Koen/nix-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

runs on prod now :)

Browse source
This commit is contained in:
KoenDR06 2026-02-10 01:04:47 +01:00
parent d7812f37c3
commit 4c66c514a3
5 changed files with 83 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

13
machines/solis/modules.nix
View file

@ -1,4 +1,6 @@
{...}: { {config, ...}: let
username = config.horseman.username;
in {
imports = [ imports = [
../../modules ../../modules
]; ];
@ -6,6 +8,15 @@
config.horseman = { config.horseman = {
users.default.enable = true; users.default.enable = true;
containers = {
enable = true;
backupDir = "/home/${username}/backups";
nginx.enable = true;
vaultwarden.enable = true;
forgejo.enable = true;
};
base = { base = {
nix.enable = true; nix.enable = true;
locale.enable = true; locale.enable = true;

16
modules/containers/default.nix
View file

@ -1,5 +1,10 @@
{lib, ...}: let {
inherit (lib) mkOption types; config,
lib,
...
}: let
inherit (lib) mkIf mkEnableOption mkOption types;
cfg = config.horseman.containers;
in { in {
imports = [ imports = [
./nginx.nix ./nginx.nix
@ -8,17 +13,20 @@ in {
]; ];
options = { options = {
horseman.containers = {
enable = mkEnableOption "Containers";
backupDir = mkOption { backupDir = mkOption {
type = types.str; type = types.str;
}; };
}; };
};
config = { config = mkIf cfg.enable {
networking.nat = { networking.nat = {
enable = true; enable = true;
# Use "ve-*" when using nftables instead of iptables # Use "ve-*" when using nftables instead of iptables
internalInterfaces = ["ve-+"]; internalInterfaces = ["ve-+"];
externalInterface = "eno1"; externalInterface = "enp2s0";
# Lazy IPv6 connectivity for the container # Lazy IPv6 connectivity for the container
enableIPv6 = true; enableIPv6 = true;
}; };

12
modules/containers/forgejo.nix
View file

@ -57,8 +57,8 @@ in {
containers.forgejoRunner = { containers.forgejoRunner = {
autoStart = true; autoStart = true;
privateNetwork = true; privateNetwork = true;
hostAddress = "172.16.0.2"; hostAddress = "172.168.100.2";
localAddress = "192.168.100.2"; localAddress = "192.168.100.102";
bindMounts = { bindMounts = {
"/var/lib/secrets" = { "/var/lib/secrets" = {
@ -91,7 +91,7 @@ in {
systemd.services.startup = { systemd.services.startup = {
script = '' script = ''
cd ${config.users.users.runner.home} cd ${config.users.users.runner.home}
${pkgs.forgejo-runner}/bin/forgejo-runner create-runner-file --instance http://192.168.100.3:3000 --secret $(cat /var/lib/secrets/secret) --name runner ${pkgs.forgejo-runner}/bin/forgejo-runner create-runner-file --instance ${cfg.url} --secret $(cat /var/lib/secrets/secret) --name runner
sleep 10 sleep 10
${pkgs.forgejo-runner}/bin/forgejo-runner daemon --config ${configFile} ${pkgs.forgejo-runner}/bin/forgejo-runner daemon --config ${configFile}
''; '';
@ -106,8 +106,8 @@ in {
containers.forgejo = { containers.forgejo = {
autoStart = true; autoStart = true;
privateNetwork = true; privateNetwork = true;
hostAddress = "172.16.0.3"; hostAddress = "192.168.100.3";
localAddress = "192.168.100.3"; localAddress = "192.168.100.103";
bindMounts = { bindMounts = {
"/var/lib/forgejo" = { "/var/lib/forgejo" = {
@ -139,7 +139,7 @@ in {
ROOT_URL = cfg.url; ROOT_URL = cfg.url;
}; };
session = { session = {
COOKIE_SECURE = false; # TODO Set to true COOKIE_SECURE = true;
}; };
service = { service = {
DISABLE_REGISTRATION = true; DISABLE_REGISTRATION = true;

35
modules/containers/nginx.nix
View file

@ -8,7 +8,6 @@
}: let }: let
inherit (lib) mkEnableOption mkIf mkOption types; inherit (lib) mkEnableOption mkIf mkOption types;
cfg = config.horseman.containers.nginx; cfg = config.horseman.containers.nginx;
osConfig = config;
in { in {
options = { options = {
horseman.containers.nginx = { horseman.containers.nginx = {
@ -22,29 +21,12 @@ in {
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
containers.nginx = { security.acme = {
autoStart = true; acceptTerms = true;
privateNetwork = true; defaults.email = "koen.de.ruiter@hotmail.com";
hostAddress = "172.16.0.1";
localAddress = "192.168.100.1";
bindMounts = {
"/var/www/portfolio" = {
hostPath = "/var/www/portfolio";
isReadOnly = true;
};
"/var/www/public" = {
hostPath = "/var/www/public";
isReadOnly = true;
};
}; };
config = { services.fail2ban.enable = true;
config,
pkgs,
lib,
...
}: {
services.nginx = { services.nginx = {
enable = true; enable = true;
@ -72,7 +54,7 @@ in {
enableACME = true; enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://${osConfig.containers.forgejo.localAddress}:${toString osConfig.horseman.containers.forgejo.port}"; proxyPass = "http://${config.containers.forgejo.localAddress}:${toString config.horseman.containers.forgejo.port}";
}; };
}; };
@ -81,7 +63,7 @@ in {
enableACME = true; enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://${osConfig.containers.vaultwarden.localAddress}:${toString osConfig.horseman.containers.vaultwarden.port}"; proxyPass = "http://${config.containers.vaultwarden.localAddress}:${toString config.horseman.containers.vaultwarden.port}";
}; };
}; };
}; };
@ -92,11 +74,6 @@ in {
enable = true; enable = true;
allowedTCPPorts = [80 443]; allowedTCPPorts = [80 443];
}; };
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
system.stateVersion = "23.11";
};
}; };
}; };
} }

8
modules/containers/vaultwarden.nix
View file

@ -52,14 +52,14 @@ in {
containers.vaultwarden = { containers.vaultwarden = {
autoStart = true; autoStart = true;
privateNetwork = true; privateNetwork = true;
hostAddress = "172.16.0.4"; hostAddress = "192.168.100.4";
localAddress = "192.168.100.4"; localAddress = "192.168.100.104";
bindMounts = { bindMounts = {
"/var/lib/vaultwarden" = { "/var/lib/bitwarden_rs" = {
hostPath = DATA_DIR; hostPath = DATA_DIR;
isReadOnly = false; isReadOnly = false;
}; # TODO set correct };
}; };
config = { config = {