Compare commits
15
Commits
4a228b5bdb
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
 Richie
|
f905b6e270 | ||
|
Richie
|
f1f027abfe | ||
|
Richie
|
0243da86f2 | ||
|
Richie
|
1803da420e | ||
|
Richie
|
2fb3a0d3ba | ||
|
Richie
|
4154640637 | ||
|
Richie
|
78641f78dd | ||
|
Richie
|
0e09b1db34 | ||
|
Richie
|
82a3bdf562 | ||
|
Richie
|
46cb80f809 | ||
|
Richie
|
bce4ccb754 | ||
|
Richie
|
7c7740fe90 | ||
|
Richie
|
a59ccd293d | ||
|
Richie
|
5514047eda | ||
|
Richie
|
810f9a66f6 |
@@ -31,6 +31,10 @@ in
|
||||
"flakes"
|
||||
"ca-derivations"
|
||||
];
|
||||
system-features = lib.mkAfter [
|
||||
"gccarch-x86-64-v2"
|
||||
"gccarch-x86-64-v3"
|
||||
];
|
||||
warn-dirty = false;
|
||||
flake-registry = ""; # disable global flake registries
|
||||
connect-timeout = 10;
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
logDriver = "local";
|
||||
storageDriver = "overlay2";
|
||||
daemon.settings = {
|
||||
live-restore = false;
|
||||
experimental = true;
|
||||
exec-opts = [ "native.cgroupdriver=systemd" ];
|
||||
log-opts = {
|
||||
|
||||
@@ -22,6 +22,12 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/var"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
|
||||
Generated
+18
-18
@@ -28,11 +28,11 @@
|
||||
},
|
||||
"locked": {
|
||||
"dir": "pkgs/firefox-addons",
|
||||
"lastModified": 1787025780,
|
||||
"narHash": "sha256-NhyLP9G4DFOn/7aYr7K/D7hWrzEGr5EgUBV+lpdmJ24=",
|
||||
"lastModified": 1788840136,
|
||||
"narHash": "sha256-ej5jnQIfjbw4wwPzy8Y4ntG9F3asdF6YBkLqpYeGUxc=",
|
||||
"owner": "rycee",
|
||||
"repo": "nur-expressions",
|
||||
"rev": "5ad360b6d3cb0aa1b61f9cb27fef113ca9117c37",
|
||||
"rev": "555b23e68256c5abfb8a85a385231830d1d7ad1f",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
@@ -49,11 +49,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1786999651,
|
||||
"narHash": "sha256-MTGMFlLDTklsXhCp4r5GXB4VAVadPdalXLvUjd/K7h0=",
|
||||
"lastModified": 1788651960,
|
||||
"narHash": "sha256-v9wJd32eZ2bvhBzVOd7TIjLQd011P7nwOhjKtWlci5I=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "353742587cbaf079b3caee743115d037bc51fea6",
|
||||
"rev": "2c0350c759688177331b8f5242311fae8877bdb3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -67,11 +67,11 @@
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1786867632,
|
||||
"narHash": "sha256-ez+ubZlA1RtdjCB18a6zJ9M4u8qoPDy08EcnsW5M3Xw=",
|
||||
"lastModified": 1788860136,
|
||||
"narHash": "sha256-MhPMOFV4pVkygWEbQ8t1De/uQ9cWF1u++tRe2L5tG48=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "ff17823245ab9ff7bcae6acf950bd89cba82c38c",
|
||||
"rev": "62173785b9a18c78b4a15aca2623d02bceb9d077",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -96,11 +96,11 @@
|
||||
},
|
||||
"nixpkgs-master": {
|
||||
"locked": {
|
||||
"lastModified": 1787081018,
|
||||
"narHash": "sha256-K0uwZBtZsbBigHAMQW7YWti3gPe6a5ct5bcOw5F+Q9Y=",
|
||||
"lastModified": 1788892992,
|
||||
"narHash": "sha256-cIMFh9gyU4/aLeB3JCcsWM3tTAvD9pAq9Smr1Wa8aIU=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "cacac5ac351a010599d9f9d106acfed25a8e4c77",
|
||||
"rev": "dff6994123e257ec9901c271bc2b52e64d7c8f05",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -128,11 +128,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1787001381,
|
||||
"narHash": "sha256-Ue1Yo8gfHdD4TMtNewhA4tkSYeFqXThju0nCyJc3ALo=",
