From e1aa2b47d37d051d98d44565616bc2c4e35770de Mon Sep 17 00:00:00 2001 From: Roy Dumblauskas Date: Fri, 25 Sep 2026 23:56:39 -0500 Subject: [PATCH] le grande update --- homelab-services/mc-service/flake.lock | 12 +- homelab-services/minio-service/flake.lock | 27 --- homelab-services/minio-service/flake.nix | 245 ---------------------- homelab-services/nimh-static/flake.lock | 6 +- homelab-services/postgresql-db/flake.lock | 6 +- nixos/flake.lock | 72 +++---- 6 files changed, 48 insertions(+), 320 deletions(-) delete mode 100755 homelab-services/minio-service/flake.lock delete mode 100755 homelab-services/minio-service/flake.nix diff --git a/homelab-services/mc-service/flake.lock b/homelab-services/mc-service/flake.lock index 18ec962..9e62797 100644 --- a/homelab-services/mc-service/flake.lock +++ b/homelab-services/mc-service/flake.lock @@ -23,11 +23,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1782091909, - "narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=", + "lastModified": 1790310854, + "narHash": "sha256-QuU33Sw5IjLKKq8xitpNSHnOUTgjTG9ZQdqOdIRz4F8=", "owner": "Infinidoge", "repo": "nix-minecraft", - "rev": "794884dacd31b251bce5abf2cf324be3659d5322", + "rev": "8945905e42ce06b68464fcd7614937bb382a95f2", "type": "github" }, "original": { @@ -54,11 +54,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1781808408, - "narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e8210c649915deed7080033cdbabcc19e40bb899", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { diff --git a/homelab-services/minio-service/flake.lock b/homelab-services/minio-service/flake.lock deleted file mode 100755 index aa10abf..0000000 --- a/homelab-services/minio-service/flake.lock +++ /dev/null @@ -1,27 +0,0 @@ -{ - "nodes": { - "nixpkgs": { - "locked": { - "lastModified": 1781216227, - "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-26.05", - "repo": "nixpkgs", - "type": "github" - } - }, - "root": { - "inputs": { - "nixpkgs": "nixpkgs" - } - } - }, - "root": "root", - "version": 7 -} diff --git a/homelab-services/minio-service/flake.nix b/homelab-services/minio-service/flake.nix deleted file mode 100755 index 71864b0..0000000 --- a/homelab-services/minio-service/flake.nix +++ /dev/null @@ -1,245 +0,0 @@ -{ - description = "minio service for storing images with api access"; - - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; - }; - - outputs = - { ... }: - { - nixosModules.minio-service = - { - config, - lib, - pkgs, - ... - }: - let - opts = config.services.minio-service; - in - { - options.services.minio-service = { - enable = lib.mkEnableOption "MinIO object storage server"; - - dataDir = lib.mkOption { - type = lib.types.path; - default = "/var/lib/minio"; - description = "Directory to store MinIO data."; - }; - - dataPort = lib.mkOption { - type = lib.types.port; - default = 9000; - description = "MinIO S3 API port."; - }; - - consolePort = lib.mkOption { - type = lib.types.port; - default = 9001; - description = "MinIO Admin Console port."; - }; - - credentialsFile = lib.mkOption { - type = lib.types.path; - description = "File containing MinIO credentials."; - }; - - bootstrap-minio = { - enable = lib.mkEnableOption "Enable bootstrapping minio creds"; - environments = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - description = "list of environments to bootstrap (dev, prod, stage, etc)"; - }; - }; - - default-nginx = { - enable = lib.mkEnableOption "Enable nginx reverse proxy for MinIO"; - hostname = lib.mkOption { - type = lib.types.str; - default = "localhost"; - description = "Hostname for nginx reverse proxy."; - }; - }; - }; - - config = lib.mkIf opts.enable { - users.groups.minio = { }; - users.users.minio = { - isSystemUser = true; - createHome = true; - home = "${opts.dataDir}"; - group = "minio"; - }; - - systemd.services.minio = { - description = "MinIO S3-compatible object storage"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - - serviceConfig = { - ExecStart = '' - ${pkgs.minio}/bin/minio server ${opts.dataDir} \ - --address ":${toString opts.dataPort}" \ - --console-address ":${toString opts.consolePort}" - ''; - - User = "minio"; - Group = "minio"; - # This breaks the local browser access - # Environment = '' - # MINIO_BROWSER_REDIRECT_URL=https://${opts.default-nginx.hostname}/console - # ''; - EnvironmentFile = "${opts.credentialsFile}"; - Restart = "always"; - }; - }; - - systemd.services.bootstrap-minio = lib.mkIf opts.bootstrap-minio.enable { - description = "Minio bootstrap users, policies, buckets"; - after = [ "minio.service" ]; - requires = [ "minio.service" ]; - wantedBy = [ "multi-user.target" ]; - - serviceConfig = { - Type = "oneshot"; - ExecStart = pkgs.writeShellScript "bootstrap-minio" '' - - set -euo pipefail - - alias_name="local" - mc_bin=${pkgs.minio-client}/bin/mc - - # Delete alias if it already exists - $mc_bin alias rm "$alias_name" || true - - # Point mc at the local minio instance - $mc_bin alias set "$alias_name" http://localhost:${toString opts.dataPort} \ - "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" - - # Loop through requested environments - for env in ${lib.escapeShellArgs opts.bootstrap-minio.environments}; do - bucket="$env" - user_var="MINIO_''${env^^}_USER" - pass_var="MINIO_''${env^^}_PASSWORD" - - # expand env var names dynamically - user_val=$(eval "echo \''${$user_var:-}") - pass_val=$(eval "echo \''${$pass_var:-}") - - if [ -z "$user_val" ] || [ -z "$pass_val" ]; then - echo "Missing credentials for $env ($user_var / $pass_var)" >&2 - exit 1 - fi - - policy="policy-$env" - - echo "Bootstrapping environment: $env" - - # Create bucket if not exists - $mc_bin mb --ignore-existing "$alias_name/$bucket" - - # Set bucket limit in future - # $mc_bin bucket quota is deprecated - - # Create policy JSON (full access to that bucket) - policy_file=$(mktemp) - cat > "$policy_file" </dev/null 2>&1; then - $mc_bin admin user add "$alias_name" "$user_val" "$pass_val" - echo "Created user $user_val" - fi - - # Attach policy - $mc_bin admin policy attach "$alias_name" "$policy" --user "''${user_val}" - - # Cleanup - rm -f "$policy_file" - - done - ''; - User = "minio"; - Group = "minio"; - EnvironmentFile = "${opts.credentialsFile}"; - - }; - }; - - services.nginx = lib.mkIf opts.default-nginx.enable { - enable = true; - - virtualHosts.${opts.default-nginx.hostname} = { - forceSSL = true; - - # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period) - useACMEHost = - let - b = builtins; - s = lib.strings; - fl = s.splitString "." "${opts.default-nginx.hostname}"; - in - b.concatStringsSep "." [ - (b.elemAt fl (b.length fl - 2)) - (b.elemAt fl (b.length fl - 1)) - ]; - - # This does not work even with the MINIO_BROWSER_REDIRECT_URL set - locations."/console" = { - proxyPass = "http://localhost:${toString opts.consolePort}"; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - ''; - }; - - # Add directive for s3like queries, which only accept root path allegedly - locations."/" = { - proxyPass = "http://localhost:${toString opts.dataPort}"; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - client_max_body_size 0; - proxy_buffering off; - ''; - }; - }; - }; - - networking.firewall.allowedTCPPorts = lib.mkMerge [ - (lib.mkIf opts.enable [ - opts.dataPort - opts.consolePort - ]) - (lib.mkIf opts.default-nginx.enable [ - 80 - 443 - ]) - ]; - }; - }; - }; -} diff --git a/homelab-services/nimh-static/flake.lock b/homelab-services/nimh-static/flake.lock index aa10abf..90714f4 100644 --- a/homelab-services/nimh-static/flake.lock +++ b/homelab-services/nimh-static/flake.lock @@ -2,11 +2,11 @@ "nodes": { "nixpkgs": { "locked": { - "lastModified": 1781216227, - "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { diff --git a/homelab-services/postgresql-db/flake.lock b/homelab-services/postgresql-db/flake.lock index c37e6c2..90714f4 100644 --- a/homelab-services/postgresql-db/flake.lock +++ b/homelab-services/postgresql-db/flake.lock @@ -2,11 +2,11 @@ "nodes": { "nixpkgs": { "locked": { - "lastModified": 1789114715, - "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "21a67dc470149f337cecafbe965d8d252a390518", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { diff --git a/nixos/flake.lock b/nixos/flake.lock index a165c33..23d60a7 100755 --- a/nixos/flake.lock +++ b/nixos/flake.lock @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1781152676, - "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", + "lastModified": 1789770686, + "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=", "owner": "nix-community", "repo": "disko", - "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", + "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563", "type": "github" }, "original": { @@ -28,11 +28,11 @@ }, "locked": { "dir": "pkgs/firefox-addons", - "lastModified": 1789185767, - "narHash": "sha256-jaWL9beN3ifjNzNEBxo0abA+TSi0n7Q8LRQvZTxEqaM=", + "lastModified": 1790395354, + "narHash": "sha256-UfIw3T23XyA9pGul+UbDQ1QW0SfpGI1zC/aQonx3mDI=", "owner": "rycee", "repo": "nur-expressions", - "rev": "811170bb74b11f3b9489618ce77487cc58c79067", + "rev": "f2188a86e55cd04677a31a9b101dc702024479c7", "type": "gitlab" }, "original": { @@ -100,11 +100,11 @@ ] }, "locked": { - "lastModified": 1789182507, - "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=", + "lastModified": 1790215976, + "narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=", "owner": "nix-community", "repo": "home-manager", - "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71", + "rev": "a6631107a83ceab5872f298a2ea710859c80c4cb", "type": "github" }, "original": { @@ -190,11 +190,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1782091909, - "narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=", + "lastModified": 1790310854, + "narHash": "sha256-QuU33Sw5IjLKKq8xitpNSHnOUTgjTG9ZQdqOdIRz4F8=", "owner": "Infinidoge", "repo": "nix-minecraft", - "rev": "794884dacd31b251bce5abf2cf324be3659d5322", + "rev": "8945905e42ce06b68464fcd7614937bb382a95f2", "type": "github" }, "original": { @@ -205,11 +205,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1787525875, - "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a3b98866eecd08edac6e61a3081e69540a35020f", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { @@ -253,11 +253,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1781808408, - "narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e8210c649915deed7080033cdbabcc19e40bb899", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { @@ -269,11 +269,11 @@ }, "nixpkgs_5": { "locked": { - "lastModified": 1781216227, - "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { @@ -285,11 +285,11 @@ }, "nixpkgs_6": { "locked": { - "lastModified": 1789114715, - "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "21a67dc470149f337cecafbe965d8d252a390518", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { @@ -301,11 +301,11 @@ }, "nixpkgs_7": { "locked": { - "lastModified": 1788405554, - "narHash": "sha256-r2f1oUwixlgq9zOdYLqJLfS/lWBT60/IITjhTKI59JU=", + "lastModified": 1789749394, + "narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a5cc6f2c37bf518436dc8d1c288ccd0c43c2f4c4", + "rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49", "type": "github" }, "original": { @@ -317,11 +317,11 @@ }, "nixpkgs_8": { "locked": { - "lastModified": 1789114715, - "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=", + "lastModified": 1790340521, + "narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "21a67dc470149f337cecafbe965d8d252a390518", + "rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7", "type": "github" }, "original": { @@ -338,11 +338,11 @@ "systems": "systems_2" }, "locked": { - "lastModified": 1788623321, - "narHash": "sha256-i8v07Plhfpx/nVFMvnMSC6P05RQ43mbLQsS5grni4Vk=", + "lastModified": 1789959143, + "narHash": "sha256-9oBHyJtUyunZL+6v0Ub8Y759cXcejQiTHpXtGcx5RLs=", "owner": "nix-community", "repo": "nixvim", - "rev": "68c2edd2787f055d9c306bcfe726f3b8f11b9441", + "rev": "4836e77b1798cd42e2de28593bec4c1788da08f5", "type": "github" }, "original": { @@ -405,11 +405,11 @@ ] }, "locked": { - "lastModified": 1788914643, - "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", + "lastModified": 1790247521, + "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=", "owner": "Mic92", "repo": "sops-nix", - "rev": "13616fff713a9f94055c66f15687ebdc17a335df", + "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f", "type": "github" }, "original": {