Fix ionos-dyndns timer interval

systemd uses min, not m for minutes.

.ansible-lint

@@ -0,0 +1,4 @@
+---
+
+profile: production
+offline: true

.drone.yml

@@ -1,35 +0,0 @@
----
-kind: pipeline
-type: docker
-name: Static Verification
-steps:
-  - name: ansible-lint
-    image: python:3.10.6
-    commands:
-      - pip install ansible==6.4.0 ansible-lint==6.4.0 > /dev/null 2> /dev/null
-      - ansible-lint ansible
-
----
-kind: pipeline
-type: docker
-name: Check
-steps:
-  - name: ansible-playbook --check
-    image: python:3.10.6
-    environment:
-      SSH_KEY:
-        from_secret: ssh_key
-      VAULT_PASSWORD:
-        from_secret: vault_password
-    commands:
-      - pip install ansible==6.4.0 > /dev/null 2> /dev/null
-
-      - mkdir "$HOME/.ssh"
-      - echo "$SSH_KEY" > "$HOME/.ssh/id"
-      - chmod 0600 ~/.ssh/id
-      - ssh-keyscan -p 2309 vmd98928.contaboserver.net > "$HOME/.ssh/known_hosts"
-
-      - echo "$VAULT_PASSWORD" > "$HOME/vault_password"
-
-      - cd ansible
-      - ansible-playbook --private-key "$HOME/.ssh/id" --vault-password-file "$HOME/vault_password" --check playbooks/misc-all.yaml

.gitea/workflows/check.yaml

@@ -0,0 +1,15 @@
+name: Check
+on: [push]
+jobs:
+  "Lint Ansible Files":
+    runs-on: ubuntu-22.04
+    steps:
+      - run: apt-get update
+      - run: apt-get install -y python3 python3-pip python3-venv
+      - run: python3 --version
+      - name: Check out repo
+        uses: actions/checkout@v3
+      - run: python3 -m venv venv
+      - run: venv/bin/pip --disable-pip-version-check install ansible==7.2.0 ansible-lint==6.16.1 > /dev/null 2> /dev/null
+      - run: venv/bin/ansible-lint -c .ansible-lint ansible
+  # TODO: Reimplement ansible-play --check step from old drone config

.gitignore

@@ -1 +1,2 @@
 backups
+*.swp

README.md

@@ -6,3 +6,14 @@
 | --- | --- |
 | Hostname | `shamash` |
 | Domains  | `{,pad.,codi.,ci.,git.,jupyter.,plantuml.}pbrinkmeier.de`, `tichy.click`, `beany.club`, `vmd98928.contaboserver.net` |
+
+## Linting
+
+Use `nix develop` to drop into a shell containing `ansible-lint`.
+Then run it using
+
+```
+ansible-lint --offline
+```
+
+to avoid checking for a new version every single run.

TODO.md

@@ -13,3 +13,6 @@
 - [ ] Lint caddy file, add gzip and disable admin interface
 - [x] Make Gitea display graphs in Notebooks (see https://docs.gitea.io/en-us/external-renderers/).
 - [x] Factorio server
+- [ ] Add flag for Gitea backups (after which Gitea will be up but no contain the sites source code)
+- [x] Add Gitea actions
+- [ ] Remove drone

ansible/playbooks/misc-docker.yaml

@@ -7,8 +7,9 @@
       ansible.builtin.user:
         name: "{{ item.name }}"
         uid: "{{ item.uid }}"
-        create_home: false
         state: "{{ item.state }}"
+        create_home: false
+        system: true
       loop:
         - name: jupyter
           uid: 42000
@@ -16,19 +17,26 @@
         - name: gitea
           uid: 42001
           state: present
+        - name: score
+          uid: 42003
+          state: present
         - name: factorio
           uid: 845
           state: present
         - name: hackmd
           uid: 1500
           state: present
+
         - name: hedgedoc
           uid: 10000
           state: absent
+        - name: bsa
+          uid: 42002
+          state: absent
     # All services that are behind Caddy need to be in this network
     - name: Create Caddy network
       become: true
-      docker_network:
+      community.docker.docker_network:
         name: caddy-network
         state: present
     - name: Upload docker configuration
@@ -47,7 +55,8 @@
         dest: /etc/pbri/docker/{{ item.name }}/.env
         # Files should inaccessible to non-root users.
         mode: u=rw,g=,o=
-        # This is true by default but I put it here anyways to emphasize what's happening
+        # This is true by default but I put it here anyways
+        # to emphasize what's happening
         decrypt: true
       # Not quite happy with all the seperate loops yet.
       loop:
@@ -56,7 +65,7 @@
         - name: drone
           state: present
         - name: factorio
-          state: absent
+          state: present
         - name: gitea
           state: present
     - name: Create directory for docker volumes
@@ -87,12 +96,20 @@
         owner: factorio
         group: factorio
         mode: u=rwx,g=,o=
+    - name: Create score data folder
+      become: true
+      ansible.builtin.file:
+        path: /var/lib/pbri/docker/score
+        state: directory
+        owner: score
+        group: score
+        mode: u=rwx,g=,o=
     # Since some docker-compose configuration might want to pull
     # images from the Gitea package repository, we need to ensure
     # that Gitea is reachable before those configurations are deployed.
     - name: Set up caddy and gitea containers
       become: true
-      docker_compose:
+      community.docker.docker_compose:
         project_src: "/etc/pbri/docker/{{ item.name }}"
         state: "{{ item.state }}"
         build: true
@@ -115,7 +132,7 @@
       delay: 5  # Retry every 5 seconds
     - name: Set up other containers
       become: true
-      docker_compose:
+      community.docker.docker_compose:
         project_src: "/etc/pbri/docker/{{ item.name }}"
         state: "{{ item.state }}"
         build: true
@@ -125,9 +142,14 @@
           state: present
         - name: codi
           state: present
-        - name: factorio
-          state: absent
         - name: jupyter
           state: present
-        - name: glebby
+        - name: utoy
           state: present
+        - name: score
+          state: present
+
+        - name: factorio
+          state: absent
+        - name: glebby
+          state: absent

ansible/roles/docker/tasks/main.yaml

@@ -28,7 +28,7 @@
 - name: Retrieve dpkg architecture
   check_mode: false
   ansible.builtin.command: dpkg --print-architecture
-  register: dpkg_architecture
+  register: docker_dpkg_architecture
   changed_when: false
 
 - name: Add Docker apt repository
@@ -36,7 +36,7 @@
   ansible.builtin.template:
     src: docker.list.j2
     dest: /etc/apt/sources.list.d/docker.list
-    mode: 0644
+    mode: "u=rw,g=r,o=r"
 
 - name: Install Docker
   become: true

ansible/roles/docker/templates/docker.list.j2

@@ -1 +1 @@
-deb [arch={{ dpkg_architecture.stdout }} signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
+deb [arch={{ docker_dpkg_architecture.stdout }} signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable

docker/docker/caddy/Caddyfile

@@ -1,3 +1,7 @@
+{
+    admin off
+}
+
 pbrinkmeier.de {
     file_server {
         root /srv/pbrinkmeier.de
@@ -37,6 +41,10 @@ plantuml.pbrinkmeier.de {
     reverse_proxy codi_plantuml:8080
 }
 
-glebby.pbrinkmeier.de {
+utoy.beany.club {
-    reverse_proxy glebby:5000
+    reverse_proxy utoy:3000
+}
+
+score.brocke.net {
+    reverse_proxy score:8080
 }

docker/docker/drone/docker-compose.yaml

@@ -12,7 +12,7 @@ services:
       DRONE_SERVER_PROTO: https
     volumes:
       - /var/lib/pbri/docker/drone:/data
-    restart: always
+    restart: unless-stopped
 
   drone_runner:
     image: drone/drone-runner-docker:1
@@ -24,7 +24,7 @@ services:
       DRONE_RUNNER_NAME: shamash
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    restart: always
+    restart: unless-stopped
 
 networks:
   default:

docker/docker/factorio/Dockerfile

@@ -1,4 +1,4 @@
-FROM factoriotools/factorio:1.1.68
+FROM factoriotools/factorio:1.1.87
 
