Compare commits
16
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 paul
|
03c7277692 | ||
|
paul
|
de16857570 | ||
|
paul
|
f2f12a2688 | ||
|
paul
|
e61a07f8d3 | ||
|
paul
|
ea38d94178 | ||
|
paul
|
81771725d0 | ||
|
paul
|
06345cd04c | ||
|
paul
|
9b622e6e3e | ||
|
paul
|
8e0c6266af | ||
|
paul
|
11049a04d8 | ||
|
paul
|
483ea954b2 | ||
|
paul
|
8fa1f674f9 | ||
|
paul
|
2006b9733e | ||
|
paul
|
0af355843d | ||
|
paul
|
1b2227af24 | ||
|
paul
|
85f2e87040 |
-36
@@ -1,36 +0,0 @@
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Static Verification
|
||||
steps:
|
||||
- name: ansible-lint
|
||||
image: python:3.10.6
|
||||
commands:
|
||||
# Make sure to update the ansible version below as well
|
||||
- pip --disable-pip-version-check install ansible==7.2.0 ansible-lint==6.16.1 > /dev/null 2> /dev/null
|
||||
- ansible-lint -c .ansible-lint ansible
|
||||
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Check
|
||||
steps:
|
||||
- name: ansible-playbook --check
|
||||
image: python:3.10.6
|
||||
environment:
|
||||
SSH_KEY:
|
||||
from_secret: ssh_key
|
||||
VAULT_PASSWORD:
|
||||
from_secret: vault_password
|
||||
commands:
|
||||
- pip install ansible==7.2.0 > /dev/null 2> /dev/null
|
||||
|
||||
- mkdir "$HOME/.ssh"
|
||||
- echo "$SSH_KEY" > "$HOME/.ssh/id"
|
||||
- chmod 0600 ~/.ssh/id
|
||||
- ssh-keyscan -p 2309 vmd98928.contaboserver.net > "$HOME/.ssh/known_hosts"
|
||||
|
||||
- echo "$VAULT_PASSWORD" > "$HOME/vault_password"
|
||||
|
||||
- cd ansible
|
||||
- ansible-playbook --private-key "$HOME/.ssh/id" --vault-password-file "$HOME/vault_password" --check playbooks/misc-all.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Check
|
||||
on: [push]
|
||||
jobs:
|
||||
"Lint Ansible Files":
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- run: apt-get update
|
||||
- run: apt-get install -y python3 python3-pip python3-venv
|
||||
- run: python3 --version
|
||||
- name: Check out repo
|
||||
uses: actions/checkout@v3
|
||||
- run: python3 -m venv venv
|
||||
- run: venv/bin/pip --disable-pip-version-check install ansible==7.2.0 ansible-lint==6.16.1 > /dev/null 2> /dev/null
|
||||
- run: venv/bin/ansible-lint -c .ansible-lint ansible
|
||||
# TODO: Reimplement ansible-play --check step from old drone config
|
||||
@@ -14,3 +14,5 @@
|
||||
- [x] Make Gitea display graphs in Notebooks (see https://docs.gitea.io/en-us/external-renderers/).
|
||||
- [x] Factorio server
|
||||
- [ ] Add flag for Gitea backups (after which Gitea will be up but no contain the sites source code)
|
||||
- [x] Add Gitea actions
|
||||
- [ ] Remove drone
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
{
|
||||
admin off
|
||||
}
|
||||
|
||||
pbrinkmeier.de {
|
||||
file_server {
|
||||
root /srv/pbrinkmeier.de
|
||||
|
||||
@@ -12,7 +12,7 @@ services:
|
||||
DRONE_SERVER_PROTO: https
|
||||
volumes:
|
||||
- /var/lib/pbri/docker/drone:/data
|
||||
restart: always
|
||||
restart: unless-stopped
|
||||
|
||||
drone_runner:
|
||||
image: drone/drone-runner-docker:1
|
||||
@@ -24,7 +24,7 @@ services:
|
||||
DRONE_RUNNER_NAME: shamash
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
restart: always
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
default:
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
FROM gitea/gitea:1.20
|
||||
FROM gitea/act_runner:0.2.5
|
||||
|
||||
RUN apk --no-cache add gcc python3-dev py3-pip linux-headers musl-dev libffi-dev
|
||||
RUN pip3 install --upgrade pip
|
||||
RUN pip3 install jupyter
|
||||
COPY runner-config.yaml /opt/runner-config.yaml
|
||||
|
||||
@@ -1,6 +1,17 @@
|
||||
# gitea
|
||||
|
||||
Add a `.env` file like this:
|
||||
|
||||
```
|
||||
GITEA_DB_PASSWORD=...
