c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

Add gemini container

This commit is contained in:
Emery 2022-02-15 07:42:43 -06:00
parent 00e84344e4
commit 2d3e83c43c
5 changed files with 148 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
flake.lock
View File

@ -23,7 +23,7 @@
},
"fenix_2": {
"inputs": {
"nixpkgs": "nixpkgs",
"nixpkgs": "nixpkgs_2",
"rust-analyzer-src": "rust-analyzer-src_2"
},
"locked": {
@ -40,6 +40,23 @@
"type": "github"
}
},
"gemini": {
"inputs": {
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1639155521,
"narHash": "sha256-Lh74QEjPIPZSZNvz1zPKEqEjSA6eIci0eDRoZJKIYeE=",
"owner": "nix-community",
"repo": "flake-gemini",
"rev": "2900f752c983974a03e66077f1e6522764486aed",
"type": "github"
},
"original": {
"id": "gemini",
"type": "indirect"
}
},
"heliwatch": {
"inputs": {
"fenix": "fenix_2",
@ -65,7 +82,7 @@
},
"naersk": {
"inputs": {
"nixpkgs": "nixpkgs_2"
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1639947939,
@ -118,16 +135,16 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1644278373,
"narHash": "sha256-9riYZyVing7OQUUWELSojlbt9u0xDh0Xm5Eg8FQn0fc=",
"owner": "nixos",
"lastModified": 1639153468,
"narHash": "sha256-AXlstb8jjYs8HKGTLOuSjIdFLyPQSI5aYPN34qUy+Rc=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "60c52a73f1d5858020ac4f161cd5bf1c9650f8b8",
"rev": "cf8f41fe116c8e733c833acd4759d9261ecd6d1f",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"owner": "NixOS",
"ref": "release-21.11",
"repo": "nixpkgs",
"type": "github"
}
@ -179,6 +196,22 @@
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1644278373,
"narHash": "sha256-9riYZyVing7OQUUWELSojlbt9u0xDh0Xm5Eg8FQn0fc=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "60c52a73f1d5858020ac4f161cd5bf1c9650f8b8",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1644151317,
"narHash": "sha256-TpXGBYCFKvEN7Q+To45rn4kqTbLPY4f56rF6ymUGGRE=",
@ -192,7 +225,7 @@
"type": "indirect"
}
},
"nixpkgs_3": {
"nixpkgs_4": {
"locked": {
"lastModified": 1644328695,
"narHash": "sha256-rK1HXS35XOO3PksBnJzbv93G9wqZsk61gi22j8dtOt0=",
@ -208,7 +241,7 @@
"type": "github"
}
},
"nixpkgs_4": {
"nixpkgs_5": {
"locked": {
"lastModified": 1637209424,
"narHash": "sha256-oXw75hkCOVtoB+CEElWiTmkC1gNdL3jf0tG2GInytHA=",
@ -224,7 +257,7 @@
"type": "github"
}
},
"nixpkgs_5": {
"nixpkgs_6": {
"locked": {
"lastModified": 1638097282,
"narHash": "sha256-EXCzj9b8X/lqDPJapxZThIOKL5ASbpsJZ+8L1LnY1ig=",
@ -240,7 +273,7 @@
"type": "github"
}
},
"nixpkgs_6": {
"nixpkgs_7": {
"locked": {
"lastModified": 1641924320,
"narHash": "sha256-DuOpJqoMmQ3Yk4C64QQHFaByhbSIi872He6z5BXY1YM=",
@ -276,10 +309,11 @@
"root": {
"inputs": {
"fenix": "fenix",
"gemini": "gemini",
"heliwatch": "heliwatch",
"naersk": "naersk_2",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_3",
"nixpkgs": "nixpkgs_4",
"nixpkgs-mobilizon": "nixpkgs-mobilizon",
"nixpkgs-unstable": "nixpkgs-unstable",
"scrapers": "scrapers",
@ -344,7 +378,7 @@
},
"secrets": {
"inputs": {
"nixpkgs": "nixpkgs_4",
"nixpkgs": "nixpkgs_5",
"sops-nix": [
"sops-nix"
]
@ -365,7 +399,7 @@
},
"sops-nix": {
"inputs": {
"nixpkgs": "nixpkgs_5"
"nixpkgs": "nixpkgs_6"
},
"locked": {
"lastModified": 1644240878,
@ -467,7 +501,7 @@
},
"zentralwerk": {
"inputs": {
"nixpkgs": "nixpkgs_6",
"nixpkgs": "nixpkgs_7",
"nixpkgs-master": "nixpkgs-master",
"openwrt": "openwrt"
},

