From f5af726382feaeb26647eb9f0666c56441ce7bbc Mon Sep 17 00:00:00 2001 From: "Lennart J. Kurzweg (Nx2)" Date: Wed, 20 Nov 2024 01:24:57 +0100 Subject: [PATCH] nx2site gitea and vaultwarden (working) --- configuration.nix | 2 +- git-crypt/secrets.nix | Bin 3134 -> 3129 bytes home-modules/ssh.nix | 2 +- system-modules/nx2site.nix | 109 ++++++++++++----- system-modules/nx2site/gitea.nix | 160 +++++-------------------- system-modules/nx2site/proxy.nix | 28 ++--- system-modules/nx2site/vaultwarden.nix | 2 +- system-modules/postgres.nix | 61 ++++------ system-modules/sshd.nix | 4 +- system-modules/users.nix | 2 +- 10 files changed, 157 insertions(+), 213 deletions(-) diff --git a/configuration.nix b/configuration.nix index 65a5205..9e989cb 100755 --- a/configuration.nix +++ b/configuration.nix @@ -42,7 +42,7 @@ ./system-modules/nx2site.nix ./system-modules/postgres.nix ./system-modules/nx2site/proxy.nix - # ./system-modules/nx2site/gitea.nix + ./system-modules/nx2site/gitea.nix ./system-modules/nx2site/vaultwarden.nix ] else []); diff --git a/git-crypt/secrets.nix b/git-crypt/secrets.nix index c6f0ad4cfb8d3016a42a0cf8a7610443d4a5d5aa..7f066b13a1e712156ab46843331e2fd5162c2ad2 100755 GIT binary patch literal 3129 zcmZQ@_Y83kiVO&0aQS#eNwO(#$)5u&ZMOwJT;5f#^v~7gxZcJ;3}3H#91o1mJALOw zIp=kgDZK8+pXNQEKJ%Ttfs|Iq`-88!ufJ9gjefhx`Kt6j0~z+e2hOt_K60^skv*G* z@$0WGbxD=n8*C(6moR>O-lp&O&s1(UTMsceqt2hDG;?%#tbl zsuh?EwrCvCWcGS|EBsp+$8E8zLN^mW2I>oPzzLQs7)BSwfG}q~^WAdXtB_$amSK^vy92MeXlvDHL3l!exvrOQ@k&eQ- zoGp`?FRj@Xu=eZSlo>zfv}fKl$W^ro+cd?U$KuKnTP2ISY3!z&x*dMuzveuCocj3e zN<))~`|SMOuh}^RAM_Rr2?=l55)`6(XXc_uy&o*o{$E=!{M+gKqKCeB*H4&xvXS}n zzu?=sap#lYm#JvPy+2=YP30ToLzR`yzRjV9eol{LSN1RN(QWylyNdVCW3RNm=bfSy zi%Ku2seK4obo-{^HLvdsMF$G&Osjb&d1+r@PiBhBo#>$SLLt?P{qFOL^FCV_c%Jh% zF>+Zh=#y{r?7-={)n|T73I}|;yN~1R=6UYECi2Cid2#Pm_pQ!qw>?-g`ISVN?74~~ zxz7Vub+u%K7=HTx`_mU6wMA;1j>R(KjqXKtuw(!O(Vr^0LQiQOhpLMG;pGwI^=8zUi93pi|@bsq*cAgEi|9U7WN%uld%_HYT^5 z8(Q?M1TD_(51;P)K)Uz-wkvllxBNNy^<2sNEnD0eA7uDlO-s4nnD=qlr%=~(r^0S3 ztu|v$3|+ok%P>A(AW@C4T$g`^Lw9msLqdw~(Ro&n&QI1Ajk(2{sB)$4@s|+8z6LJM zi_Xs;OzjjDwXWMwMR`iag$q!xMt?D^@mo9m}+T&xS%|Gp^y|d%i=zPw6_VT`H zwUupG!k$YpI~%zTn{0n-N7!*jM)@3)7(S7hQh^Vf*1+qRyIvplb+IhJX**nG3#nyVojGwt@L_!^3RU$XvX>}JnJ zg%SyeI!@JCOcLsrRql&2vn|b;q}g)p&b0HwiGfK|>?`D%pHvkz&2Nx%EUkaKeZ9?` z)duHp@C&`mct1VZKweVM{wnkGV(AqZB+l}dOe-|`vt229k>aW?Tc)j9!o2ubVcd$$ zsjrlh(^T)i^ew#I(7)%uc)P&#s-;VHr;BWg{oq}rm8thGopHkxg}1S3#oobY ziAVXV!}1pbxu>Zg?>TyJS87wkxyF8%85YvP3|sDK7pqzwRh+bLvv2yMujf1WFm2r$ zw|j*%W0;-dI-?nj?|WzYO%wU2#Je$(o$H5n`1wVV0R?n^B0V&YJ8~ z(`Pg1<%yc{T+EePiPGJF)Qw(?KDTgw?JWA^{rT5x%a>X% zTXXD)+?%*S^KDl9U4CmB|IbVB7puI?wPel#Pp3bO3GuN9gH~SUo~ttXK!uR~W!Hue zFHSp2wb~hdiQhjt)lPy}eEqsULatpB=&$gH? zx^Jtkf3WZ9+4DvGE-M@#n5cZ(eyHnR>ayQ0+?NgA_ls;Rww_ePvtnkSlfIO&#ay+T z*owU>mc~b~ac^B5;kwxO(jkYtJ5)D|?mQ4M&+|&{iO9q2xZii5ICJ3VyceGzc5msq zbYR9_<>zNFvul_AJoPO1XUXb`#g9LwZqw(ERd`?gIVCmdpZg8na!i#6?$~5aISnZqtYnQ;Qm>{1S zS5!h~Y^<}0Psq<-nV@)S_7Tr1nP0tb7lxm>_v)4LsukD7ia3jO9OfigzY%WTAbp}g zVr9kO(;pN{&u=u>nYH1zsezeFhor^4Bfk%d#BX@Wa!Ap6v2w9=$Sy6H()oWBjTYL< zeVO}Rtb|R_pGA3^u!Q51#EM7vQ!nmFnWC{vapSVb7fUmKYM!^e$$xZ$-?&A5MZCj0!jxOsmze40Ej-LSyLN#5M)?wJV(`6}gp?XF#}8Pk3) zeewQ}T0eF8E1ssatA>7h9b5lnqF7Cc=+kUH-#WFT4U<3iEPP-l`2PUI9n*4&pt*up zn>ZKT`hJu3DBIDybEd4Fa)9eE`10g34gZBWq0+@Ee?M()34ur#cF$&ao?nG zUspKITrAYA@q>+Jj~#2)vmFI3XPf`8*coU%!TjgZ@)NPM_~Y4_QY|ky%(1>(tv>T* z>u&ag7lL~)`i3YrWqw?D^5MDO4KKC^2Rm$C``NRA!&38oI)mk(9T%&vZvR!yJ!PY$ zk$_KUlZC_`zk0Q!^{%<|)3&_V`Dzx&7QFreXUFx~*WSJL;(el)@5yo}Cu6yqvK77BdFt2%Ho`vf2dEz?T0+=0Lby-W9B!B4f zw40}NZANawF_(m0myUj1G2ii??*>;R8O9A8s=oOx>;HQ)Y3&@@&GY8QJ!TIu4p?72 zoqLwtUhBeZ;+BTz&)TMkHNAc`FaFW2zf0FSXfE12_xDoQ%T9}TZ~A6?sA<8b9U?K^ z8(8L_=0Epf+l84zpPj7NYIMwA_5GOE#80O;a_wyM=MCHS_1)a9Vq%L#t8_M8es{@K zYSQBGM!PGX`^~jlZZ#_)%i+w)|4;kFb3Z;?|Ep<(m<#v(1IluJFVd#?+N{kuUgRfo z{8kA&&*PoTx_I*TTRz`kH*K-Qm-$-Z?N|NwuQk&bN|e1VRzH}`SH+d zlhUYv8!v9q-c(RJrRQW^r&Vn6ni(-pfolT!Zd(}tKeukvj^*bXlP9uHFk5zU<$Z;J z(#P7LU+Fix5*!pVdw!WI>w!b<|7S<+*rQW_xo_4FkAv#Tr;|e zZ|+VKL1Ox&2A<-BzE{ptI^BzZia;bC^>RX!u%nk?;KY zz^PNcil0uYFHRA!PKC?U7kl%bdADHh ghm+l*%*VG!Ilb`T?&|w%6>G-a%J91~%zZ+60JxtIApigX literal 3134 zcmZQ@_Y83kiVO&0sIxBhm>d*3`5L44)MIs z?reRKbKGry`nrYtxFasUd6XF?)Gf#?J#S;M-`B-%Y6s+R{F-qi`NVg@X)T*YEy@^v z9k585 za9w;5)pP6s@5@D=LUWWS9?No7bpdG&A8o|W&+OSa0at8bYfJ}FT;@#ndf(KDXNYO_yxyXUp48N0xm z3qQVl-!sl+&;EGX=j(!5%&8hm@?16VZqL&`JLjsEFGqdp%yTE_1wK5(t$X7|h|P>` zW_~K6jol9?p68xCm#cXn1JeYhR;z_4eZo}^-CUu=Ijg?y?<(8HE-63$y?>^Aa2rQw zceau7wdTf3*XXpOU51anYj)|`iT_;n*q>ohh}X#@g59eVL)4_QYNTZ{I@%{s{5O*) zw6A2sY4^WVyb|*cZMbXKa!x>u#b0xG_^-}nry0i4HSYTMYiBdfew#Pxv*CF=g%qx%A5P3` zKfGV?4tvOEe-4Fu&W$$zVvXgq6Mfdn&RwJTYtfUf>VqU&Vt=1Y+tPM^TDWffuc8a_!EJlbuP;y9 zciQ_~_2#0Bw!uH*-!FgoKFChwhpxqvKU*(yuhO*Gbb4XhES6618&B8X;d^>~sr};O z8Oq19FBPcd9sTyan-jRu6WedDj7pG63#?-T5^PD|=tul9KGYIeQ*4gmj&_2P%wO-7bvOycN zRTf5Hda*4+zM!psU(|{@4|U3J>8^fe`SROoj(g7CQ_L>=$9$AM!`vg_uX(HUy~97h zOe5=qbycozqGv)IoD!Byejn_yys7nN{>J`&%!O^MZU|a@dh{JXJEJ?-}*G?UOVr;JihO2e-dY|%#pjhvB0i*!EVku1*iX=oPcMg7QuxgVyi9I-|Li?YklgRz2eN8 z{fXz4czxb}tg+=&n(F;I{?!agy(^kJH(dVDnfCN^Y%f-~?VRNx8vgp`5>xRz3C4-* ze!pwwjV_t8XlYF1_TR@>yTqM26}O{r=Zwvtw@aV>JfAD^RO#*h?KhvYf6`6E+5frmQ+1 z@pDU-{X~m>j)rE(;-1B-&(kh0@jh`|%jO5u^!FPCgZ_(sy2rWrUy(*@ zXYK5-HT4HP1p`k;9&%i#*zlw5)+}4s!lQe)%RBKWYaFh=FWt3fuhWvsW!qgXrCOFH ztzYufIZF zxO;ipWzPT?olBXyYO^L=zMbjHERp=@Xl>GVM(>wRTkaj0viG!Y8Drs*jXnEoe|Y;G zljKPJaQf-)!