update gitea to be private
This commit is contained in:
+25
-69
@@ -110,9 +110,11 @@
|
||||
disable = [ "traefik" ];
|
||||
role = "server";
|
||||
|
||||
# only enable the service on k3s when roughly finalized
|
||||
# Until then use a vm, as k3s is persisted
|
||||
extraFlags = [
|
||||
"--data-dir=/var/lib/rancher/k3s"
|
||||
"--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql
|
||||
"--cluster-cidr 10.42.0.0/20"
|
||||
];
|
||||
};
|
||||
|
||||
@@ -141,34 +143,14 @@
|
||||
# BLOG SERVICE #
|
||||
# ================================ #
|
||||
|
||||
# Fullstack sourcecode
|
||||
# fullstack code. Dev hosted via VMs (incus)
|
||||
|
||||
/*
|
||||
MINIO DEPRECATED
|
||||
services.minio-service = {
|
||||
enable = true;
|
||||
|
||||
# Persist (or don't) the data inside of database
|
||||
dataDir = "/var/data/minio";
|
||||
credentialsFile = config.sops.secrets."minio-credentials".path;
|
||||
|
||||
dataPort = 9000; # S3 API access
|
||||
consolePort = 9001; # Admin console access
|
||||
|
||||
bootstrap-minio = {
|
||||
enable = true;
|
||||
environments = [
|
||||
"dev"
|
||||
"prod"
|
||||
];
|
||||
};
|
||||
|
||||
default-nginx = {
|
||||
enable = true;
|
||||
hostname = "imgs.roypository.com";
|
||||
};
|
||||
};
|
||||
*/
|
||||
# ================================ #
|
||||
# END BLOG SERVICE #
|
||||
# ================================ #
|
||||
# ================================ #
|
||||
# PSQL SERVICE #
|
||||
# ================================ #
|
||||
|
||||
# Postgresql/postgrest for row storage (not on k3s)
|
||||
services.postgresql-db = {
|
||||
@@ -177,16 +159,15 @@
|
||||
port = 5432;
|
||||
credentialsFile = config.sops.secrets."postgresql-credentials".path;
|
||||
databases = [
|
||||
"rdblog"
|
||||
"gitea"
|
||||
];
|
||||
ipMasks = [
|
||||
"10.42.0.0/20" # k3s cluster mask
|
||||
"10.42.0.0/20" # k3s pod mask
|
||||
];
|
||||
};
|
||||
|
||||
# ================================ #
|
||||
# END BLOG SERVICE #
|
||||
# END PSQL SERVICE #
|
||||
# ================================ #
|
||||
|
||||
# ================================ #
|
||||
@@ -238,6 +219,10 @@
|
||||
};
|
||||
};
|
||||
|
||||
# Setup Incus daemon on boot
|
||||
# Init with `incus admin init --minimal`
|
||||
virtualisation.incus.enable = true;
|
||||
|
||||
networking = {
|
||||
hostName = meta.hostname;
|
||||
hostId = meta.hostId;
|
||||
@@ -246,6 +231,7 @@
|
||||
"1.1.1.1"
|
||||
"1.0.0.1"
|
||||
];
|
||||
nftables.enable = true;
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
@@ -255,6 +241,9 @@
|
||||
443
|
||||
6443 # k3s
|
||||
];
|
||||
|
||||
# Trust all incusVMs (on this network interface)
|
||||
trustedInterfaces = [ "incusbr0" ];
|
||||
};
|
||||
|
||||
interfaces.eth0.ipv4.addresses = [
|
||||
@@ -268,40 +257,16 @@
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Select internationalisation properties.
|
||||
# i18n.defaultLocale = "en_US.UTF-8";
|
||||
# console = {
|
||||
# font = "Lat2-Terminus16";
|
||||
# keyMap = "us";
|
||||
# useXkbConfig = true; # use xkb.options in tty.
|
||||
# };
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
# services.xserver.enable = true;
|
||||
|
||||
# Configure keymap in X11
|
||||
# services.xserver.xkb.layout = "us";
|
||||
# services.xserver.xkb.options = "eurosign:e,caps:escape";
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
services.printing.enable = true;
