Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 ahtlon
|
82e247747e | ||
|
ahtlon
|
a7cac53590 | ||
 malobot
|
918dea0d14 |
@@ -7,13 +7,13 @@ on:
|
||||
- synchronize
|
||||
paths:
|
||||
- '**.nix'
|
||||
- 'flake.lock'
|
||||
- flake.lock
|
||||
push:
|
||||
branches:
|
||||
- 'master'
|
||||
- master
|
||||
paths:
|
||||
- '**.nix'
|
||||
- 'flake.lock'
|
||||
- flake.lock
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
@@ -60,4 +60,4 @@ jobs:
|
||||
timeout-minutes: 200
|
||||
run: |
|
||||
echo "Running now @ master"
|
||||
nix run nixpkgs#hydra-cli -- -H https://hydra.malobeo.org jobset-wait malobeo master
|
||||
nix run nixpkgs#hydra-cli -- -H https://hydra.malobeo.org jobset-wait malobeo master
|
||||
@@ -1,5 +1,5 @@
|
||||
# Disks
|
||||
The disks module can be used by importing `inputs.malobeo.nixosModules.malobeo.disko`
|
||||
The disks module can be used by importing `inputs.self.nixosModules.malobeo.disko`
|
||||
|
||||
|
||||
#### `let cfg = malobeo.disks`
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# Gitea-tanslator
|
||||
The module can be used by importing `inputs.malobeo.nixosModules.malobeo.gitea-translator`
|
||||
The module can be used by importing `inputs.self.nixosModules.malobeo.gitea-translator`
|
||||
|
||||
This module starts a python server that fetches the gitea pull request api and translates it to a file that hydra understands.
|
||||
To use, just set the parameters of the gitea server, then send a GET request to either `http://${host}:${port}/` or `http://${host}:${port}/gitea-pulls-sorted.json`
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# Initrd-ssh
|
||||
The initssh module can be used by importing `inputs.malobeo.nixosModules.malobeo.initssh`
|
||||
The initssh module can be used by importing `inputs.self.nixosModules.malobeo.initssh`
|
||||
|
||||
#### `let cfg = malobeo.initssh`
|
||||
|
||||
@@ -26,4 +26,4 @@ Run ` lspci -k | grep -iA4 ethernet `
|
||||
` [ ] `
|
||||
|
||||
*Example:*
|
||||
`[ "r8169" ]`
|
||||
`[ "r8169" ]`
|
||||
Generated
+4
-4
@@ -469,11 +469,11 @@
|
||||
"utils": "utils_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789131197,
|
||||
"narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
|
||||
"lastModified": 1768820076,
|
||||
"narHash": "sha256-0vnIYuWvsYasbHZHUjAcK9FR0kxkRRtzYG661VEtoPU=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
|
||||
"revCount": 161,
|
||||
"rev": "cfdfae84bb045ae429f0760eba708468871b1738",
|
||||
"revCount": 159,
|
||||
"type": "git",
|
||||
"url": "https://git.dynamicdiscord.de/kalipso/zineshop"
|
||||
},
|
||||
|
||||
@@ -17,7 +17,6 @@ keys:
|
||||
- &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
|
||||
- &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
|
||||
- &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
|
||||
- &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
|
||||
#this dummy key is used for testing.
|
||||
- &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||
creation_rules:
|
||||
@@ -124,14 +123,6 @@ creation_rules:
|
||||
age:
|
||||
- *admin_atlan
|
||||
- *machine_albert
|
||||
- path_regex: ns1/secrets.yaml$
|
||||
key_groups:
|
||||
- pgp:
|
||||
- *admin_kalipso
|
||||
- *admin_kalipso_dsktp
|
||||
age:
|
||||
- *machine_ns1
|
||||
- *admin_atlan
|
||||
- path_regex: .*/secrets/.*
|
||||
key_groups:
|
||||
- pgp:
|
||||
|
||||
@@ -15,20 +15,18 @@ in
|
||||
sops.secrets.wg_private = {};
|
||||
|
||||
imports =
|
||||
[
|
||||
inputs.malobeo.nixosModules.malobeo.vpn
|
||||
inputs.malobeo.nixosModules.malobeo.initssh
|
||||
inputs.malobeo.nixosModules.malobeo.disko
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
inputs.malobeo.nixosModules.malobeo.backup
|
||||
|
||||
[ # Include the results of the hardware scan.
|
||||
#./hardware-configuration.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
inputs.self.nixosModules.malobeo.vpn
|
||||
inputs.self.nixosModules.malobeo.initssh
|
||||
inputs.self.nixosModules.malobeo.disko
|
||||
inputs.self.nixosModules.malobeo.metrics
|
||||
inputs.self.nixosModules.malobeo.users
|
||||
inputs.self.nixosModules.malobeo.backup
|
||||
./hydra.nix
|
||||
./gitea_runner.nix
|
||||
];
|
||||
|
||||
virtualisation.vmVariantWithDisko = {
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
wg_private: ENC[AES256_GCM,data:yHkjJjW/I/5mFJuMQR0XpoMqPDt9b/ZZRmLiqJjug31p5aV6AC7Pk7bhNN8=,iv:OjRVJCCO0WTUSd6w5oeZbEeilcffJQOOrudIkss9VaE=,tag:t5N0tNjrfM8/pKbJMMDEig==,type:str]
|
||||
gitea_token: ENC[AES256_GCM,data:+zHmfVfdheo4KzOBjDr8WNcJh78ReZ7CWiiG9fAcXpQw21yWb4/jq3RqqIenB2p1EEtF0OlSUr3lu478gEBmxlilBCpEaEzNJKfOFL77P66OYLo7RJkp3TE0sILDCaVwGDkCWQKd05zqJzbb5opHE5B0NUf9dOgs8CuYZPelrTzGsTfWjdZWxweSrOcFtsGLJcR0hLd9obAuqOxi2vID2YY/uIguGEhZYHshTlZSzMTg+8k2UCe/x+LOitCkLqFJfS5b+1HJpD6R1dKsVKtSjXtzLHzfIMy28xYvqgIju0JtUA==,iv:Kah6BYvKCe06/yHBICp2YOdJfSqktNrZl5kKYgs/AY0=,tag:3B+g6zqW7vcT1t/wfmYfUg==,type:str]
|
||||
cache_priv: ENC[AES256_GCM,data:CpxYGSSdSZoULqH/AJdaYWiuAgI8Spuf/lod8x5bFEnFB2KlRFp7vBjwwRzxykurbezP2/c938NL2WxI+sDw7UV6LAG+E5KmYxXQpOJZgIPx3YcEidyp5HWq628lf1k=,iv:t7BFA4IM6eFl+Uuq7k7OR26+wHVKbvWi+yV0xg2xFGs=,tag:9hpxyjEUnbOz1NFc2JctEA==,type:str]
|
||||
gitea_runner_token: ENC[AES256_GCM,data:wUHExAD2tf1bKc3W3GXHcPg6WS8OqQK7efcR4SBMSQnSIo/E32lo9w==,iv:P9JouWGa8c4NNTua2OhqJzjjj37mLmkYmJ+c4mogH20=,tag:dLR06+PBBl1SodaLH7ElqQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMRnE5OFQwdlV1bTJwdmZ0
|
||||
Q2pLVGcyOXlILy9selVYeERGcFFyenRrcVRVClNaMWRPNllHS0ZEYlkvaUp2di9N
|
||||
cDNuY2syKzZ5WTlKTndXQnMyQkp2RGsKLS0tIEVGYVcxUTU1NVhFZnBsR1Z3RDNH
|
||||
RTJscHI0SmtUTzA3R3JkYTBZRUxlL3MKzEajq1IEBOjiF431vtkqnT3VWC2D+vGW
|
||||
C5dTc/stQ0PXvfuTlRTKKTBlaSdnwBu/pKQ5/QtqwKee2Z3nxySziQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaVNOSHZvSmJ0ZFhSVVhs
|
||||
Z3ZvTU9jRytLaUJwd3VCZ0NJb3NGRzE1MVFvCnRYaTI2MHJRZnhhZjBmZkdqMTQ3
|
||||
Rkh2WDVoUHZCY0Z2YlFlakVKTzUxUm8KLS0tIENjVXlxcWRjRXVjVFBNMVJSeTNs
|
||||
YXU5TEpNeE9oMTZpbW10ekU3Z09EbEEKYr5TMIs9KmrHZqhhc6GZx6tM78XOXYAq
|
||||
PffqNVDxsFbxAUK7dd5WPw++dE4W1gwRxI+sSPQ2H8ZvjqB8ff3TYw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
lastmodified: "2026-09-11T11:23:55Z"
|
||||
mac: ENC[AES256_GCM,data:swEaZC/CLOdrjDSEYsaWBnl7cew01eUraa4ORkJljlqKusr0BdYFozjR3Rxc66JWRChc4bP0ckeDhU6AOiXk4k4zL8CJ3S4eY3111z36xjZXY9LXxMVn0oTx+3SrD6pOttTxZUkcdogRsi/jOsMPoTgSQN5OwvV8RTLF5waxU4I=,iv:ISZk4qsmmy4RYy1cxjpE/vbcCp6UoArtOqzd1ePYL0c=,tag:N68qZyHsiOFkfNM7e+t2zQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-11T11:23:21Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQGMA5HdvEwzh/H7AQv8D1hDUkuvip430Qe/djdEP6N26XQkqcZVfuzdhgQOwdTC
|
||||
N1ou9MPJ0D0gIk72uYExHGDTwhvOEBTMuDk+te9foffcj6MHzUUpqI+TKsjV/PeY
|
||||
Xpj9YGNjmGI7hz0ERyALMDpfFbkLPIDP3LwbxM+UFpe0weGoxfROVFWlFnXi6Rrg
|
||||
MoFgDOUD9Ku7v9dkMkMcmoZULAozf5fcVMFe1mpByEh9LuATQRkuAO7Uf6nH46Qa
|
||||
n7rMm04CNdBtmVSEPsU3CZ4C9+kyOzH1xwynb6MVDnY3j6sUGr3Seu7nCfMPDjmU
|
||||
l2wcv4THJbUU+0gM9+Y3zSZlRYa0xe05D8CfpASnZ4FamFZOwuAJAgiKc8y3DEp6
|
||||
kQMK76ncZQLhOIS//1tXkD3iIeLgr6D7VCjP23IaOV/7cakmqL7mbCdA6es9tXBm
|
||||
7Hy0p7xkSVpJrxiV3NbiN84MILxpJey/usq9VEBUf3oRtVBHt3uxVnL33Txc7PRg
|
||||
JimkwsrGi9JV1YiF3Y1Q0lgBxOYufbPdYJ9n5Ki/unD1AJI/WBm/ii2Kt5RY0L2X
|
||||
JY3AguNG29wBBWJg4hyCq7fisI88TBJh6syUb91UHHMloOVe1Pk3Bb7oMWMgLl0g
|
||||
YLU07kt67eaX
|
||||
=xifQ
|
||||
-----END PGP MESSAGE-----
|
||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
||||
- created_at: "2026-09-11T11:23:21Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA98TrrsQEbXUARAApu96xR6Fy6Y0dAHzM9CjnFuSFLlUbU0yRWksHCFoo6XS
|
||||
acRWL0pVlwCWt3sR+tjpd1tEvQZFspqq+UhDLlaz+qS2dpI0IkjNEbD/0uTTcqkn
|
||||
0wlKcvDdRGv5Mb2wjFp5Q0VBIDC2nRbK579IghaEIoRRN9j2VfksracmfrvEpuuL
|
||||
5rF4Uvpzc5VLQyf9hy53j9MXuiTfWv4xEPC3zfcbxeOKaXPKEVkc0e8QyNPes3Q2
|
||||
AefQBd+QRBSCDc9P6V5Xb2r+K52k6zWxpoeR1oyJbAv5c4NKWtKtdackIyPoLF4N
|
||||
9TtcidG2OTtuIqIAmSix23KVBgJB0nESSuUhy4f0YUUnGNWpu4TDGzB9BNmiob9K
|
||||
0fO/awGV87kYKPcjdj/XLgVB+zZ/5T7b3dL6tl4lpwMf69qzq0Io/CffnYpTItGJ
|
||||
A/3G0rokjmicGSme5nNkZKXXwxNidaxvSOLXd+yAmInMcXacvO2WuA1CmCnU4Px/
|
||||
igA19i1GDc9OS1qGhIdrG14iUf1820DACdsPlg3jFEys7dpkGDIOiMAqo66OhX9Q
|
||||
gYN4Dz2PaPSrTJl0rkBds1qiGI4TN6AKQlLlwkowx465lX8UsjvaYT4z7d2JWYN2
|
||||
VHMaeEBZvO688oFYA/wn/b+OHUkRIkL1oIeU2G5Pw9m5wQbgd8DMgvYZKe3rzrbS
|
||||
WAGKWwzwHc4BjBzL1PxcwMchMfiZJ0Ltel5dcXHkHi7VV+O7dIQiseZwfHBbGyIa
|
||||
uXogIDlqULSiRxw9oht3hVDS90uW2riMEoDcr47hh1oFaGBHoY7/kf8=
|
||||
=+ckT
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.1
|
||||
@@ -1,31 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
mkRunner = runnerName: {
|
||||
enable = true;
|
||||
name = runnerName;
|
||||
url = "https://git.dynamicdiscord.de/";
|
||||
tokenFile = config.sops.secrets.gitea_runner_token.path;
|
||||
labels = [
|
||||
"ubuntu-latest:docker://node:latest"
|
||||
];
|
||||
|
||||
settings = {
|
||||
runner = {
|
||||
devices = [ "/dev/kvm" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
sops.secrets.gitea_runner_token = {};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
users.users.admin.extraGroups = [ "docker" ];
|
||||
|
||||
services.gitea-actions-runner.instances = {
|
||||
albert01 = mkRunner "albert01";
|
||||
albert02 = mkRunner "albert02";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
|
||||
imports =
|
||||
[
|
||||
inputs.malobeo.nixosModules.malobeo.gitea-translator
|
||||
inputs.self.nixosModules.malobeo.gitea-translator
|
||||
];
|
||||
|
||||
services.malobeo.gitea-translator = {
|
||||
@@ -35,17 +35,9 @@
|
||||
Include ${config.sops.secrets.gitea_token.path}
|
||||
using_frontend_proxy 1
|
||||
base_uri hydra.malobeo.org
|
||||
<hydra_notify>
|
||||
<prometheus>
|
||||
listen_address = 0.0.0.0
|
||||
port = 9199
|
||||
</prometheus>
|
||||
</hydra_notify>
|
||||
queue_runner_metrics_address = 0.0.0.0:9198
|
||||
'';
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 9199 9198 ];
|
||||
|
||||
|
||||
systemd.services.hydra-manual-setup = {
|
||||
description = "Create Admin User for Hydra";
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
wg_private: ENC[AES256_GCM,data:rSENHGEat9wre1bFcM3LYnlGjf9gmcE9FmeCySzbGZ4SCCUl5QLQN/quXw0=,iv:Bdwlk5UHSiyA9gSW91LUPJyBG50FG/hpwyClzTOUoUI=,tag:/Jw549R5Qmg4WblL7rUE8w==,type:str]
|
||||
gitea_token: ENC[AES256_GCM,data:1LevtPr5awIu2rcCGbLIsQA5QO0AhFk5Rep7RG28QdlFHDADCaEoS18pEEZ9NMYMZaGWIBA8Zq/NsCYxQGzuWh3TESZW7CO5kzCaSVG1aqjGpjfbeyG+xQEDtab2Owh+TVN/wVGUUDR1NBlWqE4Shw7mO228CWbxQRSQo3lsLhmf69fLEV1DDnH0Xt7Ml8tr7yLIeWHlG0BeOMKSkY17APahxqBx547Zw+kgaUW3WgTyxeWZaDjk/prK6bYV2euK4Il/4vTZE/x0mThmTThjszcAvdaon+V8y1Ax34gTyAgjvpFC2kE=,iv:1A8YNv/A0MEkGKV5Z9WPI4LwQFu2Z9BWuN2yfFHCPLI=,tag:hEfskDEAQiriXNjcYzziSg==,type:str]
|
||||
cache_priv: ENC[AES256_GCM,data:NbfyBv68UCWuSjbUu5lFUXPgG+vYrxbAQeD77YlklTRm6MVS4lAEjUzjnjewcX6Khca1N7r7vGieFyaBlQm0264KGTP5tc7BnEIKJDOD/UHQBdMpZgUzd2cKQWK7Kx0=,iv:6VWsZd/VDjQ/BhfwHZBcL3Zp0W/9sO/ZC9sF1Jnqguo=,tag:/gSe6TyaZDKoRFaRKiYyzw==,type:str]
|
||||
gitea_runner_token: ENC[AES256_GCM,data:7pVUx9TI/WbCWg2aI/k/fngtWZtffUCMsRfyJn2AQW6VOXknWMeXIKc07MDnbjjc,iv:isSUZ1yq3j/gIzqoCLGpmPIay5L5gYkOBW08K1rGvuA=,tag:uOkrUB6If/gQ5680A0VTxQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
@@ -22,8 +21,8 @@ sops:
|
||||
N6DSIVisJf7qNuNw6M0J5nny6xfWeIEZJettF0xSHM1gSfr7oUbHOQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
|
||||
lastmodified: "2026-09-11T18:12:32Z"
|
||||
mac: ENC[AES256_GCM,data:4uH4hVrc3ISolaYHZb0NK65Rx6wQf+P6bpbcYCPHbn3N9vkbkqBSKePsxGgKaNQQhAHwkLMdxRIcwtERjMsAngL5IZrO3riI91MZxRoFadbklJbJ4HSpQ240PT5vrpkpVb68KqCeVdoKRcR2MqH30H8UDCCvpZhdSNSl8ceQCss=,iv:5FnwnOb1dBSRCs4/5WONIYPji/+2WVtgFboTfybGZ/U=,tag:QWKWjN8ljeloS7UJM4LiKg==,type:str]
|
||||
lastmodified: "2026-08-26T17:31:59Z"
|
||||
mac: ENC[AES256_GCM,data:G0Xpe7zJZh4xAwFRUXSbR11ENqRd4UoU7gFK3nDM7Icm9DMyqyi3uBfg1j0c8yTCInIrnyX1dy7zUWjns+OAbXv8CMLXVUPdomgCxX0zUWEkTzgQqnJy97KFAmPPPMCGTUby3TMVQkcrk5/iATmydSMhs0lKErS4737u9jen/3I=,iv:YB3BqypuvamDJy64FeaSUQBCAdlr7a9UWJDNhGsTRvo=,tag:lXc7heG+MRiUo+SfRcRDNg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-08-20T15:43:21Z"
|
||||
enc: |-
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ self, config, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -8,8 +8,8 @@ let
|
||||
src = pkgs.fetchgit {
|
||||
url = "https://0xacab.org/AND/antamap.git";
|
||||
branchName = "master";
|
||||
rev = "ec584c0c4bd4ddd9ff8353bf8a926bd94526d304";
|
||||
sha256 = "sha256-o5alTWBZIaUJiwYE0/gkGlxH+v1BxaGauxHDb6gK3+I=";
|
||||
rev = "f07f4522e8658ee5dc113ea3feffb67418e5f403";
|
||||
sha256 = "sha256-ODEey7PwoBAwVxcQm02Q8/a42UxzOcQB2Dqr3FYxqyo=";
|
||||
};
|
||||
|
||||
installPhase = "mkdir -p $out; cp -R * $out/";
|
||||
@@ -22,8 +22,7 @@ in
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
self.nixosModules.malobeo.users
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
|
||||
@@ -6,14 +6,13 @@ in
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
inputs.malobeo.nixosModules.malobeo.disko
|
||||
inputs.malobeo.nixosModules.malobeo.initssh
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
#./hardware-configuration.nix
|
||||
../modules/xserver.nix
|
||||
../modules/sshd.nix
|
||||
../modules/autoupdate.nix
|
||||
inputs.self.nixosModules.malobeo.disko
|
||||
inputs.self.nixosModules.malobeo.initssh
|
||||
inputs.self.nixosModules.malobeo.users
|
||||
];
|
||||
|
||||
malobeo.autoUpdate = {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ config, self, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -17,19 +17,14 @@ with lib;
|
||||
];
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
self.nixosModules.malobeo.metrics
|
||||
inputs.tasklist.nixosModules.malobeo-tasklist
|
||||
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
malobeo.metrics = {
|
||||
enable = true;
|
||||
enablePromtail = true;
|
||||
|
||||
@@ -11,19 +11,18 @@ in
|
||||
sops.secrets.njala_api_key = {};
|
||||
|
||||
imports =
|
||||
[
|
||||
inputs.malobeo.nixosModules.malobeo.vpn
|
||||
inputs.malobeo.nixosModules.malobeo.initssh
|
||||
inputs.malobeo.nixosModules.malobeo.disko
|
||||
inputs.malobeo.nixosModules.malobeo.microvm
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
inputs.malobeo.nixosModules.malobeo.backup
|
||||
|
||||
[ # Include the results of the hardware scan.
|
||||
#./hardware-configuration.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
inputs.self.nixosModules.malobeo.vpn
|
||||
inputs.self.nixosModules.malobeo.initssh
|
||||
inputs.self.nixosModules.malobeo.disko
|
||||
inputs.self.nixosModules.malobeo.microvm
|
||||
inputs.self.nixosModules.malobeo.metrics
|
||||
inputs.self.nixosModules.malobeo.users
|
||||
inputs.self.nixosModules.malobeo.backup
|
||||
./dyndns.nix
|
||||
];
|
||||
|
||||
@@ -148,8 +147,6 @@ in
|
||||
"vaultwarden"
|
||||
"pretalx"
|
||||
"antamap"
|
||||
"ns1"
|
||||
"wordpress"
|
||||
];
|
||||
|
||||
networking = {
|
||||
@@ -193,7 +190,7 @@ in
|
||||
proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
|
||||
client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
|
||||
client_body_timeout 3600s;
|
||||
send_timeout 3600s;
|
||||
fastcgi_buffers 64 4K;
|
||||
@@ -208,7 +205,7 @@ in
|
||||
proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
|
||||
client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
|
||||
client_body_timeout 3600s;
|
||||
send_timeout 3600s;
|
||||
fastcgi_buffers 64 4K;
|
||||
@@ -315,23 +312,6 @@ in
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts."rm16bleibt.org" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts."cache.malobeo.org" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
||||
@@ -8,11 +8,9 @@
|
||||
KEYCLOUD=$(cat /run/secrets/njalacloud)
|
||||
KEYZINES=$(cat /run/secrets/njalazines)
|
||||
KEYANATAMAP=$(cat /run/secrets/njalaantamap)
|
||||
KEYRM16=$(cat /run/secrets/njalarm16)
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
|
||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=rm16bleibt.org&k="$KEYRM16"&auto"
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
|
||||
@@ -4,7 +4,6 @@ shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYX
|
||||
njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
|
||||
njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
|
||||
njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
|
||||
njalarm16: ENC[AES256_GCM,data:Uo/TBNgyvH7EGSJb7ZQUBw==,iv:YDGjr9w9YceiDGJAtNIAPltxaR5pfpEYswu33WtAiQQ=,tag:PtlbcggOHgb1vIb7KBV0hg==,type:str]
|
||||
njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
|
||||
sops:
|
||||
age:
|
||||
@@ -26,8 +25,8 @@ sops:
|
||||
SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
lastmodified: "2026-09-14T12:42:34Z"
|
||||
mac: ENC[AES256_GCM,data:cOv94thIsHzpsiYnJAP2R/RZIkkdr+NHQuO5jCMxWssFu5WcWzeXC9mbYe0RAhY0Hx+tUHJsEG5SQqRaudpbGH9aYLC+5jkVaURXSYd5FIv+I8aUrBsZtpVrE7NJwo+S3+PAgpOUCO4w0bBFsmAWvgpEQSWIcndnkZvvwF2GtrU=,iv:pupuBdJsZTLY246yanDPdgDlRm2oOZprERy3uNdY7E4=,tag:9c1IAKpXBb2KhI1N6M7hOA==,type:str]
|
||||
lastmodified: "2026-08-28T12:19:14Z"
|
||||
mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-02-11T18:32:49Z"
|
||||
enc: |-
|
||||
|
||||
+1
-6
@@ -133,12 +133,7 @@ in
|
||||
network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
|
||||
};
|
||||
|
||||
wordpress = {
|
||||
type = "microvm";
|
||||
network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
|
||||
};
|
||||
|
||||
# last host id: 21
|
||||
# last host id: 20
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ self, config, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -10,17 +10,11 @@ with lib;
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
../durruti/documentation.nix
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
malobeo.metrics = {
|
||||
enable = true;
|
||||
enablePromtail = true;
|
||||
|
||||
@@ -3,14 +3,13 @@
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
inputs.malobeo.nixosModules.malobeo.printing
|
||||
|
||||
./hardware-configuration.nix
|
||||
../modules/xserver.nix
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
inputs.self.nixosModules.malobeo.printing
|
||||
];
|
||||
|
||||
malobeo.autoUpdate = {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, inputs, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
sshKeys = import ../ssh_keys.nix;
|
||||
@@ -6,16 +6,10 @@ in
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
./hardware_configuration.nix
|
||||
../modules/malobeo_user.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
sops.secrets.njala_api_key = {};
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ rec {
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
|
||||
"albert:+eSv8F63uj94A0fvmdyPcDDH0qI3CYR91fsbA/eLFGw="
|
||||
"cache.malobeo.org:+eSv8F63uj94A0fvmdyPcDDH0qI3CYR91fsbA/eLFGw="
|
||||
];
|
||||
trusted-users = [ "root" "@wheel" ];
|
||||
};
|
||||
|
||||
@@ -65,11 +65,4 @@
|
||||
allowedIPs = [ "10.100.0.20/32" ];
|
||||
publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
|
||||
};
|
||||
|
||||
"ns1" = {
|
||||
role = "client";
|
||||
address = "10.100.0.21";
|
||||
allowedIPs = [ "10.100.0.21/32" ];
|
||||
publicKey = "jozMsP5MA2uz7eOrXG8LB8mr2tHVa6FL1+tbMQs9ySk=";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{config, lib, pkgs, inputs, ...}:
|
||||
let
|
||||
cfg = config.malobeo.users;
|
||||
sshKeys = import ( inputs.malobeo + /machines/ssh_keys.nix);
|
||||
sshKeys = import ( inputs.self + /machines/ssh_keys.nix);
|
||||
inherit (config.networking) hostName;
|
||||
in
|
||||
{
|
||||
|
||||
@@ -72,7 +72,6 @@ in
|
||||
mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
|
||||
address = [ "${myPeer.address}/24" ];
|
||||
autostart = cfg.autostart;
|
||||
#dns = [peers.ns1.address "1.1.1.1"]; #currently broken, see commit message
|
||||
listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
|
||||
|
||||
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ config, self, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -20,19 +20,13 @@ in
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
self.nixosModules.malobeo.metrics
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
malobeo.metrics = {
|
||||
enable = true;
|
||||
enablePromtail = true;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, inputs, pkgs, ... }:
|
||||
{ config, self, lib, inputs, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with inputs;
|
||||
@@ -13,33 +13,18 @@ in
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
inputs.malobeo.nixosModules.malobeo.vpn
|
||||
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 ];
|
||||
};
|
||||
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
sops.secrets.wg_private = {};
|
||||
services.malobeo.vpn = {
|
||||
enable = true;
|
||||
name = "ns1";
|
||||
privateKeyFile = config.sops.secrets.wg_private.path;
|
||||
};
|
||||
|
||||
services.bind = {
|
||||
enable = true;
|
||||
forwarders = [
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
wg_private: ENC[AES256_GCM,data:KnlCYE1/WjhNLfazuKViiVKZLPqQHwwqX1o2Irxaoj6oa54s6vBoiHVste4=,iv:ZAqdUSGwzbrLjskAntzmcNCcIjyePG+awYRkSgi6tZg=,tag:vllLI+0dbuFlkcdaYsBqYQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSDdNMUxFRGROR2YwN0Vn
|
||||
SjlqVXV5SmVwOXdWcmgrOUswNnB6YitYeTJvClcrVk53d1FBUndSQWgxRVVySnFl
|
||||
bVp4R3hHWmtGQW9lWER4L0tmTzdjc00KLS0tIFJRUHlMMGlvOVplTGNGNUo3NWNw
|
||||
azVxT1hPUUZ4Wmc4QjNGcEtUcDFqd1kKZU2LEJsStdOspRE1CmbXevkQDfPHTuWp
|
||||
k4AOM/W2T1Jz70pPl4M+Xg8oCJ5TNaURnvCxuiaBgAtQuZC7OR/Pnw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMlE1bGVyWkdOOHdja1pM
|
||||
OUhRU2VCVDhEZ3kxVDRzb0Z4YUxOeFZFTVdJCjlWd2NlUmcwU3dQb1pMT2U0a1ZO
|
||||
Zk5HNVJtQWREMWpXVG9ZVkd2QkVjeVkKLS0tIHBXbDUrcjl5VXNXT3JPTThIYVFa
|
||||
TEtTb1pNUjVUM3dBVFRJMUpnNng2bEkKBfxqOkJ4R4RMl4AYMmFXq0dYeiH8UuwB
|
||||
1ozr78TT5ksdRHuYmOyJzAG3Q14tK/+h1tcSmh5bXIZtuzJzZKN4kw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
lastmodified: "2026-09-10T15:02:33Z"
|
||||
mac: ENC[AES256_GCM,data:e03qvt+6PI5FsKtV4aK1XhX1RCzzsvAf42/NOau5kEa0pRaSM+ajTJSD+06oC35gBYwB3w9Hq1ubFZVvZM3vgqITSNzCNJr7ft6LI48Srq0VjtKoGmjKqETYTTSNhbisNCI+sU13pdV18BESHE5eIGY/0KHcSeF1vG7Ys2DMTwM=,iv:cmfCkTMj5+NxWgBIthg2MaG39CYOsZdqTOMszOiOmY0=,tag:a4ooDhkCtLZm/s1O0tNGug==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-10T15:02:19Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQGMA5HdvEwzh/H7AQv/Wz+3/F+/IPsaVUZbJ6GB8V5HkowP7KCzWJOxwY3B3Yhl
|
||||
H4Qir6G6aT2CpD5hHy+zEFw7s5t+MILybyzMZqNocjuQWIrF/YIYUbTDKK6rgSzC
|
||||
tx0E6DcndBf69eK2wL8Um19/boB+MTN3DQSUom6Jpvg7WGo0NjtDexAqwSpJwFFF
|
||||
di2DoUDHyTUUdHTcD+hfODTiQYC7cp51hZ6n3JACu1toGNfre1A/PtoSOTYP9i2p
|
||||
aIIWBSciT4K1RJnIhV4fpU7wh7gi0O4xS1XZnTQ/SOA26sHp8wObLvi3TwF5AKum
|
||||
dYyuCinJGMep7VBjBf7eJ73TI4CD1QM+MEQTzegPVlo54LvqSqwp8ZwHdIZi9gQ4
|
||||
3Vku2hGSOI9SmOjOR5GGEYfJS3BbbF9rJCnamBhZVVO5lXbFtZqWi0JOu8U4Esnw
|
||||
DTzLDOJpajEo7YxADD7yyLlFXDRtMNgU91hCjBLz76SgExI3avWq3Mm+KZXI4xCt
|
||||
L0yENHriidkFR2T/uV4w0lYBAPOSvPnvxK92VEa1oDrhIjcFd0JwH/XsrYq/nih6
|
||||
4PBf4U5DdO+ulJOj6MXV0QmsZXMObX8LWh6myufRTPIPl6wA5SeSvleDuiWQKYdW
|
||||
j0rqALTicw==
|
||||
=mpXh
|
||||
-----END PGP MESSAGE-----
|
||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
||||
- created_at: "2026-09-10T15:02:19Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA98TrrsQEbXUAQ/9EqodWqh61g7Uv1L/oF8PMMsONmprOg+17Xvn33xI8Pam
|
||||
SjiEaGh8qZRJckFPdWgw1QNfpzFnEjpJEYMQ46oHJxlLMd5T4eqOTHbmPC3IAktm
|
||||
lg3yYRmHEhyrngmQPTnoKuNQg6YDhzorHsfD98Tf0zA0B9AGCukgDZoEUs2oXwsY
|
||||
PiZYcTcgB8z/8petU9YlieO7frm17Srso5JfOfIlu88vtlAeu3z8LZl5iKl34Lxz
|
||||
+2TGAz/6YTYx24Tmj9qWpRYYPpbnQNUTkm+D9eDts6Pz1SFY/cerd1Q0Do8apIo7
|
||||
dO1gz0C2dhh6QvGAovH7k0fS+bH3N1qpqbzmLQfMArXytQVZg1Ucisk9VYkS9XEE
|
||||
dV0TVTOOEyq8rOzmZHfhVqGv+VsAMQXdcgsCRJ8HDLDWlDAOnuIX86NvlNmDHuZu
|
||||
9jMqCq+cmf7W0sZdamHLM/T3IXs0oJJc4YvyFAlPTPdbGHICQ1rWDLXvICIXiifg
|
||||
LzkbK0XjxG+fDCzKzMXJ/gho7KHOut/+Kf5+hQNMnoPZ3/MeDJEyAHKBEsTI/CYe
|
||||
9qla0CJnUVNRHDnc99qMeSeD7p6OLZsO4cANTSEnz0eiyZoJKa2m8du1TTtxIzCt
|
||||
Jcu1yFana7MX68ppxlqkfd7iSPyGo9d7DcPO9lFscNQ9yIPiGReZ8Ow7KSlu37LS
|
||||
VgFsGneFVfYYk6SnW9SOtooNAFNL9sWxqiWjb3fxfGeIuOF7LJqmevx7SU8V5eAt
|
||||
nCqGZZg/YCAecjTDHi8Yy5ly2LrNjF6yOhUtYifW6yBJB2UEQdDE
|
||||
=mUhm
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.1
|
||||
@@ -1,64 +0,0 @@
|
||||
wg_private: ENC[AES256_GCM,data:KjuXpIBnp/LVjOvaSk0vZEF3vOcq0y7cnEohYMFAHnnJK+TiGt3+ESkF08c=,iv:zlWkp9blv2KmIpXEOQRqle2voHIS/EhTVuWKJQ/qowY=,tag:nOUDEcwKODx8G8p7jWPA2w==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa0ticWhrdXRNa094MEoz
|
||||
ZmJiYTJoSTFHUnFpakJuc1NCTjZlN2kzazBzClRYb3B6YUozMUxFY09wdHNsK3No
|
||||
eWVBSUU2bUd5M2Z5WjVjWnpxcjFBTHcKLS0tIDBESUtRQVkzRVp5MGYwVER1aDFE
|
||||
dGl4bXlDTkhNVWM3R1Y4aDVabnYrd2cKCuLUw7SP/pyDJbmq/ADRvH7EfDVlYItW
|
||||
rU2b1KTyI4JpVK6/OLN2leSioYzqiE3ONewC9CMMrluCWwNEKmLiUg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaEV0WkI4Y2JoV0IzTlNj
|
||||
SkFGVTQ1ZG1VNzdtK0xTWFZRS0FTY1Y1MlZvCjdhYk9UWWtUWC9MNUwybVhZSzhI
|
||||
bjhydVVkK01zcmZZampEVW16L0dWRzAKLS0tIDhpK2YrTEtPYmVsUHExdnA4WHRa
|
||||
Y1JUT1VQMmdRUnl1b0NGOEFsNlR1VGcKOR35LVxYuGw8HOWwQ+ODN9y4I9FHq3lg
|
||||
1vDrSI3JBfRuU2G/OXbkV6bNPH9KnzgXxUEOWkZmamrcwtIGldfh9Q==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
lastmodified: "2026-09-10T15:02:04Z"
|
||||
mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-11T18:55:59Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQGMA5HdvEwzh/H7AQv/cD7baU+5Ujkrf5jUdn4HSPtVW/KkeW0Mw7uQmd7bI5sp
|
||||
n3iekWWTOpCv98lNdCMXn+iV1BL37ILPOYSXsjxw2vfKjGfgWkkwpFdcLUiS7Qnm
|
||||
ymGVIPyqHDJRqhxxhiR5B1aC7AhR+otkULNzKSSgYZa+Rj8DlFwW07aknJDSeZM0
|
||||
yy70RTxCGgH/4amYZN+QLOJapjGX4FMvJeG+y0vv65GinMmjkQ7B5z3rKUiKbud8
|
||||
mjPgMIfxcBo5o5vepld315atoZQX+kCIgJPU3rQshTobgwQD+uVZo/ocGHVdZWra
|
||||
eVOpKZYO4ecQJ8xRvSMNSrXRmeW/a6h7NhHN2kD74Ms1xB8cuhYklCz8gWd50yyo
|
||||
7kTG8wBPnvvkx4SSgFwvnj1hnppUweFUM64JBHXrjQWeDof1FPC18kiNTAQGwAOL
|
||||
UiI4Yka0d1zLl1vpdBN8E17jBqfi2CSLB9wL3IbD5CTYAprzzvptfXI2Ubqq82c1
|
||||
Np71LvSaBYA4SPNJ2EZB0lYBtkjGzUw8L9Kuod5UwXTeJQ2vbhpYpqHzjWrmWvK/
|
||||
VlCzVV+AYfOQUVvmbYf+DtowO/wCS8n2gVepyOoMCcEnRT9lqm7ndC/ozt+iZove
|
||||
vDcSGqKuUg==
|
||||
=oEsA
|
||||
-----END PGP MESSAGE-----
|
||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
||||
- created_at: "2026-09-11T18:55:59Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA98TrrsQEbXUAQ//fciJkmAmvlAHzZxO2CTCFkNNn+aSpkH/IoNRKfEIJDtf
|
||||
wAChdactP8yq6qKxSqv3Ks90K+hQRQr6tXpF652NDFYkP2CHsEo0wbOAgcqFzGtY
|
||||
92MenPwOKP6B9UTvm0ZqVFet7/jmQBatXMzFWsSkUCBqWXAg/UUrJVf/zbGoHwB7
|
||||
efskMTrkArlxhoY/3+/0bMeEqZJlhm9UmlAST1/xNlI4DUYhlBxnzA2vgi8QWBFT
|
||||
6+QkZ2YiM0IlDCUbe920c1ad0/McV8Bj6jccW1ZBISXk9KYQq41PBjQKhyKoC/Xc
|
||||
xJLcxy1NeUZWlPSFF05TTWaRUkBH8YZm7vum5xWdT1lz6FrHB+aNHr9XxKj5c7pp
|
||||
bLAQ2PfG0kK/kemNBKd9/Q5r2SfEUbmI+cGLbqkaZwbhD0ThMmEkMxdGwzzrf2Wq
|
||||
Lhpkj+2zx37r6GI8UlBp9jhUbhj1N9HetyjBhKzEcxqCEg4DXNiKRiXvMvCg6sCz
|
||||
kIKsmNDhbmt0jKNL8NJio10lo4+S2gPi8jg6mcj4RDkS8zC95P/EHkNZl2aQwBRU
|
||||
/GLzzpODa41ZZB9+WC68vMZudSQwHK0c7SNoEc5putlbUjKDSpJHY4manF6O4rG2
|
||||
FZNG8TA8VeEg6wjBPkBw5ardM//E5r0iFfx2IjrCjhNoaknc5aPRZ96XqY/5TqbS
|
||||
VgGRpWs5jaQv4CbRA0yAHqFrGgSRFY0wCFT5Hkwi7wyGyxR5Y30jISsn+kU8ysHV
|
||||
OGZFCDl7tRvL9ICJheXWS61k5LNd4H8rAMqXoPbSvtU/KC/hfRMk
|
||||
=ZdHS
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.1
|
||||
@@ -1,78 +0,0 @@
|
||||
modules:
|
||||
http_2xx:
|
||||
prober: http
|
||||
http:
|
||||
preferred_ip_protocol: "ip4"
|
||||
http_post_2xx:
|
||||
prober: http
|
||||
http:
|
||||
method: POST
|
||||
tcp_connect:
|
||||
prober: tcp
|
||||
pop3s_banner:
|
||||
prober: tcp
|
||||
tcp:
|
||||
query_response:
|
||||
- expect: "^+OK"
|
||||
tls: true
|
||||
tls_config:
|
||||
insecure_skip_verify: false
|
||||
grpc:
|
||||
prober: grpc
|
||||
grpc:
|
||||
tls: true
|
||||
preferred_ip_protocol: "ip4"
|
||||
grpc_plain:
|
||||
prober: grpc
|
||||
grpc:
|
||||
tls: false
|
||||
service: "service1"
|
||||
ssh_banner:
|
||||
prober: tcp
|
||||
tcp:
|
||||
query_response:
|
||||
- expect: "^SSH-2.0-"
|
||||
- send: "SSH-2.0-blackbox-ssh-check"
|
||||
ssh_banner_extract:
|
||||
prober: tcp
|
||||
timeout: 5s
|
||||
tcp:
|
||||
query_response:
|
||||
- expect: "^SSH-2.0-([^ -]+)(?: (.*))?$"
|
||||
labels:
|
||||
- name: ssh_version
|
||||
value: "${1}"
|
||||
- name: ssh_comments
|
||||
value: "${2}"
|
||||
irc_banner:
|
||||
prober: tcp
|
||||
tcp:
|
||||
query_response:
|
||||
- send: "NICK prober"
|
||||
- send: "USER prober prober prober :prober"
|
||||
- expect: "PING :([^ ]+)"
|
||||
send: "PONG ${1}"
|
||||
- expect: "^:[^ ]+ 001"
|
||||
icmp:
|
||||
prober: icmp
|
||||
icmp_ttl5:
|
||||
prober: icmp
|
||||
timeout: 5s
|
||||
icmp:
|
||||
ttl: 5
|
||||
websocket:
|
||||
prober: websocket
|
||||
http_3xx:
|
||||
prober: http
|
||||
http:
|
||||
preferred_ip_protocol: "ip4"
|
||||
enable_http3: true
|
||||
enable_http2: false
|
||||
valid_http_versions: ["HTTP/3.0"]
|
||||
postgresql:
|
||||
prober: tcp
|
||||
tcp:
|
||||
query_response:
|
||||
- send: !!binary AAAACATSFi8= # 0x00, 0x00, 0x00, 0x08, 0x04, 0xD2, 0x16, 0x2F - PostgreSQL SSLRequest
|
||||
- expect_bytes: S # 0x53 - Reply will be 'S' if SSL is enabled, and 'N' if it is not.
|
||||
- starttls: true
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ config, self, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -7,21 +7,11 @@ let
|
||||
in
|
||||
{
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
|
||||
sops.secrets = {
|
||||
grafana_smtp = {
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
|
||||
# Contains private targets for blackbox monitoring
|
||||
# It is used below in the blackbox-http-private0 job
|
||||
# More of these can be created such as private1, private2, ...
|
||||
private0_blackbox_config = {
|
||||
owner = "prometheus";
|
||||
group = "prometheus";
|
||||
path = "/var/lib/prometheus2/private0.json";
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
@@ -30,18 +20,12 @@ in
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
self.nixosModules.malobeo.metrics
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
./printer_module.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 3100 ];
|
||||
|
||||
malobeo.metrics = {
|
||||
@@ -124,91 +108,7 @@ in
|
||||
retentionTime = "1y";
|
||||
port = 9001;
|
||||
|
||||
# We have to disable the checks since we use file_sd_configs provided through
|
||||
# sops secrets. These are not available during buildtime which leads to errors during the check
|
||||
checkConfig = false;
|
||||
|
||||
exporters.blackbox = {
|
||||
enable = true;
|
||||
configFile = ./blackbox.yaml;
|
||||
};
|
||||
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "blackbox-http";
|
||||
metrics_path = "/probe";
|
||||
params = {
|
||||
module = ["http_2xx"];
|
||||
};
|
||||
static_configs = [{
|
||||
targets = [
|
||||
"https://malobeo.org"
|
||||
"https://cloud.malobeo.org"
|
||||
"https://antamap.malobeo.org"
|
||||
"https://docs.malobeo.org"
|
||||
"https://events.malobeo.org"
|
||||
"https://hydra.malobeo.org"
|
||||
"https://keys.malobeo.org"
|
||||
"https://tasklist.malobeo.org"
|
||||
"https://zines.malobeo.org"
|
||||
];
|
||||
}];
|
||||
|
||||
relabel_configs = [
|
||||
{
|
||||
source_labels = ["__address__"];
|
||||
target_label = "__param_target";
|
||||
}
|
||||
{
|
||||
source_labels = ["__param_target"];
|
||||
target_label = "instance";
|
||||
}
|
||||
{
|
||||
target_label = "__address__";
|
||||
replacement = "127.0.0.1:9115";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "blackbox-http-private0";
|
||||
metrics_path = "/probe";
|
||||
params = {
|
||||
module = ["http_2xx"];
|
||||
};
|
||||
file_sd_configs = [
|
||||
{
|
||||
files = [
|
||||
config.sops.secrets.private0_blackbox_config.path
|
||||
];
|
||||
}
|
||||
];
|
||||
relabel_configs = [
|
||||
{
|
||||
source_labels = ["__address__"];
|
||||
target_label = "__param_target";
|
||||
}
|
||||
{
|
||||
source_labels = ["__param_target"];
|
||||
target_label = "instance";
|
||||
}
|
||||
{
|
||||
target_label = "__address__";
|
||||
replacement = "127.0.0.1:9115";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "hydra";
|
||||
static_configs = [{
|
||||
targets = [ "${hosts.malobeo.hosts.albert.network.address}:9199" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "hydra-queue-runner";
|
||||
static_configs = [{
|
||||
targets = [ "${hosts.malobeo.hosts.albert.network.address}:9198" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "overwatch";
|
||||
static_configs = [{
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
grafana_admin: ENC[AES256_GCM,data:zO7Tfmo=,iv:xa456cUb14VjJPEKClqGJiYR7cSsjQPIld+O2E0YNM8=,tag:dFgGtqMYhg4uweoLZPu48Q==,type:str]
|
||||
grafana_smtp: ENC[AES256_GCM,data:xndLMw==,iv:0P4INbDD2/Teo8Dv6lIfLhXvNAkcneEDCeB5OAY25wI=,tag:ilE0Noleb+uL5gqF4bU70w==,type:str]
|
||||
private0_blackbox_config: ENC[AES256_GCM,data:Q7Ll0GFtCEgCKsq2rE4/qLZwo4F+8HAkWFDrc0zz7GvWR29q88rm6P3YqiGpuHo5nGoxanJPxV0ucNV4dA9CRuH6kx1B3WONUd97BSjSY0iVjVMtGhBVNdRGl3i9q9+vTsfXT7jEY5kmEQ1uUMjC+3h5r3J6s6JlVAwxdA==,iv:V4nOZYipocrZjZ9L7Kv/QZEftVwu4yIRoiff5H5Gl4M=,tag:5RCh2ra+5sBEbxLe604m8w==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
- recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPMXlEbWlabzVUNlRkVFFC
|
||||
ZktpQUx2alRNN01qYmhFYnhMRDBkYmFRdzNnCi9YbjBDUlRhc1kwVjZWY0NGZERQ
|
||||
@@ -11,8 +11,8 @@ sops:
|
||||
eDFDVStZS0o0WVh4cmJPa2o3eWNseGMKc0ydK8/2Gzxe2IYG96saVosJTrRcWizR
|
||||
lcMbsh8mKlVCt5Fx9EQOtj50ylOGk2h2Itk4uLYG4UAySDU/Aw3iQw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||
- enc: |
|
||||
- recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1QmsxNERCclRBeFo0WGZ1
|
||||
OGlHTGxDMURsWXdDRXpoUk10S0JpeGk2QURvCjBkaVFHTHo1eGtKbERPWmhNZEpL
|
||||
@@ -20,9 +20,8 @@ sops:
|
||||
QXZwTVd5NnNSdUxRSzNLMHk2SWYxVnMKZyZvZV5qhJj4KATFV2eh9aN9XMbSQL7i
|
||||
kRGQI9y5ADv6UsLh/y+rWe0xF4BPOGF0xL8JUnHfTy/RsKfhB3aTYQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
lastmodified: "2026-09-21T11:52:54Z"
|
||||
mac: ENC[AES256_GCM,data:rgxYGqsksR8vTznjod8nB9sukqRpHTNuH1hdFCUr7HnE67fojNpz3WzOQvl8Su3JK+8Kj2fe9EodQT9VUkMiSywwSw30M9j3aaXlKj798PEIHDhJBWKhkMrQDyaTMla1Lrp5PuGHDdTQ/vmPNUyeQu3XitfcAma6SdX3e9w1J0s=,iv:Je5Fu9f7NPG/to5t+qOVMV195rwbITPy4JsOjouxiLU=,tag:BhlRWoreptzqYCe29/kXdg==,type:str]
|
||||
lastmodified: "2026-01-24T17:01:57Z"
|
||||
mac: ENC[AES256_GCM,data:KySo9sJgOLBPtxQZ1gXY8aCmCHbn44aiLKiK1mGziKsBoPkBdEivCT7dDQ1tXQj9wz3gly6raS4FEmR6ikcbtAE2EN86cDLNuu9sSiW2OYiJRe5iZvet2veqtA00K7TtPZgAX+ccsUE5iy0W55bu+kpK3J8MPNy3LUK0EbSKW8I=,iv:7BQKCNyWe4azTelyKlV6XvvgPIrspVbwITyycsW/c44=,tag:1XbSxju44GCKcGw8Ln9iuQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-01-24T17:01:26Z"
|
||||
enc: |-
|
||||
@@ -63,4 +62,4 @@ sops:
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.3
|
||||
version: 3.11.0
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
grafana_admin: ENC[AES256_GCM,data:c+ZnOyxSXrG4eiK8ETKHheadiSz98LLHYwxb,iv:Ut2qFD2p6OmKDWjLMjFxyISxzTdJpZpgIB7obW5bgkY=,tag:HdayzjXQ1Zc7w9ITLzKLxA==,type:str]
|
||||
grafana_smtp: ENC[AES256_GCM,data:gOER9SzqRACIWe3PchyKguX3RdW6xhSZDzLd727CK1w=,iv:KDOyXGYGXnUu92hvt6eBqI8zeKP+JRDsF8Ir5X/9TDk=,tag:wRexcIJp8XEURKcZnHCRtQ==,type:str]
|
||||
private0_blackbox_config: ENC[AES256_GCM,data:seiw3jvNucIn8NfmYkOt9hxr17OgmydCzTSOfpmDsdL0sD8ZZ4cty0vO63f+cPzU5uWKDYOwCmFL1Rg+vefJFoXGGIHi0hjd4JNAADW3TJ5YMu91fHoB+0ikQcKsRdD8vAs3PjteohlvjBh3IuhHLcIk6NeE09yqBcHpVHbU0/Q1HUVF7gpO/4LK0V2FmJ3HTiWvo4qZNa3T,iv:OJuiotdqVT8ASeKj4Pa8RLn7TGze2O8ICwVB3BmLybk=,tag:fynrBmQOphqzwprhx0MYlA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
- recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdVhpdTdJNnh5VCtmNHh5
|
||||
M1ZTKzk1WlVYYmRWKzJxd1ZUTi9IMW1ta1VvCjVZQVQ1K1lFeC9QZkI2MGZXNk81
|
||||
@@ -11,8 +11,8 @@ sops:
|
||||
NmRNSit1TkRRbUFQNzUvYThUczAxRzAKvpDK4R7m/GpfOzM4nU5vSYDXZGUy4D+c
|
||||
xouTxOguMdId8GiKb1AJnVv2q/YYdr2M9yA/FpKn7kBfuQw/Hrj1rg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
- enc: |
|
||||
- recipient: age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEhCQitwNVpYSHRJOEMr
|
||||
ZnZLQ3lELzdtREVpSHVGd3BHZ3p6WU9BK3lFCkFlYXNsa2JWZmZFVjRmK3BTejc1
|
||||
@@ -20,9 +20,8 @@ sops:
|
||||
VnRIYVVIZktISENseEVLVWlsenFhcVkKvj8i349iNX2YNL5G0w7F9IuW/5ZRP6Z7
|
||||
XC8TrYzCSOEOXt5nMnZg2yQUJHi6Qq8Wu2e2KV7Cd9J8Q/39dRv2cg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
|
||||
lastmodified: "2026-09-21T11:52:44Z"
|
||||
mac: ENC[AES256_GCM,data:5/3fCS1QFmy4kHDCDklR+EwY/VPcb73pOI+rxDj44qlrR+1aRni97ZxdnvlfERy/Hkgsbk5UIKkj9+xMTcCW6Dqp1/zLf1YIL/xF1JVBIxBCVfNxWeS5XDsC0rORwgGi+BuRT4AuRdg2gu1cPwpbyJifpupNl9sOcaFcoctZ4NU=,iv:d2OQk8AIgHyQDOevKeeXi4sQStJF5KMky2ySwxmJrQs=,tag:KIkBsJlaGze4i43OoiXSVg==,type:str]
|
||||
lastmodified: "2026-01-24T16:52:54Z"
|
||||
mac: ENC[AES256_GCM,data:BoJwPldIVZf2NZALbeMTq6DvuBMwOwyvmr5UjsPvQrdbbzYjLTl5dplkhT6QRHPDCFDT4Ibd1UfJ8pQYRkGdO2EjlUyuk3hvAYdR+PUmVz8afFE07sNsGw2EDGVHmsFjUVHLT69YqXtGpVNTW6KjqYuRhz/Ik0wEZLxzDSiy86c=,iv:TQU0si/AYaMpShF4l3CzUN3qajQpE0ZWa7mLOqhRP00=,tag:Oyapkoo4+Q7x08m6RTXfcQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-01-24T18:05:47Z"
|
||||
enc: |-
|
||||
@@ -63,4 +62,4 @@ sops:
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.3
|
||||
version: 3.11.0
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ config, self, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -21,10 +21,9 @@ in
|
||||
|
||||
disabledModules = [ "services/web-apps/pretalx.nix" ];
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
"${inputs.nixpkgs-unstable}/nixos/modules/services/web-apps/pretalx.nix"
|
||||
self.nixosModules.malobeo.metrics
|
||||
self.nixosModules.malobeo.users
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
@@ -38,7 +37,6 @@ in
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
|
||||
|
||||
@@ -6,18 +6,13 @@ in
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
#./hardware-configuration.nix
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
inputs.malobeo.nixosModules.malobeo.initssh
|
||||
inputs.malobeo.nixosModules.malobeo.disko
|
||||
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
inputs.self.nixosModules.malobeo.initssh
|
||||
inputs.self.nixosModules.malobeo.disko
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
boot.initrd.systemd.enable = true;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
||||
@@ -9,16 +9,10 @@ with lib;
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
|
||||
services.nginx = {
|
||||
|
||||
@@ -16,17 +16,11 @@ with lib;
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
inputs.self.nixosModules.malobeo.metrics
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
|
||||
malobeo.metrics = {
|
||||
|
||||
@@ -17,18 +17,12 @@ with lib;
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.vpn
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
inputs.self.nixosModules.malobeo.vpn
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
services.malobeo.vpn = {
|
||||
enable = true;
|
||||
name = "vpn";
|
||||
|
||||
@@ -1,140 +0,0 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
|
||||
# 1. copy wp folder to host
|
||||
# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
|
||||
# 3. create user through webinterface
|
||||
# 4. delete hello world post
|
||||
# 5. run importer
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
user = "wordpress";
|
||||
stateDir = "/var/lib/wordpress/rm16bleibt.org";
|
||||
webserver = config.services.nginx;
|
||||
uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
|
||||
fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
|
||||
|
||||
in {
|
||||
networking = {
|
||||
hostName = mkDefault "wordpress";
|
||||
useDHCP = false;
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
malobeo = false;
|
||||
admin = true;
|
||||
};
|
||||
|
||||
users.users.wordpress = {
|
||||
group = webserver.group;
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${stateDir}' 0750 ${user} ${webserver.group} - -"
|
||||
"d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
|
||||
"d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
|
||||
"Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
|
||||
"d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
|
||||
"Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
|
||||
];
|
||||
|
||||
services.phpfpm.pools = {
|
||||
"wordpress-rm16bleibt.org" = {
|
||||
user = user;
|
||||
group = webserver.group;
|
||||
settings = {
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 4;
|
||||
"pm.max_requests" = 500;
|
||||
"listen.owner" = webserver.user;
|
||||
"listen.group" = webserver.group;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.mysql = {
|
||||
enable = true;
|
||||
#package = mkDefault pkgs.mariadb;
|
||||
package = pkgs.mysql84;
|
||||
ensureDatabases = ["wordpress"];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "wordpress";
|
||||
ensurePermissions = {
|
||||
"wordpress.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."_" = {
|
||||
#serverName = "rm16bleibt.org";
|
||||
root = "/var/lib/wordpress/rm16bleibt.org";
|
||||
extraConfig = ''
|
||||
index index.php;
|
||||
'';
|
||||
locations = {
|
||||
"/" = {
|
||||
priority = 200;
|
||||
extraConfig = ''
|
||||
try_files $uri $uri/ /index.php$is_args$args;
|
||||
'';
|
||||
};
|
||||
"~ \\.php$" = {
|
||||
priority = 500;
|
||||
extraConfig = ''
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
|
||||
fastcgi_index index.php;
|
||||
include "${config.services.nginx.package}/conf/fastcgi.conf";
|
||||
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
|
||||
|
||||
# Mitigate https://httpoxy.org/ vulnerabilities
|
||||
fastcgi_param HTTP_PROXY "";
|
||||
fastcgi_intercept_errors off;
|
||||
fastcgi_buffer_size 16k;
|
||||
fastcgi_buffers 4 16k;
|
||||
fastcgi_connect_timeout 300;
|
||||
fastcgi_send_timeout 300;
|
||||
fastcgi_read_timeout 300;
|
||||
'';
|
||||
};
|
||||
"~ /\\." = {
|
||||
priority = 800;
|
||||
extraConfig = "deny all;";
|
||||
};
|
||||
"~* /(?:uploads|files)/.*\\.php$" = {
|
||||
priority = 900;
|
||||
extraConfig = "deny all;";
|
||||
};
|
||||
"~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
|
||||
priority = 1000;
|
||||
extraConfig = ''
|
||||
expires max;
|
||||
log_not_found off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ self, config, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -11,17 +11,11 @@ with lib;
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.printing
|
||||
inputs.malobeo.nixosModules.malobeo.users
|
||||
inputs.zineshop.nixosModules.zineshop
|
||||
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
malobeo.users = {
|
||||
admin = true;
|
||||
malobeo = false;
|
||||
};
|
||||
|
||||
malobeo.metrics = {
|
||||
enable = true;
|
||||
enablePromtail = true;
|
||||
|
||||
Reference in New Issue
Block a user