|
||||
"lastModified": 1788752844,
|
||||
"narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "ec2d622de0773551768cf98f3fc50cbcc003b9c5",
|
||||
"rev": "dc5d91f840324650bac8c379428c7037a416959a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -162,11 +162,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1786629091,
|
||||
"narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
|
||||
"lastModified": 1788337237,
|
||||
"narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
|
||||
"rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -176,6 +176,21 @@ def create_zfs_datasets() -> None:
|
||||
run_output(("zfs", "create", "root_pool/home"))
|
||||
run_output(("zfs", "create", "-o", "reservation=1G", "root_pool/var"))
|
||||
run_output(("zfs", "create", "-o", "compression=zstd-9", "-o", "reservation=10G", "root_pool/nix"))
|
||||
run_output(
|
||||
(
|
||||
"zfs",
|
||||
"create",
|
||||
"-o",
|
||||
"sync=disabled",
|
||||
"-o",
|
||||
"redundant_metadata=some",
|
||||
"-o",
|
||||
"normalization=none",
|
||||
"-o",
|
||||
"utf8only=off",
|
||||
"root_pool/nix_build",
|
||||
)
|
||||
)
|
||||
datasets = run_output(("zfs", "list", "-o", "name"))
|
||||
|
||||
expected_datasets = {
|
||||
@@ -183,6 +198,7 @@ def create_zfs_datasets() -> None:
|
||||
"root_pool/home",
|
||||
"root_pool/var",
|
||||
"root_pool/nix",
|
||||
"root_pool/nix_build",
|
||||
}
|
||||
missing_datasets = expected_datasets.difference(datasets.splitlines())
|
||||
if missing_datasets:
|
||||
@@ -248,6 +264,7 @@ def create_nix_hardware_file(mnt_dir: str, disks: Sequence[str], encrypt: str |
|
||||
' "/home" = {\n device = "root_pool/home";\n fsType = "zfs";\n };\n\n'
|
||||
' "/var" = {\n device = "root_pool/var";\n fsType = "zfs";\n };\n\n'
|
||||
' "/nix" = {\n device = "root_pool/nix";\n fsType = "zfs";\n };\n\n'
|
||||
' "/nix/var/nix/builds" = {\n device = "root_pool/nix_build";\n fsType = "zfs";\n };\n\n'
|
||||
' "/boot" = {\n'
|
||||
f' device = "/dev/disk/by-uuid/{get_boot_drive_id(disks[0])}";\n'
|
||||
' fsType = "vfat";\n options = [\n "fmask=0077"\n'
|
||||
@@ -270,6 +287,7 @@ def install_nixos(mnt_dir: str, disks: Sequence[str], encrypt: str | None) -> No
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/home", f"{mnt_dir}/home"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/var", f"{mnt_dir}/var"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix", f"{mnt_dir}/nix"))
|
||||
run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix_build", f"{mnt_dir}/nix/var/nix/builds"))
|
||||
|
||||
for disk in disks:
|
||||
run_output(("mkfs.vfat", "-n", "EFI", f"{disk}-part1"))
|
||||
|
||||
@@ -3,7 +3,6 @@
|
||||
imports = [
|
||||
"${inputs.self}/users/math"
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/users/steve"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/monitoring-agent.nix"
|
||||
|
||||
@@ -50,6 +50,11 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
|
||||
@@ -22,6 +22,12 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/models"]
|
||||
15_min = 4
|
||||
hourly = 24
|
||||
|
||||
@@ -53,6 +53,11 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -0,0 +1,71 @@
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.docker.daemon.settings."data-root" = "${vars.containers}/docker";
