ahtlon/infrastructure
1
0
Fork 0
forked from malobeo/infrastructure
Code Pull Requests 5 Actions Activity

Merge branch 'dns'

Browse Source
This commit is contained in:
kalipso
2026-02-20 20:21:22 +01:00
parent 5a517d57fb f28125c9a4
commit 79fef44bcf
19 changed files with 341 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
machines/fanny/configuration.nix
View File

@@ -2,11 +2,13 @@
let
sshKeys = import ../ssh_keys.nix;
peers = import ../modules/malobeo/peers.nix;
hosts = import ../hosts.nix {};
in
{
sops.defaultSopsFile = ./secrets.yaml;
sops.secrets.wg_private = {};
sops.secrets.shop_auth = {};
sops.secrets.njala_api_key = {};
imports =
[ # Include the results of the hardware scan.
@@ -35,7 +37,7 @@ in
enable = true;
enablePromtail = true;
logNginx = true;
lokiHost = "10.0.0.14";
lokiHost = hosts.malobeo.hosts.overwatch.network.address;
};
malobeo.autoUpdate = {
@@ -129,7 +131,12 @@ in
privateKeyFile = config.sops.secrets.wg_private.path;
};
services.malobeo.microvm.enableHostBridge = true;
services.malobeo.microvm = {
enableHostBridge = true;
interface = "enp1s0";
gateway = "192.168.1.1";
address = "192.168.1.2/24";
};
services.malobeo.microvm.deployHosts = [
"overwatch"
"infradocs"
@@ -151,20 +158,48 @@ in
};
};
security.acme = {
acceptTerms = true;
defaults.email = "malobeo@systemli.org";
defaults = {
dnsProvider = "njalla";
credentialsFile = config.sops.secrets.njala_api_key.path;
dnsPropagationCheck = false;
};
};
services.nginx = {
enable = true;
virtualHosts."docs.malobeo.org" = {
locations."/" = {
proxyPass = "http://10.0.0.11:9000";
proxyPass = "http://${hosts.malobeo.hosts.infradocs.network.address}:9000";
extraConfig = ''
proxy_set_header Host $host;
'';
};
};
virtualHosts."cloud.malobeo.org" = {
virtualHosts."cloud.hq.malobeo.org" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "http://10.0.0.13";
proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
extraConfig = ''
proxy_set_header Host $host;
client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
client_body_timeout 3600s;
send_timeout 3600s;
fastcgi_buffers 64 4K;
'';
};
};
virtualHosts."cloud.malobeo.org" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
extraConfig = ''
proxy_set_header Host $host;
client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
@@ -186,7 +221,7 @@ in
virtualHosts."grafana.malobeo.org" = {
locations."/" = {
proxyPass = "http://10.0.0.14";
proxyPass = "http://${hosts.malobeo.hosts.overwatch.network.address}";
extraConfig = ''
proxy_set_header Host $host;
'';
@@ -195,19 +230,38 @@ in
virtualHosts."tasklist.malobeo.org" = {
locations."/" = {
proxyPass = "http://10.0.0.5:8080";
proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
extraConfig = ''
proxy_set_header Host $host;
'';
};
};
virtualHosts."zines.malobeo.org" = {
# created with: nix-shell --packages apacheHttpd --run 'htpasswd -B -c foo.txt malobeo'
# then content of foo.txt put into sops
# basicAuthFile = config.sops.secrets.shop_auth.path;
virtualHosts."zines.hq.malobeo.org" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "http://10.0.0.15:8080";
proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
extraConfig = ''
proxy_set_header Host $host;
client_body_in_file_only clean;
client_body_buffer_size 32K;
client_max_body_size 50M;
sendfile on;
send_timeout 300s;
'';
};
};
virtualHosts."zines.malobeo.org" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
extraConfig = ''
proxy_set_header Host $host;

11
machines/fanny/dummy.yaml
View File

@@ -1,9 +1,6 @@
wg_private: ENC[AES256_GCM,data:YEmIfgtyHE9msYijva0Ye2w7shVmYBPZ3mcKRF7Cy20xa6yHEUQ0kC2OWnM=,iv:ouK6fHcrxrEtsmiPmtCz9Ca8Ec1algOifrgZSBNHi74=,tag:524e/SQt++hwVyeWruCsLg==,type:str]
njala_api_key: ENC[AES256_GCM,data:uEzx7KeI7ZZP63Igu5vHmuvASVxJai8bezM40UZVobQMr7r6opjnVTc0BPyIGfnG2mx/6Bo=,iv:lch04oGn6bkqtBGVzYlz6B97FGXlGOoxkiT1IplSxm4=,tag:bzXx2jSqFBv1hgJO1r5i+w==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
enc: |
@@ -23,8 +20,8 @@ sops:
NjJ5cFdTVS9NZmVWMjcrcHo2WDZEZDgKiDwkuUn90cDmidwYGZBb5qp+4R1HafV0
vMQfjT9GrwB5K/O1GumOmvbzLNhvO2vRZJhfVHzyHLzQK64abQgF5Q==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-01-19T22:46:09Z"
mac: ENC[AES256_GCM,data:eU3SIqAGrgbO2tz4zH1tgYcif7oe5j+/wmdYl2xXXI+D6IhiKrTJGvzE3rd3ElEpb+Bg0UQId952U2Ut0yPTfxGLtdlbJA66CmhLAksByoJ8lOXUcp/qDyA4yMRSuwYG2v7uF2crvue9fyRfZ7hl7abE/Q7Z2UjOKqhSZC5cO3U=,iv:NmCVvtBWZRzhpr5nMLy+98VuQZWoUms7xFSxq8PMvBA=,tag:UWjA7oqoNWh4wb0myNg7FA==,type:str]
lastmodified: "2026-02-20T18:33:50Z"
mac: ENC[AES256_GCM,data:YlsQVjfgtlcSObjLiZif/sOJNx2PqH9q0kguPgBSwAoNiX2/eJhNH2WwtQ8uXQfdPiX7kwfFrl2E0xevqwLv+4AICr+9v6oCfcUHJYPRdkLfCs0jXyvnZr52LzfyV3GOPah/j8Uye9d9sspUMqqaXewoeWtrXHgo277pQVdrKxM=,iv:Xb5ckc/cvpGqkZoViTrw8rUniO2OWy0/rNfhF+Qb/iM=,tag:ZhI4jS2Iyig9juVGAeii+w==,type:str]
pgp:
- created_at: "2025-01-19T22:45:26Z"
enc: |-
@@ -65,4 +62,4 @@ sops:
-----END PGP MESSAGE-----
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
unencrypted_suffix: _unencrypted
version: 3.9.2
version: 3.11.0