Sif config, remote website build, agenix for secrets
This commit is contained in:
parent
16d45d2bc2
commit
db168ad3a4
9 changed files with 170 additions and 6 deletions
|
|
@ -1,7 +1,9 @@
|
|||
# Holds common settings for *all* systems, including both servers and
|
||||
# clients.
|
||||
|
||||
{ pkgs, oxalica, ... }: {
|
||||
{ pkgs, oxalica, agenix, ... }: {
|
||||
|
||||
imports = [ agenix.nixosModule ];
|
||||
|
||||
nix = {
|
||||
optimise.automatic = true;
|
||||
|
|
@ -24,6 +26,8 @@
|
|||
];
|
||||
};
|
||||
|
||||
age.secrets."website-secret".file = ./secrets/website-secret.age;
|
||||
|
||||
boot.cleanTmpDir = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
|
|
|
|||
45
flake.lock
45
flake.lock
|
|
@ -1,5 +1,23 @@
|
|||
{
|
||||
"nodes": {
|
||||
"agenix": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1652712410,
|
||||
"narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"locked": {
|
||||
"lastModified": 1637014545,
|
||||
|
|
@ -17,7 +35,7 @@
|
|||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1653153149,
|
||||
|
|
@ -34,6 +52,22 @@
|
|||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1638587357,
|
||||
"narHash": "sha256-2ySMW3QARG8BsRPmwe7clTbdCuaObromOKewykP+UJc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e34c5379866833f41e2a36f309912fa675d687c7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-21.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1653117584,
|
||||
"narHash": "sha256-5uUrHeHBIaySBTrRExcCoW8fBBYVSDjDYDU5A6iOl+k=",
|
||||
|
|
@ -47,7 +81,7 @@
|
|||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1653060744,
|
||||
"narHash": "sha256-kfRusllRumpt33J1hPV+CeCCylCXEU7e0gn2/cIM7cY=",
|
||||
|
|
@ -63,7 +97,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1637453606,
|
||||
"narHash": "sha256-Gy6cwUswft9xqsjWxFYEnx/63/qzaFUwatcbV5GF/GQ=",
|
||||
|
|
@ -82,7 +116,7 @@
|
|||
"oxalica": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1653273659,
|
||||
|
|
@ -100,8 +134,9 @@
|
|||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"home-manager": "home-manager",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"oxalica": "oxalica"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,6 +17,11 @@
|
|||
url = github:oxalica/rust-overlay;
|
||||
};
|
||||
|
||||
# For managing secrets
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
outputs = args: with args.nixpkgs; {
|
||||
|
|
|
|||
3
machines/sif/README.md
Normal file
3
machines/sif/README.md
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
# Sif
|
||||
|
||||
Sif is the server that hosts my website. It's a Raspberry Pi 3.
|
||||
|
|
@ -3,7 +3,15 @@
|
|||
{
|
||||
|
||||
imports = [
|
||||
|
||||
../../modules
|
||||
|
||||
# Reverse proxy
|
||||
./nginx.nix
|
||||
|
||||
# Website
|
||||
./website.nix
|
||||
|
||||
];
|
||||
|
||||
networking.hostName = "sif";
|
||||
|
|
@ -13,6 +21,8 @@
|
|||
generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
|
||||
documentation.enable = false;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
vim
|
||||
|
|
@ -33,6 +43,8 @@
|
|||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
fileSystems."/" = {
|
||||
|
|
@ -40,4 +52,30 @@
|
|||
fsType = "ext4";
|
||||
};
|
||||
|
||||
nix = {
|
||||
distributedBuilds = true;
|
||||
buildMachines = [{
|
||||
hostName = "thor";
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
];
|
||||
supportedFeatures = [
|
||||
"nixos-test"
|
||||
"benchmark"
|
||||
"big-parallel"
|
||||
"kvm"
|
||||
];
|
||||
}];
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = ''
|
||||
Host thor
|
||||
HostName thor
|
||||
Port 22
|
||||
User riley
|
||||
IdentitiesOnly yes
|
||||
IdentityFile /root/.ssh/id_ed25519
|
||||
'';
|
||||
|
||||
}
|
||||
|
|
|
|||
42
machines/sif/nginx.nix
Normal file
42
machines/sif/nginx.nix
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
email = "me@riley.lgbt";
|
||||
};
|
||||
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts = {
|
||||
"riley.lgbt" = {
|
||||
listen = [{
|
||||
port = 443;
|
||||
addr = "77.169.117.112";
|
||||
}];
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
"rly.cx" = {
|
||||
listen = [{
|
||||
port = 443;
|
||||
addr = "77.169.117.112";
|
||||
}];
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
26
machines/sif/website.nix
Normal file
26
machines/sif/website.nix
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
|
||||
let secret = config.age.secrets."website-secret".path;
|
||||
website = pkgs.rustPlatform.buildRustPackage {
|
||||
pname = "website";
|
||||
version = "1.0.0";
|
||||
cargoSha256 = "sha256-sT5BONGXWCpc+455TS1rc/SwNUtc6hXbwUMO/q/tiJ0=";
|
||||
|
||||
postPatch = ''
|
||||
cp ${secret} secret
|
||||
'';
|
||||
|
||||
src = pkgs.fetchgit {
|
||||
url = "https://im.badat.dev/riley/website.git";
|
||||
rev = "refs/heads/mistress";
|
||||
sha256 = "sha256-NiFinpSOE1wokOgBmgpZfMqR9AsENA9t/N84c/Ms2vU=";
|
||||
};
|
||||
};
|
||||
in {
|
||||
systemd.services."website" = {
|
||||
enable = true;
|
||||
description = "Run my website :)";
|
||||
path = [ website ];
|
||||
script = "${website}/bin/website";
|
||||
};
|
||||
}
|
||||
4
secrets/secrets.nix
Normal file
4
secrets/secrets.nix
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
let commonKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOIXreYQgV6lS0rJ1NlAbgq3Iv5FJ8o1MOr08NhLTGFG";
|
||||
in {
|
||||
"website-secret.age".publicKeys = [ commonKey ];
|
||||
}
|
||||
7
secrets/website-secret.age
Normal file
7
secrets/website-secret.age
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 ZEUNCQ D7HH+PR/jwjbb2LKJLVyADJjPvFflRDf61PywFWvpH0
|
||||
4pEJdyC8Obe7t+S5a2Yn52lfM7klw8eAsfZ6H48ivbg
|
||||
-> ^MruyW-grease S`2pFl
|
||||
z8kUgel+3sOrgcGwRRRPcvqCF7X1EmmbR6mUymUbuT0
|
||||
--- GvdH/J6Aa9dnK5QttDoOQTuZZos7s7xqPvPNJRF5A/k
|
||||
€[Å4mm!›‡Â¾8‰Ü,%<25><>t ;´“'áNæª11ò™ÿOQh5×[' ¨’_
|
||||
Loading…
Reference in a new issue