 COPY server-settings.json /server-settings.json
 ENTRYPOINT [ "/bin/sh", "-c", "mkdir -p /factorio/config && envsubst < /server-settings.json > /factorio/config/server-settings.json && exec /docker-entrypoint.sh" ]

docker/docker/gitea/Dockerfile

@@ -1,5 +1,3 @@
-FROM gitea/gitea:1.17.3
+ FROM gitea/act_runner:0.2.5
 
-RUN apk --no-cache add gcc python3-dev py3-pip linux-headers musl-dev libffi-dev
+ COPY runner-config.yaml /opt/runner-config.yaml
-RUN pip3 install --upgrade pip
-RUN pip3 install jupyter

docker/docker/gitea/README.md

@@ -1,6 +1,17 @@
+# gitea
+
 Add a `.env` file like this:
 
 ```
 GITEA_DB_PASSWORD=...
 GITEA_SMTP_PASSWORD=...
+GITEA_RUNNER_REGISTRATION_TOKEN=...
 ```
+
+You should keep an eye on `GITEA_RUNNER_REGISTRATION_TOKEN`. I suspect
+it might change over time, e.g. when restarting or updating Gitea.
+
+## Files
+
+- `runner-config.yaml`: Configuration for `gitea/act_runner`. Generated using `act_runner generate-config` then adjusted
+- `Dockerfile`: Creates an image based on `gitea/act_runner` that comes with `runner-config.yaml` in `/opt` (to avoid the extra mount)

docker/docker/gitea/docker-compose.yaml

@@ -2,9 +2,8 @@ version: "3"
 
 services:
   gitea:
-    image: pbrinkmeier/gitea
+    image: gitea/gitea:1.20.3
-    build: .
+    restart: unless-stopped
-    restart: always
     environment:
       # Ref: https://docs.gitea.io/en-us/config-cheat-sheet
       # User is created by misc-docker.yaml
@@ -36,17 +35,17 @@ services:
       GITEA__service__DEFAULT_ENABLE_TIMETRACKING: "false"
       GITEA__service__DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME: "false"
       GITEA__mailer__ENABLED: "true"
-      GITEA__mailer__HOST: smtp.mailbox.org:465
+      GITEA__mailer__PROTOCOL: smtps
+      GITEA__mailer__SMTP_ADDR: smtp.mailbox.org
+      GITEA__mailer__SMTP_HOST: 465
       GITEA__mailer__FROM: git@pbrinkmeier.de
       GITEA__mailer__USER: hallo@pbrinkmeier.de
       GITEA__mailer__PASSWD: "${GITEA_SMTP_PASSWORD}"
       GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
       GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
-      GITEA__markup_0x2E_jupyter__ENABLED: "true"
+      # Enable Gitea actions
-      GITEA__markup_0x2E_jupyter__FILE_EXTENSIONS: ".ipynb"
+      # Ref: https://docs.gitea.com/usage/actions/quickstart
-      GITEA__markup_0x2E_jupyter__RENDER_COMMAND: "jupyter nbconvert --stdin --stdout --to html --template basic"
+      GITEA__actions__ENABLED: "true"
-      GITEA__markup_0x2E_jupyter__IS_INPUT_FILE: "false"
-      GITEA__markup_0x2E_sanitizer_0x2E_jupyter_0x2E_img__ALLOW_DATA_URI_IMAGES: "true"
     volumes:
       - /var/lib/pbri/docker/gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -58,7 +57,7 @@ services:
 
   gitea_db:
     image: postgres:14.5-alpine
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_DB: gitea
       POSTGRES_USER: gitea
@@ -66,6 +65,21 @@ services:
     volumes:
       - /var/lib/pbri/docker/gitea_db:/var/lib/postgresql/data
 
+  gitea_runner:
+    image: pbrinkmeier/act_runner:0.2.5
+    build: .
+    restart: unless-stopped
+    environment:
+      CONFIG_FILE: /opt/runner-config.yaml
+      GITEA_INSTANCE_URL: "https://git.pbrinkmeier.de"
+      GITEA_RUNNER_REGISTRATION_TOKEN: "${GITEA_RUNNER_REGISTRATION_TOKEN}"
+      GITEA_RUNNER_NAME: "basic-bitchboy"
+    volumes:
+      - /var/lib/pbri/docker/gitea_runner_data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    depends_on:
+      - gitea
+
 networks:
   default:
     name: caddy-network

docker/docker/gitea/runner-config.yaml

@@ -0,0 +1,85 @@
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # Extra environment variables to run jobs.
+  # envs:
+  #   A_TEST_ENV_NAME_1: a_test_env_value_1
+  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  # env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `deamon`, will use labels in `.runner` file.
+  # Some (most?) GitHub actions use node for scripting, so just using
+  # ubuntu:22.04 here is not enough.
+  labels:
+    - "ubuntu-22.04:docker://node:16-bullseye"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: false
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options:
+  # The parent directory of a job's working directory.
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: []
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

docker/docker/jupyter/docker-compose.yaml

@@ -2,7 +2,7 @@ version: "3"
 
 services:
   jupyter:
-    image: pbri/jup:1.3
+    image: git.pbrinkmeier.de/paul/jup:1.5
     user: "42000"
     volumes:
       - /var/lib/pbri/docker/jupyter_data:/data

docker/docker/score/docker-compose.yaml

@@ -0,0 +1,16 @@
+version: "3"
+
+services:
+  score:
+    image: ghcr.io/lbrocke/score:v1.0.2
+    user: "42003:42003"
+    environment:
+      SCORE_LISTEN: 0.0.0.0:8080
+    volumes:
+      - /var/lib/pbri/docker/score:/data
+    restart: unless-stopped
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/utoy/docker-compose.yaml

@@ -0,0 +1,11 @@
+version: "3"
+
+services:
+  utoy:
+    image: git.pbrinkmeier.de/paul/utoy:0.6
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/envs/codi/.env

@@ -1,20 +1,20 @@
 $ANSIBLE_VAULT;1.1;AES256
-63343763623732396235363736376438623538373363346631336332386538346465353530646633
+35633339346331336263653239623234333765623065313466373635353662306632663063323138
-6332316539323765623066386163646362653862393638340a326564363761646430376466383030
+3138333732376665636531396335393235653538393438660a326664656462383737383735386262
-35303562633737323166646530383433373034306266366231306662353936323465616633326538
+34646634653631613333656132663536653337386362303536626634363239663064383564633663
-6539373133343437620a323663363235366139373663353362393737643634666131316634343165
+3563383663383266610a613938376665353936643361366465393765313666636531663837383036
-61336634656466626535336638646338303764316337386136323739343564323833366666643665
+34373064616662363839396233623232643134366361313130636433356237323565636338306435
-32356635383335303361363637353564343132393066643966303733386265363961313366333532
+36333139356635376366643538303736306364383764393365663365643137383439376636376561
-64313430313463353461646334376431316139383235313738636464656162646261383234376634
+65343036363538393235333434316632393562613735313165636165666662326462663063356532
-37653336373039643832323038386634616465323334616636316531636466336431633836303334
+34343936356364643536313230383633396438363638623963643239643638633435353164623635
-39373863366139326566366564653037323936383163363265383636303232613032353832346234
+35646631353364663261633862666331636532663762636164663861303262373630643265623239
-65643566666463353232373331333163303232323938663264353431616430633333653139363963
+62333737393562376235373430363662613032623436303865613634636436376565363130366532
-33343335313530666232643463623535613162636166343834303264376366353138326665623738
+36303834343439333865313037336233323036373833663837303332393330306434373431363961
-39616364383035383066393465653736303638313638643638633865373131633963633062303232
+30323134373666376563316661303131306566393830633732313664653039313263613761346262
-65623334353766313762303031366435343735613939343937316630633735623230616336383138
+34393738376434313663336231656132386163663665393133363465366230383537656630313563
-63633861356235613033393338303065353339343632333331646664306230356561633530623565
+66373633333663653837336439646363646233326233303062643635396531356438363433633131
-38396338666166343739643438643731613165343133626363326433396334386136653836326636
+36353561366265343036386533373563613836663831613836643432386633643535396536376362
-37306665346136633433653134656636616432653765373765346139313636353862373066306232
+65306335313363316236363362316533663433656531366331336132303965373230623330313636
-31383761356339396636623137346565306662363365646638336565393433613530653262656566
+38623361623934303663333631306330333434343833336132333333313939616261666461346333
-63323364663964353035353031303230666434366133323735373739303163313739333838303266
+34343935663165303665373735646636326364393336626462363732353739366161366164333465
-316139366661396333646161323536386461
+643034323233333535376461313834663132

