fi/nix-infra
1
2
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: fi:8d107286a9792bb4e63389541895f780d0be5389
Branches Tags
fi:main
fi:ikiwiki
fi:mas
..
compare: fi:b2079ab04d60fdb67b13a5e786b529dc21558d80
Branches Tags
fi:main
fi:ikiwiki
fi:mas

No commits in common. "8d107286a9792bb4e63389541895f780d0be5389" and "b2079ab04d60fdb67b13a5e786b529dc21558d80" have entirely different histories.
8d107286a9 ... b2079ab04d

23 changed files with 186 additions and 137 deletions
Download patch file Download diff file Expand all files Collapse all files

18
.sops.yaml
View file

@ -1,18 +0,0 @@
keys:
- &admin_age_fi age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
- &host_age_coturn age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l
- &host_age_ikiwiki age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0
creation_rules:
- path_regex: config/hosts/coturn/.*
key_groups:
- age:
- *admin_age_fi
- *host_age_coturn
- path_regex: config/hosts/ikiwiki/.*
key_groups:
- age:
- *admin_age_fi
- *host_age_ikiwiki
stores:
yaml:
indent: 2

1
config/common/default.nix
View file

@ -35,7 +35,6 @@
parted
tmux
nano
ssh-to-age
tcpdump
];

9
config/hosts/coturn/coturn.nix
View file

@ -5,7 +5,7 @@
min-port = 49200;
max-port = 49500;
use-auth-secret = true;
static-auth-secret-file = "/run/secrets/static-auth-secret";
static-auth-secret-file = "/secrets/static-auth-secret.secret";
realm = "turn.nekover.se";
cert = "${config.security.acme.certs."turn.nekover.se".directory}/fullchain.pem";
pkey = "${config.security.acme.certs."turn.nekover.se".directory}/key.pem";
@ -42,11 +42,4 @@
total-quota=1200
'';
};
sops.secrets."static-auth-secret" = {
mode = "0440";
owner = "turnserver";
group = "turnserver";
restartUnits = [ "coturn.service" ];
};
}

1
config/hosts/coturn/default.nix
View file

@ -4,6 +4,5 @@
./configuration.nix
./acme.nix
./coturn.nix
./sops.nix
];
}

11
config/hosts/coturn/secrets.nix Normal file
View file

@ -0,0 +1,11 @@
{ keyCommandEnv,... }:
{
deployment.keys."static-auth-secret.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "coturn/static-auth-secret" ];
destDir = "/secrets";
user = "turnserver";
group = "turnserver";
permissions = "0640";
uploadAt = "pre-activation";
};
}

25
config/hosts/coturn/secrets.yaml
View file

@ -1,25 +0,0 @@
static-auth-secret: ENC[AES256_GCM,data:af5cjUSeiCEtYki85h+XoJW5FKY4X18i6zOBZnH64Ju/LwA/yUemA8co17TG5cQnc/sw1pz6LySL2DOq/Gj42g==,iv:Yne84/VLN0jCSulA5OQ0UKbQWkqWBmHYogDuAngAp48=,tag:wJ/4yGnbypjTo/akV3P9ZA==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMXRScDR1NzhzZGRXYUZQ
ZGpRYUlOUWZTVHQvdUlrSG5SRWM2ME9sdUVZCldCZkZ0SXdqUjBVNlRnckg3N0dS
S0s2NkRnQys2SGJKSTdiUWlnbTg1dkEKLS0tIGthb0FESjAyMjlEbnV4S0lPOHda
S1ZBOWdTSmNRQXMvUGJnd05sK1Q2Qk0KHseEBDVLeSWHdgrYyITRuJyp3orrjwwS
04ORMniHR7ymHzRPvm3oX/jkFD0iJEmk8clgm/Gcn2AQ7xXeJO7Vnw==
-----END AGE ENCRYPTED FILE-----
recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmemxWRnFLMFVEcVZCb3BT
MStWU21kcnF5enpleWt3dFdaMHo3RzJGaENNClU2M2tmdE0zd2pXWUJHQkV5Mkhi
a0lIbHJmWDN6UXhVeTZId3RhcEd5TWcKLS0tIFRlSUNQN0pGYmtiOGxJS0pJY0tQ
YjFzS205QklRZWdPbklIRzVzbFFPT2sKCXra+DUchbomy9pe2HJAbhAF1mstgUcv
NalettWmuLXe2B0WjC9fAy2AAJS6kysEbUh960suzSPLTqTce0MGfA==
-----END AGE ENCRYPTED FILE-----
recipient: age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l
lastmodified: "2026-05-16T23:13:15Z"
mac: ENC[AES256_GCM,data:PxX20JAaYhj3DE1KjakVmVucL7jjZU0vh5vnSNmKLgqedJiV2ZqEXpF4s1WPgYTY723aLiWDLw/8kTF/VmvMs8zOdGSkIhojWIWFE6I2yq1MjlawXuUhGpe6C1XGQ+w0KTqzyJLxyIsUSH24GqPHmLRMStE7bYdr0a4lRBHEyqE=,iv:6tXoqhG1XqDAz4SZSIxFCi01Be76/dV4vFPwv3lkcps=,tag:ytLoh7gJ+Iuqv5AwhDElrw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.0