|
||||
|
||||
# nixos-container hardcodes its state directory to /var/lib/nixos-containers,
|
||||
# so route it to the shared container dataset with a bind mount.
|
||||
fileSystems."/var/lib/nixos-containers" = {
|
||||
device = "${vars.containers}/nixos-containers";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
prepare-docker-storage = {
|
||||
description = "Create Docker storage directory";
|
||||
requiredBy = [ "docker.service" ];
|
||||
before = [ "docker.service" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
after = [ "zfs-mount.service" ];
|
||||
path = [
|
||||
pkgs.coreutils
|
||||
pkgs.util-linux
|
||||
];
|
||||
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = [ "/nix" ];
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mountpoint -q ${vars.containers}
|
||||
install -d -m 0710 ${vars.containers}/docker
|
||||
'';
|
||||
};
|
||||
|
||||
prepare-nixos-container-storage = {
|
||||
description = "Create NixOS container storage directory";
|
||||
requiredBy = [ "var-lib-nixos\\x2dcontainers.mount" ];
|
||||
before = [ "var-lib-nixos\\x2dcontainers.mount" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
after = [ "zfs-mount.service" ];
|
||||
path = [
|
||||
pkgs.coreutils
|
||||
pkgs.util-linux
|
||||
];
|
||||
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = [ "/nix" ];
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mountpoint -q ${vars.containers}
|
||||
install -d -m 0755 ${vars.containers}/nixos-containers
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,10 +4,8 @@ let
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
"${inputs.self}/users/dov"
|
||||
"${inputs.self}/users/math"
|
||||
"${inputs.self}/users/richie"
|
||||
"${inputs.self}/users/steve"
|
||||
"${inputs.self}/common/global"
|
||||
"${inputs.self}/common/optional/docker.nix"
|
||||
"${inputs.self}/common/optional/monitoring-agent.nix"
|
||||
@@ -19,6 +17,7 @@ in
|
||||
./monitoring
|
||||
./docker
|
||||
./services
|
||||
./containers.nix
|
||||
./hardware.nix
|
||||
./networking
|
||||
./programs.nix
|
||||
|
||||
@@ -96,6 +96,11 @@ in
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
outputs,
|
||||
utils,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
@@ -12,6 +11,124 @@ let
|
||||
cfg = config.services.nix_builder;
|
||||
runnerUsername = "gitea-runner";
|
||||
runnerUserid = 601;
|
||||
runnerLabels = [
|
||||
"self-hosted:host"
|
||||
"nixos:host"
|
||||
];
|
||||
containerConfig =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
runnerConfigFile = (pkgs.formats.yaml { }).generate "gitea-runner.yaml" { };
|
||||
registerRunner = pkgs.writeShellApplication {
|
||||
name = "register-gitea-runner";
|
||||
runtimeInputs = [
|
||||
pkgs.coreutils
|
||||
pkgs.hostname
|
||||
config.services.gitea-actions-runner.package
|
||||
];
|
||||
text = builtins.readFile ./register_gitea_runner.sh;
|
||||
};
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
hostName = "nix-builder";
|
||||
useDHCP = lib.mkDefault true;
|
||||
interfaces.eth0.useDHCP = true;
|
||||
# Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
|
||||
useHostResolvConf = false;
|
||||
};
|
||||
nix.settings = {
|
||||
cores = 8;
|
||||
max-jobs = 2;
|
||||
system-features = lib.mkAfter [
|
||||
"gccarch-x86-64-v2"
|
||||
"gccarch-x86-64-v3"
|
||||
];
|
||||
trusted-substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://cache.tmmworkshop.com"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
substituters = [
|
||||
"https://cache.nixos.org/?priority=2&want-mass-query=true"
|
||||
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
|
||||
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
sandbox = true;
|
||||
allowed-users = [ runnerUsername ];
|
||||
trusted-users = [
|
||||
"root"
|
||||
runnerUsername
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users.${runnerUsername} = {
|
||||
isSystemUser = true;
|
||||
