Initial commit from system

configuration.nix

@@ -0,0 +1,210 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./ntfy/ntfy.nix
+      ./forgejo/forgejo.nix
+      ./nginx/nginx.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "ext4" ];
+  boot.initrd.luks.devices.root = {
+    device = "/dev/disk/by-uuid/c43431da-9f1f-45b4-b37f-eda31e4b2365";
+    preLVM = true;
+    allowDiscards = true;
+  };
+
+  # Setting up ssh on boot for disk decryption
+  boot.initrd.network = {
+    enable = true;
+    ssh.enable = true;
+    ssh.port = 222;
+    ssh.authorizedKeys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQbbze/eLH6FLEYQbVcevS4QCDqk8cbKhJcF3tots7G infra-one_initrd''
+    ];
+#    ssh.authorizedKeyFiles = [ "/etc/secrets/sr-one_initrd_id_ed25519.pub" ];
+    ssh.hostKeys = [ "/etc/secrets/initrd/ssh_initrd_host_ed25519_key" ];
+    # ssh.ignoreEmptyHostKeys = true;
+    postCommands = '' echo 'cryptsetup-askpass' >> /root/.profile '';
+  };
+
+  networking = {
+    hostName = "infra-one";
+    domain = "lo-probst.de";
+    networkmanager.enable = true; # Configure network connections interactively with nmcli or nmtui.
+    useDHCP = false;
+    interfaces.enp1s0.useDHCP = true;
+    # Open ports in the firewall.
+    firewall.allowedTCPPorts = [ 80 443 ];
+  #  firewall.allowedUDPPorts = [ ... ];
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+  #   font = "Lat2-Terminus16";
+    keyMap = "de";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  };
+
+  # Enable sound.
+  # services.pulseaudio.enable = true;
+  # OR
+  # services.pipewire = {
+  #   enable = true;
+  #   pulse.enable = true;
+  # };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP6qy0iMmkzTRl87DLMHJlWJIHzUKlTqk9/mW6wE5as infra-one'' ];
+#  users.users.root.openssh.authorizedKeys.keyFiles = [ /etc/secrets/infra-one_root_id_ed25519.pub ];
+
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
+  environment.systemPackages = with pkgs; [
+#    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+#    wget
+#    gptfdisk
+#    hdparm
+#    mdadm
+    htop
+    btop
+    git
+  ];
+
+  # Unlock and boot data storage array
+#   environment.etc.crypttab = {
+#     mode = "0600";
+#     text = ''
+#       # <volume-name> <encrypted-device> [key-file] [options]
+#       data /dev/disk/by-uuid/8b4aad3e-56c2-4a5b-99d0-cdaa3b32ca54 /etc/secrets/data-luks-keyfile.key
+#     '';
+#   };
+#   fileSystems = {
+#     "/mnt/nextcloud" = {
+#       device = "/dev/vg-data/nextcloud";
+#       fsType = "ext4";
+#       options = [
+#         "nofail"
+#       ];
+#     };
+#   };
+
+  programs = {
+    mosh.enable = true;
+    ssh.startAgent = true;
+  };
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services = {
+    openssh = {
+      enable = true;
+      ports = [ 22 ];
+      settings = {
+        PasswordAuthentication = true;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "yes";
+      };
+    };
+  };
+
+#  services.nginx = {
+#    enable = true;
+#    recommendedGzipSettings = true;
+#    recommendedOptimisation = true;
+#    recommendedProxySettings = true;
+#    recommendedTlsSettings = true;
+#    # pulls in the domainname set for grafana
+#    virtualHosts.${config.services.grafana.settings.server.domain} = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      # directs traffic to the appropriate port for grafana
+#      locations."/" = {
+#        proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
+#        # proxyPass = "http://localhost:3000";
+#        proxyWebsockets = true;
+#      };
+#    };
+#    virtualHosts."cloud.lo-probst.de" = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      locations."/" = {
+#        proxyPass = "https://192.168.2.225:443";
+#      };
+#    };
+#    virtualHosts."oh.lo-probst.de" = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      locations."/" = {
+#        proxyPass = "https://192.168.2.221:9443";
+#      };
+#    };
+#  };
+#  security.acme = {
+#    acceptTerms = true;
+#    defaults = {
+#      email = "admin-sr-one@lo-probst.de";
+#      dnsProvider = "ionos";
+#      # API for authentication to DNA provider e.g.
+#      # CF_API_EMAIL=<insert-dns-account-email>
+#      # specify file if not using agenix
+#      credentialFiles = {
+#        "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-ddns-updater-sr-one.txt";
+#      };
+#    };
+#  };
+#  users.users.nginx.extraGroups = [ "acme" ];
+
+
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+
+}
+

