mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-06 21:17:14 -06:00
test: forgejo microVM
This commit is contained in:
Nick
parent
1f4c493072
commit
1376cdbe77
9 changed files with 245 additions and 157 deletions
|
|
@ -2,14 +2,18 @@
|
|||
let
|
||||
inherit (moduleFunctions.instancesFunctions)
|
||||
domain0
|
||||
servicePath
|
||||
sslPath
|
||||
sopsPath
|
||||
idPrefix
|
||||
userPrefix
|
||||
varPath
|
||||
mntPath
|
||||
secretPath
|
||||
;
|
||||
|
||||
label = "Vaultwarden";
|
||||
name = "vaultwarden";
|
||||
domain = "${name}.${domain0}";
|
||||
secrets = "${secretPath}/${name}";
|
||||
ssl = "${sslPath}/${name}.${domain0}";
|
||||
in
|
||||
{
|
||||
label = label;
|
||||
|
|
@ -18,9 +22,6 @@ in
|
|||
email = {
|
||||
address0 = "noreply@${name}.${domain0}";
|
||||
};
|
||||
sops = {
|
||||
path0 = "${sopsPath}/${name}";
|
||||
};
|
||||
domains = {
|
||||
url0 = domain;
|
||||
};
|
||||
|
|
@ -32,14 +33,30 @@ in
|
|||
"bit"
|
||||
"warden"
|
||||
];
|
||||
paths = {
|
||||
path0 = "${servicePath}/${label}/BackupDir";
|
||||
};
|
||||
ports = {
|
||||
port0 = 8085; # Vaultwarden WebUI
|
||||
port0 = 8085;
|
||||
};
|
||||
interface = {
|
||||
id = "${idPrefix}-${name}";
|
||||
mac = "02:00:00:00:00:51";
|
||||
idUser = "${userPrefix}-${name}";
|
||||
macUser = "02:00:00:00:00:03";
|
||||
ip = "192.168.50.51";
|
||||
gate = "192.168.50.1";
|
||||
ssh = 2201;
|
||||
};
|
||||
ssl = {
|
||||
cert = "${sslPath}/${name}.${domain0}/fullchain.pem";
|
||||
key = "${sslPath}/${name}.${domain0}/key.pem";
|
||||
path = ssl;
|
||||
cert = "${ssl}/fullchain.pem";
|
||||
key = "${ssl}/key.pem";
|
||||
};
|
||||
varPaths = {
|
||||
path0 = "${varPath}/${name}";
|
||||
};
|
||||
mntPaths = {
|
||||
path0 = "${mntPath}/${name}";
|
||||
};
|
||||
secretPaths = {
|
||||
path0 = secrets;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -45,18 +45,18 @@ in
|
|||
ceres = {
|
||||
imports = builtins.attrValues {
|
||||
inherit (modules)
|
||||
# acmeCeres
|
||||
acmeCeres
|
||||
# audiobookshelf
|
||||
# caddyCeres
|
||||
caddyCeres
|
||||
# comfyui
|
||||
# filesorter
|
||||
# firefly-iii
|
||||
# forgejo
|
||||
forgejo
|
||||
# glance
|
||||
# jellyfin
|
||||
# logrotate
|
||||
# mastodon
|
||||
# microvm
|
||||
microvm
|
||||
# minecraft
|
||||
# ollamaCeres
|
||||
# postgresCeres
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{
|
||||
programs.virt-manager.enable = true;
|
||||
virtualisation.libvirtd.enable = true;
|
||||
users.groups.kvm = { };
|
||||
}
|
||||
|
|
|
|||
|
|
@ -31,22 +31,22 @@ in
|
|||
};
|
||||
in
|
||||
{
|
||||
"${instances.audiobookshelf.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.glance.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.jellyfin.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.ollama.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.searx.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.syncthing.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.audiobookshelf.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.glance.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.jellyfin.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.ollama.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.searx.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.syncthing.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.vaultwarden.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.prompter.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.comfyui.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.firefly-iii.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.opencloud.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.prompter.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.comfyui.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.firefly-iii.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${instances.opencloud.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.forgejo.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${instances.mastodon.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
