diff --git a/homelab-services/gitea/k3s/deployment.yaml b/homelab-services/gitea/k3s/deployment.yaml index e2b78b1..01dfe1c 100644 --- a/homelab-services/gitea/k3s/deployment.yaml +++ b/homelab-services/gitea/k3s/deployment.yaml @@ -52,6 +52,9 @@ spec: - name: GITEA__server__SSH_PORT value: "30222" + - name: GITEA__repository__MAX_CREATION_LIMIT + value: "0" + volumeMounts: - name: gitea-data mountPath: /var/lib/gitea diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 6e6249b..bfe9049 100755 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -110,9 +110,11 @@ disable = [ "traefik" ]; role = "server"; + # only enable the service on k3s when roughly finalized + # Until then use a vm, as k3s is persisted extraFlags = [ "--data-dir=/var/lib/rancher/k3s" - "--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql + "--cluster-cidr 10.42.0.0/20" ]; }; @@ -141,34 +143,14 @@ # BLOG SERVICE # # ================================ # - # Fullstack sourcecode + # fullstack code. Dev hosted via VMs (incus) - /* - MINIO DEPRECATED - services.minio-service = { - enable = true; - - # Persist (or don't) the data inside of database - dataDir = "/var/data/minio"; - credentialsFile = config.sops.secrets."minio-credentials".path; - - dataPort = 9000; # S3 API access - consolePort = 9001; # Admin console access - - bootstrap-minio = { - enable = true; - environments = [ - "dev" - "prod" - ]; - }; - - default-nginx = { - enable = true; - hostname = "imgs.roypository.com"; - }; - }; - */ + # ================================ # + # END BLOG SERVICE # + # ================================ # + # ================================ # + # PSQL SERVICE # + # ================================ # # Postgresql/postgrest for row storage (not on k3s) services.postgresql-db = { @@ -177,16 +159,15 @@ port = 5432; credentialsFile = config.sops.secrets."postgresql-credentials".path; databases = [ - "rdblog" "gitea" ]; ipMasks = [ - "10.42.0.0/20" # k3s cluster mask + "10.42.0.0/20" # k3s pod mask ]; }; # ================================ # - # END BLOG SERVICE # + # END PSQL SERVICE # # ================================ # # ================================ # @@ -238,6 +219,10 @@ }; }; + # Setup Incus daemon on boot + # Init with `incus admin init --minimal` + virtualisation.incus.enable = true; + networking = { hostName = meta.hostname; hostId = meta.hostId; @@ -246,6 +231,7 @@ "1.1.1.1" "1.0.0.1" ]; + nftables.enable = true; firewall = { enable = true; @@ -255,6 +241,9 @@ 443 6443 # k3s ]; + + # Trust all incusVMs (on this network interface) + trustedInterfaces = [ "incusbr0" ]; }; interfaces.eth0.ipv4.addresses = [ @@ -268,40 +257,16 @@ # Set your time zone. time.timeZone = "America/Chicago"; - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - # Select internationalisation properties. - # i18n.defaultLocale = "en_US.UTF-8"; - # console = { - # font = "Lat2-Terminus16"; - # keyMap = "us"; - # useXkbConfig = true; # use xkb.options in tty. - # }; - - # Enable the X11 windowing system. - # services.xserver.enable = true; - - # Configure keymap in X11 - # services.xserver.xkb.layout = "us"; - # services.xserver.xkb.options = "eurosign:e,caps:escape"; - # Enable CUPS to print documents. services.printing.enable = true; - # Enable sound. - # hardware.pulseaudio.enable = true; - # OR - # services.pipewire = { - # enable = true; - # pulse.enable = true; - # }; - # Define a user account. Don't forget to set a password with ‘passwd’. users.users.roy = { isNormalUser = true; - extraGroups = [ "wheel" ]; + extraGroups = [ + "wheel" + "incus-admin" + ]; hashedPassword = "$y$j9T$qHYfvijvytC69cjEWTHYA/$YF6ig1hNvkTQi0UffZP1dpilS.8O28qEY4bfdvRTXYA"; # laptop and desktop openssh.authorizedKeys.keys = [ @@ -328,8 +293,7 @@ ]; }; - # List packages installed in system profile. To search, run: - # $ nix search wget + # List packages installed in system profile environment.systemPackages = with pkgs; [ curl kitty @@ -358,14 +322,6 @@ EDITOR = "nvim"; }; - # Some programs need SUID wrappers, can be configured further or are - # started in user sessions. - # programs.mtr.enable = true; - # programs.gnupg.agent = { - # enable = true; - # enableSSHSupport = true; - # }; - # List services that you want to enable: services.openssh = { enable = true; diff --git a/nixos/secrets/gitea.yaml b/nixos/secrets/gitea.yaml index bf6f37d..3145446 100644 --- a/nixos/secrets/gitea.yaml +++ b/nixos/secrets/gitea.yaml @@ -1,4 +1,4 @@ -credentials: ENC[AES256_GCM,data:CG7CVSOP/rS1eMuaMx6DnSSKrauugLldcrlklpe3TQ8zlsXA1TeFiNywDwPWZ7Oa0i99ZFS1EaWhca/E/X93yzNO0TQ=,iv:/qd/vCo2tMuzno+Gwa/KAnfiSTfFyjs5iggRwE931Ns=,tag:7Ae3+9pCqIxKFaJQxFP7Xw==,type:str] +credentials: ENC[AES256_GCM,data:eNpZuaKurue1WN+RtYPr2GDY/Iyg13zrI2Mdi32XbJXzTdtdpXyvIheRAUE6Wi6hLFEEhDL7kgLyLns+6jhAqgmFYgZ/kqY8PlOS+T+ooyZ+wm0aM/hYhZ46OKqYgETOa+kFeDWxS7AZiLB48/a4gT8jzAb1cSp8t2Fpkw==,iv:CpDTo24HYIsWoy/yFglSmk2WBD8c6RtxOSmlDsqKF8Q=,tag:I8LdMKhTZccyCv3g12HoIg==,type:str] sops: age: - enc: | @@ -37,7 +37,7 @@ sops: o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w== -----END AGE ENCRYPTED FILE----- recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 - lastmodified: "2026-09-12T21:07:44Z" - mac: ENC[AES256_GCM,data:pUxZDthG6eK2LyiQhc3dp6TONKf+URP1JDUn6T9hjetToY9/uWXXBnpjJL1LKdsml/F/4DS9zw7Vw92vlrcYmlO8stCbC0Bbhb/4oevA1BxqXGJw/nPKwNaapy3Q7sQ8+xKXlJbOEqDC97yPiEUY6RsKErvfFo+x22wUw1j0ges=,iv:Amqkx9cRgZUCHeFk12Qf0SE07uqpR1cRy7t4mIFWRUI=,tag:Le+7hsr28EgZR+rFvVCVVg==,type:str] + lastmodified: "2026-09-12T21:33:27Z" + mac: ENC[AES256_GCM,data:rEk6x8vbIRry7cJ8Ci15kg1bR/F2oUm7rc2kavjlUM+1b2idgn4zgD6Msa/8I04TyJiDjAmDsHqKi/fLTBIk0lvfbFpPXGvId6ICKKmi1qMYvavJYkAY4Q/mJuY9rnwZVhnu3HHuvLTrkF50oNKkoxE99RQZ6fS9ItNGixZwnNA=,iv:tHh2Q7bh02xL7yCcTDWdbafWKQIfA11UQNCDnyT/arg=,tag:RpagdZ2oOYl5j86z5JfguQ==,type:str] unencrypted_suffix: _unencrypted version: 3.13.3 diff --git a/nixos/secrets/psql.yaml b/nixos/secrets/psql.yaml index 8753e27..e796886 100644 --- a/nixos/secrets/psql.yaml +++ b/nixos/secrets/psql.yaml @@ -1,4 +1,4 @@ -credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str] +credentials: ENC[AES256_GCM,data:nTeaDgmVMhbN3gsOaVcS7nYckcEv4RRWtLC7+LSqDL/m5/nJ3ALstrKZnXfL7gGO2GMU2SD5tDoAjOXQpPXR3V+smASHYmwgxs1v+QwEj+qh1OAotA==,iv:nWuXavCNi/MQFoWvsu48M2/7VQHE8CgTLfqdW66ecO0=,tag:LkaUhCvYlHdSmevTGUGSZw==,type:str] sops: age: - enc: | @@ -37,7 +37,7 @@ sops: 1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w== -----END AGE ENCRYPTED FILE----- recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 - lastmodified: "2026-09-12T19:58:55Z" - mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str] + lastmodified: "2026-09-12T21:33:12Z" + mac: ENC[AES256_GCM,data:56iH/eMqvlkysV6sEET7t3TKgCEO6x1y67PJ6Iv6numeUHDFmj2qja9FW2VOgELGyXVZFb0CbKq6GxPRtP1RBRX0yxM0GIuccVL9aJ/GfoB2wtOqr6GOKMXjmLVpXOgwy6SskNYD8S5IHkRgq7mop3ffHXkxA035cD4RQ4XyhLA=,iv:J+VRkeVNDhpVBQuKEflhwgNzmcE1ndRsflOHsP26ZdM=,tag:8kyC71Og0VWGhwLqa/jPUA==,type:str] unencrypted_suffix: _unencrypted version: 3.13.3