group = runnerUsername;
|
||||
uid = runnerUserid;
|
||||
};
|
||||
groups.${runnerUsername}.gid = runnerUserid;
|
||||
};
|
||||
services.gitea-actions-runner.instances.builder = {
|
||||
enable = true;
|
||||
name = "jeeves-nix-builder";
|
||||
url = "http://192.168.99.14:6443/";
|
||||
labels = runnerLabels;
|
||||
tokenFile = "/run/secrets/gitea-runners/registration-token";
|
||||
settings.runner.timeout = "12h";
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
my_python
|
||||
nix
|
||||
nixfmt
|
||||
nixos-rebuild
|
||||
nodejs
|
||||
treefmt
|
||||
wget
|
||||
];
|
||||
};
|
||||
systemd.services."gitea-runner-builder" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = mkForce false;
|
||||
User = mkForce runnerUsername;
|
||||
Group = mkForce runnerUsername;
|
||||
ExecStartPre = mkForce [
|
||||
"${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs runnerLabels}"
|
||||
];
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
sharedContainerPath =
|
||||
(import "${pkgs.path}/nixos/lib/eval-config.nix" {
|
||||
modules = [
|
||||
{
|
||||
boot.isNspawnContainer = true;
|
||||
nixpkgs.pkgs = pkgs;
|
||||
}
|
||||
containerConfig
|
||||
];
|
||||
system = null;
|
||||
}).config.system.build.toplevel;
|
||||
in
|
||||
{
|
||||
options.services.nix_builder = {
|
||||
@@ -48,9 +165,11 @@ in
|
||||
containers = mapAttrs (
|
||||
name: containerCfg:
|
||||
mkIf containerCfg.enable {
|
||||
path = sharedContainerPath;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostBridge = cfg.bridgeName;
|
||||
extraFlags = [ "--hostname=${name}" ];
|
||||
bindMounts = {
|
||||
host-nix = {
|
||||
mountPoint = "/host-nix/var/nix/daemon-socket";
|
||||
@@ -68,93 +187,6 @@ in
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking = {
|
||||
useDHCP = lib.mkDefault true;
|
||||
interfaces.eth0.useDHCP = true;
|
||||
# Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
|
||||
useHostResolvConf = false;
|
||||
};
|
||||
nix.settings = {
|
||||
trusted-substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://cache.tmmworkshop.com"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
substituters = [
|
||||
"https://cache.nixos.org/?priority=2&want-mass-query=true"
|
||||
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
|
||||
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
sandbox = true;
|
||||
allowed-users = [ "gitea-runner" ];
|
||||
trusted-users = [
|
||||
"root"
|
||||
"gitea-runner"
|
||||
];
|
||||
};
|
||||
nixpkgs = {
|
||||
overlays = builtins.attrValues outputs.overlays;
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
users = {
|
||||
users.${runnerUsername} = {
|
||||
isSystemUser = true;
|
||||
group = runnerUsername;
|
||||
uid = runnerUserid;
|
||||
};
|
||||
groups.${runnerUsername}.gid = runnerUserid;
|
||||
};
|
||||
services.gitea-actions-runner.instances.${name} = {
|
||||
enable = true;
|
||||
name = "jeeves-${name}";
|
||||
url = "http://192.168.99.14:6443/";
|
||||
labels = [
|
||||
"self-hosted:host"
|
||||
"nixos:host"
|
||||
];
|
||||
tokenFile = "/run/secrets/gitea-runners/registration-token";
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
my_python
|
||||
nix
|
||||
nixfmt
|
||||
nixos-rebuild
|
||||
nodejs
|
||||
treefmt
|
||||
wget
|
||||
];
|
||||
};
|
||||
systemd.services."gitea-runner-${utils.escapeSystemdPath name}" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = mkForce false;
|
||||
User = mkForce runnerUsername;
|
||||
Group = mkForce runnerUsername;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
}
|
||||
) cfg.containers;
|
||||
|
||||
@@ -165,6 +197,7 @@ in
|
||||
value = {
|
||||
requires = [ "gitea.service" ];
|
||||
after = [ "gitea.service" ];
|
||||
serviceConfig.CPUQuota = "800%";
|
||||
};
|
||||
}) (builtins.attrNames (filterAttrs (_: c: c.enable) cfg.containers))
|
||||
);
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
legacy_instance_dir="$STATE_DIRECTORY/$(hostname)"