"${domain0}" = dnsConfig dns0Path dns0;
|
||||
"${domain1}" = dnsConfig dns0Path dns0;
|
||||
"${domain4}" = dnsConfig dns1Path dns1;
|
||||
# "${instances.mastodon.domains.url0}" = dnsConfig dns0Path dns0;
|
||||
# "${domain0}" = dnsConfig dns0Path dns0;
|
||||
# "${domain1}" = dnsConfig dns0Path dns0;
|
||||
# "${domain4}" = dnsConfig dns1Path dns1;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,29 +1,12 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services) instances;
|
||||
inherit (flake.config.machines) devices;
|
||||
|
||||
domain0 = instances.web.domains.url0;
|
||||
service = instances.caddy;
|
||||
opencloud = instances.opencloud;
|
||||
in
|
||||
{
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"${domain0}" = {
|
||||
extraConfig = ''
|
||||
tls /var/lib/acme/${domain0}/fullchain.pem /var/lib/acme/${domain0}/key.pem
|
||||
encode zstd gzip
|
||||
'';
|
||||
};
|
||||
# "${opencloud.domains.url0}" = {
|
||||
# extraConfig = ''
|
||||
# reverse_proxy http://${devices.eris.ip.address0}:${builtins.toString service.ports.port4}
|
||||
# tls ${opencloud.ssl.cert} ${opencloud.ssl.key}
|
||||
# '';
|
||||
# };
|
||||
};
|
||||
};
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"acme"
|
||||
|
|
|
|||
|
|
@ -164,6 +164,12 @@ in
|
|||
source = service.ssl.path;
|
||||
tag = "acme_certs";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/var/lib/secrets";
|
||||
tag = "run_secrets";
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
|
|
@ -179,6 +185,11 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${service.mntPaths.path0} 0755 root root -"
|
||||
"d ${service.secretPaths.path0} 0755 root root -"
|
||||
];
|
||||
|
||||
services.caddy.virtualHosts."${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${service.interface.ip}:${toString service.ports.port0}
|
||||
|
|
|
|||
|
|
@ -1,76 +1,174 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.services) instances;
|
||||
service = instances.vaultwarden;
|
||||
localhost = instances.web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
syncthing = instances.syncthing;
|
||||
|
||||
backupPath = "${syncthing.paths.path1}/${service.name}";
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) vaultwarden smtp web;
|
||||
service = vaultwarden;
|
||||
host = vaultwarden.domains.url0;
|
||||
secrets = service.secretPaths.path0;
|
||||
localhost = web.localhost.address0;
|
||||
sshPort = 22;
|
||||
in
|
||||
{
|
||||
microvm = {
|
||||
vms = {
|
||||
vaultwarden = {
|
||||
autostart = true;
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
system.stateVersion = "25.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
|
||||
users.users.root = {
|
||||
openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
};
|
||||
|
||||
services = {
|
||||
vaultwarden = {
|
||||
backupDir = backupPath;
|
||||
enable = true;
|
||||
environmentFile = config.sops.secrets."${service.name}/env".path;
|
||||
environmentFile = config.sops.secrets."${service.name}-env".path;
|
||||
config = {
|
||||
# Domain Configuration
|
||||
DOMAIN = "https://${host}";
|
||||
|
||||
# Email Configuration
|
||||
SMTP_AUTH_MECHANISM = "Plain";
|
||||
SMTP_EMBED_IMAGES = true;
|
||||
SMTP_FROM = instances.smtp.email.address0;
|
||||
SMTP_FROM = smtp.email.address0;
|
||||
SMTP_FROM_NAME = service.label;
|
||||
SMTP_HOST = instances.smtp.hostname;
|
||||
SMTP_PORT = instances.smtp.ports.port1;
|
||||
SMTP_SECURITY = instances.smtp.records.record1;
|
||||
SMTP_USERNAME = instances.smtp.email.address0;
|
||||
|
||||
SMTP_HOST = smtp.hostname;
|
||||
SMTP_PORT = smtp.ports.port1;
|
||||
SMTP_SECURITY = smtp.records.record1;
|
||||
SMTP_USERNAME = smtp.email.address0;
|
||||
# Security Configuration
|
||||
DISABLE_ADMIN_TOKEN = false;
|
||||
|
||||
# Event and Backup Management
|
||||
EVENTS_DAYS_RETAIN = 90;
|
||||
|
||||
# User Features
|
||||
SENDS_ALLOWED = true;
|
||||
SIGNUPS_VERIFY = true;
|
||||
WEB_VAULT_ENABLED = true;
|
||||
|
||||
# Rocket (Web Server) Settings
|
||||
ROCKET_ADDRESS = localhost;
|
||||
ROCKET_PORT = service.ports.port0;
|
||||
};
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd = {
|
||||
tmpfiles.rules = [
|
||||
"d ${secrets} 0755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
network = {
|
||||
enable = true;
|
||||
networks."10-enp" = {
|
||||
matchConfig.Name = "enp0s4";
|
||||
addresses = [ { Address = "${service.interface.ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "${localhost}/0";
|
||||
Gateway = service.interface.gate;
|
||||
}
|
||||
];
|
||||
dns = [ service.interface.gate ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
sshPort
|
||||
service.ports.port0
|
||||
];
|
||||
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 2048;
|
||||
hypervisor = "qemu";
|
||||
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = service.interface.id;
|
||||
mac = service.interface.mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = service.interface.idUser;
|
||||
mac = service.interface.macUser;
|
||||
}
|
||||
];
|
||||
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = service.varPaths.path0;
|
||||
proto = "virtiofs";
|
||||
source = service.mntPaths.path0;
|
||||
tag = "${service.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = service.secretPaths.path0;
|
||||
proto = "virtiofs";
|
||||
source = service.secretPaths.path0;
|
||||
tag = "${service.name}_secrets";
|
||||
}
|
||||
{
|
||||
mountPoint = service.ssl.path;
|
||||
proto = "virtiofs";
|
||||
source = service.ssl.path;
|
||||
tag = "acme_certs";
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = service.interface.ssh;
|
||||
guest.port = sshPort;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0} {
|
||||
reverse_proxy ${service.interface.ip}:${toString service.ports.port0} {
|
||||
header_up X-Real-IP {remote_host}
|
||||
}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
|
||||
encode zstd gzip
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
path = "${secrets}/${service.name}-${secret}";
|
||||
owner = "root";
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
|
|
@ -78,7 +176,7 @@ in
|
|||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}/${secret}";
|
||||
name = "${service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
|
|
@ -86,30 +184,4 @@ in
|
|||
]
|
||||
);
|
||||
};
|
||||
|
||||
systemd = {
|
||||
tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
|
||||
];
|
||||
services.backup-vaultwarden = {
|
||||
serviceConfig = {
|
||||
Group = lib.mkForce syncthing.name;
|
||||
};
|
||||
wantedBy = lib.mkForce [ ];
|
||||
after = [ "${service.name}.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
syncthing.name
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -63,7 +63,11 @@ in
|
|||
home = {
|
||||
username = user0;
|
||||
homeDirectory = "/home/${user0}";
|
||||
file = {
|
||||
file =
|
||||
if hostname == devices.ceres.name then
|
||||
{ }
|
||||
else
|
||||
{
|
||||
"./justfile" = import ./files/misc/justfile.nix { inherit flake config lib; };
|
||||
"./.config/scripts/list.sh" = {
|
||||
source = ./files/scripts/list.sh;
|
||||
|
|
|
|||
|
|
@ -59,11 +59,11 @@ in
|
|||
fsType = "vfat";
|
||||
options = mars.boot.options;
|
||||
};
|
||||
}
|
||||
// (builtins.listToAttrs (map storageMounts storageDrives))
|
||||
// (builtins.listToAttrs (
|
||||
builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
|
||||
));
|
||||
};
|
||||
# // (builtins.listToAttrs (map storageMounts storageDrives))
|
||||
# // (builtins.listToAttrs (
|
||||
# builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
|
||||
# ));
|
||||
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-uuid/6b56990c-545d-4d00-b93b-8ca1f143882e"; }
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue