Compare commits
8
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 ahtlon
|
02a5f5427b
|
||
|
ahtlon
|
72b2ae020a | ||
|
ahtlon
|
4b222ac4b0
|
||
|
ahtlon
|
a2b49bb36e
|
||
|
ahtlon
|
9641ed68e2
|
||
|
ahtlon
|
80a9fdb880
|
||
|
ahtlon
|
a07c47846e
|
||
|
ahtlon
|
f1f8a3c908
|
@@ -2,7 +2,7 @@ name: Weekly Flake Update
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 4 1/14 * *"
|
||||
- cron: "0 0 * * 4"
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
@@ -89,18 +89,6 @@ jobs:
|
||||
grep -q ${{ github.ref_name }} &&
|
||||
exit 1 ||
|
||||
exit 0
|
||||
- name: close other bump requests
|
||||
run: |
|
||||
for i in $(tea pr -o simple | grep "Automatic Nixpkgs update" | awk '{print $1}')
|
||||
do
|
||||
if [ "$i" = "" ]
|
||||
then
|
||||
echo "No bumps to close"
|
||||
exit 0
|
||||
else
|
||||
tea pr close $i
|
||||
fi
|
||||
done
|
||||
- name: Force push branch
|
||||
run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
|
||||
- name: Create pull request
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
name: Hydra callback
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types:
|
||||
- opened
|
||||
- synchronize
|
||||
paths:
|
||||
- '**.nix'
|
||||
- flake.lock
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
paths:
|
||||
- '**.nix'
|
||||
- flake.lock
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
on_pr:
|
||||
if: github.event.pull_request
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
NIXPKGS_ALLOW_UNFREE: 1
|
||||
steps:
|
||||
- name: Install sudo
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y sudo
|
||||
- name: Set up Nix
|
||||
uses: https://github.com/cachix/install-nix-action@v31
|
||||
with:
|
||||
github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
|
||||
- name: Find pr number
|
||||
run: |
|
||||
echo PR=$(echo "${{ github.ref }}" | cut -d / -f 3) >> "$GITHUB_ENV"
|
||||
- name: run hydra wait
|
||||
timeout-minutes: 200
|
||||
run: |
|
||||
echo "Running now @ pr no $PR"
|
||||
nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 "$PR"
|
||||
|
||||
on_push:
|
||||
if: github.event.push
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
NIXPKGS_ALLOW_UNFREE: 1
|
||||
steps:
|
||||
- name: Install sudo
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y sudo
|
||||
- name: Set up Nix
|
||||
uses: https://github.com/cachix/install-nix-action@v31
|
||||
with:
|
||||
github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
|
||||
- name: run hydra wait
|
||||
timeout-minutes: 200
|
||||
run: |
|
||||
echo "Running now @ master"
|
||||
nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 master
|
||||
@@ -15,28 +15,6 @@ let
|
||||
keepnr = 1;
|
||||
type = 1;
|
||||
flake = "${info.head.repo.html_url}/archive/${info.head.ref}.tar.gz";
|
||||
inputs = {
|
||||
gitea_repo_name = {
|
||||
type = "string";
|
||||
value = "${info.head.repo.name}";
|
||||
emailresponsible = false;
|
||||
};
|
||||
gitea_repo_owner = {
|
||||
type = "string";
|
||||
value = "${info.head.repo.owner.username}";
|
||||
emailresponsible = false;
|
||||
};
|
||||
gitea_http_url = {
|
||||
type = "string";
|
||||
value = "https://git.dynamicdiscord.de";
|
||||
emailresponsible = false;
|
||||
};
|
||||
gitea_status_repo = {
|
||||
type = "string";
|
||||
value = "${info.head.ref}";
|
||||
emailresponsible = false;
|
||||
};
|
||||
};
|
||||
}) prs;
|
||||
mkFlakeJobset = branch: {
|
||||
description = "Build ${branch} branch of the Malobeo Infrastructure repo";
|
||||
@@ -48,7 +26,7 @@ let
|
||||
keepnr = 3;
|
||||
hidden = false;
|
||||
type = 1;
|
||||
flake = "https://git.dynamicdiscord.de/malobeo/infrastructure/archive/${branch}.tar.gz";
|
||||
flake = "git+https://git.dynamicdiscord.de/malobeo/infrastructure/archive/${branch}.tar.gz";
|
||||
};
|
||||
|
||||
desc = prJobsets // {
|
||||
|
||||
+1
-1
@@ -12,7 +12,7 @@
|
||||
"type": 0,
|
||||
"inputs": {
|
||||
"nixexpr": {
|
||||
"value": "https://git.dynamicdiscord.de/malobeo/infrastructure master",
|
||||
"value": "https://git.dynamicdiscord.de/ahtlon/infrastructure master",
|
||||
"type": "git",
|
||||
"emailresponsible": false
|
||||
},
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
[book]
|
||||
authors = ["ahtlon"]
|
||||
language = "de"
|
||||
multilingual = false
|
||||
src = "src"
|
||||
title = "Malobeo Infrastruktur Dokumentation"
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
- [musik](./projekte/musik.md)
|
||||
- [TODO](./todo.md)
|
||||
- [Modules]()
|
||||
- [Gitea-translator](./module/gitea-translator.md)
|
||||
- [Initrd-ssh](./module/initssh.md)
|
||||
- [Disks](./module/disks.md)
|
||||
- [How-to]()
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
# Gitea-tanslator
|
||||
The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
|
||||
|
||||
This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.
|
||||
To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`
|
||||
|
||||
## Module config
|
||||
##### enable (default = false) - enables the module
|
||||
##### baseurl (default = "git.dynamicdiscord.de") - Base URL of the Gitea instance
|
||||
##### owner (default = "malobeo") - Repository owner
|
||||
##### repo (default = "infrastructure") - Repository name
|
||||
##### host (default = "127.0.0.1") - Address the server binds to
|
||||
##### port (default = 27364) - Port the server listens on
|
||||
|
||||
## Hydra config
|
||||
If you change the default port or host, the file `.hydra/spec.json` has to be modified accordingly.
|
||||
With the module running on the hydra host, create a new hydra project, then:
|
||||
|
||||
- Set `Declarative spec file` to `.hydra/spec.json`
|
||||
- Change declaritive input type to `Git checkout`
|
||||
- Set your git repo location in the field below that
|
||||
Generated
+25
-41
@@ -85,16 +85,16 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781319724,
|
||||
"narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
|
||||
"lastModified": 1763992789,
|
||||
"narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
|
||||
"rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "release-26.05",
|
||||
"ref": "release-25.05",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -126,11 +126,11 @@
|
||||
"spectrum": "spectrum"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781389237,
|
||||
"narHash": "sha256-Ne1/E5XNUq0gleaQz0vW5R4xf/0h/uEZ+bOW1aNjeQk=",
|
||||
"lastModified": 1772055583,
|
||||
"narHash": "sha256-iPIm1orqkhsxqju6EVODOrV1BmyA5HNTZ8a1o812bFM=",
|
||||
"owner": "astro",
|
||||
"repo": "microvm.nix",
|
||||
"rev": "6ad601df0a07d9855c5e8f9b81135ecaf7c287eb",
|
||||
"rev": "f6dcfb7c16cc3775536c825dc0698d4ede13d063",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -176,15 +176,12 @@
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781622756,
|
||||
"narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
|
||||
"lastModified": 1771969195,
|
||||
"narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
|
||||
"rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -212,11 +209,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1781577229,
