131 lines
4.0 KiB
Nix
131 lines
4.0 KiB
Nix
{ withSystem, self, inputs, lib, ... }:
|
|
# Intent: NixOS service node for Forgejo + restic with mTLS, host-local secrets, and a paired Home Manager profile for john.
|
|
let
|
|
username = "john";
|
|
hostname = "soteria";
|
|
forgejoDomain = "forgejo.john-stream.com";
|
|
ipv4 = "192.168.1.233";
|
|
ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
|
|
sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
|
|
mtlsNames = sshNames ++ [ forgejoDomain ];
|
|
in
|
|
{
|
|
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
|
modules = with inputs.self.modules; [
|
|
nixos.lxc
|
|
nixos.login-text
|
|
inputs.home-manager.nixosModules.home-manager
|
|
nixos."${username}"
|
|
nixos.ssh-new
|
|
nixos.mtls
|
|
nixos.mysops
|
|
nixos.docker
|
|
nixos.step-client
|
|
nixos.forgejo
|
|
nixos.restic-server
|
|
# nixos.restic-envoy
|
|
({ config, pkgs, ... }: {
|
|
networking.hostName = hostname;
|
|
|
|
# Removes password for sudo
|
|
security.sudo-rs.extraRules = lib.mkAfter [
|
|
{
|
|
users = [ username ];
|
|
commands = [
|
|
{
|
|
command = "ALL";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
# users.users."${username}".extraGroups = [ "mtls" ];
|
|
mtls = {
|
|
enable = true;
|
|
subject = hostname;
|
|
san = mtlsNames;
|
|
certDir = "/etc/mtls";
|
|
# lifetime = "12h";
|
|
# renew.onCalendar = "*:3/15";
|
|
# renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
|
|
# certReaders = [ config.services.forgejo.user "restic" ];
|
|
};
|
|
|
|
forgejo = {
|
|
enable = true;
|
|
root_url = "https://forgejo.john-stream.com";
|
|
https = true;
|
|
port = 443;
|
|
pocketId = {
|
|
enable = true;
|
|
discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration";
|
|
};
|
|
};
|
|
|
|
# resticServer = {
|
|
# enable = true;
|
|
# dataDir = "/mnt/restic";
|
|
# privateRepos = true;
|
|
# listenAddress = "0.0.0.0:8000";
|
|
# tls = {
|
|
# certFile = config.mtls.certFile;
|
|
# keyFile = config.mtls.keyFile;
|
|
# };
|
|
# };
|
|
|
|
loginText.extraServiceStatus = {
|
|
Docker = "docker";
|
|
"mTLS Renewal" = "mtls-renew.timer";
|
|
"Forgejo" = "forgejo.service";
|
|
"Forgejo Backup" = "forgejo-dump.timer";
|
|
"Restic REST Server" = "restic-rest-server.service";
|
|
};
|
|
|
|
ssh-new.certificates = {
|
|
provisioner = "admin";
|
|
host = {
|
|
enable = true;
|
|
extraPrincipals = sshNames;
|
|
autoRenew = true;
|
|
};
|
|
user.enable = true;
|
|
};
|
|
|
|
# This provides the secrets at install time
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
|
|
home-manager.users."${username}".imports = [ inputs.self.modules.homeManager.soteria ];
|
|
|
|
environment.systemPackages = [
|
|
inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim
|
|
inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
|
|
];
|
|
})
|
|
];
|
|
};
|
|
|
|
flake.modules.homeManager.soteria = { config, pkgs, lib, ... }: {
|
|
imports = with inputs.self.modules.homeManager; [
|
|
rebuild
|
|
mysops
|
|
step-client
|
|
({ config, pkgs, lib, ... }: {
|
|
homeManagerFlakeDir = "${config.xdg.configHome}/home-manager";
|
|
docker.enable = true;
|
|
|
|
# This will provide the edit-secrets script targeting this file
|
|
mysops.hostSecretFile = "${config.homeManagerFlakeDir}/modules/hosts/soteria/secrets.yaml";
|
|
})
|
|
];
|
|
};
|
|
|
|
# flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
|
|
# inputs.home-manager.lib.homeManagerConfiguration {
|
|
# pkgs = inputs'.nixpkgs.legacyPackages;
|
|
# modules = [
|
|
# inputs.self.modules.homeManager."${username}"
|
|
# inputs.self.modules.homeManager.soteria
|
|
# ];
|
|
# });
|
|
} |