nix fmt
This commit is contained in:
parent
3da42ead11
commit
9ea80639a3
216
data.nix
216
data.nix
|
@ -65,32 +65,45 @@ rec {
|
|||
jakstIP = "100.89.176.4";
|
||||
};
|
||||
"vno3-rp3b.servers.jakst" = rec {
|
||||
extraHostNames = [jakstIP];
|
||||
extraHostNames = [ jakstIP ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBudUFFEBpUVdr26vLJup8Hk6wj1iDbOPPQnJbv6GUGC";
|
||||
jakstIP = "100.89.176.2";
|
||||
};
|
||||
"fra1-a.servers.jakst" = rec {
|
||||
extraHostNames = ["fra1-a.jakstys.lt" publicIP jakstIP];
|
||||
extraHostNames = [
|
||||
"fra1-a.jakstys.lt"
|
||||
publicIP
|
||||
jakstIP
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFj9Ktw9SZQlHe/Pl5MI7PRUcCyTgZgZ0SsvWUmO0wBM";
|
||||
initrdPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtYwVhfmdHRK8YcaRQ3JGSIOK55lEMNSPh33Z0iI+pO";
|
||||
publicIP = "168.119.184.134";
|
||||
jakstIP = "100.89.176.5";
|
||||
system = "aarch64-linux";
|
||||
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
|
||||
supportedFeatures = [
|
||||
"nixos-test"
|
||||
"benchmark"
|
||||
"big-parallel"
|
||||
"kvm"
|
||||
"gccarch-armv8-a"
|
||||
];
|
||||
};
|
||||
"fwminex.motiejus.jakst" = rec {
|
||||
extraHostNames = [jakstIP vno1IP];
|
||||
extraHostNames = [
|
||||
jakstIP
|
||||
vno1IP
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
|
||||
jakstIP = "100.89.176.6";
|
||||
vno1IP = "192.168.189.10";
|
||||
};
|
||||
"mtworx.motiejus.jakst" = rec {
|
||||
extraHostNames = [jakstIP];
|
||||
extraHostNames = [ jakstIP ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRrsOkKkpJ9ZJYhEdxjwrmdVYoPcGDGtcGfBkkpVF6l";
|
||||
jakstIP = "100.89.176.20";
|
||||
};
|
||||
"vno1-vinc.vincentas.jakst" = rec {
|
||||
extraHostNames = [jakstIP];
|
||||
extraHostNames = [ jakstIP ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIwK7et5NBM+vaffiwpKLSAJwKfwMhCZwl1JyXo79uL";
|
||||
jakstIP = "100.89.176.7";
|
||||
};
|
||||
|
@ -118,15 +131,14 @@ rec {
|
|||
range = "100.89.176.0-100.89.191.255";
|
||||
sshPattern = "100.89.176.*"; # until we have more hosts
|
||||
};
|
||||
motiejus.cidrs = let
|
||||
mHosts =
|
||||
attrVals [
|
||||
motiejus.cidrs =
|
||||
let
|
||||
mHosts = attrVals [
|
||||
"mxp10.motiejus.jakst"
|
||||
"mtworx.motiejus.jakst"
|
||||
"fwminex.motiejus.jakst"
|
||||
]
|
||||
hosts;
|
||||
in
|
||||
] hosts;
|
||||
in
|
||||
builtins.catAttrs "jakstIP" mHosts;
|
||||
|
||||
vno1 = {
|
||||
|
@ -136,99 +148,103 @@ rec {
|
|||
vno3.cidr = "192.168.100.0/24";
|
||||
};
|
||||
|
||||
e11syncZone = let
|
||||
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
|
||||
fra1a = hosts."fra1-a.servers.jakst".publicIP;
|
||||
in ''
|
||||
$ORIGIN 11sync.net.
|
||||
$TTL 3600
|
||||
@ SOA ns1.11sync.net. motiejus.11sync.net. (2024011500 86400 86400 86400 86400)
|
||||
@ NS ns1.11sync.net.
|
||||
@ NS ns2.11sync.net.
|
||||
@ A ${vno1}
|
||||
@ TXT google-site-verification=nvUYd7_ShhPKvTn_Xbw-vPFONOhPeaYQsGp34DbV-80
|
||||
@ TXT "hosted-email-verify=qeuysotu"
|
||||
@ MX 10 aspmx1.migadu.com.
|
||||
@ MX 20 aspmx2.migadu.com.
|
||||
@ TXT "v=spf1 include:spf.migadu.com -all"
|
||||
ns1 A ${vno1}
|
||||
ns2 A ${fra1a}
|
||||
www A ${vno1}
|
||||
admin A ${hosts."fra1-a.servers.jakst".jakstIP}
|
||||
key1._domainkey CNAME key1.11sync.net._domainkey.migadu.com.
|
||||
key2._domainkey CNAME key2.11sync.net._domainkey.migadu.com.
|
||||
key3._domainkey CNAME key3.11sync.net._domainkey.migadu.com.
|
||||
_dmarc TXT "v=DMARC1; p=quarantine;"
|
||||
autoconfig CNAME autoconfig.migadu.com.
|
||||
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
|
||||
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
|
||||
_imaps._tcp SRV 0 1 993 imap.migadu.com.
|
||||
_pop3s._tcp SRV 0 1 995 pop.migadu.com.
|
||||
_github-challenge-11sync-org TXT "ff5e813c58"
|
||||
'';
|
||||
e11syncZone =
|
||||
let
|
||||
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
|
||||
fra1a = hosts."fra1-a.servers.jakst".publicIP;
|
||||
in
|
||||
''
|
||||
$ORIGIN 11sync.net.
|
||||
$TTL 3600
|
||||
@ SOA ns1.11sync.net. motiejus.11sync.net. (2024011500 86400 86400 86400 86400)
|
||||
@ NS ns1.11sync.net.
|
||||
@ NS ns2.11sync.net.
|
||||
@ A ${vno1}
|
||||
@ TXT google-site-verification=nvUYd7_ShhPKvTn_Xbw-vPFONOhPeaYQsGp34DbV-80
|
||||
@ TXT "hosted-email-verify=qeuysotu"
|
||||
@ MX 10 aspmx1.migadu.com.
|
||||
@ MX 20 aspmx2.migadu.com.
|
||||
@ TXT "v=spf1 include:spf.migadu.com -all"
|
||||
ns1 A ${vno1}
|
||||
ns2 A ${fra1a}
|
||||
www A ${vno1}
|
||||
admin A ${hosts."fra1-a.servers.jakst".jakstIP}
|
||||
key1._domainkey CNAME key1.11sync.net._domainkey.migadu.com.
|
||||
key2._domainkey CNAME key2.11sync.net._domainkey.migadu.com.
|
||||
key3._domainkey CNAME key3.11sync.net._domainkey.migadu.com.
|
||||
_dmarc TXT "v=DMARC1; p=quarantine;"
|
||||
autoconfig CNAME autoconfig.migadu.com.
|
||||
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
|
||||
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
|
||||
_imaps._tcp SRV 0 1 993 imap.migadu.com.
|
||||
_pop3s._tcp SRV 0 1 995 pop.migadu.com.
|
||||
_github-challenge-11sync-org TXT "ff5e813c58"
|
||||
'';
|
||||
|
||||
jakstysLTZone = let
|
||||
fra1a = hosts."fra1-a.servers.jakst".publicIP;
|
||||
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
|
||||
in ''
|
||||
$ORIGIN jakstys.lt.
|
||||
$TTL 86400
|
||||
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023100800 86400 86400 86400 86400)
|
||||
@ NS ns1.jakstys.lt.
|
||||
@ NS ns2.jakstys.lt.
|
||||
@ A ${vno1}
|
||||
www A ${vno1}
|
||||
ns1 A ${vno1}
|
||||
ns2 A ${fra1a}
|
||||
vpn A ${vno1}
|
||||
git A ${vno1}
|
||||
auth A ${vno1}
|
||||
dl A ${vno1}
|
||||
fra1-a A ${fra1a}
|
||||
vno1 A ${vno1}
|
||||
jakstysLTZone =
|
||||
let
|
||||
fra1a = hosts."fra1-a.servers.jakst".publicIP;
|
||||
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
|
||||
in
|
||||
''
|
||||
$ORIGIN jakstys.lt.
|
||||
$TTL 86400
|
||||
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023100800 86400 86400 86400 86400)
|
||||
@ NS ns1.jakstys.lt.
|
||||
@ NS ns2.jakstys.lt.
|
||||
@ A ${vno1}
|
||||
www A ${vno1}
|
||||
ns1 A ${vno1}
|
||||
ns2 A ${fra1a}
|
||||
vpn A ${vno1}
|
||||
git A ${vno1}
|
||||
auth A ${vno1}
|
||||
dl A ${vno1}
|
||||
fra1-a A ${fra1a}
|
||||
vno1 A ${vno1}
|
||||
|
||||
@ TXT google-site-verification=sU99fmO8gEJF-0lbOY-IzkovC6MXsP3Gozqrs8BR5OM
|
||||
@ TXT hosted-email-verify=rvyd6h64
|
||||
@ MX 10 aspmx1.migadu.com.
|
||||
@ MX 20 aspmx2.migadu.com.
|
||||
* MX 10 aspmx1.migadu.com.
|
||||
* MX 20 aspmx2.migadu.com.
|
||||
key1._domainkey CNAME key1.jakstys.lt._domainkey.migadu.com.
|
||||
key2._domainkey CNAME key2.jakstys.lt._domainkey.migadu.com.
|
||||
key3._domainkey CNAME key3.jakstys.lt._domainkey.migadu.com.
|
||||
@ TXT "v=spf1 include:spf.migadu.com -all"
|
||||
_dmarc TXT "v=DMARC1; p=quarantine;"
|
||||
* MX 10 aspmx1.migadu.com.
|
||||
* MX 20 aspmx2.migadu.com.
|
||||
autoconfig CNAME autoconfig.migadu.com.
|
||||
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
|
||||
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
|
||||
_imaps._tcp SRV 0 1 993 imap.migadu.com.
|
||||
_pop3s._tcp SRV 0 1 995 imap.migadu.com.
|
||||
@ TXT google-site-verification=sU99fmO8gEJF-0lbOY-IzkovC6MXsP3Gozqrs8BR5OM
|
||||
@ TXT hosted-email-verify=rvyd6h64
|
||||
@ MX 10 aspmx1.migadu.com.
|
||||
@ MX 20 aspmx2.migadu.com.
|
||||
* MX 10 aspmx1.migadu.com.
|
||||
* MX 20 aspmx2.migadu.com.
|
||||
key1._domainkey CNAME key1.jakstys.lt._domainkey.migadu.com.
|
||||
key2._domainkey CNAME key2.jakstys.lt._domainkey.migadu.com.
|
||||
key3._domainkey CNAME key3.jakstys.lt._domainkey.migadu.com.
|
||||
@ TXT "v=spf1 include:spf.migadu.com -all"
|
||||
_dmarc TXT "v=DMARC1; p=quarantine;"
|
||||
* MX 10 aspmx1.migadu.com.
|
||||
* MX 20 aspmx2.migadu.com.
|
||||
autoconfig CNAME autoconfig.migadu.com.
|
||||
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
|
||||
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
|
||||
_imaps._tcp SRV 0 1 993 imap.migadu.com.
|
||||
_pop3s._tcp SRV 0 1 995 imap.migadu.com.
|
||||
|
||||
grafana A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.grafana CNAME _acme-endpoint.grafana
|
||||
_acme-endpoint.grafana NS ns._acme-endpoint.grafana
|
||||
ns._acme-endpoint.grafana A ${vno1}
|
||||
grafana A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.grafana CNAME _acme-endpoint.grafana
|
||||
_acme-endpoint.grafana NS ns._acme-endpoint.grafana
|
||||
ns._acme-endpoint.grafana A ${vno1}
|
||||
|
||||
irc A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.irc CNAME _acme-endpoint.irc
|
||||
_acme-endpoint.irc NS ns._acme-endpoint.irc
|
||||
ns._acme-endpoint.irc A ${vno1}
|
||||
irc A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.irc CNAME _acme-endpoint.irc
|
||||
_acme-endpoint.irc NS ns._acme-endpoint.irc
|
||||
ns._acme-endpoint.irc A ${vno1}
|
||||
|
||||
hass A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.hass CNAME _acme-endpoint.hass
|
||||
_acme-endpoint.hass NS ns._acme-endpoint.hass
|
||||
ns._acme-endpoint.hass A ${vno1}
|
||||
hass A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.hass CNAME _acme-endpoint.hass
|
||||
_acme-endpoint.hass NS ns._acme-endpoint.hass
|
||||
ns._acme-endpoint.hass A ${vno1}
|
||||
|
||||
bitwarden A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.bitwarden CNAME _acme-endpoint.bitwarden
|
||||
_acme-endpoint.bitwarden NS ns._acme-endpoint.bitwarden
|
||||
ns._acme-endpoint.bitwarden A ${vno1}
|
||||
bitwarden A ${hosts."vno1-oh2.servers.jakst".jakstIP}
|
||||
_acme-challenge.bitwarden CNAME _acme-endpoint.bitwarden
|
||||
_acme-endpoint.bitwarden NS ns._acme-endpoint.bitwarden
|
||||
ns._acme-endpoint.bitwarden A ${vno1}
|
||||
|
||||
hdd A ${hosts."vno3-rp3b.servers.jakst".jakstIP}
|
||||
_acme-challenge.hdd CNAME _acme-endpoint.hdd
|
||||
_acme-endpoint.hdd NS ns._acme-endpoint.hdd
|
||||
ns._acme-endpoint.hdd A ${vno1}
|
||||
'';
|
||||
hdd A ${hosts."vno3-rp3b.servers.jakst".jakstIP}
|
||||
_acme-challenge.hdd CNAME _acme-endpoint.hdd
|
||||
_acme-endpoint.hdd NS ns._acme-endpoint.hdd
|
||||
ns._acme-endpoint.hdd A ${vno1}
|
||||
'';
|
||||
}
|
||||
|
|
235
flake.nix
235
flake.nix
|
@ -61,65 +61,68 @@
|
|||
extra-experimental-features = "nix-command flakes";
|
||||
};
|
||||
|
||||
outputs = {
|
||||
self,
|
||||
nixpkgs,
|
||||
nixpkgs-unstable,
|
||||
agenix,
|
||||
deploy-rs,
|
||||
flake-utils,
|
||||
home-manager,
|
||||
nixos-hardware,
|
||||
nix-index-database,
|
||||
pre-commit-hooks,
|
||||
nur,
|
||||
nixgl,
|
||||
...
|
||||
} @ inputs: let
|
||||
myData = import ./data.nix;
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
nixpkgs-unstable,
|
||||
agenix,
|
||||
deploy-rs,
|
||||
flake-utils,
|
||||
home-manager,
|
||||
nixos-hardware,
|
||||
nix-index-database,
|
||||
pre-commit-hooks,
|
||||
nur,
|
||||
nixgl,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
myData = import ./data.nix;
|
||||
|
||||
overlays = [
|
||||
nur.overlay
|
||||
nixgl.overlay
|
||||
overlays = [
|
||||
nur.overlay
|
||||
nixgl.overlay
|
||||
|
||||
(_self: super: {deploy-rs-pkg = super.deploy-rs;})
|
||||
deploy-rs.overlay
|
||||
(_self: super: {
|
||||
deploy-rs = {
|
||||
deploy-rs = super.deploy-rs-pkg;
|
||||
inherit (super.deploy-rs) lib;
|
||||
(_self: super: { deploy-rs-pkg = super.deploy-rs; })
|
||||
deploy-rs.overlay
|
||||
(_self: super: {
|
||||
deploy-rs = {
|
||||
deploy-rs = super.deploy-rs-pkg;
|
||||
inherit (super.deploy-rs) lib;
|
||||
};
|
||||
deploy-rs-pkg = null;
|
||||
})
|
||||
(_: super: {
|
||||
compressDrv = super.callPackage ./pkgs/compress-drv { };
|
||||
compressDrvWeb = super.callPackage ./pkgs/compress-drv/web.nix { };
|
||||
|
||||
tmuxbash = super.callPackage ./pkgs/tmuxbash.nix { };
|
||||
btrfs-auto-snapshot = super.callPackage ./pkgs/btrfs-auto-snapshot.nix { };
|
||||
nicer = super.callPackage ./pkgs/nicer.nix { };
|
||||
|
||||
pkgs-unstable = import nixpkgs-unstable { inherit (super) system; };
|
||||
})
|
||||
];
|
||||
|
||||
mkVM =
|
||||
system:
|
||||
nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
./hosts/vm/configuration.nix
|
||||
|
||||
./modules
|
||||
./modules/profiles/desktop
|
||||
|
||||
home-manager.nixosModules.home-manager
|
||||
];
|
||||
specialArgs = {
|
||||
inherit myData;
|
||||
} // inputs;
|
||||
};
|
||||
deploy-rs-pkg = null;
|
||||
})
|
||||
(_: super: {
|
||||
compressDrv = super.callPackage ./pkgs/compress-drv {};
|
||||
compressDrvWeb = super.callPackage ./pkgs/compress-drv/web.nix {};
|
||||
|
||||
tmuxbash = super.callPackage ./pkgs/tmuxbash.nix {};
|
||||
btrfs-auto-snapshot = super.callPackage ./pkgs/btrfs-auto-snapshot.nix {};
|
||||
nicer = super.callPackage ./pkgs/nicer.nix {};
|
||||
|
||||
pkgs-unstable = import nixpkgs-unstable {
|
||||
inherit (super) system;
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
mkVM = system:
|
||||
nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
{nixpkgs.overlays = overlays;}
|
||||
./hosts/vm/configuration.nix
|
||||
|
||||
./modules
|
||||
./modules/profiles/desktop
|
||||
|
||||
home-manager.nixosModules.home-manager
|
||||
];
|
||||
specialArgs = {inherit myData;} // inputs;
|
||||
};
|
||||
in
|
||||
in
|
||||
{
|
||||
nixosConfigurations = {
|
||||
vm-x86_64 = mkVM "x86_64-linux";
|
||||
|
@ -128,7 +131,7 @@
|
|||
mtworx = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
{nixpkgs.overlays = overlays;}
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
./hosts/mtworx/configuration.nix
|
||||
home-manager.nixosModules.home-manager
|
||||
nixos-hardware.nixosModules.lenovo-thinkpad-x1-11th-gen
|
||||
|
@ -147,13 +150,15 @@
|
|||
}
|
||||
];
|
||||
|
||||
specialArgs = {inherit myData;} // inputs;
|
||||
specialArgs = {
|
||||
inherit myData;
|
||||
} // inputs;
|
||||
};
|
||||
|
||||
vno1-oh2 = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
{nixpkgs.overlays = overlays;}
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
./hosts/vno1-oh2/configuration.nix
|
||||
./modules
|
||||
|
||||
|
@ -184,13 +189,15 @@
|
|||
}
|
||||
];
|
||||
|
||||
specialArgs = {inherit myData;} // inputs;
|
||||
specialArgs = {
|
||||
inherit myData;
|
||||
} // inputs;
|
||||
};
|
||||
|
||||
fwminex = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
{nixpkgs.overlays = overlays;}
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
./hosts/fwminex/configuration.nix
|
||||
home-manager.nixosModules.home-manager
|
||||
nixos-hardware.nixosModules.framework-12th-gen-intel
|
||||
|
@ -207,13 +214,15 @@
|
|||
}
|
||||
];
|
||||
|
||||
specialArgs = {inherit myData;} // inputs;
|
||||
specialArgs = {
|
||||
inherit myData;
|
||||
} // inputs;
|
||||
};
|
||||
|
||||
vno3-rp3b = nixpkgs.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
modules = [
|
||||
{nixpkgs.overlays = overlays;}
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
./hosts/vno3-rp3b/configuration.nix
|
||||
|
||||
./modules
|
||||
|
@ -232,13 +241,15 @@
|
|||
}
|
||||
];
|
||||
|
||||
specialArgs = {inherit myData;} // inputs;
|
||||
specialArgs = {
|
||||
inherit myData;
|
||||
} // inputs;
|
||||
};
|
||||
|
||||
fra1-a = nixpkgs.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
modules = [
|
||||
{nixpkgs.overlays = overlays;}
|
||||
{ nixpkgs.overlays = overlays; }
|
||||
agenix.nixosModules.default
|
||||
home-manager.nixosModules.home-manager
|
||||
|
||||
|
@ -256,7 +267,9 @@
|
|||
}
|
||||
];
|
||||
|
||||
specialArgs = {inherit myData;} // inputs;
|
||||
specialArgs = {
|
||||
inherit myData;
|
||||
} // inputs;
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -266,8 +279,7 @@
|
|||
profiles = {
|
||||
system = {
|
||||
sshUser = "motiejus";
|
||||
path =
|
||||
self.nixosConfigurations.vno1-oh2.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno1-oh2;
|
||||
path = self.nixosConfigurations.vno1-oh2.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno1-oh2;
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
|
@ -278,8 +290,7 @@
|
|||
profiles = {
|
||||
system = {
|
||||
sshUser = "motiejus";
|
||||
path =
|
||||
self.nixosConfigurations.fwminex.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fwminex;
|
||||
path = self.nixosConfigurations.fwminex.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fwminex;
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
|
@ -290,8 +301,7 @@
|
|||
profiles = {
|
||||
system = {
|
||||
sshUser = "motiejus";
|
||||
path =
|
||||
self.nixosConfigurations.mtworx.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.mtworx;
|
||||
path = self.nixosConfigurations.mtworx.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.mtworx;
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
|
@ -302,8 +312,7 @@
|
|||
profiles = {
|
||||
system = {
|
||||
sshUser = "motiejus";
|
||||
path =
|
||||
self.nixosConfigurations.vno3-rp3b.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno3-rp3b;
|
||||
path = self.nixosConfigurations.vno3-rp3b.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno3-rp3b;
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
|
@ -314,51 +323,55 @@
|
|||
profiles = {
|
||||
system = {
|
||||
sshUser = "motiejus";
|
||||
path =
|
||||
self.nixosConfigurations.fra1-a.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fra1-a;
|
||||
path = self.nixosConfigurations.fra1-a.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fra1-a;
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
checks =
|
||||
builtins.mapAttrs (
|
||||
system: deployLib:
|
||||
deployLib.deployChecks self.deploy
|
||||
// {
|
||||
pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
|
||||
src = ./.;
|
||||
hooks = {
|
||||
alejandra.enable = true;
|
||||
deadnix.enable = true;
|
||||
statix.enable = true;
|
||||
};
|
||||
checks = builtins.mapAttrs (
|
||||
system: deployLib:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system overlays; };
|
||||
in
|
||||
deployLib.deployChecks self.deploy
|
||||
// {
|
||||
pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
|
||||
src = ./.;
|
||||
hooks = {
|
||||
nixfmt = {
|
||||
enable = true;
|
||||
package = pkgs.nixfmt-rfc-style;
|
||||
};
|
||||
deadnix.enable = true;
|
||||
statix.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
compress-drv-test = let
|
||||
pkgs = import nixpkgs {inherit system overlays;};
|
||||
in
|
||||
pkgs.callPackage ./pkgs/compress-drv/test.nix {};
|
||||
}
|
||||
)
|
||||
deploy-rs.lib;
|
||||
compress-drv-test = pkgs.callPackage ./pkgs/compress-drv/test.nix { };
|
||||
}
|
||||
) deploy-rs.lib;
|
||||
}
|
||||
// flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = import nixpkgs {inherit system overlays;};
|
||||
in {
|
||||
devShells.default = pkgs.mkShellNoCC {
|
||||
GIT_AUTHOR_EMAIL = "motiejus@jakstys.lt";
|
||||
packages = [
|
||||
pkgs.nix-output-monitor
|
||||
pkgs.rage
|
||||
pkgs.age-plugin-yubikey
|
||||
pkgs.deploy-rs.deploy-rs
|
||||
agenix.packages.${system}.agenix
|
||||
];
|
||||
inherit (self.checks.${system}.pre-commit-check) shellHook;
|
||||
};
|
||||
// flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system overlays; };
|
||||
in
|
||||
{
|
||||
devShells.default = pkgs.mkShellNoCC {
|
||||
GIT_AUTHOR_EMAIL = "motiejus@jakstys.lt";
|
||||
packages = [
|
||||
pkgs.nix-output-monitor
|
||||
pkgs.rage
|
||||
pkgs.age-plugin-yubikey
|
||||
pkgs.deploy-rs.deploy-rs
|
||||
agenix.packages.${system}.agenix
|
||||
];
|
||||
inherit (self.checks.${system}.pre-commit-check) shellHook;
|
||||
};
|
||||
|
||||
formatter = pkgs.alejandra;
|
||||
});
|
||||
formatter = pkgs.nixfmt-rfc-style;
|
||||
}
|
||||
);
|
||||
}
|
||||
|
|
|
@ -4,25 +4,31 @@
|
|||
myData,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
|
||||
}:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
zfs-root = {
|
||||
boot = {
|
||||
enable = true;
|
||||
devNodes = "/dev/disk/by-id/";
|
||||
bootDevices = ["scsi-0QEMU_QEMU_HARDDISK_36151096"];
|
||||
bootDevices = [ "scsi-0QEMU_QEMU_HARDDISK_36151096" ];
|
||||
immutable = false;
|
||||
availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" "virtio_gpu"];
|
||||
availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"virtio_pci"
|
||||
"virtio_scsi"
|
||||
"usbhid"
|
||||
"sr_mod"
|
||||
"virtio_gpu"
|
||||
];
|
||||
removableEfi = true;
|
||||
kernelParams = ["console=tty"];
|
||||
kernelParams = [ "console=tty" ];
|
||||
sshUnlock = {
|
||||
enable = true;
|
||||
authorizedKeys =
|
||||
(builtins.attrValues myData.people_pubkeys)
|
||||
++ [
|
||||
myData.hosts."vno1-oh2.servers.jakst".publicKey
|
||||
];
|
||||
authorizedKeys = (builtins.attrValues myData.people_pubkeys) ++ [
|
||||
myData.hosts."vno1-oh2.servers.jakst".publicKey
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
@ -46,7 +52,7 @@
|
|||
|
||||
snapshot = {
|
||||
enable = true;
|
||||
mountpoints = ["/var/lib"];
|
||||
mountpoints = [ "/var/lib" ];
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -79,22 +85,24 @@
|
|||
];
|
||||
|
||||
enable = true;
|
||||
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
|
||||
sshAllowSubnets = [ myData.subnets.tailscale.sshPattern ];
|
||||
uidgid = myData.uidgid.updaterbot-deployee;
|
||||
};
|
||||
};
|
||||
|
||||
zfsunlock = {
|
||||
enable = false;
|
||||
targets."vno1-oh2.servers.jakst" = let
|
||||
host = myData.hosts."vno1-oh2.servers.jakst";
|
||||
in {
|
||||
sshEndpoint = host.publicIP;
|
||||
pingEndpoint = host.jakstIP;
|
||||
remotePubkey = host.initrdPubKey;
|
||||
pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
|
||||
startAt = "*-*-* *:00/5:00";
|
||||
};
|
||||
targets."vno1-oh2.servers.jakst" =
|
||||
let
|
||||
host = myData.hosts."vno1-oh2.servers.jakst";
|
||||
in
|
||||
{
|
||||
sshEndpoint = host.publicIP;
|
||||
pingEndpoint = host.jakstIP;
|
||||
remotePubkey = host.initrdPubKey;
|
||||
pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
|
||||
startAt = "*-*-* *:00/5:00";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
@ -120,7 +128,10 @@
|
|||
|
||||
nsd = {
|
||||
enable = true;
|
||||
interfaces = ["0.0.0.0" "::"];
|
||||
interfaces = [
|
||||
"0.0.0.0"
|
||||
"::"
|
||||
];
|
||||
zones = {
|
||||
"jakstys.lt.".data = myData.jakstysLTZone;
|
||||
"11sync.net.".data = myData.e11syncZone;
|
||||
|
@ -134,8 +145,16 @@
|
|||
domain = "servers.jakst";
|
||||
useDHCP = true;
|
||||
firewall = {
|
||||
allowedUDPPorts = [53 443];
|
||||
allowedTCPPorts = [22 53 80 443];
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
443
|
||||
];
|
||||
allowedTCPPorts = [
|
||||
22
|
||||
53
|
||||
80
|
||||
443
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
@ -3,20 +3,28 @@
|
|||
pkgs,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
nvme = "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NS0TA01331A_1";
|
||||
in {
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../../modules
|
||||
../../modules/profiles/btrfs
|
||||
];
|
||||
|
||||
boot = {
|
||||
kernelModules = ["kvm-intel"];
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
loader.systemd-boot.enable = true;
|
||||
initrd = {
|
||||
kernelModules = ["usb_storage"];
|
||||
availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usbhid" "tpm_tis"];
|
||||
kernelModules = [ "usb_storage" ];
|
||||
availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"thunderbolt"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"tpm_tis"
|
||||
];
|
||||
systemd.enableTpm2 = true;
|
||||
luks.devices = {
|
||||
luksroot = {
|
||||
|
@ -44,7 +52,7 @@ in {
|
|||
"/" = {
|
||||
device = "/dev/mapper/luksroot";
|
||||
fsType = "btrfs";
|
||||
options = ["compress=zstd"];
|
||||
options = [ "compress=zstd" ];
|
||||
};
|
||||
"/boot" = {
|
||||
device = "${nvme}-part1";
|
||||
|
@ -86,18 +94,20 @@ in {
|
|||
verboseLogs = false;
|
||||
};
|
||||
|
||||
remote-builder.client = let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in {
|
||||
enable = true;
|
||||
inherit (host) system supportedFeatures;
|
||||
hostName = host.jakstIP;
|
||||
sshKey = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
remote-builder.client =
|
||||
let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
inherit (host) system supportedFeatures;
|
||||
hostName = host.jakstIP;
|
||||
sshKey = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
|
||||
node_exporter = {
|
||||
enable = true;
|
||||
extraSubnets = [myData.subnets.vno1.cidr];
|
||||
extraSubnets = [ myData.subnets.vno1.cidr ];
|
||||
};
|
||||
|
||||
deployerbot = {
|
||||
|
@ -127,7 +137,7 @@ in {
|
|||
|
||||
enable = true;
|
||||
uidgid = myData.uidgid.updaterbot-deployee;
|
||||
sshAllowSubnets = with myData.subnets; [tailscale.sshPattern];
|
||||
sshAllowSubnets = with myData.subnets; [ tailscale.sshPattern ];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
@ -1,10 +1,8 @@
|
|||
{
|
||||
config,
|
||||
myData,
|
||||
...
|
||||
}: let
|
||||
{ config, myData, ... }:
|
||||
let
|
||||
nvme = "/dev/disk/by-id/nvme-WD_PC_SN810_SDCQNRY-1T00-1201_23234W800017";
|
||||
in {
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../../shared/work
|
||||
../../modules
|
||||
|
@ -14,10 +12,16 @@ in {
|
|||
];
|
||||
|
||||
boot = {
|
||||
kernelModules = ["kvm-intel"];
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
loader.systemd-boot.enable = true;
|
||||
initrd = {
|
||||
availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usbhid" "tpm_tis"];
|
||||
availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"thunderbolt"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"tpm_tis"
|
||||
];
|
||||
systemd = {
|
||||
enableTpm2 = true;
|
||||
emergencyAccess = true;
|
||||
|
@ -26,7 +30,7 @@ in {
|
|||
luksroot = {
|
||||
device = "${nvme}-part3";
|
||||
allowDiscards = true;
|
||||
crypttabExtraOpts = ["tpm2-device=auto"];
|
||||
crypttabExtraOpts = [ "tpm2-device=auto" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
@ -43,7 +47,7 @@ in {
|
|||
"/" = {
|
||||
device = "/dev/mapper/luksroot";
|
||||
fsType = "btrfs";
|
||||
options = ["compress=zstd"];
|
||||
options = [ "compress=zstd" ];
|
||||
};
|
||||
"/boot" = {
|
||||
device = "${nvme}-part1";
|
||||
|
@ -81,18 +85,20 @@ in {
|
|||
toUser = config.mj.username;
|
||||
};
|
||||
|
||||
remote-builder.client = let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in {
|
||||
enable = true;
|
||||
inherit (host) system supportedFeatures;
|
||||
hostName = host.jakstIP;
|
||||
sshKey = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
remote-builder.client =
|
||||
let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
inherit (host) system supportedFeatures;
|
||||
hostName = host.jakstIP;
|
||||
sshKey = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
|
||||
node_exporter = {
|
||||
enable = true;
|
||||
extraSubnets = [myData.subnets.vno1.cidr];
|
||||
extraSubnets = [ myData.subnets.vno1.cidr ];
|
||||
};
|
||||
|
||||
deployerbot = {
|
||||
|
@ -104,7 +110,7 @@ in {
|
|||
|
||||
enable = true;
|
||||
uidgid = myData.uidgid.updaterbot-deployee;
|
||||
sshAllowSubnets = with myData.subnets; [tailscale.sshPattern];
|
||||
sshAllowSubnets = with myData.subnets; [ tailscale.sshPattern ];
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -131,7 +137,7 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
users.extraGroups.vboxusers.members = ["motiejus"];
|
||||
users.extraGroups.vboxusers.members = [ "motiejus" ];
|
||||
|
||||
security.tpm2.enable = true;
|
||||
|
||||
|
|
|
@ -1,8 +1,5 @@
|
|||
{ self, modulesPath, ... }:
|
||||
{
|
||||
self,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
"${modulesPath}/profiles/all-hardware.nix"
|
||||
"${modulesPath}/installer/cd-dvd/iso-image.nix"
|
||||
|
@ -21,7 +18,10 @@
|
|||
};
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.supportedFilesystems = ["zfs" "btrfs"];
|
||||
boot.supportedFilesystems = [
|
||||
"zfs"
|
||||
"btrfs"
|
||||
];
|
||||
|
||||
isoImage = {
|
||||
isoName = "toolshed-${self.lastModifiedDate}.iso";
|
||||
|
@ -31,7 +31,7 @@
|
|||
makeUsbBootable = true; # USB booting
|
||||
};
|
||||
|
||||
swapDevices = [];
|
||||
swapDevices = [ ];
|
||||
|
||||
services = {
|
||||
getty.autologinUser = "nixos";
|
||||
|
@ -45,7 +45,7 @@
|
|||
networking = {
|
||||
hostName = "vm";
|
||||
domain = "jakstys.lt";
|
||||
firewall.allowedTCPPorts = [22];
|
||||
firewall.allowedTCPPorts = [ 22 ];
|
||||
hostId = "abefef01";
|
||||
};
|
||||
}
|
||||
|
|
|
@ -4,12 +4,13 @@
|
|||
pkgs,
|
||||
myData,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
zfs-root = {
|
||||
boot = {
|
||||
enable = true;
|
||||
devNodes = "/dev/disk/by-id/";
|
||||
bootDevices = ["nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P"];
|
||||
bootDevices = [ "nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P" ];
|
||||
immutable = false;
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
|
@ -26,14 +27,14 @@
|
|||
];
|
||||
sshUnlock = {
|
||||
enable = true;
|
||||
authorizedKeys =
|
||||
(builtins.attrValues myData.people_pubkeys)
|
||||
++ [myData.hosts."fra1-a.servers.jakst".publicKey];
|
||||
authorizedKeys = (builtins.attrValues myData.people_pubkeys) ++ [
|
||||
myData.hosts."fra1-a.servers.jakst".publicKey
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot.binfmt.emulatedSystems = ["aarch64-linux"];
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
|
||||
mj = {
|
||||
stateVersion = "23.05";
|
||||
|
@ -50,7 +51,11 @@
|
|||
|
||||
snapshot = {
|
||||
enable = true;
|
||||
mountpoints = ["/home" "/var/lib" "/var/log"];
|
||||
mountpoints = [
|
||||
"/home"
|
||||
"/var/lib"
|
||||
"/var/log"
|
||||
];
|
||||
};
|
||||
|
||||
zfsborg = {
|
||||
|
@ -73,9 +78,7 @@
|
|||
"tailscale"
|
||||
"private/soju"
|
||||
];
|
||||
patterns = [
|
||||
"- gitea/data/repo-archive/"
|
||||
];
|
||||
patterns = [ "- gitea/data/repo-archive/" ];
|
||||
backup_at = "*-*-* 01:00:00 UTC";
|
||||
prune.keep = {
|
||||
within = "1d";
|
||||
|
@ -86,7 +89,9 @@
|
|||
}
|
||||
{
|
||||
mountpoint = "/var/lib";
|
||||
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_lib";
|
||||
repo = "borgstor@${
|
||||
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
|
||||
}:${config.networking.hostName}.${config.networking.domain}-var_lib";
|
||||
paths = [
|
||||
"bitwarden_rs"
|
||||
"caddy"
|
||||
|
@ -98,9 +103,7 @@
|
|||
"tailscale"
|
||||
"private/soju"
|
||||
];
|
||||
patterns = [
|
||||
"- gitea/data/repo-archive/"
|
||||
];
|
||||
patterns = [ "- gitea/data/repo-archive/" ];
|
||||
backup_at = "*-*-* 01:00:00 UTC";
|
||||
}
|
||||
|
||||
|
@ -108,7 +111,7 @@
|
|||
{
|
||||
mountpoint = "/var/log";
|
||||
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-var_log";
|
||||
paths = ["caddy"];
|
||||
paths = [ "caddy" ];
|
||||
patterns = [
|
||||
"+ caddy/access-jakstys.lt.log-*.zst"
|
||||
"- *"
|
||||
|
@ -117,8 +120,10 @@
|
|||
}
|
||||
{
|
||||
mountpoint = "/var/log";
|
||||
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_log";
|
||||
paths = ["caddy"];
|
||||
repo = "borgstor@${
|
||||
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
|
||||
}:${config.networking.hostName}.${config.networking.domain}-var_log";
|
||||
paths = [ "caddy" ];
|
||||
patterns = [
|
||||
"+ caddy/access-jakstys.lt.log-*.zst"
|
||||
"- *"
|
||||
|
@ -138,7 +143,9 @@
|
|||
}
|
||||
{
|
||||
mountpoint = "/home";
|
||||
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
|
||||
repo = "borgstor@${
|
||||
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
|
||||
}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
|
||||
paths = [
|
||||
"motiejus/annex2"
|
||||
"motiejus/.config/syncthing"
|
||||
|
@ -157,7 +164,7 @@
|
|||
services = {
|
||||
friendlyport.ports = [
|
||||
{
|
||||
subnets = [myData.subnets.tailscale.cidr];
|
||||
subnets = [ myData.subnets.tailscale.cidr ];
|
||||
tcp = with myData.ports; [
|
||||
80
|
||||
443
|
||||
|
@ -181,18 +188,20 @@
|
|||
subnetCIDR = myData.subnets.tailscale.cidr;
|
||||
};
|
||||
|
||||
nsd-acme = let
|
||||
accountKey = config.age.secrets.letsencrypt-account-key.path;
|
||||
in {
|
||||
enable = true;
|
||||
zones = {
|
||||
"irc.jakstys.lt".accountKey = accountKey;
|
||||
"hdd.jakstys.lt".accountKey = accountKey;
|
||||
"hass.jakstys.lt".accountKey = accountKey;
|
||||
"grafana.jakstys.lt".accountKey = accountKey;
|
||||
"bitwarden.jakstys.lt".accountKey = accountKey;
|
||||
nsd-acme =
|
||||
let
|
||||
accountKey = config.age.secrets.letsencrypt-account-key.path;
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
zones = {
|
||||
"irc.jakstys.lt".accountKey = accountKey;
|
||||
"hdd.jakstys.lt".accountKey = accountKey;
|
||||
"hass.jakstys.lt".accountKey = accountKey;
|
||||
"grafana.jakstys.lt".accountKey = accountKey;
|
||||
"bitwarden.jakstys.lt".accountKey = accountKey;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
deployerbot = {
|
||||
follower = {
|
||||
|
@ -202,7 +211,7 @@
|
|||
];
|
||||
|
||||
enable = true;
|
||||
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
|
||||
sshAllowSubnets = [ myData.subnets.tailscale.sshPattern ];
|
||||
uidgid = myData.uidgid.updaterbot-deployee;
|
||||
};
|
||||
};
|
||||
|
@ -228,25 +237,29 @@
|
|||
|
||||
zfsunlock = {
|
||||
enable = true;
|
||||
targets."fra1-a.servers.jakst" = let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in {
|
||||
sshEndpoint = host.publicIP;
|
||||
pingEndpoint = host.jakstIP;
|
||||
remotePubkey = host.initrdPubKey;
|
||||
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
|
||||
startAt = "*-*-* *:00/5:00";
|
||||
};
|
||||
targets."fra1-a.servers.jakst" =
|
||||
let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in
|
||||
{
|
||||
sshEndpoint = host.publicIP;
|
||||
pingEndpoint = host.jakstIP;
|
||||
remotePubkey = host.initrdPubKey;
|
||||
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
|
||||
startAt = "*-*-* *:00/5:00";
|
||||
};
|
||||
};
|
||||
|
||||
remote-builder.client = let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in {
|
||||
enable = true;
|
||||
inherit (host) system supportedFeatures;
|
||||
hostName = host.jakstIP;
|
||||
sshKey = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
remote-builder.client =
|
||||
let
|
||||
host = myData.hosts."fra1-a.servers.jakst";
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
inherit (host) system supportedFeatures;
|
||||
hostName = host.jakstIP;
|
||||
sshKey = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -301,25 +314,27 @@
|
|||
"www.jakstys.lt".extraConfig = ''
|
||||
redir https://jakstys.lt
|
||||
'';
|
||||
"irc.jakstys.lt".extraConfig = let
|
||||
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
|
||||
gamjaConfig = {
|
||||
server = {
|
||||
url = "irc.jakstys.lt:6698";
|
||||
nick = "motiejus";
|
||||
"irc.jakstys.lt".extraConfig =
|
||||
let
|
||||
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
|
||||
gamjaConfig = {
|
||||
server = {
|
||||
url = "irc.jakstys.lt:6698";
|
||||
nick = "motiejus";
|
||||
};
|
||||
};
|
||||
};
|
||||
}) {};
|
||||
in ''
|
||||
@denied not remote_ip ${myData.subnets.tailscale.cidr}
|
||||
abort @denied
|
||||
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
|
||||
}) { };
|
||||
in
|
||||
''
|
||||
@denied not remote_ip ${myData.subnets.tailscale.cidr}
|
||||
abort @denied
|
||||
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
|
||||
|
||||
root * ${gamja}
|
||||
file_server browse {
|
||||
precompressed br gzip
|
||||
}
|
||||
'';
|
||||
root * ${gamja}
|
||||
file_server browse {
|
||||
precompressed br gzip
|
||||
}
|
||||
'';
|
||||
"dl.jakstys.lt".extraConfig = ''
|
||||
root * /var/www/dl
|
||||
file_server browse {
|
||||
|
@ -452,47 +467,52 @@
|
|||
evaluation_interval = "1m";
|
||||
};
|
||||
|
||||
scrapeConfigs = let
|
||||
port = builtins.toString myData.ports.exporters.node;
|
||||
in [
|
||||
{
|
||||
job_name = "prometheus";
|
||||
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.prometheus}"];}];
|
||||
}
|
||||
{
|
||||
job_name = "caddy";
|
||||
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.exporters.caddy}"];}];
|
||||
}
|
||||
{
|
||||
job_name = "${config.networking.hostName}.${config.networking.domain}";
|
||||
static_configs = [{targets = ["127.0.0.1:${port}"];}];
|
||||
}
|
||||
{
|
||||
job_name = "fra1-a.servers.jakst";
|
||||