|
||||
|
||||
# Enable sound.
|
||||
# hardware.pulseaudio.enable = true;
|
||||
# OR
|
||||
# services.pipewire = {
|
||||
# enable = true;
|
||||
# pulse.enable = true;
|
||||
# };
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.roy = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"incus-admin"
|
||||
];
|
||||
hashedPassword = "$y$j9T$qHYfvijvytC69cjEWTHYA/$YF6ig1hNvkTQi0UffZP1dpilS.8O28qEY4bfdvRTXYA";
|
||||
# laptop and desktop
|
||||
openssh.authorizedKeys.keys = [
|
||||
@@ -328,8 +293,7 @@
|
||||
];
|
||||
};
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
kitty
|
||||
@@ -358,14 +322,6 @@
|
||||
EDITOR = "nvim";
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
credentials: ENC[AES256_GCM,data:CG7CVSOP/rS1eMuaMx6DnSSKrauugLldcrlklpe3TQ8zlsXA1TeFiNywDwPWZ7Oa0i99ZFS1EaWhca/E/X93yzNO0TQ=,iv:/qd/vCo2tMuzno+Gwa/KAnfiSTfFyjs5iggRwE931Ns=,tag:7Ae3+9pCqIxKFaJQxFP7Xw==,type:str]
|
||||
credentials: ENC[AES256_GCM,data:eNpZuaKurue1WN+RtYPr2GDY/Iyg13zrI2Mdi32XbJXzTdtdpXyvIheRAUE6Wi6hLFEEhDL7kgLyLns+6jhAqgmFYgZ/kqY8PlOS+T+ooyZ+wm0aM/hYhZ46OKqYgETOa+kFeDWxS7AZiLB48/a4gT8jzAb1cSp8t2Fpkw==,iv:CpDTo24HYIsWoy/yFglSmk2WBD8c6RtxOSmlDsqKF8Q=,tag:I8LdMKhTZccyCv3g12HoIg==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
@@ -37,7 +37,7 @@ sops:
|
||||
o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
|
||||
lastmodified: "2026-09-12T21:07:44Z"
|
||||
mac: ENC[AES256_GCM,data:pUxZDthG6eK2LyiQhc3dp6TONKf+URP1JDUn6T9hjetToY9/uWXXBnpjJL1LKdsml/F/4DS9zw7Vw92vlrcYmlO8stCbC0Bbhb/4oevA1BxqXGJw/nPKwNaapy3Q7sQ8+xKXlJbOEqDC97yPiEUY6RsKErvfFo+x22wUw1j0ges=,iv:Amqkx9cRgZUCHeFk12Qf0SE07uqpR1cRy7t4mIFWRUI=,tag:Le+7hsr28EgZR+rFvVCVVg==,type:str]
|
||||
lastmodified: "2026-09-12T21:33:27Z"
|
||||
mac: ENC[AES256_GCM,data:rEk6x8vbIRry7cJ8Ci15kg1bR/F2oUm7rc2kavjlUM+1b2idgn4zgD6Msa/8I04TyJiDjAmDsHqKi/fLTBIk0lvfbFpPXGvId6ICKKmi1qMYvavJYkAY4Q/mJuY9rnwZVhnu3HHuvLTrkF50oNKkoxE99RQZ6fS9ItNGixZwnNA=,iv:tHh2Q7bh02xL7yCcTDWdbafWKQIfA11UQNCDnyT/arg=,tag:RpagdZ2oOYl5j86z5JfguQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.3
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str]
|
||||
credentials: ENC[AES256_GCM,data:nTeaDgmVMhbN3gsOaVcS7nYckcEv4RRWtLC7+LSqDL/m5/nJ3ALstrKZnXfL7gGO2GMU2SD5tDoAjOXQpPXR3V+smASHYmwgxs1v+QwEj+qh1OAotA==,iv:nWuXavCNi/MQFoWvsu48M2/7VQHE8CgTLfqdW66ecO0=,tag:LkaUhCvYlHdSmevTGUGSZw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
@@ -37,7 +37,7 @@ sops:
|
||||
1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
|
||||
lastmodified: "2026-09-12T19:58:55Z"
|
||||
mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str]
|
||||
lastmodified: "2026-09-12T21:33:12Z"
|
||||
mac: ENC[AES256_GCM,data:56iH/eMqvlkysV6sEET7t3TKgCEO6x1y67PJ6Iv6numeUHDFmj2qja9FW2VOgELGyXVZFb0CbKq6GxPRtP1RBRX0yxM0GIuccVL9aJ/GfoB2wtOqr6GOKMXjmLVpXOgwy6SskNYD8S5IHkRgq7mop3ffHXkxA035cD4RQ4XyhLA=,iv:J+VRkeVNDhpVBQuKEflhwgNzmcE1ndRsflOHsP26ZdM=,tag:8kyC71Og0VWGhwLqa/jPUA==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.3
|
||||
|
||||
Reference in New Issue
Block a user