jana/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retry
Some checks are pending
/ lint (push) Waiting to run
Details

Browse source
This commit is contained in:
Jana Dönszelmann 2025-08-20 11:41:30 +02:00
parent 4bbb51ef42
commit 1efeddf961
No known key found for this signature in database
13 changed files with 150 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

13
.github/workflows/deploy.yml vendored
View file

@ -1,6 +1,11 @@
on: [push]
on:
push:
branches:
- main
jobs:
test:
runs-on: docker
build:
runs-on: nixos-latest
steps:
- run: echo All good!
- uses: actions/checkout@v4
- run: nix develop
- run: colmena build -v --on @fili

7
.github/workflows/lint.yml vendored Normal file
View file

@ -0,0 +1,7 @@
on: [push]
jobs:
lint:
runs-on: nixos-latest
steps:
- uses: actions/checkout@v4
- run: nix fmt -- --check .

1
fili/configuration.nix
View file

@ -16,7 +16,6 @@ _: {
networkmanager.enable = true;
};
nix.settings = {
# users that can interact with nix
trusted-users = [

3
fili/lib/auth.nix
View file

@ -1,4 +1,5 @@
{ baseUrl, clientId }: {
{ baseUrl, clientId }:
{
inherit clientId;
userAuthUrl = "${baseUrl}/ui/oauth2";

11
fili/services/auth/kanidm.nix
View file

@ -1,9 +1,11 @@
{pkgs, config, ...}: let
{ pkgs, config, ... }:
let
lib = pkgs.lib;
domain = "auth.donsz.nl";
port = 3013;
backupsDir = "/var/lib/kanidm/backup";
in {
in
{
services.kanidm.enableServer = true;
services.kanidm.package = pkgs.kanidm_1_6;
services.kanidm.serverSettings = {
@ -26,12 +28,11 @@ in {
mkdir -p "${backupsDir}"
'';
serviceConfig = {
SupplementaryGroups =
[ config.security.acme.certs.${domain}.group ];
SupplementaryGroups = [ config.security.acme.certs.${domain}.group ];
};
};
environment.systemPackages = [pkgs.kanidm];
environment.systemPackages = [ pkgs.kanidm ];
services.nginx.virtualHosts.${domain} = {
forceSSL = true;

59
fili/services/auth/oauth2-proxy.nix
View file

@ -1,45 +1,50 @@
{pkgs, config, ...}: {
{ pkgs, config, ... }:
{
sops.secrets.oauth2-proxy = {
sopsFile = ../../../secrets/oauth2-proxy.env;
};
services.oauth2-proxy =
let
auth = import ../../lib/auth.nix { baseUrl = "https://auth.donsz.nl"; clientId = "homeserver"; };
in {
enable = true;
auth = import ../../lib/auth.nix {
baseUrl = "https://auth.donsz.nl";
clientId = "homeserver";
};
in
{
enable = true;
provider = "oidc";
clientID = "${auth.clientId}";
oidcIssuerUrl = auth.oidcIssuerUri;
provider = "oidc";
clientID = "${auth.clientId}";
oidcIssuerUrl = auth.oidcIssuerUri;
proxyPrefix = "/oauth2";
reverseProxy = true;
proxyPrefix = "/oauth2";
reverseProxy = true;
keyFile = config.sops.secrets.oauth2-proxy.path;
keyFile = config.sops.secrets.oauth2-proxy.path;
loginURL = auth.apiAuthUrl;
redeemURL = auth.tokenUrl;
validateURL = auth.rfc7662TokenIntrospectionUrl;
profileURL = auth.oidcUserInfo;
loginURL = auth.apiAuthUrl;
redeemURL = auth.tokenUrl;
validateURL = auth.rfc7662TokenIntrospectionUrl;
profileURL = auth.oidcUserInfo;
scope = "openid profile email";
scope = "openid profile email";
email.domains = [ "*" ];
email.domains = [ "*" ];
cookie = {
domain = "donsz.nl";
refresh = "1h";
secure = true;
cookie = {
domain = "donsz.nl";
refresh = "1h";
secure = true;
};
extraConfig = {
whitelist-domain = [ "*.donsz.nl" ];
};
nginx.domain = "oauth2.donsz.nl";
};
extraConfig = {
whitelist-domain = ["*.donsz.nl"];
};
nginx.domain = "oauth2.donsz.nl";
};
services.nginx.virtualHosts."oauth2.donsz.nl" = {
forceSSL = true;
http2 = true;

52
fili/services/forgejo.nix
View file

@ -1,4 +1,9 @@
{ lib, pkgs, config, ... }:
{
lib,
pkgs,
config,
...
}:
let
cfg = config.services.forgejo;
srv = cfg.settings.server;
@ -6,7 +11,7 @@ in
{
sops.secrets.forgejo = {
sopsFile = ../../secrets/forgejo.yaml;
key="email_password";
key = "email_password";
format = "yaml";
};
@ -33,7 +38,7 @@ in
lfs.enable = true;
user = "forgejo";
group = "forgejo";
repositoryRoot="/storage/storage/git";
repositoryRoot = "/storage/storage/git";
database = {
type = "postgres";
@ -43,8 +48,8 @@ in
settings = {
DEFAULT = {
APP_NAME="jana's git server";
APP_SLOGAN="meow!";
APP_NAME = "jana's git server";
APP_SLOGAN = "meow!";
};
server = {
DOMAIN = "git.donsz.nl";
@ -62,7 +67,7 @@ in
DEFAULT_ACTIONS_URL = "github";
};
repository = {
DEFAULT_PRIVATE="private";
DEFAULT_PRIVATE = "private";
};
mailer = {
ENABLED = true;
@ -74,19 +79,46 @@ in
mailerPasswordFile = config.sops.secrets.forgejo.path;
};
users.groups.forgejo-runner = { };
users.users.forgejo-runner = {
isSystemUser = true;
group = "forgejo-runner";
};
sops.secrets.forgejo-runner = {
sopsFile = ../../secrets/forgejo-runner.env;
};
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
instances.fili = {
enable = true;
name = "forgejo-runner-01";
token = "SutcrCJ3ULoE5LBj9Tm8zkvTRDEJCpbvpe7FEJHC";
tokenFile = config.sops.secrets.forgejo-runner.path;
url = "https://git.donsz.nl/";
labels = [
"node-22:docker://node:22-bookworm"
"nixos-latest:docker://nixos/nix"
"nix:host"
"docker:docker://node:16-bullseye"
"ubuntu-latest:docker://node:16-bullseye"
];
settings = { };
hostPackages = with pkgs; [
# default ones
bash
coreutils
curl
gawk
gitMinimal
gnused
nodejs
wget
# used in deployments
lix
openssh
];
settings = {};
};
};

3
fili/services/nginx.nix
View file

@ -1,4 +1,5 @@
{pkgs, config, ...}: {
{ pkgs, config, ... }:
{
services.nginx = {
enable = true;
statusPage = true;

3
fili/services/websites/homepage.nix
View file

@ -1,4 +1,5 @@
{flakes, pkgs, ...}: {
{ flakes, pkgs, ... }:
{
services.nginx = {
virtualHosts."donsz.nl" = {
forceSSL = true;

3
fili/services/websites/mapf.nix
View file

@ -1,4 +1,5 @@
{flakes,...}: {
{ flakes, ... }:
{
# imports = [
# flakes.mapf.nixosModules.default
# ];

19
fili/services/websites/totpal.nix
View file

@ -1,8 +1,6 @@
{ flakes, pkgs,... }:
{ flakes, pkgs, ... }:
let
totpal =
flakes.totpal.packages.${pkgs.system}.default
;
totpal = flakes.totpal.packages.${pkgs.system}.default;
in
{
services.nginx = {
@ -17,12 +15,11 @@ in
};
};
systemd.services.totpal =
{
description = "totpal";
serviceConfig = {
Type = "simple";
ExecStart = "${totpal}/bin/totpal";
};
systemd.services.totpal = {
description = "totpal";
serviceConfig = {
Type = "simple";
ExecStart = "${totpal}/bin/totpal";
};
};
}

