fix persistent mount path

add install lock
2026-09-12 17:58:19 -05:00 · 2026-09-12 17:29:27 -05:00 · 2026-09-12 17:23:43 -05:00 · 2026-09-12 17:03:10 -05:00 · 2026-09-12 16:53:55 -05:00 · 2026-09-12 16:43:53 -05:00
8 changed files with 84 additions and 125 deletions
@@ -52,9 +52,15 @@ spec:
            - name: GITEA__server__SSH_PORT
              value: "30222"

+            - name: GITEA__repository__MAX_CREATION_LIMIT
+              value: "0"
+
+            - name: GITEA__security__INSTALL_LOCK
+              value: "true"
+
          volumeMounts:
            - name: gitea-data
-              mountPath: /var/lib/gitea
+              mountPath: /data

      volumes:
        - name: gitea-data
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1787525875,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
        "type": "github"
      },
      "original": {
@@ -90,19 +90,17 @@

                # Prod can be connected via local machine and declared masks
                ${lib.concatStringsSep "" (
-                  map (db: "host ${db} ${db}_produser 127.0.0.1/32 scram-sha-256\n") opts.databases
+                  map (db: "host ${db} ${db}_user 127.0.0.1/32 scram-sha-256\n") opts.databases
                )}
                ${lib.concatStringsSep "" (
-                  map (db: "host ${db} ${db}_produser ::1/128 scram-sha-256\n") opts.databases
+                  map (db: "host ${db} ${db}_user ::1/128 scram-sha-256\n") opts.databases
                )}
                # configurable list of subnets allowed to connect (for example k3s pods subnet)
                # will allow connection to all declared ips. fine for now
                ${lib.concatStringsSep "" (
                  map (
                    db:
-                    lib.concatStringsSep "" (
-                      map (mask: "host ${db} ${db}_produser ${opts.ipMasks} scram-sha-256\n") opts.ipMasks
-                    )
+                    lib.concatStringsSep "" (map (mask: "host ${db} ${db}_user ${mask} scram-sha-256\n") opts.ipMasks)
                  ) opts.databases
                )}
              '';
@@ -129,9 +127,8 @@
                    db_upper="''${db^^}"

                    pass_var="PSQL_''${db_upper}_PASSWORD"
-                    dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"

-                    user_val="$db"_produser
+                    user_val="$db"_user
                    pass_val=$(eval "echo \''${$pass_var:-}")

                    if [ -z "$pass_val" ]; then
@@ -67,9 +67,9 @@
    acceptTerms = true;
    defaults = {
      # use staging for testing
-      server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
      # use prod for deploy
-      # server = "https://acme-v02.api.letsencrypt.org/directory";
+      server = "https://acme-v02.api.letsencrypt.org/directory";
      email = "roydumblauskas@gmail.com";
      dnsProvider = "cloudflare";
      # When the service CHECKS to see if certs are near expiry (< 30 days)
@@ -110,9 +110,11 @@
    disable = [ "traefik" ];
    role = "server";

+    # only enable the service on k3s when roughly finalized
+    # Until then use a vm, as k3s is persisted
    extraFlags = [
-      "--data-dir=/var/lib/rancher/k3s"
-      "--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql
+      "--data-dir=/persist/var/lib/rancher/k3s"
+      "--cluster-cidr=10.42.0.0/20"
    ];
  };

@@ -141,52 +143,31 @@
  #           BLOG SERVICE           #
  # ================================ #

-  # Fullstack sourcecode
+  # fullstack code. Dev hosted via VMs (incus)

-  /*
-    MINIO DEPRECATED
-    services.minio-service = {
-      enable = true;
-
-      # Persist (or don't) the data inside of database
-      dataDir = "/var/data/minio";
-      credentialsFile = config.sops.secrets."minio-credentials".path;
-
-      dataPort = 9000; # S3 API access
-      consolePort = 9001; # Admin console access
-
-      bootstrap-minio = {
-        enable = true;
-        environments = [
-          "dev"
-          "prod"
-        ];
-      };
-
-      default-nginx = {
-        enable = true;
-        hostname = "imgs.roypository.com";
-      };
-    };
-  */
+  # ================================ #
+  #         END BLOG SERVICE         #
+  # ================================ #
+  # ================================ #
+  #           PSQL SERVICE           #
+  # ================================ #

  # Postgresql/postgrest for row storage (not on k3s)
  services.postgresql-db = {
    enable = true;
-    dataDir = "/var/lib/postgresql";
+    dataDir = "/persist/var/lib/postgresql";
    port = 5432;
    credentialsFile = config.sops.secrets."postgresql-credentials".path;
    databases = [
-      "rdblog"
      "gitea"
    ];
    ipMasks = [
-      "10.42.0.0/20" # k3s cluster mask
+      "10.42.0.0/20" # k3s pod mask
    ];
  };

  # ================================ #
-  #         END BLOG SERVICE         #
+  #         END PSQL SERVICE         #
  # ================================ #

  # ================================ #
@@ -238,6 +219,10 @@
    };
  };

+  # Setup Incus daemon on boot
+  # Init with `incus admin init --minimal`
+  virtualisation.incus.enable = true;
+
  networking = {
    hostName = meta.hostname;
    hostId = meta.hostId;
@@ -246,6 +231,7 @@
      "1.1.1.1"
      "1.0.0.1"
    ];
+    nftables.enable = true;

    firewall = {
      enable = true;
@@ -255,6 +241,9 @@
        443
        6443 # k3s
      ];
+
+      # Trust all incusVMs (on this network interface)
+      trustedInterfaces = [ "incusbr0" ];
    };

    interfaces.eth0.ipv4.addresses = [
@@ -268,40 +257,16 @@
  # Set your time zone.
  time.timeZone = "America/Chicago";

-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-  # Select internationalisation properties.
-  # i18n.defaultLocale = "en_US.UTF-8";
-  # console = {
-  #   font = "Lat2-Terminus16";
-  #   keyMap = "us";
-  #   useXkbConfig = true; # use xkb.options in tty.
-  # };
-
-  # Enable the X11 windowing system.
-  # services.xserver.enable = true;
-
-  # Configure keymap in X11
-  # services.xserver.xkb.layout = "us";
-  # services.xserver.xkb.options = "eurosign:e,caps:escape";
-
  # Enable CUPS to print documents.
  services.printing.enable = true;

-  # Enable sound.
-  # hardware.pulseaudio.enable = true;
-  # OR
-  # services.pipewire = {
-  #   enable = true;
-  #   pulse.enable = true;
-  # };
-
  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.roy = {
    isNormalUser = true;
-    extraGroups = [ "wheel" ];
+    extraGroups = [
+      "wheel"
+      "incus-admin"
+    ];
    hashedPassword = "$y$j9T$qHYfvijvytC69cjEWTHYA/$YF6ig1hNvkTQi0UffZP1dpilS.8O28qEY4bfdvRTXYA";
    # laptop and desktop
    openssh.authorizedKeys.keys = [
@@ -328,8 +293,7 @@
    ];
  };

-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
+  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
    curl
    kitty
@@ -358,14 +322,6 @@
    EDITOR = "nvim";
  };

-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
  # List services that you want to enable:
  services.openssh = {
    enable = true;
@@ -28,11 +28,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1788408179,
-        "narHash": "sha256-c9H5yvtmigYSyu/+FlctcQ1W8LV5y7g2aumHNovywp4=",
+        "lastModified": 1789185767,
+        "narHash": "sha256-jaWL9beN3ifjNzNEBxo0abA+TSi0n7Q8LRQvZTxEqaM=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "ba178ebb105382ab382ab497ca5a977a2fbe3cfd",
+        "rev": "811170bb74b11f3b9489618ce77487cc58c79067",
        "type": "gitlab"
      },
      "original": {
@@ -66,11 +66,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785627969,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
        "type": "github"
      },
      "original": {
@@ -100,11 +100,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787377438,
-        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
+        "lastModified": 1789182507,
+        "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
+        "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
        "type": "github"
      },
      "original": {
@@ -284,6 +284,22 @@
      }
    },
    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
      "locked": {
        "lastModified": 1788405554,
        "narHash": "sha256-r2f1oUwixlgq9zOdYLqJLfS/lWBT60/IITjhTKI59JU=",
@@ -299,29 +315,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_7": {
-      "locked": {
-        "lastModified": 1787204541,
-        "narHash": "sha256-OURZPknrTjQrlNyxPdqzyqmU/81Wes1CUP/Ft1Rv/YI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5880666fd9eb563038431edb35c2d0aa595884e6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1787525875,
-        "narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
        "type": "github"
      },
      "original": {
@@ -338,11 +338,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1787536726,
-        "narHash": "sha256-aBh5Yk9tX8ZV4k10BJr2fvTq0/+iWGegaCMUOU7YKas=",
+        "lastModified": 1788623321,
+        "narHash": "sha256-i8v07Plhfpx/nVFMvnMSC6P05RQ43mbLQsS5grni4Vk=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "e2c3f9f36326d07340626847543c557e2b95fb50",
+        "rev": "68c2edd2787f055d9c306bcfe726f3b8f11b9441",
        "type": "github"
      },
      "original": {
@@ -405,11 +405,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788337237,
-        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
+        "lastModified": 1788914643,
+        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
+        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
        "type": "github"
      },
      "original": {
@@ -10,7 +10,7 @@
      gpr = "git pull --rebase";
      gl = "git log";
      shypr = "start-hyprland";
-      nixrb = "sudo nixos-rebuild switch --flake";
+      nixrb = "sudo nixos-rebuild switch --flake .#$hostname";
    };

    functions = {
@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:3F9YE18X4zRqppoVSnoiwBJPNuxbB6hlntXIiNV8yWhomVP6TRwhadSC3J3t/rqzD6TdbnweInDlU9U9JtfDM6H+MTXd5eVynG/aR4c=,iv:yjm4TU8AqcpY2mn+cl1/Ya9e5FHWsUVAkcyvmFxaLVU=,tag:lx/ACG2g0H/eoiJ6AVEbjQ==,type:str]
+credentials: ENC[AES256_GCM,data:cl7lN8VFcGid6N0I9if2rnHXxfzcSpi9WuDOgr8Zw3YcMObU0Vu9F+FxnNNJ6/ISCWHsYCJg9dOqQwBmWwHNz7rsglL1+M51UynrjOhqGex3OCocvPkWTHk/QBxjum3rn3dZ2p40Zl0ZLmi8JO+2qBa62nwqqQGtsAfI2M2FjEPGMSqaDwv9zsGdiyfz/GEoel+mBCoe4simf3KZFmAcGs3Rwqj1YtuQy/x6+txK2lur+4Fp6Pj0VV7UQ0AXlvkn8z5EO+aieK+1PKOqSeV66rs/a8q2x05hEmOtaneGnc176B0iIweE+dQLr3GMfp4LeTQaUE2xyjjHgjGpKQhHxHf75icJDtOU/1KsNruOpYS2Bkp3/kv3tx1XUMt+dS4TWXq4FWCQ41B+NDjFAiFGJgKTCbD0kebOnhNYsg==,iv:4UkxIypVzO1lBTgWLcOjkfHy323K3sbmyu+kW4kAvxk=,tag:6hspoY9AJhe3//vgyC/HCQ==,type:str]
 sops:
    age:
        - enc: |
@@ -37,7 +37,7 @@ sops:
            o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-12T19:58:39Z"
-    mac: ENC[AES256_GCM,data:nWWObv95W+Ewp49Ygqrsat3yFlY15d8jcmjZusk8gCb1ollX8ulifP/SCt8GTOTQootbXpKxJc+BqBYcdR46gxMZert0ok2o9B7ks5zI7a0pH54mLDclN1ONmAyHRC0IqSfe7XSn70dgjLchjpCSjeTaylzidwBAUfKbkZtzjG8=,iv:jLqbj1XJaZNPKDNRUafxAexHeKQh9GqEeaIr+vzqGCc=,tag:QBir2cmH8M0zSjpAkQrHwQ==,type:str]
+    lastmodified: "2026-09-12T21:53:45Z"
+    mac: ENC[AES256_GCM,data:CWlbmhzYuTFTvC6hczXOqPQ7gFaKU0hwxx1/5w5IoESlJQwoKYWI55ZpXgT2Ynx26BZU3l+v04ytB23SkBhaY3w6Cs2AP4O7RNyTXc4Q9xkaq2qrLNRvIIsotAVhKULd0NRFkG0E8Urcf8ciK5iPbKhaovbGEQRtfB+EJFC6KNM=,iv:4ta099T9Fn7WcfCdaXYzZ94b5B1imnWxlJ/je9kI69w=,tag:sWytXiE10+3S/axircaApA==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.3
@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str]
+credentials: ENC[AES256_GCM,data:utwbvinGqNWCe0Pydl/afBw2T4VTnxhkRf9XApduUeNbReiiz6OkQhyB1rCUbqKCOlVu/ahJAwT2rT+HQRzjeFMWFUUbZpFG8q54u1uLHuNB1QsLXHwC7aZS6L9IdLUe5Tf+uzlT9047o5QgpZkNdsuQg43JWHxuA9nAjPR78R7q2eCNEsfEaoZmz34utabkKhWRGf9CpiDYYO2nLNXFFpSrRWk0nyU3CmqX9XROYphLwZw2obHs2EP6vUDK+1FsPa8Lza2TG7pF/NegSE9yMdnWmlzpj1f6B1+w5GLPweAPedTm6mRxsG8OfPLIwNrhfIP8XmsTQZ+JOsNq3boVaALgAacGd0ZOw7oB8/GsEjSEnkKETw==,iv:OsTSCYMoc6rMt+IqiKxZw9nWhXseA5wYHTUwgCqE9ZA=,tag:SWHAGuqkDYSuKxLb4oFf/A==,type:str]
 sops:
    age:
        - enc: |
@@ -37,7 +37,7 @@ sops:
            1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-12T19:58:55Z"
-    mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str]
+    lastmodified: "2026-09-12T21:53:27Z"
+    mac: ENC[AES256_GCM,data:QRouK5Vp5NGC8n3nh4per1ytbbKkSXV+kpXByrkR3BmZ3mOymyeOX4XfGbZdTgkRc+16mlMLM1dwTvbeWj8XOt65xH8uMw8oW2cRs68qyrSDq6+Ai/bovf+szAR1gx+mLk7FdqzyuslnXHzpJFS6vLPFt29DBj1fQFWslew+SoY=,iv:D0qaTYdPNm2AmlXq6HnvbIpgCKTzvXOtrsA1C8gZ9P4=,tag:TAVTUr5inXbvrWUdJnlOkA==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.3
Author	SHA1	Message	Date
RoyDumblauskas	fb5c117ae4	fix persistent mount path	2026-09-12 17:58:19 -05:00
RoyDumblauskas	dfe4c52590	add install lock	2026-09-12 17:29:27 -05:00
RoyDumblauskas	98c94994d9	add install lock	2026-09-12 17:23:43 -05:00
RoyDumblauskas	e331e3275c	final gitea to persist	2026-09-12 17:03:10 -05:00
RoyDumblauskas	d663d0557a	update secrets	2026-09-12 16:53:55 -05:00
RoyDumblauskas	3869be82a6	update gitea to be private	2026-09-12 16:43:53 -05:00
RoyDumblauskas	3f05c14747	udpate psql script	2026-09-12 16:09:34 -05:00
RoyDumblauskas	9d0bc48fd4	gitea details	2026-09-12 16:07:52 -05:00
RoyDumblauskas	0f80aa57ce	update mask ref	2026-09-12 15:06:16 -05:00
RoyDumblauskas	c6ac6b0a56	update flakes	2026-09-12 15:03:42 -05:00