add ssh

homelab-services/gitea/flake.nix

@@ -64,11 +64,13 @@
 
                   echo "Generating templated files"
                   gomplate=${pkgs.gomplate}/bin/gomplate
-                  printf '%s' "${opts.database-hostname}" | $gomplate \
+                  printf '{"db_hostname":"%s","web_hostname":"%s"}' \
+                    "${opts.database-hostname}" \
+                    "${opts.default-nginx.hostname}" | $gomplate \
                     --input-dir=${k3sDir} \
                     --output-dir=$kubernetes_config \
                     --datasource credentials=file://${opts.credentialsFile}?type=application/x-env \
-                    --datasource dbhostname=stdin:
+                    --datasource config=stdin:?type=application/json
 
                   echo "Applying k3s config"
                   kubectl=${pkgs.kubectl}/bin/kubectl

homelab-services/gitea/k3s/deployment.yaml

@@ -35,7 +35,7 @@ spec:
               value: postgres
 
             - name: GITEA__database__HOST
-              value: '{{ (datasource "dbhostname") }}'
+              value: '{{ (datasource "config").db_hostname }}'
 
             - name: GITEA__database__NAME
               value: '{{ (datasource "credentials").GITEA_DB_NAME }}'
@@ -52,6 +52,15 @@ spec:
             - name: GITEA__server__SSH_PORT
               value: "30222"
 
+            - name: GITEA__server__DOMAIN
+              value: '{{ (datasource "config").web_hostname }}'
+
+            - name: GITEA__server__SSH_DOMAIN
+              value: '{{ (datasource "config").web_hostname }}'
+
+            - name: GITEA__server__ROOT_URL
+              value: 'https://{{ (datasource "config").web_hostname }}/'
+
             - name: GITEA__repository__MAX_CREATION_LIMIT
               value: "0"
 

homelab-services/incus-vm/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1788405554,
+        "lastModified": 1789344334,
-        "narHash": "sha256-r2f1oUwixlgq9zOdYLqJLfS/lWBT60/IITjhTKI59JU=",
+        "narHash": "sha256-vdhpDJ3Lr24lkZ+fDCjmBRRtw9/vcSzkqGJOJyF5h2U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a5cc6f2c37bf518436dc8d1c288ccd0c43c2f4c4",
+        "rev": "c3eea5b2156db11c7eeeada3dc737711255b253e",
         "type": "github"
       },
       "original": {
@@ -16,9 +16,40 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "postgresql-db": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "path": "../postgresql-db",
+        "type": "path"
+      },
+      "original": {
+        "path": "../postgresql-db",
+        "type": "path"
+      },
+      "parent": []
+    },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "postgresql-db": "postgresql-db"
       }
     }
   },

homelab-services/incus-vm/flake.nix

@@ -3,11 +3,27 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    postgresql-db.url = "path:../postgresql-db";
   };
 
   outputs =
-    { ... }:
     {
+      self,
+      nixpkgs,
+      postgresql-db,
+    }@inputs:
+    {
+      nixosConfigurations = {
+        virtual-env = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            ./virtual.nix
+            postgresql-db.nixosModules.postgresql-db
 
+            # declare the vm output
+            "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"
+          ];
+        };
+      };
     };
 }

homelab-services/incus-vm/secrets/ex-psql.yaml

@@ -0,0 +1 @@
+PSQL_TEST_PASSWORD=password1234

homelab-services/incus-vm/virtual.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  pkgs,
+  meta,
+  ...
+}:
+{
+
+  # Allow login and remote control of VM
+  users.users.admin = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFEQyjykrRpkgMFpNAR2G1rbofqbtcuLwIYzgqH85QCn roydumblauskas@gmail.com"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPERQEHVwrtsWOpu1BgT7b1WNe4ShCy4bXWoGWvYENBw roydumblauskas@gmail.com"
+    ];
+  };
+
+  # ================================ #
+  #            K3S SERVICE           #
+  # ================================ #
+
+  services.k3s = {
+    enable = true;
+    disable = [ "traefik" ];
+    role = "server";
+
+    # only enable the service on k3s when roughly finalized
+    # Until then use a vm, as k3s is persisted
+    extraFlags = [
+      "--data-dir=/var/lib/rancher/k3s"
+      "--cluster-cidr=10.42.0.0/20"
+    ];
+  };
+
+  # ================================ #
+  #           PSQL SERVICE           #
+  # ================================ #
+
+  # Postgresql/postgrest for row storage (not on k3s)
+  services.postgresql-db = {
+    enable = true;
+    dataDir = "/var/lib/postgresql";
+    port = 5432;
+    credentialsFile = ./secrets/ex-psql.yaml;
+    databases = [
+      "test"
+    ];
+    ipMasks = [
+      "10.42.0.0/20" # k3s pod mask
+    ];
+  };
+
+}

nixos/configuration.nix

@@ -118,9 +118,6 @@
     ];
   };
 
-  # ================================ #
-  #          END K3S SERVICE         #
-  # ================================ #
   # ================================ #
   #           GITEA SERVICE          #
   # ================================ #
@@ -136,18 +133,12 @@
     };
   };
 
-  # ================================ #
-  #           GITEA SERVICE          #
-  # ================================ #
   # ================================ #
   #           BLOG SERVICE           #
   # ================================ #
 
   # fullstack code. Dev hosted via VMs (incus)
 
-  # ================================ #
-  #         END BLOG SERVICE         #
-  # ================================ #
   # ================================ #
   #           PSQL SERVICE           #
   # ================================ #
@@ -166,10 +157,6 @@
     ];
   };
 
-  # ================================ #
-  #         END PSQL SERVICE         #
-  # ================================ #
-
   # ================================ #
   #             MINECRAFT            #
   # ================================ #
@@ -179,10 +166,6 @@
     storeDir = "/persist/srv/minecraft";
   };
 
-  # ================================ #
-  #             END MINECRAFT        #
-  # ================================ #
-
   # Grub Boot Loader Setup
   boot.loader.grub = {
     enable = true;
@@ -290,6 +273,7 @@
       "/root/.ssh"
       "/var/lib/nixos"
       "/var/db/sudo/lectured"
+      "/var/lib/acme"
     ];
   };
 

nixos/flake.lock

@@ -374,12 +374,12 @@
         "rev": "2ffdd630adbbe2004366b2d90ef29f62e7f670ca",
         "shallow": true,
         "type": "git",
-        "url": "ssh://git@github.com/RoyDumblauskas/server-semi-secrets"
+        "url": "ssh://git@roypository.com:30222/RoyDumblauskas/server-semi-secrets"
       },
       "original": {
         "shallow": true,
         "type": "git",
-        "url": "ssh://git@github.com/RoyDumblauskas/server-semi-secrets"
+        "url": "ssh://git@roypository.com:30222/RoyDumblauskas/server-semi-secrets"
       }
     },
     "root": {

nixos/flake.nix

@@ -4,7 +4,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixvim.url = "github:nix-community/nixvim/nixos-26.05";
-    quasiSecrets.url = "git+ssh://git@github.com/RoyDumblauskas/server-semi-secrets?shallow=1";
+    quasiSecrets.url = "git+ssh://git@roypository.com:30222/RoyDumblauskas/server-semi-secrets?shallow=1";
     home-manager = {
       url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";