7
secrets/forgejo-runner.env Normal file
View file

@ -0,0 +1,7 @@
TOKEN=ENC[AES256_GCM,data:5WnyyafhDtizIzL4VjXYsMFxLTKikS4Lg6rNGoeVbMqXbquutotfcQ==,iv:2QknXqH8eHft9NHy6K17uv2WvSfvDE8HJsaBDfzUlws=,tag:jw0ffCsfhBNBy++W7cyJsg==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHaTZNTmxkMVVuWER0dTZN\nL3N0cDF2bHdpZUNLQWdJMHVjVk5LbnY1OGlVClpya1VhcHdRUW0yUW5CL21mSUJN\nMDU5cFZ1QUppaHZ2dXkwUjgrVFloS3cKLS0tIGNzRWUxSFlXUnR5eFhEQkNOWmRY\nV0dNWWRXVnJCU0duU2dGcWZRWFhMUm8K9dsrIrABcLRZ4pfduYrIaSiEVF+e2OA0\nOGY2eYWAxbgtqBXEX+vLn0eNtoAptpQi2WgOWwVPr1M1+07w7jExBA==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1ygkcl4ss92z5ptzt3w5g4n98qx2c4kagyssm96m5z4c7t299c5wszjchxw
sops_lastmodified=2025-08-20T10:03:18Z
sops_mac=ENC[AES256_GCM,data:Su4KI/pxc1hqNzEYoA1iPU2a5Fp9o/SEf2DW+hx0T5sNL8UvUFDELqYUoGvNNuz1/59ZR8cEmNWhao9euBoF0eVoUAVuS6ADKkX8EjXXJY8qR3M7aseweYxRYXADcWLTlrXsK4xWU6z+NKwmdvYzir9N1XEeR+w3fJLBBNPBnZI=,iv:z3e0kJuJsCLrBGDXZZiYERA48bdvxTxCsPnSdUFgtT8=,tag:rW0zsoEKnKRTpJN8pkJ4/A==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.10.2

62
users/users.nix
View file

@ -17,43 +17,43 @@
};
users.extraUsers.jonathan = {
isNormalUser = true;
shell = pkgs.fish;
openssh.authorizedKeys.keys = [
# ori (lenovo laptop/desktop)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIET69oniNUA2nJV5+GxQ6XuK+vQbO8Uhtgrp1TrmiXVi jana@ori"
isNormalUser = true;
shell = pkgs.fish;
openssh.authorizedKeys.keys = [
# ori (lenovo laptop/desktop)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIET69oniNUA2nJV5+GxQ6XuK+vQbO8Uhtgrp1TrmiXVi jana@ori"
# bastion (arch server)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJT6QJcxhUKjvHBv3Bd1rugyfAFUpxIe9cu1Frw3ylL jana@bastion"
# bastion (arch server)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJT6QJcxhUKjvHBv3Bd1rugyfAFUpxIe9cu1Frw3ylL jana@bastion"
# fili (server)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0pmCsQeMMJ0r3o/XN7Zw8YFa9OEqrL3ikoGTK0OUY6 jana@fili"
# fili (server)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0pmCsQeMMJ0r3o/XN7Zw8YFa9OEqrL3ikoGTK0OUY6 jana@fili"
# kili (tudelft laptop)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAXOTU6E06zjK/zkzlSPhTG35PoNRYgTCStEPUYyjeE jana@kili"
# kili (tudelft laptop)
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAXOTU6E06zjK/zkzlSPhTG35PoNRYgTCStEPUYyjeE jana@kili"
# nori hp tudelft laptop
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSCuEu1kFg8mAgpOuYZ/IH2Ur7LQP7sQrDjcPmerkSx jana@nori"
# nori hp tudelft laptop
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSCuEu1kFg8mAgpOuYZ/IH2Ur7LQP7sQrDjcPmerkSx jana@nori"
# oneplus 5 phone
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTqoHEVYxD+mwmZhPj+1+i1P0XmgTxXgSnPdPwFT1vr u0_a484@localhost"
# oneplus 5 phone
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTqoHEVYxD+mwmZhPj+1+i1P0XmgTxXgSnPdPwFT1vr u0_a484@localhost"
# git deploy key
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgadaDrViJp0Z6fbLBAo9grkmCeNQliIPXe12l3X3i/ jana@deploy"
];
# Make me admin
extraGroups = [
"systemd-journal"
"wheel"
"networkmanager"
"libvirtd"
"dialout"
"storage"
"syncthing"
"jellyfin"
"media"
];
};
# git deploy key
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgadaDrViJp0Z6fbLBAo9grkmCeNQliIPXe12l3X3i/ jana@deploy"
];
# Make me admin
extraGroups = [
"systemd-journal"
"wheel"
"networkmanager"
"libvirtd"
"dialout"
"storage"
"syncthing"
"jellyfin"
"media"
];
};
users.extraUsers.jana = {
isNormalUser = true;