|
||||
GITEA_SMTP_PASSWORD=...
|
||||
GITEA_RUNNER_REGISTRATION_TOKEN=...
|
||||
```
|
||||
|
||||
You should keep an eye on `GITEA_RUNNER_REGISTRATION_TOKEN`. I suspect
|
||||
it might change over time, e.g. when restarting or updating Gitea.
|
||||
|
||||
## Files
|
||||
|
||||
- `runner-config.yaml`: Configuration for `gitea/act_runner`. Generated using `act_runner generate-config` then adjusted
|
||||
- `Dockerfile`: Creates an image based on `gitea/act_runner` that comes with `runner-config.yaml` in `/opt` (to avoid the extra mount)
|
||||
|
||||
@@ -2,9 +2,8 @@ version: "3"
|
||||
|
||||
services:
|
||||
gitea:
|
||||
image: pbrinkmeier/gitea
|
||||
build: .
|
||||
restart: always
|
||||
image: gitea/gitea:1.20.3
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
# Ref: https://docs.gitea.io/en-us/config-cheat-sheet
|
||||
# User is created by misc-docker.yaml
|
||||
@@ -36,17 +35,17 @@ services:
|
||||
GITEA__service__DEFAULT_ENABLE_TIMETRACKING: "false"
|
||||
GITEA__service__DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME: "false"
|
||||
GITEA__mailer__ENABLED: "true"
|
||||
GITEA__mailer__HOST: smtp.mailbox.org:465
|
||||
GITEA__mailer__PROTOCOL: smtps
|
||||
GITEA__mailer__SMTP_ADDR: smtp.mailbox.org
|
||||
GITEA__mailer__SMTP_HOST: 465
|
||||
GITEA__mailer__FROM: git@pbrinkmeier.de
|
||||
GITEA__mailer__USER: hallo@pbrinkmeier.de
|
||||
GITEA__mailer__PASSWD: "${GITEA_SMTP_PASSWORD}"
|
||||
GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
|
||||
GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
|
||||
GITEA__markup_0x2E_jupyter__ENABLED: "true"
|
||||
GITEA__markup_0x2E_jupyter__FILE_EXTENSIONS: ".ipynb"
|
||||
GITEA__markup_0x2E_jupyter__RENDER_COMMAND: "jupyter nbconvert --stdin --stdout --to html --template basic"
|
||||
GITEA__markup_0x2E_jupyter__IS_INPUT_FILE: "false"
|
||||
GITEA__markup_0x2E_sanitizer_0x2E_jupyter_0x2E_img__ALLOW_DATA_URI_IMAGES: "true"
|
||||
# Enable Gitea actions
|
||||
# Ref: https://docs.gitea.com/usage/actions/quickstart
|
||||
GITEA__actions__ENABLED: "true"
|
||||
volumes:
|
||||
- /var/lib/pbri/docker/gitea:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
@@ -58,7 +57,7 @@ services:
|
||||
|
||||
gitea_db:
|
||||
image: postgres:14.5-alpine
|
||||
restart: always
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_DB: gitea
|
||||
POSTGRES_USER: gitea
|
||||
@@ -66,6 +65,21 @@ services:
|
||||
volumes:
|
||||
- /var/lib/pbri/docker/gitea_db:/var/lib/postgresql/data
|
||||
|
||||
gitea_runner:
|
||||
image: pbrinkmeier/act_runner:0.2.5
|
||||
build: .
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
CONFIG_FILE: /opt/runner-config.yaml
|
||||
GITEA_INSTANCE_URL: "https://git.pbrinkmeier.de"
|
||||
GITEA_RUNNER_REGISTRATION_TOKEN: "${GITEA_RUNNER_REGISTRATION_TOKEN}"
|
||||
GITEA_RUNNER_NAME: "basic-bitchboy"
|
||||
volumes:
|
||||
- /var/lib/pbri/docker/gitea_runner_data:/data
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
depends_on:
|
||||
- gitea
|
||||
|
||||
networks:
|
||||
default:
|
||||
name: caddy-network
|
||||
|
||||
@@ -0,0 +1,85 @@
|
||||
log:
|
||||
# The level of logging, can be trace, debug, info, warn, error, fatal
|
||||
level: info
|
||||
|
||||
runner:
|
||||
# Where to store the registration result.
|
||||
file: .runner
|
||||
# Execute how many tasks concurrently at the same time.
|
||||
capacity: 1
|
||||
# Extra environment variables to run jobs.
|
||||
# envs:
|
||||
# A_TEST_ENV_NAME_1: a_test_env_value_1
|
||||
# A_TEST_ENV_NAME_2: a_test_env_value_2
|
||||
# Extra environment variables to run jobs from a file.
|
||||
# It will be ignored if it's empty or the file doesn't exist.
|
||||
# env_file: .env
|
||||
# The timeout for a job to be finished.
|
||||
# Please note that the Gitea instance also has a timeout (3h by default) for the job.
|
||||
# So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
|
||||
timeout: 3h
|
||||
# Whether skip verifying the TLS certificate of the Gitea instance.
|
||||
insecure: false
|
||||
# The timeout for fetching the job from the Gitea instance.
|
||||
fetch_timeout: 5s
|
||||
# The interval for fetching the job from the Gitea instance.
|
||||
fetch_interval: 2s
|
||||
# The labels of a runner are used to determine which jobs the runner can run, and how to run them.
|
||||
# Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
|
||||
# If it's empty when registering, it will ask for inputting labels.
|
||||
# If it's empty when execute `deamon`, will use labels in `.runner` file.
|
||||
# Some (most?) GitHub actions use node for scripting, so just using
|
||||
# ubuntu:22.04 here is not enough.
|
||||
labels:
|
||||
- "ubuntu-22.04:docker://node:16-bullseye"
|
||||
|
||||
cache:
|
||||
# Enable cache server to use actions/cache.
|
||||
enabled: false
|
||||
# The directory to store the cache data.
|
||||
# If it's empty, the cache data will be stored in $HOME/.cache/actcache.
|
||||
dir: ""
|
||||
# The host of the cache server.
|
||||
# It's not for the address to listen, but the address to connect from job containers.
|
||||
# So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
|
||||
host: ""
|
||||
# The port of the cache server.
|
||||
# 0 means to use a random available port.
|
||||
port: 0
|
||||
# The external cache server URL. Valid only when enable is true.
|
||||
# If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
|
||||
# The URL should generally end with "/".
|
||||
external_server: ""
|
||||
|
||||
container:
|
||||
# Specifies the network to which the container will connect.
|
||||
# Could be host, bridge or the name of a custom network.
|
||||
# If it's empty, act_runner will create a network automatically.
|
||||
network: ""
|
||||
# Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
|
||||
privileged: false
|
||||
# And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
|
||||
options:
|
||||
# The parent directory of a job's working directory.
|
||||
# If it's empty, /workspace will be used.
|
||||
workdir_parent:
|
||||
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
|
||||
# You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
|
||||
# For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
|
||||
# valid_volumes:
|
||||
# - data
|
||||
# - /src/*.json
|
||||
# If you want to allow any volume, please use the following configuration:
|
||||
# valid_volumes:
|
||||
# - '**'
|
||||
valid_volumes: []
|
||||
# overrides the docker client host with the specified one.
|
||||
# If it's empty, act_runner will find an available docker host automatically.
|
||||
# If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
|
||||
# If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
|
||||
docker_host: ""
|
||||
|
||||
host:
|
||||
# The parent directory of a job's working directory.
|
||||
# If it's empty, $HOME/.cache/act/ will be used.
|
||||
workdir_parent:
|
||||
+13
-10
@@ -1,11 +1,14 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
32303131323835666635366533363238303766643063633934353139323837396336373734393263
|
||||
6334616639373630616437646437626666343161373338310a323234313330323839663165653038
|
||||
66386266373562363966643666653234656337373166626131383565313334333234373532633133
|
||||
6265656232613337380a393531323765373332613162346365373831373733623166363136326239
|
||||
66386262393836343634353061363131313936666665343634326430393939633336656666626530
|
||||
32633762306136356464386262633132646633373066316434343437356636313831313462366533
|
||||
37343864636265666166613761386639316534386365343439623634373039383237353839656130
|
||||
36353036623336653336663738636632326238326133663039633330656530376335343539646465
|
||||
61663436626235306462336636393332313562646633373637396664636661333131663864393138
|
||||
6161396237323233333961353231643236393232623635303465
|
||||
35623364633833623964623536646534373634663736613561333561343136333965306638396532
|
||||
6162393239383936386338666565306132646230383066630a336337613636383431623738343663
|
||||
61343262363631376665383035323139313863626331666439336134613035663439376231343863
|
||||
3032353139643138640a383365356630323835383538393734643134343133653033383663333464
|
||||
62386361633435633664306531623835353665326432393932336163316561653866343137323030
|
||||
63643262323436356166373533363235366238393633336631336266373837373932313134303563
|
||||
65633337393938623134636538653561356565333831356638373862376333336163363438626438
|
||||
39343436383732313561396236656530303064363961663636353538346264633532633866333162
|
||||
35303032303662646166333537373566316462633536333463323433353539623363323036643763
|
||||
34376365613932303133366236613235636238643139666663356436326532616437383432303437
|
||||
39376535656266383465373837643634383937656431323265386163373138336164383666383962
|
||||
64623762613332363731323739666238613634646237396331666463363663313461313966356233
|
||||
30653362353061333739303234336461373337346632646433623462623765353330
|
||||
|
||||
Generated
+81
-1
@@ -1,5 +1,47 @@
|
||||
{
|
||||
"nodes": {
|
||||
"agenix": {
|
||||
"inputs": {
|
||||
"darwin": "darwin",
|
||||
"home-manager": "home-manager",
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1696775529,
|
||||
"narHash": "sha256-TYlE4B0ktPtlJJF9IFxTWrEeq+XKG8Ny0gc2FGEAdj0=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "daf42cb35b2dc614d1551e37f96406e4c4a2d3e4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1673295039,
|
||||
"narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lnl7",
|
||||
"ref": "master",
|
||||
"repo": "nix-darwin",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
@@ -18,7 +60,44 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1682203081,
|
||||
"narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1677676435,
|
||||
"narHash": "sha256-6FxdcmQr5JeZqsQvfinIMr0XcTyTuR7EXX0H3ANShpQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a08d6979dd7c82c4cef0dcc6ac45ab16051c1169",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1686259070,
|
||||
"narHash": "sha256-bJ2TqJHMdU27o3+AlYzsDooUzneFHwvK5LaRv5JYit4=",
|
||||
@@ -35,8 +114,9 @@
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
|
||||
@@ -5,9 +5,10 @@
|
||||
# lib
|
||||
nixpkgs.url = github:nixos/nixpkgs;
|
||||
flake-utils.url = github:numtide/flake-utils;
|
||||
agenix.url = github:ryantm/agenix;
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, flake-utils }: flake-utils.lib.eachDefaultSystem (system:
|
||||
outputs = { self, nixpkgs, flake-utils, agenix }: flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in
|
||||
@@ -16,6 +17,7 @@
|
||||
buildInputs = [
|
||||
pkgs.ansible
|
||||
pkgs.ansible-lint
|
||||
agenix.packages.${system}.default
|
||||
];
|
||||
|
||||
shellHook = ''
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
# `gilgamesh`
|
||||
|
||||
> Old Thinkpad running a Minecraft server.
|
||||
|
||||
## TODO
|
||||
|
||||
- Figure out if there's some more powersaving options
|
||||
- Add some doc for initial setup
|
||||
- Install NixOS according to the official guide
|
||||
- Check out this repo, build this `configuration.nix`
|
||||
- Afterwards: Just build it locally then deploy
|
||||
- Use Flakes, add doc for `./deploy.sh`
|
||||
@@ -0,0 +1,146 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
agenix = builtins.fetchTarball {
|
||||
url = "https://github.com/ryantm/agenix/archive/daf42cb35b2dc614d1551e37f96406e4c4a2d3e4.tar.gz";
|
||||
sha256 = "0gbn01hi8dh7s9rc66yawnmixcasadf20zci4ijzpd143ph492ad";
|
||||
};
|
||||
in {
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
"${agenix}/modules/age.nix"
|
||||
../modules/spigot-server.nix
|
||||
../modules/ionos-dyndns.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
# boot.loader.grub.efiSupport = true;
|
||||
# boot.loader.grub.efiInstallAsRemovable = true;
|
||||
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
# Define on which hard drive you want to install Grub.
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
networking.hostName = "gilgamesh"; # Define your hostname.
|
||||
# Pick only one of the below networking options.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
# networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "de-latin1";
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.paul = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMFqREiw3EareYXntIrm1/numKDo113zx1WMOFO69LJ paul"
|
||||
];
|
||||
# packages = with pkgs; [];
|
||||
};
|
||||
|
||||
# Users in group wheel may sudo without password
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Users in group wheel are special friends of the Nix daemon
|
||||
nix.settings.trusted-users = [
|
||||
"@wheel"
|
||||
];
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
tmux
|
||||
bottom
|
||||
(pkgs.callPackage ../packages/ionos-dyndns.nix {})
|
||||
];
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
};
|
||||
};
|
||||
|
||||
# Enable Avahi for mDNS (advertise hostname in LAN)
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns = true;
|
||||
};
|
||||
|
||||
services.spigot-server = {
|
||||
enable = true;
|
||||
user = "spigot";
|
||||
};
|
||||
|
||||
# Secrets management
|
||||
age.secrets = {
|
||||
ionos-prefix = {
|
||||
file = ../secrets/ionos-prefix.age;
|
||||
owner = "ionos-dyndns";
|
||||
group = "ionos-dyndns";
|
||||
};
|
||||
ionos-secret = {
|
||||
file = ../secrets/ionos-secret.age;
|
||||
owner = "ionos-dyndns";
|
||||
group = "ionos-dyndns";
|
||||
};
|
||||
};
|
||||
|
||||
# DynDNS stuff. IONOS has a (proprietary?) API for this,
|
||||
# so we're using a Python script from the interwebs :shrug:
|
||||
services.ionos-dyndns = {
|
||||
enable = true;
|
||||
# Must match the user owning the secrets below. See agenix config
|
||||
# above for more details.
|
||||
user = "ionos-dyndns";
|
||||
apiPrefixPath = config.age.secrets.ionos-prefix.path;
|
||||
apiSecretPath = config.age.secrets.ionos-secret.path;
|
||||
aaaa = true;
|
||||
fqdn = "blocks.beany.club";
|
||||
interface = "enp0s25";
|
||||
};
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [ 25565 ];
|
||||
networking.firewall.allowedUDPPorts = [ 25565 ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# TODO: Backups
|
||||
|
||||
# Practical hardware options
|
||||
services.logind.lidSwitch = "ignore";
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It's perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
Executable
+3
@@ -0,0 +1,3 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
nixos-rebuild -I nixos-config=configuration.nix --target-host gilgamesh --use-remote-sudo switch
|
||||
@@ -0,0 +1,33 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s25.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,118 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.ionos-dyndns;
|
||||
ionos-dyndns = pkgs.callPackage ../packages/ionos-dyndns.nix {};
|
||||
|
||||
command = lib.concatStringsSep " " (
|
||||
[
|
||||
"${ionos-dyndns}/bin/ionos-dyndns"
|
||||
"--api-prefix"
|
||||
"$(cat ${cfg.apiPrefixPath})"
|
||||
"--api-secret"
|
||||
"$(cat ${cfg.apiSecretPath})"
|
||||
"--fqdn"
|
||||
cfg.fqdn
|
||||
"--interface"
|
||||
cfg.interface
|
||||
]
|
||||
++ lib.optionals cfg.a [ "--A" ]
|
||||
++ lib.optionals cfg.aaaa [ "--AAAA" ]
|
||||
);
|
||||
in {
|
||||
options = {
|
||||
services.ionos-dyndns = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to turn on the IONOS DynDNS timer.
|
||||
'';
|
||||
};
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "ionos-dyndns";
|
||||
};
|
||||
apiPrefixPath = mkOption {
|
||||
type = types.path;
|
||||
description = ''
|
||||
Path of a file holding the API prefix.
|
||||
'';
|
||||
};
|
||||
apiSecretPath = mkOption {
|
||||
type = types.path;
|
||||
description = ''
|
||||
Path of a file holding the API secret.
|
||||
'';
|
||||
};
|
||||
a = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to set the A record (IPv4).
|
||||
'';
|
||||
};
|
||||
aaaa = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to set the AAAA record (IPv6).
|
||||
'';
|
||||
};
|
||||
fqdn = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
Fully qualified domain name for this host.
|
||||
'';
|
||||
};
|
||||
interface = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
Interface to get the IP address from.
|
||||
'';
|
||||
};
|
||||
interval = mkOption {
|
||||
type = types.str;
|
||||
default = "14min";
|
||||
description = "How often to run the update script in systemd.timers notation.";
|
||||
};
|
||||
serviceName = mkOption {
|
||||
type = types.str;
|
||||
default = "ionos-dyndns";
|
||||
};
|
||||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
users = {
|
||||
users = {
|
||||
${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.user;
|
||||
description = "IONOS DynDNS user.";
|
||||
};
|
||||
};
|
||||
groups = {
|
||||
${cfg.user} = {
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd = {
|
||||
services.${cfg.serviceName} = {
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
# We assume that command doesn't contain any single quotes
|
||||
ExecStart = "${pkgs.bash}/bin/bash -c '${command}'";
|
||||
};
|
||||
};
|
||||
timers.${cfg.serviceName} = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
Unit = "${cfg.serviceName}.service";
|
||||
OnBootSec = "30s";
|
||||
OnActiveSec = cfg.interval;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
let
|
||||
spigot-server = pkgs.callPackage ../packages/spigot-server.nix {};
|
||||
cfg = config.services.spigot-server;
|
||||
StateDirectory = "spigot-server";
|
||||
in {
|
||||
options = {
|
||||
services.spigot-server = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to turn on the Spigot Minecraft server.
|
||||
'';
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "spigot-server";
|
||||
description = ''
|
||||
The user account and group that Spigot runs as.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users.users = {
|
||||
${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.user;
|
||||
description = "Spigot Minecraft server user";
|
||||
};
|
||||
};
|
||||
users.groups = {
|
||||
${cfg.user} = {
|
||||
};
|
||||
};
|
||||
|
||||
systemd = {
|
||||
services.spigot-server = {
|
||||
description = "Spigot Minecraft server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
User = "${cfg.user}";
|
||||
|
||||
Sockets = "spigot-server.socket";
|
||||
StandardInput = "socket";
|
||||
StandardOutput = "journal";
|
||||
StandardError = "journal";
|
||||
|
||||
inherit StateDirectory;
|
||||
WorkingDirectory = "/var/lib/${StateDirectory}";
|
||||
ExecStart = "${spigot-server}/bin/spigot-server -nogui";
|
||||
ExecStop = [
|
||||
"${pkgs.bash}/bin/bash -c '${pkgs.coreutils}/bin/echo save-all > /run/spigot-server.stdin'"
|
||||
"${pkgs.bash}/bin/bash -c '${pkgs.coreutils}/bin/echo stop > /run/spigot-server.stdin'"
|
||||
# Wait for the main process to exit
|
||||
# If we don't do this systemd tries to nudge Java to stop, causing a race condition
|
||||
# that leads to an ungraceful shutdown
|
||||
"${pkgs.coreutils}/bin/echo \"Waiting for \${MAINPID} to exit...\""
|
||||
"${pkgs.bash}/bin/bash -c 'while ${pkgs.coreutils}/bin/kill -s 0 $MAINPID 2>/dev/null; do sleep 0.5; done'"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
sockets.spigot-server = {
|
||||
description = "Spigot Minecraft server socket for commands and stuff";
|
||||
unitConfig = {
|
||||
# Automatically start and stop socket along with the service
|
||||
PartOf = "spigot-server.service";
|
||||
};
|
||||
socketConfig = {
|
||||
ListenFIFO = "/run/spigot-server.stdin";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
spigot-1.20.1.jar
|
||||
@@ -0,0 +1,11 @@
|
||||
# Packages
|
||||
|
||||
## `spigot-server`
|
||||
|
||||
In order to build `spigot-server.nix` you'll need a copy of the Spigot JAR.
|
||||
For licensing reasons I won't check it into Git.
|
||||
Just drop `spigot-${version}.jar` into this folder and change the `version = ` line in `spigot-server.nix` accordingly.
|
||||
|
||||
## TODO
|
||||
|
||||
- Make some more stuff in `spigot-server.nix` configurable
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
fetchFromGitHub,
|
||||
lib,
|
||||
makeWrapper,
|
||||
stdenv,
|
||||
# Runtime Dependencies
|
||||
python3,
|
||||
# grep
|
||||
gnugrep,
|
||||
# ip
|
||||
iproute2,
|
||||
# hostname
|
||||
hostname
|
||||
}:
|
||||
let
|
||||
pythonWithDeps = python3.withPackages (p: [p.requests]);
|
||||
in stdenv.mkDerivation rec {
|
||||
pname = "ionos-dyndns";
|
||||
# Packaging time, not commit time
|
||||
version = "20231118";
|
||||
src = fetchFromGitHub {
|
||||
owner = "lazaroblanc";
|
||||
repo = "IONOS-DynDNS";
|
||||
rev = "6c090ab928ce8d6eaa28b09614995b036ad60027";
|
||||
hash = "sha256-rabDuKuPvzcMltnCSvc5kDjcDhv7sXxbDLWw3/hdSmk=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
buildCommand = ''
|
||||
install -Dm755 $src/ionos_dyndns.py $out/lib/ionos_dyndns.py
|
||||
|
||||
makeWrapper ${pythonWithDeps}/bin/python3 $out/bin/ionos-dyndns \
|
||||
--set PATH ${lib.makeBinPath [ iproute2 gnugrep hostname ]} \
|
||||
--add-flags $out/lib/ionos_dyndns.py
|
||||
'';
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
makeWrapper,
|
||||
stdenv,
|
||||
# Runtime Dependencies
|
||||
jre
|
||||
}:
|
||||
let
|
||||
# Copied from some forum thread without much thought.
|
||||
# Let's see if they work out.
|
||||
javaFlags = "-Xmx5G -XX:+UseG1GC -XX:+UnlockExperimentalVMOptions -XX:MaxGCPauseMillis=50 -XX:+DisableExplicitGC -XX:TargetSurvivorRatio=90 -XX:G1NewSizePercent=50 -XX:G1MaxNewSizePercent=80 -XX:InitiatingHeapOccupancyPercent=10 -XX:G1MixedGCLiveThresholdPercent=50";
|
||||
in stdenv.mkDerivation rec {
|
||||
pname = "spigot-server";
|
||||
version = "1.20.1";
|
||||
src = ./spigot-${version}.jar;
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
buildCommand = ''
|
||||
install -Dm644 $src $out/lib/spigot-${version}.jar
|
||||
|
||||
makeWrapper ${jre}/bin/java $out/bin/spigot-server \
|
||||
--argv0 spigot-server \
|
||||
--add-flags "${javaFlags}" \
|
||||
--add-flags "-jar $out/lib/spigot-${version}.jar"
|
||||
'';
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
# secrets
|
||||
|
||||
> Nix configuration secrets managed with [agenix](https://github.com/ryantm/agenix#tutorial).
|
||||
|
||||
Use `nix develop` in the repository root to drop into a shell with `agenix`.
|
||||
|
||||
## Editing files
|
||||
|
||||
```
|
||||
agenix -e <thingamajig.age>
|
||||
```
|
||||
@@ -0,0 +1,9 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 9V3MUQ 7+lohnPlQALVPEGo2LwS2fj5r2RCKaVeEFmi6EYEyCE
|
||||
9U6eAthRVd5ry0ej79FEy3oRG3okJTwY6zSN1u68H1o
|
||||
-> ssh-ed25519 CcM6/g QQX9SsgKkk8YdUPRKj9Tda8mf6qRJ7ywtP6IIpN9fxo
|
||||
3Ml2+1+AQMwr5Lnv84pYOee/s5mzfVdsHRLaUIAKNFk
|
||||
-> i)!b3gaJ-grease 7|bwS ?k2JgF E-G 2HI
|
||||
0mFbZ22lqvLd
|
||||
--- 0+CwYGJlJC7bRbokHSlv+V4JKppBo+/ocfjp2NQBD3Q
|
||||
JDv� 8ě ë�¶ÚŤÄ÷8é V/Ă'O”M ¸x×é!ȸTÉA7ÍK5#É8©&•Ř-VqČ&}ů]ráÂ
|
||||
Binary file not shown.
@@ -0,0 +1,10 @@
|
||||
let
|
||||
# Users
|
||||
paul = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMFqREiw3EareYXntIrm1/numKDo113zx1WMOFO69LJ";
|
||||
|
||||
# Systems
|
||||
gilgamesh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDmLWYK6/4/Fh+wsoiz9+PCHvNcP2/wu2GvfzrqXCGA";
|
||||
in {
|
||||
"ionos-prefix.age".publicKeys = [ paul gilgamesh ];
|
||||
"ionos-secret.age".publicKeys = [ paul gilgamesh ];
|
||||
}
|
||||
Reference in New Issue
Block a user