upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: forgejo microVM

Browse source
This commit is contained in:
Nick 2025-11-06 04:08:29 -06:00
parent 1f4c493072
commit 1376cdbe77
9 changed files with 245 additions and 157 deletions
Download patch file Download diff file Expand all files Collapse all files

41
modules/config/instances/config/vaultwarden.nix
View file

@ -2,14 +2,18 @@
let let
inherit (moduleFunctions.instancesFunctions) inherit (moduleFunctions.instancesFunctions)
domain0 domain0
servicePath
sslPath sslPath
sopsPath idPrefix
userPrefix
varPath
mntPath
secretPath
; ;
label = "Vaultwarden"; label = "Vaultwarden";
name = "vaultwarden"; name = "vaultwarden";
domain = "${name}.${domain0}"; domain = "${name}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${name}.${domain0}";
in in
{ {
label = label; label = label;
@ -18,9 +22,6 @@ in
email = { email = {
address0 = "noreply@${name}.${domain0}"; address0 = "noreply@${name}.${domain0}";
}; };
sops = {
path0 = "${sopsPath}/${name}";
};
domains = { domains = {
url0 = domain; url0 = domain;
}; };
@ -32,14 +33,30 @@ in
"bit" "bit"
"warden" "warden"
]; ];
paths = {
path0 = "${servicePath}/${label}/BackupDir";
};
ports = { ports = {
port0 = 8085; # Vaultwarden WebUI port0 = 8085;
};
interface = {
id = "${idPrefix}-${name}";
mac = "02:00:00:00:00:51";
idUser = "${userPrefix}-${name}";
macUser = "02:00:00:00:00:03";
ip = "192.168.50.51";
gate = "192.168.50.1";
ssh = 2201;
}; };
ssl = { ssl = {
cert = "${sslPath}/${name}.${domain0}/fullchain.pem"; path = ssl;
key = "${sslPath}/${name}.${domain0}/key.pem"; cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
}; };
} }

8
modules/nixos/default.nix
View file

@ -45,18 +45,18 @@ in
ceres = { ceres = {
imports = builtins.attrValues { imports = builtins.attrValues {
inherit (modules) inherit (modules)
# acmeCeres acmeCeres
# audiobookshelf # audiobookshelf
# caddyCeres caddyCeres
# comfyui # comfyui
# filesorter # filesorter
# firefly-iii # firefly-iii
# forgejo forgejo
# glance # glance
# jellyfin # jellyfin
# logrotate # logrotate
# mastodon # mastodon
# microvm microvm
# minecraft # minecraft
# ollamaCeres # ollamaCeres
# postgresCeres # postgresCeres

1
modules/nixos/programs/virtManager/default.nix
View file

@ -1,4 +1,5 @@
{ {
programs.virt-manager.enable = true; programs.virt-manager.enable = true;
virtualisation.libvirtd.enable = true; virtualisation.libvirtd.enable = true;
users.groups.kvm = { };
} }

28
modules/nixos/services/acme/acmeCeres/default.nix
View file

@ -31,22 +31,22 @@ in
}; };
in in
{ {
"${instances.audiobookshelf.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.audiobookshelf.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.glance.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.glance.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.jellyfin.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.jellyfin.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.ollama.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.ollama.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.searx.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.searx.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.syncthing.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.syncthing.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.vaultwarden.domains.url0}" = dnsConfig dns0Path dns0; "${instances.vaultwarden.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.prompter.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.prompter.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.comfyui.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.comfyui.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.firefly-iii.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.firefly-iii.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.opencloud.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.opencloud.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.forgejo.domains.url0}" = dnsConfig dns0Path dns0; "${instances.forgejo.domains.url0}" = dnsConfig dns0Path dns0;
"${instances.mastodon.domains.url0}" = dnsConfig dns0Path dns0; # "${instances.mastodon.domains.url0}" = dnsConfig dns0Path dns0;
"${domain0}" = dnsConfig dns0Path dns0; # "${domain0}" = dnsConfig dns0Path dns0;
"${domain1}" = dnsConfig dns0Path dns0; # "${domain1}" = dnsConfig dns0Path dns0;
"${domain4}" = dnsConfig dns1Path dns1; # "${domain4}" = dnsConfig dns1Path dns1;
}; };
}; };

17
modules/nixos/services/caddy/caddyCeres/default.nix
View file

@ -1,29 +1,12 @@
{ flake, ... }: { flake, ... }:
let let
inherit (flake.config.services) instances; inherit (flake.config.services) instances;
inherit (flake.config.machines) devices;
domain0 = instances.web.domains.url0;
service = instances.caddy; service = instances.caddy;
opencloud = instances.opencloud;
in in
{ {
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts = {
"${domain0}" = {
extraConfig = ''
tls /var/lib/acme/${domain0}/fullchain.pem /var/lib/acme/${domain0}/key.pem
encode zstd gzip
'';
};
# "${opencloud.domains.url0}" = {
# extraConfig = ''
# reverse_proxy http://${devices.eris.ip.address0}:${builtins.toString service.ports.port4}
# tls ${opencloud.ssl.cert} ${opencloud.ssl.key}
# '';
# };
};
}; };
users.users.${service.name}.extraGroups = [ users.users.${service.name}.extraGroups = [
"acme" "acme"

