upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up opencloud and microvms

Browse source
This commit is contained in:
Nick 2025-12-05 02:47:08 -06:00
parent 97aebfbb59
commit 9ab5ebd35f
8 changed files with 81 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/nixos/default.nix
View file

@ -45,7 +45,7 @@ in
imports = builtins.attrValues { imports = builtins.attrValues {
inherit (modules) inherit (modules)
acme acme
caddy0 caddy
comfyui comfyui
firefly-iii firefly-iii
forgejo forgejo
@ -70,8 +70,6 @@ in
eris = { eris = {
imports = builtins.attrValues { imports = builtins.attrValues {
inherit (modules) inherit (modules)
acme
caddy1
impermanence impermanence
microvm microvm
opencloud0 opencloud0

53
modules/nixos/guests/opencloud/opencloud0/default.nix
View file

@ -1,5 +1,4 @@
{ {
config,
flake, flake,
pkgs, pkgs,
... ...
@ -9,10 +8,8 @@ let
inherit (flake.config.services) instances; inherit (flake.config.services) instances;
serviceCfg = instances.opencloud0; serviceCfg = instances.opencloud0;
hostCfg = instances.web; hostCfg = instances.web;
dns = instances.web.dns.provider0;
localhost = instances.web.localhost.address1; localhost = instances.web.localhost.address1;
host = serviceCfg.domains.url0; host = serviceCfg.domains.url0;
dnsPath = "dns/${dns}";
in in
{ {
microvm.vms = { microvm.vms = {
@ -55,17 +52,28 @@ in
path = [ pkgs.inotify-tools ]; path = [ pkgs.inotify-tools ];
}; };
opencloud-fix-permissions = { opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions on file changes"; description = "Fix OpenCloud storage permissions";
after = [ "opencloud.service" ]; after = [ "opencloud.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "oneshot";
ExecStart = pkgs.writeShellScript "fix-perms-on-change" '' ExecStart = pkgs.writeShellScript "fix-perms" ''
${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do echo "Starting permission fix..."
${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
OPENCLOUD_UID=$(id -u opencloud)
echo "OpenCloud UID: $OPENCLOUD_UID"
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
echo "Fixing file: $file"
chown opencloud:opencloud "$file" 2>/dev/null || true
done done
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
echo "Fixing dir: $dir"
chown opencloud:opencloud "$dir" 2>/dev/null || true
done
echo "Permission fix complete"
''; '';
Restart = "always";
User = "root"; User = "root";
}; };
}; };
@ -74,7 +82,7 @@ in
description = "Periodically fix OpenCloud storage permissions"; description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ]; wantedBy = [ "timers.target" ];
timerConfig = { timerConfig = {
OnBootSec = "1min"; OnBootSec = "30s";
OnUnitActiveSec = "1min"; OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service"; Unit = "opencloud-fix-permissions.service";
}; };
@ -158,6 +166,7 @@ in
}; };
environment.systemPackages = builtins.attrValues { environment.systemPackages = builtins.attrValues {
inherit (pkgs) inherit (pkgs)
inotify-tools
opencloud opencloud
; ;
}; };
@ -165,28 +174,6 @@ in
}; };
}; };
# security.acme.certs."${host}" = {
# dnsProvider = dns;
# environmentFile = config.sops.secrets.${dnsPath}.path;
# group = "caddy";
# };
services.caddy.virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
'';
};
};
users.users.caddy.extraGroups = [ "acme" ];
systemd = { systemd = {
tmpfiles.rules = [ tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"

