Compare commits

..

8 Commits

Author SHA1 Message Date
02a5f5427b Add hydra spec files 2026-03-12 15:21:54 +01:00
72b2ae020a merge upstream 2026-03-10 18:52:07 +01:00
4b222ac4b0 miaou 2026-02-19 12:49:34 +01:00
a2b49bb36e bugh 2026-02-19 12:42:29 +01:00
9641ed68e2 gwah! 2026-02-19 12:32:41 +01:00
80a9fdb880 bleh 2026-02-19 02:31:46 +01:00
a07c47846e wehhhh 2026-02-19 02:25:58 +01:00
f1f8a3c908 fix? 2026-02-19 00:13:50 +01:00
21 changed files with 55 additions and 430 deletions

View File

@@ -2,7 +2,7 @@ name: Weekly Flake Update
on:
schedule:
- cron: "0 4 1/14 * *"
- cron: "0 0 * * 4"
workflow_dispatch:
permissions:
@@ -89,18 +89,6 @@ jobs:
grep -q ${{ github.ref_name }} &&
exit 1 ||
exit 0
- name: close other bump requests
run: |
for i in $(tea pr -o simple | grep "Automatic Nixpkgs update" | awk '{print $1}')
do
if [ "$i" = "" ]
then
echo "No bumps to close"
exit 0
else
tea pr close $i
fi
done
- name: Force push branch
run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
- name: Create pull request

View File

@@ -1,63 +0,0 @@
name: Hydra callback
on:
pull_request:
types:
- opened
- synchronize
paths:
- '**.nix'
- flake.lock
push:
branches:
- master
paths:
- '**.nix'
- flake.lock
permissions:
contents: write
jobs:
on_pr:
if: github.event.pull_request
runs-on: ubuntu-latest
env:
NIXPKGS_ALLOW_UNFREE: 1
steps:
- name: Install sudo
run: |
apt-get update
apt-get install -y sudo
- name: Set up Nix
uses: https://github.com/cachix/install-nix-action@v31
with:
github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
- name: Find pr number
run: |
echo PR=$(echo "${{ github.ref }}" | cut -d / -f 3) >> "$GITHUB_ENV"
- name: run hydra wait
timeout-minutes: 200
run: |
echo "Running now @ pr no $PR"
nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 "$PR"
on_push:
if: github.event.push
runs-on: ubuntu-latest
env:
NIXPKGS_ALLOW_UNFREE: 1
steps:
- name: Install sudo
run: |
apt-get update
apt-get install -y sudo
- name: Set up Nix
uses: https://github.com/cachix/install-nix-action@v31
with:
github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
- name: run hydra wait
timeout-minutes: 200
run: |
echo "Running now @ master"
nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 master

View File

@@ -15,28 +15,6 @@ let
keepnr = 1;
type = 1;
flake = "${info.head.repo.html_url}/archive/${info.head.ref}.tar.gz";
inputs = {
gitea_repo_name = {
type = "string";
value = "${info.head.repo.name}";
emailresponsible = false;
};
gitea_repo_owner = {
type = "string";
value = "${info.head.repo.owner.username}";
emailresponsible = false;
};
gitea_http_url = {
type = "string";
value = "https://git.dynamicdiscord.de";
emailresponsible = false;
};
gitea_status_repo = {
type = "string";
value = "${info.head.ref}";
emailresponsible = false;
};
};
}) prs;
mkFlakeJobset = branch: {
description = "Build ${branch} branch of the Malobeo Infrastructure repo";
@@ -48,7 +26,7 @@ let
keepnr = 3;
hidden = false;
type = 1;
flake = "https://git.dynamicdiscord.de/malobeo/infrastructure/archive/${branch}.tar.gz";
flake = "git+https://git.dynamicdiscord.de/malobeo/infrastructure/archive/${branch}.tar.gz";
};
desc = prJobsets // {

View File

@@ -12,7 +12,7 @@
"type": 0,
"inputs": {
"nixexpr": {
"value": "https://git.dynamicdiscord.de/malobeo/infrastructure master",
"value": "https://git.dynamicdiscord.de/ahtlon/infrastructure master",
"type": "git",
"emailresponsible": false
},

View File

@@ -1,5 +1,6 @@
[book]
authors = ["ahtlon"]
language = "de"
multilingual = false
src = "src"
title = "Malobeo Infrastruktur Dokumentation"

View File

@@ -12,7 +12,6 @@
- [musik](./projekte/musik.md)
- [TODO](./todo.md)
- [Modules]()
- [Gitea-translator](./module/gitea-translator.md)
- [Initrd-ssh](./module/initssh.md)
- [Disks](./module/disks.md)
- [How-to]()

