swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2025-12-06 09:07:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: adapt oci sync to new structure

Browse source
This commit is contained in:
Swarsel 2024-12-15 17:18:27 +01:00
parent a26a53c824
commit d9a72d44ea
Signed by: swarsel
GPG key ID: 26A54C31F2A4FD84
5 changed files with 73 additions and 166 deletions
Download patch file Download diff file Expand all files Collapse all files

111
SwarselSystems.org
View file

@ -1252,69 +1252,33 @@ I have removed most of the machines from this section. What remains are some hos
:END:
#+begin_src nix :tangle hosts/nixos/sync/default.nix
{ self, config, inputs, pkgs, ... }:
{ self, inputs, outputs, lib, ... }:
let
profilesPath = "${self}/profiles";
in
{
imports = [
inputs.sops-nix.nixosModules.sops
"${profilesPath}/server/nixos"
./hardware-configuration.nix
];
environment.systemPackages = with pkgs; [
git
gnupg
ssh-to-age
];
inputs.home-manager.nixosModules.home-manager
{
home-manager.users.swarsel.imports = [
"${profilesPath}/server/home"
] ++ (builtins.attrValues outputs.homeManagerModules);
}
services.xserver.xkb = {
layout = "us";
variant = "altgr-intl";
};
nix.settings.experimental-features = [ "nix-command" "flakes" ];
] ++ (builtins.attrValues outputs.nixosModules);
sops = {
age.sshKeyPaths = [ "/etc/ssh/sops" ];
defaultSopsFile = "/root/.dotfiles/secrets/sync/secrets.yaml";
validateSopsFiles = false;
secrets.swarsel = { owner = "root"; };
secrets.dnstokenfull = { owner = "acme"; };
templates."certs.secret".content = ''
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
'';
defaultSopsFile = lib.mkForce "/root/.dotfiles/secrets/sync/secrets.yaml";
};
security.acme = {
acceptTerms = true;
preliminarySelfsigned = false;
defaults.email = "mrswarsel@gmail.com";
defaults.dnsProvider = "cloudflare";
defaults.environmentFile = "${config.sops.templates."certs.secret".path}";
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
virtualHosts = {
"synki.swarsel.win" = {
enableACME = true;
forceSSL = true;
acmeRoot = null;
locations = {
"/" = {
proxyPass = "http://localhost:27701";
extraConfig = ''
client_max_body_size 0;
'';
};
};
};
"sync.swarsel.win" = {
enableACME = true;
forceSSL = true;
@ -1328,13 +1292,18 @@ I have removed most of the machines from this section. What remains are some hos
};
};
};
};
};
boot.tmp.cleanOnBoot = true;
boot = {
tmp.cleanOnBoot = true;
loader.grub.device = "nodev";
};
zramSwap.enable = false;
networking = {
firewall.allowedTCPPorts = [ 8384 22000 ];
firewall.allowedUDPPorts = [ 21027 22000 ];
hostName = "sync";
enableIPv6 = false;
domain = "subnet03112148.vcn03112148.oraclevcn.com";
@ -1347,37 +1316,14 @@ I have removed most of the machines from this section. What remains are some hos
iptables -I INPUT -m state --state NEW -p tcp --dport 22000 -j ACCEPT
iptables -I INPUT -m state --state NEW -p udp --dport 22000 -j ACCEPT
iptables -I INPUT -m state --state NEW -p udp --dport 21027 -j ACCEPT
iptables -I INPUT -m state --state NEW -p tcp --dport 9812 -j ACCEPT
'';
};
services.openssh = {
enable = true;
# settings.PermitRootLogin = "yes";
};
users.users.root.openssh.authorizedKeys.keyFiles = [
"${self}/secrets/keys/ssh/nbl-imba-2.pub"
];
system.stateVersion = "23.11"; # TEMPLATE - but probably no need to change
# system.stateVersion = "23.11"; # TEMPLATE - but probably no need to change
environment.shellAliases = {
nswitch = "cd ~/.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
};
boot.loader.grub.device = "nodev";
services.anki-sync-server = {
enable = true;
port = 27701;
address = "0.0.0.0";
openFirewall = true;
users = [
{
username = "Swarsel";
passwordFile = config.sops.secrets.swarsel.path;
}
];
};
# do not manage OCI syncthing through nix config
services.syncthing = {
enable = true;
guiAddress = "0.0.0.0:8384";
@ -1394,6 +1340,8 @@ I have removed most of the machines from this section. What remains are some hos
server = {
enable = true;
forgejo = true;
ankisync = true;
emacs = true;
};
};
@ -3056,7 +3004,7 @@ This section is for setting things that should be used on hosts that are using t
#+end_src
**** General NixOS settings (enable home-manager module, stateVersion)
**** General NixOS settings (stateVersion)
:PROPERTIES:
:CUSTOM_ID: h:24c9146f-2147-4fd5-bafc-d5853e15cf12
:END:
@ -4703,11 +4651,11 @@ Also, the system state version is set here. No need to touch it.
:END:
#+begin_src nix :tangle profiles/server/nixos/sops.nix
{ config, ... }:
{ config, lib, ... }:
{
sops = {
age.sshKeyPaths = [ "/etc/ssh/sops" ];
defaultSopsFile = "${config.swarselsystems.flakePath}/secrets/server/winters/secrets.yaml";
age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/sops" ];
defaultSopsFile = lib.mkDefault "${config.swarselsystems.flakePath}/secrets/server/winters/secrets.yaml";
validateSopsFiles = false;
};
@ -6161,7 +6109,6 @@ Also, the system state version is set here. No need to touch it.
services.emacs = {
enable = true;
install = true;
startWithGraphical = false;
};