6
config/hosts/coturn/sops.nix
View file

@ -1,6 +0,0 @@
{ ... }:
{
sops = {
defaultSopsFile = ./secrets.yaml;
};
}

51
config/hosts/hydra/configuration.nix Normal file
View file

@ -0,0 +1,51 @@
{ ... }:
{
boot = {
loader.grub = {
enable = true;
device = "/dev/vda";
};
binfmt.emulatedSystems = [
"armv6l-linux"
"armv7l-linux"
"aarch64-linux"
];
};
networking = {
hostName = "hydra";
firewall = {
enable = true;
allowedTCPPorts = [ 8443 ];
};
};
users.users.builder = {
isNormalUser = true;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK/plZfxF/RtB+pJsUYx9HUgRcB56EoO0uj+j3AGzZta root@cherry"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKeIiHkHA5c6/jZx+BB28c5wchdzlFI7R1gbvNmPyoOg root@kiara"
];
};
nix = {
settings = {
trusted-users = [ "builder" ];
allowed-uris = "http:// https://";
};
buildMachines = [
{
hostName = "localhost";
systems = [
"x86_64-linux"
"armv6l-linux"
"armv7l-linux"
"aarch64-linux"
];
}
];
};
system.stateVersion = "23.05";
}

9
config/hosts/hydra/default.nix Normal file
View file

@ -0,0 +1,9 @@
{ ... }:
{
imports = [
./configuration.nix
./hydra.nix
./nix-serve.nix
./nginx.nix
];
}

14
config/hosts/hydra/hydra.nix Normal file
View file

@ -0,0 +1,14 @@
{ ... }:
{
services.hydra = {
enable = true;
hydraURL = "https://hydra.nekover.se";
listenHost = "localhost";
port = 3001;
useSubstitutes = true;
notificationSender = "hydra@robot.grzb.de";
extraConfig = "
binary_cache_public_uri = https://nix-cache.nekover.se
";
};
}

44
config/hosts/hydra/nginx.nix Normal file
View file

@ -0,0 +1,44 @@
{ ... }:
{
services.nginx = {
enable = true;
virtualHosts = {
"hydra.nekover.se" = {
forceSSL = true;
enableACME = true;
listen = [{
addr = "0.0.0.0";
port = 80;
}];
locations."/" = {
proxyPass = "http://localhost:3001";
};
extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol;
'';
};
"nix-cache.nekover.se" = {
forceSSL = true;
enableACME = true;
listen = [ {
addr = "0.0.0.0";
port = 80;
}];
locations."/" = {
proxyPass = "http://localhost:5005";
};
extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol;
'';
};
};
};
}

9
config/hosts/hydra/nix-serve.nix Normal file
View file

@ -0,0 +1,9 @@
{ ... }:
{
services.nix-serve = {
enable = true;
port = 5005;
bindAddress = "localhost";
secretKeyFile = "/secrets/signing-key.secret";
};
}

11
config/hosts/hydra/secrets.nix Normal file
View file

@ -0,0 +1,11 @@
{ keyCommandEnv, ... }:
{
deployment.keys."signing-key.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "hydra/signing-key" ];
destDir = "/secrets";
user = "root";
group = "root";
permissions = "0640";
uploadAt = "pre-activation";
};
}

