From 3ebec257d7bc2e17e52a305c99459ece013610b5 Mon Sep 17 00:00:00 2001 From: Roy Dumblauskas Date: Tue, 20 Oct 2026 23:56:55 -0500 Subject: [PATCH] add gitea service to vm --- nixos/configuration.nix | 8 +++- virtual-machines/vm-test/secrets/gitea.env | 13 +++++++ virtual-machines/vm-test/secrets/psql.env | 6 +-- virtual-machines/vm-test/virtual.nix | 44 ++++++++++++++++++++++ 4 files changed, 66 insertions(+), 5 deletions(-) create mode 100644 virtual-machines/vm-test/secrets/gitea.env diff --git a/nixos/configuration.nix b/nixos/configuration.nix index e405796..95e90c2 100755 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -225,8 +225,6 @@ enable = true; allowedTCPPorts = [ 22 - 80 - 443 6443 # k3s ]; @@ -326,6 +324,12 @@ path = "/persist/etc/ssh/ssh_host_rsa_key"; } ]; + + # Don't allow remote password login + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + }; }; # INITIAL system version diff --git a/virtual-machines/vm-test/secrets/gitea.env b/virtual-machines/vm-test/secrets/gitea.env new file mode 100644 index 0000000..30e0d17 --- /dev/null +++ b/virtual-machines/vm-test/secrets/gitea.env @@ -0,0 +1,13 @@ +GITEA_DB_NAME=ENC[AES256_GCM,data:zEhMvGo=,iv:HxxKDckuk8wzV9k1be2kbhWWwKN5C36Mciaj+RbNfRQ=,tag:l2JTkvzVSiSD8RmMWPY/pw==,type:str] +GITEA_DB_USER=ENC[AES256_GCM,data:I7w/mZ7yq9yeHA==,iv:N3hT4f6BcH4xt0Z+YowTSM/MLIV4C1afM+2MYMFYAlg=,tag:tiUDZ9UvE/Rzmfcw69kK9Q==,type:str] +GITEA_DB_PASS=ENC[AES256_GCM,data:TRG6S/fCrJ8=,iv:gAmGfL0vapgSIf7Gyhm12ibKRmBurN5IBJIcRVki/PY=,tag:Zinc2oTv+jlZ+E+wgEvIwQ==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzQ3FuUzJSUmRSK05JU1Rt\nbnBmU3pmMG02dzRTY2srYnZURDJvVFhlc0ZJCkxrN0MxRThqTHBDbkxpdXNCNE55\nY3RSTjRSUkxBZExxa2hSMUtKNUtiUmsKLS0tIHcwMUdlejJqS3NxdEd3bDNCamlY\nTkFFeTM2eG9vZlB5eW9pQ3hxam1WMmsKk2qivwtZFzmbj/ulbYx1AwUCkHuGbv+o\nm1ipBqm3qnVHF5Q8L03EndCeKfqgIRjT8oQ8s/Djb8NA58emlsRhZw==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y +sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArYVBtUWlDOFhsaWdTTXRO\nSGorQkJiS2d6SXZPK25LeVN2RVpiYlFnRjEwCmhaOG82K1FMcnU2VWpDSW9HUmZv\nWEtMbXBYcVhic3RyaFhPejl6elJ0bGMKLS0tIHpMa3VvYTF1TzZWNGVPY3ZmSWl1\nWm1ZVmxoR2M1cWhmWXlGTFkxQ1pWaDQKqJX/oxX6Kb+YB/haTHAvqNctfW6QA3eO\nPtbErC6H4DMSNYvHHVSapejD1ENNoH2CGpCKkgZiil+gP3fz0pR6Rw==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj +sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQc2oydjZYOHVCSzM0N1FK\naGhMYWdoaWNmWTZPNEI1K29YSnlOWmh6WEJZCk11T2Q4RVdJR3J4RmpDcWh2dmE1\nZFFGdHEvTUF3cHMxZWlGbm5IaFhJZ3MKLS0tIDFYdHZva3kzVGdCZlJTeFFCRjJY\nc1B0ZGU1aCtKVW5qbXdNNkIvTmhPYUkKUdlj41Bun0Bo/5zMKKYVrw9CsbfysWKR\n0lBTXB/F3B+9t03fuY+3QmqsAZdQxRdtdGA15jYLeLfDIHjCNDM6mQ==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_2__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 +sops_lastmodified=2026-10-21T04:55:18Z +sops_mac=ENC[AES256_GCM,data:f79R0ImdGWtaPQ7S8U6/sSUArI17sOBHZYfRFs9oft4rg7nF84Umpy9Tjsy4whjRHQjpPy5iQIWORAkdVsZ4ecW0KTwDTzXAjuXYlxxoTqKkyWQOOF2X2uhZalwpw4e+RM+vkXL6qatlkFcKz3STG7/T3i4NvOa+fmMh6+vZnCc=,iv:GQU2vsU4AS629V62rCVAU8gsT+vuXFamx7/3MBhEsTA=,tag:ZkkTD7Ku0FGwyDJia1SsAQ==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.13.3 diff --git a/virtual-machines/vm-test/secrets/psql.env b/virtual-machines/vm-test/secrets/psql.env index 44af0f3..21a54c4 100644 --- a/virtual-machines/vm-test/secrets/psql.env +++ b/virtual-machines/vm-test/secrets/psql.env @@ -1,4 +1,4 @@ -PSQL_TEST_PASSWORD=ENC[AES256_GCM,data:23yfH/WahP629zM=,iv:d7MCyz1OD/Ns1D4KMMtOhMMnG3WVXG406sUA5Xv0eFw=,tag:QTa5Akrd/co03MZn5C2VPA==,type:str] +PSQL_GITEA_PASSWORD=ENC[AES256_GCM,data:tT/Uym0M6GY=,iv:4+UJmz6AD7K4qn4HfPNFafV0Bqi17Pr1LU+wARn9X44=,tag:wyD7gdV+vibdgFnExyooMw==,type:str] sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdlFYVmFFMkhtUUpBc3M3\nL2pURXdFbzZpWW03TDM3cHIwdXpLMU9kS2k0CmZDRWN5Q1g4VkdLb29xRkI3TFhm\nUUcvdXNQMUUxdHJKcWt5VDJsY2YrNEEKLS0tIGhVSzMvYkJFOHZJd0RSNW5DNHIx\ncG42bzY0OUIzZzUreU5NU0FvN3NPZzQKZZ0Yko7SsaOtd/cdC1WBn0L8OWLCm2Bb\nXgeTlJzEk7x9uGZYflbEuO9NFPTH5lx7wsfliDbGpIFA2WadbhFsXQ==\n-----END AGE ENCRYPTED FILE-----\n sops_age__list_0__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByb3BCMzhEREtOUk5SY25H\nbENkMnlLSUhIc3pBc3BPZHlSc3dwYXg5T1NFCi8xcm93N01wbWo1ZkgycU51c1Qz\nbEVwQ1pxWXdkbGFWN3ppSFJsa0gxbWcKLS0tIFN2Q2p2K3VWUTdld0kzSldSS1pV\nOTN5YnBGVG9TN09xT1FmZDFSNTBjbDAKo9Lxc2BEMnGdF63Mx/4ZFtB0BvNZYj2b\nTN+af9mWJb6BRVHTlGJt914fKHUCNhO/SdoKbqq4A3+kv/w29m97NA==\n-----END AGE ENCRYPTED FILE-----\n @@ -7,7 +7,7 @@ sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb2 sops_age__list_2__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSNzNnQ0hTQXIvZDhEcVdo\nVGdYQ253NG9DWHl6TWdaQndpVnJwRENmSVFNCnFuZU9oeTI3cWpjc1hBd2ZWYXJy\naWg3bEthUzlJTSs3R2dSazBzOENnQ1UKLS0tIE1rVlhXOUFGdU10dU9KRlIvYm8w\nMmluaWlTQ29ONU0xUXVGcFdoRWNnVFUK1RKPj+VL7lHPixt0WB+KKRl7S5L/yaBc\nA+wpzVxDXDGysBrPm3ENfVeSStxgUhd6YsV06py9+AbJkLoXKVELJQ==\n-----END AGE ENCRYPTED FILE-----\n sops_age__list_3__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y -sops_lastmodified=2026-09-26T06:04:51Z -sops_mac=ENC[AES256_GCM,data:Q4AhgLZLR6hSSiwextwm53DHKKeSN+YSLKyQGNfZG/sb/c+4QOQxYXZD2YXShbOei1Og+IqcVCkJy+CaYAE6roz04AxnQgis3anVOSOAMAcezFndXU/f80pqkikj/o14O6ueOi/2gQMJND9HHEZSJBAwpJbsX1CLru16Uv2gkaY=,iv:nItKXHq2sgw8ijA5d/DxeTAafkwIUuxJXyXOP8gDuL0=,tag:oNYfflLLKhhQN8H1DRBVUQ==,type:str] +sops_lastmodified=2026-10-21T04:55:45Z +sops_mac=ENC[AES256_GCM,data:444WNcnJjuE09R9ERw5VV5vGXEo1coHKaa37luYKejcV/TNpzaeyJu9b+5UmMVJuYNm878l6tX/gmoTfliocn6Z4RaoWnNP0H5VkUw9khA3zksnrxUfpaG1CIR53BP0ZhuqMDhpvYYA1crhHUJhT0PRBdAlDluivlt627K8L4Sc=,iv:oObMPvFlsnGmseVJNAj/mMHCeyaFp4JvjedYVmz+PBA=,tag:HtV1wM+vyhpZv+x1Yd47Ww==,type:str] sops_unencrypted_suffix=_unencrypted sops_version=3.13.3 diff --git a/virtual-machines/vm-test/virtual.nix b/virtual-machines/vm-test/virtual.nix index 94e7915..d0d80ea 100644 --- a/virtual-machines/vm-test/virtual.nix +++ b/virtual-machines/vm-test/virtual.nix @@ -35,6 +35,36 @@ }; }; + # Networking + networking = { + hostName = "nixos-vm-test-00"; + hostId = "9C7030FE"; + defaultGateway = "192.168.8.1"; + nameservers = [ + "1.1.1.1" + "1.0.0.1" + ]; + nftables.enable = true; + + firewall = { + enable = true; + allowedTCPPorts = [ + 22 + 80 # gitea routing not enabled, open firewall here + 443 # gitea routing not enabled, open firewall here + 30222 # gitea routing not enabled, open firewall here + 6443 # k3s + ]; + }; + + interfaces.eth0.ipv4.addresses = [ + { + address = "192.168.8.180"; + prefixLength = 24; + } + ]; + }; + # Packages environment.systemPackages = with pkgs; [ curl @@ -63,6 +93,20 @@ ]; }; + # ================================ # + # GITEA SERVICE # + # ================================ # + + services.hl-gitea = { + enable = true; + credentialsFile = credentials.gitea-env; + database-hostname = "${config.ipAddrs.${meta.hostname}}:5432"; # whatever port I host psql on below + + default-nginx = { + enable = false; + }; + }; + # ================================ # # PSQL SERVICE # # ================================ #