|
||||
"narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
|
||||
"lastModified": 1771848320,
|
||||
"narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
|
||||
"rev": "2fc6539b481e1d2569f25f8799236694180c0993",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -228,29 +225,16 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1767892417,
|
||||
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
|
||||
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1781216227,
|
||||
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
|
||||
"lastModified": 1771903837,
|
||||
"narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
|
||||
"rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-26.05",
|
||||
"ref": "nixos-25.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -265,7 +249,7 @@
|
||||
"microvm": "microvm",
|
||||
"nixos-generators": "nixos-generators",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"sops-nix": "sops-nix",
|
||||
"tasklist": "tasklist",
|
||||
@@ -280,11 +264,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780547341,
|
||||
"narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
|
||||
"lastModified": 1772048434,
|
||||
"narHash": "sha256-/wA0OaH6kZ/pFA+nXR/tvg5oupOmEDmMS5us79JT60o=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
|
||||
"rev": "334daa7c273dd8bf7a0cd370e4e16022b64e55e9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -296,11 +280,11 @@
|
||||
"spectrum": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1778940603,
|
||||
"narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
|
||||
"lastModified": 1759482047,
|
||||
"narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
|
||||
"revCount": 1265,
|
||||
"rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
|
||||
"revCount": 996,
|
||||
"type": "git",
|
||||
"url": "https://spectrum-os.org/git/spectrum"
|
||||
},
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
inputs = {
|
||||
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
@@ -43,7 +43,7 @@
|
||||
};
|
||||
|
||||
home-manager= {
|
||||
url = "github:nix-community/home-manager/release-26.05";
|
||||
url = "github:nix-community/home-manager/release-25.05";
|
||||
inputs = {
|
||||
nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
@@ -1,52 +0,0 @@
|
||||
{ self, config, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
antamap-pkg = pkgs.stdenv.mkDerivation {
|
||||
name = "antamap";
|
||||
src = pkgs.fetchgit {
|
||||
url = "https://0xacab.org/AND/antamap.git";
|
||||
branchName = "master";
|
||||
rev = "f62cc588df661e089d4ffb17adb78e667bda8f87";
|
||||
sha256 = "sha256-vMAk2pphApkp1YkFBtX4cQDAyxDgMLnrhI4DTVgBYdE=";
|
||||
};
|
||||
|
||||
installPhase = "mkdir -p $out; cp -R * $out/";
|
||||
};
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
hostName = mkDefault "antamap";
|
||||
useDHCP = false;
|
||||
};
|
||||
|
||||
imports = [
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."_" = {
|
||||
listen = [
|
||||
{ addr = "0.0.0.0"; port = 80; }
|
||||
];
|
||||
root = "${antamap-pkg}";
|
||||
extraConfig = ''
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
}
|
||||
|
||||
@@ -146,7 +146,6 @@ in
|
||||
"zineshop"
|
||||
"vaultwarden"
|
||||
"pretalx"
|
||||
"antamap"
|
||||
];
|
||||
|
||||
networking = {
|
||||
@@ -166,7 +165,7 @@ in
|
||||
defaults.email = "malobeo@systemli.org";
|
||||
defaults = {
|
||||
dnsProvider = "njalla";
|
||||
environmentFile = config.sops.secrets.njala_api_key.path;
|
||||
