upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: trying to get microVMs to work

Browse source
This commit is contained in:
Nick 2025-11-10 01:55:02 -06:00
parent 72bb3fbe34
commit bc73d3bc98
4 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
modules/nixos/services/firefly-iii/default.nix
View file

@ -14,6 +14,7 @@ let
host = serviceCfg.domains.url0; host = serviceCfg.domains.url0;
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
hostSecrets = "/opt/secrets";
in in
{ {
microvm.vms.${serviceCfg.name} = { microvm.vms.${serviceCfg.name} = {
@ -175,7 +176,7 @@ in
{ {
mountPoint = "/run/secrets"; mountPoint = "/run/secrets";
proto = "virtiofs"; proto = "virtiofs";
source = "/var/lib/secrets/${serviceCfg.name}"; source = "${hostSecrets}/${serviceCfg.name}";
tag = "host_secrets"; tag = "host_secrets";
} }
]; ];
@ -201,7 +202,7 @@ in
(secret: { (secret: {
name = "${serviceCfg.name}/${secret}"; name = "${serviceCfg.name}/${secret}";
value = { value = {
path = "/var/lib/secrets"; path = hostSecrets;
owner = "root"; owner = "root";
mode = "600"; mode = "600";
}; };

7
modules/nixos/services/forgejo/default.nix
View file

@ -12,6 +12,7 @@ let
host = serviceCfg.domains.url0; host = serviceCfg.domains.url0;
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
hostSecrets = "/opt/secrets";
in in
{ {
users.users.caddy.extraGroups = [ "acme" ]; users.users.caddy.extraGroups = [ "acme" ];
@ -179,7 +180,7 @@ in
{ {
mountPoint = "/run/secrets"; mountPoint = "/run/secrets";
proto = "virtiofs"; proto = "virtiofs";
source = "/var/lib/secrets/${serviceCfg.name}"; source = "${hostSecrets}/${serviceCfg.name}";
tag = "host_secrets"; tag = "host_secrets";
} }
]; ];
@ -207,12 +208,12 @@ in
sops.secrets = { sops.secrets = {
"${serviceCfg.name}/smtp" = { "${serviceCfg.name}/smtp" = {
path = "/var/lib/secrets"; path = hostSecrets;
owner = "root"; owner = "root";
mode = "0600"; mode = "0600";
}; };
"${serviceCfg.name}/database" = { "${serviceCfg.name}/database" = {
path = "/var/lib/secrets"; path = hostSecrets;
owner = "root"; owner = "root";
mode = "0600"; mode = "0600";
}; };

5
modules/nixos/services/vaultwarden/default.nix
View file

@ -12,6 +12,7 @@ let
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0; host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
hostSecrets = "/opt/secrets";
in in
{ {
@ -148,7 +149,7 @@ in
{ {
mountPoint = "/run/secrets"; mountPoint = "/run/secrets";
proto = "virtiofs"; proto = "virtiofs";
source = "/var/lib/secrets/${serviceCfg.name}"; source = "${hostSecrets}/${serviceCfg.name}";
tag = "host_secrets"; tag = "host_secrets";
} }
]; ];
@ -184,7 +185,7 @@ in
sops.secrets = { sops.secrets = {
"${serviceCfg.name}/env" = { "${serviceCfg.name}/env" = {
path = "/var/lib/secrets"; path = hostSecrets;
owner = "root"; owner = "root";
mode = "0600"; mode = "0600";
}; };

5
systems/ceres/config/filesystem.nix
View file

@ -111,6 +111,7 @@ in
directories = [ directories = [
"/var/cache" "/var/cache"
"/var/lib" "/var/lib"
"/opt/secrets"
{ {
directory = "/etc/ssh"; directory = "/etc/ssh";
mode = "u=rwx,g=rx,o=rx"; mode = "u=rwx,g=rx,o=rx";
@ -134,7 +135,9 @@ in
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"Z ${config.home-manager.users.${user0}.home.homeDirectory} 0755 ${user0} users -" "Z ${config.home-manager.users.${user0}.home.homeDirectory} 0755 ${user0} users -"
"Z /mnt/storage 2775 root root -" "d /mnt/storage 2775 root root -"
"d /opt/secrets 2775 root root -"
]; ];
services.udisks2.enable = true; services.udisks2.enable = true;