john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'forgejo'

Browse Source
This commit is contained in:
John Lancaster
2026-04-01 20:55:17 -05:00
parent cf02260941 76cb1d078b
commit d7e32c0a2f
15 changed files with 338 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/forgejo.nix
+64
View File
@@ -0,0 +1,64 @@
{ self, inputs, ... }: {
flake.modules.nixos.forgejo = {config, pkgs, lib, ... }:
let
cfg = config.forgejo;
in
{
options.forgejo = {
enable = lib.mkEnableOption "Enable Forgejo backed with PostgreSQL";
port = lib.mkOption {
type = lib.types.port;
default = 3000;
description = "TCP port for the Forgejo web interface.";
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Open the Forgejo web interface port in the firewall.";
};
https = lib.mkEnableOption "Open the Forgejo web interface port in the firewall.";
};
config = lib.mkIf cfg.enable {
networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
services.forgejo = {
enable = true;
lfs.enable = true;
settings.server = lib.mkMerge [
{
HTTP_PORT = cfg.port;
DISABLE_SSH = true;
}
(lib.mkIf cfg.https {
ROOT_URL = "https://forgejo.john-stream.com";
PROTOCOL = "https";
COOKIE_SECURE = true;
KEY_FILE = config.mtls.keyFile;
CERT_FILE = config.mtls.certFile;
})
];
database = {
type = "postgres";
port = config.services.postgresql.settings.port;
# createDatabase = false;
};
# dump = {
# enable = true;
# interval = "12h";
# };
};
services.postgresql = {
enable = true;
settings = {
};
};
};
};
}
modules/features/greetd.nix
+1 -1
View File
@@ -1,6 +1,6 @@
# https://github.com/glabrie/dotfiles/blob/main/modules/system/settings/greetd.nix
{ inputs, ... }: {
flake.module.nixos.greetd = { pkgs, lib, ... }: {
flake.modules.nixos.greetd = { pkgs, lib, ... }: {
services.greetd = {
enable = true;
settings = {
modules/features/mtls.nix
+56 -53
View File
@@ -1,7 +1,7 @@
{ self, inputs, lib, ... }:
let
# Options that will be in common between
opts = {
# Options that will be in common between the nixos module and the home-manager module.
mkOpts = config: let cfg = config.mtls; in {
enable = lib.mkEnableOption "Enable mTLS";
subject = lib.mkOption {
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
@@ -11,20 +11,25 @@ let
description = "String path to the directory where the certs will be stored";
type = lib.types.str;
};
keyFilename = lib.mkOption {
description = "String filename for the private key";
caFile = lib.mkOption {
description = "String path for the root CA file";
type = lib.types.str;
default = "key.pem";
default = "${cfg.certDir}/root_ca.crt";
};
certFilename = lib.mkOption {
description = "String filename for the public certificate";
keyFile = lib.mkOption {
description = "String path for the private key";
type = lib.types.str;
default = "cert.pem";
default = "${cfg.certDir}/key.pem";
};
bundleFilename = lib.mkOption {
description = "String filename for the mTLS key bundle";
certFile = lib.mkOption {
description = "String path for the public cert";
type = lib.types.str;
default = "mtls.pem";
default = "${cfg.certDir}/cert.pem";
};
bundleFile = lib.mkOption {
description = "String path for the mTLS key bundle";
type = lib.types.str;
default = "${cfg.certDir}/mtls.pem";
};
san = lib.mkOption {
description = "List of SAN to give the mTLS cert";
@@ -37,7 +42,7 @@ let
};
lifetime = lib.mkOption {
type = lib.types.str;
default = "6h";
default = "24h";
};
renew = {
enable = lib.mkOption {
@@ -83,9 +88,9 @@ let
subject,
provisioner,
san,
tlsCert,
tlsKey,
mtlsBundle,
certFile,
keyFile,
bundleFile,
lifetime,
}:
let
@@ -95,26 +100,26 @@ let
pkgs.writeShellScriptBin "mtls-generate" ''
set -euo pipefail
${stepCmd} ca certificate \
${subject} ${tlsCert} ${tlsKey} \
${subject} ${certFile} ${keyFile} \
--not-before=-5m --not-after=${lifetime} \
--provisioner ${provisioner} \
${sanArgs} \
"$@"
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
cat ${certFile} ${keyFile} > ${bundleFile}
'';
mkMtlsCheckScript = { pkgs, mtlsBundle }: pkgs.writeShellScriptBin "mtls-check" ''
mkMtlsCheckScript = { pkgs, bundleFile }: pkgs.writeShellScriptBin "mtls-check" ''
${lib.getExe pkgs.openssl} x509 \
-noout -subject -issuer \
-ext subjectAltName,extendedKeyUsage \
-enddate -in ${mtlsBundle}
-enddate -in ${bundleFile}
'';
mkMtlsRenewScript = {
pkgs,
tlsCert,
tlsKey,
mtlsBundle,
certFile,
keyFile,
bundleFile,
reloadUnits ? [ ],
postCommands ? [ ],
systemctlArgs ? [ ],
@@ -134,17 +139,17 @@ let
pkgs.writeShellScriptBin "mtls-renew" ''
set -euo pipefail
if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${certFile}"; then
${echoCmd} "Renewing mTLS certificate"
else
${echoCmd} "Skipping renew"
exit "$?"
fi
${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
${lib.getExe pkgs.step-cli} ca renew --force "${certFile}" "${keyFile}"
umask 077
${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
${lib.getExe' pkgs.coreutils "cat"} "${certFile}" "${keyFile}" > "${bundleFile}"
${echoCmd} "Reloading units:"
${renewReloadScript}
@@ -155,9 +160,9 @@ let
mkNixosMtlsRenewService = {
pkgs,
tlsCert,
tlsKey,
mtlsBundle,
certFile,
keyFile,
bundleFile,
reloadUnits ? [ ],
postCommands ? [ ],
user ? "root",
@@ -166,7 +171,7 @@ let
let
serviceGroup = if group == null then user else group;
renewScript = mkMtlsRenewScript {
inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
inherit pkgs certFile keyFile bundleFile reloadUnits postCommands;
};
in
{
@@ -200,15 +205,15 @@ let
mkHomeManagerMtlsRenewService = {
pkgs,
tlsCert,
tlsKey,
mtlsBundle,
certFile,
keyFile,
bundleFile,
reloadUnits ? [ ],
postCommands ? [ ],
}:
let
renewScript = mkMtlsRenewScript {
inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
inherit pkgs certFile keyFile bundleFile reloadUnits postCommands;
systemctlArgs = [ "--user" ];
};
in
@@ -249,29 +254,26 @@ in
flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
tlsKey = "${cfg.certDir}/${cfg.keyFilename}";
tlsCert = "${cfg.certDir}/${cfg.certFilename}";
mtlsBundle = "${cfg.certDir}/${cfg.bundleFilename}";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
in
{
options.mtls = opts // {
options.mtls = (mkOpts config) // {
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default = "/etc/step/certs";
default = "/etc/step-ca/certs";
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; lib.optionals cfg.enable [
step-cli
# step-cli
(mkMtlsGenerateScript {
inherit (cfg) subject provisioner san lifetime;
inherit pkgs tlsCert tlsKey mtlsBundle;
inherit pkgs;
inherit (cfg) subject provisioner san certFile keyFile bundleFile lifetime;
})
(mkMtlsCheckScript { inherit pkgs mtlsBundle; })
(mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
(mkMtlsCheckScript { inherit pkgs; inherit (cfg) bundleFile; })
(mkMtlsRenewScript { inherit pkgs; inherit (cfg) certFile keyFile bundleFile; })
];
systemd.tmpfiles.rules = [
@@ -279,7 +281,8 @@ in
];
systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
inherit pkgs tlsCert tlsKey mtlsBundle;
inherit pkgs;
inherit (cfg) certFile keyFile bundleFile;
inherit (cfg.renew) reloadUnits postCommands user group;
});
@@ -292,13 +295,13 @@ in
flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
tlsKey = "${cfg.certDir}/${cfg.keyFilename}";
tlsCert = "${cfg.certDir}/${cfg.certFilename}";
mtlsBundle = "${cfg.certDir}/${cfg.bundleFilename}";
keyFile = cfg.keyFile;
certFile = cfg.certFile;
bundleFile = cfg.bundleFile;
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
in
{
options.mtls = opts // {
options.mtls = (mkOpts config) // {
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
@@ -308,13 +311,13 @@ in
config = {
home.packages = with pkgs; lib.optionals cfg.enable [
step-cli
# step-cli
(mkMtlsGenerateScript {
inherit (cfg) subject provisioner san lifetime;
inherit pkgs tlsCert tlsKey mtlsBundle;
inherit pkgs certFile keyFile bundleFile;
})
(mkMtlsCheckScript { inherit pkgs mtlsBundle; })
(mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
(mkMtlsCheckScript { inherit pkgs bundleFile; })
(mkMtlsRenewScript { inherit pkgs certFile keyFile bundleFile; })
];
systemd.user.tmpfiles.rules = lib.mkIf cfg.enable [
@@ -322,7 +325,7 @@ in
];
systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
inherit pkgs tlsCert tlsKey mtlsBundle;
inherit pkgs certFile keyFile bundleFile;
inherit (cfg.renew) reloadUnits postCommands;
});
modules/features/restic.nix
+12 -12
View File
@@ -19,6 +19,11 @@
type = lib.types.str;
default = "john-ubuntu";
};
repoUrl = lib.mkOption {
description = "URL to the REST endpoint";
type = lib.types.str;
default = "rest:https://soteria.john-stream.com/${cfg.repoName}";
};
passwordFile = lib.mkOption {
description = "String path to the restic password file";
type = lib.types.str;
@@ -44,29 +49,24 @@
};
};
config = let
resticRepository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
caCert = "${config.mtls.certDir}/root_ca.crt";
mtlsBundle = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
in
{
config = {
home.sessionVariables = {
RESTIC_REPOSITORY = resticRepository;
RESTIC_REPOSITORY = cfg.repoUrl;
RESTIC_PASSWORD_FILE = cfg.passwordFile;
RESTIC_CACERT = caCert;
RESTIC_TLS_CLIENT_CERT = mtlsBundle;
RESTIC_CACERT = config.mtls.caFile;
RESTIC_TLS_CLIENT_CERT = config.mtls.bundleFile;
};
# This is necessary because the restic service in home manager doesn't otherwise expose these options.
systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
"RESTIC_CACERT=${caCert}"
"RESTIC_TLS_CLIENT_CERT=${mtlsBundle}"
"RESTIC_CACERT=${config.mtls.caFile}"
"RESTIC_TLS_CLIENT_CERT=${config.mtls.bundleFile}"
];
services.restic = {
enable = true;
backups.${cfg.repoName} = {
repository = resticRepository;
repository = cfg.repoUrl;
passwordFile = cfg.passwordFile;
paths = cfg.paths;
timerConfig = {
modules/hosts/janus/default.nix
+41 -21
View File
@@ -4,30 +4,31 @@ let
hostname = "janus";
ca-url = "https://janus.john-stream.com/";
fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
in
{
flake.modules.nixos.janus-ca = { config, lib, ... }:
let
johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
johnGroup = lib.attrByPath [ "users" "users" username "group" ] username config;
mkStepRules = home: user: group: [
"d ${home}/.step 0700 ${user} ${group} -"
"d ${home}/.step/config 0700 ${user} ${group} -"
"d ${home}/.step/certs 0700 ${user} ${group} -"
"L+ ${home}/.step/config/defaults.json - - - - /etc/step/config/defaults.json"
"L+ ${home}/.step/certs/root_ca.crt - - - - /etc/step/certs/root_ca.crt"
];
in {
environment.etc."step/config/defaults.json".text = builtins.toJSON {
inherit ca-url fingerprint;
root = "/etc/step/certs/root_ca.crt";
flake.modules.nixos.janus-ca =
{ config, lib, ... }:
let
johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
johnGroup = lib.attrByPath [ "users" "users" username "group" ] username config;
mkStepRules = home: user: group: [
"d ${home}/.step 0700 ${user} ${group} -"
"d ${home}/.step/config 0700 ${user} ${group} -"
"d ${home}/.step/certs 0700 ${user} ${group} -"
"L+ ${home}/.step/config/defaults.json - - - - /etc/step/config/defaults.json"
"L+ ${home}/.step/certs/root_ca.crt - - - - /etc/step/certs/root_ca.crt"
];
in
{
environment.etc."step/config/defaults.json".text = builtins.toJSON {
inherit ca-url fingerprint;
root = "/etc/step-ca/certs/root_ca.crt";
};
