Compare commits
No commits in common. "63406570861f91bcf1658c3736ad461567618655" and "7d306e67fa6b79481161017652db94cb41276346" have entirely different histories.
6340657086
...
7d306e67fa
9 changed files with 73 additions and 371 deletions
|
|
@ -31,15 +31,6 @@ creation_rules:
|
|||
- *mail-01
|
||||
pgp:
|
||||
- *lander
|
||||
- path_regex: hosts/servers/common.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *db-01
|
||||
- *hosting-01
|
||||
- *hosting-02
|
||||
- *mail-01
|
||||
pgp:
|
||||
- *lander
|
||||
- path_regex: hosts/db-01/secrets.yam?l$
|
||||
key_groups:
|
||||
- age:
|
||||
|
|
|
|||
133
flake.lock
generated
133
flake.lock
generated
|
|
@ -35,25 +35,23 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"colmena": {
|
||||
"deploy-rs": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"flake-utils": "flake-utils",
|
||||
"nix-github-actions": "nix-github-actions",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"stable": "stable"
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1755272288,
|
||||
"narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=",
|
||||
"owner": "zhaofengli",
|
||||
"repo": "colmena",
|
||||
"rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473",
|
||||
"lastModified": 1756719547,
|
||||
"narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "zhaofengli",
|
||||
"repo": "colmena",
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
|
|
@ -117,11 +115,11 @@
|
|||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1650374568,
|
||||
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
|
||||
"lastModified": 1733328505,
|
||||
"narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
|
||||
"rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -219,23 +217,8 @@
|
|||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"locked": {
|
||||
"lastModified": 1659877975,
|
||||
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
|
|
@ -251,9 +234,9 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_2"
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
|
|
@ -342,7 +325,7 @@
|
|||
"headplane": {
|
||||
"inputs": {
|
||||
"devshell": "devshell",
|
||||
"flake-utils": "flake-utils_2",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
|
|
@ -412,27 +395,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-github-actions": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"colmena",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729742964,
|
||||
"narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-github-actions",
|
||||
"rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-github-actions",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-mailserver": {
|
||||
"inputs": {
|
||||
"blobs": "blobs",
|
||||
|
|
@ -543,16 +505,16 @@
|
|||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1750134718,
|
||||
"narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
|
||||
"lastModified": 1743014863,
|
||||
"narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
|
||||
"rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
|
|
@ -679,7 +641,7 @@
|
|||
"flake-parts": "flake-parts_2",
|
||||
"nixpkgs": "nixpkgs_6",
|
||||
"nuschtosSearch": "nuschtosSearch",
|
||||
"systems": "systems_3"
|
||||
"systems": "systems_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1751144320,
|
||||
|
|
@ -697,7 +659,7 @@
|
|||
},
|
||||
"nuschtosSearch": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_3",
|
||||
"flake-utils": "flake-utils_2",
|
||||
"ixx": "ixx",
|
||||
"nixpkgs": [
|
||||
"nixvim",
|
||||
|
|
@ -742,7 +704,7 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"catppuccin": "catppuccin",
|
||||
"colmena": "colmena",
|
||||
"deploy-rs": "deploy-rs",
|
||||
"disko": "disko",
|
||||
"headplane": "headplane",
|
||||
"home-manager": "home-manager",
|
||||
|
|
@ -775,22 +737,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"stable": {
|
||||
"locked": {
|
||||
"lastModified": 1750133334,
|
||||
"narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "36ab78dab7da2e4e27911007033713bab534187b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-25.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"superdirt-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
@ -852,6 +798,21 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_4": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tidal-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
@ -892,6 +853,24 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"vim-tidal-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
|
|||
79
flake.nix
79
flake.nix
|
|
@ -23,8 +23,8 @@
|
|||
home-manager.url = "github:nix-community/home-manager/release-25.05";
|
||||
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
# colmena
|
||||
colmena.url = "github:zhaofengli/colmena";
|
||||
# deploy-rs
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
|
||||
# nixos-wsl
|
||||
nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
|
||||
|
|
@ -57,7 +57,7 @@
|
|||
self,
|
||||
nixpkgs,
|
||||
tidalcycles,
|
||||
colmena,
|
||||
deploy-rs,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
|
|
@ -92,20 +92,6 @@
|
|||
nixosModules = import ./modules/nixos;
|
||||
homeManagerModules = import ./modules/home-manager;
|
||||
|
||||
devShells = forAllSystems (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in
|
||||
{
|
||||
default = pkgs.mkShell {
|
||||
buildInputs = [
|
||||
colmena.packages.${system}.colmena
|
||||
];
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
nixosConfigurations =
|
||||
let
|
||||
hetzner = import ./lib/hetzner.nix { inherit inputs nixpkgs; };
|
||||
|
|
@ -150,7 +136,7 @@
|
|||
};
|
||||
|
||||
# servers
|
||||
db-01 = hetzner.mkMachine "db-01" {
|
||||
db-01 = hetzner.mkHetznerMachine "db-01" {
|
||||
ipv6Address = "2a01:4f8:c012:15d4::/64";
|
||||
};
|
||||
hosting-01 = nixpkgs.lib.nixosSystem {
|
||||
|
|
@ -160,7 +146,7 @@
|
|||
./hosts/hosting-01
|
||||
];
|
||||
};
|
||||
hosting-02 = hetzner.mkMachine "hosting-02" {
|
||||
hosting-02 = hetzner.mkHetznerMachine "hosting-02" {
|
||||
ipv6Address = "2a01:4f8:c013:7fc0::/64";
|
||||
};
|
||||
mail-01 = nixpkgs.lib.nixosSystem {
|
||||
|
|
@ -172,53 +158,14 @@
|
|||
};
|
||||
};
|
||||
|
||||
colmenaHive =
|
||||
let
|
||||
servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) (
|
||||
builtins.filter (file: file != "common.nix" && nixpkgs.lib.hasSuffix ".nix" file) (
|
||||
builtins.attrNames (builtins.readDir ./hosts/servers)
|
||||
)
|
||||
);
|
||||
|
||||
colmenaConfig = nixpkgs.lib.genAttrs servers (
|
||||
name:
|
||||
{ ... }:
|
||||
let
|
||||
diskConfig = import ./lib/disk-config.nix { inherit nixpkgs; };
|
||||
machineConfig = import ./hosts/servers/${name}.nix;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.self.nixosModules.namespaced-vpn
|
||||
inputs.self.nixosModules.storagebox
|
||||
|
||||
./hosts/servers/common.nix
|
||||
|
||||
diskConfig
|
||||
machineConfig
|
||||
];
|
||||
|
||||
deployment = {
|
||||
targetHost = "${name}.escapeangle.com";
|
||||
targetPort = 22;
|
||||
targetUser = "root";
|
||||
buildOnTarget = true;
|
||||
deploy.nodes = nixpkgs.lib.mapAttrs (name: config: {
|
||||
hostname = "${name}.escapeangle.com";
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.aarch64-linux.activate.nixos config;
|
||||
};
|
||||
}
|
||||
);
|
||||
in
|
||||
colmena.lib.makeHive (
|
||||
{
|
||||
meta = {
|
||||
nixpkgs = import nixpkgs {
|
||||
system = "aarch64-linux";
|
||||
overlays = [ ];
|
||||
};
|
||||
};
|
||||
}
|
||||
// colmenaConfig
|
||||
);
|
||||
}) { inherit (self.nixosConfigurations) db-01 hosting-02; };
|
||||
|
||||
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,104 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot = {
|
||||
loader.grub = {
|
||||
devices = [ "/dev/sda" ];
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
};
|
||||
|
||||
initrd.kernelModules = [ "virtio_gpu" ];
|
||||
|
||||
kernelParams = [ "console=tty" ];
|
||||
};
|
||||
|
||||
time.timeZone = lib.mkDefault "Europe/Berlin";
|
||||
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
|
||||
networks = {
|
||||
"30-wan" = {
|
||||
matchConfig.Name = "enp1s0";
|
||||
networkConfig.DHCP = "ipv4";
|
||||
routes = [
|
||||
{ Gateway = "fe80::1"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
extraConfig = ''
|
||||
PrintLastLog no
|
||||
'';
|
||||
};
|
||||
|
||||
sops.secrets.tailscale-authkey = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
sopsFile = ./common.yaml;
|
||||
};
|
||||
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
openFirewall = false;
|
||||
extraUpFlags = [
|
||||
"--login-server=https://headscale.escapeangle.com"
|
||||
];
|
||||
authKeyFile = config.sops.secrets.tailscale-authkey.path;
|
||||
};
|
||||
|
||||
programs.zsh.enable = true;
|
||||
environment.pathsToLink = [ "/share/zsh" ];
|
||||
environment.shells = [ pkgs.zsh ];
|
||||
environment.enableAllTerminfo = true;
|
||||
|
||||
users.users.lander = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
|
||||
];
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
trusted-users = [ "lander" ];
|
||||
accept-flake-config = true;
|
||||
auto-optimise-store = true;
|
||||
};
|
||||
|
||||
package = pkgs.nixVersions.stable;
|
||||
extraOptions = ''experimental-features = nix-command flakes'';
|
||||
|
||||
gc = {
|
||||
automatic = true;
|
||||
options = "--delete-older-than 7d";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
tailscale-authkey: ENC[AES256_GCM,data:5gGzPfdHWB8dYJ0/pyy1ZLXgpTy0Vb3J+RDcRnSPBp9aS11iZJHBp+drNmrKGIzM,iv:bvKua+uX8jbfPAD5LwcEX+lDmCQpKImK7bfw9kKeDt4=,tag:XSTe6iLDWwPQG7ohCTjHIQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1a5zz4cyda0aqh0hgf8svpyh9ktwy6z5x3gnnu5ysvpvek9rn03csx7dyqn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TUNKT0JtZEs3M0hEUjVt
|
||||
WWJRUkFNSm9pVjRlVkk3RzVPeVZkNytUYVJRCnhzd0syd25HLzBTTFRBN3pXQUVW
|
||||
VXJxakRZdzdGL3U0aFNrVEdTRVNBZUkKLS0tIDFrOC8ySVVYV3pLbDlDakpRZHhh
|
||||
SzlLWGwrYjVNcGFLVGNTTmhleXNZMEEKabv69KbHpVEGpknnuEO+1OgdWCtvdkP6
|
||||
fP55S4jIHjkONG1upwIxHj3YJO55nI5kA4XAx+5AOSntwN1iAXRciA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age18g4z53ykxzq35dsjq3a2np4f88xwat0kwtax229l3zn0ykhlpvqqy8fgtv
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTGFJTE5oU2tUcU1XcTVy
|
||||
ZDBiSTQ5bGppOGRjUEV4WG9lc2xFN1RIQTNzCmZuelNkUjhyZWtqSTNZWHhIRjhT
|
||||
UEpyeE9wdC9wSVZLckVzMVdQSXlhOTAKLS0tIGRBeXlWNHRyQkFpS2l2WlJHTnBI
|
||||
WVRHWmE0QU1qK0NpT1QyL1ZZWXpmc3cK4UKRpOatiXqt2DvJmMlB2D+En4ufBXhe
|
||||
vdxhnMZgMlMhN0F+KkOEt8JD1jrbOQ0fn1KdDcsjqO4MBJJK1smB9Q==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZGNYQW9pbEVQdTl3WEo2
|
||||
ZWtHOHZzRmRMNkZHS1FjN1UrN0VGc0swc0JZClN3ckNrcXZoWTBpRGpGa0NSMkVY
|
||||
K2ZVSmhuaHlQWUtqakRNTGVacDhScUkKLS0tIDl3czNRYUpra3Y2enlkMkRxUzlN
|
||||
cDdhVlUyZGhsdHMzZ0E5andLVHVoNkkKocZp5EicX0pu1xaX+wYFfLqMoXxn5KiL
|
||||
DsNPjAG//EslXpYq2UxXnWYaUKBq8fUr4moMG8omaoZ6KWgG8u1PeQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1u2a7wakgsyct6ed7ah2pksymh7jjl08ankedeyl5pa5jcs8r0uks02jpza
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIdkpsYUlwVlFJVjBRQjJn
|
||||
TWhpZlluTEYwV0I2cDVUYytUZisrL0lWWTBnCnc3THNqT1BzeGkraDUyV0dMWGFr
|
||||
NEo0aEtkUGVxVmttc09RMXJjblRNQUUKLS0tIENIN0hFbVFsbnIwRnYxdmVqVHlN
|
||||
ZWFpdkxVVFpOUzRnUUFYYkIvcG0xa00Ktrrn8R69OF8wwsz9RuvKAiVtS+thbbNp
|
||||
5DnmezbVOr6g3bNLnRQ/GDfesHqvCWTQ+Lv2t8tnXXbjXrNWcxOTgw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-09-09T21:18:09Z"
|
||||
mac: ENC[AES256_GCM,data:+GzVY/9R89YOL1dm0q1q3VSdsBa8krphFk8vOup+0XRn2BaLjwCIvOXQMBycVuRgMUHf77p1ETgpoj9quTDwJK8JDcP8pT6gfa/1mLuFz1I34cVk5f7Vx2BnX2Oh0LN+PXiMggbuySiNk3huOhgnrVCwwukT6PfvOXlYY5DVPPg=,iv:mp07YVgO0Xpp/XtOvD70hF+4ZGQJbn5EXxwPh2fXPMQ=,tag:dVwF6Y73DFeaNlYWLrqJWw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-09-09T21:20:01Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hF4DARdpY4woM6wSAQdAqzNqNtPjbYWAx9XIB+bdZjhIIfCTOm1hUrpCu7emwgMw
|
||||
WKfVFLeKJg+d/3PrR5hBoEfsj/IFUXiXDNrlpfr+VQCwd0XLMAM0WvFeod2gPe+1
|
||||
0l4BXxWsyWzDdukiLzqtHelEvaJk8UU3LfhqsmdmQoApbx0AkLGUAQLgiHWtDkj6
|
||||
w+QeYq0CJbO5kCLO+kNCVSNoWDyGOokKqcMxglyaIjlkjodf/Xw56HAeF1BuxPmV
|
||||
=BwAM
|
||||
-----END PGP MESSAGE-----
|
||||
fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.10.2
|
||||
|
|
@ -34,39 +34,6 @@
|
|||
passFile = config.sops.secrets.storageboxCryptKey.path;
|
||||
};
|
||||
|
||||
services.slskd = {
|
||||
enable = true;
|
||||
domain = "slsk.escapeangle.com";
|
||||
environmentFile = config.sops.secrets.slskdEnvFile.path;
|
||||
settings = {
|
||||
shares.directories = [ "/data/slsk/share" ];
|
||||
directories = {
|
||||
downloads = "/data/slsk/downloads";
|
||||
incomplete = "/data/slsk/incomplete";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.slskd.serviceConfig = {
|
||||
UMask = "0002";
|
||||
NetworkNamespacePath = "/run/netns/vpn";
|
||||
};
|
||||
|
||||
users.groups.storage = {
|
||||
name = "storage";
|
||||
gid = 491729;
|
||||
members = [ "slskd" ];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."sls.escapeangle.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://10.10.10.2:${toString config.services.slskd.settings.web.port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ./hosting-02.yaml;
|
||||
secrets = {
|
||||
|
|
@ -79,9 +46,6 @@
|
|||
storageboxCryptKey = {
|
||||
owner = "root";
|
||||
};
|
||||
slskdEnvFile = {
|
||||
owner = config.services.slskd.user;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
