Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 kalipso
|
ae1e8f35e2 |
@@ -7,13 +7,13 @@ on:
|
|||||||
- synchronize
|
- synchronize
|
||||||
paths:
|
paths:
|
||||||
- '**.nix'
|
- '**.nix'
|
||||||
- 'flake.lock'
|
- flake.lock
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- 'master'
|
- master
|
||||||
paths:
|
paths:
|
||||||
- '**.nix'
|
- '**.nix'
|
||||||
- 'flake.lock'
|
- flake.lock
|
||||||
|
|
||||||
permissions:
|
permissions:
|
||||||
contents: write
|
contents: write
|
||||||
|
|||||||
Generated
+4
-4
@@ -469,11 +469,11 @@
|
|||||||
"utils": "utils_4"
|
"utils": "utils_4"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1789131197,
|
"lastModified": 1768820076,
|
||||||
"narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
|
"narHash": "sha256-0vnIYuWvsYasbHZHUjAcK9FR0kxkRRtzYG661VEtoPU=",
|
||||||
"ref": "refs/heads/master",
|
"ref": "refs/heads/master",
|
||||||
"rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
|
"rev": "cfdfae84bb045ae429f0760eba708468871b1738",
|
||||||
"revCount": 161,
|
"revCount": 159,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.dynamicdiscord.de/kalipso/zineshop"
|
"url": "https://git.dynamicdiscord.de/kalipso/zineshop"
|
||||||
},
|
},
|
||||||
|
|||||||
@@ -17,7 +17,6 @@ keys:
|
|||||||
- &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
|
- &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
|
||||||
- &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
|
- &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
|
||||||
- &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
|
- &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
|
||||||
- &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
|
|
||||||
#this dummy key is used for testing.
|
#this dummy key is used for testing.
|
||||||
- &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
- &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||||
creation_rules:
|
creation_rules:
|
||||||
@@ -124,14 +123,6 @@ creation_rules:
|
|||||||
age:
|
age:
|
||||||
- *admin_atlan
|
- *admin_atlan
|
||||||
- *machine_albert
|
- *machine_albert
|
||||||
- path_regex: ns1/secrets.yaml$
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *admin_kalipso
|
|
||||||
- *admin_kalipso_dsktp
|
|
||||||
age:
|
|
||||||
- *machine_ns1
|
|
||||||
- *admin_atlan
|
|
||||||
- path_regex: .*/secrets/.*
|
- path_regex: .*/secrets/.*
|
||||||
key_groups:
|
key_groups:
|
||||||
- pgp:
|
- pgp:
|
||||||
|
|||||||
@@ -6,10 +6,6 @@ let
|
|||||||
in
|
in
|
||||||
{
|
{
|
||||||
networking.hostName = "albert";
|
networking.hostName = "albert";
|
||||||
networking.nameservers = [
|
|
||||||
"192.168.1.1"
|
|
||||||
"1.1.1.1"
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = ./secrets.yaml;
|
sops.defaultSopsFile = ./secrets.yaml;
|
||||||
sops.secrets.wg_private = {};
|
sops.secrets.wg_private = {};
|
||||||
@@ -27,7 +23,6 @@ in
|
|||||||
inputs.self.nixosModules.malobeo.users
|
inputs.self.nixosModules.malobeo.users
|
||||||
inputs.self.nixosModules.malobeo.backup
|
inputs.self.nixosModules.malobeo.backup
|
||||||
./hydra.nix
|
./hydra.nix
|
||||||
./gitea_runner.nix
|
|
||||||
];
|
];
|
||||||
|
|
||||||
virtualisation.vmVariantWithDisko = {
|
virtualisation.vmVariantWithDisko = {
|
||||||
@@ -50,7 +45,7 @@ in
|
|||||||
enable = true;
|
enable = true;
|
||||||
url = "https://hydra.malobeo.org";
|
url = "https://hydra.malobeo.org";
|
||||||
project = "malobeo";
|
project = "malobeo";
|
||||||
jobset = "master";
|
jobset = "infrastructure";
|
||||||
cacheurl = "https://cache.malobeo.org";
|
cacheurl = "https://cache.malobeo.org";
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -82,13 +77,14 @@ in
|
|||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
firewall = {
|
firewall = {
|
||||||
allowedTCPPorts = [ 80 443 3000 5000];
|
allowedTCPPorts = [ 80 443 3000 ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
nixpkgs.config.allowUnfree = true;
|
nixpkgs.config.allowUnfree = true;
|
||||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" "i686-linux" ];
|
|
||||||
services.acpid.enable = true;
|
services.acpid.enable = true;
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
time.timeZone = "Europe/Berlin";
|
time.timeZone = "Europe/Berlin";
|
||||||
system.stateVersion = "26.05"; # Do.. Not.. Change..
|
system.stateVersion = "26.05"; # Do.. Not.. Change..
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,67 +0,0 @@
|
|||||||
wg_private: ENC[AES256_GCM,data:yHkjJjW/I/5mFJuMQR0XpoMqPDt9b/ZZRmLiqJjug31p5aV6AC7Pk7bhNN8=,iv:OjRVJCCO0WTUSd6w5oeZbEeilcffJQOOrudIkss9VaE=,tag:t5N0tNjrfM8/pKbJMMDEig==,type:str]
|
|
||||||
gitea_token: ENC[AES256_GCM,data:+zHmfVfdheo4KzOBjDr8WNcJh78ReZ7CWiiG9fAcXpQw21yWb4/jq3RqqIenB2p1EEtF0OlSUr3lu478gEBmxlilBCpEaEzNJKfOFL77P66OYLo7RJkp3TE0sILDCaVwGDkCWQKd05zqJzbb5opHE5B0NUf9dOgs8CuYZPelrTzGsTfWjdZWxweSrOcFtsGLJcR0hLd9obAuqOxi2vID2YY/uIguGEhZYHshTlZSzMTg+8k2UCe/x+LOitCkLqFJfS5b+1HJpD6R1dKsVKtSjXtzLHzfIMy28xYvqgIju0JtUA==,iv:Kah6BYvKCe06/yHBICp2YOdJfSqktNrZl5kKYgs/AY0=,tag:3B+g6zqW7vcT1t/wfmYfUg==,type:str]
|
|
||||||
cache_priv: ENC[AES256_GCM,data:CpxYGSSdSZoULqH/AJdaYWiuAgI8Spuf/lod8x5bFEnFB2KlRFp7vBjwwRzxykurbezP2/c938NL2WxI+sDw7UV6LAG+E5KmYxXQpOJZgIPx3YcEidyp5HWq628lf1k=,iv:t7BFA4IM6eFl+Uuq7k7OR26+wHVKbvWi+yV0xg2xFGs=,tag:9hpxyjEUnbOz1NFc2JctEA==,type:str]
|
|
||||||
gitea_runner_token: ENC[AES256_GCM,data:wUHExAD2tf1bKc3W3GXHcPg6WS8OqQK7efcR4SBMSQnSIo/E32lo9w==,iv:P9JouWGa8c4NNTua2OhqJzjjj37mLmkYmJ+c4mogH20=,tag:dLR06+PBBl1SodaLH7ElqQ==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMRnE5OFQwdlV1bTJwdmZ0
|
|
||||||
Q2pLVGcyOXlILy9selVYeERGcFFyenRrcVRVClNaMWRPNllHS0ZEYlkvaUp2di9N
|
|
||||||
cDNuY2syKzZ5WTlKTndXQnMyQkp2RGsKLS0tIEVGYVcxUTU1NVhFZnBsR1Z3RDNH
|
|
||||||
RTJscHI0SmtUTzA3R3JkYTBZRUxlL3MKzEajq1IEBOjiF431vtkqnT3VWC2D+vGW
|
|
||||||
C5dTc/stQ0PXvfuTlRTKKTBlaSdnwBu/pKQ5/QtqwKee2Z3nxySziQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
|
||||||
- enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaVNOSHZvSmJ0ZFhSVVhs
|
|
||||||
Z3ZvTU9jRytLaUJwd3VCZ0NJb3NGRzE1MVFvCnRYaTI2MHJRZnhhZjBmZkdqMTQ3
|
|
||||||
Rkh2WDVoUHZCY0Z2YlFlakVKTzUxUm8KLS0tIENjVXlxcWRjRXVjVFBNMVJSeTNs
|
|
||||||
YXU5TEpNeE9oMTZpbW10ekU3Z09EbEEKYr5TMIs9KmrHZqhhc6GZx6tM78XOXYAq
|
|
||||||
PffqNVDxsFbxAUK7dd5WPw++dE4W1gwRxI+sSPQ2H8ZvjqB8ff3TYw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
|
||||||
lastmodified: "2026-09-11T11:23:55Z"
|
|
||||||
mac: ENC[AES256_GCM,data:swEaZC/CLOdrjDSEYsaWBnl7cew01eUraa4ORkJljlqKusr0BdYFozjR3Rxc66JWRChc4bP0ckeDhU6AOiXk4k4zL8CJ3S4eY3111z36xjZXY9LXxMVn0oTx+3SrD6pOttTxZUkcdogRsi/jOsMPoTgSQN5OwvV8RTLF5waxU4I=,iv:ISZk4qsmmy4RYy1cxjpE/vbcCp6UoArtOqzd1ePYL0c=,tag:N68qZyHsiOFkfNM7e+t2zQ==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2026-09-11T11:23:21Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQGMA5HdvEwzh/H7AQv8D1hDUkuvip430Qe/djdEP6N26XQkqcZVfuzdhgQOwdTC
|
|
||||||
N1ou9MPJ0D0gIk72uYExHGDTwhvOEBTMuDk+te9foffcj6MHzUUpqI+TKsjV/PeY
|
|
||||||
Xpj9YGNjmGI7hz0ERyALMDpfFbkLPIDP3LwbxM+UFpe0weGoxfROVFWlFnXi6Rrg
|
|
||||||
MoFgDOUD9Ku7v9dkMkMcmoZULAozf5fcVMFe1mpByEh9LuATQRkuAO7Uf6nH46Qa
|
|
||||||
n7rMm04CNdBtmVSEPsU3CZ4C9+kyOzH1xwynb6MVDnY3j6sUGr3Seu7nCfMPDjmU
|
|
||||||
l2wcv4THJbUU+0gM9+Y3zSZlRYa0xe05D8CfpASnZ4FamFZOwuAJAgiKc8y3DEp6
|
|
||||||
kQMK76ncZQLhOIS//1tXkD3iIeLgr6D7VCjP23IaOV/7cakmqL7mbCdA6es9tXBm
|
|
||||||
7Hy0p7xkSVpJrxiV3NbiN84MILxpJey/usq9VEBUf3oRtVBHt3uxVnL33Txc7PRg
|
|
||||||
JimkwsrGi9JV1YiF3Y1Q0lgBxOYufbPdYJ9n5Ki/unD1AJI/WBm/ii2Kt5RY0L2X
|
|
||||||
JY3AguNG29wBBWJg4hyCq7fisI88TBJh6syUb91UHHMloOVe1Pk3Bb7oMWMgLl0g
|
|
||||||
YLU07kt67eaX
|
|
||||||
=xifQ
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
|
||||||
- created_at: "2026-09-11T11:23:21Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA98TrrsQEbXUARAApu96xR6Fy6Y0dAHzM9CjnFuSFLlUbU0yRWksHCFoo6XS
|
|
||||||
acRWL0pVlwCWt3sR+tjpd1tEvQZFspqq+UhDLlaz+qS2dpI0IkjNEbD/0uTTcqkn
|
|
||||||
0wlKcvDdRGv5Mb2wjFp5Q0VBIDC2nRbK579IghaEIoRRN9j2VfksracmfrvEpuuL
|
|
||||||
5rF4Uvpzc5VLQyf9hy53j9MXuiTfWv4xEPC3zfcbxeOKaXPKEVkc0e8QyNPes3Q2
|
|
||||||
AefQBd+QRBSCDc9P6V5Xb2r+K52k6zWxpoeR1oyJbAv5c4NKWtKtdackIyPoLF4N
|
|
||||||
9TtcidG2OTtuIqIAmSix23KVBgJB0nESSuUhy4f0YUUnGNWpu4TDGzB9BNmiob9K
|
|
||||||
0fO/awGV87kYKPcjdj/XLgVB+zZ/5T7b3dL6tl4lpwMf69qzq0Io/CffnYpTItGJ
|
|
||||||
A/3G0rokjmicGSme5nNkZKXXwxNidaxvSOLXd+yAmInMcXacvO2WuA1CmCnU4Px/
|
|
||||||
igA19i1GDc9OS1qGhIdrG14iUf1820DACdsPlg3jFEys7dpkGDIOiMAqo66OhX9Q
|
|
||||||
gYN4Dz2PaPSrTJl0rkBds1qiGI4TN6AKQlLlwkowx465lX8UsjvaYT4z7d2JWYN2
|
|
||||||
VHMaeEBZvO688oFYA/wn/b+OHUkRIkL1oIeU2G5Pw9m5wQbgd8DMgvYZKe3rzrbS
|
|
||||||
WAGKWwzwHc4BjBzL1PxcwMchMfiZJ0Ltel5dcXHkHi7VV+O7dIQiseZwfHBbGyIa
|
|
||||||
uXogIDlqULSiRxw9oht3hVDS90uW2riMEoDcr47hh1oFaGBHoY7/kf8=
|
|
||||||
=+ckT
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.13.1
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
|
||||||
|
|
||||||
let
|
|
||||||
mkRunner = runnerName: {
|
|
||||||
enable = true;
|
|
||||||
name = runnerName;
|
|
||||||
url = "https://git.dynamicdiscord.de/";
|
|
||||||
tokenFile = config.sops.secrets.gitea_runner_token.path;
|
|
||||||
labels = [
|
|
||||||
"ubuntu-latest:docker://node:latest"
|
|
||||||
];
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
runner = {
|
|
||||||
devices = [ "/dev/kvm" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets.gitea_runner_token = {};
|
|
||||||
|
|
||||||
virtualisation.docker.enable = true;
|
|
||||||
users.users.admin.extraGroups = [ "docker" ];
|
|
||||||
|
|
||||||
services.gitea-actions-runner.instances = {
|
|
||||||
albert01 = mkRunner "albert01";
|
|
||||||
albert02 = mkRunner "albert02";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -24,7 +24,7 @@
|
|||||||
|
|
||||||
services.hydra = {
|
services.hydra = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hydraURL = "https://hydra.malobeo.org";
|
hydraURL = "localhost:3000";
|
||||||
useSubstitutes = true;
|
useSubstitutes = true;
|
||||||
notificationSender = "hydra@localhost";
|
notificationSender = "hydra@localhost";
|
||||||
|
|
||||||
@@ -33,19 +33,9 @@
|
|||||||
binary_cache_secret_key_file = /etc/nix/albert/secret
|
binary_cache_secret_key_file = /etc/nix/albert/secret
|
||||||
binary_cache_dir = /var/lib/hydra/cache
|
binary_cache_dir = /var/lib/hydra/cache
|
||||||
Include ${config.sops.secrets.gitea_token.path}
|
Include ${config.sops.secrets.gitea_token.path}
|
||||||
using_frontend_proxy 1
|
|
||||||
base_uri hydra.malobeo.org
|
|
||||||
<hydra_notify>
|
|
||||||
<prometheus>
|
|
||||||
listen_address = 0.0.0.0
|
|
||||||
port = 9199
|
|
||||||
</prometheus>
|
|
||||||
</hydra_notify>
|
|
||||||
queue_runner_metrics_address = 0.0.0.0:9198
|
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
networking.firewall.allowedTCPPorts = [ 9199 9198 ];
|
|
||||||
|
|
||||||
systemd.services.hydra-manual-setup = {
|
systemd.services.hydra-manual-setup = {
|
||||||
description = "Create Admin User for Hydra";
|
description = "Create Admin User for Hydra";
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
@@ -105,5 +95,11 @@
|
|||||||
"git+ssh://git.dynamicdiscord.de/"
|
"git+ssh://git.dynamicdiscord.de/"
|
||||||
"https://git.dynamicdiscord.de"
|
"https://git.dynamicdiscord.de"
|
||||||
];
|
];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."hydra.malobeo.org" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/".proxyPass = "http://localhost:3000";
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,6 @@
|
|||||||
wg_private: ENC[AES256_GCM,data:rSENHGEat9wre1bFcM3LYnlGjf9gmcE9FmeCySzbGZ4SCCUl5QLQN/quXw0=,iv:Bdwlk5UHSiyA9gSW91LUPJyBG50FG/hpwyClzTOUoUI=,tag:/Jw549R5Qmg4WblL7rUE8w==,type:str]
|
wg_private: ENC[AES256_GCM,data:rSENHGEat9wre1bFcM3LYnlGjf9gmcE9FmeCySzbGZ4SCCUl5QLQN/quXw0=,iv:Bdwlk5UHSiyA9gSW91LUPJyBG50FG/hpwyClzTOUoUI=,tag:/Jw549R5Qmg4WblL7rUE8w==,type:str]
|
||||||
gitea_token: ENC[AES256_GCM,data:1LevtPr5awIu2rcCGbLIsQA5QO0AhFk5Rep7RG28QdlFHDADCaEoS18pEEZ9NMYMZaGWIBA8Zq/NsCYxQGzuWh3TESZW7CO5kzCaSVG1aqjGpjfbeyG+xQEDtab2Owh+TVN/wVGUUDR1NBlWqE4Shw7mO228CWbxQRSQo3lsLhmf69fLEV1DDnH0Xt7Ml8tr7yLIeWHlG0BeOMKSkY17APahxqBx547Zw+kgaUW3WgTyxeWZaDjk/prK6bYV2euK4Il/4vTZE/x0mThmTThjszcAvdaon+V8y1Ax34gTyAgjvpFC2kE=,iv:1A8YNv/A0MEkGKV5Z9WPI4LwQFu2Z9BWuN2yfFHCPLI=,tag:hEfskDEAQiriXNjcYzziSg==,type:str]
|
gitea_token: ENC[AES256_GCM,data:1LevtPr5awIu2rcCGbLIsQA5QO0AhFk5Rep7RG28QdlFHDADCaEoS18pEEZ9NMYMZaGWIBA8Zq/NsCYxQGzuWh3TESZW7CO5kzCaSVG1aqjGpjfbeyG+xQEDtab2Owh+TVN/wVGUUDR1NBlWqE4Shw7mO228CWbxQRSQo3lsLhmf69fLEV1DDnH0Xt7Ml8tr7yLIeWHlG0BeOMKSkY17APahxqBx547Zw+kgaUW3WgTyxeWZaDjk/prK6bYV2euK4Il/4vTZE/x0mThmTThjszcAvdaon+V8y1Ax34gTyAgjvpFC2kE=,iv:1A8YNv/A0MEkGKV5Z9WPI4LwQFu2Z9BWuN2yfFHCPLI=,tag:hEfskDEAQiriXNjcYzziSg==,type:str]
|
||||||
cache_priv: ENC[AES256_GCM,data:NbfyBv68UCWuSjbUu5lFUXPgG+vYrxbAQeD77YlklTRm6MVS4lAEjUzjnjewcX6Khca1N7r7vGieFyaBlQm0264KGTP5tc7BnEIKJDOD/UHQBdMpZgUzd2cKQWK7Kx0=,iv:6VWsZd/VDjQ/BhfwHZBcL3Zp0W/9sO/ZC9sF1Jnqguo=,tag:/gSe6TyaZDKoRFaRKiYyzw==,type:str]
|
cache_priv: ENC[AES256_GCM,data:NbfyBv68UCWuSjbUu5lFUXPgG+vYrxbAQeD77YlklTRm6MVS4lAEjUzjnjewcX6Khca1N7r7vGieFyaBlQm0264KGTP5tc7BnEIKJDOD/UHQBdMpZgUzd2cKQWK7Kx0=,iv:6VWsZd/VDjQ/BhfwHZBcL3Zp0W/9sO/ZC9sF1Jnqguo=,tag:/gSe6TyaZDKoRFaRKiYyzw==,type:str]
|
||||||
gitea_runner_token: ENC[AES256_GCM,data:7pVUx9TI/WbCWg2aI/k/fngtWZtffUCMsRfyJn2AQW6VOXknWMeXIKc07MDnbjjc,iv:isSUZ1yq3j/gIzqoCLGpmPIay5L5gYkOBW08K1rGvuA=,tag:uOkrUB6If/gQ5680A0VTxQ==,type:str]
|
|
||||||
sops:
|
sops:
|
||||||
age:
|
age:
|
||||||
- enc: |
|
- enc: |
|
||||||
@@ -22,8 +21,8 @@ sops:
|
|||||||
N6DSIVisJf7qNuNw6M0J5nny6xfWeIEZJettF0xSHM1gSfr7oUbHOQ==
|
N6DSIVisJf7qNuNw6M0J5nny6xfWeIEZJettF0xSHM1gSfr7oUbHOQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
recipient: age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
|
recipient: age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
|
||||||
lastmodified: "2026-09-11T18:12:32Z"
|
lastmodified: "2026-08-26T17:31:59Z"
|
||||||
mac: ENC[AES256_GCM,data:4uH4hVrc3ISolaYHZb0NK65Rx6wQf+P6bpbcYCPHbn3N9vkbkqBSKePsxGgKaNQQhAHwkLMdxRIcwtERjMsAngL5IZrO3riI91MZxRoFadbklJbJ4HSpQ240PT5vrpkpVb68KqCeVdoKRcR2MqH30H8UDCCvpZhdSNSl8ceQCss=,iv:5FnwnOb1dBSRCs4/5WONIYPji/+2WVtgFboTfybGZ/U=,tag:QWKWjN8ljeloS7UJM4LiKg==,type:str]
|
mac: ENC[AES256_GCM,data:G0Xpe7zJZh4xAwFRUXSbR11ENqRd4UoU7gFK3nDM7Icm9DMyqyi3uBfg1j0c8yTCInIrnyX1dy7zUWjns+OAbXv8CMLXVUPdomgCxX0zUWEkTzgQqnJy97KFAmPPPMCGTUby3TMVQkcrk5/iATmydSMhs0lKErS4737u9jen/3I=,iv:YB3BqypuvamDJy64FeaSUQBCAdlr7a9UWJDNhGsTRvo=,tag:lXc7heG+MRiUo+SfRcRDNg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2026-08-20T15:43:21Z"
|
- created_at: "2026-08-20T15:43:21Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
|
|||||||
@@ -1,59 +0,0 @@
|
|||||||
{ self, config, lib, pkgs, inputs, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
antamap-pkg = pkgs.stdenv.mkDerivation {
|
|
||||||
name = "antamap";
|
|
||||||
src = pkgs.fetchgit {
|
|
||||||
url = "https://0xacab.org/AND/antamap.git";
|
|
||||||
branchName = "master";
|
|
||||||
rev = "ec584c0c4bd4ddd9ff8353bf8a926bd94526d304";
|
|
||||||
sha256 = "sha256-o5alTWBZIaUJiwYE0/gkGlxH+v1BxaGauxHDb6gK3+I=";
|
|
||||||
};
|
|
||||||
|
|
||||||
installPhase = "mkdir -p $out; cp -R * $out/";
|
|
||||||
};
|
|
||||||
in
|
|
||||||
{
|
|
||||||
networking = {
|
|
||||||
hostName = mkDefault "antamap";
|
|
||||||
useDHCP = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
imports = [
|
|
||||||
self.nixosModules.malobeo.users
|
|
||||||
../modules/sshd.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
malobeo.users = {
|
|
||||||
malobeo = false;
|
|
||||||
admin = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts."_" = {
|
|
||||||
listen = [
|
|
||||||
{ addr = "0.0.0.0"; port = 80; }
|
|
||||||
];
|
|
||||||
root = "${antamap-pkg}";
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_cache off;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
|
||||||
|
|
||||||
time.timeZone = "Europe/Berlin";
|
|
||||||
|
|
||||||
system.stateVersion = "22.11"; # Did you read the comment?
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -19,7 +19,7 @@ in
|
|||||||
enable = true;
|
enable = true;
|
||||||
url = "https://hydra.malobeo.org";
|
url = "https://hydra.malobeo.org";
|
||||||
project = "malobeo";
|
project = "malobeo";
|
||||||
jobset = "master";
|
jobset = "infrastructure";
|
||||||
cacheurl = "https://cache.malobeo.org";
|
cacheurl = "https://cache.malobeo.org";
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -83,6 +83,7 @@ in
|
|||||||
services.acpid.enable = true;
|
services.acpid.enable = true;
|
||||||
|
|
||||||
networking.hostName = "bakunin";
|
networking.hostName = "bakunin";
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
|
||||||
security.rtkit.enable = true;
|
security.rtkit.enable = true;
|
||||||
services.pipewire = {
|
services.pipewire = {
|
||||||
|
|||||||
@@ -44,7 +44,7 @@ in
|
|||||||
enable = true;
|
enable = true;
|
||||||
url = "https://hydra.malobeo.org";
|
url = "https://hydra.malobeo.org";
|
||||||
project = "malobeo";
|
project = "malobeo";
|
||||||
jobset = "master";
|
jobset = "infrastructure";
|
||||||
cacheurl = "https://cache.malobeo.org";
|
cacheurl = "https://cache.malobeo.org";
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -146,9 +146,6 @@ in
|
|||||||
"zineshop"
|
"zineshop"
|
||||||
"vaultwarden"
|
"vaultwarden"
|
||||||
"pretalx"
|
"pretalx"
|
||||||
"antamap"
|
|
||||||
"ns1"
|
|
||||||
"wordpress"
|
|
||||||
];
|
];
|
||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
@@ -289,56 +286,6 @@ in
|
|||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
virtualHosts."antamap.malobeo.org" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${hosts.malobeo.hosts.antamap.network.address}:80";
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
virtualHosts."hydra.malobeo.org" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:3000";
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Forwarded-Port 443;
|
|
||||||
proxy_set_header X-Forwarded-Proto https;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
virtualHosts."www.rm16bleibt.org" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}:80";
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Forwarded-Port 443;
|
|
||||||
proxy_set_header X-Forwarded-Proto https;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
virtualHosts."cache.malobeo.org" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:5000";
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.tor = {
|
services.tor = {
|
||||||
@@ -352,6 +299,7 @@ in
|
|||||||
services.acpid.enable = true;
|
services.acpid.enable = true;
|
||||||
|
|
||||||
networking.hostName = "fanny";
|
networking.hostName = "fanny";
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
|
||||||
virtualisation.vmVariant.virtualisation.graphics = false;
|
virtualisation.vmVariant.virtualisation.graphics = false;
|
||||||
|
|
||||||
|
|||||||
@@ -2,17 +2,12 @@
|
|||||||
{
|
{
|
||||||
sops.secrets.njalacloud = {};
|
sops.secrets.njalacloud = {};
|
||||||
sops.secrets.njalazines = {};
|
sops.secrets.njalazines = {};
|
||||||
sops.secrets.njalaantamap = {};
|
|
||||||
systemd.services."dyndns" = {
|
systemd.services."dyndns" = {
|
||||||
script = ''
|
script = ''
|
||||||
KEYCLOUD=$(cat /run/secrets/njalacloud)
|
KEYCLOUD=$(cat /run/secrets/njalacloud)
|
||||||
KEYZINES=$(cat /run/secrets/njalazines)
|
KEYZINES=$(cat /run/secrets/njalazines)
|
||||||
KEYANATAMAP=$(cat /run/secrets/njalaantamap)
|
|
||||||
KEYRM16=$(cat /run/secrets/njalarm16)
|
|
||||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
|
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
|
||||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
|
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
|
||||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
|
|
||||||
${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=www.rm16bleibt.org&k="$KEYRM16"&auto"
|
|
||||||
'';
|
'';
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "oneshot";
|
Type = "oneshot";
|
||||||
|
|||||||
@@ -3,11 +3,11 @@ shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS
|
|||||||
shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
|
shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
|
||||||
njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
|
njalacloud: ENC[AES256_GCM,data:sp79Ij1vd9pQZuPUR1phmw==,iv:AWKZoOfBA/n16pWQCfA0dZmH1KajCztnLvYItoZZbgA=,tag:BIUrobBoO96pxUz1sjIYIw==,type:str]
|
||||||
njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
|
njalazines: ENC[AES256_GCM,data:fnObUEnXYvdj9HtkZNzXVA==,iv:0Zj2n2we9w4fj/n7e1ayd9XgFEMAGCHk4QLTu1IlRnQ=,tag:zeOLAB0oE6XbxqdqhdRNxw==,type:str]
|
||||||
njalaantamap: ENC[AES256_GCM,data:nUc+E7HNbW0EDclzNDV6+w==,iv:H8nqeuOrvvu8O8QhGWkBkYWAQXwkBehf/jU6u/grs1A=,tag:mqX6jn47DyeSuk8xzG0e/Q==,type:str]
|
|
||||||
njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
|
njala_api_key: ENC[AES256_GCM,data:ohSVzQUvFjia/s9WceqnZCdLyk3N1Lm2BCBmXeBlkWD2dyrohKCnd9GiJ499IORpuYcOXyM=,iv:Uczk8op5mgqe8gefxgU9YuTqOsYvjzHCKvzA7GDsgio=,tag:XA7JRq/LsGkpHcQSO36Whg==,type:str]
|
||||||
sops:
|
sops:
|
||||||
age:
|
age:
|
||||||
- enc: |
|
- recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
|
||||||
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
|
||||||
MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
|
MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
|
||||||
@@ -15,8 +15,8 @@ sops:
|
|||||||
TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
|
TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
|
||||||
pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
|
pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
|
- recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||||
- enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
|
||||||
S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
|
S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
|
||||||
@@ -24,9 +24,8 @@ sops:
|
|||||||
QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
|
QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
|
||||||
SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
|
SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
lastmodified: "2026-02-20T19:25:05Z"
|
||||||
lastmodified: "2026-08-28T12:19:14Z"
|
mac: ENC[AES256_GCM,data:g+bFYqJN1X8F52tpIO60S2WKxLG27ZrP399fsfE6o7rPtIMimZou/4oUo7i+kpNtygEuCr3+suP8TPas4x5zMXhRjnjJuwJwL/NwdciHZU0O3rPJgucCEWqr9OdAtxezDM9c2vv+jzqZxWT9t0fIpB9RxO5oy1pHZs0RCgjAJR4=,iv:v6RdTMeQUxSdjIVNFbx2HtxCsdVgFTQTzMXS5Fj62is=,tag:pLoZMBRIXYElO5rY+xX9zg==,type:str]
|
||||||
mac: ENC[AES256_GCM,data:TnElCRaL/b238clfFVEq+Ot1lwg5MLMchCkmhi5PmADRn2exA42Zeq5v1M/IM5sHt4xEyFLn5R/88Y49DAfehRFwu6rddV+3lnFV40k2rWRtMfQOUXSrCd7lGxZdFbMU0eIXF5jaATFbcP0wO03FohNA69/u6kNsS0y0jK3vuLQ=,iv:xPeNXUIavVYFfAv1fs5TXCHXmvnXQDs4mJZMHOX7qG8=,tag:85hrBTKMh1ckTtXpOxj5lg==,type:str]
|
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2025-02-11T18:32:49Z"
|
- created_at: "2025-02-11T18:32:49Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
@@ -67,4 +66,4 @@ sops:
|
|||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.13.1
|
version: 3.11.0
|
||||||
|
|||||||
+1
-21
@@ -29,8 +29,6 @@ in
|
|||||||
local = true;
|
local = true;
|
||||||
hostId = "11";
|
hostId = "11";
|
||||||
address = "192.168.1.101";
|
address = "192.168.1.101";
|
||||||
gateway = "192.168.1.1";
|
|
||||||
nameservers = [ "192.168.1.1" "1.1.1.1" ];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -40,8 +38,6 @@ in
|
|||||||
local = true;
|
local = true;
|
||||||
hostId = "12";
|
hostId = "12";
|
||||||
address = "192.168.1.102";
|
address = "192.168.1.102";
|
||||||
gateway = "192.168.1.1";
|
|
||||||
nameservers = [ "192.168.1.1" "1.1.1.1" ];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -51,8 +47,6 @@ in
|
|||||||
local = true;
|
local = true;
|
||||||
hostId = "13";
|
hostId = "13";
|
||||||
address = "192.168.1.103";
|
address = "192.168.1.103";
|
||||||
gateway = "192.168.1.1";
|
|
||||||
nameservers = [ "192.168.1.1" "1.1.1.1" ];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -62,8 +56,6 @@ in
|
|||||||
local = true;
|
local = true;
|
||||||
hostId = "15";
|
hostId = "15";
|
||||||
address = "192.168.1.105";
|
address = "192.168.1.105";
|
||||||
gateway = "192.168.1.1";
|
|
||||||
nameservers = [ "192.168.1.1" "1.1.1.1" ];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -73,8 +65,6 @@ in
|
|||||||
local = true;
|
local = true;
|
||||||
hostId = "19";
|
hostId = "19";
|
||||||
address = "192.168.1.111";
|
address = "192.168.1.111";
|
||||||
gateway = "192.168.1.1";
|
|
||||||
nameservers = [ "192.168.1.1" "1.1.1.1" ];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -128,17 +118,7 @@ in
|
|||||||
network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
|
network = createMaloNet "18" "52:DA:0D:F9:EF:F4";
|
||||||
};
|
};
|
||||||
|
|
||||||
antamap = {
|
# last host id: 19
|
||||||
type = "microvm";
|
|
||||||
network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
|
|
||||||
};
|
|
||||||
|
|
||||||
wordpress = {
|
|
||||||
type = "microvm";
|
|
||||||
network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
|
|
||||||
};
|
|
||||||
|
|
||||||
# last host id: 21
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -16,7 +16,7 @@
|
|||||||
enable = true;
|
enable = true;
|
||||||
url = "https://hydra.malobeo.org";
|
url = "https://hydra.malobeo.org";
|
||||||
project = "malobeo";
|
project = "malobeo";
|
||||||
jobset = "master";
|
jobset = "infrastructure";
|
||||||
cacheurl = "https://cache.malobeo.org";
|
cacheurl = "https://cache.malobeo.org";
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -71,6 +71,7 @@
|
|||||||
services.acpid.enable = true;
|
services.acpid.enable = true;
|
||||||
|
|
||||||
networking.hostName = "louise";
|
networking.hostName = "louise";
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
|
||||||
security.rtkit.enable = true;
|
security.rtkit.enable = true;
|
||||||
services.pipewire = {
|
services.pipewire = {
|
||||||
|
|||||||
@@ -31,8 +31,8 @@ rec {
|
|||||||
"https://cache.nixos.org/"
|
"https://cache.nixos.org/"
|
||||||
];
|
];
|
||||||
trusted-public-keys = [
|
trusted-public-keys = [
|
||||||
|
# TODO: add cache.malobeo.org key after creation
|
||||||
"cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
|
"cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
|
||||||
"albert:+eSv8F63uj94A0fvmdyPcDDH0qI3CYR91fsbA/eLFGw="
|
|
||||||
];
|
];
|
||||||
trusted-users = [ "root" "@wheel" ];
|
trusted-users = [ "root" "@wheel" ];
|
||||||
};
|
};
|
||||||
@@ -45,20 +45,6 @@ rec {
|
|||||||
];
|
];
|
||||||
defaultModules = baseModules;
|
defaultModules = baseModules;
|
||||||
|
|
||||||
makeNetwork = network: [{
|
|
||||||
systemd.network.enable = true;
|
|
||||||
|
|
||||||
systemd.network.networks."20-lan" = {
|
|
||||||
matchConfig.Type = "ether";
|
|
||||||
networkConfig = {
|
|
||||||
Address = [ "${network.address}/24" ];
|
|
||||||
Gateway = "${network.gateway}";
|
|
||||||
DNS = network.nameservers;
|
|
||||||
DHCP = "no";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}];
|
|
||||||
|
|
||||||
makeMicroVM = hostName: network: modules: [
|
makeMicroVM = hostName: network: modules: [
|
||||||
{
|
{
|
||||||
microvm = {
|
microvm = {
|
||||||
@@ -103,6 +89,18 @@ rec {
|
|||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
systemd.network.enable = true;
|
||||||
|
|
||||||
|
systemd.network.networks."20-lan" = {
|
||||||
|
matchConfig.Type = "ether";
|
||||||
|
networkConfig = {
|
||||||
|
Address = [ "${network.address}/24" ];
|
||||||
|
Gateway = "${network.gateway}";
|
||||||
|
DNS = network.nameservers;
|
||||||
|
DHCP = "no";
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
] ++ defaultModules ++ modules;
|
] ++ defaultModules ++ modules;
|
||||||
|
|
||||||
@@ -261,9 +259,9 @@ rec {
|
|||||||
specialArgs.inputs = inputsMod;
|
specialArgs.inputs = inputsMod;
|
||||||
specialArgs.self = self;
|
specialArgs.self = self;
|
||||||
modules = (if (settings.type != "microvm") then
|
modules = (if (settings.type != "microvm") then
|
||||||
(makeNetwork settings.network) ++ defaultModules ++ [ ../${host}/configuration.nix ]
|
defaultModules ++ [ ../${host}/configuration.nix ]
|
||||||
else
|
else
|
||||||
(makeNetwork settings.network) ++ makeMicroVM "${host}" settings.network [
|
makeMicroVM "${host}" settings.network [
|
||||||
inputs.microvm.nixosModules.microvm
|
inputs.microvm.nixosModules.microvm
|
||||||
../${host}/configuration.nix
|
../${host}/configuration.nix
|
||||||
]);
|
]);
|
||||||
|
|||||||
@@ -65,11 +65,4 @@
|
|||||||
allowedIPs = [ "10.100.0.20/32" ];
|
allowedIPs = [ "10.100.0.20/32" ];
|
||||||
publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
|
publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
|
||||||
};
|
};
|
||||||
|
|
||||||
"ns1" = {
|
|
||||||
role = "client";
|
|
||||||
address = "10.100.0.21";
|
|
||||||
allowedIPs = [ "10.100.0.21/32" ];
|
|
||||||
publicKey = "jozMsP5MA2uz7eOrXG8LB8mr2tHVa6FL1+tbMQs9ySk=";
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -72,7 +72,6 @@ in
|
|||||||
mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
|
mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
|
||||||
address = [ "${myPeer.address}/24" ];
|
address = [ "${myPeer.address}/24" ];
|
||||||
autostart = cfg.autostart;
|
autostart = cfg.autostart;
|
||||||
dns = [peers.ns1.address];
|
|
||||||
listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
|
listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
|
||||||
|
|
||||||
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
|
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
|
||||||
|
|||||||
@@ -1,64 +0,0 @@
|
|||||||
wg_private: ENC[AES256_GCM,data:KnlCYE1/WjhNLfazuKViiVKZLPqQHwwqX1o2Irxaoj6oa54s6vBoiHVste4=,iv:ZAqdUSGwzbrLjskAntzmcNCcIjyePG+awYRkSgi6tZg=,tag:vllLI+0dbuFlkcdaYsBqYQ==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSDdNMUxFRGROR2YwN0Vn
|
|
||||||
SjlqVXV5SmVwOXdWcmgrOUswNnB6YitYeTJvClcrVk53d1FBUndSQWgxRVVySnFl
|
|
||||||
bVp4R3hHWmtGQW9lWER4L0tmTzdjc00KLS0tIFJRUHlMMGlvOVplTGNGNUo3NWNw
|
|
||||||
azVxT1hPUUZ4Wmc4QjNGcEtUcDFqd1kKZU2LEJsStdOspRE1CmbXevkQDfPHTuWp
|
|
||||||
k4AOM/W2T1Jz70pPl4M+Xg8oCJ5TNaURnvCxuiaBgAtQuZC7OR/Pnw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
|
||||||
- enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMlE1bGVyWkdOOHdja1pM
|
|
||||||
OUhRU2VCVDhEZ3kxVDRzb0Z4YUxOeFZFTVdJCjlWd2NlUmcwU3dQb1pMT2U0a1ZO
|
|
||||||
Zk5HNVJtQWREMWpXVG9ZVkd2QkVjeVkKLS0tIHBXbDUrcjl5VXNXT3JPTThIYVFa
|
|
||||||
TEtTb1pNUjVUM3dBVFRJMUpnNng2bEkKBfxqOkJ4R4RMl4AYMmFXq0dYeiH8UuwB
|
|
||||||
1ozr78TT5ksdRHuYmOyJzAG3Q14tK/+h1tcSmh5bXIZtuzJzZKN4kw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
|
||||||
lastmodified: "2026-09-10T15:02:33Z"
|
|
||||||
mac: ENC[AES256_GCM,data:e03qvt+6PI5FsKtV4aK1XhX1RCzzsvAf42/NOau5kEa0pRaSM+ajTJSD+06oC35gBYwB3w9Hq1ubFZVvZM3vgqITSNzCNJr7ft6LI48Srq0VjtKoGmjKqETYTTSNhbisNCI+sU13pdV18BESHE5eIGY/0KHcSeF1vG7Ys2DMTwM=,iv:cmfCkTMj5+NxWgBIthg2MaG39CYOsZdqTOMszOiOmY0=,tag:a4ooDhkCtLZm/s1O0tNGug==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2026-09-10T15:02:19Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQGMA5HdvEwzh/H7AQv/Wz+3/F+/IPsaVUZbJ6GB8V5HkowP7KCzWJOxwY3B3Yhl
|
|
||||||
H4Qir6G6aT2CpD5hHy+zEFw7s5t+MILybyzMZqNocjuQWIrF/YIYUbTDKK6rgSzC
|
|
||||||
tx0E6DcndBf69eK2wL8Um19/boB+MTN3DQSUom6Jpvg7WGo0NjtDexAqwSpJwFFF
|
|
||||||
di2DoUDHyTUUdHTcD+hfODTiQYC7cp51hZ6n3JACu1toGNfre1A/PtoSOTYP9i2p
|
|
||||||
aIIWBSciT4K1RJnIhV4fpU7wh7gi0O4xS1XZnTQ/SOA26sHp8wObLvi3TwF5AKum
|
|
||||||
dYyuCinJGMep7VBjBf7eJ73TI4CD1QM+MEQTzegPVlo54LvqSqwp8ZwHdIZi9gQ4
|
|
||||||
3Vku2hGSOI9SmOjOR5GGEYfJS3BbbF9rJCnamBhZVVO5lXbFtZqWi0JOu8U4Esnw
|
|
||||||
DTzLDOJpajEo7YxADD7yyLlFXDRtMNgU91hCjBLz76SgExI3avWq3Mm+KZXI4xCt
|
|
||||||
L0yENHriidkFR2T/uV4w0lYBAPOSvPnvxK92VEa1oDrhIjcFd0JwH/XsrYq/nih6
|
|
||||||
4PBf4U5DdO+ulJOj6MXV0QmsZXMObX8LWh6myufRTPIPl6wA5SeSvleDuiWQKYdW
|
|
||||||
j0rqALTicw==
|
|
||||||
=mpXh
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
|
||||||
- created_at: "2026-09-10T15:02:19Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA98TrrsQEbXUAQ/9EqodWqh61g7Uv1L/oF8PMMsONmprOg+17Xvn33xI8Pam
|
|
||||||
SjiEaGh8qZRJckFPdWgw1QNfpzFnEjpJEYMQ46oHJxlLMd5T4eqOTHbmPC3IAktm
|
|
||||||
lg3yYRmHEhyrngmQPTnoKuNQg6YDhzorHsfD98Tf0zA0B9AGCukgDZoEUs2oXwsY
|
|
||||||
PiZYcTcgB8z/8petU9YlieO7frm17Srso5JfOfIlu88vtlAeu3z8LZl5iKl34Lxz
|
|
||||||
+2TGAz/6YTYx24Tmj9qWpRYYPpbnQNUTkm+D9eDts6Pz1SFY/cerd1Q0Do8apIo7
|
|
||||||
dO1gz0C2dhh6QvGAovH7k0fS+bH3N1qpqbzmLQfMArXytQVZg1Ucisk9VYkS9XEE
|
|
||||||
dV0TVTOOEyq8rOzmZHfhVqGv+VsAMQXdcgsCRJ8HDLDWlDAOnuIX86NvlNmDHuZu
|
|
||||||
9jMqCq+cmf7W0sZdamHLM/T3IXs0oJJc4YvyFAlPTPdbGHICQ1rWDLXvICIXiifg
|
|
||||||
LzkbK0XjxG+fDCzKzMXJ/gho7KHOut/+Kf5+hQNMnoPZ3/MeDJEyAHKBEsTI/CYe
|
|
||||||
9qla0CJnUVNRHDnc99qMeSeD7p6OLZsO4cANTSEnz0eiyZoJKa2m8du1TTtxIzCt
|
|
||||||
Jcu1yFana7MX68ppxlqkfd7iSPyGo9d7DcPO9lFscNQ9yIPiGReZ8Ow7KSlu37LS
|
|
||||||
VgFsGneFVfYYk6SnW9SOtooNAFNL9sWxqiWjb3fxfGeIuOF7LJqmevx7SU8V5eAt
|
|
||||||
nCqGZZg/YCAecjTDHi8Yy5ly2LrNjF6yOhUtYifW6yBJB2UEQdDE
|
|
||||||
=mUhm
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.13.1
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
wg_private: ENC[AES256_GCM,data:KjuXpIBnp/LVjOvaSk0vZEF3vOcq0y7cnEohYMFAHnnJK+TiGt3+ESkF08c=,iv:zlWkp9blv2KmIpXEOQRqle2voHIS/EhTVuWKJQ/qowY=,tag:nOUDEcwKODx8G8p7jWPA2w==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa0ticWhrdXRNa094MEoz
|
|
||||||
ZmJiYTJoSTFHUnFpakJuc1NCTjZlN2kzazBzClRYb3B6YUozMUxFY09wdHNsK3No
|
|
||||||
eWVBSUU2bUd5M2Z5WjVjWnpxcjFBTHcKLS0tIDBESUtRQVkzRVp5MGYwVER1aDFE
|
|
||||||
dGl4bXlDTkhNVWM3R1Y4aDVabnYrd2cKCuLUw7SP/pyDJbmq/ADRvH7EfDVlYItW
|
|
||||||
rU2b1KTyI4JpVK6/OLN2leSioYzqiE3ONewC9CMMrluCWwNEKmLiUg==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
recipient: age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
|
|
||||||
- enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaEV0WkI4Y2JoV0IzTlNj
|
|
||||||
SkFGVTQ1ZG1VNzdtK0xTWFZRS0FTY1Y1MlZvCjdhYk9UWWtUWC9MNUwybVhZSzhI
|
|
||||||
bjhydVVkK01zcmZZampEVW16L0dWRzAKLS0tIDhpK2YrTEtPYmVsUHExdnA4WHRa
|
|
||||||
Y1JUT1VQMmdRUnl1b0NGOEFsNlR1VGcKOR35LVxYuGw8HOWwQ+ODN9y4I9FHq3lg
|
|
||||||
1vDrSI3JBfRuU2G/OXbkV6bNPH9KnzgXxUEOWkZmamrcwtIGldfh9Q==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
|
||||||
lastmodified: "2026-09-10T15:02:04Z"
|
|
||||||
mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2026-09-11T18:55:59Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQGMA5HdvEwzh/H7AQv/cD7baU+5Ujkrf5jUdn4HSPtVW/KkeW0Mw7uQmd7bI5sp
|
|
||||||
n3iekWWTOpCv98lNdCMXn+iV1BL37ILPOYSXsjxw2vfKjGfgWkkwpFdcLUiS7Qnm
|
|
||||||
ymGVIPyqHDJRqhxxhiR5B1aC7AhR+otkULNzKSSgYZa+Rj8DlFwW07aknJDSeZM0
|
|
||||||
yy70RTxCGgH/4amYZN+QLOJapjGX4FMvJeG+y0vv65GinMmjkQ7B5z3rKUiKbud8
|
|
||||||
mjPgMIfxcBo5o5vepld315atoZQX+kCIgJPU3rQshTobgwQD+uVZo/ocGHVdZWra
|
|
||||||
eVOpKZYO4ecQJ8xRvSMNSrXRmeW/a6h7NhHN2kD74Ms1xB8cuhYklCz8gWd50yyo
|
|
||||||
7kTG8wBPnvvkx4SSgFwvnj1hnppUweFUM64JBHXrjQWeDof1FPC18kiNTAQGwAOL
|
|
||||||
UiI4Yka0d1zLl1vpdBN8E17jBqfi2CSLB9wL3IbD5CTYAprzzvptfXI2Ubqq82c1
|
|
||||||
Np71LvSaBYA4SPNJ2EZB0lYBtkjGzUw8L9Kuod5UwXTeJQ2vbhpYpqHzjWrmWvK/
|
|
||||||
VlCzVV+AYfOQUVvmbYf+DtowO/wCS8n2gVepyOoMCcEnRT9lqm7ndC/ozt+iZove
|
|
||||||
vDcSGqKuUg==
|
|
||||||
=oEsA
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
|
||||||
- created_at: "2026-09-11T18:55:59Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA98TrrsQEbXUAQ//fciJkmAmvlAHzZxO2CTCFkNNn+aSpkH/IoNRKfEIJDtf
|
|
||||||
wAChdactP8yq6qKxSqv3Ks90K+hQRQr6tXpF652NDFYkP2CHsEo0wbOAgcqFzGtY
|
|
||||||
92MenPwOKP6B9UTvm0ZqVFet7/jmQBatXMzFWsSkUCBqWXAg/UUrJVf/zbGoHwB7
|
|
||||||
efskMTrkArlxhoY/3+/0bMeEqZJlhm9UmlAST1/xNlI4DUYhlBxnzA2vgi8QWBFT
|
|
||||||
6+QkZ2YiM0IlDCUbe920c1ad0/McV8Bj6jccW1ZBISXk9KYQq41PBjQKhyKoC/Xc
|
|
||||||
xJLcxy1NeUZWlPSFF05TTWaRUkBH8YZm7vum5xWdT1lz6FrHB+aNHr9XxKj5c7pp
|
|
||||||
bLAQ2PfG0kK/kemNBKd9/Q5r2SfEUbmI+cGLbqkaZwbhD0ThMmEkMxdGwzzrf2Wq
|
|
||||||
Lhpkj+2zx37r6GI8UlBp9jhUbhj1N9HetyjBhKzEcxqCEg4DXNiKRiXvMvCg6sCz
|
|
||||||
kIKsmNDhbmt0jKNL8NJio10lo4+S2gPi8jg6mcj4RDkS8zC95P/EHkNZl2aQwBRU
|
|
||||||
/GLzzpODa41ZZB9+WC68vMZudSQwHK0c7SNoEc5putlbUjKDSpJHY4manF6O4rG2
|
|
||||||
FZNG8TA8VeEg6wjBPkBw5ardM//E5r0iFfx2IjrCjhNoaknc5aPRZ96XqY/5TqbS
|
|
||||||
VgGRpWs5jaQv4CbRA0yAHqFrGgSRFY0wCFT5Hkwi7wyGyxR5Y30jISsn+kU8ysHV
|
|
||||||
OGZFCDl7tRvL9ICJheXWS61k5LNd4H8rAMqXoPbSvtU/KC/hfRMk
|
|
||||||
=ZdHS
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.13.1
|
|
||||||
@@ -1,78 +0,0 @@
|
|||||||
modules:
|
|
||||||
http_2xx:
|
|
||||||
prober: http
|
|
||||||
http:
|
|
||||||
preferred_ip_protocol: "ip4"
|
|
||||||
http_post_2xx:
|
|
||||||
prober: http
|
|
||||||
http:
|
|
||||||
method: POST
|
|
||||||
tcp_connect:
|
|
||||||
prober: tcp
|
|
||||||
pop3s_banner:
|
|
||||||
prober: tcp
|
|
||||||
tcp:
|
|
||||||
query_response:
|
|
||||||
- expect: "^+OK"
|
|
||||||
tls: true
|
|
||||||
tls_config:
|
|
||||||
insecure_skip_verify: false
|
|
||||||
grpc:
|
|
||||||
prober: grpc
|
|
||||||
grpc:
|
|
||||||
tls: true
|
|
||||||
preferred_ip_protocol: "ip4"
|
|
||||||
grpc_plain:
|
|
||||||
prober: grpc
|
|
||||||
grpc:
|
|
||||||
tls: false
|
|
||||||
service: "service1"
|
|
||||||
ssh_banner:
|
|
||||||
prober: tcp
|
|
||||||
tcp:
|
|
||||||
query_response:
|
|
||||||
- expect: "^SSH-2.0-"
|
|
||||||
- send: "SSH-2.0-blackbox-ssh-check"
|
|
||||||
ssh_banner_extract:
|
|
||||||
prober: tcp
|
|
||||||
timeout: 5s
|
|
||||||
tcp:
|
|
||||||
query_response:
|
|
||||||
- expect: "^SSH-2.0-([^ -]+)(?: (.*))?$"
|
|
||||||
labels:
|
|
||||||
- name: ssh_version
|
|
||||||
value: "${1}"
|
|
||||||
- name: ssh_comments
|
|
||||||
value: "${2}"
|
|
||||||
irc_banner:
|
|
||||||
prober: tcp
|
|
||||||
tcp:
|
|
||||||
query_response:
|
|
||||||
- send: "NICK prober"
|
|
||||||
- send: "USER prober prober prober :prober"
|
|
||||||
- expect: "PING :([^ ]+)"
|
|
||||||
send: "PONG ${1}"
|
|
||||||
- expect: "^:[^ ]+ 001"
|
|
||||||
icmp:
|
|
||||||
prober: icmp
|
|
||||||
icmp_ttl5:
|
|
||||||
prober: icmp
|
|
||||||
timeout: 5s
|
|
||||||
icmp:
|
|
||||||
ttl: 5
|
|
||||||
websocket:
|
|
||||||
prober: websocket
|
|
||||||
http_3xx:
|
|
||||||
prober: http
|
|
||||||
http:
|
|
||||||
preferred_ip_protocol: "ip4"
|
|
||||||
enable_http3: true
|
|
||||||
enable_http2: false
|
|
||||||
valid_http_versions: ["HTTP/3.0"]
|
|
||||||
postgresql:
|
|
||||||
prober: tcp
|
|
||||||
tcp:
|
|
||||||
query_response:
|
|
||||||
- send: !!binary AAAACATSFi8= # 0x00, 0x00, 0x00, 0x08, 0x04, 0xD2, 0x16, 0x2F - PostgreSQL SSLRequest
|
|
||||||
- expect_bytes: S # 0x53 - Reply will be 'S' if SSL is enabled, and 'N' if it is not.
|
|
||||||
- starttls: true
|
|
||||||
@@ -108,58 +108,7 @@ in
|
|||||||
retentionTime = "1y";
|
retentionTime = "1y";
|
||||||
port = 9001;
|
port = 9001;
|
||||||
|
|
||||||
exporters.blackbox = {
|
|
||||||
enable = true;
|
|
||||||
configFile = ./blackbox.yaml;
|
|
||||||
};
|
|
||||||
|
|
||||||
scrapeConfigs = [
|
scrapeConfigs = [
|
||||||
{
|
|
||||||
job_name = "blackbox-http";
|
|
||||||
metrics_path = "/probe";
|
|
||||||
params = {
|
|
||||||
module = ["http_2xx"];
|
|
||||||
};
|
|
||||||
static_configs = [{
|
|
||||||
targets = [
|
|
||||||
"https://malobeo.org"
|
|
||||||
"https://cloud.malobeo.org"
|
|
||||||
"https://antamap.malobeo.org"
|
|
||||||
"https://docs.malobeo.org"
|
|
||||||
"https://events.malobeo.org"
|
|
||||||
"https://hydra.malobeo.org"
|
|
||||||
"https://keys.malobeo.org"
|
|
||||||
"https://tasklist.malobeo.org"
|
|
||||||
"https://zines.malobeo.org"
|
|
||||||
];
|
|
||||||
}];
|
|
||||||
relabel_configs = [
|
|
||||||
{
|
|
||||||
source_labels = ["__address__"];
|
|
||||||
target_label = "__param_target";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
source_labels = ["__param_target"];
|
|
||||||
target_label = "instance";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
target_label = "__address__";
|
|
||||||
replacement = "127.0.0.1:9115";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
job_name = "hydra";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "${hosts.malobeo.hosts.albert.network.address}:9199" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
job_name = "hydra-queue-runner";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "${hosts.malobeo.hosts.albert.network.address}:9198" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
{
|
{
|
||||||
job_name = "overwatch";
|
job_name = "overwatch";
|
||||||
static_configs = [{
|
static_configs = [{
|
||||||
@@ -214,12 +163,6 @@ in
|
|||||||
targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
|
targets = [ "${hosts.malobeo.hosts.fanny.network.address}:9002" ];
|
||||||
}];
|
}];
|
||||||
}
|
}
|
||||||
{
|
|
||||||
job_name = "albert";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
# add vpn - check how to reach it first. most probably 10.100.0.1
|
# add vpn - check how to reach it first. most probably 10.100.0.1
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -51,6 +51,7 @@ in
|
|||||||
services.acpid.enable = true;
|
services.acpid.enable = true;
|
||||||
|
|
||||||
networking.hostName = "testvm";
|
networking.hostName = "testvm";
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
|
||||||
time.timeZone = "Europe/Berlin";
|
time.timeZone = "Europe/Berlin";
|
||||||
system.stateVersion = "23.05"; # Do.. Not.. Change..
|
system.stateVersion = "23.05"; # Do.. Not.. Change..
|
||||||
|
|||||||
@@ -1,139 +0,0 @@
|
|||||||
{ config, lib, pkgs, inputs, ... }:
|
|
||||||
|
|
||||||
# 1. copy wp folder to host
|
|
||||||
# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
|
|
||||||
# 3. create user through webinterface
|
|
||||||
# 4. delete hello world post
|
|
||||||
# 5. run importer
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
|
|
||||||
user = "wordpress";
|
|
||||||
stateDir = "/var/lib/wordpress/rm16bleibt.org";
|
|
||||||
webserver = config.services.nginx;
|
|
||||||
uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
|
|
||||||
fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
|
|
||||||
|
|
||||||
in {
|
|
||||||
networking = {
|
|
||||||
hostName = mkDefault "wordpress";
|
|
||||||
useDHCP = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
imports = [
|
|
||||||
inputs.self.nixosModules.malobeo.users
|
|
||||||
../modules/sshd.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
malobeo.users = {
|
|
||||||
malobeo = false;
|
|
||||||
admin = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
users.users.wordpress = {
|
|
||||||
group = webserver.group;
|
|
||||||
isSystemUser = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [
|
|
||||||
"d '${stateDir}' 0750 ${user} ${webserver.group} - -"
|
|
||||||
"d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
|
|
||||||
"d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
|
|
||||||
"Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
|
|
||||||
"d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
|
|
||||||
"Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.phpfpm.pools = {
|
|
||||||
"wordpress-rm16bleibt.org" = {
|
|
||||||
user = user;
|
|
||||||
group = webserver.group;
|
|
||||||
settings = {
|
|
||||||
"pm" = "dynamic";
|
|
||||||
"pm.max_children" = 32;
|
|
||||||
"pm.start_servers" = 2;
|
|
||||||
"pm.min_spare_servers" = 2;
|
|
||||||
"pm.max_spare_servers" = 4;
|
|
||||||
"pm.max_requests" = 500;
|
|
||||||
"listen.owner" = webserver.user;
|
|
||||||
"listen.group" = webserver.group;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.mysql = {
|
|
||||||
enable = true;
|
|
||||||
#package = mkDefault pkgs.mariadb;
|
|
||||||
package = pkgs.mysql84;
|
|
||||||
ensureDatabases = ["wordpress"];
|
|
||||||
ensureUsers = [
|
|
||||||
{
|
|
||||||
name = "wordpress";
|
|
||||||
ensurePermissions = {
|
|
||||||
"wordpress.*" = "ALL PRIVILEGES";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts."rm16bleibt.org" = {
|
|
||||||
#serverName = "rm16bleibt.org";
|
|
||||||
root = "/var/lib/wordpress/rm16bleibt.org";
|
|
||||||
extraConfig = ''
|
|
||||||
index index.php;
|
|
||||||
'';
|
|
||||||
locations = {
|
|
||||||
"/" = {
|
|
||||||
priority = 200;
|
|
||||||
extraConfig = ''
|
|
||||||
try_files $uri $uri/ /index.php$is_args$args;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
"~ \\.php$" = {
|
|
||||||
priority = 500;
|
|
||||||
extraConfig = ''
|
|
||||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
|
||||||
fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
|
|
||||||
fastcgi_index index.php;
|
|
||||||
include "${config.services.nginx.package}/conf/fastcgi.conf";
|
|
||||||
fastcgi_param PATH_INFO $fastcgi_path_info;
|
|
||||||
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
|
|
||||||
|
|
||||||
# Mitigate https://httpoxy.org/ vulnerabilities
|
|
||||||
fastcgi_param HTTP_PROXY "";
|
|
||||||
fastcgi_intercept_errors off;
|
|
||||||
fastcgi_buffer_size 16k;
|
|
||||||
fastcgi_buffers 4 16k;
|
|
||||||
fastcgi_connect_timeout 300;
|
|
||||||
fastcgi_send_timeout 300;
|
|
||||||
fastcgi_read_timeout 300;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
"~ /\\." = {
|
|
||||||
priority = 800;
|
|
||||||
extraConfig = "deny all;";
|
|
||||||
};
|
|
||||||
"~* /(?:uploads|files)/.*\\.php$" = {
|
|
||||||
priority = 900;
|
|
||||||
extraConfig = "deny all;";
|
|
||||||
};
|
|
||||||
"~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
|
|
||||||
priority = 1000;
|
|
||||||
extraConfig = ''
|
|
||||||
expires max;
|
|
||||||
log_not_found off;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
|
||||||
|
|
||||||
system.stateVersion = "22.11"; # Did you read the comment?
|
|
||||||
}
|
|
||||||
|
|
||||||
Reference in New Issue
Block a user