nixfmt
This commit is contained in:
goeranh
parent
6add85a106
commit
3e82d5f015
5 changed files with 173 additions and 166 deletions
32
flake.nix
32
flake.nix
|
|
@ -52,8 +52,14 @@
|
|||
# copy install image to testserver and deploy the specified configuration to it
|
||||
"${name}-deploy-test" = nixpkgs.legacyPackages.x86_64-linux.writeShellScriptBin "deploy" ''
|
||||
FILENAME="$(ls ${self.packages.x86_64-linux."installer-iso".outPath}/iso)"
|
||||
scp ${self.packages.x86_64-linux."installer-iso".outPath}/iso/$FILENAME root@10.1.0.17:/var/lib/vz/template/iso/$FILENAME
|
||||
ssh 10.1.0.17 "qm create $1 --name ${nixosConfigurations.${name}.config.networking.fqdn} --cores 4 --memory 4096 --sata1 file=/var/lib/vz/template/iso/$FILENAME,media=cdrom --scsi1 pool1:32 --scsihw virtio-scsi-single --net0 virtio,bridge=vmbr1 --description \"von goeranh mailserver flake genierierte wegwerf-vm <br> ${nixosConfigurations.${name}.config.networking.fqdn}\""
|
||||
scp ${
|
||||
self.packages.x86_64-linux."installer-iso".outPath
|
||||
}/iso/$FILENAME root@10.1.0.17:/var/lib/vz/template/iso/$FILENAME
|
||||
ssh 10.1.0.17 "qm create $1 --name ${
|
||||
nixosConfigurations.${name}.config.networking.fqdn
|
||||
} --cores 4 --memory 4096 --sata1 file=/var/lib/vz/template/iso/$FILENAME,media=cdrom --scsi1 pool1:32 --scsihw virtio-scsi-single --net0 virtio,bridge=vmbr1 --description \"von goeranh mailserver flake genierierte wegwerf-vm <br> ${
|
||||
nixosConfigurations.${name}.config.networking.fqdn
|
||||
}\""
|
||||
ssh 10.1.0.17 "qm start $1"
|
||||
|
||||
# hardcoded deployment ip
|
||||
|
|
@ -67,12 +73,12 @@
|
|||
}
|
||||
)
|
||||
{ }
|
||||
( # filter all nixos configs containing installer
|
||||
builtins.filter (item: !nixpkgs.lib.hasInfix "-" item) (
|
||||
builtins.attrNames nixosConfigurations
|
||||
(
|
||||
# filter all nixos configs containing installer
|
||||
builtins.filter (item: !nixpkgs.lib.hasInfix "-" item) (builtins.attrNames nixosConfigurations)
|
||||
)
|
||||
) //
|
||||
(let
|
||||
// (
|
||||
let
|
||||
iso-config = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
|
|
@ -83,10 +89,12 @@
|
|||
isNormalUser = true;
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keys = sshkeys;
|
||||
networking.interfaces.ens18.ipv4.addresses = [{
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "141.56.51.98";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
}
|
||||
];
|
||||
services.getty.autologinUser = "root";
|
||||
services.openssh.enable = true;
|
||||
system.stateVersion = "25.11";
|
||||
|
|
@ -96,10 +104,12 @@
|
|||
}
|
||||
];
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
installer-iso = iso-config.config.system.build.isoImage;
|
||||
installer-vm = iso-config.config.system.build.vm;
|
||||
});
|
||||
}
|
||||
);
|
||||
|
||||
nixosConfigurations = builtins.foldl' (
|
||||
result: input:
|
||||
|
|
|
|||
|
|
@ -44,7 +44,10 @@
|
|||
|
||||
systemd.services.authentik-secrets-generator = {
|
||||
enable = true;
|
||||
requiredBy = [ "authentik-secrets-setup.service" "authentik-worker.service" ];
|
||||
requiredBy = [
|
||||
"authentik-secrets-setup.service"
|
||||
"authentik-worker.service"
|
||||
];
|
||||
script = ''
|
||||
echo "AUTHENTIK_SECRET_KEY=$(${pkgs.openssl}/bin/openssl rand -hex 32)" > /var/lib/authentik_secret
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -29,21 +29,14 @@ in
|
|||
];
|
||||
|
||||
networking.hostName = "git";
|
||||
networking.domain = "test.htw.stura-dresden.de";
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "167.235.225.23";
|
||||
prefixLength = 32;
|
||||
address = "141.56.51.97";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
|
||||
networking.interfaces.ens18.ipv6.addresses = [
|
||||
{
|
||||
address = "2a01:4f8:c012:6bd7::1";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway.address = "172.31.1.1";
|
||||
networking.defaultGateway.address = "141.56.51.254";
|
||||
networking.nameservers = [
|
||||
"9.9.9.9"
|
||||
"1.1.1.1"
|
||||
|
|
@ -56,27 +49,33 @@ in
|
|||
|
||||
server = {
|
||||
PROTOCOL = "http+unix";
|
||||
HTTP_ADDR = "/var/run/forgejo.sock";
|
||||
HTTP_ADDR = "/run/forgejo/forgejo.sock";
|
||||
ROOT_URL = "https://${config.networking.fqdn}";
|
||||
};
|
||||
oauth2_client = {
|
||||
ENABLE_AUTO_REGISTRATION = "true";
|
||||
REGISTER_EMAIL_CONFIRM = "false";
|
||||
username = "email";
|
||||
};
|
||||
service = {
|
||||
SHOW_REGISTRATION_BUTTON = "false";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."git.htw.stura-dresden.de" = {
|
||||
virtualHosts."${config.networking.fqdn}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
recommendedProxySettings = true;
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://unix:/var/run/forgejo.sock";
|
||||
proxyPass = "http://unix:/run/forgejo/forgejo.sock";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# virtualisation.docker.enable = true;
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.defaults.email = "cert@stura.htw-dresden.de";
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
25
|
||||
80
|
||||
|
|
|
|||
|
|
@ -98,7 +98,8 @@ services = {
|
|||
httpsPort = 443;
|
||||
};
|
||||
};
|
||||
in{
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
config = ''
|
||||
global
|
||||
|
|
@ -129,17 +130,15 @@ services = {
|
|||
frontend http-in
|
||||
bind *:80
|
||||
|
||||
${
|
||||
lib.foldlAttrs(prev: name: value: prev +
|
||||
"acl is_${name} hdr(host) -i ${value.domain}\n"
|
||||
) "" forwards
|
||||
}
|
||||
${lib.foldlAttrs (
|
||||
prev: name: value:
|
||||
prev + "acl is_${name} hdr(host) -i ${value.domain}\n"
|
||||
) "" forwards}
|
||||
|
||||
${
|
||||
lib.foldlAttrs(prev: name: value: prev +
|
||||
"use_backend ${name}_80 if is_${name}\n"
|
||||
) "" forwards
|
||||
}
|
||||
${lib.foldlAttrs (
|
||||
prev: name: value:
|
||||
prev + "use_backend ${name}_80 if is_${name}\n"
|
||||
) "" forwards}
|
||||
|
||||
default_backend plone_80
|
||||
|
||||
|
|
@ -159,11 +158,10 @@ services = {
|
|||
tcp-request content accept if { req_ssl_hello_type 1 }
|
||||
|
||||
# terminated here
|
||||
${
|
||||
lib.foldlAttrs(prev: name: value: prev +
|
||||
"use_backend ${name}_443 if { req_ssl_sni -i ${value.domain} }\n"
|
||||
) "" forwards
|
||||
}
|
||||
${lib.foldlAttrs (
|
||||
prev: name: value:
|
||||
prev + "use_backend ${name}_443 if { req_ssl_sni -i ${value.domain} }\n"
|
||||
) "" forwards}
|
||||
|
||||
backend ssh_srs2
|
||||
mode tcp
|
||||
|
|
@ -172,9 +170,10 @@ services = {
|
|||
option tcpka
|
||||
server srs2 141.56.51.2:80 check
|
||||
|
||||
${
|
||||
lib.foldlAttrs(prev: name: value: prev +
|
||||
''
|
||||
${lib.foldlAttrs (
|
||||
prev: name: value:
|
||||
prev
|
||||
+ ''
|
||||
|
||||
backend ${name}_80
|
||||
mode http
|
||||
|
|
@ -184,14 +183,11 @@ services = {
|
|||
server ${name} ${value.dest}:${builtins.toString value.httpsPort} check
|
||||
|
||||
''
|
||||
) "" forwards
|
||||
}
|
||||
) "" forwards}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
openvpn
|
||||
tcpdump
|
||||
|
|
|
|||
|
|
@ -19,7 +19,6 @@
|
|||
];
|
||||
networking.defaultGateway.address = "141.56.51.254";
|
||||
|
||||
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.defaults.email = "cert@stura.htw-dresden.de";
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue