Work on hydra config, fix tor relay config, prepare web-public-2 host

hosts/hydra/configuration.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "hydra";
+    firewall.enable = false;
+  };
+
+  system.stateVersion = "23.05";
+}

hosts/hydra/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./secrets.nix
+    ./hydra.nix
+    ./nix-serve.nix
+    ./nginx.nix
+  ];
+}

hosts/hydra/hydra.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://hydra.nekover.se";
+    listenHost = "localhost";
+    port = 3001;
+    useSubstitutes = true;
+    notificationSender = "hydra@robot.grzb.de";
+    extraConfig = "
+      binary_cache_public_uri = https://nix-cache.nekover.se
+    ";
+  };
+}

hosts/hydra/nginx.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+
+      "hydra.nekover.se" = {
+        enableACME = true;
+        listen = [{
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+        }];
+        locations."/" = {
+          proxyPass = "http://localhost:3001";
+        };
+      };
+
+      "nix-cache.nekover.se" = {
+        enableACME = true;
+        listen = [{
+          addr = "0.0.0.0";
+          port = 8443;
+          ssl = true;
+        }];
+        locations."/" = {
+          proxyPass = "http://localhost:5005";
+        };
+      };
+      
+    };
+  };
+}

hosts/hydra/nix-serve.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  services.nix-serve = {
+    enable = true;
+    port = 5005;
+    bindAddress = "localhost";
+    secretKeyFile = "/secrets/signing-key.secret";
+  };
+}

hosts/hydra/secrets.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  deployment.keys."signing-key.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "hydra/signing-key" ];
+    destDir = "/secrets";
+    user = "root";
+    group = "root";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+}