wireguardKey: ENC[AES256_GCM,data:Z239oQMzOp4C33pBePuANX3aPkmjTcrT+Z/UY0dnUCmMOs2Oy3iktS6Fgsw=,iv:21XLXpgsoYpvz887ZlLJW/A6IOJwEX5YwJrnO725M5U=,tag:VDGjOiYqFN8tMhf8s2YV6g==,type:str]
|
||||
storageboxKey: ENC[AES256_GCM,data:uWDkiWIk3OePRfoaqjllVlRVzW5+ryE4sIOs8qm6cS8JN/+YFbnkCsT5sdFeXSpJyQ7ymgD6uJJ75RWH6Y/iIARbmZN/x/9hnB3LORHSl/C0F3xMHUf6prXtYyPNLWe+ghCMygaLyvBuCBiEhleevRQANXLUJCysiODepSkXwyasAHKTKuKQUPU/T+1R7eXaQPDMehzD4/0o8SdLkqcZXBQzs3VRp+CbQyl7dx6znwoPWckmFH2W+9fZCE+AxFxBP3jPVjBPuOC3BviTYFSvZPEkmtH+lxYv+PXFAPpgYwmAEjCwWyDMDRy6bNVQIG6TKHn60TJv+GCfRwPJ46mVtbruyil23d7g/V7dhu8btPbgtvcBx/8EexJ0PHAVWcIZ1FJwr7inMCAghbSDD3CkGpOV8btaYgUZtosqfg9r5cd75jB+7RZPwyb8/1mrLWE3eL9Za2lZ6bC7a9AeIn1q3Cn6+aoMKqXp8q/sVwozNpUJj73yhjR146MGjCGpqoKJqK453qc3VCC50OZTOULV,iv:sEwA6zrK6FFqTmVJOMD77g0OuDjCHDLRBlirjhZBx/0=,tag:z1fX+7goXk4U6Di+4EK6Fw==,type:str]
|
||||
storageboxCryptKey: ENC[AES256_GCM,data:ryYOzFvdPaVkOHmypYbqw+KU6aB2OQutLw==,iv:FL4c7P36qxYR1KJlg7t0dvFHlKGMIrTlQG+CDkeJu9U=,tag:Ia4mhV9Ed/m1rRMCNnHqXw==,type:str]
|
||||
slskdEnvFile: ENC[AES256_GCM,data:K1S1PXQMiBoEdbuM/NTBUYRrUSnAC/KBhm/PFzoCJATiLLPsstzgqzbe9vG8tnULb2driAH4Ytd03cmROp30V+9vW6J9eyCofWySWZNEYriRfY1y7y5AR8W13zQL0FGZOewUy/1T7YRvN8FjZFh4n7S3c0GREX3FSSNrmaHwOqgueDs=,iv:VziNMRpC2clhFyOMG8LRReMGUxhYqjUaZeA8gh599aM=,tag:H1tQBZ8nSgATSJB6nFSdlA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
|
||||
|
|
@ -13,8 +12,8 @@ sops:
|
|||
b1ZqUzZLUkFwNHJyVlhmK0FOZ1JFYUEKDU4NmBCHRY+ZK+RFK/LioGzjJTaOE1ky
|
||||
MC6jxt7Y5RkCk0BBqeoEVLaNXNViPjwakbvyfH0w0P6l0KDJ4mNlYQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-09-20T23:35:47Z"
|
||||
mac: ENC[AES256_GCM,data:idOk0S4lGYWOPHayOgqX0oKk8cWmm9YUXbAIDlojOmroE8qL45nBMNpb6npuA7wGoHWsg8kYCidi8v8Gz+dGnEMURdcT7NoqcgtDWisYxyw5sMQ52Wc+pNQzct34FGnIVcuQl/kFWEc5s7+jsXCiF5o0YbJLeyr6tyl1D2rWKkw=,iv:6n69rCiyETkV3hnGvAhxd3o+DcDI/Se7JMIs4fsDdag=,tag:Lf7lXw0dhgRqb7lnbJ2H6g==,type:str]
|
||||
lastmodified: "2025-09-18T21:32:51Z"
|
||||
mac: ENC[AES256_GCM,data:y3iMxGNyJfkmJZebiJ/iW/fhX3758Bz8/z8GfzvBiosjHOE6Awka70uQ7rFvHrLIFATDCrWW09ERD16/EIGL7bZMBKeXmjpkTe9WrmqYu4aS9qj1A/UzcW9zkxj6kKSZlgbdh2RaPXj9VcVfdYs/WDp8cxAuNmFLLEpY9Ar0SSY=,iv:rSGm4Y9XWrYmA2rL3t63NfSgHd6wBPWbtvfGivj6Qq0=,tag:gdHWOS0NO5piFK3fQiCSrw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-09-18T21:32:42Z"
|
||||
enc: |-
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
...
|
||||
}:
|
||||
{
|
||||
mkMachine =
|
||||
mkHetznerMachine =
|
||||
hostname:
|
||||
{
|
||||
system ? "aarch64-linux",
|
||||
|
|
@ -154,23 +154,4 @@
|
|||
machineConfig
|
||||
] ++ extraModules;
|
||||
};
|
||||
|
||||
mkColmena =
|
||||
{
|
||||
system ? "aarch64-linux",
|
||||
user ? "lander",
|
||||
timeZone ? "Europe/Berlin",
|
||||
disks ? [ "/dev/sda" ],
|
||||
ipv6Address,
|
||||
tailscale ? true,
|
||||
extraModules ? [ ],
|
||||
}:
|
||||
{
|
||||
deployment = {
|
||||
targetHost = "hosting-02.escapeangle.com";
|
||||
targetPort = 22;
|
||||
targetUser = "root";
|
||||
buildOnTarget = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -61,10 +61,10 @@ in
|
|||
"defaults"
|
||||
"_netdev"
|
||||
"allow_other"
|
||||
"default_permissions"
|
||||
"port=23"
|
||||
"compression=no"
|
||||
"reconnect"
|
||||
"umask=000"
|
||||
"ServerAliveInterval=15"
|
||||
"IdentityFile=${cfg.sshKeyFile}"
|
||||
];
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue