upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

feat: provisioned resources properly across microvms

Browse source
This commit is contained in:
Nick 2025-12-04 03:09:51 -06:00
parent 857f2e39a8
commit 30593b866e
11 changed files with 42 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

16
modules/nixos/guests/firefly-iii/default.nix
View file

@ -1,6 +1,7 @@
{ {
flake, flake,
config, config,
pkgs,
... ...
}: }:
let let
@ -55,26 +56,20 @@ in
SITE_OWNER = email.address2; SITE_OWNER = email.address2;
}; };
}; };
phpfpm.pools.firefly-iii.phpEnv = { phpfpm.pools.firefly-iii.phpEnv = {
TRUSTED_PROXIES = "*"; TRUSTED_PROXIES = "*";
APP_URL = "https://${host}"; APP_URL = "https://${host}";
}; };
firefly-iii-data-importer = { firefly-iii-data-importer = {
enable = true; enable = true;
}; };
caddy = { caddy = {
enable = true; enable = true;
virtualHosts.":80" = { virtualHosts.":80" = {
extraConfig = '' extraConfig = ''
root * ${config.services.firefly-iii.package}/public root * ${config.services.firefly-iii.package}/public
file_server file_server
encode gzip encode gzip
php_fastcgi unix//run/phpfpm/firefly-iii.sock { php_fastcgi unix//run/phpfpm/firefly-iii.sock {
env HTTPS {http.request.header.X-Forwarded-Proto} env HTTPS {http.request.header.X-Forwarded-Proto}
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto} env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
@ -82,7 +77,6 @@ in
''; '';
}; };
}; };
postgresql = { postgresql = {
enable = true; enable = true;
ensureDatabases = [ "firefly-iii" ]; ensureDatabases = [ "firefly-iii" ];
@ -93,7 +87,6 @@ in
} }
]; ];
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -102,18 +95,15 @@ in
}; };
}; };
}; };
users.users.caddy = { users.users.caddy = {
extraGroups = [ "firefly-iii" ]; extraGroups = [ "firefly-iii" ];
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 22
80 80
serviceCfg.ports.port0 serviceCfg.ports.port0
serviceCfg.ports.port1 serviceCfg.ports.port1
]; ];
systemd = { systemd = {
services = { services = {
caddy = { caddy = {
@ -161,15 +151,13 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
]; ];
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024; mem = 512;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

14
modules/nixos/guests/forgejo/default.nix
View file

@ -15,13 +15,11 @@ let
in in
{ {
users.users.caddy.extraGroups = [ "acme" ]; users.users.caddy.extraGroups = [ "acme" ];
security.acme.certs."${host}" = { security.acme.certs."${host}" = {
dnsProvider = dns0; dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path; environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy"; group = "caddy";
}; };
microvm.vms = { microvm.vms = {
${serviceCfg.name} = { ${serviceCfg.name} = {
autostart = true; autostart = true;
@ -64,7 +62,6 @@ in
}; };
}; };
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -73,7 +70,6 @@ in
}; };
}; };
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 # SSH 22 # SSH
25 # SMTP 25 # SMTP
@ -82,7 +78,6 @@ in
2525 # SMTP 2525 # SMTP
serviceCfg.ports.port0 serviceCfg.ports.port0
]; ];
fileSystems."/tmp" = { fileSystems."/tmp" = {
device = "tmpfs"; device = "tmpfs";
fsType = "tmpfs"; fsType = "tmpfs";
@ -91,7 +86,6 @@ in
"mode=1777" "mode=1777"
]; ];
}; };
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -110,15 +104,12 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# "Z /var/lib/postgresql 0755 postgres postgres -" # "Z /var/lib/postgresql 0755 postgres postgres -"
]; ];
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024; mem = 1024;
@ -166,23 +157,18 @@ in
}; };
}; };
}; };
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
]; ];
services.caddy.virtualHosts."${host}" = { services.caddy.virtualHosts."${host}" = {
extraConfig = '' extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} { reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host} header_up X-Real-IP {remote_host}
} }
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip encode zstd gzip
''; '';
}; };
sops.secrets = { sops.secrets = {
"${serviceCfg.name}/smtp" = { "${serviceCfg.name}/smtp" = {
owner = "root"; owner = "root";

23
modules/nixos/guests/jellyfin/default.nix
View file

@ -28,7 +28,6 @@ in
enable = true; enable = true;
openFirewall = true; openFirewall = true;
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -37,24 +36,20 @@ in
}; };
}; };
}; };
users.users.jellyfin = { users.users.jellyfin = {
isSystemUser = true; isSystemUser = true;
group = serviceCfg.name; group = serviceCfg.name;
uid = id; uid = id;
}; };
users.groups.jellyfin = { users.groups.jellyfin = {
gid = id; gid = id;
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 22
serviceCfg.ports.port0 serviceCfg.ports.port0
serviceCfg.ports.port1 serviceCfg.ports.port1
serviceCfg.ports.port2 serviceCfg.ports.port2
]; ];
fileSystems."/tmp" = { fileSystems."/tmp" = {
device = "tmpfs"; device = "tmpfs";
fsType = "tmpfs"; fsType = "tmpfs";
@ -63,7 +58,6 @@ in
"mode=1777" "mode=1777"
]; ];
}; };
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -82,7 +76,6 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"Z ${serviceCfg.varPaths.path2} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path2} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
@ -90,11 +83,9 @@ in
"Z ${serviceCfg.varPaths.path2} 0775 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path2} 0775 ${serviceCfg.name} ${serviceCfg.name} -"
]; ];
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 2; vcpu = 4;
mem = 1024 * 3; mem = 1024 * 3;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
@ -143,24 +134,14 @@ in
} }
]; ];
}; };
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
yazi
bottom
trashy
fastfetch
;
}; };
}; };
}; };
};
security.acme.certs."${host}" = { security.acme.certs."${host}" = {
dnsProvider = dns0; dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path; environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy"; group = "caddy";
}; };
services = { services = {
caddy = { caddy = {
virtualHosts = { virtualHosts = {
@ -182,7 +163,6 @@ in
gid = id; gid = id;
members = [ user0 ]; members = [ user0 ];
}; };
users = { users = {
jellyfin = { jellyfin = {
isSystemUser = true; isSystemUser = true;
@ -192,7 +172,6 @@ in
caddy.extraGroups = [ "acme" ]; caddy.extraGroups = [ "acme" ];
}; };
}; };
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0755 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/data 0755 microvm wheel - -"

5
modules/nixos/guests/minecraft/world0/default.nix
View file

@ -1,5 +1,6 @@
{ {
flake, flake,
pkgs,
... ...
}: }:
let let
@ -124,8 +125,8 @@ in
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 2; vcpu = 4;
mem = 1024 * 3; mem = 1024 * 4;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

5
modules/nixos/guests/minecraft/world1/default.nix
View file

@ -1,5 +1,6 @@
{ {
flake, flake,
pkgs,
... ...
}: }:
let let
@ -122,8 +123,8 @@ in
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 2; vcpu = 4;
mem = 1024 * 3; mem = 1024 * 4;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

28
modules/nixos/guests/opencloud/ceresOpenCloud/default.nix
View file

@ -50,9 +50,34 @@ in
systemd = { systemd = {
services = { services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
opencloud = { opencloud = {
path = [ pkgs.inotify-tools ]; path = [ pkgs.inotify-tools ];
}; };
opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions on file changes";
after = [ "opencloud.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
ExecStart = pkgs.writeShellScript "fix-perms-on-change" ''
${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do
${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
done
'';
Restart = "always";
User = "root";
};
};
};
timers.opencloud-fix-permissions = {
description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "1min";
OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service";
};
}; };
network = { network = {
enable = true; enable = true;
@ -81,8 +106,6 @@ in
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024 * 1; mem = 1024 * 1;
@ -142,7 +165,6 @@ in
opencloud opencloud
; ;
}; };
}; };
}; };
}; };

18
modules/nixos/guests/projectSite/default.nix
View file

@ -15,26 +15,20 @@ in
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
]; ];
microvm.vms.${serviceCfg.name} = { microvm.vms.${serviceCfg.name} = {
autostart = true; autostart = true;
config = { config = {
system.stateVersion = "25.05"; system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 22
80 80
]; ];
services.openssh = { services.openssh = {
enable = true; enable = true;
settings.PasswordAuthentication = false; settings.PasswordAuthentication = false;
}; };
environment.etc."website".source = websitePkg; environment.etc."website".source = websitePkg;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -45,21 +39,17 @@ in
}; };
}; };
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts.":80".extraConfig = '' virtualHosts.":80".extraConfig = ''
root * /etc/website root * /etc/website
file_server file_server
try_files {path} /index.html try_files {path} /index.html
''; '';
}; };
microvm = { microvm = {
vcpu = 2; vcpu = 1;
mem = 1024; mem = 512;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {
@ -68,7 +58,6 @@ in
mac = serviceCfg.interface.mac; mac = serviceCfg.interface.mac;
} }
]; ];
shares = [ shares = [
{ {
source = "/nix/store"; source = "/nix/store";
@ -80,16 +69,13 @@ in
}; };
}; };
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts.${host}.extraConfig = '' virtualHosts.${host}.extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:80 reverse_proxy ${serviceCfg.interface.ip}:80
tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem
''; '';
}; };
security.acme.certs.${host} = { security.acme.certs.${host} = {
dnsProvider = instances.web.dns.provider1; dnsProvider = instances.web.dns.provider1;
environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path; environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;

3
modules/nixos/guests/torrent/default.nix
View file

@ -316,7 +316,7 @@ in
}; };
microvm = { microvm = {
vcpu = 4; vcpu = 1;
mem = 1024 * 1; mem = 1024 * 1;
hypervisor = "qemu"; hypervisor = "qemu";
@ -362,7 +362,6 @@ in
} }
]; ];
}; };
environment.systemPackages = builtins.attrValues { environment.systemPackages = builtins.attrValues {
inherit (pkgs) inherit (pkgs)
bottom bottom

4
modules/nixos/guests/vaultwarden/default.nix
View file

@ -1,6 +1,7 @@
{ {
config, config,
flake, flake,
pkgs,
... ...
}: }:
let let
@ -12,7 +13,6 @@ let
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0; host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
hostSecrets = "/var/lib/secrets/${serviceCfg.name}";
in in
{ {
microvm.vms = { microvm.vms = {
@ -110,7 +110,7 @@ in
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024; mem = 512;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

3
modules/nixos/guests/website/default.nix
View file

@ -29,6 +29,7 @@ in
environment.etc."website".source = websitePkg; environment.etc."website".source = websitePkg;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -51,7 +52,7 @@ in
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024; mem = 512;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

14
modules/nixos/guests/zookeeper/default.nix
View file

@ -57,7 +57,7 @@ in
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024; mem = 512;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {
@ -65,18 +65,6 @@ in
id = serviceCfg.interface.id; id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac; mac = serviceCfg.interface.mac;
} }
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
]; ];
shares = [ shares = [
{ {