}}WUrK}2AoO;lAyTrF1rM~dgg-`6?Ox(aAaHz{q(kvq}K`yjt9tZ13 zuK8~t^{igY$i1yDZjQbZe|pb~13ESZp0+C)&);7Zdr5v$&oUklb1jir4yo|f+6@m> z@4R3w^ZQZ8aL(tpYxSBR>)!UKF+FJZGxeUttWFJq*eQ$A3rnyN6+CTIX>HUHLs_{auzc5O%hqa{f0q4 z%jE046M8R-?sBb|ZSyZj!jOBhhG<)!yiTzbx1z$PM5a06DvzIKUfFeO!HPp$H%DK6%_Ceu(+%F7B9OBYsaxJ~-3q zz*M`{_dgY^yE}95%S^)zhrEjId&RfTmloUq^85o^pHe5E%coCg)Lsbw#BQRg`}TzS zmIluK5?NK*3&SQX_%F-ZCceAtN$2H*yUsPHo#D_tG;7(~zy4?5JX&qxm>FBKE^tZf zFR2fjT&0mVLd|mJ&Kutvd=Ck7QoqK2#L{_r^=Y-&YzL*Q6%Tu6vD@=ZxW+X7*I}kf zf|D<8oOwf>CFoF8WKG-TFrmA~@_$}x+?@Gl-2o<+jrViod_&Ifl9LoTzt%YUpg?`O zS^2>bzOu!}$zj&3&ONcbyXOH@|IH3Fo63j5Uk?*;*%L zn7^ApbM=d#KhJ4=^_{7=``h-UqbEM3KK5qQ>JT~4qb#|1LXJvH??t(})2!0dm6kY3 zF@ERbcU5KiXXWy$f7R^JX^huS?VEJG=GHf9!PV<~@8&c03xC)w7(AoEQ^Zc{%cdgP zoqI)-E6dodUwc&tURPoL(#B-9MNs=~`>XtKd8nsAx>2=W9FPPr9-Px(_$EoP8|29`$ z3;k^R_tevz;FAjCQICR`F1zCQ)2iUheo0Fucac()hrx!&ciJrwe&%Fg-7V0ycH^0% z?sH)gv9FINsN|-WG~DQ#wqov!JHC6ieN>t8^I!$nEkD74^52>FB3#sG_lv9vIP|8) z^T|u;9|tGbyuZ-h^YzJlp1%9NXa2n5XZv{7ap%Nyf1V_K+GDRFekeEL*!{v^X-gAr zPe(m2`no!ur_Oy+-RTbrH9Shy`kO4L=iT-E_R}Fmtk#n2*Ch6Ylj|d+@}mp4CiYl3 zDZlaAP&DhelV#q#u8s%FQ*7s{-J5rl$ML zDSMAdtQJUY;k|P9%A`L9-Jv?F4*ws|?GAksammj6Q}0qM>$1ilnTJB;C)AoOeZK8& z+_a^S`+hM*9f-7>bKLM!`*#b2orz~z(z9>yF0qxN-2L+oBX1|Rxa>cWq-@gZ06Ko|Cg~naN~};#c^DrTJvz@gmail.com' --header "X-Auth-Key: " -s | jq base = "58d3412e8d88889d1a611b3669f0700f"; - sub = "fc861353142bc05d5dbad1799178e6a1"; base6 = "d1b90e21d2d747dcb30448bd65312927"; + sub = "fc861353142bc05d5dbad1799178e6a1"; sub6 = "b8082b7afe9e80971fc9f9dda16ec284"; + ssh = "c0f14f17f32d6595c202f041dd836eb3"; + ssh6 = "f1ecb2d9d0522d4eec06437688ca76da"; }; passord-file-path = config.sops.secrets."nx2site/cloudflare/global-api-key".path; log-file-path = "/var/log/couldflare.log"; count-file-path = "/var/log/cloudflare-count.txt"; in pkgs.writers.writePython3Bin "dyn_dns" { libraries = with pkgs.python311Packages; [ requests ]; - flakeIgnore = [ "E501" "E305" "E701" "E704" "E302" "E114" "F841" "E121" "E261" "E303"]; + flakeIgnore = [ "E501" "E305" "E701" "E704" "E302" "E114" "F841" "E121" "E261" "E303" ]; } /* python */ '' import requests import subprocess - from datetime import datetime + # from datetime import datetime def get_public_ip(ipv6=False): return subprocess.run(['${pkgs.curl}/bin/curl', '-s', '-6' if ipv6 else '-4', 'https://ifconfig.me'], capture_output=True, text=True).stdout.strip() @@ -43,13 +59,13 @@ my_ip = get_public_ip() my_ip6 = get_public_ip(ipv6=True) - with open("${count-file-path}", "r") as f: - content = f.read() - if content == "": count = 0 - else: count = int(content) - count += 1 - with open("${count-file-path}", "w") as f: - f.write(str(count)) + # with open("${count-file-path}", "r") as f: + # content = f.read() + # if content == "": count = 0 + # else: count = int(content) + # count += 1 + # with open("${count-file-path}", "w") as f: + # f.write(str(count)) # 4 with open("${passord-file-path}", 'r') as pw_file: @@ -85,7 +101,7 @@ }, json={ "comment": "Domain verification record", - "name": "${domain}", + "name": "*.${domain}", "proxied": True, "settings": {}, "tags": [], @@ -95,15 +111,34 @@ } ) + resp_sshd = requests.patch( + 'https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${record_id.ssh}', + headers={ + 'Content-Type': 'application/json', + 'X-Auth-Email': '${account_id}', + 'X-Auth-Key': pw + }, + json={ + "comment": "Domain verification record", + "name": "ssh.${domain}", + "proxied": False, + "settings": {}, + "tags": [], + "ttl": 1, # automatic + "content": my_ip, + "type": "A" + } + ) + if resp_base.status_code != 200: print(resp_base.text) - now_str = datetime.now().strftime('%Y/%m/%d-%R') - log_entry = f"At {now_str} - to {my_ip} - Response {resp_base.status_code}\n" - print(log_entry, end="") - with open("${log-file-path}", 'a') as log_file: - log_file.write(log_entry) + # now_str = datetime.now().strftime('%Y/%m/%d-%R') + # log_entry = f"At {now_str} - to {my_ip} - Response {resp_base.status_code}\n" + # print(log_entry, end="") + # with open("${log-file-path}", 'a') as log_file: + # log_file.write(log_entry) # Perform DNS updates # https://developers.cloudflare.com/api/operations/dns-records-for-a-zone-update-dns-record @@ -135,7 +170,7 @@ }, json={ "comment": "Domain verification record", - "name": "${domain}", + "name": "*.${domain}", "proxied": True, "settings": {}, "tags": [], @@ -145,14 +180,32 @@ } ) + resp_sshd = requests.patch( + 'https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${record_id.ssh6}', + headers={ + 'Content-Type': 'application/json', + 'X-Auth-Email': '${account_id}', + 'X-Auth-Key': pw + }, + json={ + "comment": "Domain verification record", + "name": "ssh.${domain}", + "proxied": False, + "settings": {}, + "tags": [], + "ttl": 1, # automatic + "content": my_ip6, + "type": "AAAA" + } + ) + if resp_base.status_code != 200: print(resp_base.text) - - now_str = datetime.now().strftime('%Y/%m/%d-%R') - log_entry = f"At {now_str} - to {my_ip6} - Response {resp_base.status_code}\n" - print(log_entry, end="") - with open("${log-file-path}", 'a') as log_file: log_file.write(log_entry) + # now_str = datetime.now().strftime('%Y/%m/%d-%R') + # log_entry = f"At {now_str} - to {my_ip6} - Response {resp_base.status_code}\n" + # print(log_entry, end="") + # with open("${log-file-path}", 'a') as log_file: log_file.write(log_entry) if __name__ == "__main__": main() @@ -164,7 +217,7 @@ ''; serviceConfig = { Type = "oneshot"; - User = "root"; + User = dns-user; }; }; }; @@ -174,7 +227,7 @@ # "172.1.0.9" = [ "matrixdb.docker" ]; # "172.1.4.1" = [ "matrix-ss.docker" ]; # "172.1.0.7" = [ "matrix-ssdb.docker" ]; - "172.1.5.1" = [ "pw.docker" ]; + # "172.1.5.1" = [ "pw.docker" ]; "172.1.6.1" = [ "git.docker" ]; # "172.1.0.10" = [ "gitdb.docker" ]; # "172.1.7.1" = [ "nn.docker" ]; diff --git a/system-modules/nx2site/gitea.nix b/system-modules/nx2site/gitea.nix index 6f877ea..df41284 100644 --- a/system-modules/nx2site/gitea.nix +++ b/system-modules/nx2site/gitea.nix @@ -1,4 +1,5 @@ -{ config, pkgs, lib, domain, ... }: +{ config, pkgs, secrets, user, domain, ... }: +let git-user = "git"; in { sops.secrets = { "postgres-pw" = { owner = config.services.gitea.user; }; @@ -7,36 +8,46 @@ environment.systemPackages = with pkgs; [ gitea ]; + users = { + users = { + "${user}".extraGroups = [ git-user ]; + "${git-user}" = { + isSystemUser = true; + group = git-user; + useDefaultShell = true; + home = config.services.gitea.stateDir; + openssh.authorizedKeys.keys = config.users.users."${user}".openssh.authorizedKeys.keys; + }; + }; + groups."${git-user}" = {}; + }; services.gitea = { enable = true; package = pkgs.gitea; - group = "gitea"; # default - user = "gitea"; # default + group = git-user; + user = git-user; appName = "NxGit"; stateDir = "/var/lib/gitea"; # default useWizard = false; # default # camoHmacKeyFile = ; - customDir = "${config.services.gitea.stateDir}/custom"; # default database = { createDatabase = false; # default host = "127.0.0.1"; # default port = 5432; passwordFile = config.sops.secrets."postgres-pw".path; - # path = "${config.services.gitea.stateDir}/data/gitea.db"; # default - # socket = "/run/postgresql"; socket = null; type = "postgres"; name = "gitea"; # default user = "gitea"; # default }; - # dump = { - # enable = true; - # backupDir = "${config.services.gitea.stateDir}/dump"; # default - # file = null; # default - # interval = "daily"; - # type = "zip"; # default - # }; + dump = { + enable = true; + backupDir = "/var/backup/gitea"; + file = null; # default = chosen by gitea + interval = "daily"; + type = "zip"; # default + }; # extraConfig = null; # default # lfs = { # enable = false; # default @@ -44,25 +55,23 @@ # }; # mailerPasswordFile = null; # default # metricsTokenFile = null; # default - repositoryRoot = "${config.services.gitea.stateDir}/repositories"; # default + # repositoryRoot = "${config.services.gitea.stateDir}/repositories"; # default settings = { log = { LEVEL = "Info"; # LEVEL = "Error"; - ROOT_PATH = "${config.services.gitea.stateDir}/log"; # default }; - # i18n = { - # LANGS = "en-US"; - # }; server = { DISABLE_SSH = false; # default - SSH_PORT = 20022; - # DOMAIN = "pw2.${domain}"; - # HTTP_ADDR = "${config.services.gitea.settings.server.DOMAIN}:${toString config.services.gitea.settings.server.HTTP_PORT}/"; + START_SSH_SERVER = false; # default + SSH_LISTEN_HOST = "0.0.0.0"; + SSH_PORT = secrets.ssh.port; + DOMAIN = "pw.