mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-07 21:42:16 -06:00
test: forgejo microVM
This commit is contained in:
Nick
parent
aedf6e4be4
commit
6d83b2b2f5
11 changed files with 270 additions and 294 deletions
393
modules/nixos/services/forgejo/default.nix
Executable file → Normal file
393
modules/nixos/services/forgejo/default.nix
Executable file → Normal file
|
|
@ -1,248 +1,203 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances)
|
||||
forgejo
|
||||
smtp
|
||||
web
|
||||
;
|
||||
service = forgejo;
|
||||
host = forgejo.domains.url0;
|
||||
secrets = service.secretPaths.path0;
|
||||
localhost = web.localhost.address1;
|
||||
sshPort = 22;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = flake.config.services.instances.forgejo;
|
||||
smtpCfg = flake.config.services.instances.smtp;
|
||||
hostCfg = flake.config.services.instances.web;
|
||||
host = serviceCfg.domains.url0;
|
||||
dns0 = instances.web.dns.provider0;
|
||||
dns0Path = "dns/${dns0}";
|
||||
in
|
||||
{
|
||||
microvm = {
|
||||
vms = {
|
||||
forgejo = {
|
||||
autostart = true;
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "25.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.caddy.extraGroups = [ "acme" ];
|
||||
|
||||
users.users.root = {
|
||||
openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
security.acme.certs."${host}" = {
|
||||
dnsProvider = dns0;
|
||||
environmentFile = config.sops.secrets.${dns0Path}.path;
|
||||
group = "caddy";
|
||||
};
|
||||
|
||||
microvm.vms.forgejo = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
forgejo = {
|
||||
enable = true;
|
||||
database.type = "postgres";
|
||||
lfs.enable = true;
|
||||
secrets = {
|
||||
mailer.PASSWD = "/run/secrets/${serviceCfg.name}-smtp";
|
||||
database.PASSWD = "/run/secrets/${serviceCfg.name}-database";
|
||||
};
|
||||
dump = {
|
||||
interval = "5:00";
|
||||
type = "zip";
|
||||
file = "forgejo-backup";
|
||||
enable = true;
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = host;
|
||||
ROOT_URL = "https://${host}/";
|
||||
HTTP_PORT = serviceCfg.ports.port0;
|
||||
};
|
||||
|
||||
services = {
|
||||
forgejo = {
|
||||
enable = true;
|
||||
database.type = "postgres";
|
||||
lfs.enable = true;
|
||||
|
||||
dump = {
|
||||
interval = "5:00";
|
||||
type = "zip";
|
||||
file = "forgejo-backup";
|
||||
enable = true;
|
||||
};
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = host;
|
||||
ROOT_URL = "https://${host}/";
|
||||
HTTP_PORT = service.ports.port0;
|
||||
HTTP_ADDR = localhost;
|
||||
};
|
||||
|
||||
# If you need to start from scratch, don't forget to turn this off again
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
|
||||
mirror.ENABLED = true;
|
||||
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = smtp.hostname;
|
||||
FROM = smtp.email.address1;
|
||||
USER = smtp.email.address1;
|
||||
PROTOCOL = "${smtp.name}+${smtp.records.record1}";
|
||||
SMTP_PORT = smtp.ports.port1;
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
USE_CLIENT_CERT = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
# If you need to start from scratch, don't forget to turn this off again
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
|
||||
systemd = {
|
||||
tmpfiles.rules = [
|
||||
"d ${secrets} 0755 ${service.name} ${service.name} -"
|
||||
"d /run/forgejo 0755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
services.copy-forgejo-secrets = {
|
||||
description = "Prepare Forgejo secrets environment file";
|
||||
before = [ "forgejo.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = service.name;
|
||||
Group = service.name;
|
||||
};
|
||||
script = ''
|
||||
cat > /run/forgejo/env << EOF
|
||||
FORGEJO__database__PASSWD=$(cat /run/secrets/${service.name}-database)
|
||||
FORGEJO__mailer__PASSWD=$(cat /run/secrets/${service.name}-smtp)
|
||||
EOF
|
||||
chmod 600 /run/forgejo/env
|
||||
'';
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
serviceConfig = {
|
||||
EnvironmentFile = "/run/forgejo/env";
|
||||
};
|
||||
};
|
||||
|
||||
services.forgejo-dump = {
|
||||
serviceConfig = {
|
||||
ExecStartPost = "${pkgs.nushell}/bin/nu -c 'ls ${service.varPaths.path0}/dump | where name =~ forgejo-backup and modified < ((date now) - 7day) | each { rm $in.name }'";