docker/envs/gitea/.env

@@ -1,11 +1,14 @@
 $ANSIBLE_VAULT;1.1;AES256
-32303131323835666635366533363238303766643063633934353139323837396336373734393263
+35623364633833623964623536646534373634663736613561333561343136333965306638396532
-6334616639373630616437646437626666343161373338310a323234313330323839663165653038
+6162393239383936386338666565306132646230383066630a336337613636383431623738343663
-66386266373562363966643666653234656337373166626131383565313334333234373532633133
+61343262363631376665383035323139313863626331666439336134613035663439376231343863
-6265656232613337380a393531323765373332613162346365373831373733623166363136326239
+3032353139643138640a383365356630323835383538393734643134343133653033383663333464
-66386262393836343634353061363131313936666665343634326430393939633336656666626530
+62386361633435633664306531623835353665326432393932336163316561653866343137323030
-32633762306136356464386262633132646633373066316434343437356636313831313462366533
+63643262323436356166373533363235366238393633336631336266373837373932313134303563
-37343864636265666166613761386639316534386365343439623634373039383237353839656130
+65633337393938623134636538653561356565333831356638373862376333336163363438626438
-36353036623336653336663738636632326238326133663039633330656530376335343539646465
+39343436383732313561396236656530303064363961663636353538346264633532633866333162
-61663436626235306462336636393332313562646633373637396664636661333131663864393138
+35303032303662646166333537373566316462633536333463323433353539623363323036643763
-6161396237323233333961353231643236393232623635303465
+34376365613932303133366236613235636238643139666663356436326532616437383432303437
+39376535656266383465373837643634383937656431323265386163373138336164383666383962
+64623762613332363731323739666238613634646237396331666463363663313461313966356233
+30653362353061333739303234336461373337346632646433623462623765353330

flake.lock

@@ -1,12 +1,57 @@
 {
   "nodes": {
-    "flake-utils": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs"
+      },
       "locked": {
-        "lastModified": 1659877975,
+        "lastModified": 1696775529,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "narHash": "sha256-TYlE4B0ktPtlJJF9IFxTWrEeq+XKG8Ny0gc2FGEAdj0=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "daf42cb35b2dc614d1551e37f96406e4c4a2d3e4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1673295039,
+        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1685518550,
+        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
         "type": "github"
       },
       "original": {
@@ -15,13 +60,50 @@
         "type": "github"
       }
     },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1682203081,
+        "narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1663707275,
+        "lastModified": 1677676435,
-        "narHash": "sha256-xRIlf8OWJLPxeF5y8iToWx9M1P3pUhPuyXeXUrIjaf8=",
+        "narHash": "sha256-6FxdcmQr5JeZqsQvfinIMr0XcTyTuR7EXX0H3ANShpQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a08d6979dd7c82c4cef0dcc6ac45ab16051c1169",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1686259070,
+        "narHash": "sha256-bJ2TqJHMdU27o3+AlYzsDooUzneFHwvK5LaRv5JYit4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2f8b8bc98da3cbcf287df9cb4fae4857282fe60a",
+        "rev": "8a7d5c039cacc83bd1926aaabc04d541e04a1460",
         "type": "github"
       },
       "original": {
@@ -32,8 +114,24 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -5,17 +5,19 @@
     # lib
     nixpkgs.url = github:nixos/nixpkgs;
     flake-utils.url = github:numtide/flake-utils;
+    agenix.url = github:ryantm/agenix;
   };
 
-  outputs = { self, nixpkgs, flake-utils }: flake-utils.lib.eachDefaultSystem (system:
+  outputs = { self, nixpkgs, flake-utils, agenix }: flake-utils.lib.eachDefaultSystem (system:
     let
       pkgs = nixpkgs.legacyPackages.${system};
     in
       {
         devShells.default = pkgs.mkShell {
           buildInputs = [
-            pkgs.python3Packages.ansible
+            pkgs.ansible
-            pkgs.python3Packages.ansible-lint
+            pkgs.ansible-lint
+            agenix.packages.${system}.default
           ];
 
           shellHook = ''

nix/gilgamesh/README.md

@@ -0,0 +1,12 @@
+# `gilgamesh`
+
+> Old Thinkpad running a Minecraft server.
+
+## TODO
+
+- Figure out if there's some more powersaving options
+- Add some doc for initial setup
+    - Install NixOS according to the official guide
+    - Check out this repo, build this `configuration.nix`
+    - Afterwards: Just build it locally then deploy
+- Use Flakes, add doc for `./deploy.sh`

nix/gilgamesh/configuration.nix

@@ -0,0 +1,146 @@
+{ config, pkgs, lib, ... }:
+let
+  agenix = builtins.fetchTarball {
+    url = "https://github.com/ryantm/agenix/archive/daf42cb35b2dc614d1551e37f96406e4c4a2d3e4.tar.gz";
+    sha256 = "0gbn01hi8dh7s9rc66yawnmixcasadf20zci4ijzpd143ph492ad";
+  };
+in {
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      "${agenix}/modules/age.nix"
+      ../modules/spigot-server.nix
+      ../modules/ionos-dyndns.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  # boot.loader.grub.efiSupport = true;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda";
+
+  networking.hostName = "gilgamesh"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "de-latin1";
+  };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.paul = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMFqREiw3EareYXntIrm1/numKDo113zx1WMOFO69LJ paul"
+    ];
+    # packages = with pkgs; [];
+  };
+
+  # Users in group wheel may sudo without password
+  security.sudo.wheelNeedsPassword = false;
+
+  # Users in group wheel are special friends of the Nix daemon
+  nix.settings.trusted-users = [
+    "@wheel"
+  ];
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim
+    tmux
+    bottom
+    (pkgs.callPackage ../packages/ionos-dyndns.nix {})
+  ];
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
+  };
+
+  # Enable Avahi for mDNS (advertise hostname in LAN)
+  services.avahi = {
+    enable = true;
+    nssmdns = true;
+  };
+
+  services.spigot-server = {
+    enable = true;
+    user = "spigot";
+  };
+
+  # Secrets management
+  age.secrets = {
+    ionos-prefix = {
+      file = ../secrets/ionos-prefix.age;
+      owner = "ionos-dyndns";
+      group = "ionos-dyndns";
+    };
+    ionos-secret = {
+      file = ../secrets/ionos-secret.age;
+      owner = "ionos-dyndns";
+      group = "ionos-dyndns";
+    };
+  };
+
+  # DynDNS stuff. IONOS has a (proprietary?) API for this,
+  # so we're using a Python script from the interwebs :shrug:
+  services.ionos-dyndns = {
+    enable = true;
+    # Must match the user owning the secrets below. See agenix config
+    # above for more details.
+    user = "ionos-dyndns";
+    apiPrefixPath = config.age.secrets.ionos-prefix.path;
+    apiSecretPath = config.age.secrets.ionos-secret.path;
+    aaaa = true;
+    fqdn = "blocks.beany.club";
+    interface = "enp0s25";
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 25565 ];
+  networking.firewall.allowedUDPPorts = [ 25565 ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # TODO: Backups
+
+  # Practical hardware options
+  services.logind.lidSwitch = "ignore";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}
+

nix/gilgamesh/deploy.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+nixos-rebuild -I nixos-config=configuration.nix --target-host gilgamesh --use-remote-sudo switch

nix/gilgamesh/hardware-configuration.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s25.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nix/modules/ionos-dyndns.nix

@@ -0,0 +1,118 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.ionos-dyndns;
+  ionos-dyndns = pkgs.callPackage ../packages/ionos-dyndns.nix {};
+
+  command = lib.concatStringsSep " " (
+    [
+      "${ionos-dyndns}/bin/ionos-dyndns"
+      "--api-prefix"
+      "$(cat ${cfg.apiPrefixPath})"
+      "--api-secret"
+      "$(cat ${cfg.apiSecretPath})"
+      "--fqdn"
+      cfg.fqdn
+      "--interface"
+      cfg.interface
+    ]
+    ++ lib.optionals cfg.a [ "--A" ]
+    ++ lib.optionals cfg.aaaa [ "--AAAA" ]
+  );
+in {
+  options = {
+    services.ionos-dyndns = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to turn on the IONOS DynDNS timer.
+        '';
+      };
+      user = mkOption {
+        type = types.str;
+        default = "ionos-dyndns";
+      };
+      apiPrefixPath = mkOption {
+        type = types.path;
+        description = ''
+          Path of a file holding the API prefix.
+        '';
+      };
+      apiSecretPath = mkOption {
+        type = types.path;
+        description = ''
+          Path of a file holding the API secret.
+        '';
+      };
+      a = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to set the A record (IPv4).
+        '';
+      };
+      aaaa = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to set the AAAA record (IPv6).
+        '';
+      };
+      fqdn = mkOption {
+        type = types.str;
+        description = ''
+          Fully qualified domain name for this host.
+        '';
+      };
+      interface = mkOption {
+        type = types.str;
+        description = ''
+          Interface to get the IP address from.
+        '';
+      };
+      interval = mkOption {
+        type = types.str;
+        default = "14min";
+        description = "How often to run the update script in systemd.timers notation.";
+      };
+      serviceName = mkOption {
+        type = types.str;
+        default = "ionos-dyndns";
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    users = {
+      users = {
+        ${cfg.user} = {
+          isSystemUser = true;
+          group = cfg.user;
+          description = "IONOS DynDNS user.";
+        };
+      };
+      groups = {
+        ${cfg.user} = {
+        };
+      };
+    };
+    systemd = {
+      services.${cfg.serviceName} = {
+        serviceConfig = {
+          Type = "oneshot";
+          User = cfg.user;
+          # We assume that command doesn't contain any single quotes
+          ExecStart = "${pkgs.bash}/bin/bash -c '${command}'";
+        };
+      };
+      timers.${cfg.serviceName} = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          Unit = "${cfg.serviceName}.service";
+          OnBootSec = "30s";
+          OnActiveSec = cfg.interval;
+        };
+      };
+    };
+  };
+}

nix/modules/spigot-server.nix

@@ -0,0 +1,81 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  spigot-server = pkgs.callPackage ../packages/spigot-server.nix {};
+  cfg = config.services.spigot-server;
+  StateDirectory = "spigot-server";
+in {
+  options = {
+    services.spigot-server = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to turn on the Spigot Minecraft server.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "spigot-server";
+        description = ''
+          The user account and group that Spigot runs as.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users = {
+      ${cfg.user} = {
+        isSystemUser = true;
+        group = cfg.user;
+        description = "Spigot Minecraft server user";
+      };
+    };
+    users.groups = {
+      ${cfg.user} = {
+      };
+    };
+
+    systemd = {
+      services.spigot-server = {
+        description = "Spigot Minecraft server";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          User = "${cfg.user}";
+
+          Sockets = "spigot-server.socket";
+          StandardInput = "socket";
+          StandardOutput = "journal";
+          StandardError = "journal";
+
+          inherit StateDirectory;
+          WorkingDirectory = "/var/lib/${StateDirectory}";
+          ExecStart = "${spigot-server}/bin/spigot-server -nogui";
+          ExecStop = [
+            "${pkgs.bash}/bin/bash -c '${pkgs.coreutils}/bin/echo save-all > /run/spigot-server.stdin'"
+            "${pkgs.bash}/bin/bash -c '${pkgs.coreutils}/bin/echo stop > /run/spigot-server.stdin'"
+            # Wait for the main process to exit
+            # If we don't do this systemd tries to nudge Java to stop, causing a race condition
+            # that leads to an ungraceful shutdown
+            "${pkgs.coreutils}/bin/echo \"Waiting for \${MAINPID} to exit...\""
+            "${pkgs.bash}/bin/bash -c 'while ${pkgs.coreutils}/bin/kill -s 0 $MAINPID 2>/dev/null; do sleep 0.5; done'"
+          ];
+        };
+      };
+
+      sockets.spigot-server = {
+        description = "Spigot Minecraft server socket for commands and stuff";
+        unitConfig = {
+          # Automatically start and stop socket along with the service
+          PartOf = "spigot-server.service";
+        };
+        socketConfig = {
+          ListenFIFO = "/run/spigot-server.stdin";
+        };
+      };
+    };
+  };
+}

nix/packages/.gitignore

@@ -0,0 +1 @@
+spigot-1.20.1.jar

nix/packages/README.md

@@ -0,0 +1,11 @@
+# Packages
+
+## `spigot-server`
+
+In order to build `spigot-server.nix` you'll need a copy of the Spigot JAR.
+For licensing reasons I won't check it into Git.
+Just drop `spigot-${version}.jar` into this folder and change the `version = ` line in `spigot-server.nix` accordingly.
+
+## TODO
+
+- Make some more stuff in `spigot-server.nix` configurable

nix/packages/ionos-dyndns.nix

@@ -0,0 +1,37 @@
+{
+  fetchFromGitHub,
+  lib,
+  makeWrapper,
+  stdenv,
+  # Runtime Dependencies
+  python3,
+  # grep
+  gnugrep,
+  # ip
+  iproute2,
+  # hostname
+  hostname
+}:
+let
+  pythonWithDeps = python3.withPackages (p: [p.requests]);
+in stdenv.mkDerivation rec {
+  pname = "ionos-dyndns";
+  # Packaging time, not commit time
+  version = "20231118";
+  src = fetchFromGitHub {
+    owner = "lazaroblanc";
+    repo = "IONOS-DynDNS";
+    rev = "6c090ab928ce8d6eaa28b09614995b036ad60027";
+    hash = "sha256-rabDuKuPvzcMltnCSvc5kDjcDhv7sXxbDLWw3/hdSmk=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildCommand = ''
+    install -Dm755 $src/ionos_dyndns.py $out/lib/ionos_dyndns.py
+
+    makeWrapper ${pythonWithDeps}/bin/python3 $out/bin/ionos-dyndns \
+      --set PATH ${lib.makeBinPath [ iproute2 gnugrep hostname ]} \
+      --add-flags $out/lib/ionos_dyndns.py
+  '';
+}

nix/packages/spigot-server.nix

@@ -0,0 +1,26 @@
+{
+  makeWrapper,
+  stdenv,
+  # Runtime Dependencies
+  jre
+}:
+let
+  # Copied from some forum thread without much thought.
+  # Let's see if they work out.
+  javaFlags = "-Xmx5G -XX:+UseG1GC -XX:+UnlockExperimentalVMOptions -XX:MaxGCPauseMillis=50 -XX:+DisableExplicitGC -XX:TargetSurvivorRatio=90 -XX:G1NewSizePercent=50 -XX:G1MaxNewSizePercent=80 -XX:InitiatingHeapOccupancyPercent=10 -XX:G1MixedGCLiveThresholdPercent=50";
+in stdenv.mkDerivation rec {
+  pname = "spigot-server";
+  version = "1.20.1";
+  src = ./spigot-${version}.jar;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildCommand = ''
+    install -Dm644 $src $out/lib/spigot-${version}.jar
+
+    makeWrapper ${jre}/bin/java $out/bin/spigot-server \
+      --argv0 spigot-server \
+      --add-flags "${javaFlags}" \
+      --add-flags "-jar $out/lib/spigot-${version}.jar"
+  '';
+}

nix/secrets/README.md

@@ -0,0 +1,11 @@
+# secrets
+
+> Nix configuration secrets managed with [agenix](https://github.com/ryantm/agenix#tutorial).
+
+Use `nix develop` in the repository root to drop into a shell with `agenix`.
+
+## Editing files
+
+```
+agenix -e <thingamajig.age>
+```

nix/secrets/ionos-prefix.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 9V3MUQ 7+lohnPlQALVPEGo2LwS2fj5r2RCKaVeEFmi6EYEyCE
+9U6eAthRVd5ry0ej79FEy3oRG3okJTwY6zSN1u68H1o
+-> ssh-ed25519 CcM6/g QQX9SsgKkk8YdUPRKj9Tda8mf6qRJ7ywtP6IIpN9fxo
+3Ml2+1+AQMwr5Lnv84pYOee/s5mzfVdsHRLaUIAKNFk
+-> i)!b3gaJ-grease 7|bwS ?k2JgF E-G 2HI
+0mFbZ22lqvLd
+--- 0+CwYGJlJC7bRbokHSlv+V4JKppBo+/ocfjp2NQBD3Q
+JDv�8ě ë�¶ÚŤÄ÷8é V/Ă'O”M¸x
×é!ȸTÉA7ÍK5#É8©&•Ř-VqČ&}ů]ráÂ

nix/secrets/secrets.nix

@@ -0,0 +1,10 @@
+let
+  # Users
+  paul = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMFqREiw3EareYXntIrm1/numKDo113zx1WMOFO69LJ";
+
+  # Systems
+  gilgamesh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDmLWYK6/4/Fh+wsoiz9+PCHvNcP2/wu2GvfzrqXCGA";
+in {
+  "ionos-prefix.age".publicKeys = [ paul gilgamesh ];
+  "ionos-secret.age".publicKeys = [ paul gilgamesh ];
+}