11
modules/nixos/services/forgejo/default.nix
View file

@ -164,6 +164,12 @@ in
source = service.ssl.path; source = service.ssl.path;
tag = "acme_certs"; tag = "acme_certs";
} }
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/var/lib/secrets";
tag = "run_secrets";
}
]; ];
forwardPorts = [ forwardPorts = [
@ -179,6 +185,11 @@ in
}; };
}; };
systemd.tmpfiles.rules = [
"d ${service.mntPaths.path0} 0755 root root -"
"d ${service.secretPaths.path0} 0755 root root -"
];
services.caddy.virtualHosts."${host}" = { services.caddy.virtualHosts."${host}" = {
extraConfig = '' extraConfig = ''
reverse_proxy ${service.interface.ip}:${toString service.ports.port0} reverse_proxy ${service.interface.ip}:${toString service.ports.port0}

232
modules/nixos/services/vaultwarden/default.nix
View file

@ -1,76 +1,174 @@
{ {
flake, flake,
config,
lib,
... ...
}: }:
let let
inherit (flake.config.services) instances; inherit (flake.config.people) user0;
service = instances.vaultwarden; inherit (flake.config.services.instances) vaultwarden smtp web;
localhost = instances.web.localhost.address0; service = vaultwarden;
host = service.domains.url0; host = vaultwarden.domains.url0;
syncthing = instances.syncthing; secrets = service.secretPaths.path0;
localhost = web.localhost.address0;
backupPath = "${syncthing.paths.path1}/${service.name}"; sshPort = 22;
in in
{ {
services = { microvm = {
vaultwarden = { vms = {
backupDir = backupPath; vaultwarden = {
enable = true; autostart = true;
environmentFile = config.sops.secrets."${service.name}/env".path; config =
config = { {
# Domain Configuration config,
DOMAIN = "https://${host}"; pkgs,
lib,
...
}:
{
system.stateVersion = "25.05";
time.timeZone = "America/Winnipeg";
# Email Configuration users.users.root = {
SMTP_AUTH_MECHANISM = "Plain"; openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
SMTP_EMBED_IMAGES = true; };
SMTP_FROM = instances.smtp.email.address0;
SMTP_FROM_NAME = service.label;
SMTP_HOST = instances.smtp.hostname;
SMTP_PORT = instances.smtp.ports.port1;
SMTP_SECURITY = instances.smtp.records.record1;
SMTP_USERNAME = instances.smtp.email.address0;
# Security Configuration services = {
DISABLE_ADMIN_TOKEN = false; vaultwarden = {
enable = true;
environmentFile = config.sops.secrets."${service.name}-env".path;
config = {
# Domain Configuration
DOMAIN = "https://${host}";
# Email Configuration
SMTP_AUTH_MECHANISM = "Plain";
SMTP_EMBED_IMAGES = true;
SMTP_FROM = smtp.email.address0;
SMTP_FROM_NAME = service.label;
SMTP_HOST = smtp.hostname;
SMTP_PORT = smtp.ports.port1;
SMTP_SECURITY = smtp.records.record1;
SMTP_USERNAME = smtp.email.address0;
# Security Configuration
DISABLE_ADMIN_TOKEN = false;
# Event and Backup Management
EVENTS_DAYS_RETAIN = 90;
# User Features
SENDS_ALLOWED = true;
SIGNUPS_VERIFY = true;
WEB_VAULT_ENABLED = true;
# Rocket (Web Server) Settings
ROCKET_ADDRESS = localhost;
ROCKET_PORT = service.ports.port0;
};
};
# Event and Backup Management openssh = {
EVENTS_DAYS_RETAIN = 90; enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
# User Features systemd = {
SENDS_ALLOWED = true; tmpfiles.rules = [
SIGNUPS_VERIFY = true; "d ${secrets} 0755 ${service.name} ${service.name} -"
WEB_VAULT_ENABLED = true; ];
# Rocket (Web Server) Settings network = {
ROCKET_ADDRESS = localhost; enable = true;
ROCKET_PORT = service.ports.port0; networks."10-enp" = {
matchConfig.Name = "enp0s4";
addresses = [ { Address = "${service.interface.ip}/24"; } ];
routes = [
{
Destination = "${localhost}/0";
Gateway = service.interface.gate;
}
];
dns = [ service.interface.gate ];
};
};
};
networking.firewall.allowedTCPPorts = [
sshPort
service.ports.port0
];
microvm = {
vcpu = 2;
mem = 2048;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = service.interface.id;
mac = service.interface.mac;
}
{
type = "user";
id = service.interface.idUser;
mac = service.interface.macUser;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = service.varPaths.path0;
proto = "virtiofs";
source = service.mntPaths.path0;
tag = "${service.name}_data";
}
{
mountPoint = service.secretPaths.path0;
proto = "virtiofs";
source = service.secretPaths.path0;
tag = "${service.name}_secrets";
}
{
mountPoint = service.ssl.path;
proto = "virtiofs";
source = service.ssl.path;
tag = "acme_certs";
}
];
forwardPorts = [
{
from = "host";
host.port = service.interface.ssh;
guest.port = sshPort;
}
];
};
};
}; };
}; };
caddy = { };
virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${localhost}:${toString service.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${service.ssl.cert} ${service.ssl.key} services.caddy.virtualHosts."${host}" = {
extraConfig = ''
encode zstd gzip reverse_proxy ${service.interface.ip}:${toString service.ports.port0} {
''; header_up X-Real-IP {remote_host}
}; }
}; tls ${service.ssl.cert} ${service.ssl.key}
}; encode zstd gzip
'';
}; };
sops = sops =
let let
sopsPath = secret: { sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}"; path = "${secrets}/${service.name}-${secret}";
owner = service.name; owner = "root";
mode = "600"; mode = "600";
}; };
in in
@ -78,7 +176,7 @@ in
secrets = builtins.listToAttrs ( secrets = builtins.listToAttrs (
map map
(secret: { (secret: {
name = "${service.name}/${secret}"; name = "${service.name}-${secret}";
value = sopsPath secret; value = sopsPath secret;
}) })
[ [
@ -86,30 +184,4 @@ in
] ]
); );
}; };
systemd = {
tmpfiles.rules = [
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
];
services.backup-vaultwarden = {
serviceConfig = {
Group = lib.mkForce syncthing.name;
};
wantedBy = lib.mkForce [ ];
after = [ "${service.name}.service" ];
};
};
users.users.${service.name}.extraGroups = [
syncthing.name
];
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0
];
};
};
} }

