jonas/.hive
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: harbor

Browse Source
This commit is contained in:
Jonas Röger
2026-03-28 15:21:17 +01:00
parent cf289c8c48
commit fc166785ee
12 changed files with 809 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

150
hosts/harbor/configuration.nix Normal file
View File

@@ -0,0 +1,150 @@
{
config,
pkgs,
...
}: {
imports = [
./hardware-configuration.nix
./disko.nix
];
# Secret management
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.secrets."nextcloud-admin-pass" = {
sopsFile = ../../secrets/harbor/nextcloud.yaml;
owner = "nextcloud";
key = "admin-pass";
};
sops.secrets."wg-priv" = {
sopsFile = ../../secrets/harbor/wg.yaml;
key = "privateKey";
};
sops.secrets."gitea-db-pass" = {
sopsFile = ../../secrets/harbor/gitea.yaml;
owner = config.services.gitea.user;
key = "databasePassword";
};
sops.secrets."gotify-admin-pass" = {
sopsFile = ../../secrets/harbor/gotify.yaml;
owner = config.hive.gotify-instance.user;
key = "adminPassword";
};
# gc settings and binary caches
nix = {
settings = {
substituters = [
"https://aseipp-nix-cache.freetls.fastly.net"
"https://nix-community.cachix.org"
"https://cache.nixos.org/"
];
experimental-features = ["nix-command" "flakes"];
auto-optimise-store = true;
};
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
};
# user with ssh access
users.users.jonas = {
isNormalUser = true;
description = "Jonas";
extraGroups = ["wheel"];
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyCyYsMSiy7shcehlzJEbCyRiHk+cicFB35Bc2uc4PjjkCjswLh01fRAV2QcplrNkH/5F4GBTbOoZHHc7/AVLyUxgwDC9ffD2i7fevuGpfBFy9D30uz6jDekxXkmRmIlidXLdG1Fh4zwVejGlwdhUu/Zb7PonO/dktx3EFdf1SpnW+y75anN85zoGsld7KQk42wEd0zXtCgx4CKI6Vvt6heWCEiJ9wyw1sLpTJr4H8In236CUj1/r1qY9Gfa8n9NA0J9XCpcwSCEWGRKQNicoQIpnp5txrgzaUq4r6qBKHmImYXmSTVnDZ9dJLRYNu2lDvBtTXP4ztlR6Lpxs873fPg51qgaX9rRVMMo/gGjq8fOFWsDVaJZab9VY3hZYNCKIbWFqo4GKyCQs9Xfzr2AUACm09HWiYMTefwEypOzvUb4z+LF2B/0c5XmghLF/TOzLVgDXzAgWMH4mCnPh9EDLHTtoJaGNURler9VRV8yQyLH6oK9UpHZovCFs7HpFN+WPv2QVFfkK8aHg7tnklFsT78z154bjuspiEI/fFGmTxoQUGufmHlRy/9GQDusgNfe24ZEB2hHBVjKv29XdIfvFAhoPVpA6+O/N3feSlmVISaU+8QraVQEf/TuQjopDUWpJTmqSxKvQSTPwcyWDy6NtcJ85bGAu6jSUGC3ouH4Rb2Q== cardno:000609618602"
];
};
users.defaultUserShell = pkgs.zsh;
programs.zsh.enable = true;
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
};
# hive modules
hive.gitea-instance.enable = true;
hive.gitea-instance.nativeRunner = true;
hive.gitea-instance.instanceFQDN = "git.jroeger.de";
hive.gitea-instance.databasePasswordFile = config.sops.secrets.gitea-db-pass.path;
hive.gotify-instance.enable = true;
hive.gotify-instance.instanceFQDN = "gotify.jroeger.de";
hive.gotify-instance.adminPasswordSopsKey = config.sops.secrets.gotify-admin-pass.name;
hive.nextcloud-instance.enable = true;
hive.nextcloud-instance.ssl = true;
hive.nextcloud-instance.adminPasswordFile = config.sops.secrets.nextcloud-admin-pass.path;
hive.nextcloud-instance.instanceFQDN = "nextcloud.jroeger.de";
hive.minecraft-server.enable = true;
hive.borg-server.enable = true;
hive.borg-server.repositories.comfy-station.ssh_public_key = builtins.readFile (../../static/keys + "/borg-jonas@comfy-station.pub");
hive.wg.server.enable = true;
hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "25.11"; # Did you read the comment?
# VPS compat
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/sda";
boot.loader.grub.version = 2;
boot.kernelParams = [
"net.ifnames=0" # ensure iface is called eth0
"ip=173.249.42.252::173.249.42.1:255.255.255.0:harbor:eth0:none:8.8.8.8"
];
networking.networkmanager.enable = true;
networking = {
# Static network configuration
hostName = "harbor";
domain = "jroeger.de";
defaultGateway = "173.249.42.1";
nameservers = ["8.8.8.8"];
interfaces.eth0.ipv4.addresses = [
{
address = "173.249.42.252";
prefixLength = 24;
}
];
};
# Temporary ssh server for disk unlock
boot.initrd = {
availableKernelModules = ["virtio_pci"];
network = {
enable = true;
ssh = {
enable = true;
port = 2222;
authorizedKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyCyYsMSiy7shcehlzJEbCyRiHk+cicFB35Bc2uc4PjjkCjswLh01fRAV2QcplrNkH/5F4GBTbOoZHHc7/AVLyUxgwDC9ffD2i7fevuGpfBFy9D30uz6jDekxXkmRmIlidXLdG1Fh4zwVejGlwdhUu/Zb7PonO/dktx3EFdf1SpnW+y75anN85zoGsld7KQk42wEd0zXtCgx4CKI6Vvt6heWCEiJ9wyw1sLpTJr4H8In236CUj1/r1qY9Gfa8n9NA0J9XCpcwSCEWGRKQNicoQIpnp5txrgzaUq4r6qBKHmImYXmSTVnDZ9dJLRYNu2lDvBtTXP4ztlR6Lpxs873fPg51qgaX9rRVMMo/gGjq8fOFWsDVaJZab9VY3hZYNCKIbWFqo4GKyCQs9Xfzr2AUACm09HWiYMTefwEypOzvUb4z+LF2B/0c5XmghLF/TOzLVgDXzAgWMH4mCnPh9EDLHTtoJaGNURler9VRV8yQyLH6oK9UpHZovCFs7HpFN+WPv2QVFfkK8aHg7tnklFsT78z154bjuspiEI/fFGmTxoQUGufmHlRy/9GQDusgNfe24ZEB2hHBVjKv29XdIfvFAhoPVpA6+O/N3feSlmVISaU+8QraVQEf/TuQjopDUWpJTmqSxKvQSTPwcyWDy6NtcJ85bGAu6jSUGC3ouH4Rb2Q== cardno:000609618602"
];
hostKeys = ["/etc/secrets/initrd/ssh_host_rsa_key"];
shell = "/bin/cryptsetup-askpass";
};
};
};
# Set your time zone.
time.timeZone = "Europe/Berlin";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "de_DE.UTF-8";
LC_IDENTIFICATION = "de_DE.UTF-8";
LC_MEASUREMENT = "de_DE.UTF-8";
LC_MONETARY = "de_DE.UTF-8";
LC_NAME = "de_DE.UTF-8";
LC_NUMERIC = "de_DE.UTF-8";
LC_PAPER = "de_DE.UTF-8";
LC_TELEPHONE = "de_DE.UTF-8";
LC_TIME = "de_DE.UTF-8";
};
console.keyMap = "de";
}