|
||||
};
|
||||
};
|
||||
|
||||
network = {
|
||||
enable = true;
|
||||
networks."10-enp" = {
|
||||
matchConfig.Name = "enp0s4";
|
||||
|
||||
# Option 1: Static IP (recommended if you need consistent IP for reverse proxy)
|
||||
addresses = [ { Address = "${service.interface.ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1"; # Your LAN gateway - adjust if different
|
||||
}
|
||||
];
|
||||
dns = [ "192.168.50.1" ]; # Your LAN DNS - adjust if different
|
||||
|
||||
# Option 2: DHCP (uncomment below and comment out above if preferred)
|
||||
# Note: You'll need to update the Caddy reverse_proxy IP or use hostname
|
||||
# networkConfig.DHCP = "yes";
|
||||
};
|
||||
};
|
||||
mirror = {
|
||||
ENABLED = true;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
sshPort
|
||||
service.ports.port0
|
||||
];
|
||||
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 3096;
|
||||
hypervisor = "qemu";
|
||||
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = service.interface.id;
|
||||
mac = service.interface.mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = service.interface.idUser;
|
||||
mac = service.interface.macUser;
|
||||
}
|
||||
|
||||
];
|
||||
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = service.varPaths.path0;
|
||||
proto = "virtiofs";
|
||||
source = service.mntPaths.path0;
|
||||
tag = "${service.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = service.secretPaths.path0;
|
||||
proto = "virtiofs";
|
||||
source = service.secretPaths.path0;
|
||||
tag = "${service.name}_secrets";
|
||||
}
|
||||
{
|
||||
mountPoint = service.ssl.path;
|
||||
proto = "virtiofs";
|
||||
source = service.ssl.path;
|
||||
tag = "acme_certs";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/var/lib/secrets";
|
||||
tag = "run_secrets";
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = service.interface.ssh;
|
||||
guest.port = sshPort;
|
||||
}
|
||||
];
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = smtpCfg.hostname;
|
||||
FROM = smtpCfg.email.address1;
|
||||
USER = smtpCfg.email.address1;
|
||||
PROTOCOL = "${smtpCfg.name}+${smtpCfg.records.record1}";
|
||||
SMTP_PORT = smtpCfg.ports.port1;
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
USE_CLIENT_CERT = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22 # SSH
|
||||
25 # SMTP
|
||||
139 # SMTP
|
||||
587 # SMTP
|
||||
2525 # SMTP
|
||||
serviceCfg.ports.port0
|
||||
];
|
||||
|
||||
fileSystems."/tmp" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"size=4G"
|
||||
"mode=1777"
|
||||
];
|
||||
};
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "${hostCfg.localhost.address1}/0";
|
||||
Gateway = serviceCfg.interface.gate;
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 3072;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = serviceCfg.interface.id;
|
||||
mac = serviceCfg.interface.mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = serviceCfg.interface.idUser;
|
||||
mac = serviceCfg.interface.macUser;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = serviceCfg.interface.ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = serviceCfg.mntPaths.path0;
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${service.mntPaths.path0} 0755 root root -"
|
||||
"d ${service.secretPaths.path0} 0755 root root -"
|
||||
"d ${serviceCfg.mntPaths.path0} 0755 root root -"
|
||||
];
|
||||
|
||||
services.caddy.virtualHosts."${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${service.interface.ip}:${toString service.ports.port0}
|
||||
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
|
||||
header_up X-Real-IP {remote_host}
|
||||
}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
|
||||
|
||||
encode zstd gzip
|
||||
'';
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${secrets}/${service.name}-${secret}";
|
||||
owner = "root";
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}/${secret}"; # it's vaultwarden/env, not vaultwarden-env
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"database"
|
||||
"smtp"
|
||||
]
|
||||
);
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}-smtp" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
"${serviceCfg.name}-database" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue