tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 8 Pull requests Activity

update(treewide): Update to NixOS 25.11

Browse source
This commit is contained in:
Tristan Daniël Maat 2025-12-01 16:22:00 +08:00
parent 342b6c756a
commit 642dad3afa
Signed by: tlater
GPG key ID: 02E935006CF2E8E7
12 changed files with 44 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

8
configuration/hardware-specific/vm.nix
View file

@ -43,6 +43,14 @@
source = ../../keys/hosts/staging.key; source = ../../keys/hosts/staging.key;
}; };
# Pretend the acme renew succeeds.
#
# TODO(tlater): Set up pebble to retrieve certs "properly"
# instead
systemd.services."acme-order-renew-tlater.net".script = ''
touch out/acme-success
'';
virtualisation.vmVariant = { virtualisation.vmVariant = {
virtualisation = { virtualisation = {
memorySize = 3941; memorySize = 3941;

34
configuration/nginx/ssl.nix
View file

@ -51,20 +51,9 @@
paths = [ "/var/lib/acme/tlater.net" ]; paths = [ "/var/lib/acme/tlater.net" ];
}; };
systemd.services = { systemd.services.nginx.serviceConfig.SupplementaryGroups = [
nginx.serviceConfig.SupplementaryGroups = [ config.security.acme.certs."tlater.net".group ]; config.security.acme.certs."tlater.net".group
];
# Don't attempt to retrieve a certificate if the domain name
# doesn't *actually* match the cert name
#
# TODO(tlater): Set up pebble to retrieve certs "properly"
# instead
"acme-tlater.net".serviceConfig.ExecCondition =
let
confirm = ''[[ "tlater.net" = "${config.services.nginx.domain}" ]]'';
in
''${pkgs.runtimeShell} -c '${confirm}' '';
};
sops.secrets = { sops.secrets = {
"porkbun/api-key".owner = "acme"; "porkbun/api-key".owner = "acme";
@ -85,10 +74,18 @@
security.acme.certs."tlater.net".extraDomainNames = [ config.services.nginx.domain ]; security.acme.certs."tlater.net".extraDomainNames = [ config.services.nginx.domain ];
services.nginx = { # Pretend the acme renew succeeds.
domain = "testHost"; #
# TODO(tlater): Set up pebble to retrieve certs "properly"
# instead
systemd.services."acme-order-renew-tlater.net".script = ''
touch out/acme-success
'';
virtualHosts."${config.services.nginx.domain}" = { services.nginx = {
domain = "testHost.test";
virtualHosts."${config.services.nginx.domain}.local" = {
useACMEHost = "tlater.net"; useACMEHost = "tlater.net";
onlySSL = true; onlySSL = true;
enableHSTS = true; enableHSTS = true;
@ -109,6 +106,7 @@
{ pkgs, ... }: { pkgs, ... }:
{ {
environment.systemPackages = [ pkgs.curl ]; environment.systemPackages = [ pkgs.curl ];
networking.hosts."192.168.1.2" = [ "testHost.test" ];
}; };
}; };
@ -125,7 +123,7 @@
"--silent", "--silent",
"--dump-header -", "--dump-header -",
"--cacert /certs/tlater.net/fullchain.pem", "--cacert /certs/tlater.net/fullchain.pem",
"https://testHost", "https://testHost.test",
"-o /dev/null" "-o /dev/null"
])) ]))

2
configuration/services/foundryvtt.nix
View file

@ -23,7 +23,7 @@ in
minifyStaticFiles = true; minifyStaticFiles = true;
proxySSL = true; proxySSL = true;
proxyPort = 443; proxyPort = 443;
package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_13; package = flake-inputs.foundryvtt.packages.${pkgs.stdenv.hostPlatform.system}.foundryvtt_13;
}; };
nginx.virtualHosts."${domain}" = nginx.virtualHosts."${domain}" =

4
configuration/services/nextcloud.nix
View file

@ -5,7 +5,7 @@
... ...
}: }:
let let
nextcloud = pkgs.nextcloud31; nextcloud = pkgs.nextcloud32;
hostName = "nextcloud.${config.services.nginx.domain}"; hostName = "nextcloud.${config.services.nginx.domain}";
in in
{ {
@ -104,7 +104,7 @@ in
}; };
# Ensure that this service doesn't start before postgres is ready # Ensure that this service doesn't start before postgres is ready
systemd.services.nextcloud-setup.after = [ "postgresql.service" ]; systemd.services.nextcloud-setup.after = [ "postgresql.target" ];
sops.secrets."nextcloud/tlater" = { sops.secrets."nextcloud/tlater" = {
owner = "nextcloud"; owner = "nextcloud";

1
configuration/services/ntfy-sh/default.nix
View file

@ -17,7 +17,6 @@ in
services.ntfy-sh = { services.ntfy-sh = {
enable = true; enable = true;
package = flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.ntfy-sh;
environmentFile = config.sops.secrets."ntfy/users".path; environmentFile = config.sops.secrets."ntfy/users".path;

2
configuration/services/starbound.nix
View file

@ -19,7 +19,7 @@ in
serviceConfig = { serviceConfig = {
ExecStart = "${ ExecStart = "${
flake-inputs.self.packages.${pkgs.system}.starbound flake-inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.starbound
}/bin/launch-starbound ${./configs/starbound.json}"; }/bin/launch-starbound ${./configs/starbound.json}";
Type = "simple"; Type = "simple";

2
configuration/services/webserver.nix
View file

@ -20,7 +20,7 @@ in
after = [ "network.target" ]; after = [ "network.target" ];
script = '' script = ''
${lib.getExe flake-inputs.self.packages.${pkgs.system}.webserver} ${lib.getExe flake-inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.webserver}
''; '';
environment = { environment = {

32
flake.lock generated
View file

@ -255,28 +255,15 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1763509821, "lastModified": 1764522689,
"narHash": "sha256-ibZr0ONEUA1W2WAdTzgm9/6jBE+tM20j1YW2FK4RZ/k=", "narHash": "sha256-GzkEBSHGkj8EyOxnxQvl9sx0x2S7JzH0hwCziF176T8=",
"rev": "659aa6fa27619d04de231b4cc0c938905dfa01e9", "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
"type": "tarball", "type": "tarball",
"url": "https://releases.nixos.org/nixos/25.05-small/nixos-25.05.812929.659aa6fa2761/nixexprs.tar.xz?lastModified=1763509821&rev=659aa6fa27619d04de231b4cc0c938905dfa01e9" "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.650.8bb5646e0bed/nixexprs.tar.xz?lastModified=1764522689&rev=8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f"
}, },
"original": { "original": {
"type": "tarball", "type": "tarball",
"url": "https://channels.nixos.org/nixos-25.05-small/nixexprs.tar.xz" "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
}
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1763835633,
"narHash": "sha256-nzRnw0UkYQpDm0o20AKvG/5oHCXy5qEGOsFAVhB5NmA=",
"rev": "050e09e091117c3d7328c7b2b7b577492c43c134",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/unstable/nixos-25.11pre900642.050e09e09111/nixexprs.tar.xz?lastModified=1763835633&rev=050e09e091117c3d7328c7b2b7b577492c43c134"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
} }
}, },
"pre-commit-hooks": { "pre-commit-hooks": {
@ -325,7 +312,6 @@
"flint": "flint", "flint": "flint",
"foundryvtt": "foundryvtt", "foundryvtt": "foundryvtt",
"nixpkgs": "nixpkgs", "nixpkgs": "nixpkgs",
"nixpkgs-unstable": "nixpkgs-unstable",
"sonnenshift": "sonnenshift", "sonnenshift": "sonnenshift",
"sops-nix": "sops-nix" "sops-nix": "sops-nix"
} }
@ -338,11 +324,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1763619077, "lastModified": 1764578400,
"narHash": "sha256-dlfamaoIzFEgwgtzPJuw5Tl5SqjbWcV8CsbP2hVBeuI=", "narHash": "sha256-8V0SpIcYyjpP+nAHfYJDof7CofLTwVVDo5QLZ0epjOQ=",
"ref": "refs/heads/main", "ref": "refs/heads/main",
"rev": "64a2c8a3743ea6897ecac6692fba8aebc3389fca", "rev": "bf17617899692c9c2bfebfce87320a4174e6dc28",
"revCount": 26, "revCount": 27,
"type": "git", "type": "git",
"url": "ssh://git@github.com/sonnenshift/battery-manager" "url": "ssh://git@github.com/sonnenshift/battery-manager"
}, },

8
flake.nix
View file

@ -2,8 +2,7 @@
description = "tlater.net host configuration"; description = "tlater.net host configuration";
inputs = { inputs = {
nixpkgs.url = "https://channels.nixos.org/nixos-25.05-small/nixexprs.tar.xz"; nixpkgs.url = "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz";
nixpkgs-unstable.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz";
## Nix/OS utilities ## Nix/OS utilities
@ -138,10 +137,7 @@
packages.${system} = { packages.${system} = {
default = vm.config.system.build.vm; default = vm.config.system.build.vm;
} }
// import ./pkgs { // import ./pkgs { pkgs = nixpkgs.legacyPackages.${system}; };
pkgs = nixpkgs.legacyPackages.${system};
flake-inputs = inputs;
};
################### ###################
# Utility scripts # # Utility scripts #

2
modules/crowdsec/default.nix
View file

@ -271,7 +271,7 @@ in
# To add completions; sadly need to hand-roll this since # To add completions; sadly need to hand-roll this since
# neither `symlinkJoin` nor `buildEnv` have collision # neither `symlinkJoin` nor `buildEnv` have collision
# handling. # handling.
(pkgs.runCommandNoCCLocal "cscli" { } '' (pkgs.runCommandLocal "cscli" { } ''
mkdir -p $out mkdir -p $out
ln -s ${cscli}/bin $out/bin ln -s ${cscli}/bin $out/bin
ln -s ${cfg.package}/share $out/share ln -s ${cfg.package}/share $out/share

2
modules/crowdsec/remediations/cs-firewall-bouncer.nix
View file

@ -6,7 +6,7 @@
... ...
}: }:
let let
inherit (flake-inputs.self.packages.${pkgs.system}) crowdsec-firewall-bouncer; inherit (flake-inputs.self.packages.${pkgs.stdenv.hostPlatform.system}) crowdsec-firewall-bouncer;
crowdsecCfg = config.security.crowdsec; crowdsecCfg = config.security.crowdsec;
cfg = crowdsecCfg.remediationComponents.firewallBouncer; cfg = crowdsecCfg.remediationComponents.firewallBouncer;

7
pkgs/default.nix
View file

@ -1,8 +1,5 @@
{ pkgs, flake-inputs }: { pkgs }:
let
inherit (flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}) ast-grep;
in
pkgs.lib.packagesFromDirectoryRecursive { pkgs.lib.packagesFromDirectoryRecursive {
callPackage = pkgs.lib.callPackageWith (pkgs // { inherit ast-grep; }); inherit (pkgs) callPackage;
directory = ./packages; directory = ./packages;
} }