aboutsummaryrefslogtreecommitdiffstats
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/by-name/server2/configuration.nix101
-rw-r--r--hosts/by-name/server2/secrets/grafana/adminPassword.age17
-rw-r--r--hosts/by-name/server2/secrets/grafana/secretKey.age18
-rw-r--r--hosts/by-name/server2/secrets/nextcloud/adminpassFile.age14
-rw-r--r--hosts/by-name/server3/configuration.nix50
-rw-r--r--hosts/by-name/server3/secrets/rocie/login.age16
-rw-r--r--hosts/by-name/server3/websites.nix8
-rw-r--r--hosts/default.nix20
8 files changed, 188 insertions, 56 deletions
diff --git a/hosts/by-name/server2/configuration.nix b/hosts/by-name/server2/configuration.nix
index f7a5d2d..ba08d87 100644
--- a/hosts/by-name/server2/configuration.nix
+++ b/hosts/by-name/server2/configuration.nix
@@ -1,6 +1,6 @@
{
- config,
lib,
+ pkgs,
...
}: {
imports = [
@@ -16,13 +16,9 @@
};
vhack = {
- back = {
+ atuin-sync = {
enable = true;
- domain = "issues.foss-syndicate.org";
- settings = {
- scan_path = "${config.services.gitolite.dataDir}/repositories";
- project_list = "${config.services.gitolite.dataDir}/projects.list";
- };
+ fqdn = "atuin-sync.vhack.eu";
};
backup = {
enable = true;
@@ -30,6 +26,21 @@
privatePassword = ./secrets/backup/backuppass.age;
user = "u384702-sub3";
};
+
+ monitoring = {
+ enable = true;
+ prometheus = {
+ remoteWriteReceiver = "prometheus-server2.vhack.eu";
+ };
+ grafana = {
+ fqdn = "grafana.vhack.eu";
+
+ contactPoints = ["admin@vhack.eu"];
+ adminPassword = ./secrets/grafana/adminPassword.age;
+ secretKey = ./secrets/grafana/secretKey.age;
+ };
+ };
+
dns = {
enable = true;
openFirewall = true;
@@ -60,12 +71,82 @@
mail = {
enable = true;
fqdn = "mail.foss-syndicate.org";
+
+ domains = [
+ "vhack.eu"
+
+ "s-schoeffel.de"
+ "b-peetz.de"
+
+ "sils.li"
+ "nightingale.sils.li"
+ "sils.sils.li"
+
+ "jaki.li"
+ ];
+
+ accounts = {
+ "sils@vhack.eu" = {
+ hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm";
+ };
+ "soispha@vhack.eu" = {
+ hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW";
+ aliases = [
+ "abuse@vhack.eu"
+ "admin@vhack.eu"
+ "postmaster@vhack.eu"
+ ];
+ };
+
+ "soispha@b-peetz.de" = {
+ hashedPassword = "$y$j9T$asnEgvMxJrbeabfyp1AOe/$0dJ0/Rta57V8nHCLVGOHrXsXeEhBCaKx/HTuPHXZj04";
+ };
+ "benedikt.peetz@b-peetz.de" = {
+ hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy";
+ aliases = ["@b-peetz.de"];
+ };
+ "silas.schoeffel@s-schoeffel.de" = {
+ hashedPassword = "$2b$05$Qb8rl7ncpCcTbsSdsduJBuOITp8RTD6sfOTjuxJsVtD9vjAYY9n8e";
+ aliases = ["@s-schoeffel.de"];
+ };
+
+ "nightingale@vhack.eu" = {
+ hashedPassword = "$2b$05$nDKVVq1EktKXWqGFhnOLP.plLovXFyvWSuptK9GIkxA5DScKFx6YS";
+ aliases = [
+ "@nightingale.sils.li"
+ ];
+ };
+ "sils@sils.li" = {
+ hashedPassword = "$2b$05$Ebzh2ZhuWkz1p4tqJ172IejNZg10FtCxPDY4k6umYrpirXg7ezIRq";
+ aliases = [
+ "@sils.sils.li"
+ "@sils.li"
+ ];
+ };
+ "mail@jaki.li" = {
+ hashedPassword = "$y$j9T$jaG/lkAOfYXUNiJt11DoE.$ZKTeev6b5TCBEXZzNLH12hOmy5mL.Fitp0V6saWXR73";
+ aliases = [
+ "postmaster@jaki.li"
+ "abuse@jaki.li"
+ "admin@jaki.li"
+ ];
+ };
+
+ # Mail-Account used by hosted software
+ "mastodon@vhack.eu" = {
+ hashedPassword = "$2b$05$pSby3x2p3cHg0FyAE8IiJ.nYUqtAIR10JA8HNpHwMAiLXqc.ltSK.";
+ };
+ "peertube@vhack.eu" = {
+ hashedPassword = "$y$j9T$hyWQ8Awd2Xrc6qsK.2hwE1$LxACfaeW.yHGbkQL95dWtID9.zXL/aMwT6lp.yU/0g0";
+ };
+ };
};
nextcloud = {
enable = true;
+ package = pkgs.nextcloud33;
hostname = "nextcloud.vhack.eu";
- adminpassFile = ./secrets/nextcloud/adminpassFile.age;
};
+
nginx = {
enable = true;
redirects = {
@@ -81,10 +162,10 @@
"/var/log"
];
};
- redlib.enable = true;
+ redlib.enable = false;
rust-motd.enable = true;
sharkey = {
- enable = true;
+ enable = false;
fqdn = "sharkey.vhack.eu";
settings = {
id = "aidx";
diff --git a/hosts/by-name/server2/secrets/grafana/adminPassword.age b/hosts/by-name/server2/secrets/grafana/adminPassword.age
new file mode 100644
index 0000000..ff072fc
--- /dev/null
+++ b/hosts/by-name/server2/secrets/grafana/adminPassword.age
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bi9zRm5RRmU0YjJ4N3pi
+S2lNNGZRNUpycnUrZ3VRdFBsdkdIRjVTakRFCkxtVG1VbUFTbHpBZlYxV2pMSU5p
+a0lRcGVPWUUwMWpKdm5oYktWRklyWEUKLT4gWDI1NTE5IHNzN2NXRWYxdjladFF6
+ejk4eW43eUFsSStIV3FpWVJZREhLVEpjRkkvWFkKdlZtOG5pbDVvd0hwUEdMZnVn
+WFAvYWJDUEVBckc3M3NVQUdvdFVqNDB0QQotPiBzc2gtZWQyNTUxOSBYUG94RFEg
+RkpweWRJQklNUHVRWUhicXdDUVc3cXhyRi9KOS9wYWxDYnNNcjIzWmhERQpZZnpr
+eHRWbnI0cFd1T3h3TTVGZ1JiUzUrNUpSNkUwM2UyWTVYZ2VHVHBnCi0+IC5eKT0+
+eS1ncmVhc2Ugc0YvI25zZyAub3YgPDNtbmsKejExd2NBV0E2Q1pLSVhyQTRLaWZ6
+dmZSZHhidjBqeW10RnIxNStVTGIyY1RMS25xaUlxRDVxMlpKQQotLS0gc3BER0to
+dGdicEd3d1QzWWdoTmpkM1V5L0VvVG82cnNGY0hJTWUwVVBmTQpRQwKmFmQj10Z1
+AXllRSWcTSCzcM7fCVjCRcTF2lsxtXiXUkTS59yfNih02myuYCFIUG/MDl3A3pur
+WckFpQVHTdvQ9ilYORI/zi9LTmPy8TZYYcdmXnNRelfZ3fAqiR8ScIEG3P0smNyP
+9h6BcfiWYG2ppANLOeZxHz/UoG/LORXJyXoTCuiG8KJ714jX8f3CMX3+m9q/GmAX
+VZiYvvbGgrN5T5QrZE+8quRM1laAXmnmbDynODfhNFNw4/I0Opi0CF5MSObmvzKN
+z6vsc/kTGMqbip6k/LKvzea+jXMc8b8BeO0Y
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/server2/secrets/grafana/secretKey.age b/hosts/by-name/server2/secrets/grafana/secretKey.age
new file mode 100644
index 0000000..bfe4afe
--- /dev/null
+++ b/hosts/by-name/server2/secrets/grafana/secretKey.age
@@ -0,0 +1,18 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsYlhkcFdwL2NDUllGVko3
+bTEwVE00MjRoZUpXMGFWZFFSMXNBUkpFRVU4CkJwSU5RUnlITnRSZklVZjNBN3Ix
+NDdUS0ZpWVNBWEY3MVZYVlBkZkM3VlUKLT4gWDI1NTE5IHdsSm55NCtIT0Z4cUhx
+dE9pM0RmSHUrUGZTYXhuQlM4TGVKcm5MWGZNekkKQXZmZ05JVmZYdzJIYlN5WmxV
+Zlh0TWlxWWZucldweHpjdFM5TGJKZnprOAotPiBzc2gtZWQyNTUxOSBYUG94RFEg
+SjVTVXVJRjQrc0RIenVIVmNmZEtQS1lWbVNhSzY5QjJXRUxNY1JvVGdIOAo5V0Y5
+SGhTRlZUcFE3eU1iazBwYzh0Q2UxTnA2UTJQQ2VhaW1INnBGTTQwCi0+IGdeazN5
+ZmstZ3JlYXNlIGpZSGUgTUYja2N5RCAhICNaeT8KVnFRWjJXQ1lMekJQZG5jbGk4
+KzB5YVVmMGRFT1pUZzF3dkJBby94NXZjbkFOYlQ1dy9VWUFnaVRlTHpkUXdZaQox
+R1BMN3RjVXFwbitqU1pETzdlc0VqOFZhbVBrRlFiOWl3TWZkNzlCSS9kNkhBVUcw
+Zk5UbFRrZXhWQ2QrZwotLS0gbFV3MXRoYjZ4QVo0UU9iMmpGVllNcDdJZFQvUEFR
+UXpWYmptWmdWSllLVQrTggsrW+giXmbRL6Jq3VqT8uXhqHs5ZTCnPQSpKth04fzr
+mNLKMIi2kRJm3hJCaSPBrLpDuop+08hjGe0l0CxvuRlnFUOZkh+C/kFWOI3ecaWt
+TYVDkKNLXjrhyfw/rVHy03czluQncFYHFKib8djDqYTUa0ORj+M5cIgAzWODyCWB
+IGftRRjhDMHhQzq0GRwwu6jNA+ovT1cN1aMmafQFmqTR7BqO18HqKsGdtirFLV3o
+qrvHjqz1cJNKYEU89ogLJydTJHyuPhuPeHBl
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age b/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age
deleted file mode 100644
index 2b831f3..0000000
--- a/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxanRqM3pOT29DWitxUERF
-RjRURVZUWGpOSzFoZVpCSzJIN0RGZDAzWEZzCkczaExmOGgxQUQwV2NleUdHMXBB
-eTZLZXpGZE1hcXBhWWhVcEQ5OFBQWUkKLT4gWDI1NTE5IG5DVmlEaDhTWk9xaWs2
-TnF1K1ZtK2UyeDgvOEFlbVUzc0V1VnZoSmFobEkKczNrSGdwZEVxVFNES3dzcVgy
-SmRYNS9WR29mNGNCQW84bHZsZzNTRGZCQQotPiBzc2gtZWQyNTUxOSBYUG94RFEg
-Y2ZQd25odWRRbUdqM3gxMzBrQ1Y3UjRwQ0JsRldtblRaYnVKWHZud2p5awpZdkNm
-bk82RVVId2tsOXlKb2psa25pNFpManN4bjQwblBWUWdGaWxxQ1B3Ci0+ICNqaTBs
-KE8tZ3JlYXNlIE1KZGEgNzAKSGNMSlRGTzN5d3ZXcFZNTkxlZHprVlVQTzJ4K2Vp
-MG1YMTFHRmV6L2tMMGUKLS0tIE44WHBBZk1qcmRnK2lPczdiQ294SW50UFdrUHUw
-d0EreHNod29LL2pjd2cKw1rpd83gONZaOiV5lQ+QOtIZzoIkaOvRD/8avsbeFsP7
-AB/jiOfOwYJ0DVbNMjopwnzpcAFsLWs6Gg0wQhjNsl349TIcTAS0xLTJYTm8DwQy
-FmzftPMHAuJ/IPGzb3hQOFqpuFAPkunfiOgZ/N7N/+LLNMC5NxkkSH8m8gDBCCk=
------END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/server3/configuration.nix b/hosts/by-name/server3/configuration.nix
index 6966e58..f7ee7d3 100644
--- a/hosts/by-name/server3/configuration.nix
+++ b/hosts/by-name/server3/configuration.nix
@@ -20,7 +20,23 @@
];
zones = import ../../../zones {inherit lib;};
};
+
+ monitoring = {
+ prometheus = {
+ enable = true;
+ remoteWriteTo = {
+ url = "https://prometheus-server2.vhack.eu";
+ };
+ };
+ # TODO: Also provide something for Loki <2026-07-19>
+ };
+
fail2ban.enable = true;
+ rocie = {
+ enable = true;
+ domain = "rocie.vhack.eu";
+ loginSecret = ./secrets/rocie/login.age;
+ };
nix-sync = {
enable = true;
domains = import ./websites.nix {};
@@ -68,23 +84,23 @@
];
};
stalwart-mail = {
- enable = true;
- fqdn = "mail.vhack.eu";
- admin = "admin@vhack.eu";
- security = {
- dkimKeys = let
- loadKey = name: {
- dkimPublicKey = builtins.readFile (./secrets/dkim + "/${name}-public");
- dkimPrivateKeyPath = ./secrets/dkim + "/${name}-private.age";
- keyAlgorithm = "ed25519-sha256";
- };
- in {
- "mail.vhack.eu" = loadKey "mail.vhack.eu";
- };
- verificationMode = "strict";
- };
- openFirewall = true;
- principals = null;
+ # enable = false;
+ # fqdn = "mail.vhack.eu";
+ # admin = "admin@vhack.eu";
+ # security = {
+ # dkimKeys = let
+ # loadKey = name: {
+ # dkimPublicKey = builtins.readFile (./secrets/dkim + "/${name}-public");
+ # dkimPrivateKeyPath = ./secrets/dkim + "/${name}-private.age";
+ # keyAlgorithm = "ed25519-sha256";
+ # };
+ # in {
+ # "mail.vhack.eu" = loadKey "mail.vhack.eu";
+ # };
+ # verificationMode = "strict";
+ # };
+ # openFirewall = true;
+ # principals = null;
};
postgresql.enable = true;
rust-motd.enable = true;
diff --git a/hosts/by-name/server3/secrets/rocie/login.age b/hosts/by-name/server3/secrets/rocie/login.age
new file mode 100644
index 0000000..0a6b8d3
--- /dev/null
+++ b/hosts/by-name/server3/secrets/rocie/login.age
@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWN3ZFdjMyNjBvQXQ1YVYz
+OTBHMWYvbk5xK1ArVDYvMmZEUFF5dHRSajFNCkFXSCtPV2VVdW50amVVMVYxYXBK
+SHd4bXRXSEw0ZnJ3TTMvbmZGTStFbEUKLT4gWDI1NTE5IDZYMFJKWVBPVmc5QmFK
+M0xGNGNJZHNnRWxBcytaZXU3VWlqMzQvdDdhbm8KcVlIZTlRYVBZNEx1djZJbURD
+Qy9NUTEwYVN0VjhZbkc3TTNuUWd0QTFjcwotPiBzc2gtZWQyNTUxOSBweXU5Ymcg
+SnZ0czg2OUszeFJIbmNpU2RDV2tnMVRlUUVvMk5BTWcwbFFibDVzQXZUbwpJbkVC
+bFFqYzJZQTFQWDM4Zk42ZzE4Q2kzQlh4aTRtMHUyRlgrWlc1WUtjCi0+IFFELWdy
+ZWFzZQpCMDVUczNTa01KS2hFREhpM0k5L3ZHT0NDUEtVck1iZE13cnVkSi9Kdk80
+WXU1M3A0V1pZbGxZaVNGanZRUnE4CmYwUlo4QlVFTjc4YlFaQjZyU3BybTAwaTVP
+WHc2K1FyYzduT0RBYWtEa0xSREEKLS0tIExFSThrd2xGT3lEU1p6VXE0eWpZUG5z
+ZlVXMWJFS0NxczhycXl1VWc1bmsK4Dq740IgQP9CnGtkUrwWxM4QUOnQTgWe1YbI