View File

@@ -1,14 +1,7 @@
### Updating nextcloud
## Updating the draggable patch
As of 17.06.26 the patch now gets applied automaticly while building the package.
On a nextcloud update:
- Change the `services.nextcloud.package` to the next version (ex.: `pkgs.nextcloud33`)
- Change `services.nextcloud.extraApps.deck.src.rev` to the next version (ex.: `stable33`)
- update hashes
### Building the package manually
The draggable patch is a one line patch found in the deck repo under `src/components/cards/CardItem.vue`
Direct link: https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761

View File

@@ -1,21 +0,0 @@
# Gitea-tanslator
The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.
To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`
## Module config
##### enable (default = false) - enables the module
##### baseurl (default = "git.dynamicdiscord.de") - Base URL of the Gitea instance
##### owner (default = "malobeo") - Repository owner
##### repo (default = "infrastructure") - Repository name
##### host (default = "127.0.0.1") - Address the server binds to
##### port (default = 27364) - Port the server listens on
## Hydra config
If you change the default port or host, the file `.hydra/spec.json` has to be modified accordingly.
With the module running on the hydra host, create a new hydra project, then:
- Set `Declarative spec file` to `.hydra/spec.json`
- Change declaritive input type to `Git checkout`
- Set your git repo location in the field below that

66
flake.lock generated
View File

@@ -85,16 +85,16 @@
]
},
"locked": {
"lastModified": 1781319724,
"narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
"lastModified": 1763992789,
"narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
"rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-26.05",
"ref": "release-25.05",
"repo": "home-manager",
"type": "github"
}
@@ -126,11 +126,11 @@
"spectrum": "spectrum"
},
"locked": {
"lastModified": 1781389237,
"narHash": "sha256-Ne1/E5XNUq0gleaQz0vW5R4xf/0h/uEZ+bOW1aNjeQk=",
"lastModified": 1772055583,
"narHash": "sha256-iPIm1orqkhsxqju6EVODOrV1BmyA5HNTZ8a1o812bFM=",
"owner": "astro",
"repo": "microvm.nix",
"rev": "6ad601df0a07d9855c5e8f9b81135ecaf7c287eb",
"rev": "f6dcfb7c16cc3775536c825dc0698d4ede13d063",
"type": "github"
},
"original": {
@@ -176,15 +176,12 @@
}
},
"nixos-hardware": {
"inputs": {
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1781622756,
"narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
"lastModified": 1771969195,
"narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
"rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
"type": "github"
},
"original": {
@@ -212,11 +209,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1781577229,
"narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
"lastModified": 1771848320,
"narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
"rev": "2fc6539b481e1d2569f25f8799236694180c0993",
"type": "github"
},
"original": {
@@ -228,29 +225,16 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1767892417,
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1781216227,
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
"lastModified": 1771903837,
"narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
"rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-26.05",
"ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
}
@@ -265,7 +249,7 @@
"microvm": "microvm",
"nixos-generators": "nixos-generators",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_3",
"nixpkgs": "nixpkgs_2",
"nixpkgs-unstable": "nixpkgs-unstable",
"sops-nix": "sops-nix",
"tasklist": "tasklist",
@@ -280,11 +264,11 @@
]
},
"locked": {
"lastModified": 1780547341,
"narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
"lastModified": 1772048434,
"narHash": "sha256-/wA0OaH6kZ/pFA+nXR/tvg5oupOmEDmMS5us79JT60o=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
"rev": "334daa7c273dd8bf7a0cd370e4e16022b64e55e9",
"type": "github"
},
"original": {
@@ -296,11 +280,11 @@
"spectrum": {
"flake": false,
"locked": {
"lastModified": 1778940603,
"narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
"lastModified": 1759482047,
"narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
"ref": "refs/heads/main",
"rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
"revCount": 1265,
"rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
"revCount": 996,
"type": "git",
"url": "https://spectrum-os.org/git/spectrum"
},

View File

@@ -3,7 +3,7 @@
inputs = {
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -43,7 +43,7 @@
};
home-manager= {
url = "github:nix-community/home-manager/release-26.05";
url = "github:nix-community/home-manager/release-25.05";
inputs = {
nixpkgs.follows = "nixpkgs";
};

View File

@@ -165,7 +165,7 @@ in
defaults.email = "malobeo@systemli.org";
defaults = {
dnsProvider = "njalla";
environmentFile = config.sops.secrets.njala_api_key.path;
credentialsFile = config.sops.secrets.njala_api_key.path;
dnsPropagationCheck = false;
};
};

View File

@@ -46,8 +46,6 @@
];
};
nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];
services.tor = {
enable = true;
client.enable = true;

View File

@@ -67,17 +67,17 @@ in
mpd = {
enable = true;
musicDirectory = "/var/lib/mpd/music";
settings = {
audio_output = [{
type = "alsa";
name = "My ALSA";
device = "hw:0,0"; # optional
format = "44100:16:2"; # optional
mixer_type = "hardware";
mixer_device = "default";
mixer_control = "PCM";
}];
};
extraConfig = ''
audio_output {
type "alsa"
name "My ALSA"
device "hw:0,0" # optional
format "44100:16:2" # optional
mixer_type "hardware"
mixer_device "default"
mixer_control "PCM"
}
'';
# Optional:
network.listenAddress = "any"; # if you want to allow non-localhost connections
@@ -199,7 +199,7 @@ in
defaults.email = "malobeo@systemli.org";
defaults = {
dnsProvider = "njalla";
environmentFile = config.sops.secrets.njala_api_key.path;
credentialsFile = config.sops.secrets.njala_api_key.path;
dnsPropagationCheck = false;
};
};

View File

@@ -1,78 +0,0 @@
{ config, self, lib, inputs, pkgs, ... }:
with lib;
let
cfg = config.services.malobeo.gitea-translator;
in
{
options = {
services.malobeo.gitea-translator = {
enable = mkOption {
default = false;
type = types.bool;
description = lib.mdDoc "Start a webserver for hydra to use the gitea pull request api.";
};
baseurl = mkOption {
type = types.str;
default = "git.dynamicdiscord.de";
description = lib.mdDoc "Base URL of the Gitea instance.";
};
owner = mkOption {
type = types.str;
default = "malobeo";
description = lib.mdDoc "Repository owner on the Gitea instance.";
};
repo = mkOption {
type = types.str;
default = "infrastructure";
description = lib.mdDoc "Repository name on the Gitea instance.";
};
host = mkOption {
type = types.str;
default = "127.0.0.1";
description = lib.mdDoc "Address the server binds to.";
};
port = mkOption {
type = types.port;
default = 27364;
description = lib.mdDoc "Port the server listens on.";
};
};
};
config = mkIf cfg.enable {
systemd.services.gitea-translator = {
description = "Gitea Pull Request Translator for Hydra";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''
${pkgs.python3}/bin/python3 ${../../../scripts/gitea_hydra_server.py} \
--baseurl ${cfg.baseurl} \
--owner ${cfg.owner} \
--repo ${cfg.repo} \
--host ${cfg.host} \
--port ${toString cfg.port}
'';
Restart = "on-failure";
RestartSec = 5;
# Hardening because why not
DynamicUser = true;
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
PrivateDevices = true;
};
};
};
}

View File

@@ -41,22 +41,17 @@ in
};
};
services.alloy = {
services.promtail = {
enable = cfg.enablePromtail;
extraFlags = ["--config.format=promtail"]; #TODO please change this to native alloy config later
configPath = import ./promtail_config.nix {
configFile = import ./promtail_config.nix {
lokiAddress = cfg.lokiHost;
logNginx = cfg.logNginx;
config = config;
pkgs = pkgs;
};
};
users.groups.promtail = {};
users.users.promtail = {
isNormalUser = true;
group = "promtail";
extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
};
users.users.promtail.extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
};
}

View File

@@ -1,25 +0,0 @@
From 0d4b14e8eb62b0f0ed01f45bbaa7c2721245f7d6 Mon Sep 17 00:00:00 2001
From: ahtlon <git@ahtlon.de>
Date: Thu, 9 Oct 2025 12:22:08 +0200
Subject: [PATCH] Patch cards to be draggable
---
src/components/cards/CardItem.vue | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/components/cards/CardItem.vue b/src/components/cards/CardItem.vue
index 7539ac53e..aaf9f2fe0 100644
--- a/src/components/cards/CardItem.vue
+++ b/src/components/cards/CardItem.vue
@@ -20,7 +20,7 @@
<CardCover v-if="showCardCover" :card-id="card.id" />
<div class="card-upper">
<h4 v-if="editingTitle === 0" key="title-view" dir="auto">
- <span class="dragDisabled" contenteditable="false">{{ displayTitle }}</span>
+ <span contenteditable="false">{{ displayTitle }}</span>
</h4>
<h4 v-if="editingTitle >= 1"
key="title-edit"
--
2.54.0

View File

@@ -39,7 +39,7 @@ in
services.nextcloud = {
enable = true;
package = pkgs.nextcloud33;
package = pkgs.nextcloud32;
hostName = "cloud.malobeo.org";
config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
maxUploadSize = "10G";
@@ -54,29 +54,15 @@ in
extraAppsEnable = true;
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
deck = pkgs.php.buildComposerProject2 (finalAttrs: {
pname = "deck";
version = "1.18.0";
src = pkgs.fetchFromGitHub {
owner = "nextcloud";
repo = "deck";
rev = "stable33";
hash = "sha256-7R0IteB34mWFwUlHptvqNlfmeFhJcGMRlKFtDqsw1Dw=";
};
composerNoDev = false;
composerStrictValidation = false;
vendorHash = "sha256-gAuG5kKVpuaOpw2HvAP/hu89lmcVWUiSwujoN++I/ZA=";
patches = [ ./0001-Patch-cards-to-be-draggable.patch ];
postInstall = ''
cp -r $out/share/php/deck/* $out/
rm -r $out/share
'';
});
deck = pkgs.fetchNextcloudApp {
sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
license = "agpl3Plus";
};
};
settings = {
trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
overwriteprotocol = "https";
"maintenance_window_start" = "1";
"default_phone_region" = "DE";
};

View File

@@ -37,7 +37,6 @@ in
services.grafana = {
enable = true;
settings = {
security.secret_key = "SW2YcwTIb9zpOOhoPsMm";
server = {
domain = "grafana.malobeo.org";
http_port = 2342;

View File

@@ -1,4 +1,4 @@
{ config, self, lib, pkgs, inputs, ... }:
{ config, self, lib, pkgs, ... }:
with lib;
@@ -58,7 +58,6 @@ in
services.pretalx = {
enable = true;
package = inputs.nixpkgs-unstable.legacyPackages."x86_64-linux".pretalx;
celery.extraArgs = [
"--concurrency=${toString config.microvm.vcpu}"
];

View File

@@ -118,7 +118,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
users.imports = [ ./machines/modules/malobeo/users.nix ];
backup.imports = [ ./machines/modules/malobeo/backup.nix ];
printing.imports = [ ./machines/modules/malobeo/printing.nix ];
gitea-translator.imports = [ ./machines/modules/malobeo/gitea_translator.nix ];
};
hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (

View File

@@ -1,107 +0,0 @@
#!/usr/bin/env python3
#imports
import os
import json
import argparse
from http.server import BaseHTTPRequestHandler, HTTPServer
import urllib.request
def _get_api_response(baseurl, owner, repo):
###https://docs.gitea.com/api/1.21/#tag/repository/operation/repoListPullRequests
###GET /api/v1/repos/{owner}/{repo}/pulls
url=(f"https://{baseurl}/api/v1/repos/{owner}/{repo}/pulls?state=open")
headers={"Accept": "application/json"}
req=urllib.request.Request(url, headers=headers)
with urllib.request.urlopen(req) as resp:
return json.loads(resp.read().decode("utf-8"))
def _parse_response(baseurl, owner, repo):
target_repo_url=f"https://{baseurl}/{owner}/{repo}.git"
pulls: dict={}
response=_get_api_response(baseurl, owner, repo)
for pr in response:
pr["target_repo_url"]=target_repo_url
pulls[str(pr["number"])]=pr
return pulls
class PullsHandler(BaseHTTPRequestHandler):
_VALID_PATHS={"/", "/gitea-pulls-sorted.json"}
# Class variables to store configuration
baseurl = None
owner = None
repo = None
def do_GET(self):
if self.path not in self._VALID_PATHS:
self.send_error(404, "Not Found")
return
answer=dict(_parse_response(self.baseurl, self.owner, self.repo))
body=json.dumps(answer, indent=2, sort_keys=True).encode("utf-8")
self.send_response(200)
self.send_header("Content-Type", "application/json; charset=utf-8")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)
def log_message(self, fmt, *args):
print(
f"[gitea-translator] {self.address_string()} - {fmt % args}",
flush=True,
)
def main():
parser = argparse.ArgumentParser(
description="Hydra Server to Gitea-pull-request translator"
)
parser.add_argument(
"--baseurl",
default="git.dynamicdiscord.de",
help="Base URL of Gitea instance (default: git.dynamicdiscord.de)"
)
parser.add_argument(
"--owner",
default="malobeo",
help="Repository owner (default: malobeo)"
)
parser.add_argument(
"--repo",
default="infrastructure",
help="Repository name (default: infrastructure)"
)
parser.add_argument(
"--host",
default="127.0.0.1",
help="Host to bind to (default: 127.0.0.1)"
)
parser.add_argument(
"--port",
type=int,
default=27364,
help="Port to bind to (default: 27364)"
)
args = parser.parse_args()
# Set class variables so they're accessible in request handlers
PullsHandler.baseurl = args.baseurl
PullsHandler.owner = args.owner
PullsHandler.repo = args.repo
print(
f"[gitea-translator] Starting, pulling from {args.baseurl}/{args.owner}/{args.repo}",
flush=True,
)
server=HTTPServer((args.host, args.port), PullsHandler)
print(
f"[gitea-translator] online @ {args.host}:{args.port}",
flush=True,
)
server.serve_forever()
if __name__ == "__main__":
main()