xin/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

biotite: move all services to biotite except kanidm

Browse source
This commit is contained in:
xinyangli 2024-12-05 13:28:22 +08:00
parent 7bc5db676d
commit 756357552a
Signed by: xin
SSH key fingerprint: SHA256:UU5pRTl7NiLFJbWJZa+snLylZSXIz5rgHmwjzv8v4oE
13 changed files with 78 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
machines/biotite/default.nix
View file

@ -35,7 +35,6 @@
commonSettings = { commonSettings = {
auth.enable = true; auth.enable = true;
autoupgrade.enable = true;
}; };
custom.monitoring = { custom.monitoring = {

5
machines/biotite/services/gotosocial.nix
View file

@ -1,4 +1,7 @@
{ config, ... }: { config, ... }:
let
inherit (config.my-lib.settings) idpUrl;
in
{ {
sops.secrets."gotosocial/oidc_client_secret" = { sops.secrets."gotosocial/oidc_client_secret" = {
owner = "gotosocial"; owner = "gotosocial";
@ -23,7 +26,7 @@
instance-expose-public-timeline = true; instance-expose-public-timeline = true;
oidc-enabled = true; oidc-enabled = true;
oidc-idp-name = "Kanidm"; oidc-idp-name = "Kanidm";
oidc-issuer = "https://auth.xinyang.life/oauth2/openid/gotosocial"; oidc-issuer = "${idpUrl}/oauth2/openid/gotosocial";
oidc-client-id = "gotosocial"; oidc-client-id = "gotosocial";
oidc-link-existing = true; oidc-link-existing = true;
}; };

26
machines/biotite/services/synapse.nix
View file

@ -1,5 +1,11 @@
{ config, pkgs, ... }: {
config,
lib,
pkgs,
...
}:
let let
inherit (config.my-lib.settings) idpUrl synapseDelegateUrl synapseUrl;
port-synapse = 6823; port-synapse = 6823;
in in
{ {
@ -27,7 +33,7 @@ in
enable = true; enable = true;
settings = { settings = {
server_name = "xiny.li"; server_name = "xiny.li";
public_baseurl = "https://synapse.xiny.li"; public_baseurl = synapseDelegateUrl;
database = { database = {
name = "psycopg2"; name = "psycopg2";
args = { args = {
@ -71,11 +77,11 @@ in
oidc_providers = [ oidc_providers = [
{ {
idp_id = "Kanidm"; idp_id = "Kanidm";
idp_name = "auth.xinyang.life"; idp_name = lib.removePrefix "https://" idpUrl;
issuer = "https://auth.xinyang.life/oauth2/openid/synapse"; issuer = "${idpUrl}/oauth2/openid/synapse";
authorization_endpoint = "https://auth.xinyang.life/ui/oauth2"; authorization_endpoint = "${idpUrl}/ui/oauth2";
token_endpoint = "https://auth.xinyang.life/oauth2/token"; token_endpoint = "${idpUrl}/oauth2/token";
userinfo_endpoint = "https://auth.xinyang.life/oauth2/openid/synapse/userinfo"; userinfo_endpoint = "${idpUrl}/oauth2/openid/synapse/userinfo";
client_id = "synapse"; client_id = "synapse";
client_secret_path = config.sops.secrets."synapse/oidc_client_secret".path; client_secret_path = config.sops.secrets."synapse/oidc_client_secret".path;
scopes = [ scopes = [
@ -95,13 +101,13 @@ in
}; };
services.caddy = { services.caddy = {
virtualHosts."https://xiny.li".extraConfig = '' virtualHosts.${synapseUrl}.extraConfig = ''
header /.well-known/matrix/* Content-Type application/json header /.well-known/matrix/* Content-Type application/json
header /.well-known/matrix/* Access-Control-Allow-Origin * header /.well-known/matrix/* Access-Control-Allow-Origin *
respond /.well-known/matrix/server `{"m.server":"synapse.xiny.li:443"}` respond /.well-known/matrix/server `{"m.server":"synapse.xiny.li:443"}`
respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://synapse.xiny.li/"}}` respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"${synapseDelegateUrl}"}}`
''; '';
virtualHosts."https://synapse.xiny.li".extraConfig = '' virtualHosts.${synapseDelegateUrl}.extraConfig = ''
reverse_proxy /_matrix/* 127.0.0.1:${toString port-synapse} reverse_proxy /_matrix/* 127.0.0.1:${toString port-synapse}
reverse_proxy /_synapse/client/* 127.0.0.1:${toString port-synapse} reverse_proxy /_synapse/client/* 127.0.0.1:${toString port-synapse}
''; '';

9
machines/massicot/default.nix
View file

@ -15,18 +15,9 @@
defaultSopsFile = ./secrets.yaml; defaultSopsFile = ./secrets.yaml;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets = { secrets = {
storage_box_mount = {
owner = "root";
};
gts_env = { gts_env = {
owner = "gotosocial"; owner = "gotosocial";
}; };
"miniflux/oauth2_secret" = {
owner = "root";
};
"forgejo/env" = {
owner = "forgejo";
};
}; };
}; };

12
machines/massicot/kanidm-provision.nix
View file

@ -1,10 +1,12 @@
{ pkgs, ... }: { pkgs, config, ... }:
let let
inherit (config.my-lib.settings) inherit (config.my-lib.settings)
gotosocialUrl gotosocialUrl
minifluxUrl minifluxUrl
hedgedocDomain hedgedocDomain
forgejoDomain forgejoDomain
grafanaUrl
synapseDelegateUrl
; ;
in in
{ {
@ -200,8 +202,8 @@ in
}; };
grafana = { grafana = {
displayName = "Grafana"; displayName = "Grafana";
originUrl = "https://grafana.xinyang.life/login/generic_oauth"; originUrl = "${grafanaUrl}/login/generic_oauth";
originLanding = "https://grafana.xinyang.life/"; originLanding = "${grafanaUrl}/";
scopeMaps = { scopeMaps = {
grafana-users = [ grafana-users = [
"openid" "openid"
@ -223,8 +225,8 @@ in
}; };
synapse = { synapse = {
displayName = "Synapse"; displayName = "Synapse";
originUrl = "https://synapse.xiny.li/_synapse/client/oidc/callback"; originUrl = "${synapseDelegateUrl}/_synapse/client/oidc/callback";
originLanding = "https://synapse.xiny.li/"; originLanding = "${synapseDelegateUrl}/";
scopeMaps = { scopeMaps = {
synapse-users = [ synapse-users = [
"openid" "openid"

7
machines/massicot/services/restic.nix
View file

@ -34,13 +34,6 @@ in
]; ];
}; };
services.postgresqlBackup = {
enable = true;
compression = "zstd";
compressionLevel = 9;
location = "/backup/postgresql";
};
services.restic.backups.${config.networking.hostName} = { services.restic.backups.${config.networking.hostName} = {
extraBackupArgs = [ extraBackupArgs = [
"--limit-upload=1024" "--limit-upload=1024"

1
machines/thorite/default.nix
View file

@ -3,6 +3,7 @@
./hardware-configurations.nix ./hardware-configurations.nix
./monitoring.nix ./monitoring.nix
./restic.nix ./restic.nix
./ntfy.nix
]; ];
config = { config = {

13
machines/thorite/monitoring.nix
View file

@ -10,7 +10,8 @@ let
minifluxUrl minifluxUrl
gotosocialUrl gotosocialUrl
hedgedocDomain hedgedocDomain
forgejoDomain grafanaUrl
ntfyUrl
; ;
removeHttps = s: lib.removePrefix "https://" s; removeHttps = s: lib.removePrefix "https://" s;
in in
@ -44,7 +45,7 @@ in
promtail.enable = true; promtail.enable = true;
}; };
services.caddy.virtualHosts."https://grafana.xinyang.life".extraConfig = services.caddy.virtualHosts.${grafanaUrl}.extraConfig =
with config.services.grafana.settings.server; '' with config.services.grafana.settings.server; ''
reverse_proxy http://${http_addr}:${toString http_port} reverse_proxy http://${http_addr}:${toString http_port}
''; '';
@ -98,17 +99,13 @@ in
name = "hedgedoc"; name = "hedgedoc";
address = hedgedocDomain; address = hedgedocDomain;
} }
{
name = "forgejo";
address = forgejoDomain;
}
{ {
name = "ntfy"; name = "ntfy";
address = "ntfy.xinyang.life"; address = removeHttps ntfyUrl;
} }
{ {
name = "grafana-eu"; name = "grafana-eu";
address = "grafana.xinyang.life"; address = removeHttps grafanaUrl;
} }
{ {
name = "loki"; name = "loki";

29
machines/thorite/ntfy.nix Normal file
View file

@ -0,0 +1,29 @@
{ config, ... }:
let
inherit (config.my-lib.settings) ntfyUrl;
in
{
services.ntfy-sh = {
enable = true;
group = "caddy";
settings = {
listen-unix = "/var/run/ntfy-sh/ntfy.sock";
listen-unix-mode = 432; # octal 0660
base-url = ntfyUrl;
};
};
systemd.services.ntfy-sh.serviceConfig.RuntimeDirectory = "ntfy-sh";
services.caddy.virtualHosts.${ntfyUrl}.extraConfig = ''
reverse_proxy unix/${config.services.ntfy-sh.settings.listen-unix}
@httpget {
protocol http
method GET
path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
}
redir @httpget https://{host}{uri}
'';
}

2
machines/weilite/default.nix
View file

@ -69,7 +69,7 @@
}; };
custom.monitoring = { custom.monitoring = {
loki.enable = true; promtail.enable = true;
}; };
systemd.mounts = [ systemd.mounts = [

10
modules/nixos/monitor/default.nix
View file

@ -11,6 +11,7 @@ let
mkMerge mkMerge
types types
; ;
inherit (config.my-lib.settings) ntfyUrl;
cfg = config.custom.prometheus; cfg = config.custom.prometheus;
mkRulesOption = mkOption { mkRulesOption = mkOption {
@ -121,12 +122,11 @@ in
name = "ntfy"; name = "ntfy";
webhook_configs = [ webhook_configs = [
{ {
url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL '' url = "${ntfyUrl}/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
Alert {{.status}} {{range .alerts}}[{{ if eq .status "resolved" }}✅ RESOLVED{{ else }}{{ if eq .status "firing" }}🔥 FIRING{{end}}{{end}}]{{range $k,$v := .labels}}
{{range .alerts}}-----{{range $k,$v := .labels}}
{{$k}}={{$v}}{{end}} {{$k}}={{$v}}{{end}}
{{end}}
''}"; {{end}}''}";
send_resolved = true; send_resolved = true;
} }
]; ];

11
modules/nixos/monitor/grafana.nix
View file

@ -1,5 +1,6 @@
{ config, lib, ... }: { config, lib, ... }:
let let
inherit (config.my-lib.settings) grafanaUrl idpUrl;
cfg = config.custom.monitoring.grafana; cfg = config.custom.monitoring.grafana;
in in
{ {
@ -13,17 +14,17 @@ in
server = { server = {
http_addr = "127.0.0.1"; http_addr = "127.0.0.1";
http_port = 3003; http_port = 3003;
root_url = "https://grafana.xinyang.life"; root_url = grafanaUrl;
domain = "grafana.xinyang.life"; domain = lib.removePrefix "https://" grafanaUrl;
}; };
"auth.generic_oauth" = { "auth.generic_oauth" = {
enabled = true; enabled = true;
name = "Kanidm"; name = "Kanidm";
client_id = "grafana"; client_id = "grafana";
scopes = "openid,profile,email,groups"; scopes = "openid,profile,email,groups";
auth_url = "https://auth.xinyang.life/ui/oauth2"; auth_url = "${idpUrl}/ui/oauth2";
token_url = "https://auth.xinyang.life/oauth2/token"; token_url = "${idpUrl}/oauth2/token";
api_url = "https://auth.xinyang.life/oauth2/openid/grafana/userinfo"; api_url = "${idpUrl}/oauth2/openid/grafana/userinfo";
use_pkce = true; use_pkce = true;
use_refresh_token = true; use_refresh_token = true;
allow_sign_up = true; allow_sign_up = true;

4
overlays/my-lib/settings.nix
View file

@ -8,5 +8,9 @@
forgejoDomain = "git.xiny.li"; forgejoDomain = "git.xiny.li";
forgejoGitDomain = "git.xiny.li"; forgejoGitDomain = "git.xiny.li";
vaultwardenUrl = "https://vaultwarden.xiny.li"; vaultwardenUrl = "https://vaultwarden.xiny.li";
ntfyUrl = "https://ntfy.xiny.li";
grafanaUrl = "https://grafana.xiny.li";
synapseUrl = "https://xiny.li";
synapseDelegateUrl = "https://synapse.xiny.li";
}; };
} }