From 81807eeaa8ce32728c298b03f76c34bad847a374 Mon Sep 17 00:00:00 2001 From: Lander Van den Bulcke Date: Sat, 20 Sep 2025 23:01:03 +0200 Subject: [PATCH 1/4] feat: try out colmena Signed-off-by: Lander Van den Bulcke --- flake.lock | 157 ++++++++++++++++++++++++++++++++------- flake.nix | 71 +++++++++++++++++- hosts/servers/common.nix | 88 ++++++++++++++++++++++ lib/hetzner.nix | 21 +++++- 4 files changed, 309 insertions(+), 28 deletions(-) create mode 100644 hosts/servers/common.nix diff --git a/flake.lock b/flake.lock index 58dc309..92c321f 100644 --- a/flake.lock +++ b/flake.lock @@ -35,10 +35,32 @@ "type": "github" } }, - "deploy-rs": { + "colmena": { "inputs": { "flake-compat": "flake-compat", + "flake-utils": "flake-utils", + "nix-github-actions": "nix-github-actions", "nixpkgs": "nixpkgs_2", + "stable": "stable" + }, + "locked": { + "lastModified": 1755272288, + "narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=", + "owner": "zhaofengli", + "repo": "colmena", + "rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473", + "type": "github" + }, + "original": { + "owner": "zhaofengli", + "repo": "colmena", + "type": "github" + } + }, + "deploy-rs": { + "inputs": { + "flake-compat": "flake-compat_2", + "nixpkgs": "nixpkgs_3", "utils": "utils" }, "locked": { @@ -115,11 +137,11 @@ "flake-compat": { "flake": false, "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", + "lastModified": 1650374568, + "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=", "owner": "edolstra", "repo": "flake-compat", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", + "rev": "b4a34015c698c7793d592d66adbab377907a2be8", "type": "github" }, "original": { @@ -131,11 +153,11 @@ "flake-compat_2": { "flake": false, "locked": { - "lastModified": 1747046372, - "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "lastModified": 1733328505, + "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", "owner": "edolstra", "repo": "flake-compat", - "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", "type": "github" }, "original": { @@ -161,6 +183,22 @@ } }, "flake-compat_4": { + "flake": false, + "locked": { + "lastModified": 1747046372, + "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_5": { "flake": false, "locked": { "lastModified": 1696426674, @@ -217,6 +255,21 @@ } }, "flake-utils": { + "locked": { + "lastModified": 1659877975, + "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_2": { "inputs": { "systems": "systems_2" }, @@ -234,7 +287,7 @@ "type": "github" } }, - "flake-utils_2": { + "flake-utils_3": { "inputs": { "systems": "systems_3" }, @@ -325,7 +378,7 @@ "headplane": { "inputs": { "devshell": "devshell", - "flake-utils": "flake-utils", + "flake-utils": "flake-utils_2", "nixpkgs": [ "nixpkgs" ] @@ -395,10 +448,31 @@ "type": "github" } }, + "nix-github-actions": { + "inputs": { + "nixpkgs": [ + "colmena", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1729742964, + "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=", + "owner": "nix-community", + "repo": "nix-github-actions", + "rev": "e04df33f62cdcf93d73e9a04142464753a16db67", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nix-github-actions", + "type": "github" + } + }, "nixos-mailserver": { "inputs": { "blobs": "blobs", - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "git-hooks": "git-hooks", "nixpkgs": [ "nixpkgs" @@ -422,8 +496,8 @@ }, "nixos-wsl": { "inputs": { - "flake-compat": "flake-compat_3", - "nixpkgs": "nixpkgs_3" + "flake-compat": "flake-compat_4", + "nixpkgs": "nixpkgs_4" }, "locked": { "lastModified": 1758123407, @@ -504,6 +578,22 @@ } }, "nixpkgs_2": { + "locked": { + "lastModified": 1750134718, + "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { "locked": { "lastModified": 1743014863, "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=", @@ -519,7 +609,7 @@ "type": "github" } }, - "nixpkgs_3": { + "nixpkgs_4": { "locked": { "lastModified": 1757745802, "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=", @@ -535,7 +625,7 @@ "type": "github" } }, - "nixpkgs_4": { + "nixpkgs_5": { "locked": { "lastModified": 1758070117, "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=", @@ -551,7 +641,7 @@ "type": "github" } }, - "nixpkgs_5": { + "nixpkgs_6": { "locked": { "lastModified": 1751011381, "narHash": "sha256-krGXKxvkBhnrSC/kGBmg5MyupUUT5R6IBCLEzx9jhMM=", @@ -567,7 +657,7 @@ "type": "github" } }, - "nixpkgs_6": { + "nixpkgs_7": { "locked": { "lastModified": 1750811787, "narHash": "sha256-rD/978c35JXz6JLAzciTIOCMenPumF6zrQOj4rVZeHE=", @@ -583,7 +673,7 @@ "type": "github" } }, - "nixpkgs_7": { + "nixpkgs_8": { "locked": { "lastModified": 1730768919, "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=", @@ -599,7 +689,7 @@ "type": "github" } }, - "nixpkgs_8": { + "nixpkgs_9": { "locked": { "lastModified": 1722813957, "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=", @@ -618,7 +708,7 @@ "nixvim": { "inputs": { "flake-parts": "flake-parts", - "nixpkgs": "nixpkgs_5", + "nixpkgs": "nixpkgs_6", "nixvim": "nixvim_2", "pre-commit-hooks": "pre-commit-hooks" }, @@ -639,7 +729,7 @@ "nixvim_2": { "inputs": { "flake-parts": "flake-parts_2", - "nixpkgs": "nixpkgs_6", + "nixpkgs": "nixpkgs_7", "nuschtosSearch": "nuschtosSearch", "systems": "systems_4" }, @@ -659,7 +749,7 @@ }, "nuschtosSearch": { "inputs": { - "flake-utils": "flake-utils_2", + "flake-utils": "flake-utils_3", "ixx": "ixx", "nixpkgs": [ "nixvim", @@ -683,9 +773,9 @@ }, "pre-commit-hooks": { "inputs": { - "flake-compat": "flake-compat_4", + "flake-compat": "flake-compat_5", "gitignore": "gitignore_2", - "nixpkgs": "nixpkgs_7" + "nixpkgs": "nixpkgs_8" }, "locked": { "lastModified": 1750779888, @@ -704,13 +794,14 @@ "root": { "inputs": { "catppuccin": "catppuccin", + "colmena": "colmena", "deploy-rs": "deploy-rs", "disko": "disko", "headplane": "headplane", "home-manager": "home-manager", "nixos-mailserver": "nixos-mailserver", "nixos-wsl": "nixos-wsl", - "nixpkgs": "nixpkgs_4", + "nixpkgs": "nixpkgs_5", "nixpkgs-unstable": "nixpkgs-unstable", "nixvim": "nixvim", "sops-nix": "sops-nix", @@ -737,6 +828,22 @@ "type": "github" } }, + "stable": { + "locked": { + "lastModified": 1750133334, + "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "36ab78dab7da2e4e27911007033713bab534187b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, "superdirt-src": { "flake": false, "locked": { @@ -833,7 +940,7 @@ "tidalcycles": { "inputs": { "dirt-samples-src": "dirt-samples-src", - "nixpkgs": "nixpkgs_8", + "nixpkgs": "nixpkgs_9", "superdirt-src": "superdirt-src", "tidal-src": "tidal-src", "vim-tidal-src": "vim-tidal-src", diff --git a/flake.nix b/flake.nix index 6f87e0b..c451fad 100644 --- a/flake.nix +++ b/flake.nix @@ -26,6 +26,9 @@ # deploy-rs deploy-rs.url = "github:serokell/deploy-rs"; + # colmena + colmena.url = "github:zhaofengli/colmena"; + # nixos-wsl nixos-wsl.url = "github:nix-community/NixOS-WSL/main"; @@ -58,6 +61,7 @@ nixpkgs, tidalcycles, deploy-rs, + colmena, ... }@inputs: let @@ -92,6 +96,20 @@ nixosModules = import ./modules/nixos; homeManagerModules = import ./modules/home-manager; + devShells = forAllSystems ( + system: + let + pkgs = nixpkgs.legacyPackages.${system}; + in + { + default = pkgs.mkShell { + buildInputs = [ + colmena.packages.${system}.colmena + ]; + }; + } + ); + nixosConfigurations = let hetzner = import ./lib/hetzner.nix { inherit inputs nixpkgs; }; @@ -136,7 +154,7 @@ }; # servers - db-01 = hetzner.mkHetznerMachine "db-01" { + db-01 = hetzner.mkMachine "db-01" { ipv6Address = "2a01:4f8:c012:15d4::/64"; }; hosting-01 = nixpkgs.lib.nixosSystem { @@ -146,7 +164,7 @@ ./hosts/hosting-01 ]; }; - hosting-02 = hetzner.mkHetznerMachine "hosting-02" { + hosting-02 = hetzner.mkMachine "hosting-02" { ipv6Address = "2a01:4f8:c013:7fc0::/64"; }; mail-01 = nixpkgs.lib.nixosSystem { @@ -166,6 +184,55 @@ }; }) { inherit (self.nixosConfigurations) db-01 hosting-02; }; + colmenaHive = + let + servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) ( + builtins.filter (file: file != "common.nix" && nixpkgs.lib.hasSuffix ".nix" file) ( + builtins.attrNames (builtins.readDir ./hosts/servers) + ) + ); + + colmenaConfig = nixpkgs.lib.genAttrs servers ( + name: + { ... }: + let + diskConfig = import ./lib/disk-config.nix { inherit nixpkgs; }; + machineConfig = import ./hosts/servers/${name}.nix; + in + { + imports = [ + inputs.disko.nixosModules.disko + inputs.sops-nix.nixosModules.sops + inputs.self.nixosModules.namespaced-vpn + inputs.self.nixosModules.storagebox + + ./hosts/servers/common.nix + + diskConfig + machineConfig + ]; + + deployment = { + targetHost = "${name}.escapeangle.com"; + targetPort = 22; + targetUser = "root"; + buildOnTarget = true; + }; + } + ); + in + colmena.lib.makeHive ( + { + meta = { + nixpkgs = import nixpkgs { + system = "aarch64-linux"; + overlays = [ ]; + }; + }; + } + // colmenaConfig + ); + checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib; }; } diff --git a/hosts/servers/common.nix b/hosts/servers/common.nix new file mode 100644 index 0000000..a4cec32 --- /dev/null +++ b/hosts/servers/common.nix @@ -0,0 +1,88 @@ +{ + lib, + modulesPath, + pkgs, + ... +}: +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot = { + loader.grub = { + devices = [ "/dev/sda" ]; + efiSupport = true; + efiInstallAsRemovable = true; + }; + + initrd.kernelModules = [ "virtio_gpu" ]; + + kernelParams = [ "console=tty" ]; + }; + + time.timeZone = lib.mkDefault "Europe/Berlin"; + + networking = { + useNetworkd = true; + }; + + systemd.network = { + enable = true; + + networks = { + "30-wan" = { + matchConfig.Name = "enp1s0"; + networkConfig.DHCP = "ipv4"; + routes = [ + { Gateway = "fe80::1"; } + ]; + }; + }; + }; + + services.openssh = { + enable = true; + settings.PasswordAuthentication = false; + extraConfig = '' + PrintLastLog no + ''; + }; + + programs.zsh.enable = true; + environment.pathsToLink = [ "/share/zsh" ]; + environment.shells = [ pkgs.zsh ]; + environment.enableAllTerminfo = true; + + users.users.lander = { + isNormalUser = true; + shell = pkgs.zsh; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026" + ]; + }; + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026" + ]; + + nix = { + settings = { + trusted-users = [ "lander" ]; + accept-flake-config = true; + auto-optimise-store = true; + }; + + package = pkgs.nixVersions.stable; + extraOptions = ''experimental-features = nix-command flakes''; + + gc = { + automatic = true; + options = "--delete-older-than 7d"; + }; + }; +} diff --git a/lib/hetzner.nix b/lib/hetzner.nix index e74f1c3..5b02e35 100644 --- a/lib/hetzner.nix +++ b/lib/hetzner.nix @@ -4,7 +4,7 @@ ... }: { - mkHetznerMachine = + mkMachine = hostname: { system ? "aarch64-linux", @@ -154,4 +154,23 @@ machineConfig ] ++ extraModules; }; + + mkColmena = + { + system ? "aarch64-linux", + user ? "lander", + timeZone ? "Europe/Berlin", + disks ? [ "/dev/sda" ], + ipv6Address, + tailscale ? true, + extraModules ? [ ], + }: + { + deployment = { + targetHost = "hosting-02.escapeangle.com"; + targetPort = 22; + targetUser = "root"; + buildOnTarget = true; + }; + }; } From eb59eaea95926f8412feeee975d61747947150a3 Mon Sep 17 00:00:00 2001 From: Lander Van den Bulcke Date: Sat, 20 Sep 2025 23:30:22 +0200 Subject: [PATCH 2/4] chore: remove deploy-rs Signed-off-by: Lander Van den Bulcke --- flake.lock | 126 +++++++++-------------------------------------------- flake.nix | 14 ------ 2 files changed, 20 insertions(+), 120 deletions(-) diff --git a/flake.lock b/flake.lock index 92c321f..aac0f83 100644 --- a/flake.lock +++ b/flake.lock @@ -57,26 +57,6 @@ "type": "github" } }, - "deploy-rs": { - "inputs": { - "flake-compat": "flake-compat_2", - "nixpkgs": "nixpkgs_3", - "utils": "utils" - }, - "locked": { - "lastModified": 1756719547, - "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=", - "owner": "serokell", - "repo": "deploy-rs", - "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2", - "type": "github" - }, - "original": { - "owner": "serokell", - "repo": "deploy-rs", - "type": "github" - } - }, "devshell": { "inputs": { "nixpkgs": [ @@ -153,11 +133,11 @@ "flake-compat_2": { "flake": false, "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", + "lastModified": 1747046372, + "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", "owner": "edolstra", "repo": "flake-compat", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", + "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", "type": "github" }, "original": { @@ -183,22 +163,6 @@ } }, "flake-compat_4": { - "flake": false, - "locked": { - "lastModified": 1747046372, - "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_5": { "flake": false, "locked": { "lastModified": 1696426674, @@ -271,7 +235,7 @@ }, "flake-utils_2": { "inputs": { - "systems": "systems_2" + "systems": "systems" }, "locked": { "lastModified": 1731533236, @@ -289,7 +253,7 @@ }, "flake-utils_3": { "inputs": { - "systems": "systems_3" + "systems": "systems_2" }, "locked": { "lastModified": 1731533236, @@ -472,7 +436,7 @@ "nixos-mailserver": { "inputs": { "blobs": "blobs", - "flake-compat": "flake-compat_3", + "flake-compat": "flake-compat_2", "git-hooks": "git-hooks", "nixpkgs": [ "nixpkgs" @@ -496,8 +460,8 @@ }, "nixos-wsl": { "inputs": { - "flake-compat": "flake-compat_4", - "nixpkgs": "nixpkgs_4" + "flake-compat": "flake-compat_3", + "nixpkgs": "nixpkgs_3" }, "locked": { "lastModified": 1758123407, @@ -594,22 +558,6 @@ } }, "nixpkgs_3": { - "locked": { - "lastModified": 1743014863, - "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_4": { "locked": { "lastModified": 1757745802, "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=", @@ -625,7 +573,7 @@ "type": "github" } }, - "nixpkgs_5": { + "nixpkgs_4": { "locked": { "lastModified": 1758070117, "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=", @@ -641,7 +589,7 @@ "type": "github" } }, - "nixpkgs_6": { + "nixpkgs_5": { "locked": { "lastModified": 1751011381, "narHash": "sha256-krGXKxvkBhnrSC/kGBmg5MyupUUT5R6IBCLEzx9jhMM=", @@ -657,7 +605,7 @@ "type": "github" } }, - "nixpkgs_7": { + "nixpkgs_6": { "locked": { "lastModified": 1750811787, "narHash": "sha256-rD/978c35JXz6JLAzciTIOCMenPumF6zrQOj4rVZeHE=", @@ -673,7 +621,7 @@ "type": "github" } }, - "nixpkgs_8": { + "nixpkgs_7": { "locked": { "lastModified": 1730768919, "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=", @@ -689,7 +637,7 @@ "type": "github" } }, - "nixpkgs_9": { + "nixpkgs_8": { "locked": { "lastModified": 1722813957, "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=", @@ -708,7 +656,7 @@ "nixvim": { "inputs": { "flake-parts": "flake-parts", - "nixpkgs": "nixpkgs_6", + "nixpkgs": "nixpkgs_5", "nixvim": "nixvim_2", "pre-commit-hooks": "pre-commit-hooks" }, @@ -729,9 +677,9 @@ "nixvim_2": { "inputs": { "flake-parts": "flake-parts_2", - "nixpkgs": "nixpkgs_7", + "nixpkgs": "nixpkgs_6", "nuschtosSearch": "nuschtosSearch", - "systems": "systems_4" + "systems": "systems_3" }, "locked": { "lastModified": 1751144320, @@ -773,9 +721,9 @@ }, "pre-commit-hooks": { "inputs": { - "flake-compat": "flake-compat_5", + "flake-compat": "flake-compat_4", "gitignore": "gitignore_2", - "nixpkgs": "nixpkgs_8" + "nixpkgs": "nixpkgs_7" }, "locked": { "lastModified": 1750779888, @@ -795,13 +743,12 @@ "inputs": { "catppuccin": "catppuccin", "colmena": "colmena", - "deploy-rs": "deploy-rs", "disko": "disko", "headplane": "headplane", "home-manager": "home-manager", "nixos-mailserver": "nixos-mailserver", "nixos-wsl": "nixos-wsl", - "nixpkgs": "nixpkgs_5", + "nixpkgs": "nixpkgs_4", "nixpkgs-unstable": "nixpkgs-unstable", "nixvim": "nixvim", "sops-nix": "sops-nix", @@ -905,21 +852,6 @@ "type": "github" } }, - "systems_4": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, "tidal-src": { "flake": false, "locked": { @@ -940,7 +872,7 @@ "tidalcycles": { "inputs": { "dirt-samples-src": "dirt-samples-src", - "nixpkgs": "nixpkgs_9", + "nixpkgs": "nixpkgs_8", "superdirt-src": "superdirt-src", "tidal-src": "tidal-src", "vim-tidal-src": "vim-tidal-src", @@ -960,24 +892,6 @@ "type": "github" } }, - "utils": { - "inputs": { - "systems": "systems" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, "vim-tidal-src": { "flake": false, "locked": { diff --git a/flake.nix b/flake.nix index c451fad..b1fa3fe 100644 --- a/flake.nix +++ b/flake.nix @@ -23,9 +23,6 @@ home-manager.url = "github:nix-community/home-manager/release-25.05"; home-manager.inputs.nixpkgs.follows = "nixpkgs"; - # deploy-rs - deploy-rs.url = "github:serokell/deploy-rs"; - # colmena colmena.url = "github:zhaofengli/colmena"; @@ -60,7 +57,6 @@ self, nixpkgs, tidalcycles, - deploy-rs, colmena, ... }@inputs: @@ -176,14 +172,6 @@ }; }; - deploy.nodes = nixpkgs.lib.mapAttrs (name: config: { - hostname = "${name}.escapeangle.com"; - profiles.system = { - user = "root"; - path = deploy-rs.lib.aarch64-linux.activate.nixos config; - }; - }) { inherit (self.nixosConfigurations) db-01 hosting-02; }; - colmenaHive = let servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) ( @@ -232,7 +220,5 @@ } // colmenaConfig ); - - checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib; }; } From 16ffe4e125a3410d00d2cfb817f81ded01ba50d5 Mon Sep 17 00:00:00 2001 From: Lander Van den Bulcke Date: Sun, 21 Sep 2025 00:13:05 +0200 Subject: [PATCH 3/4] feat: add slskd Signed-off-by: Lander Van den Bulcke --- hosts/servers/hosting-02.nix | 36 +++++++++++++++++++++++++++++++++++ hosts/servers/hosting-02.yaml | 5 +++-- modules/nixos/storagebox.nix | 2 +- 3 files changed, 40 insertions(+), 3 deletions(-) diff --git a/hosts/servers/hosting-02.nix b/hosts/servers/hosting-02.nix index 90359a5..83af31b 100644 --- a/hosts/servers/hosting-02.nix +++ b/hosts/servers/hosting-02.nix @@ -34,6 +34,39 @@ passFile = config.sops.secrets.storageboxCryptKey.path; }; + services.slskd = { + enable = true; + domain = "slsk.escapeangle.com"; + environmentFile = config.sops.secrets.slskdEnvFile.path; + settings = { + shares.directories = [ "/data/slsk/share" ]; + directories = { + downloads = "/data/slsk/downloads"; + incomplete = "/data/slsk/incomplete"; + }; + }; + }; + + systemd.services.slskd.serviceConfig = { + UMask = "0002"; + NetworkNamespacePath = "/run/netns/vpn"; + }; + + users.groups.storage = { + name = "storage"; + gid = 491729; + members = [ "slskd" ]; + }; + + services.nginx.virtualHosts."sls.escapeangle.com" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://10.10.10.2:${toString config.services.slskd.settings.web.port}"; + proxyWebsockets = true; + }; + }; + sops = { defaultSopsFile = ./hosting-02.yaml; secrets = { @@ -46,6 +79,9 @@ storageboxCryptKey = { owner = "root"; }; + slskdEnvFile = { + owner = config.services.slskd.user; + }; }; }; diff --git a/hosts/servers/hosting-02.yaml b/hosts/servers/hosting-02.yaml index 85ef193..a210d37 100644 --- a/hosts/servers/hosting-02.yaml +++ b/hosts/servers/hosting-02.yaml @@ -1,6 +1,7 @@ wireguardKey: ENC[AES256_GCM,data:Z239oQMzOp4C33pBePuANX3aPkmjTcrT+Z/UY0dnUCmMOs2Oy3iktS6Fgsw=,iv:21XLXpgsoYpvz887ZlLJW/A6IOJwEX5YwJrnO725M5U=,tag:VDGjOiYqFN8tMhf8s2YV6g==,type:str] storageboxKey: ENC[AES256_GCM,data:uWDkiWIk3OePRfoaqjllVlRVzW5+ryE4sIOs8qm6cS8JN/+YFbnkCsT5sdFeXSpJyQ7ymgD6uJJ75RWH6Y/iIARbmZN/x/9hnB3LORHSl/C0F3xMHUf6prXtYyPNLWe+ghCMygaLyvBuCBiEhleevRQANXLUJCysiODepSkXwyasAHKTKuKQUPU/T+1R7eXaQPDMehzD4/0o8SdLkqcZXBQzs3VRp+CbQyl7dx6znwoPWckmFH2W+9fZCE+AxFxBP3jPVjBPuOC3BviTYFSvZPEkmtH+lxYv+PXFAPpgYwmAEjCwWyDMDRy6bNVQIG6TKHn60TJv+GCfRwPJ46mVtbruyil23d7g/V7dhu8btPbgtvcBx/8EexJ0PHAVWcIZ1FJwr7inMCAghbSDD3CkGpOV8btaYgUZtosqfg9r5cd75jB+7RZPwyb8/1mrLWE3eL9Za2lZ6bC7a9AeIn1q3Cn6+aoMKqXp8q/sVwozNpUJj73yhjR146MGjCGpqoKJqK453qc3VCC50OZTOULV,iv:sEwA6zrK6FFqTmVJOMD77g0OuDjCHDLRBlirjhZBx/0=,tag:z1fX+7goXk4U6Di+4EK6Fw==,type:str] storageboxCryptKey: ENC[AES256_GCM,data:ryYOzFvdPaVkOHmypYbqw+KU6aB2OQutLw==,iv:FL4c7P36qxYR1KJlg7t0dvFHlKGMIrTlQG+CDkeJu9U=,tag:Ia4mhV9Ed/m1rRMCNnHqXw==,type:str] +slskdEnvFile: ENC[AES256_GCM,data:K1S1PXQMiBoEdbuM/NTBUYRrUSnAC/KBhm/PFzoCJATiLLPsstzgqzbe9vG8tnULb2driAH4Ytd03cmROp30V+9vW6J9eyCofWySWZNEYriRfY1y7y5AR8W13zQL0FGZOewUy/1T7YRvN8FjZFh4n7S3c0GREX3FSSNrmaHwOqgueDs=,iv:VziNMRpC2clhFyOMG8LRReMGUxhYqjUaZeA8gh599aM=,tag:H1tQBZ8nSgATSJB6nFSdlA==,type:str] sops: age: - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt @@ -12,8 +13,8 @@ sops: b1ZqUzZLUkFwNHJyVlhmK0FOZ1JFYUEKDU4NmBCHRY+ZK+RFK/LioGzjJTaOE1ky MC6jxt7Y5RkCk0BBqeoEVLaNXNViPjwakbvyfH0w0P6l0KDJ4mNlYQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-09-18T21:32:51Z" - mac: ENC[AES256_GCM,data:y3iMxGNyJfkmJZebiJ/iW/fhX3758Bz8/z8GfzvBiosjHOE6Awka70uQ7rFvHrLIFATDCrWW09ERD16/EIGL7bZMBKeXmjpkTe9WrmqYu4aS9qj1A/UzcW9zkxj6kKSZlgbdh2RaPXj9VcVfdYs/WDp8cxAuNmFLLEpY9Ar0SSY=,iv:rSGm4Y9XWrYmA2rL3t63NfSgHd6wBPWbtvfGivj6Qq0=,tag:gdHWOS0NO5piFK3fQiCSrw==,type:str] + lastmodified: "2025-09-20T23:35:47Z" + mac: ENC[AES256_GCM,data:idOk0S4lGYWOPHayOgqX0oKk8cWmm9YUXbAIDlojOmroE8qL45nBMNpb6npuA7wGoHWsg8kYCidi8v8Gz+dGnEMURdcT7NoqcgtDWisYxyw5sMQ52Wc+pNQzct34FGnIVcuQl/kFWEc5s7+jsXCiF5o0YbJLeyr6tyl1D2rWKkw=,iv:6n69rCiyETkV3hnGvAhxd3o+DcDI/Se7JMIs4fsDdag=,tag:Lf7lXw0dhgRqb7lnbJ2H6g==,type:str] pgp: - created_at: "2025-09-18T21:32:42Z" enc: |- diff --git a/modules/nixos/storagebox.nix b/modules/nixos/storagebox.nix index 7ed47b5..7011c4d 100644 --- a/modules/nixos/storagebox.nix +++ b/modules/nixos/storagebox.nix @@ -61,10 +61,10 @@ in "defaults" "_netdev" "allow_other" - "default_permissions" "port=23" "compression=no" "reconnect" + "umask=000" "ServerAliveInterval=15" "IdentityFile=${cfg.sshKeyFile}" ]; From 63406570861f91bcf1658c3736ad461567618655 Mon Sep 17 00:00:00 2001 From: Lander Van den Bulcke Date: Sun, 21 Sep 2025 00:52:10 +0200 Subject: [PATCH 4/4] fix: reenable tailcale on colmena nodes Signed-off-by: Lander Van den Bulcke --- .sops.yaml | 9 +++++++ hosts/servers/common.nix | 16 ++++++++++++ hosts/servers/common.yaml | 55 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 80 insertions(+) create mode 100644 hosts/servers/common.yaml diff --git a/.sops.yaml b/.sops.yaml index 81d000a..6b4f967 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -31,6 +31,15 @@ creation_rules: - *mail-01 pgp: - *lander + - path_regex: hosts/servers/common.yaml$ + key_groups: + - age: + - *db-01 + - *hosting-01 + - *hosting-02 + - *mail-01 + pgp: + - *lander - path_regex: hosts/db-01/secrets.yam?l$ key_groups: - age: diff --git a/hosts/servers/common.nix b/hosts/servers/common.nix index a4cec32..26590f1 100644 --- a/hosts/servers/common.nix +++ b/hosts/servers/common.nix @@ -1,4 +1,5 @@ { + config, lib, modulesPath, pkgs, @@ -50,6 +51,21 @@ ''; }; + sops.secrets.tailscale-authkey = { + owner = "root"; + group = "root"; + sopsFile = ./common.yaml; + }; + + services.tailscale = { + enable = true; + openFirewall = false; + extraUpFlags = [ + "--login-server=https://headscale.escapeangle.com" + ]; + authKeyFile = config.sops.secrets.tailscale-authkey.path; + }; + programs.zsh.enable = true; environment.pathsToLink = [ "/share/zsh" ]; environment.shells = [ pkgs.zsh ]; diff --git a/hosts/servers/common.yaml b/hosts/servers/common.yaml new file mode 100644 index 0000000..9c57980 --- /dev/null +++ b/hosts/servers/common.yaml @@ -0,0 +1,55 @@ +tailscale-authkey: ENC[AES256_GCM,data:5gGzPfdHWB8dYJ0/pyy1ZLXgpTy0Vb3J+RDcRnSPBp9aS11iZJHBp+drNmrKGIzM,iv:bvKua+uX8jbfPAD5LwcEX+lDmCQpKImK7bfw9kKeDt4=,tag:XSTe6iLDWwPQG7ohCTjHIQ==,type:str] +sops: + age: + - recipient: age1a5zz4cyda0aqh0hgf8svpyh9ktwy6z5x3gnnu5ysvpvek9rn03csx7dyqn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TUNKT0JtZEs3M0hEUjVt + WWJRUkFNSm9pVjRlVkk3RzVPeVZkNytUYVJRCnhzd0syd25HLzBTTFRBN3pXQUVW + VXJxakRZdzdGL3U0aFNrVEdTRVNBZUkKLS0tIDFrOC8ySVVYV3pLbDlDakpRZHhh + SzlLWGwrYjVNcGFLVGNTTmhleXNZMEEKabv69KbHpVEGpknnuEO+1OgdWCtvdkP6 + fP55S4jIHjkONG1upwIxHj3YJO55nI5kA4XAx+5AOSntwN1iAXRciA== + -----END AGE ENCRYPTED FILE----- + - recipient: age18g4z53ykxzq35dsjq3a2np4f88xwat0kwtax229l3zn0ykhlpvqqy8fgtv + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTGFJTE5oU2tUcU1XcTVy + ZDBiSTQ5bGppOGRjUEV4WG9lc2xFN1RIQTNzCmZuelNkUjhyZWtqSTNZWHhIRjhT + UEpyeE9wdC9wSVZLckVzMVdQSXlhOTAKLS0tIGRBeXlWNHRyQkFpS2l2WlJHTnBI + WVRHWmE0QU1qK0NpT1QyL1ZZWXpmc3cK4UKRpOatiXqt2DvJmMlB2D+En4ufBXhe + vdxhnMZgMlMhN0F+KkOEt8JD1jrbOQ0fn1KdDcsjqO4MBJJK1smB9Q== + -----END AGE ENCRYPTED FILE----- + - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZGNYQW9pbEVQdTl3WEo2 + ZWtHOHZzRmRMNkZHS1FjN1UrN0VGc0swc0JZClN3ckNrcXZoWTBpRGpGa0NSMkVY + K2ZVSmhuaHlQWUtqakRNTGVacDhScUkKLS0tIDl3czNRYUpra3Y2enlkMkRxUzlN + cDdhVlUyZGhsdHMzZ0E5andLVHVoNkkKocZp5EicX0pu1xaX+wYFfLqMoXxn5KiL + DsNPjAG//EslXpYq2UxXnWYaUKBq8fUr4moMG8omaoZ6KWgG8u1PeQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1u2a7wakgsyct6ed7ah2pksymh7jjl08ankedeyl5pa5jcs8r0uks02jpza + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIdkpsYUlwVlFJVjBRQjJn + TWhpZlluTEYwV0I2cDVUYytUZisrL0lWWTBnCnc3THNqT1BzeGkraDUyV0dMWGFr + NEo0aEtkUGVxVmttc09RMXJjblRNQUUKLS0tIENIN0hFbVFsbnIwRnYxdmVqVHlN + ZWFpdkxVVFpOUzRnUUFYYkIvcG0xa00Ktrrn8R69OF8wwsz9RuvKAiVtS+thbbNp + 5DnmezbVOr6g3bNLnRQ/GDfesHqvCWTQ+Lv2t8tnXXbjXrNWcxOTgw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-09-09T21:18:09Z" + mac: ENC[AES256_GCM,data:+GzVY/9R89YOL1dm0q1q3VSdsBa8krphFk8vOup+0XRn2BaLjwCIvOXQMBycVuRgMUHf77p1ETgpoj9quTDwJK8JDcP8pT6gfa/1mLuFz1I34cVk5f7Vx2BnX2Oh0LN+PXiMggbuySiNk3huOhgnrVCwwukT6PfvOXlYY5DVPPg=,iv:mp07YVgO0Xpp/XtOvD70hF+4ZGQJbn5EXxwPh2fXPMQ=,tag:dVwF6Y73DFeaNlYWLrqJWw==,type:str] + pgp: + - created_at: "2025-09-09T21:20:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DARdpY4woM6wSAQdAqzNqNtPjbYWAx9XIB+bdZjhIIfCTOm1hUrpCu7emwgMw + WKfVFLeKJg+d/3PrR5hBoEfsj/IFUXiXDNrlpfr+VQCwd0XLMAM0WvFeod2gPe+1 + 0l4BXxWsyWzDdukiLzqtHelEvaJk8UU3LfhqsmdmQoApbx0AkLGUAQLgiHWtDkj6 + w+QeYq0CJbO5kCLO+kNCVSNoWDyGOokKqcMxglyaIjlkjodf/Xw56HAeF1BuxPmV + =BwAM + -----END PGP MESSAGE----- + fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92 + unencrypted_suffix: _unencrypted + version: 3.10.2