credentialsFile = config.sops.secrets.njala_api_key.path;
|
||||
dnsPropagationCheck = false;
|
||||
};
|
||||
};
|
||||
@@ -287,15 +286,6 @@ in
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts."antamap.malobeo.org" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://${hosts.malobeo.hosts.antamap.network.address}:80";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.tor = {
|
||||
|
||||
@@ -2,15 +2,12 @@
|
||||
{
|
||||
sops.secrets.njalacloud = {};
|
||||
sops.secrets.njalazines = {};
|
||||
sops.secrets.njalaantamap = {};
|
||||
systemd.services."dyndns" = {
|
||||
script = ''
|
||||
KEYCLOUD=$(cat /run/secrets/njalacloud)
|
||||
KEYZINES=$(cat /run/secrets/njalazines)
|
||||
KEYANATAMAP=$(cat /run/secrets/njalaantamap)
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
|
||||
@@ -3,11 +3,11 @@ shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS
|
||||
shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
|
||||
njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
|
||||
njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
|
||||
njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
|
||||
njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
- recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
|
||||
MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
|
||||
@@ -15,8 +15,8 @@ sops:
|
||||
TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
|
||||
pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
|
||||
- enc: |
|
||||
- recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
|
||||
S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
|
||||
@@ -24,9 +24,8 @@ sops:
|
||||
QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
|
||||
SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
lastmodified: "2026-08-28T12:19:14Z"
|
||||
mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
|
||||
lastmodified: "2026-02-20T19:25:05Z"
|
||||
mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-02-11T18:32:49Z"
|
||||
enc: |-
|
||||
@@ -67,4 +66,4 @@ sops:
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.1
|
||||
version: 3.11.0
|
||||
|
||||
@@ -108,11 +108,6 @@ in
|
||||
type = "microvm";
|
||||
network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
|
||||
};
|
||||
|
||||
antamap = {
|
||||
type = "microvm";
|
||||
network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -46,8 +46,6 @@
|
||||
];
|
||||
};
|
||||
|
||||
nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];
|
||||
|
||||
services.tor = {
|
||||
enable = true;
|
||||
client.enable = true;
|
||||
|
||||
@@ -64,29 +64,29 @@ in
|
||||
};
|
||||
|
||||
|
||||
# mpd = {
|
||||
# enable = true;
|
||||
# musicDirectory = "/var/lib/mpd/music";
|
||||
# settings = {
|
||||
# audio_output = [{
|
||||
# type = "alsa";
|
||||
# name = "My ALSA";
|
||||
# device = "hw:0,0"; # optional
|
||||
# format = "44100:16:2"; # optional
|
||||
# mixer_type = "hardware";
|
||||
# mixer_device = "default";
|
||||
# mixer_control = "PCM";
|
||||
# }];
|
||||
# };
|
||||
mpd = {
|
||||
enable = true;
|
||||
musicDirectory = "/var/lib/mpd/music";
|
||||
extraConfig = ''
|
||||
audio_output {
|
||||
type "alsa"
|
||||
name "My ALSA"
|
||||
device "hw:0,0" # optional
|
||||
format "44100:16:2" # optional
|
||||
mixer_type "hardware"
|
||||
mixer_device "default"
|
||||
mixer_control "PCM"
|
||||
}
|
||||
'';
|
||||
|
||||
# # Optional:
|
||||
# network.listenAddress = "any"; # if you want to allow non-localhost connections
|
||||
# startWhenNeeded = true; # systemd feature: only start MPD service upon connection to its socket
|
||||
# };
|
||||
# Optional:
|
||||
network.listenAddress = "any"; # if you want to allow non-localhost connections
|
||||
startWhenNeeded = true; # systemd feature: only start MPD service upon connection to its socket
|
||||
};
|
||||
|
||||
# ympd = {
|
||||
# enable = true;
|
||||
# };
|
||||
ympd = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
#samba = {
|
||||
# enable = true;
|
||||
@@ -199,7 +199,7 @@ in
|
||||
defaults.email = "malobeo@systemli.org";
|
||||
defaults = {
|
||||
dnsProvider = "njalla";
|
||||
environmentFile = config.sops.secrets.njala_api_key.path;
|
||||
credentialsFile = config.sops.secrets.njala_api_key.path;
|
||||
dnsPropagationCheck = false;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
{ config, self, lib, inputs, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.malobeo.gitea-translator;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.malobeo.gitea-translator = {
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = lib.mdDoc "Start a webserver for hydra to use the gitea pull request api.";
|
||||
};
|
||||
|
||||
baseurl = mkOption {
|
||||
type = types.str;
|
||||
default = "git.dynamicdiscord.de";
|
||||
description = lib.mdDoc "Base URL of the Gitea instance.";
|
||||
};
|
||||
|
||||
owner = mkOption {
|
||||
type = types.str;
|
||||
default = "malobeo";
|
||||
description = lib.mdDoc "Repository owner on the Gitea instance.";
|
||||
};
|
||||
|
||||
repo = mkOption {
|
||||
type = types.str;
|
||||
default = "infrastructure";
|
||||
description = lib.mdDoc "Repository name on the Gitea instance.";
|
||||
};
|
||||
|
||||
host = mkOption {
|
||||
type = types.str;
|
||||
default = "127.0.0.1";
|
||||
description = lib.mdDoc "Address the server binds to.";
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 27364;
|
||||
description = lib.mdDoc "Port the server listens on.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.gitea-translator = {
|
||||
description = "Gitea Pull Request Translator for Hydra";
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${pkgs.python3}/bin/python3 ${../../../scripts/gitea_hydra_server.py} \
|
||||
--baseurl ${cfg.baseurl} \
|
||||
--owner ${cfg.owner} \
|
||||
--repo ${cfg.repo} \
|
||||
--host ${cfg.host} \
|
||||
--port ${toString cfg.port}
|
||||
'';
|
||||
Restart = "on-failure";
|
||||
RestartSec = 5;
|
||||
|
||||
# Hardening because why not
|
||||
DynamicUser = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -58,7 +58,7 @@ in
|
||||
networkctl down wg-initrd
|
||||
'';
|
||||
serviceConfig.Type = "oneshot";
|
||||
};
|
||||
};
|
||||
};
|
||||
network = {
|
||||
flushBeforeStage2 = true;
|
||||
|
||||
@@ -41,22 +41,17 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
services.alloy = {
|
||||
services.promtail = {
|
||||
enable = cfg.enablePromtail;
|
||||
extraFlags = ["--config.format=promtail"]; #TODO please change this to native alloy config later
|
||||
configPath = import ./promtail_config.nix {
|
||||
configFile = import ./promtail_config.nix {
|
||||
lokiAddress = cfg.lokiHost;
|
||||
logNginx = cfg.logNginx;
|
||||
config = config;
|
||||
pkgs = pkgs;
|
||||
};
|
||||
};
|
||||
users.groups.promtail = {};
|
||||
users.users.promtail = {
|
||||
isNormalUser = true;
|
||||
group = "promtail";
|
||||
extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
|
||||
};
|
||||
|
||||
users.users.promtail.extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
|
||||
|
||||
};
|
||||
}
|
||||
|
||||
@@ -39,7 +39,7 @@ in
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud33;
|
||||
package = pkgs.nextcloud32;
|
||||
hostName = "cloud.malobeo.org";
|
||||
config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
|
||||
maxUploadSize = "10G";
|
||||
@@ -55,15 +55,14 @@ in
|
||||
extraApps = {
|
||||
inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
|
||||
deck = pkgs.fetchNextcloudApp {
|
||||
sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
|
||||
url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
|
||||
sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
|
||||
url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
|
||||
license = "agpl3Plus";
|
||||
};
|
||||
};
|
||||
settings = {
|
||||
trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
|
||||
trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
|
||||
overwriteprotocol = "https";
|
||||
"maintenance_window_start" = "1";
|
||||
"default_phone_region" = "DE";
|
||||
};
|
||||
|
||||
@@ -37,7 +37,6 @@ in
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings = {
|
||||
security.secret_key = "SW2YcwTIb9zpOOhoPsMm";
|
||||
server = {
|
||||
domain = "grafana.malobeo.org";
|
||||
http_port = 2342;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, self, lib, pkgs, inputs, ... }:
|
||||
{ config, self, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -58,7 +58,6 @@ in
|
||||
|
||||
services.pretalx = {
|
||||
enable = true;
|
||||
package = inputs.nixpkgs-unstable.legacyPackages."x86_64-linux".pretalx;
|
||||
celery.extraArgs = [
|
||||
"--concurrency=${toString config.microvm.vcpu}"
|
||||
];
|
||||
|
||||
@@ -4,7 +4,6 @@
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxgcjNOYbza3+RfANFDXy7HXNRFlkpDOAcGyB7MKshiVlbPByWRSjfZa0BeRNjpeCd8QkIodKUzqYOCOrc8ad3kiNbdLRcDz57A5xSLD3ynakoWJo0AmJjT3Ta1JJj8inNwwykR0ig5//SrtsZb9HkWJDAF017MokM2r8AWPE1QzcQdh93kojXcgTHrJHzEqgKbEGDEk37f1RvZG4umEFeqdK2FvS5isPa7P9X7hyyoDC8bvEy7xfaDrToJAoXon6r79taxH8UWIvy//xsU0NBLYK2eE4RQe2AjF6Ri+CybI6y1SsHOvyh4nNKWlfUOEL6UnIulRn/LXFOKCJi7xuoTeJXS0+w1DNEuiGosVNXPSKbUm/eDBVnb8Iyep9wmygSZayN82xL5lRlG3Mn45ttecqfm2SJkmduBA5qXcTdDPe/lXTZaVO9tbiIcJfUgd3ttEu2+6YjLn74D965PlovzvR6EhbVUZ8IkOAt4VmuTkXIdm8SCS7jzhsiKeUXoZ4rfa375zi79SIPuIkoMasj6d16wcYOeFIUIMFFccfQ9jQjr9NTSXC2dd7sfbI9I9mF7eRQSsUdSwpP8WH1b+M1MxTbdhEUdPwpOLviTTIuk8E8K8DQDZIcOOh38mCDpyoh02nwfRxlyoYVsKAHIQH02dHTvYEa3/pMsRwGc9W1Ow== kalipso@desktop"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQg6a2EGmq+i9lfwU+SRMQ8MGN3is3VS6janzl9qOHo quaseb67@hzdr.de"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDi8yxrMZoXEy7e8/MZeyihOARU2tN0TpJTUX55UO31B atlan@argon"
|
||||
];
|
||||
backup = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIGryhnXdmbGObONG88K+c9zeduMrwtoLHwzMDZg3UXB+Cnq2FXWOrlLZxA+95VUgHpyGZiykJmzeWrKhldDlDeGGd8QCCLeuliiOgXADTYjWaVfhd+6arPZrK2VtqqsguvH40gW1xfoGAOmAT4WFnxWxIaEip0V2u6NOoKTiH9I3bz2Qe4lfJvPXig+XwCXcukXd6XUkDFYDpiw8XNV3X7pqTus5d2RYR97bAhIYZZQ6h50ZpTY8N0lFh4RY5yfx8BhxJW3tfoi9uZvVuPx7dGPsZsSniENFPMNz3UwHGitTJMr4088cJrAGgd5lyFuLouiHiM2JMGA0wx9wWTbWJEwTLaTVQK9gSJf857ndV2zCh9vKlfko4w9bQgqxKg4U/mY8dXX1E7D51nD2ci8Ed+ZG+NEneFLyZhLsD82GkBY+YovA+4xm/pcx+hBhlyqGNxI8v+Jh+JhEyD/ZLgJfq3ZMbGIGsTiDwZ2flLLxImHHEoDoT6PHU6hDhPDJu560="
|
||||
|
||||
@@ -118,7 +118,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
|
||||
users.imports = [ ./machines/modules/malobeo/users.nix ];
|
||||
backup.imports = [ ./machines/modules/malobeo/backup.nix ];
|
||||
printing.imports = [ ./machines/modules/malobeo/printing.nix ];
|
||||
gitea-translator.imports = [ ./machines/modules/malobeo/gitea_translator.nix ];
|
||||
};
|
||||
|
||||
hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (
|
||||
|
||||
@@ -1,107 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
#imports
|
||||
import os
|
||||
import json
|
||||
import argparse
|
||||
from http.server import BaseHTTPRequestHandler, HTTPServer
|
||||
import urllib.request
|
||||
|
||||
def _get_api_response(baseurl, owner, repo):
|
||||
###https://docs.gitea.com/api/1.21/#tag/repository/operation/repoListPullRequests
|
||||
###GET /api/v1/repos/{owner}/{repo}/pulls
|
||||
url=(f"https://{baseurl}/api/v1/repos/{owner}/{repo}/pulls?state=open")
|
||||
headers={"Accept": "application/json"}
|
||||
req=urllib.request.Request(url, headers=headers)
|
||||
with urllib.request.urlopen(req) as resp:
|
||||
return json.loads(resp.read().decode("utf-8"))
|
||||
|
||||
def _parse_response(baseurl, owner, repo):
|
||||
target_repo_url=f"https://{baseurl}/{owner}/{repo}.git"
|
||||
pulls: dict={}
|
||||
response=_get_api_response(baseurl, owner, repo)
|
||||
for pr in response:
|
||||
pr["target_repo_url"]=target_repo_url
|
||||
pulls[str(pr["number"])]=pr
|
||||
return pulls
|
||||
|
||||
class PullsHandler(BaseHTTPRequestHandler):
|
||||
_VALID_PATHS={"/", "/gitea-pulls-sorted.json"}
|
||||
|
||||
# Class variables to store configuration
|
||||
baseurl = None
|
||||
owner = None
|
||||
repo = None
|
||||
|
||||
def do_GET(self):
|
||||
if self.path not in self._VALID_PATHS:
|
||||
self.send_error(404, "Not Found")
|
||||
return
|
||||
|
||||
answer=dict(_parse_response(self.baseurl, self.owner, self.repo))
|
||||
|
||||
body=json.dumps(answer, indent=2, sort_keys=True).encode("utf-8")
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/json; charset=utf-8")
|
||||
self.send_header("Content-Length", str(len(body)))
|
||||
self.end_headers()
|
||||
self.wfile.write(body)
|
||||
|
||||
def log_message(self, fmt, *args):
|
||||
print(
|
||||
f"[gitea-translator] {self.address_string()} - {fmt % args}",
|
||||
flush=True,
|
||||
)
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Hydra Server to Gitea-pull-request translator"
|
||||
)
|
||||
parser.add_argument(
|
||||
"--baseurl",
|
||||
default="git.dynamicdiscord.de",
|
||||
help="Base URL of Gitea instance (default: git.dynamicdiscord.de)"
|
||||
)
|
||||
parser.add_argument(
|
||||
"--owner",
|
||||
default="malobeo",
|
||||
help="Repository owner (default: malobeo)"
|
||||
)
|
||||
parser.add_argument(
|
||||
"--repo",
|
||||
default="infrastructure",
|
||||
help="Repository name (default: infrastructure)"
|
||||
)
|
||||
parser.add_argument(
|
||||
"--host",
|
||||
default="127.0.0.1",
|
||||
help="Host to bind to (default: 127.0.0.1)"
|
||||
)
|
||||
parser.add_argument(
|
||||
"--port",
|
||||
type=int,
|
||||
default=27364,
|
||||
help="Port to bind to (default: 27364)"
|
||||
)
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
# Set class variables so they're accessible in request handlers
|
||||
PullsHandler.baseurl = args.baseurl
|
||||
PullsHandler.owner = args.owner
|
||||
PullsHandler.repo = args.repo
|
||||
|
||||
print(
|
||||
f"[gitea-translator] Starting, pulling from {args.baseurl}/{args.owner}/{args.repo}",
|
||||
flush=True,
|
||||
)
|
||||
server=HTTPServer((args.host, args.port), PullsHandler)
|
||||
print(
|
||||
f"[gitea-translator] online @ {args.host}:{args.port}",
|
||||
flush=True,
|
||||
)
|
||||
server.serve_forever()
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user