aboutsummaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/sagittarius/auto-update.nix80
-rw-r--r--hosts/sagittarius/default.nix73
-rw-r--r--hosts/sagittarius/hardware.nix42
-rw-r--r--hosts/sagittarius/home.nix13
-rw-r--r--hosts/sagittarius/network.nix73
-rw-r--r--hosts/sagittarius/sops.nix33
-rw-r--r--hosts/sagittarius/ssh.nix14
-rw-r--r--hosts/sagittarius/web/acme.nix11
-rw-r--r--hosts/sagittarius/web/blog.nix26
-rw-r--r--hosts/sagittarius/web/default.nix8
-rw-r--r--hosts/sagittarius/web/mediadb.nix50
-rw-r--r--hosts/sagittarius/web/static.nix14
12 files changed, 0 insertions, 437 deletions
diff --git a/hosts/sagittarius/auto-update.nix b/hosts/sagittarius/auto-update.nix
deleted file mode 100644
index 43ba327..0000000
--- a/hosts/sagittarius/auto-update.nix
+++ /dev/null
@@ -1,80 +0,0 @@
-{ pkgs, ... }:
-let
- configRepoSource = "file:///var/lib/git/repos/isabella/nixos-config";
-in
-{
- systemd.timers.auto-update-nixos = {
- enable = true;
- description = "Fetch and update the NixOS config every minute";
- timerConfig = {
- Unit = "update-nixos.service";
- OnUnitActiveSec = "60s";
- };
- wantedBy = [ "multi-user.target" ];
- };
-
- systemd.services.update-nixos = {
- enable = true;
- description = "Fetches and update the NixOS config";
- serviceConfig = {
- Type = "oneshot";
- User = "root";
- StandardOutput = "journal";
- StandardError = "journal";
- };
- path = [
- pkgs.gitMinimal
- pkgs.nixos-rebuild-ng
- ];
- # we need root privileges for a system update anyway
- confinement.enable = false;
-
- enableStrictShellChecks = true;
- script = ''
- #!/bin/sh
- set -eu
-
- SRC_REPO="$1"
- if [ -z "$SRC_REPO" ]; then
- echo "Error: git repository source was not provided." >&2
- exit 1
- fi
-
- TEMP_DIR="$(mktemp --directory)"
- git clone --depth 1 "$SRC_REPO" "$TEMP_DIR"
-
- pushd "$TEMP_DIR"
-
- TAGS="$(git tag --sort tag --list 'v*')"
- LATEST_TAG="$(echo "$TAGS" | tail --lines 1)"
-
- if [ -z "$LATEST_TAG" ]; then
- echo "Error: no release tags defined." >&2
- exit 1
- fi
-
- git fetch "$SRC_REPO" "$LATEST_TAG"
- git checkout FETCH_HEAD
-
- CURRENT_REV="$(git rev-parse HEAD)"
- STATE_DIR="/var/lib/auto-update"
- [ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
-
- if [ -e "$STATE_DIR/last-commit" ]; then
- LAST_REV="$(cat "$STATE_DIR/last-commit")"
- if [ "$CURRENT_REV" = "$LAST_REV" ]; then
- echo "System is already up to date. Exiting." >&2
- exit 0
- fi
- fi
- echo -n "$CURRENT_REV" > "$STATE_DIR/last-commit"
-
- nixos-rebuild switch --flake .#
-
- popd
-
- rm -rf "$TEMP_DIR"
- '';
- scriptArgs = "${configRepoSource}";
- };
-}
diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
deleted file mode 100644
index 842c01e..0000000
--- a/hosts/sagittarius/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{
- pkgs,
- config,
- ...
-}:
-{
- imports = [
- # Include the results of the hardware scan.
- ./hardware.nix
- ./home.nix
- ./ssh.nix
- ./web
- ./sops.nix
- ./network.nix
- ./auto-update.nix
- ];
-
- boot.loader.grub.device = "/dev/sda";
- time.timeZone = "Europe/Helsinki";
-
- environment.systemPackages = [ pkgs.rclone ];
- virtualisation.podman = {
- enable = true;
- autoPrune.enable = true;
- dockerCompat = true;
- dockerSocket.enable = true;
- };
-
- # Set the max amount of space used for logs
- services.journald.extraConfig = ''
- SystemMaxUse=100M
- '';
-
- # Select internationalisation properties.
- i18n.defaultLocale = "en_US.UTF-8";
-
- programs.gnupg.agent = {
- enable = true;
- enableSSHSupport = true;
- };
-
- services.tailscale = {
- enable = true;
- openFirewall = true;
- };
- networking.firewall = {
- checkReversePath = "loose";
- trustedInterfaces = [ "tailscale0" ];
- allowedUDPPorts = [ config.services.tailscale.port ];
- };
-
- users = {
- users = {
- ascella = {
- isNormalUser = true;
- extraGroups = [ "wheel" ];
- openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM4aG8NI25TgjcDevjsY/Y6d3iYsQxSEtIpsqprMHmad osiris@underworld"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUcWGKF3uIf/gqbo1/lxb8XLoi67Bc2tVi1Bd/Ddhoz isabella@wonderland"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvtzeVHgenfSUrpZeyZBoBTzN96rdYMy3KEJoRXja0O isabella@nyaan"
- ];
- };
- };
- };
-
- # This value determines the NixOS release from which the default
- # settings for stateful data, like file locations and database versions
- # on your system were taken. It‘s perfectly fine and recommended to leave
- # this value at the release version of the first install of this system.
- # Before changing this value read the documentation for this option
- # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
- system.stateVersion = "23.05"; # Did you read the comment?
-}
diff --git a/hosts/sagittarius/hardware.nix b/hosts/sagittarius/hardware.nix
deleted file mode 100644
index 6b004d1..0000000
--- a/hosts/sagittarius/hardware.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-# Do not modify this file! It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations. Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
- config,
- lib,
- pkgs,
- modulesPath,
- ...
-}:
-
-{
- imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
- boot.initrd.availableKernelModules = [
- "ahci"
- "xhci_pci"
- "virtio_pci"
- "virtio_scsi"
- "sd_mod"
- "sr_mod"
- ];
- boot.initrd.kernelModules = [ ];
- boot.kernelModules = [ ];
- boot.extraModulePackages = [ ];
-
- fileSystems."/" = {
- device = "/dev/disk/by-uuid/34d333d4-2298-47c7-b015-5c3e2fd1a27e";
- fsType = "ext4";
- };
-
- swapDevices = [ ];
-
- # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
- # (the default) this is the recommended approach. When using systemd-networkd it's
- # still possible to use this option, but it's recommended to use it in conjunction
- # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
- networking.useDHCP = lib.mkDefault true;
- # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
- nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
diff --git a/hosts/sagittarius/home.nix b/hosts/sagittarius/home.nix
deleted file mode 100644
index d285afc..0000000
--- a/hosts/sagittarius/home.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ flakeRoot, ... }:
-{
- home-manager = {
- useGlobalPkgs = true;
- useUserPackages = true;
- sharedModules = [ { imports = [ (flakeRoot + /share/home/minimal.nix) ]; } ];
-
- users = {
- root.home.stateVersion = "23.05";
- ascella.home.stateVersion = "23.05";
- };
- };
-}
diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
deleted file mode 100644
index 8d21275..0000000
--- a/hosts/sagittarius/network.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ flakeRoot, ... }:
-{
- imports = [ (flakeRoot + /wireguard.nix) ];
-
- networking = {
- hostName = "sagittarius";
- useNetworkd = true;
- firewall.enable = false;
- nftables = {
- enable = true;
- tables.filter = {
- enable = true;
- family = "inet";
- content = ''
- set temp-ports {
- type inet_proto . inet_service
- flags interval
- comment "Temporarily opened ports"
- }
-
- chain rpfilter {
- type filter hook prerouting priority mangle + 10; policy drop;
- meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
- fib saddr . mark . iif check exists accept
- jump rpfilter-allow
- }
-
- chain rpfilter-allow {
- }
-
- chain prerouting {
- type filter hook prerouting priority mangle;
- iifname "wg0" meta mark set 42
- }
-
- chain input {
- type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "trusted interfaces"
- icmpv6 type echo-reply accept
- ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
- }
-
- chain input-allow {
- tcp dport { 22, 80, 443 } accept
- udp dport 51820 accept
- meta l4proto . th dport @temp-ports accept
- icmp type echo-request accept comment "allow ping"
- icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4."
- ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
-
- iifname "wg0" udp dport 53 accept comment "allow DNS over wireguard"
- }
- '';
- };
- };
- };
-
- systemd.network = {
- enable = true;
-
- networks = {
- "10-wan" = {
- matchConfig.Name = "enp1s0";
- networkConfig.DHCP = "ipv4";
- address = [ "2a01:4f9:c012:c7a7::1/64" ];
- routes = [ { Gateway = "fe80::1"; } ];
- # networkConfig = {
- # IPv6Forwarding = false;
- # };
- };
- };
- };
-}
diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix
deleted file mode 100644
index a58b4b2..0000000
--- a/hosts/sagittarius/sops.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ ... }:
-{
- sops = {
- age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
- defaultSopsFile = ../../secrets/sagittarius.yaml;
- secrets = {
- # "sorre-forgejo-access-token" = { };
- # "forgejo-runner-token" = {
- # sopsFile = ../../secrets/forgejo-runner-token.env;
- # format = "dotenv";
- # };
- "porkbun-acme-conf" = {
- sopsFile = ../../secrets/porkbun.env;
- format = "dotenv";
- };
- # "priv-blog-auth-file" = {
- # sopsFile = ../../secrets/priv.sorre.xyz.htpasswd.txt;
- # owner = "nginx";
- # format = "binary";
- # };
- "wg-ca-key" = {
- sopsFile = ../../secrets/ca/certs/sagittarius.sorre.internal.key;
- owner = "nginx";
- format = "binary";
- };
- "wg-ca-crt" = {
- sopsFile = ../../secrets/ca/certs/sagittarius.sorre.internal.crt;
- owner = "nginx";
- format = "binary";
- };
- };
- };
-}
diff --git a/hosts/sagittarius/ssh.nix b/hosts/sagittarius/ssh.nix
deleted file mode 100644
index 78faebd..0000000
--- a/hosts/sagittarius/ssh.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ ... }:
-{
- services.openssh = {
- enable = true;
- settings = {
- PermitRootLogin = "no";
- PasswordAuthentication = false;
- AllowUsers = [
- "ascella"
- "forgejo"
- ];
- };
- };
-}
diff --git a/hosts/sagittarius/web/acme.nix b/hosts/sagittarius/web/acme.nix
deleted file mode 100644
index 85c0c75..0000000
--- a/hosts/sagittarius/web/acme.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, ... }:
-{
- security.acme = {
- acceptTerms = true;
- defaults = {
- email = "isabella@sorre.xyz";
- dnsProvider = "porkbun";
- environmentFile = config.sops.secrets."porkbun-acme-conf".path;
- };
- };
-}
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
deleted file mode 100644
index 1788d15..0000000
--- a/hosts/sagittarius/web/blog.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- inputs,
- pkgs,
- config,
- ...
-}:
-{
- imports = [ ./acme.nix ];
-
- services.nginx = {
- # enable = false;
-
- virtualHosts."sorre.xyz" = {
- enableACME = true;
- forceSSL = true;
- root = inputs.sorre-website.packages.${pkgs.system}.default;
- };
-
- virtualHosts."priv.sorre.xyz" = {
- enableACME = true;
- forceSSL = true;
- root = "/var/www/priv";
- basicAuthFile = config.sops.secrets."priv-blog-auth-file".path;
- };
- };
-}
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
deleted file mode 100644
index c0b9d3b..0000000
--- a/hosts/sagittarius/web/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ ... }:
-{
- imports = [
- # ./blog.nix
- # ./mediadb.nix
- # ./static.nix
- ];
-}
diff --git a/hosts/sagittarius/web/mediadb.nix b/hosts/sagittarius/web/mediadb.nix
deleted file mode 100644
index 6627e50..0000000
--- a/hosts/sagittarius/web/mediadb.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
- pkgs,
- lib,
- config,
- ...
-}:
-let
- newPostgres = pkgs.postgresql_18_jit;
- cfg = config.services.postgresql;
- # upgrade-pg-cluster = pkgs.writeScriptBin "upgrade-pg-cluster" ''
- # set -eux
- # systemctl stop postgresql
-
- # export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
- # export NEWBIN="${newPostgres}/bin"
-
- # export OLDDATA="${cfg.dataDir}"
- # export OLDBIN="${cfg.finalPackage}/bin"
-
- # install -d -m 0700 -o postgres -g postgres "$NEWDATA"
- # cd "$NEWDATA"
- # sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs}
-
- # sudo -u postgres "$NEWBIN/pg_upgrade" \
- # --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
- # --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
- # "$@"
- # '';
-in
-{
- services.postgresql = {
- enable = false;
- package = pkgs.postgresql_18_jit;
- enableTCPIP = true;
- enableJIT = true;
-
- settings = {
- password_encryption = "scram-sha-256";
- };
-
- authentication = ''
- # TYPE DATABASE USER ADDRESS METHOD
- local all all peer
- host all postgres all reject
- host all all all scram-sha-256
- '';
- }; # end of services.postgreslq
-
- # environment.systemPackages = [ upgrade-pg-cluster ];
-}
diff --git a/hosts/sagittarius/web/static.nix b/hosts/sagittarius/web/static.nix
deleted file mode 100644
index 617cac9..0000000
--- a/hosts/sagittarius/web/static.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ ... }:
-{
- imports = [ ./acme.nix ];
-
- services.nginx = {
- # enable = false;
-
- virtualHosts."static.sorre.xyz" = {
- enableACME = true;
- forceSSL = true;
- root = "/var/www/static";
- };
- };
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-27 09:25:59 +0000