|
||||
instance_dir="$STATE_DIRECTORY/$1"
|
||||
runner_url="$2"
|
||||
runner_config_file="$3"
|
||||
shift 3
|
||||
runner_labels="$(IFS=,; printf '%s' "$*")"
|
||||
|
||||
if [ ! -e "$instance_dir" ] && [ -d "$legacy_instance_dir" ]; then
|
||||
mv "$legacy_instance_dir" "$instance_dir"
|
||||
fi
|
||||
|
||||
mkdir -vp "$instance_dir"
|
||||
cd "$instance_dir" || exit 1
|
||||
|
||||
token_hash_file="$instance_dir/.token-hash"
|
||||
token_hash_current="$(printf '%s' "$TOKEN" | sha256sum | cut -d' ' -f1)"
|
||||
token_hash_stored="$(cat "$token_hash_file" 2>/dev/null || echo "")"
|
||||
labels_file="$instance_dir/.labels"
|
||||
labels_wanted="$(printf '%s\n' "$@" | sort)"
|
||||
labels_current="$(cat "$labels_file" 2>/dev/null || echo 0)"
|
||||
|
||||
if [ ! -e "$instance_dir/.runner" ] || [ "$labels_wanted" != "$labels_current" ] || [ "$token_hash_current" != "$token_hash_stored" ]; then
|
||||
rm -v "$instance_dir/.runner" || true
|
||||
|
||||
gitea-runner register --no-interactive \
|
||||
--instance "$runner_url" \
|
||||
--token "$TOKEN" \
|
||||
--name "jeeves-$(hostname)" \
|
||||
--labels "$runner_labels" \
|
||||
--config "$runner_config_file"
|
||||
|
||||
printf '%s' "$token_hash_current" > "$token_hash_file"
|
||||
printf '%s\n' "$labels_wanted" > "$labels_file"
|
||||
fi
|
||||
@@ -17,6 +17,7 @@ sudo zpool create scratch -o ashift=12 -O acltype=posixacl -O atime=off -O dnode
|
||||
# media datasets
|
||||
sudo zfs create media/temp -o sync=disabled -o redundant_metadata=none
|
||||
sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
|
||||
sudo zfs create media/secure/containers -o mountpoint=/zfs/media/containers -o compression=lz4 -o sync=disabled -o redundant_metadata=some -o normalization=none -o utf8only=off
|
||||
sudo zfs create media/secure/docker -o compression=zstd-9
|
||||
sudo zfs create media/secure/github-runners -o compression=zstd-9 -o sync=disabled
|
||||
sudo zfs create media/secure/notes -o copies=2
|
||||
|
||||
@@ -1,80 +0,0 @@
|
||||
{
|
||||
...
|
||||
}:
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${vars.docker_configs}/camofox-browser 0750 root root - -"
|
||||
];
|
||||
|
||||
containers.camofox-browser = {
|
||||
autoStart = true;
|
||||
privateNetwork = false;
|
||||
bindMounts = {
|
||||
camofox-browser = {
|
||||
hostPath = "${vars.docker_configs}/camofox-browser";
|
||||
mountPoint = "/var/lib/camofox-browser";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
config =
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking.hostName = "camofox-browser";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
ffmpeg
|
||||
git
|
||||
nodejs
|
||||
python3Packages.yt-dlp
|
||||
];
|
||||
|
||||
systemd.services.camofox-browser = {
|
||||
description = "Camofox browser server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
environment = {
|
||||
CAMOFOX_HOST = "127.0.0.1";
|
||||
CAMOFOX_PORT = "9377";
|
||||
HOME = "/var/lib/camofox-browser";
|
||||
};
|
||||
path = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
git
|
||||
nodejs
|
||||
];
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
WorkingDirectory = "/var/lib/camofox-browser";
|
||||
};
|
||||
script = ''
|
||||
set -eu
|
||||
|
||||
app_dir=/var/lib/camofox-browser/app
|
||||
|
||||
if [ ! -d "$app_dir/.git" ]; then
|
||||
git clone --depth 1 https://github.com/jo-inc/camofox-browser "$app_dir"
|
||||
fi
|
||||
|
||||
cd "$app_dir"
|
||||
|
||||
if [ ! -d node_modules ]; then
|
||||
npm install
|
||||
fi
|
||||
|
||||
exec npm start
|
||||
'';
|
||||
};
|
||||
|
||||
system.stateVersion = lib.mkDefault "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -19,6 +19,7 @@ in
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
ENDLESS_TASK_TIMEOUT = "12h";
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
server = {
|
||||
|
||||
@@ -23,6 +23,12 @@ hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/nix_build"]