54
profiles/user0/default.nix
View file

@ -63,31 +63,35 @@ in
home = { home = {
username = user0; username = user0;
homeDirectory = "/home/${user0}"; homeDirectory = "/home/${user0}";
file = { file =
"./justfile" = import ./files/misc/justfile.nix { inherit flake config lib; }; if hostname == devices.ceres.name then
"./.config/scripts/list.sh" = { { }
source = ./files/scripts/list.sh; else
executable = true; {
}; "./justfile" = import ./files/misc/justfile.nix { inherit flake config lib; };
"./.config/scripts/loop.sh" = { "./.config/scripts/list.sh" = {
source = ./files/scripts/loop.sh; source = ./files/scripts/list.sh;
executable = true; executable = true;
}; };
"./.config/scripts/get_weather.sh" = { "./.config/scripts/loop.sh" = {
source = ./files/scripts/get_weather.sh; source = ./files/scripts/loop.sh;
executable = true; executable = true;
}; };
".config/wallpaper" = { "./.config/scripts/get_weather.sh" = {
source = ./files/wallpaper; source = ./files/scripts/get_weather.sh;
recursive = true; executable = true;
}; };
"./.config/vesktop/themes/macchiato-theme.css" = { ".config/wallpaper" = {
source = ./files/themes/vesktop/macchiato-theme.css; source = ./files/wallpaper;
}; recursive = true;
"./.config/qBittorrent/themes/catppuccin-mocha.qbtheme" = { };
source = ./files/themes/qbittorrent/macchiato.qbtheme; "./.config/vesktop/themes/macchiato-theme.css" = {
}; source = ./files/themes/vesktop/macchiato-theme.css;
}; };
"./.config/qBittorrent/themes/catppuccin-mocha.qbtheme" = {
source = ./files/themes/qbittorrent/macchiato.qbtheme;
};
};
sessionVariables = { sessionVariables = {
VISUAL = lib.getExe pkgs.zed-editor; VISUAL = lib.getExe pkgs.zed-editor;
GTK_THEME = "catppuccin-macchiato-mauve-compact"; GTK_THEME = "catppuccin-macchiato-mauve-compact";

10
systems/mars/config/filesystem.nix
View file

@ -59,11 +59,11 @@ in
fsType = "vfat"; fsType = "vfat";
options = mars.boot.options; options = mars.boot.options;
}; };
} };
// (builtins.listToAttrs (map storageMounts storageDrives)) # // (builtins.listToAttrs (map storageMounts storageDrives))
// (builtins.listToAttrs ( # // (builtins.listToAttrs (
builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives # builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
)); # ));
swapDevices = [ swapDevices = [
{ device = "/dev/disk/by-uuid/6b56990c-545d-4d00-b93b-8ca1f143882e"; } { device = "/dev/disk/by-uuid/6b56990c-545d-4d00-b93b-8ca1f143882e"; }