+LtC471ykB4YlPIbMiqUdnBuFZQ9cBAOT2YuicxbI+/2Rb/mSRV0l8dGKpc2fqOVy
+zLLcX8A48NfmcbPeUtlv/HnVfu6Fe7X91V0bw6eMjWSvvcpQXsaIAd7TEPTpexCs
+gfAWd+brZMq6VzwslklxO4S5ZIu0jUSz4q6covAuxfEW3hdSbIg=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/server3/websites.nix b/hosts/by-name/server3/websites.nix
index 466f1e9..ece6247 100644
--- a/hosts/by-name/server3/websites.nix
+++ b/hosts/by-name/server3/websites.nix
@@ -1,7 +1,7 @@
{...}: let
mkWkd = domain: {
domain = "openpgpkey.${domain}";
- repositoryUrl = "https://git.foss-syndicate.org/vhack.eu/pgp-wkd.git";
+ repositoryUrl = "https://git.foss-syndicate.org/vhack.eu/pgp-wkd";
extraSettings = {
locations."/.well-known/openpgpkey/".extraConfig = ''
default_type application/octet-stream;
@@ -15,17 +15,17 @@
in [
{
domain = "vhack.eu";
- repositoryUrl = "https://codeberg.org/vhack.eu/website.git";
+ repositoryUrl = "https://codeberg.org/vhack.eu/website";
}
{
domain = "b-peetz.de";
- repositoryUrl = "https://git.foss-syndicate.org/bpeetz/b-peetz.de.git";
+ repositoryUrl = "https://git.foss-syndicate.org/bpeetz/b-peetz.de";
}
# Trinitrix
{
domain = "trinitrix.vhack.eu";
- repositoryUrl = "https://codeberg.org/trinitrix/website.git";
+ repositoryUrl = "https://codeberg.org/trinitrix/website";
}
# WKD
diff --git a/hosts/default.nix b/hosts/default.nix
index f53ee35..dc3b45d 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -4,15 +4,13 @@
nixpkgs,
specialArgs,
extraModules,
- deployPackage,
+ deploy-rs,
+ self,
}: let
- hostnames = builtins.fromTOML (builtins.readFile ./host-names.toml);
-
hosts = nixLib.mkByName {
useShards = false;
baseDirectory = ./by-name;
fileName = "configuration.nix";
- finalizeFunction = name: value: value;
};
mkNixosConfiguration = _: value:
@@ -26,16 +24,16 @@
value
];
};
- nixosConfigurations = builtins.mapAttrs mkNixosConfiguration hosts;
-
- mkDeploy = name: _: {
- hostname = hostnames."${name}";
+ mkDeployHost = name: value: {
+ hostname = name;
profiles.system = {
user = "root";
- path = deployPackage.lib.activate.nixos nixosConfigurations."${name}";
+ path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations."${name}";
};
};
- deploy = {nodes = builtins.mapAttrs mkDeploy hosts;};
+
+ nixosConfigurations = builtins.mapAttrs mkNixosConfiguration hosts;
+ nodes = builtins.mapAttrs mkDeployHost hosts;
in {
- inherit nixosConfigurations deploy;
+ inherit nixosConfigurations nodes;
}
generated by cgit v1.3.1 (git 2.54.0) at 2026-11-14 22:22:54 +0000