upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: forgejo microVM

Browse source
This commit is contained in:
Nick 2025-11-09 02:42:22 -06:00
parent aedf6e4be4
commit 6d83b2b2f5
11 changed files with 270 additions and 294 deletions
Download patch file Download diff file Expand all files Collapse all files

13
modules/config/instances/config/forgejo.nix
View file

@ -37,13 +37,14 @@ in
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:00:50";
idUser = "vm-${name}-user";
macUser = "02:00:00:00:00:02";
ip = "192.168.50.50";
gate = "192.168.50.2";
ssh = 2200;
mac = "03:00:00:00:00:53";
idUser = "vmuser-${name}";
macUser = "04:00:00:00:00:05";
ip = "192.168.50.153";
gate = "192.168.50.1";
ssh = 2205;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";

8
modules/nixos/default.nix
View file

@ -50,7 +50,7 @@ in
# comfyui
# filesorter
# firefly-iii
# forgejo
forgejo
# glance
jellyfin
# logrotate
@ -61,7 +61,7 @@ in
# postgresCeres
# projectSite
# prompter
# sambaCeres
sambaCeres
# searx
vaultwarden
# website
@ -73,8 +73,8 @@ in
eris = {
imports = builtins.attrValues {
inherit (modules)
acmeEris
caddyEris
acme
caddy
logrotate
microvm
# opencloud

393
modules/nixos/services/forgejo/default.nix Executable file → Normal file
View file

