From 9cae73f501c76967aaacfd980490ec678e056631 Mon Sep 17 00:00:00 2001 From: LorenzProbst Date: Mon, 15 Jun 2026 19:03:52 +0200 Subject: [PATCH] Initial commit from system --- configuration.nix | 210 +++++++++++++++++++++++++++++++++++++ forgejo/forgejo.nix | 48 +++++++++ hardware-configuration.nix | 38 +++++++ nginx/nginx.nix | 57 ++++++++++ ntfy/ntfy.nix | 13 +++ 5 files changed, 366 insertions(+) create mode 100644 configuration.nix create mode 100644 forgejo/forgejo.nix create mode 100644 hardware-configuration.nix create mode 100644 nginx/nginx.nix create mode 100644 ntfy/ntfy.nix diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 0000000..b915e9f --- /dev/null +++ b/configuration.nix @@ -0,0 +1,210 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page, on +# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). + +{ config, lib, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ./ntfy/ntfy.nix + ./forgejo/forgejo.nix + ./nginx/nginx.nix + ]; + + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + # Define on which hard drive you want to install Grub. + boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "ext4" ]; + boot.initrd.luks.devices.root = { + device = "/dev/disk/by-uuid/c43431da-9f1f-45b4-b37f-eda31e4b2365"; + preLVM = true; + allowDiscards = true; + }; + + # Setting up ssh on boot for disk decryption + boot.initrd.network = { + enable = true; + ssh.enable = true; + ssh.port = 222; + ssh.authorizedKeys = [ + ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQbbze/eLH6FLEYQbVcevS4QCDqk8cbKhJcF3tots7G infra-one_initrd'' + ]; +# ssh.authorizedKeyFiles = [ "/etc/secrets/sr-one_initrd_id_ed25519.pub" ]; + ssh.hostKeys = [ "/etc/secrets/initrd/ssh_initrd_host_ed25519_key" ]; + # ssh.ignoreEmptyHostKeys = true; + postCommands = '' echo 'cryptsetup-askpass' >> /root/.profile ''; + }; + + networking = { + hostName = "infra-one"; + domain = "lo-probst.de"; + networkmanager.enable = true; # Configure network connections interactively with nmcli or nmtui. + useDHCP = false; + interfaces.enp1s0.useDHCP = true; + # Open ports in the firewall. + firewall.allowedTCPPorts = [ 80 443 ]; + # firewall.allowedUDPPorts = [ ... ]; + }; + + # Set your time zone. + time.timeZone = "Europe/Berlin"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + # i18n.defaultLocale = "en_US.UTF-8"; + console = { + # font = "Lat2-Terminus16"; + keyMap = "de"; + # useXkbConfig = true; # use xkb.options in tty. + }; + + # Enable sound. + # services.pulseaudio.enable = true; + # OR + # services.pipewire = { + # enable = true; + # pulse.enable = true; + # }; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP6qy0iMmkzTRl87DLMHJlWJIHzUKlTqk9/mW6wE5as infra-one'' ]; +# users.users.root.openssh.authorizedKeys.keyFiles = [ /etc/secrets/infra-one_root_id_ed25519.pub ]; + + # List packages installed in system profile. + # You can use https://search.nixos.org/ to find more packages (and options). + environment.systemPackages = with pkgs; [ +# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. +# wget +# gptfdisk +# hdparm +# mdadm + htop + btop + git + ]; + + # Unlock and boot data storage array +# environment.etc.crypttab = { +# mode = "0600"; +# text = '' +# # [key-file] [options] +# data /dev/disk/by-uuid/8b4aad3e-56c2-4a5b-99d0-cdaa3b32ca54 /etc/secrets/data-luks-keyfile.key +# ''; +# }; +# fileSystems = { +# "/mnt/nextcloud" = { +# device = "/dev/vg-data/nextcloud"; +# fsType = "ext4"; +# options = [ +# "nofail" +# ]; +# }; +# }; + + programs = { + mosh.enable = true; + ssh.startAgent = true; + }; + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services = { + openssh = { + enable = true; + ports = [ 22 ]; + settings = { + PasswordAuthentication = true; + KbdInteractiveAuthentication = false; + PermitRootLogin = "yes"; + }; + }; + }; + +# services.nginx = { +# enable = true; +# recommendedGzipSettings = true; +# recommendedOptimisation = true; +# recommendedProxySettings = true; +# recommendedTlsSettings = true; +# # pulls in the domainname set for grafana +# virtualHosts.${config.services.grafana.settings.server.domain} = { +# enableACME = true; +# acmeRoot = null; +# forceSSL = true; +# # directs traffic to the appropriate port for grafana +# locations."/" = { +# proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}"; +# # proxyPass = "http://localhost:3000"; +# proxyWebsockets = true; +# }; +# }; +# virtualHosts."cloud.lo-probst.de" = { +# enableACME = true; +# acmeRoot = null; +# forceSSL = true; +# locations."/" = { +# proxyPass = "https://192.168.2.225:443"; +# }; +# }; +# virtualHosts."oh.lo-probst.de" = { +# enableACME = true; +# acmeRoot = null; +# forceSSL = true; +# locations."/" = { +# proxyPass = "https://192.168.2.221:9443"; +# }; +# }; +# }; +# security.acme = { +# acceptTerms = true; +# defaults = { +# email = "admin-sr-one@lo-probst.de"; +# dnsProvider = "ionos"; +# # API for authentication to DNA provider e.g. +# # CF_API_EMAIL= +# # specify file if not using agenix +# credentialFiles = { +# "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-ddns-updater-sr-one.txt"; +# }; +# }; +# }; +# users.users.nginx.extraGroups = [ "acme" ]; + + + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.05"; # Did you read the comment? + +} + diff --git a/forgejo/forgejo.nix b/forgejo/forgejo.nix new file mode 100644 index 0000000..0d588ae --- /dev/null +++ b/forgejo/forgejo.nix @@ -0,0 +1,48 @@ +{ lib, pkgs, config, ...}: + +{ + services.forgejo = { + enable = true; + database = { + createDatabase = true; + type = "mysql"; + #passwordFile = "/etc/secrets/forgejo/forgejo-db.txt"; + }; + # Enable support for Git Large File Storage + lfs.enable = true; + settings = { + server = { + DOMAIN = "git.${config.networking.domain}"; + # You need to specify this to remove the port from URLs in the web UI. + ROOT_URL = "https://${config.services.forgejo.settings.server.DOMAIN}"; + HTTP_PORT = 3100; + }; + # You can temporarily allow registration to create an admin user. + service.DISABLE_REGISTRATION = false; + session.COOKIE_SECURE = true; + # Add support for actions, based on act: https://github.com/nektos/act +# actions = { +# ENABLED = true; +# DEFAULT_ACTIONS_URL = "github"; +# }; + # Sending emails is completely optional + # You can send a test email from the web UI at: + # Profile Picture > Site Administration > Configuration > Mailer Configuration +# mailer = { +# ENABLED = true; +# SMTP_ADDR = "mail.example.com"; +# FROM = "noreply@${srv.DOMAIN}"; +# USER = "noreply@${srv.DOMAIN}"; +# }; + }; +# secrets = { +# mailer.PASSWD = config.age.secrets.forgejo-mailer-password.path; +# }; + }; + +# age.secrets.forgejo-mailer-password = { +# file = ../secrets/forgejo-mailer-password.age; +# mode = "400"; +# owner = "forgejo"; +# }; +} diff --git a/hardware-configuration.nix b/hardware-configuration.nix new file mode 100644 index 0000000..51e155b --- /dev/null +++ b/hardware-configuration.nix @@ -0,0 +1,38 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/69507661-1a2a-4ae1-ae14-6858c8948db0"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/0de6e535-03d2-4746-b4ad-0c9dac13081e"; + fsType = "ext4"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/f1ff2bbd-969a-4edf-a798-4cd4fa105be9"; } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nginx/nginx.nix b/nginx/nginx.nix new file mode 100644 index 0000000..bba9a78 --- /dev/null +++ b/nginx/nginx.nix @@ -0,0 +1,57 @@ +{ lib, pkgs, config, ...}: + +{ + services.nginx = { + enable = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = false; + # pulls in the domainname set for ntfy + virtualHosts."ntfy.lo-probst.de" = { + enableACME = true; + acmeRoot = null; + forceSSL = true; +# sslCertificate = "/var/lib/acme/ntfy.lo-probst.de/fullchain.pem"; + # directs traffic to the appropriate port for ntfy + locations."/" = { + proxyPass = "http://localhost:8080"; + # proxyPass = "http://localhost:3000"; + proxyWebsockets = true; + }; + }; + virtualHosts."${config.services.forgejo.settings.server.DOMAIN}" = { + enableACME = true; + acmeRoot = null; + forceSSL = true; + extraConfig = '' + client_max_body_size 512M; + ''; + locations."/" = { + proxyPass = "http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}"; + }; + }; +# virtualHosts."oh.lo-probst.de" = { +# enableACME = true; +# acmeRoot = null; +# forceSSL = true; +# locations."/" = { +# proxyPass = "https://192.168.2.221:9443"; +# }; +# }; + }; + security.acme = { + acceptTerms = true; + defaults = { + email = "admin-infra-one@lo-probst.de"; + dnsProvider = "ionos"; + # API for authentication to DNA provider e.g. + # CF_API_EMAIL= + # specify file if not using agenix + credentialFiles = { + "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-acme-infra-one.txt"; + }; + }; + }; + users.users.nginx.extraGroups = [ "acme" ]; +} diff --git a/ntfy/ntfy.nix b/ntfy/ntfy.nix new file mode 100644 index 0000000..e936c1b --- /dev/null +++ b/ntfy/ntfy.nix @@ -0,0 +1,13 @@ +{ lib, pkgs, config, ...}: +{ + services = { + ntfy-sh = { + enable = true; + settings.base-url = "https://ntfy.lo-probst.de"; + settings = { + listen-http = ":8080"; + behind-proxy = true; + }; + }; + }; +}