1
config/hosts/ikiwiki/default.nix
View file

@ -4,6 +4,5 @@
./configuration.nix
./ikiwiki.nix
./nginx.nix
./sops.nix
];
}

9
config/hosts/ikiwiki/nginx.nix
View file

@ -26,7 +26,7 @@ in
tryFiles = "$uri $uri/ =404";
};
"~ .cgi" = {
basicAuthFile = "/run/secrets/auth_file";
basicAuthFile = "/secrets/ikiwiki-auth-file.secret";
extraConfig = ''
gzip off;
fastcgi_pass unix:${config.services.fcgiwrap.instances."ikiwiki".socket.address};
@ -45,11 +45,4 @@ in
'';
};
};
sops.secrets."auth_file" = {
mode = "0440";
owner = "nginx";
group = "nginx";
restartUnits = [ "nginx.service" ];
};
}

11
config/hosts/ikiwiki/secrets.nix Normal file
View file

@ -0,0 +1,11 @@
{ keyCommandEnv, ... }:
{
deployment.keys."ikiwiki-auth-file.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "ikiwiki/auth-file" ];
destDir = "/secrets";
user = "nginx";
group = "nginx";
permissions = "0640";
uploadAt = "pre-activation";
};
}

25
config/hosts/ikiwiki/secrets.yaml
View file

@ -1,25 +0,0 @@
auth_file: ENC[AES256_GCM,data:5/uT1sIOI95LNA9YFWh3I9J2PCZmz/J38YxVsKVWFHfJdZUOQpSW6ekjX7StP/svtv6Tp0AonnvcKfRcyPYn,iv:NKdWae+EihasTMV24Hk+dKJG8032mWu+RWItWs0b6RE=,tag:WBM6pXlKaDXOMnBWGBLJWg==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArNDZLcEFGRHczMHg3S0w3
eTNvNGI5TXBWTTc1eXAzZStlSmZTQ3NkdTA4CmlYVEF1NWhldVZuZmwzTUU0NG5j
UFhvU3Q3Q1BvVHhrODJWc296UUo0TmMKLS0tIFFlUGRYVDNNYm40cXhlZ004eFk5
b3BnLzBjZFpjVDN2clZaTGlWV29NVUEKsdK4V5Og+bK26Gl6HTkOBtFrHfr1RFYu
zWNGQ3skkvATO/ypa0zFf3+qnupCTTO5emwscoRK8ZZFVgSswdnbIA==
-----END AGE ENCRYPTED FILE-----
recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPOUJXWW95OXlEZFFwbHlp
RzJJMDFJU2pUTjltZ1JaWjE5c0xPY0hvNUdZCk5uWk9kdlRWNTNVUUVmT3VVeE9j
ajNNeVlZcEw4WFdqZ2QwTXl2MlhVZ2cKLS0tIFVVUXJtWkhtREFsdXp5ODZkOTA1
b1h3THFYSU1yblM0WmdxTUVtZG1OYVUK5tmcOX+jOdbSD1YCPqcAeoGF8ny61lWY
xwguejMeVZ/pCjO/qf3tb+MUlInPMXva59FelGd3nz6cbVqbeWtxSQ==
-----END AGE ENCRYPTED FILE-----
recipient: age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0
lastmodified: "2026-05-16T22:13:21Z"
mac: ENC[AES256_GCM,data:McAN1DueAhDBAY8kloB5l8M0pLIeswtnCxBtMYFyzBaY2Z43gNetBwdpzs5sL4nEmAZGPJ9AjXJVSmjb1tOn3BF8X5n6/9F7DzvHT7ukpIjumGC0KeB0QfaIGgKJyo7koISIVlGFZAwgcf1fQwaKZsYzfOGelj7UNrzFCjArK+Y=,iv:oZUmzcEr08jROw24J2fXQ4EjEJH3vzYysdy51vEtUNM=,tag:QJjNb/YvuZrZtQD9QE1Z3g==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.0

6
config/hosts/ikiwiki/sops.nix
View file

@ -1,6 +0,0 @@
{ ... }:
{
sops = {
defaultSopsFile = ./secrets.yaml;
};
}

1
config/hosts/valkyrie/nginx.nix
View file

@ -41,6 +41,7 @@
element-admin.nekover.se 10.202.41.100:8443;
fi.nekover.se 10.202.41.125:8443;
git.nekover.se 10.202.41.106:8443;
hydra.nekover.se 10.202.41.121:8443;
id.nekover.se 10.202.41.124:8443;
mas.nekover.se 10.202.41.112:8443;
matrix.nekover.se 10.202.41.112:8443;

1
config/hosts/web-public-2/nginx.nix
View file

@ -21,6 +21,7 @@
element-admin.nekover.se 10.202.41.100:8443;
fi.nekover.se 10.202.41.125:8443;
git.nekover.se 10.202.41.106:8443;
hydra.nekover.se 10.202.41.121:8443;
id.nekover.se 10.202.41.124:8443;
mas.nekover.se 10.202.41.112:8443;
matrix.nekover.se 10.202.41.112:8443;

41
flake.lock generated
View file

@ -118,11 +118,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1778947228,
"narHash": "sha256-z1PIyRIm5nlh6sB4I4ObT42O6IT5zuFzQK0RtvRoL/c=",
"lastModified": 1778830137,
"narHash": "sha256-wVKu7ZYV3ikh7RVDY1TVlaKwPTFvfkYnOzQGn3IqT4o=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "ff5e747c5f45865599ba7387244212420558e83c",
"rev": "a3c34a1dd63140ab2150ebb4fa290bbbae58193b",
"type": "github"
},
"original": {
@ -134,11 +134,11 @@
},
"nixpkgs-master": {
"locked": {
"lastModified": 1778973839,
"narHash": "sha256-gnglqTdKUK1UlKfq+ZRXmxWW+MRhbpOi3DzjTp2zqRU=",
"lastModified": 1778877216,
"narHash": "sha256-NZ9yg+VJy6RftGD3YXeqCEEVsPZH9hPu6yWm/bAuqLM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b6aac1076920329e7863e9fb607d4d1811ea16f3",
"rev": "b0415a300a8d2daf19019ef418f0b019ee38cf47",
"type": "github"
},
"original": {
@ -150,11 +150,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1778930970,
"narHash": "sha256-FqqcYr0c5in/HRL5bkRWykAGp/Q10Vj/zUiSr1P8URE=",
"lastModified": 1778843877,
"narHash": "sha256-BxYhb8H0aVtiM1kGRt+S49NbsJMUMIHvOXxziE9u0nY=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "5a51fe22e18a6ce886b3cffa4c255378c151323c",
"rev": "758b562bc257084aef30b8e3efbdd61d292806c3",
"type": "github"
},
"original": {
@ -186,8 +186,7 @@
"nixpkgs": "nixpkgs",
"nixpkgs-master": "nixpkgs-master",
"nixpkgs-unstable": "nixpkgs-unstable",
"simple-nixos-mailserver": "simple-nixos-mailserver",
"sops-nix": "sops-nix"
"simple-nixos-mailserver": "simple-nixos-mailserver"
}
},
"simple-nixos-mailserver": {
@ -211,26 +210,6 @@
"repo": "nixos-mailserver",
"type": "gitlab"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1777944972,
"narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
}
},
"root": "root",

12
flake.nix
View file

@ -8,13 +8,9 @@
inputs.nixpkgs.follows = "nixpkgs";
};
simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.11";
sops-nix = {
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-master, nixos-generators, simple-nixos-mailserver, sops-nix, ... }@inputs:
outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-master, nixos-generators, simple-nixos-mailserver, ... }@inputs:
let
hosts = import ./hosts.nix inputs;
helper = import ./helper.nix inputs;
@ -40,6 +36,12 @@
};
} // builtins.mapAttrs (helper.generateColmenaHost) hosts;
hydraJobs = {
nixConfigurations = builtins.mapAttrs (host: helper.generateNixConfiguration host {
inherit nixpkgs-unstable nixpkgs-master hosts simple-nixos-mailserver;
}) hosts;
};
# Generate a base VM image for Proxmox with `nix build .#base-proxmox`
packages.x86_64-linux = {
base-proxmox = nixos-generators.nixosGenerate {

7
hosts.nix
View file

@ -1,4 +1,4 @@
{ nixpkgs, nixpkgs-unstable, nixpkgs-master, sops-nix, ... }:
{ nixpkgs, nixpkgs-unstable, nixpkgs-master, ... }:
let
# Set of environment specific modules
environments = {
@ -22,11 +22,14 @@ let
modules = [
./config/common
./config/hosts/${name}
sops-nix.nixosModules.sops
] ++ (if environment != "" then environments.${environment} else []);
}) hosts;
in
generateDefaults {
hydra = {
site = "vs";
environment = "proxmox";
};
ikiwiki = {
site = "vs";
environment = "proxmox";