tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 9 Pull requests Releases Activity

Compare commits

base: tlaternet:444d2446a666f60305802c7164d19bd12f630280
Branches Tags
tlaternet:master
tlaternet:tlater/with-minecraft
tlaternet:tlater/nixpkgs-formatting
tlaternet:tlater/authelia
...
compare: tlaternet:465f751aa952a837998ba5316f4a30d015167617
Branches Tags
tlaternet:tlater/with-minecraft
tlaternet:master
tlaternet:tlater/nixpkgs-formatting
tlaternet:tlater/authelia

3 commits
444d2446a6 ... 465f751aa9

Author SHA1 Message Date
Tristan Daniël Maat 465f751aa9
WIP: gitea: Migrate to forgejo 2023-12-29 16:48:53 +01:00
Tristan Daniël Maat b6dbe05b9e
treewide: Upgrade to NixOS 23.11 2023-12-29 16:48:50 +01:00
Tristan Daniël Maat a9d3c1c5e7
flake.lock: Update 
Flake lock file updates:

• Updated input 'deploy-rs':
    'github:serokell/deploy-rs/31c32fb2959103a796e07bbe47e0a5e287c343a8' (2023-09-12)
  → 'github:serokell/deploy-rs/915327515f5fd1b7719c06e2f1eb304ee0bdd803' (2023-12-13)
• Updated input 'deploy-rs/flake-compat':
    'github:edolstra/flake-compat/009399224d5e398d03b22badca40a37ac85412a1' (2022-11-17)
  → 'github:edolstra/flake-compat/0f9255e01c2351cc7d116c072cb317785dd33b33' (2023-10-04)
• Updated input 'deploy-rs/nixpkgs':
    'github:NixOS/nixpkgs/bb31220cca6d044baa6dc2715b07497a2a7c4bc7' (2022-12-19)
  → 'github:NixOS/nixpkgs/e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d' (2023-12-11)
• Updated input 'deploy-rs/utils':
    'github:numtide/flake-utils/5aed5285a952e0b949eb3ba02c12fa4fcfef535f' (2022-11-02)
  → 'github:numtide/flake-utils/4022d587cbbfd70fe950c1e2083a02621806a725' (2023-12-04)
• Added input 'deploy-rs/utils/systems':
    'github:nix-systems/default/da67096a3b9bf56a91d16901293e51ba5b49a27e' (2023-04-09)
• Updated input 'foundryvtt':
    'github:reckenrode/nix-foundryvtt/3358ccef0ea3e06faabe8c54761fb8a0862b80d4' (2023-08-10)
  → 'github:reckenrode/nix-foundryvtt/f624c0ceabe13dd876ecff871e0dc7f55f96e993' (2023-12-01)
• Updated input 'nixpkgs-unstable':
    'github:nixos/nixpkgs/ace5093e36ab1e95cb9463863491bee90d5a4183' (2023-09-15)
  → 'github:nixos/nixpkgs/a9bf124c46ef298113270b1f84a164865987a91c' (2023-12-11)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/ea208e55f8742fdcc0986b256bdfa8986f5e4415' (2023-09-12)
  → 'github:Mic92/sops-nix/d806e546f96c88cd9f7d91c1c19ebc99ba6277d9' (2023-12-10)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/5601118d39ca9105f8e7b39d4c221d3388c0419d' (2023-09-02)
  → 'github:NixOS/nixpkgs/b8f33c044e51de6dde3ad80a9676945e0e4e3227' (2023-12-09)
 2023-12-29 16:48:47 +01:00
6 changed files with 97 additions and 82 deletions
Show stats Expand all files Collapse all files