40
modules/nixos/guests/opencloud/opencloud1/default.nix
View file

@ -32,7 +32,6 @@ in
stateDir = "/var/lib/${serviceCfg.name}"; stateDir = "/var/lib/${serviceCfg.name}";
environmentFile = "/run/secrets/projectenv"; environmentFile = "/run/secrets/projectenv";
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -41,13 +40,11 @@ in
}; };
}; };
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 # SSH 22 # SSH
587 # SMTP 587 # SMTP
serviceCfg.ports.port0 serviceCfg.ports.port0
]; ];
systemd = { systemd = {
services = { services = {
systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd-networkd.wantedBy = [ "multi-user.target" ];
@ -55,17 +52,28 @@ in
path = [ pkgs.inotify-tools ]; path = [ pkgs.inotify-tools ];
}; };
opencloud-fix-permissions = { opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions on file changes"; description = "Fix OpenCloud storage permissions";
after = [ "opencloud.service" ]; after = [ "opencloud.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "oneshot";
ExecStart = pkgs.writeShellScript "fix-perms-on-change" '' ExecStart = pkgs.writeShellScript "fix-perms" ''
${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do echo "Starting permission fix..."
${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
OPENCLOUD_UID=$(id -u opencloud)
echo "OpenCloud UID: $OPENCLOUD_UID"
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
echo "Fixing file: $file"
chown opencloud:opencloud "$file" 2>/dev/null || true
done done
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
echo "Fixing dir: $dir"
chown opencloud:opencloud "$dir" 2>/dev/null || true
done
echo "Permission fix complete"
''; '';
Restart = "always";
User = "root"; User = "root";
}; };
}; };
@ -74,7 +82,7 @@ in
description = "Periodically fix OpenCloud storage permissions"; description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ]; wantedBy = [ "timers.target" ];
timerConfig = { timerConfig = {
OnBootSec = "1min"; OnBootSec = "30s";
OnUnitActiveSec = "1min"; OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service"; Unit = "opencloud-fix-permissions.service";
}; };
@ -98,14 +106,11 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -" "z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
]; ];
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024 * 1; mem = 1024 * 1;
@ -158,19 +163,18 @@ in
}; };
environment.systemPackages = builtins.attrValues { environment.systemPackages = builtins.attrValues {
inherit (pkgs) inherit (pkgs)
inotifywait
opencloud opencloud
; ;
}; };
}; };
}; };
}; };
security.acme.certs."${host}" = { security.acme.certs."${host}" = {
dnsProvider = dns; dnsProvider = dns;
environmentFile = config.sops.secrets.${dnsPath}.path; environmentFile = config.sops.secrets.${dnsPath}.path;
group = "caddy"; group = "caddy";
}; };
services.caddy.virtualHosts = { services.caddy.virtualHosts = {
"${host}" = { "${host}" = {
extraConfig = extraConfig =
@ -189,9 +193,7 @@ in
''; '';
}; };
}; };
users.users.caddy.extraGroups = [ "acme" ]; users.users.caddy.extraGroups = [ "acme" ];
systemd = { systemd = {
tmpfiles.rules = [ tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
@ -199,12 +201,10 @@ in
"d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -"
]; ];
}; };
sops.secrets = { sops.secrets = {
"${serviceCfg.name}/projectenv" = { "${serviceCfg.name}/projectenv" = {
owner = "root"; owner = "root";
mode = "0600"; mode = "0600";
}; };
}; };
} }

36
modules/nixos/services/caddy/caddy0/default.nix
View file

@ -1,36 +0,0 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
inherit (flake.config.machines.devices) eris;
opencloud = instances.opencloud0;
dns = instances.web.dns.provider0;
opencloudHost = opencloud.domains.url0;
dnsPath = "dns/${dns}";
service = instances.caddy;
in
{
services.caddy = {
enable = true;
virtualHosts = {
"${opencloud.domains.url0}" = {
extraConfig = ''
reverse_proxy ${eris.ip.address0}:${builtins.toString service.ports.port0}
tls ${opencloud.ssl.cert} ${opencloud.ssl.key}
'';
};
};
};
security.acme.certs."${opencloudHost}" = {
dnsProvider = dns;
environmentFile = config.sops.secrets.${dnsPath}.path;
group = "caddy";
};
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0 # 80
service.ports.port1 # 443
];
};
};
}

20
modules/nixos/services/caddy/caddy1/default.nix
View file

@ -1,20 +0,0 @@
{ flake, ... }:
let
inherit (flake.config.services) instances;
service = instances.caddy;
in
{
services.caddy = {
enable = true;
};
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0
service.ports.port1
];
};
};
}

45
modules/nixos/services/caddy/default.nix
View file

@ -1,11 +1,42 @@
{ flake, config, ... }:
let let
importList = inherit (flake.config.services) instances;
let inherit (flake.config.machines.devices) eris;
content = builtins.readDir ./.; opencloud = instances.opencloud0;
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content); dns = instances.web.dns.provider0;
in opencloudHost = opencloud.domains.url0;
map (name: ./. + "/${name}") dirContent; dnsPath = "dns/${dns}";
service = instances.caddy;
in in
{ {
imports = importList; services.caddy = {
enable = true;
virtualHosts = {
"${opencloud.domains.url0}" = {
extraConfig = ''
reverse_proxy ${opencloud.interface.ip}:${toString opencloud.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
tls ${opencloud.ssl.cert} ${opencloud.ssl.key}
'';
};
};
};
security.acme.certs."${opencloudHost}" = {
dnsProvider = dns;
environmentFile = config.sops.secrets.${dnsPath}.path;
group = "caddy";
};
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0 # 80
service.ports.port1 # 443
];
};
};
} }

3
modules/nixos/services/samba/sambaEris/default.nix
View file

@ -12,11 +12,10 @@ in
# sudo smbpasswd -a username # sudo smbpasswd -a username
services = { services = {
samba = { samba = {
# package = pkgs.samba4Full;
enable = true; enable = true;
openFirewall = true; openFirewall = true;
settings = { settings = {
"raid0" = { "storage" = {
path = "/mnt/storage"; path = "/mnt/storage";
writable = "yes"; writable = "yes";
"valid users" = user0; "valid users" = user0;

2
systems/mars/config/filesystem.nix
View file

@ -19,7 +19,7 @@ in
"samba0" "samba0"
]; ];
erisFolders = [ erisFolders = [
"raid0" "storage"
]; ];
ceresDrives = [ ceresDrives = [
"samba0" "samba0"