12
flake.nix
View File

@ -28,7 +28,7 @@
fenix.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = inputs@{ self, nixpkgs, secrets, nixos-hardware, zentralwerk, yammat, scrapers, spacemsg, tigger, ticker, heliwatch, sops-nix, naersk, fenix, ... }:
outputs = inputs@{ self, nixpkgs, secrets, nixos-hardware, zentralwerk, yammat, scrapers, spacemsg, tigger, ticker, heliwatch, sops-nix, naersk, fenix, gemini, ... }:
let
inherit (nixpkgs) lib;
forAllSystems = lib.genAttrs [ "aarch64-linux" "x86_64-linux" ];
@ -243,6 +243,16 @@
];
};
gemini = nixosSystem' {
nixpkgs = inputs.nixpkgs-unstable;
modules = [
./config/lxc-container.nix
./hosts/containers/gemini
gemini.nixosModules.duckling-proxy
gemini.nixosModules.kineto
];
};
gitea = nixosSystem' {
nixpkgs = inputs.nixpkgs-unstable;
modules = [

7
host-registry.nix
View File

@ -12,6 +12,13 @@
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMFbxHGfBMBjjior1FNRub56O62K++HVnqUH67BeKD7d";
};
gemini = {
ip6 = "2a00:8180:2c00:223:58f4:2eff:fe48:5216";
# ygg = "30c:c3d2:b946:76d0:58f4:2eff:fe48:5216";
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvB3MTO5+MJk8/sojF+bX0MBz9BLwo3FRH5SjIbrfeH";
};
gitea.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8MmjiiRmiyUqRYs5a07m7qKDwxh2NwvS2h7pm2b+zx";
glotzbert = {

62
hosts/containers/gemini/default.nix Normal file
View File

@ -0,0 +1,62 @@
{ config, lib, pkgs, ... }:
let fqdn = "gemini.c3d2.de";
in {
imports = [ ./users.nix ];
c3d2.hq.statistics.enable = true;
c3d2.autoUpdate = true;
networking.hostName = "gemini";
networking.hosts."::1" = [ fqdn ];
networking.firewall.enable = false;
networking.firewall.allowedTCPPorts = [
80
443
config.services.molly-brown.settings.Port
config.services.duckling-proxy.port
];
services.duckling-proxy = {
enable = true;
address = "0.0.0.0";
port = 1966;
serverCert = "/var/lib/acme/${fqdn}/cert.pem";
serverKey = "/var/lib/acme/${fqdn}/key.pem";
};
services.kineto = {
enable = true;
port = 1967;
geminiDomain = "gemini://${fqdn}";
};
services.molly-brown = {
enable = true;
hostName = fqdn;
certPath = "/var/lib/acme/${fqdn}/cert.pem";
keyPath = "/var/lib/acme/${fqdn}/key.pem";
docBase = "/var/gemini";
settings = {
DefaultLang = "de";
ReadMollyFiles = true;
};
};
services.nginx = {
enable = true;
virtualHosts.${fqdn} = {
default = true;
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://127.0.0.1:1967";
};
};
systemd.services.duckling-proxy.serviceConfig.SupplementaryGroups =
[ config.security.acme.certs.${fqdn}.group ];
systemd.services.molly-brown.serviceConfig.SupplementaryGroups =
[ config.security.acme.certs.${fqdn}.group ];
}

18
hosts/containers/gemini/users.nix Normal file
View File

@ -0,0 +1,18 @@
{ config, lib, ... }:
{
system.activationScripts.gemini = ''
mkdir -p ${config.services.molly-brown.docBase}/users/
'' + lib.strings.concatStrings (lib.attrsets.mapAttrsToList (name:
{ isNormalUser, home, ... }:
lib.strings.optionalString (isNormalUser && home != null) ''
ln -sf ${home}/public_gemini ${config.services.molly-brown.docBase}/users/${name}
'') config.users.users);
users.users = lib.attrsets.mapAttrs (name:
{ sshKeys, ... }: {
createHome = true;
isNormalUser = true;
openssh.authorizedKeys.keys = sshKeys;
}) config.c3d2.users;
}