this system";
+    pipeline = {
-            extraGroups = [ "docker" ];
+      isNormalUser = true;
-            openssh.authorizedKeys.keys = [ "TODO" ];
+      home = "/home/pipeline";
-        };
+      description = "User used by forgejo runners to connect to this system";
+      extraGroups = [ "docker" ];
+      openssh.authorizedKeys.keys = [ "TODO" ];
     };
-}
+  };
+}
+

dummy-hardware.nix

@@ -0,0 +1,14 @@
+# TODO: Copy paste after install nixos, this should include `hardware-configuration.nix`s contents
+{
+  boot.loader.systemd-boot.enable = true;
+
+  fileSystems."/" = {
+    device = "/dev/disk/bazqux";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/foobar";
+    fsType = "vfat";
+  };
+}

execute.sh

@@ -2,4 +2,4 @@
 
 openssl passwd -6 $1 > dev_user_password.pw
 
-colmena apply -f colmena.nix
+colmena apply

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1745279238,
+        "narHash": "sha256-AQ7M9wTa/Pa/kK5pcGTgX/DGqMHyzsyINfN7ktsI7Fo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9684b53175fc6c09581e94cc85f05ab77464c7e3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,54 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  };
+
+  outputs =
+    { nixpkgs, ... }:
+    {
+      colmena = {
+        meta = {
+          nixpkgs = import nixpkgs {
+            system = "x86_64-linux";
+            overlays = [ ];
+          };
+        };
+
+        git-system =
+          {
+            name,
+            nodes,
+            pkgs,
+            ...
+          }:
+          {
+            deployment = {
+              targetHost = "somehost.tld";
+              targetPort = 1234;
+              targetUser = "luser";
+            };
+            imports = [ ./git_system.nix ];
+          };
+        runner-system =
+          {
+            name,
+            nodes,
+            pkgs,
+            ...
+          }:
+          {
+            imports = [ ./runner_system.nix ];
+          };
+        dev-system =
+          {
+            name,
+            nodes,
+            pkgs,
+            ...
+          }:
+          {
+            imports = [ ./dev_system.nix ];
+          };
+      };
+    };
+}

git_system.nix

@@ -5,99 +5,105 @@
 # NixOS-WSL specific options are documented on the NixOS-WSL repository:
 # https://github.com/nix-community/NixOS-WSL
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-    cfg = config.services.forgejo;
+  cfg = config.services.forgejo;
-    srv = cfg.settings.server;
+  srv = cfg.settings.server;
 in
 {
-    imports = [
+  imports = [
-        "shared/system.nix"
+    ./shared/system.nix
-        "shared/dev_user.nix"
+    ./shared/dev_user.nix
-        "shared/docker.nix"
+    ./shared/docker.nix
-        "shared/ssh.nix"
+    ./shared/ssh.nix
-    ];
+  ];
 
-    programs = {
+  programs = {
-        msmtp = {
+    msmtp = {
-            enable = true;
+      enable = true;
-            defaults = {
+      defaults = {
-                tls = true;
+        tls = true;
-            };
+      };
-            accounts = {
+      accounts = {
-                default = {
+        default = {
-                    auth = true;
+          auth = true;
-                    host = "TODO: e.g. smtp.strato.de";
+          host = "TODO: e.g. smtp.strato.de";
-                    port = 587;
+          port = 587;
-                    tls_starttls = true;
+          tls_starttls = true;
-                    from = "TODO: email";
+          from = "TODO: email";
-                    user = "TODO: email";
+          user = "TODO: email";
-                    password = "TODO";
+          password = "TODO";
-                };
-            };
         };
+      };
+    };
+  };
+
+  security.acme = {
+    defaults.email = "michael.huebner@ptspaper.de";
+    acceptTerms = true;
+  };
+
+  services = {
+    nginx = {
+      enable = true;
+      virtualHosts.${srv.DOMAIN} = {
+        forceSSL = true;
+        enableACME = true;
+        extraConfig = ''
+          client_max_body_size 512M;
+        '';
+        locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+      };
     };
 
-    security.acme = {
+    forgejo = {
-        defaults.email = "michael.huebner@ptspaper.de";
+      enable = true;
-        acceptTerms = true;
+      database.type = "postgres";
+      lfs.enable = true;
+      settings = {
+        server = {
+          DOMAIN = "localhost";
+          ROOT_URL = "https://${srv.DOMAIN}";
+          HTTP_PORT = 3000;
+          SSH_PORT = 62;
+        };
+        service.DISABLE_REGISTRATION = true;
+        actions = {
+          ENABLED = true;
+          DEFAULT_ACTIONS_URL = "github";
+        };
+      };
     };
 
-    services = {
+    renovate = {
-        nginx = {
+      enable = true;
-            enable = true;
+      schedule = "TODO";
-            virtualHosts.${srv.DOMAIN} = {
+      credentials = {
-                forceSSL = true;
+        RENOVATE_TOKEN = "/etc/renovate/token";
-                enableACME = true;
+      };
-                extraConfig = ''
+      settings = {
-                client_max_body_size 512M;
+        endpoint = "http://<TODO>.de/api/v1/";
-                '';
+        persistRepoData = true;
-                locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+        platform = "forgejo";
-            };
+        autodiscover = true;
-        };
+        onboardingConfig = {
-
+          extends = [ "config:recommended" ];
-        forgejo = {
-            enable = true;
-            database.type = "postgres";
-            lfs.enable = true;
-            settings = {
-                server = {
-                    DOMAIN = "localhost";
-                    ROOT_URL = "https://${srv.DOMAIN}";
-                    HTTP_PORT = 3000;
-                    SSH_PORT = 62;
-                };
-                service.DISABLE_REGISTRATION = true;
-                actions = {
-                    ENABLED = true;
-                    DEFAULT_ACTIONS_URL = "github";
-                };
-            };
-        };
-
-        renovate = {
-            enable = true;
-            schedule = "TODO";
-            credentials = {
-                RENOVATE_TOKEN = "/etc/renovate/token";
-            };
-            settings = {
-            endpoint = "http://<TODO>.de/api/v1/";
-            persistRepoData = true;
-            platform = "forgejo";
-            autodiscover = true;
-            onboardingConfig= {
-                extends= ["config:recommended"];
-            };
-            prCommitsPerRunLimit= 0;
-            };
-        };
-
-        cron = {
-            enable = true;
-            systemCronJobs = [
-                "00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
-            ];
         };
+        prCommitsPerRunLimit = 0;
+      };
     };
-}
+
+    cron = {
+      enable = true;
+      systemCronJobs = [
+        "00 03 * * * forgejo sh backup_forgejo.sh -d /var/lib/forgejo -u TODO -s TODO -p TODO"
+      ];
+    };
+  };
+}
+

runner_system.nix

@@ -5,34 +5,40 @@
 # NixOS-WSL specific options are documented on the NixOS-WSL repository:
 # https://github.com/nix-community/NixOS-WSL
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-    cfg = config.services.forgejo;
+  cfg = config.services.forgejo;
-    srv = cfg.settings.server;
+  srv = cfg.settings.server;
 in
 {
-    imports = [
+  imports = [
-        "shared/system.nix"
+    ./shared/system.nix
-        "shared/dev_user.nix"
+    ./shared/dev_user.nix
-        "shared/docker.nix"
+    ./shared/docker.nix
-        "shared/ssh.nix"
+    ./shared/ssh.nix
-    ];
+  ];
 
-    services = {
+  services = {
-        # TODO: forgejo runner
+    # TODO: forgejo runner
-        gitea-actions-runner = {
+    gitea-actions-runner = {
-        package = pkgs.forgejo-actions-runner;
+      package = pkgs.forgejo-actions-runner;
-        instances.default = {
+      instances.default = {
-            enable = true;
+        enable = true;
-            name = "default-runner";
+        name = "default-runner";
-            url = "TODO";
+        url = "TODO";
-            tokenFile = config.age.secrets.forgejo-runner-token.path;
+        tokenFile = config.age.secrets.forgejo-runner-token.path;
-            labels = [
+        labels = [
-                "ubuntu-latest:docker://node:16-bullseye"
+          "ubuntu-latest:docker://node:16-bullseye"
-                "ubuntu-22.04:docker://node:16-bullseye"
+          "ubuntu-22.04:docker://node:16-bullseye"
-                "ubuntu-20.04:docker://node:16-bullseye"
+          "ubuntu-20.04:docker://node:16-bullseye"
-                ];
+        ];
-            }
+      };
-        }
     };
-}
+  };
+}
+

shared/dev_user.nix

@@ -1,13 +1,23 @@
-{ config, lib, pkgs, modulesPath, ... }:
 {
-    users.users = {
+  config,
-        # connection only via hashed password;
+  lib,
-        dev = {
+  pkgs,
-            isNormalUser = true;
+  modulesPath,
-            home = "/home/dev";
+  ...
-            description = "User used to manually connect to this system (e.g. for maintenance)";
+}:
-            extraGroups = [ "docker" "wheel" ];
+{
-            hashedPasswordFile = "dev_user_password.pw";
+  users.users = {
-        }
+    # connection only via hashed password;
+    dev = {
+      isNormalUser = true;
+      home = "/home/dev";
+      description = "User used to manually connect to this system (e.g. for maintenance)";
+      extraGroups = [
+        "docker"
+        "wheel"
+      ];
+      hashedPassword = "${builtins.readFile ./../dev_user_password.pw}";
     };
-}
+  };
+}
+

shared/system.nix

@@ -1,15 +1,24 @@
-{ config, lib, pkgs, modulesPath, ... }:
 {
-    system = "x86_64-linux";
+  config,
-    system.stateVersion = "24.11";
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  system.stateVersion = "24.11";
 
-    nix = {
+  nix = {
-        settings = {
+    settings = {
-            experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = [
-        };
+        "nix-command"
+        "flakes"
+      ];
     };
+  };
+
+  environment.systemPackages = with pkgs; [
+    git
+  ];
+}
 
-    environment.systemPackages = with pkgs; [
-        git
-    ];
-}