clara/nix-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactoring and cleaning up

Browse source
This commit is contained in:
CDaut 2025-10-31 21:29:30 +01:00
parent 7113bb629a
commit 8df968546d
Signed by: clara
GPG key ID: 223391B52FAD4463
15 changed files with 169 additions and 161 deletions
Download patch file Download diff file Expand all files Collapse all files

6
configs/containers/forgejo_container.nix → configs/containers/cube/forgejo_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "192.168.178.37";
targetPort = 22;
targetUser = "root";
tags = [ "cube" ];
};
networking.hostName = "forgejo";
networking.interfaces.wgbr.ipv4.addresses = [
@ -13,7 +14,8 @@
}
];
imports = [
../container_config.nix
../services/forgejo.nix
../../container_config.nix
../../services/forgejo.nix
];
}

5
configs/containers/mastodon_container.nix → configs/containers/cube/mastodon_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "192.168.178.81";
targetPort = 22;
targetUser = "root";
tags = [ "cube" ];
};
networking.hostName = "mastodon";
networking.interfaces.wgbr.ipv4.addresses = [
@ -13,7 +14,7 @@
}
];
imports = [
../container_config.nix
../services/mastodon.nix
../../container_config.nix
../../services/mastodon.nix
];
}

5
configs/containers/vikunja_container.nix → configs/containers/cube/vikunja_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "192.168.178.107";
targetPort = 22;
targetUser = "root";
tags = [ "cube" ];
};
networking.hostName = "paperless";
networking.interfaces.wgbr.ipv4.addresses = [
@ -13,7 +14,7 @@
}
];
imports = [
../container_config.nix
../services/vikunja.nix
../../container_config.nix
../../services/vikunja.nix
];
}

5
configs/containers/wg_container.nix → configs/containers/cube/wg_container.nix
View file

@ -3,10 +3,11 @@
targetHost = "192.168.178.123";
targetPort = 22;
targetUser = "root";
tags = [ "cube" ];
};
networking.hostName = "wireguard";
imports = [
../container_config.nix
../services/wireguard.nix
../../container_config.nix
../../services/wireguard.nix
];
}

5
configs/containers/zammad_container.nix → configs/containers/cube/zammad_container.nix
View file

@ -3,6 +3,7 @@
targetHost = "192.168.178.110";
targetPort = 22;
targetUser = "root";
tags = [ "cube" ];
};
networking.hostName = "zammad";
networking.interfaces.wgbr.ipv4.addresses = [
@ -12,7 +13,7 @@
}
];
imports = [
../container_config.nix
../services/zammad.nix
../../container_config.nix
../../services/zammad.nix
];
}

19
configs/containers/mc_container.nix
View file

@ -1,19 +0,0 @@
{ lib, pkgs, config, ... }: {
deployment = {
targetHost = "192.168.178.65";
targetPort = 22;
targetUser = "root";
};
networking.hostName = "mcserver";
networking.interfaces.wgbr.ipv4.addresses = [
{
address = "10.8.1.2";
prefixLength = 24;
}
];
imports = [
../container_config.nix
#../services/minecraft-server.nix
];
}

5
configs/containers/nginx_container.nix → configs/containers/netcup_pve/nginx_container.nix
View file

@ -4,6 +4,7 @@
targetHost = "10.0.0.2";
targetPort = 22;
targetUser = "root";
tags = [ "netcup_pve" ];
};
networking = {
hostName = "nginx";
@ -17,7 +18,7 @@
};
};
imports = [
../container_config.nix
../services/nginx.nix
../../container_config.nix
../../services/nginx.nix
];
}

14
configs/containers/netcup_pve/wg_server_container.nix Normal file
View file

@ -0,0 +1,14 @@
{ lib, pkgs, config, ... }:
{
deployment = {
targetHost = "10.0.0.3";
targetPort = 22;
targetUser = "root";
tags = [ "netcup_pve" ];
};
networking.hostName = "wireguard";
imports = [
../../container_config.nix
];
}

66
configs/containers/paperless_container.nix
View file

@ -1,66 +0,0 @@
{ lib, pkgs, config, ... }:
let paperless_dir = "/mnt/paperless_dir";
in {
deployment = {
targetHost = "192.168.178.101";
targetPort = 22;
targetUser = "root";
};
networking.hostName = "paperless";
networking.interfaces.wgbr.ipv4.addresses = [
{
address = "10.8.1.7";
prefixLength = 24;
}
];
imports = [
../container_config.nix
../services/paperless.nix
];
# set up secret key
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets = {
smb_uname.sopsFile = ../../secrets/paperless/secrets.yaml;
smb_pass.sopsFile = ../../secrets/paperless/secrets.yaml;
};
templates."cifs-credentials".content = ''
username=${config.sops.placeholder.smb_uname}
password=${config.sops.placeholder.smb_pass}
'';
};
# Mount paperless directory
environment.systemPackages = [ pkgs.cifs-utils ];
systemd.tmpfiles.rules = [
"d ${paperless_dir} 0777 paperless paperless 99999y"
];
fileSystems.${paperless_dir} = {
device = "//10.8.1.5/milo_paperless";
fsType = "cifs";
options =
let
# this line prevents hanging on network split
automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
in
[
"${automount_opts}"
"credentials=${config.sops.templates."cifs-credentials".path}"
"uid=paperless,gid=paperless"
];
};
# Paperless needs the share to be mounted
systemd.user.services."paperless-web.service".requires = [
"mnt-paperless_dir.mount"
];
systemd.user.services."paperless-scheduler.service".requires = [
"mnt-paperless_dir.mount"
];
}

60
configs/services/wg_server.nix Normal file
View file

@ -0,0 +1,60 @@
{ lib, pkgs, config, ... }:
let wg_port = 51820;
in {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = lib.mkDefault true;
"net.ipv6.conf.all.forwarding" = lib.mkDefault true;
};
# set up secret key
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.wg_private_key = {
sopsFile = ../../secrets/wireguard/secrets.yaml;
};
};
networking = {
firewall.allowedUDPPorts = [ wg_port ];
firewall.rejectPackets = true;
firewall.trustedInterfaces = [ "wgbr" "wg0" ];
interfaces.wgbr.ipv4 = {
routes = [ ];
addresses = [
{
address = "10.8.1.1";
prefixLength = 24;
}
];
};
wg-quick.interfaces = {
wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface.
address = [ "10.8.1.1/16" ];
listenPort = wg_port; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# Path to the private key file (see sops).
privateKeyFile = "/run/secrets/wg_private_key";
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
# Public key of the server (not a file path).
publicKey = "AJ1nr0/w8OvsNq5Ju//m4856u7yY0hlPGMEGeZtlhlY=";
# Forward all the traffic via VPN.
allowedIPs = [ "10.8.0.0/16" ];
# Set this to the server IP and port.
endpoint = "202.61.230.52:51820";
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
persistentKeepalive = 25;
}
];
};
};
};
}

2
configs/services/wireguard.nix
View file

@ -10,7 +10,7 @@ in {
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.wg_private_key = {
sopsFile = ../../secrets/wireguard/secrets.yaml;
sopsFile = ../../secrets/wireguard/cube.yaml;
};
};