environment.etc."step-ca/certs/root_ca.crt".source = ./root_ca.crt;
systemd.tmpfiles.rules =
mkStepRules johnHome username johnGroup
++ mkStepRules "/root" "root" "root";
};
environment.etc."step/certs/root_ca.crt".source = ./root_ca.crt;
systemd.tmpfiles.rules =
mkStepRules johnHome username johnGroup
++ mkStepRules "/root" "root" "root";
};
flake.modules.homeManager.janus-ca = { config, ... }: {
home.file.".step/config/defaults.json".text = builtins.toJSON {
@@ -73,4 +74,23 @@ in
}
];
};
flake-file.inputs = {
wrappers = {
url = "github:lassulus/wrappers";
inputs.nixpkgs.follows = "nixpkgs";
};
};
perSystem = { pkgs, lib, ... }: {
packages.janus-ca = inputs.wrappers.lib.wrapPackage {
inherit pkgs;
package = pkgs.step-cli;
binName = "janus-cert";
args = [
"ca" "certificate"
"--ca-url=${ca-url}"
];
};
};
}
modules/hosts/john-p14s/configuration.nix
+2 -1
View File
@@ -5,7 +5,7 @@
hostname = "john-p14s";
homeDirectory = config.home-manager.users.john.home.homeDirectory;
flakeDir = "${homeDirectory}/Documents/dendritic";
my-neovim = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim
my-neovim = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim;
in
{
imports = [
@@ -130,6 +130,7 @@
appdaemon = true;
homelab = true;
dev = true;
certs = true;
};
}
];
modules/hosts/john-pc/default.nix
+1 -3
View File
@@ -3,7 +3,7 @@ let
username = "john";
hostname = "john-pc-ubuntu";
testHost = "soteria";
testHost = "soteria"; # which host to test build
testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
# testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
@@ -12,8 +12,6 @@ in
flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }:
let
flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
certDir = "${config.mtls.certDir}";
mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
testPushCmd = (pkgs.writeShellScriptBin "test-push" ''
modules/hosts/soteria/soteria.nix
+8
View File
@@ -14,6 +14,7 @@ in
nixos.docker
nixos.mtls
nixos.janus-ca
nixos.forgejo
# nixos.restic-server
# nixos.restic-envoy
({ pkgs, ... }: {
@@ -60,6 +61,13 @@ in
homeManager."${hostname}"
];
};
environment.systemPackages = [
inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.janus-ca
inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim
];
forgejo.enable = true;
})
];
};
modules/nix-tools/rebuild.nix
+13
View File
@@ -87,6 +87,19 @@
${echoCmd} "Testing the evaulation of the nixos config for $HOSTNAME"
${lib.getExe nix} eval ${flakeDir}#nixosConfigurations.$HOSTNAME.config.system.build.toplevel.drvPath
'')
(writeShellScriptBin "cleanup" ''
set -e
DAYS=$1
if [ -z "$DAYS" ]; then
${echoCmd} "usage: cleanup <days>"
exit 1
fi
${lib.getExe home-manager} expire-generations "-$DAYS days"
${lib.getExe nix} profile wipe-history --older-than "''${DAYS}d"
${lib.getExe nix} store gc
${lib.getExe nix} store optimise
'')
];
};
};
modules/nix-tools/user.nix
+5 -8
View File
@@ -18,16 +18,13 @@
isNormalUser = true;
home = "/home/${username}";
shell = lib.mkIf config.programs.zsh.enable pkgs.zsh;
extraGroups = [
"input"
"networkmanager"
] ++ lib.optionals isAdmin [
"docker"
"wheel"
];
extraGroups = [ "input" "networkmanager" ]
++ lib.optional isAdmin "wheel"
++ lib.optional config.virtualisation.docker.enable "docker"
++ lib.optional (isAdmin && config.services.forgejo.enable) config.services.forgejo.group