@ -1,248 +1,203 @@
{
config,
flake,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services.instances)
forgejo
smtp
web
;
service = forgejo;
host = forgejo.domains.url0;
secrets = service.secretPaths.path0;
localhost = web.localhost.address1;
sshPort = 22;
inherit (flake.config.services) instances;
serviceCfg = flake.config.services.instances.forgejo;
smtpCfg = flake.config.services.instances.smtp;
hostCfg = flake.config.services.instances.web;
host = serviceCfg.domains.url0;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
microvm = {
vms = {
forgejo = {
autostart = true;
config =
{ config, pkgs, ... }:
{
system.stateVersion = "25.05";
time.timeZone = "America/Winnipeg";
users.users.caddy.extraGroups = [ "acme" ];
users.users.root = {
openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
microvm.vms.forgejo = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
forgejo = {
enable = true;
database.type = "postgres";
lfs.enable = true;
secrets = {
mailer.PASSWD = "/run/secrets/${serviceCfg.name}-smtp";
database.PASSWD = "/run/secrets/${serviceCfg.name}-database";
};
dump = {
interval = "5:00";
type = "zip";
file = "forgejo-backup";
enable = true;
};
settings = {
server = {
DOMAIN = host;
ROOT_URL = "https://${host}/";
HTTP_PORT = serviceCfg.ports.port0;
};
services = {
forgejo = {
enable = true;
database.type = "postgres";
lfs.enable = true;
dump = {
interval = "5:00";
type = "zip";
file = "forgejo-backup";
enable = true;
};
settings = {
server = {
DOMAIN = host;
ROOT_URL = "https://${host}/";
HTTP_PORT = service.ports.port0;
HTTP_ADDR = localhost;
};
# If you need to start from scratch, don't forget to turn this off again
service.DISABLE_REGISTRATION = false;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
mirror.ENABLED = true;
mailer = {
ENABLED = true;
SMTP_ADDR = smtp.hostname;
FROM = smtp.email.address1;
USER = smtp.email.address1;
PROTOCOL = "${smtp.name}+${smtp.records.record1}";
SMTP_PORT = smtp.ports.port1;
SEND_AS_PLAIN_TEXT = true;
USE_CLIENT_CERT = false;
};
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
# If you need to start from scratch, don't forget to turn this off again
service.DISABLE_REGISTRATION = false;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
systemd = {
tmpfiles.rules = [
"d ${secrets} 0755 ${service.name} ${service.name} -"
"d /run/forgejo 0755 ${service.name} ${service.name} -"
];
services.copy-forgejo-secrets = {
description = "Prepare Forgejo secrets environment file";
before = [ "forgejo.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
User = service.name;
Group = service.name;
};
script = ''
cat > /run/forgejo/env << EOF
FORGEJO__database__PASSWD=$(cat /run/secrets/${service.name}-database)
FORGEJO__mailer__PASSWD=$(cat /run/secrets/${service.name}-smtp)
EOF
chmod 600 /run/forgejo/env
'';
};
services.forgejo = {
serviceConfig = {
EnvironmentFile = "/run/forgejo/env";
};
};
services.forgejo-dump = {
serviceConfig = {
ExecStartPost = "${pkgs.nushell}/bin/nu -c 'ls ${service.varPaths.path0}/dump | where name =~ forgejo-backup and modified < ((date now) - 7day) | each { rm $in.name }'";
};
};
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s4";
# Option 1: Static IP (recommended if you need consistent IP for reverse proxy)
addresses = [ { Address = "${service.interface.ip}/24"; } ];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1"; # Your LAN gateway - adjust if different
}
];
dns = [ "192.168.50.1" ]; # Your LAN DNS - adjust if different
# Option 2: DHCP (uncomment below and comment out above if preferred)
# Note: You'll need to update the Caddy reverse_proxy IP or use hostname
# networkConfig.DHCP = "yes";
};
};
mirror = {
ENABLED = true;
};
networking.firewall.allowedTCPPorts = [
sshPort
service.ports.port0
];
microvm = {
vcpu = 2;
mem = 3096;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = service.interface.id;
mac = service.interface.mac;
}
{
type = "user";
id = service.interface.idUser;
mac = service.interface.macUser;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = service.varPaths.path0;
proto = "virtiofs";
source = service.mntPaths.path0;
tag = "${service.name}_data";
}
{
mountPoint = service.secretPaths.path0;
proto = "virtiofs";
source = service.secretPaths.path0;
tag = "${service.name}_secrets";
}
{
mountPoint = service.ssl.path;
proto = "virtiofs";
source = service.ssl.path;
tag = "acme_certs";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/var/lib/secrets";
tag = "run_secrets";
}
];
forwardPorts = [
{
from = "host";
host.port = service.interface.ssh;
guest.port = sshPort;
}
];
mailer = {
ENABLED = true;
SMTP_ADDR = smtpCfg.hostname;
FROM = smtpCfg.email.address1;
USER = smtpCfg.email.address1;
PROTOCOL = "${smtpCfg.name}+${smtpCfg.records.record1}";
SMTP_PORT = smtpCfg.ports.port1;
SEND_AS_PLAIN_TEXT = true;
USE_CLIENT_CERT = false;
};
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
25 # SMTP
139 # SMTP
587 # SMTP
2525 # SMTP
serviceCfg.ports.port0
];
fileSystems."/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=4G"
"mode=1777"
];
};
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 2;
mem = 3072;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = serviceCfg.mntPaths.path0;
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets";
tag = "host_secrets";
}
];
};
};
};
systemd.tmpfiles.rules = [
"d ${service.mntPaths.path0} 0755 root root -"
"d ${service.secretPaths.path0} 0755 root root -"
"d ${serviceCfg.mntPaths.path0} 0755 root root -"
];
services.caddy.virtualHosts."${host}" = {
extraConfig = ''
reverse_proxy ${service.interface.ip}:${toString service.ports.port0}
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${service.ssl.cert} ${service.ssl.key}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
sops =
let
sopsPath = secret: {
path = "${secrets}/${service.name}-${secret}";
owner = "root";
mode = "600";
};
in
{
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}/${secret}"; # it's vaultwarden/env, not vaultwarden-env
value = sopsPath secret;
})
[
"database"
"smtp"
]
);
sops.secrets = {
"${serviceCfg.name}-smtp" = {
owner = "root";
mode = "0600";
};
"${serviceCfg.name}-database" = {
owner = "root";
mode = "0600";
};
};
}

46
modules/nixos/services/jellyfin/default.nix
View file

@ -42,31 +42,35 @@ in
serviceCfg.ports.port2
];
systemd.network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
};
services.systemd-networkd.wantedBy = [ "multi-user.target" ];
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0}/media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
};
microvm = {
vcpu = 4;
mem = 4096;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
@ -79,7 +83,6 @@ in
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
@ -87,7 +90,6 @@ in
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
@ -110,13 +112,11 @@ in
];
};
# Increase tmpfs size for /tmp to satisfy Jellyfin's 2GB requirement
# By default, tmpfs is limited to 50% of RAM, but we need more space
fileSystems."/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=3G"
"size=4G"
"mode=1777"
];
};

16
modules/nixos/services/samba/sambaCeres/default.nix
View file

@ -18,20 +18,8 @@ in
enable = true;
openFirewall = true;
settings = {
${instances.jellyfin.name} = {
path = instances.jellyfin.paths.path0;
writable = "true";
};
${instances.audiobookshelf.name} = {
path = instances.audiobookshelf.paths.path0;
writable = "true";
};
${instances.comfyui.name} = {
path = instances.comfyui.paths.path0;
writable = "true";
};
${instances.opencloud.name} = {
path = instances.opencloud.paths.path0;
"storage" = {
path = "/mnt/storage";
writable = "true";
};
};

8
modules/nixos/services/samba/sambaEris/default.nix
View file

@ -17,10 +17,10 @@ in
enable = true;
openFirewall = true;
settings = {
# ${instances.opencloud.name} = {
# path = instances.opencloud.paths.path0;
# writable = "true";
# };
"raid0" = {
path = "/mnt/raid0";
writable = "true";
};
};
};
};

10
modules/nixos/services/template/default.nix
View file

@ -125,11 +125,6 @@ in
};
};
# Open firewall ports inside the VM
networking.firewall.allowedTCPPorts = [
serviceCfg.ports.port0 # Service web interface port number
];
# ============================================================================
# VM NETWORK CONFIGURATION (systemd-networkd)
# ============================================================================
@ -137,6 +132,11 @@ in
# The VM sees a network interface called "enp0s5" which connects to the
# host's TAP interface (vm-service) via the bridge (br-vms)
};
# Open firewall ports inside the VM
networking.firewall.allowedTCPPorts = [
serviceCfg.ports.port0 # Service web interface port number
];
systemd.network = {
enable = true; # Enable systemd-networkd for network management

28
systems/ceres/config/filesystem.nix
View file

@ -6,9 +6,31 @@
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.machines.devices) eris;
erisSecrets = config.sops.secrets."network/server".path;
rootDevice = "/dev/disk/by-label/root";
bootDevice = "/dev/disk/by-label/BOOT";
sambaDrives = [
"samba0"
];
sambaFolders = [
"raid0"
];
sambaMounts = sambaDrive: folder: {
name = "${eris.${sambaDrive}.mount}/${folder}";
value = {
device = "${eris.${sambaDrive}.device}/${folder}";
fsType = "cifs";
options = eris.${sambaDrive}.options ++ [
"credentials=${erisSecrets}"
];
};
};
in
{
fileSystems = {
@ -54,7 +76,11 @@ in
"/etc/ssh" = {
neededForBoot = true;
};
};
}
// (builtins.listToAttrs (
builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
));
boot.initrd.postResumeCommands = lib.mkAfter ''
mkdir /btrfs_tmp
mount -o subvolid=5 ${rootDevice} /btrfs_tmp

11
systems/ceres/config/sops.nix Executable file
View file

@ -0,0 +1,11 @@
{
sops = {
secrets = {
"network/server" = {
path = "/var/lib/secrets/server";
owner = "root";
mode = "600";
};
};
};
}

3
systems/eris/config/filesystem.nix
View file

@ -5,7 +5,6 @@
}:
let
inherit (flake.config.machines.devices) ceres;
inherit (flake.config.services) instances;
ceresSecrets = config.sops.secrets."network/server".path;
sambaDrives = [
@ -13,7 +12,7 @@ let
];
sambaFolders = [
instances.jellyfin.name
"storage"
];
sambaMounts = sambaDrive: folder: {

28
systems/mars/config/filesystem.nix
View file

@ -5,9 +5,8 @@
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.machines.devices) mars ceres;
inherit (flake.config.services) instances;
ceresSecrets = config.sops.secrets."network/server".path;
inherit (flake.config.machines.devices) mars eris;
erisSecrets = config.sops.secrets."network/server".path;
in
{
fileSystems =
@ -23,10 +22,7 @@ in
];
sambaFolders = [
instances.audiobookshelf.name
instances.jellyfin.name
instances.comfyui.name
# instances.opencloud.name
"raid0"
];
storageMounts = storageDrive: {
@ -39,12 +35,12 @@ in
};
sambaMounts = sambaDrive: folder: {
name = "${ceres.${sambaDrive}.mount}/${folder}";
name = "${eris.${sambaDrive}.mount}/${folder}";
value = {
device = "${ceres.${sambaDrive}.device}/${folder}";
device = "${eris.${sambaDrive}.device}/${folder}";
fsType = "cifs";
options = ceres.${sambaDrive}.options ++ [
"credentials=${ceresSecrets}"
options = eris.${sambaDrive}.options ++ [
"credentials=${erisSecrets}"
];
};
};
@ -59,11 +55,11 @@ in
fsType = "vfat";
options = mars.boot.options;
};
};
# // (builtins.listToAttrs (map storageMounts storageDrives))
# // (builtins.listToAttrs (
# builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
# ));
}
// (builtins.listToAttrs (map storageMounts storageDrives))
// (builtins.listToAttrs (
builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
));
swapDevices = [
{ device = "/dev/disk/by-uuid/6b56990c-545d-4d00-b93b-8ca1f143882e"; }