|
||||
15_min = 1
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["root_pool/var"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
@@ -60,6 +66,12 @@ daily = 30
|
||||
monthly = 12
|
||||
|
||||
# media
|
||||
["media/secure/containers"]
|
||||
15_min = 2
|
||||
hourly = 0
|
||||
daily = 0
|
||||
monthly = 0
|
||||
|
||||
["media/temp"]
|
||||
15_min = 2
|
||||
hourly = 0
|
||||
|
||||
@@ -5,6 +5,7 @@ let
|
||||
in
|
||||
{
|
||||
inherit zfs_media zfs_storage zfs_scratch;
|
||||
containers = "${zfs_media}/containers";
|
||||
database = "${zfs_media}/database";
|
||||
docker = "${zfs_media}/docker";
|
||||
docker_configs = "${zfs_media}/docker/configs";
|
||||
|
||||
@@ -34,14 +34,22 @@
|
||||
device = "root_pool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/home" = {
|
||||
device = "root_pool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/nix/var/nix/builds" = {
|
||||
device = "root_pool/nix_build";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
|
||||
users = {
|
||||
users.dov = {
|
||||
isNormalUser = true;
|
||||
|
||||
shell = pkgs.zsh;
|
||||
group = "dov";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoSBmMfvp6aThkrfkLQ4TDwZJD0HCC0lsTIRNREIAWeduNkVFdkO3T1SMLmCKJ+zlL9xziNBEqB8NFl4TabAhptIGlKgTOc8C9eDaPQMQV8PB/4DxZhCt7O2qb4Vfcz82IHPtdwwaIsGpssgh81mQ4tPtP8BI0TluRBy+2v095s20j+PYRGrAXJtOWpVY9zaXxEJ8dXDhHDF2xzxvUcwu9NsoY8t+4/ZJ1mrTTG+eGp5gLAKnSVhAGgsmqCY577Nkso1jSzKer1XcCiaGIedpLuTzmUbOFFEVhhTSy+Ki1NLEcjGW2e6Vyg5Pm8VGN75MqyDZsi5igv9Grxq62EHQ4mFea9rns48B74O/bNQ1OoLVO9u/HwdLCgBTZzptrCmNwML6kBWrmCogoH3ueVbHwDCW5kTTMBCoVV+HaZ+qDWu7xZVx49MuCK29QGZj/IrN0N7h78KL0NYajdei87R0mcmWGP0YaJTdCQ4iKi9c77BUYQp+Qpqt+mnIX0cgjQOU= dkruger@kzin" # cspell:disable-line
|
||||
];
|
||||
extraGroups = [
|
||||
"audio"
|
||||
"video"
|
||||
"users"
|
||||
];
|
||||
uid = 1004;
|
||||
};
|
||||
|
||||
groups.dov.gid = 1004;
|
||||
};
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
./direnv.nix
|
||||
./git.nix
|
||||
./zsh.nix
|
||||
];
|
||||
|
||||
programs.starship.enable = true;
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
{
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
enableZshIntegration = true;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
programs.git = {
|
||||
enable = true;
|
||||
signing.format = null;
|
||||
settings = {
|
||||
user = {
|
||||
email = "dov.kruger@gmail.com";
|
||||
name = "Dov Kruger";
|
||||
};
|
||||
pull.rebase = true;
|
||||
color.ui = true;
|
||||
};
|
||||
lfs.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
{
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
history.size = 10000;
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"docker"
|
||||
"docker-compose"
|
||||
"colored-man-pages"
|
||||
"rust"
|
||||
"systemd"
|
||||
"tmux"
|
||||
"ufw"
|
||||
"z"
|
||||
];
|
||||
};
|
||||
shellAliases = {
|
||||
"lrt" = "eza --icons -lsnew";
|
||||
"ls" = "eza";
|
||||
"ll" = "eza --long --group";
|
||||
"la" = "eza --all";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./cli
|
||||
./programs.nix
|
||||
./ssh_config.nix
|
||||
];
|
||||
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
git.enable = true;
|
||||
};
|
||||
|
||||
home = {
|
||||
username = "dov";
|
||||
homeDirectory = "/home/${config.home.username}";
|
||||
stateVersion = "24.05";
|
||||
sessionVariables = {
|
||||
FLAKE = "$HOME/dotfiles";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
};
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
@@ -3,54 +3,17 @@
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
ouch
|
||||
fastfetch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
{ inputs, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
"${inputs.self}/users/shared/comms.nix"
|
||||
"${inputs.self}/users/shared/games.nix"
|
||||
"${inputs.self}/users/shared/sweet.nix"
|
||||
./comms.nix
|
||||
./firefox
|
||||
./games.nix
|
||||
./kitty.nix
|
||||
./llm_tools.nix
|
||||
./sweet.nix
|
||||
./t3_code
|
||||
./vscode
|
||||
];
|
||||
|
||||
@@ -3,21 +3,14 @@
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
fastfetch
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# Home Assistant
|
||||
esphome
|
||||
@@ -35,8 +28,6 @@
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
bacon
|
||||
cargo
|
||||
@@ -51,9 +42,6 @@
|
||||
rustfmt
|
||||
trunk
|
||||
wasm-pack
|
||||
# cpp
|
||||
clang-tools
|
||||
clang_20
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
@@ -61,6 +49,5 @@
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
codebase-memory-mcp
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
|
||||
in
|
||||
{
|
||||
|
||||
users = {
|
||||
users.steve = {
|
||||
isNormalUser = true;
|
||||
|
||||
shell = pkgs.zsh;
|
||||
group = "steve";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJH03VzDbUhzfhvwD+OsYh6GobODYaI9jdNdzWQoqFsp matth@Jove" # cspell:disable-line
|
||||
];
|
||||
extraGroups = [
|
||||
"audio"
|
||||
"video"
|
||||
"wheel"
|
||||
"users"
|
||||
]
|
||||
++ ifTheyExist [
|
||||
"dialout"
|
||||
"docker"
|
||||
"hass"
|
||||
"libvirtd"
|
||||
"networkmanager"
|
||||
"plugdev"
|
||||
"scanner"
|
||||
"transmission"
|
||||
"uaccess"
|
||||
"wireshark"
|
||||
];
|
||||
uid = 1005;
|
||||
};
|
||||
|
||||
groups.steve.gid = 1005;
|
||||
};
|
||||
home-manager.users.steve = import ./systems/${config.networking.hostName}.nix;
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
./direnv.nix
|
||||
./git.nix
|
||||
./zsh.nix
|
||||
];
|
||||
|
||||
programs.starship.enable = true;
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
{
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
enableZshIntegration = true;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
programs.git = {
|
||||
enable = true;
|
||||
signing.format = null;
|
||||
settings = {
|
||||
user = {
|
||||
email = "matthew.michal11@gmail.com";
|
||||
name = "Matthew Michal";
|
||||
};
|
||||
pull.rebase = true;
|
||||
color.ui = true;
|
||||
};
|
||||
lfs.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
{
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
history.size = 10000;
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"docker"
|
||||
"docker-compose"
|
||||
"colored-man-pages"
|
||||
"rust"
|
||||
"systemd"
|
||||
"tmux"
|
||||
"ufw"
|
||||
"z"
|
||||
];
|
||||
};
|
||||
shellAliases = {
|
||||
"lrt" = "eza --icons -lsnew";
|
||||
"ls" = "eza";
|
||||
"ll" = "eza --long --group";
|
||||
"la" = "eza --all";
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./cli
|
||||
./programs.nix
|
||||
./ssh_config.nix
|
||||
];
|
||||
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
git.enable = true;
|
||||
};
|
||||
|
||||
home = {
|
||||
username = "steve";
|
||||
homeDirectory = "/home/${config.home.username}";
|
||||
stateVersion = "24.05";
|
||||
sessionVariables = {
|
||||
FLAKE = "$HOME/dotfiles";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
# cli
|
||||
bat
|
||||
btop
|
||||
eza
|
||||
fd
|
||||
ffmpegthumbnailer
|
||||
fzf
|
||||
git
|
||||
gnupg
|
||||
imagemagick
|
||||
jq
|
||||
ncdu
|
||||
ouch
|
||||
p7zip
|
||||
poppler
|
||||
rar
|
||||
ripgrep
|
||||
starship
|
||||
tmux
|
||||
unzip
|
||||
yazi
|
||||
zoxide
|
||||
# system info
|
||||
hwloc
|
||||
lynis
|
||||
pciutils
|
||||
smartmontools
|
||||
usbutils
|
||||
# networking
|
||||
iperf3
|
||||
nmap
|
||||
wget
|
||||
# python
|
||||
ruff
|
||||
uv
|
||||
# nodejs
|
||||
nodejs
|
||||
# Rust packages
|
||||
trunk
|
||||
wasm-pack
|
||||
cargo-watch
|
||||
cargo-generate
|
||||
cargo-audit
|
||||
cargo-update
|
||||
# nix
|
||||
nix-init
|
||||
nix-output-monitor
|
||||
nix-prefetch
|
||||
nix-tree
|
||||
nixfmt
|
||||
treefmt
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
};
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
Reference in New Issue
Block a user