feat: harbor
This commit is contained in:
150
hosts/harbor/configuration.nix
Normal file
150
hosts/harbor/configuration.nix
Normal file
@@ -0,0 +1,150 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./disko.nix
|
||||
];
|
||||
|
||||
# Secret management
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.secrets."nextcloud-admin-pass" = {
|
||||
sopsFile = ../../secrets/harbor/nextcloud.yaml;
|
||||
owner = "nextcloud";
|
||||
key = "admin-pass";
|
||||
};
|
||||
sops.secrets."wg-priv" = {
|
||||
sopsFile = ../../secrets/harbor/wg.yaml;
|
||||
key = "privateKey";
|
||||
};
|
||||
sops.secrets."gitea-db-pass" = {
|
||||
sopsFile = ../../secrets/harbor/gitea.yaml;
|
||||
owner = config.services.gitea.user;
|
||||
key = "databasePassword";
|
||||
};
|
||||
sops.secrets."gotify-admin-pass" = {
|
||||
sopsFile = ../../secrets/harbor/gotify.yaml;
|
||||
owner = config.hive.gotify-instance.user;
|
||||
key = "adminPassword";
|
||||
};
|
||||
|
||||
# gc settings and binary caches
|
||||
nix = {
|
||||
settings = {
|
||||
substituters = [
|
||||
"https://aseipp-nix-cache.freetls.fastly.net"
|
||||
"https://nix-community.cachix.org"
|
||||
"https://cache.nixos.org/"
|
||||
];
|
||||
experimental-features = ["nix-command" "flakes"];
|
||||
auto-optimise-store = true;
|
||||
};
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
};
|
||||
|
||||
# user with ssh access
|
||||
users.users.jonas = {
|
||||
isNormalUser = true;
|
||||
description = "Jonas";
|
||||
extraGroups = ["wheel"];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyCyYsMSiy7shcehlzJEbCyRiHk+cicFB35Bc2uc4PjjkCjswLh01fRAV2QcplrNkH/5F4GBTbOoZHHc7/AVLyUxgwDC9ffD2i7fevuGpfBFy9D30uz6jDekxXkmRmIlidXLdG1Fh4zwVejGlwdhUu/Zb7PonO/dktx3EFdf1SpnW+y75anN85zoGsld7KQk42wEd0zXtCgx4CKI6Vvt6heWCEiJ9wyw1sLpTJr4H8In236CUj1/r1qY9Gfa8n9NA0J9XCpcwSCEWGRKQNicoQIpnp5txrgzaUq4r6qBKHmImYXmSTVnDZ9dJLRYNu2lDvBtTXP4ztlR6Lpxs873fPg51qgaX9rRVMMo/gGjq8fOFWsDVaJZab9VY3hZYNCKIbWFqo4GKyCQs9Xfzr2AUACm09HWiYMTefwEypOzvUb4z+LF2B/0c5XmghLF/TOzLVgDXzAgWMH4mCnPh9EDLHTtoJaGNURler9VRV8yQyLH6oK9UpHZovCFs7HpFN+WPv2QVFfkK8aHg7tnklFsT78z154bjuspiEI/fFGmTxoQUGufmHlRy/9GQDusgNfe24ZEB2hHBVjKv29XdIfvFAhoPVpA6+O/N3feSlmVISaU+8QraVQEf/TuQjopDUWpJTmqSxKvQSTPwcyWDy6NtcJ85bGAu6jSUGC3ouH4Rb2Q== cardno:000609618602"
|
||||
];
|
||||
};
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
programs.zsh.enable = true;
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
};
|
||||
|
||||
# hive modules
|
||||
hive.gitea-instance.enable = true;
|
||||
hive.gitea-instance.nativeRunner = true;
|
||||
hive.gitea-instance.instanceFQDN = "git.jroeger.de";
|
||||
hive.gitea-instance.databasePasswordFile = config.sops.secrets.gitea-db-pass.path;
|
||||
hive.gotify-instance.enable = true;
|
||||
hive.gotify-instance.instanceFQDN = "gotify.jroeger.de";
|
||||
hive.gotify-instance.adminPasswordSopsKey = config.sops.secrets.gotify-admin-pass.name;
|
||||
hive.nextcloud-instance.enable = true;
|
||||
hive.nextcloud-instance.ssl = true;
|
||||
hive.nextcloud-instance.adminPasswordFile = config.sops.secrets.nextcloud-admin-pass.path;
|
||||
hive.nextcloud-instance.instanceFQDN = "nextcloud.jroeger.de";
|
||||
hive.minecraft-server.enable = true;
|
||||
hive.borg-server.enable = true;
|
||||
hive.borg-server.repositories.comfy-station.ssh_public_key = builtins.readFile (../../static/keys + "/borg-jonas@comfy-station.pub");
|
||||
hive.wg.server.enable = true;
|
||||
hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
|
||||
# VPS compat
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.loader.grub.version = 2;
|
||||
boot.kernelParams = [
|
||||
"net.ifnames=0" # ensure iface is called eth0
|
||||
"ip=173.249.42.252::173.249.42.1:255.255.255.0:harbor:eth0:none:8.8.8.8"
|
||||
];
|
||||
networking.networkmanager.enable = true;
|
||||
networking = {
|
||||
# Static network configuration
|
||||
hostName = "harbor";
|
||||
domain = "jroeger.de";
|
||||
defaultGateway = "173.249.42.1";
|
||||
nameservers = ["8.8.8.8"];
|
||||
interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
address = "173.249.42.252";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
};
|
||||
# Temporary ssh server for disk unlock
|
||||
boot.initrd = {
|
||||
availableKernelModules = ["virtio_pci"];
|
||||
network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 2222;
|
||||
authorizedKeys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyCyYsMSiy7shcehlzJEbCyRiHk+cicFB35Bc2uc4PjjkCjswLh01fRAV2QcplrNkH/5F4GBTbOoZHHc7/AVLyUxgwDC9ffD2i7fevuGpfBFy9D30uz6jDekxXkmRmIlidXLdG1Fh4zwVejGlwdhUu/Zb7PonO/dktx3EFdf1SpnW+y75anN85zoGsld7KQk42wEd0zXtCgx4CKI6Vvt6heWCEiJ9wyw1sLpTJr4H8In236CUj1/r1qY9Gfa8n9NA0J9XCpcwSCEWGRKQNicoQIpnp5txrgzaUq4r6qBKHmImYXmSTVnDZ9dJLRYNu2lDvBtTXP4ztlR6Lpxs873fPg51qgaX9rRVMMo/gGjq8fOFWsDVaJZab9VY3hZYNCKIbWFqo4GKyCQs9Xfzr2AUACm09HWiYMTefwEypOzvUb4z+LF2B/0c5XmghLF/TOzLVgDXzAgWMH4mCnPh9EDLHTtoJaGNURler9VRV8yQyLH6oK9UpHZovCFs7HpFN+WPv2QVFfkK8aHg7tnklFsT78z154bjuspiEI/fFGmTxoQUGufmHlRy/9GQDusgNfe24ZEB2hHBVjKv29XdIfvFAhoPVpA6+O/N3feSlmVISaU+8QraVQEf/TuQjopDUWpJTmqSxKvQSTPwcyWDy6NtcJ85bGAu6jSUGC3ouH4Rb2Q== cardno:000609618602"
|
||||
];
|
||||
hostKeys = ["/etc/secrets/initrd/ssh_host_rsa_key"];
|
||||
shell = "/bin/cryptsetup-askpass";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "de_DE.UTF-8";
|
||||
LC_IDENTIFICATION = "de_DE.UTF-8";
|
||||
LC_MEASUREMENT = "de_DE.UTF-8";
|
||||
LC_MONETARY = "de_DE.UTF-8";
|
||||
LC_NAME = "de_DE.UTF-8";
|
||||
LC_NUMERIC = "de_DE.UTF-8";
|
||||
LC_PAPER = "de_DE.UTF-8";
|
||||
LC_TELEPHONE = "de_DE.UTF-8";
|
||||
LC_TIME = "de_DE.UTF-8";
|
||||
};
|
||||
console.keyMap = "de";
|
||||
}
|
||||
25
hosts/harbor/default.nix
Normal file
25
hosts/harbor/default.nix
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
inputs,
|
||||
self,
|
||||
...
|
||||
}: {
|
||||
flake.nixosConfigurations.harbor = inputs.nixpkgs.lib.nixosSystem {
|
||||
modules = [
|
||||
({...}: {
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
})
|
||||
|
||||
./configuration.nix
|
||||
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.disko.nixosModules.disko
|
||||
self.nixosModules.nix-scripts
|
||||
self.nixosModules.gitea-instance
|
||||
self.nixosModules.gotify-instance
|
||||
self.nixosModules.nextcloud-instance
|
||||
self.nixosModules.minecraft-server
|
||||
self.nixosModules.borg-server
|
||||
self.nixosModules.wireguard-server
|
||||
];
|
||||
};
|
||||
}
|
||||
71
hosts/harbor/disko.nix
Normal file
71
hosts/harbor/disko.nix
Normal file
@@ -0,0 +1,71 @@
|
||||
let
|
||||
btrfsopt = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
"ssd"
|
||||
"space_cache=v2"
|
||||
"user_subvol_rm_allowed"
|
||||
];
|
||||
in {
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
type = "disk";
|
||||
device = "/dev/sda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "ef02";
|
||||
};
|
||||
esp = {
|
||||
name = "esp";
|
||||
size = "500M";
|
||||
type = "ef00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
luks = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
name = "nixos";
|
||||
passwordFile = "/tmp/pass";
|
||||
additionalKeyFiles = ["/nixos-enc.key"];
|
||||
extraFormatArgs = [
|
||||
"--type luks1"
|
||||
"--iter-time 3000"
|
||||
];
|
||||
settings = {
|
||||
allowDiscards = true;
|
||||
};
|
||||
content = {
|
||||
type = "btrfs";
|
||||
subvolumes = {
|
||||
"@root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = btrfsopt;
|
||||
};
|
||||
"@home" = {
|
||||
mountpoint = "/home";
|
||||
mountOptions = btrfsopt;
|
||||
};
|
||||
"@nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = btrfsopt;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
21
hosts/harbor/hardware-configuration.nix
Normal file
21
hosts/harbor/hardware-configuration.nix
Normal file
@@ -0,0 +1,21 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = [];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
Reference in New Issue
Block a user