${domain}"; + SSH_DOMAIN = "ssh.${domain}"; + # HTTP_ADDR = "${config.services.gitea.settings.server.DOMAIN}"; # HTTP_PORT = 3000; # default # PROTOCOL = "http"; # default - # ROOT_URL = "https:pw2.${domain}/"; # default - STATIC_ROOT_PATH = "${config.services.gitea.stateDir}/static"; + # ROOT_URL = "https:pw.${domain}/"; # default }; session = { COOKIE_SECURE = true; @@ -73,108 +82,3 @@ }; }; } -# APP_NAME = Gitea: Git with a cup of tea -# RUN_MODE = prod -# RUN_USER = git -# WORK_PATH = /data/gitea - -# [repository] -# ROOT = /data/git/repositories -# ENABLE_PUSH_CREATE_ORG = true -# ENABLE_PUSH_CREATE_USER = true - -# [repository.local] -# LOCAL_COPY_PATH = /data/gitea/tmp/local-repo - -# [repository.upload] -# TEMP_PATH = /data/gitea/uploads - -# [server] -# APP_DATA_PATH = /data/gitea -# DOMAIN = git.nx2.site -# SSH_DOMAIN = git.nx2.site -# HTTP_PORT = 3000 -# ROOT_URL = https://git.nx2.site/ -# DISABLE_SSH = false -# SSH_PORT = 22 -# SSH_LISTEN_PORT = 22 -# LFS_START_SERVER = true -# LFS_JWT_SECRET = aitnnoway -# OFFLINE_MODE = false - -# [database] -# PATH = /data/gitea/gitea.db -# DB_TYPE = postgres -# HOST = giteadb:5432 -# NAME = gitea -# USER = gitea -# PASSWD = -lkjlkj -# LOG_SQL = false -# SCHEMA = -# SSL_MODE = disable - -# [indexer] -# ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve - -# [session] -# PROVIDER_CONFIG = /data/gitea/sessions -# PROVIDER = file - -# [picture] -# AVATAR_UPLOAD_PATH = /data/gitea/avatars -# REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars - -# [attachment] -# PATH = /data/gitea/attachments - -# [log] -# MODE = console -# LEVEL = info -# ROOT_PATH = /data/gitea/log - -# [security] -# INSTALL_LOCK = true -# SECRET_KEY = -# REVERSE_PROXY_LIMIT = 1 -# REVERSE_PROXY_TRUSTED_PROXIES = * -# INTERNAL_TOKEN = faaaaakeeyJuYmYiOjE3MTMxMTAzMjN9.iliwlrfZDTb8oL296gpXRYhC-6_AJdjePO7dk3NT-PE -# PASSWORD_HASH_ALGO = pbkdf2 - -# [service] -# DISABLE_REGISTRATION = true -# REQUIRE_SIGNIN_VIEW = false -# REGISTER_EMAIL_CONFIRM = false -# ENABLE_NOTIFY_MAIL = false -# ALLOW_ONLY_EXTERNAL_REGISTRATION = false -# ENABLE_CAPTCHA = false -# DEFAULT_KEEP_EMAIL_PRIVATE = false -# DEFAULT_ALLOW_CREATE_ORGANIZATION = true -# DEFAULT_ENABLE_TIMETRACKING = true -# NO_REPLY_ADDRESS = noreply.nx2.site - -# [lfs] -# PATH = /data/git/lfs - -# [mailer] -# ENABLED = true -# SMTP_ADDR = smtp.gmail.com -# SMTP_PORT = 587 -# FROM = git@nx2.site -# USER = lennart.kurzweg.lk@gmail.com -# PASSWD = "ihh" - -# [openid] -# ENABLE_OPENID_SIGNIN = true -# ENABLE_OPENID_SIGNUP = false - -# [cron.update_checker] -# ENABLED = false - -# [repository.pull-request] -# DEFAULT_MERGE_STYLE = merge - -# [repository.signing] -# DEFAULT_TRUST_MODEL = committer - -# [oauth2] -# JWT_SECRET = redavt diff --git a/system-modules/nx2site/proxy.nix b/system-modules/nx2site/proxy.nix index df9f34a..d22f510 100644 --- a/system-modules/nx2site/proxy.nix +++ b/system-modules/nx2site/proxy.nix @@ -14,7 +14,7 @@ }; certs = { "${domain}" = { - extraDomainNames = builtins.map (subd: "${subd}.${domain}") [ "git" "git2" "pw" "pw2" "sync" ]; + extraDomainNames = builtins.map (subd: "${subd}.${domain}") [ "git" "pw" "sync" ]; }; }; }; @@ -99,16 +99,16 @@ listen = dl; locations = { "~.*" = { return = "502"; }; }; }; + # "pw.${domain}" = vh // { + # listen = dl; + # locations = let d = "pw.docker:80"; in { + # "/" = { proxyPass = "http://${d}"; }; + # "/admin" = { proxyPass = "http://${d}"; }; + # "/notifications/hub" = { proxyPass = "http://${d}"; }; + # "/notifications/hub/negotiate" = { proxyPass = "http://${d}"; }; + # }; + # }; "pw.${domain}" = vh // { - listen = dl; - locations = let d = "pw.docker:80"; in { - "/" = { proxyPass = "http://${d}"; }; - "/admin" = { proxyPass = "http://${d}"; }; - "/notifications/hub" = { proxyPass = "http://${d}"; }; - "/notifications/hub/negotiate" = { proxyPass = "http://${d}"; }; - }; - }; - "pw2.${domain}" = vh // { listen = dl; locations = let d = with config.services.vaultwarden.config; "${ROCKET_ADDRESS}:${builtins.toString ROCKET_PORT}"; @@ -123,11 +123,11 @@ listen = dl; locations = { "/" = { proxyPass = "http://127.0.0.1:11434"; }; }; }; + # "git.${domain}" = vh // { + # listen = dl; + # locations = { "/" = { proxyPass = "http://git.docker:3000"; }; }; + # }; "git.${domain}" = vh // { - listen = dl; - locations = { "/" = { proxyPass = "http://git.docker:3000"; }; }; - }; - "git2.${domain}" = vh // { http2 = false; listen = dl; locations = { "/" = { proxyPass = "http://127.0.0.1:3000"; }; }; diff --git a/system-modules/nx2site/vaultwarden.nix b/system-modules/nx2site/vaultwarden.nix index c7fe7e7..d5e5546 100644 --- a/system-modules/nx2site/vaultwarden.nix +++ b/system-modules/nx2site/vaultwarden.nix @@ -27,7 +27,7 @@ SMTP_PASSWORD = "@SMTP_PASSWORD@"; LOGIN_RATELIMIT_MAX_BURST = 10; LOGIN_RATELIMIT_SECONDS = 60; - DOMAIN = "https://pw2.${domain}"; + DOMAIN = "https://pw.${domain}"; INVITATION_ORG_NAME = "NxPW"; INVITATIONS_ALLOWED = true; ADMIN_TOKEN = "@ADMIN_TOKEN@"; diff --git a/system-modules/postgres.nix b/system-modules/postgres.nix index f37ad51..b86a5cf 100644 --- a/system-modules/postgres.nix +++ b/system-modules/postgres.nix @@ -32,22 +32,9 @@ shared_preload_libraries = [ ]; # default }; ensureUsers = [ - # { - # name = "${user}"; - # ensureDBOwnership = false; - # ensureClauses = { - # login = true; - # # inherit - # createdb = true; - # bypassrls = true; - # superuser = true; - # createrole = true; - # replication = true; - # }; - # } + # as liong as there is no declarative user management you gotta set a pw by hand + # sudo -u postgres psql -c "ALTER USER gitea PASSWORD 'new-passwd';" { - # as liong as there is no declarative user management you gotta set a pw by hand - # sudo -u postgres psql -c "ALTER USER gitea PASSWORD 'new-passwd';" name = "gitea"; ensureDBOwnership = true; } @@ -57,28 +44,28 @@ } ]; }; -# postgresqlBackup = { -# enable -# startAt -# location -# databases -# backupAll -# compression -# } - - -# postgresqlWalReceiver.receivers."main" = { -# postgresqlPackage = pkgs.postgresql_15; -# directory = /mnt/pg_wal/main/; -# slot = "main_wal_receiver"; -# connection = "postgresql://user@somehost"; -# compress -# extraArgs -# synchronous -# environment -# statusInterval -# }; -# } + postgresqlBackup = { + enable = true; + # startAt = "*-*-* 01:15:00"; + # location = "/var/backup/postgresql"; + databases = config.services.postgresql.ensureDatabases; + backupAll = false; + # compression = "gzip"; + # pgdumpOptions = "-C"; + # compressionLevel = 6; + }; + # postgresqlWalReceiver.receivers."main" = { + # postgresqlPackage = pkgs.postgresql_15; + # directory = /mnt/pg_wal/main/; + # slot = "main_wal_receiver"; + # connection = "postgresql://user@somehost"; + # compress + # extraArgs + # synchronous + # environment + # statusInterval + # }; + # }; }; } diff --git a/system-modules/sshd.nix b/system-modules/sshd.nix index dff0395..7bdd4b3 100644 --- a/system-modules/sshd.nix +++ b/system-modules/sshd.nix @@ -3,7 +3,7 @@ { environment.etc."ssh/ssh_host_ed25519_key.pub".text = if (host == "NxNORTH") then "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF1r5gUQPPS/dGB0SsvWtP6WdNWoxMwhhHRrqlO19cJt root@NxNORTH" - else if ( host == "NxXPS") then + else if ( host == "NxXPS" ) then "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPf+08+t8a0lY2+nR1mhIU3vuksStiJOlojJjzCwFk7r root@NxXPS" else "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBFfZpWVPlujsz3FklSVAM+tuYn4pzDSijhp5CeYNOZk root@NxACE"; @@ -13,7 +13,7 @@ }; services.openssh = { enable = true; - ports = secrets.ssh.ports; + ports = [ secrets.ssh.port ]; settings = { PasswordAuthentication = false; }; diff --git a/system-modules/users.nix b/system-modules/users.nix index f43423e..7920c80 100755 --- a/system-modules/users.nix +++ b/system-modules/users.nix @@ -6,6 +6,7 @@ users.users."${user}" = { isNormalUser = true; extraGroups = [ + # TODO: actually put the groups into the relevant files "networkmanager" "wheel" "audio" @@ -18,7 +19,6 @@ "acme" "nginx" "adbusers" - "gitea" "postgres" ]; useDefaultShell = true;