81
configuration/services/gitea.nix
View file

@ -6,12 +6,10 @@
}: let }: let
domain = "gitea.${config.services.nginx.domain}"; domain = "gitea.${config.services.nginx.domain}";
in { in {
services.gitea = { services.forgejo = {
enable = true; enable = true;
database.type = "postgres"; database.type = "postgres";
appName = "Gitea: Git with a cup of tea";
settings = { settings = {
server = { server = {
DOMAIN = domain; DOMAIN = domain;
@ -29,18 +27,18 @@ in {
}; };
}; };
systemd.services.gitea.serviceConfig.ExecStartPre = let systemd.services.forgejo.serviceConfig.ExecStartPre = let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret"; replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."gitea/metrics-token".path; secretPath = config.sops.secrets."forgejo/metrics-token".path;
runConfig = "${config.services.gitea.customDir}/conf/app.ini"; runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
in [ in [
"+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
]; ];
# Set up SSL # Set up SSL
services.nginx.virtualHosts."${domain}" = let services.nginx.virtualHosts."${domain}" = let
httpAddress = config.services.gitea.settings.server.HTTP_ADDR; httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
httpPort = config.services.gitea.settings.server.HTTP_PORT; httpPort = config.services.forgejo.settings.server.HTTP_PORT;
in { in {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
@ -62,40 +60,39 @@ in {
# Block repeated failed login attempts # Block repeated failed login attempts
# #
# TODO(tlater): Update to the new regex, since apparently this one # TODO(tlater): Update this - we switched to forgejo, who knows what
# is deprecated (but the new one doesn't work on the current version # the new matches are.
# of gitea yet): https://docs.gitea.io/en-us/fail2ban-setup/ # environment.etc = {
environment.etc = { # "fail2ban/filter.d/gitea.conf".text = ''
"fail2ban/filter.d/gitea.conf".text = '' # [Definition]
[Definition] # failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST> # journalmatch = _SYSTEMD_UNIT=forgejo.service + _COMM=forgejo + SYSLOG_IDENTIFIER=forgejo
journalmatch = _SYSTEMD_UNIT=gitea.service + _COMM=gitea + SYSLOG_IDENTIFIER=gitea # '';
''; # };
};
services.fail2ban.jails = { # services.fail2ban.jails = {
gitea = '' # gitea = ''
enabled = true # enabled = true
''; # '';
}; # };
services.backups.gitea = { # services.backups.forgejo = {
user = "gitea"; # user = "forgejo";
paths = [ # paths = [
"/var/lib/gitea/gitea-db.sql" # "/var/lib/forgejo/forgejo-db.sql"
"/var/lib/gitea/repositories/" # "/var/lib/forgejo/repositories/"
"/var/lib/gitea/data/" # "/var/lib/forgejo/data/"
"/var/lib/gitea/custom/" # "/var/lib/forgejo/custom/"
# Conf is backed up via nix # # Conf is backed up via nix
]; # ];
preparation = { # preparation = {
packages = [config.services.postgresql.package]; # packages = [config.services.postgresql.package];
text = "pg_dump ${config.services.gitea.database.name} --file=/var/lib/gitea/gitea-db.sql"; # text = "pg_dump ${config.services.forgejo.database.name} --file=/var/lib/forgejo/forgejo-db.sql";
}; # };
cleanup = { # cleanup = {
packages = [pkgs.coreutils]; # packages = [pkgs.coreutils];
text = "rm /var/lib/gitea/gitea-db.sql"; # text = "rm /var/lib/forgejo/forgejo-db.sql";
}; # };
pauseServices = ["gitea.service"]; # pauseServices = ["forgejo.service"];
}; # };
} }

6
configuration/services/metrics/victoriametrics.nix
View file

@ -6,9 +6,9 @@
]; ];
scrapeConfigs = { scrapeConfigs = {
gitea = { forgejo = {
targets = ["127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}"]; targets = ["127.0.0.1:${toString config.services.forgejo.settings.server.HTTP_PORT}"];
extraSettings.authorization.credentials_file = config.sops.secrets."gitea/metrics-token".path; extraSettings.authorization.credentials_file = config.sops.secrets."forgejo/metrics-token".path;
}; };
coturn.targets = ["127.0.0.1:9641"]; coturn.targets = ["127.0.0.1:9641"];
}; };

4
configuration/sops.nix
View file

@ -4,8 +4,8 @@
secrets = { secrets = {
# Gitea # Gitea
"gitea/metrics-token" = { "forgejo/metrics-token" = {
owner = "gitea"; owner = "forgejo";
group = "metrics"; group = "metrics";
mode = "0440"; mode = "0440";
}; };

76
flake.lock
View file

@ -41,11 +41,11 @@
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1694513707, "lastModified": 1702460489,
"narHash": "sha256-wE5kHco3+FQjc+MwTPwLVqYz4hM7uno2CgXDXUFMCpc=", "narHash": "sha256-H6s6oVLvx7PCjUcvfkB89Bb+kbaiJxTAgWfMjiQTjA0=",
"owner": "serokell", "owner": "serokell",
"repo": "deploy-rs", "repo": "deploy-rs",
"rev": "31c32fb2959103a796e07bbe47e0a5e287c343a8", "rev": "915327515f5fd1b7719c06e2f1eb304ee0bdd803",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -160,11 +160,11 @@
"flake-compat": { "flake-compat": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1668681692, "lastModified": 1696426674,
"narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=", "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra", "owner": "edolstra",
"repo": "flake-compat", "repo": "flake-compat",
"rev": "009399224d5e398d03b22badca40a37ac85412a1", "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -229,7 +229,7 @@
}, },
"flake-utils": { "flake-utils": {
"inputs": { "inputs": {
"systems": "systems" "systems": "systems_2"
}, },
"locked": { "locked": {
"lastModified": 1692799911, "lastModified": 1692799911,
@ -267,11 +267,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1691701569, "lastModified": 1701473318,
"narHash": "sha256-7TK+sO+JC37OGTQDTiz9TriqbB5yTgoo7fyPyLtWvd8=", "narHash": "sha256-QdCJN8GeNl/V8wMjrvNkrWzNXnahgfjBfCSya4qQdrc=",
"owner": "reckenrode", "owner": "reckenrode",
"repo": "nix-foundryvtt", "repo": "nix-foundryvtt",
"rev": "3358ccef0ea3e06faabe8c54761fb8a0862b80d4", "rev": "f624c0ceabe13dd876ecff871e0dc7f55f96e993",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -345,11 +345,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1671417167, "lastModified": 1702272962,
"narHash": "sha256-JkHam6WQOwZN1t2C2sbp1TqMv3TVRjzrdoejqfefwrM=", "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "bb31220cca6d044baa6dc2715b07497a2a7c4bc7", "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -361,11 +361,11 @@
}, },
"nixpkgs-stable": { "nixpkgs-stable": {
"locked": { "locked": {
"lastModified": 1693675694, "lastModified": 1702148972,
"narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=", "narHash": "sha256-h2jODFP6n+ABrUWcGRSVPRFfLOkM9TJ2pO+h+9JcaL0=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d", "rev": "b8f33c044e51de6dde3ad80a9676945e0e4e3227",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -377,11 +377,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1694767346, "lastModified": 1702312524,
"narHash": "sha256-5uH27SiVFUwsTsqC5rs3kS7pBoNhtoy9QfTP9BmknGk=", "narHash": "sha256-gkZJRDBUCpTPBvQk25G0B7vfbpEYM5s5OZqghkjZsnE=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "ace5093e36ab1e95cb9463863491bee90d5a4183", "rev": "a9bf124c46ef298113270b1f84a164865987a91c",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -408,16 +408,16 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1694937365, "lastModified": 1702346276,
"narHash": "sha256-iHZSGrb9gVpZRR4B2ishUN/1LRKWtSHZNO37C8z1SmA=", "narHash": "sha256-eAQgwIWApFQ40ipeOjVSoK4TEHVd6nbSd9fApiHIw5A=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "5d017a8822e0907fb96f7700a319f9fe2434de02", "rev": "cf28ee258fd5f9a52de6b9865cdb93a1f96d09b7",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "nixos", "owner": "nixos",
"ref": "nixos-23.05", "ref": "nixos-23.11",
"repo": "nixpkgs", "repo": "nixpkgs",
"type": "github" "type": "github"
} }
@ -556,11 +556,11 @@
"nixpkgs-stable": "nixpkgs-stable" "nixpkgs-stable": "nixpkgs-stable"
}, },
"locked": { "locked": {
"lastModified": 1694495315, "lastModified": 1702177193,
"narHash": "sha256-sZEYXs9T1NVHZSSbMqBEtEm2PGa7dEDcx0ttQkArORc=", "narHash": "sha256-J2409SyXROoUHYXVy9h4Pj0VU8ReLuy/mzBc9iK4DBg=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "ea208e55f8742fdcc0986b256bdfa8986f5e4415", "rev": "d806e546f96c88cd9f7d91c1c19ebc99ba6277d9",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -584,6 +584,21 @@
"type": "github" "type": "github"
} }
}, },
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"tlaternet-webserver": { "tlaternet-webserver": {
"inputs": { "inputs": {
"dream2nix": "dream2nix", "dream2nix": "dream2nix",
@ -607,12 +622,15 @@
} }
}, },
"utils": { "utils": {
"inputs": {
"systems": "systems"
},
"locked": { "locked": {
"lastModified": 1667395993, "lastModified": 1701680307,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=", "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
"owner": "numtide", "owner": "numtide",
"repo": "flake-utils", "repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f", "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
"type": "github" "type": "github"
}, },
"original": { "original": {

2
flake.nix
View file

@ -2,7 +2,7 @@
description = "tlater.net host configuration"; description = "tlater.net host configuration";
inputs = { inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05"; nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable"; nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
deploy-rs.url = "github:serokell/deploy-rs"; deploy-rs.url = "github:serokell/deploy-rs";
sops-nix = { sops-nix = {

10
keys/production.yaml
View file

@ -1,5 +1,5 @@
gitea: forgejo:
metrics-token: ENC[AES256_GCM,data:/7/zvVl2ZOBoekrJR32vl/QQcG5XqTmltgpHEMUpbXVeqwnq29idzE2Qyjau96ZHObmSI73/ZtW95uXF6LH9Qw==,iv:iWZECCZSh1CN7wMBqstXR5QWtriR7QLKVqhekGnpXl0=,tag:HEr9km8VYmruBzf0I/5HuA==,type:str] metrics-token: ENC[AES256_GCM,data:WVbD5JloJlHNjeEwe1uEd4Haj6L3ilj1Pnux6yrelUQP18ZPAh90aDO1OIZHaPJR7tTeyATr8BIzZL1zkNhCuA==,iv:eTYXN3hymIN3bTX1YxNGkAYE0KVDbdz2ds8UQAHlALE=,tag:A61loGdu0pfsiez96u2Qsg==,type:str]
grafana: grafana:
adminPassword: ENC[AES256_GCM,data:/qw//J7cOkIGa58bG4GgdzndvKof32AmQeWB00IX8WhA22PDCOc4VdUEoB3wVJJqI/ucoHFInYyhg2rFYoYBesBjAt0QS3+O+8WblIunUuYeqlBuYJJK1TLhy6ql6+aqvfiW/rJLm4LpgA7CboyDD2OYHcAbvGSD2GWwFcHTR/Y=,iv:KK6p8GKzc9SBDZZFkEwCdIjSxriPGNMDNcr97tfbwTI=,tag:gLRNSGdJWFD+V9K5TfJvXw==,type:str] adminPassword: ENC[AES256_GCM,data:/qw//J7cOkIGa58bG4GgdzndvKof32AmQeWB00IX8WhA22PDCOc4VdUEoB3wVJJqI/ucoHFInYyhg2rFYoYBesBjAt0QS3+O+8WblIunUuYeqlBuYJJK1TLhy6ql6+aqvfiW/rJLm4LpgA7CboyDD2OYHcAbvGSD2GWwFcHTR/Y=,iv:KK6p8GKzc9SBDZZFkEwCdIjSxriPGNMDNcr97tfbwTI=,tag:gLRNSGdJWFD+V9K5TfJvXw==,type:str]
secretKey: ENC[AES256_GCM,data:OUXWOE6I3a26SrFEOczWNIwyR3Rx62fbsRBBcfh0xyEbxOIPhexH6lIqlVG9Ltwra9+rAldNM4/0BydtxIDj7A==,iv:fiNO/or5yZnhpDPMANDnEC5dtXmbKBZsV+BPmvCN/HI=,tag:Q0M0OtLWdWAJgQmUlL//fg==,type:str] secretKey: ENC[AES256_GCM,data:OUXWOE6I3a26SrFEOczWNIwyR3Rx62fbsRBBcfh0xyEbxOIPhexH6lIqlVG9Ltwra9+rAldNM4/0BydtxIDj7A==,iv:fiNO/or5yZnhpDPMANDnEC5dtXmbKBZsV+BPmvCN/HI=,tag:Q0M0OtLWdWAJgQmUlL//fg==,type:str]
@ -26,8 +26,8 @@ sops:
azure_kv: [] azure_kv: []
hc_vault: [] hc_vault: []
age: [] age: []
lastmodified: "2023-10-12T18:40:26Z" lastmodified: "2023-12-28T00:07:08Z"
mac: ENC[AES256_GCM,data:F+yQ20jCtLRKeQDFVKoqrYCgtwGkXxrK6aQO0MFZTIMJAnbTVPM2ZJGQ1RxXb+Zs4T+44EEc2xN4LjeANvgpE6MfOz2VTw+sEEjcYwUyB6RcXHia9XlFLa8lh7/Wx/9DxlSFjjSrxmDkNB6r+n5UF81cdRXF2E9ibdH346ST98A=,iv:xVxFN1IDKrLskaGqnWvOWx1zUII0jRSjQxEsaTf2GNw=,tag:lnp1AvgMOXXlg1vFjHEWUQ==,type:str] mac: ENC[AES256_GCM,data:P2bNJLjzn69Kg2bJHXmofER7J8wbEj9C4jq9ePWewXBOt45GEiqgnqIaISwZkyzQmm9cxZd95Lr780ICwoKDFdtSCCcC7CdYxYEfyyhnvU3W2qzEghvkypL8JbiEtPSlQ9xOlCk7p41A9eRrV+JziIVSv5UEUs4NubrG9Mkwv3k=,iv:Yq2gANTTgx6cFxkdustUZ1MPszxGSkao/bS1KHAkzJc=,tag:kqJibocgRQXkxTJze6O5MA==,type:str]
pgp: pgp:
- created_at: "2022-10-12T00:46:51Z" - created_at: "2022-10-12T00:46:51Z"
enc: | enc: |
@ -65,4 +65,4 @@ sops:
-----END PGP MESSAGE----- -----END PGP MESSAGE-----
fp: 8a3737d48f1035fe6c3a0a8fd6a1976ca74c7f3b fp: 8a3737d48f1035fe6c3a0a8fd6a1976ca74c7f3b
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.7.3 version: 3.8.1