++ lib.optional (isAdmin && config.services.postgresql.enable) "postgres";
};
security.sudo-rs.enable = lib.mkIf isAdmin true;
home-manager.useGlobalPkgs = true;
modules/programs/neovim.nix
+75 -9
View File
@@ -7,10 +7,11 @@
};
perSystem = { system, pkgs, ... }: {
packages.my-neovim = (inputs.nvf.lib.neovimConfiguration {
packages.my-neovim = ((inputs.nvf.lib.neovimConfiguration {
inherit pkgs;
modules = [
{
# https://nvf.notashelf.dev/search.html
config.vim = {
options = {
number = true;
@@ -19,6 +20,9 @@
shiftwidth = 4;
tabstop = 4;
softtabstop = 4;
wrap = true;
linebreak = true;
};
syntaxHighlighting = true;
@@ -28,10 +32,38 @@
theme.name = "catppuccin";
theme.style = "mocha";
lazy = {
git.enable = true;
# git.neogit.enable = true;
# https://github.com/akinsho/toggleterm.nvim
terminal.toggleterm.enable = true;
terminal.toggleterm.lazygit.enable = true;
terminal.toggleterm.lazygit.direction = "float";
terminal.toggleterm.lazygit.mappings.open = "<C-g>";
utility.nix-develop.enable = true;
utility.oil-nvim.enable = true;
utility.oil-nvim.gitStatus.enable = true;
filetree.neo-tree = {
enable = true;
};
# lazy = {
# enable = true;
# };
# globals = {
# SimpylFold_docstring_preview = 1;
# SimpylFold_fold_blank = 0;
# };
# extraPlugins = with pkgs.vimPlugins; {
# SimpylFold.package = SimpylFold;
# };
telescope = {
enable = true;
extensions = [
@@ -46,7 +78,7 @@
# Enable Treesitter
treesitter = {
enable = true;
# grammars = [ "python" ];
grammars = with pkgs.vimPlugins.nvim-treesitter-parsers; [ python ];
};
lsp.enable = true;
@@ -54,6 +86,24 @@
languages = {
enableTreesitter = true;
enableFormat = true;
markdown = {
enable = true;
extensions = {
# render-markdown-nvim.enable = true;
markview-nvim.enable = true;
};
};
bash.enable = true;
css.enable = true;
yaml.enable = true;
toml.enable = true;
nix = {
enable = true;
};
python = {
enable = true;
dap.enable = true;
@@ -63,16 +113,32 @@
keymaps = [
{
key = "<leader>m";
desc = "Key Maps [Telescope]";
key = "<leader>fkm";
mode = "n";
silent = true;
action = ":make<CR>";
silent = false;
action = "<cmd>:Telescope keymaps<CR>";
}
{
desc = "Toggle Filesystem Tree [NeoTree]";
key = "<C-b>";
mode = [ "n" "v" "t" ];
silent = false;
action = "<cmd>:Neotree toggle filesystem left action=show<CR>";
}
{
key = "<C-`>";
mode = ["n" "v" "t"];
silent = false;
action = "<cmd>:ToggleTerm<CR>";
}
];
};
}
];
})
.neovim;
}).neovim).overrideAttrs (old: {
pname = "my-neovim";
version = "custom";
});
};
}
}
modules/services/step-ca/ssh-host.nix
+2 -2
View File
@@ -33,7 +33,7 @@
networking.nameservers = [ "192.168.1.150" ];
networking.dhcpcd.extraConfig = "nohook resolv.conf";
environment.systemPackages = with pkgs; [
step-cli
# step-cli
(writeShellScriptBin "ssh-host-cert-renew" ''
${lib.getExe pkgs.step-cli} ssh certificate \
--host --sign \
@@ -51,7 +51,7 @@
wantedBy = [ ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
path = [ pkgs.step-cli pkgs.openssh pkgs.coreutils pkgs.systemd ];
path = with pkgs; [ coreutils systemd step-cli openssh ];
serviceConfig = {
Type = "oneshot";
User = "root";
modules/services/step-ca/step-ca.nix
+4 -1
View File
@@ -17,6 +17,9 @@ in
crt = "";
};
};
environment.systemPackages = with pkgs; [ step-ca step-cli ];
environment.systemPackages = with pkgs; [
step-ca
step-cli
];
};
}