forgejo/forgejo.nix

@@ -0,0 +1,48 @@
+{ lib, pkgs, config, ...}:
+
+{
+  services.forgejo = {
+    enable = true;
+    database = {
+      createDatabase = true;
+      type = "mysql";
+      #passwordFile = "/etc/secrets/forgejo/forgejo-db.txt";
+    };
+    # Enable support for Git Large File Storage
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = "git.${config.networking.domain}";
+        # You need to specify this to remove the port from URLs in the web UI.
+        ROOT_URL = "https://${config.services.forgejo.settings.server.DOMAIN}";
+        HTTP_PORT = 3100;
+      };
+      # You can temporarily allow registration to create an admin user.
+      service.DISABLE_REGISTRATION = false;
+      session.COOKIE_SECURE = true;
+      # Add support for actions, based on act: https://github.com/nektos/act
+#      actions = {
+#        ENABLED = true;
+#        DEFAULT_ACTIONS_URL = "github";
+#      };
+      # Sending emails is completely optional
+      # You can send a test email from the web UI at:
+      # Profile Picture > Site Administration > Configuration >  Mailer Configuration
+#      mailer = {
+#        ENABLED = true;
+#        SMTP_ADDR = "mail.example.com";
+#        FROM = "noreply@${srv.DOMAIN}";
+#        USER = "noreply@${srv.DOMAIN}";
+#      };
+    };
+#    secrets = {
+#      mailer.PASSWD = config.age.secrets.forgejo-mailer-password.path;
+#    };
+  };
+
+#  age.secrets.forgejo-mailer-password = {
+#    file = ../secrets/forgejo-mailer-password.age;
+#    mode = "400";
+#    owner = "forgejo";
+#  };
+}

hardware-configuration.nix

@@ -0,0 +1,38 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/69507661-1a2a-4ae1-ae14-6858c8948db0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/0de6e535-03d2-4746-b4ad-0c9dac13081e";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/f1ff2bbd-969a-4edf-a798-4cd4fa105be9"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nginx/nginx.nix

@@ -0,0 +1,57 @@
+{ lib, pkgs, config, ...}:
+
+{
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = false;
+    # pulls in the domainname set for ntfy
+    virtualHosts."ntfy.lo-probst.de" = {
+      enableACME = true;
+      acmeRoot = null;
+      forceSSL = true;
+#      sslCertificate = "/var/lib/acme/ntfy.lo-probst.de/fullchain.pem";
+      # directs traffic to the appropriate port for ntfy
+      locations."/" = {
+        proxyPass = "http://localhost:8080";
+        # proxyPass = "http://localhost:3000";
+        proxyWebsockets = true;
+      };
+    };
+    virtualHosts."${config.services.forgejo.settings.server.DOMAIN}" = {
+      enableACME = true;
+      acmeRoot = null;
+      forceSSL = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}";
+      };
+    };
+#    virtualHosts."oh.lo-probst.de" = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      locations."/" = {
+#        proxyPass = "https://192.168.2.221:9443";
+#      };
+#    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "admin-infra-one@lo-probst.de";
+      dnsProvider = "ionos";
+      # API for authentication to DNA provider e.g.
+      # CF_API_EMAIL=<insert-dns-account-email>
+      # specify file if not using agenix
+      credentialFiles = {
+        "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-acme-infra-one.txt";
+      };
+    };
+  };
+  users.users.nginx.extraGroups = [ "acme" ];
+}

ntfy/ntfy.nix

@@ -0,0 +1,13 @@
+{ lib, pkgs, config, ...}:
+{
+  services = {
+    ntfy-sh = {
+      enable = true;
+      settings.base-url = "https://ntfy.lo-probst.de";
+      settings = {
+        listen-http = ":8080";
+        behind-proxy = true;
+      };
+    };
+  };
+}