diff --git a/flake.nix b/flake.nix index b6e3e26..c420aae 100644 --- a/flake.nix +++ b/flake.nix @@ -123,7 +123,6 @@ modules = [ ./hosts/monolith.nix ./system/monolith-gitlab-runner.nix - ./system/monolith-forgejo-runner.nix ./system/nix-serve.nix ./system/steam.nix ] ++ common_modules; diff --git a/hosts/phantom/default.nix b/hosts/phantom/default.nix index 782b783..47b8757 100644 --- a/hosts/phantom/default.nix +++ b/hosts/phantom/default.nix @@ -12,7 +12,6 @@ ./writefreely.nix ./renawiki.nix ./email.nix - ./forgejo.nix ]; # # Enable networking diff --git a/hosts/phantom/email.nix b/hosts/phantom/email.nix index fbe33d7..8d3021b 100644 --- a/hosts/phantom/email.nix +++ b/hosts/phantom/email.nix @@ -9,21 +9,13 @@ mailserver = { enable = true; fqdn = "mail.lelgenio.xyz"; - domains = [ - "lelgenio.xyz" - "git.lelgenio.xyz" - ]; + domains = [ "lelgenio.xyz" ]; certificateScheme = "acme-nginx"; - # Create passwords with - # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt' loginAccounts = { "lelgenio@lelgenio.xyz" = { hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS"; aliases = [ "postmaster@lelgenio.xyz" ]; }; - "noreply@git.lelgenio.xyz" = { - hashedPassword = "$2b$05$TmR1R7ZwXfec7yrOfeBL7u3ZtyXf0up5dEO6uMWSvb/O7LPEm.j0."; - }; }; }; diff --git a/hosts/phantom/forgejo.nix b/hosts/phantom/forgejo.nix deleted file mode 100644 index 94b7169..0000000 --- a/hosts/phantom/forgejo.nix +++ /dev/null @@ -1,56 +0,0 @@ -{ lib, pkgs, config, ... }: -let - cfg = config.services.forgejo; - srv = cfg.settings.server; -in -{ - services.nginx = { - virtualHosts.${cfg.settings.server.DOMAIN} = { - forceSSL = true; - enableACME = true; - extraConfig = '' - client_max_body_size 512M; - ''; - locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}"; - }; - }; - - services.openssh = { - authorizedKeysFiles = [ - "${config.services.forgejo.stateDir}/.ssh/authorized_keys" - ]; - # Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh - settings.AcceptEnv = "GIT_PROTOCOL"; - }; - - services.forgejo = { - enable = true; - database.type = "postgres"; - lfs.enable = true; - settings = { - service.DISABLE_REGISTRATION = true; - actions = { - ENABLED = true; - DEFAULT_ACTIONS_URL = "github"; - }; - server = { - DOMAIN = "git.lelgenio.xyz"; - HTTP_PORT = 3000; - ROOT_URL = "https://${srv.DOMAIN}/"; - }; - mailer = { - ENABLED = true; - SMTP_ADDR = "mail.lelgenio.xyz"; - FROM = "noreply@git.lelgenio.xyz"; - USER = "noreply@git.lelgenio.xyz"; - }; - }; - mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path; - }; - - age.secrets.phantom-forgejo-mailer-password = { - file = ../../secrets/phantom-forgejo-mailer-password.age; - mode = "400"; - owner = "forgejo"; - }; -} diff --git a/hosts/phantom/mastodon.nix b/hosts/phantom/mastodon.nix index adfaf0d..3e629d7 100644 --- a/hosts/phantom/mastodon.nix +++ b/hosts/phantom/mastodon.nix @@ -6,6 +6,5 @@ smtp.fromAddress = "lelgenio@disroot.org"; streamingProcesses = 2; extraConfig.SINGLE_USER_MODE = "true"; - mediaAutoRemove.olderThanDays = 10; }; } diff --git a/hosts/phantom/users.nix b/hosts/phantom/users.nix index 75aee27..5cc853a 100644 --- a/hosts/phantom/users.nix +++ b/hosts/phantom/users.nix @@ -2,7 +2,7 @@ security.rtkit.enable = true; services.openssh = { enable = true; - ports = [ 9022 22 ]; + ports = [ 9022 ]; settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; diff --git a/hosts/phantom/vpsadminos.nix b/hosts/phantom/vpsadminos.nix index 40401cd..070017e 100644 --- a/hosts/phantom/vpsadminos.nix +++ b/hosts/phantom/vpsadminos.nix @@ -13,8 +13,7 @@ let "1.1.1.1" "2606:4700:4700::1111" ]; -in -{ +in { networking.nameservers = mkDefault nameservers; services.resolved = mkDefault { fallbackDns = nameservers; }; networking.dhcpcd.extraConfig = "noipv4ll"; @@ -22,7 +21,7 @@ in systemd.services.systemd-sysctl.enable = false; systemd.services.systemd-oomd.enable = false; systemd.sockets."systemd-journald-audit".enable = false; - systemd.mounts = [{ where = "/sys/kernel/debug"; enable = false; }]; + systemd.mounts = [ {where = "/sys/kernel/debug"; enable = false;} ]; systemd.services.rpc-gssd.enable = false; # Due to our restrictions in /sys, the default systemd-udev-trigger fails diff --git a/overlays/sway.nix b/overlays/sway.nix index c6d8d5e..4de4395 100644 --- a/overlays/sway.nix +++ b/overlays/sway.nix @@ -11,7 +11,7 @@ executable = true; text = '' systemctl --user import-environment - dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway SWAYSOCK + dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway # systemctl --user stop pipewire wireplumber xdg-desktop-portal xdg-desktop-portal-wlr # systemctl --user start pipewire wireplumber xdg-desktop-portal xdg-desktop-portal-wlr ''; diff --git a/secrets/monolith-forgejo-runner-token.age b/secrets/monolith-forgejo-runner-token.age deleted file mode 100644 index aa3deb8..0000000 Binary files a/secrets/monolith-forgejo-runner-token.age and /dev/null differ diff --git a/secrets/phantom-forgejo-mailer-password.age b/secrets/phantom-forgejo-mailer-password.age deleted file mode 100644 index 90fbe73..0000000 Binary files a/secrets/phantom-forgejo-mailer-password.age and /dev/null differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 07ed876..9bc7c27 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -5,11 +5,9 @@ in "rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ]; "monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ]; "gitlab-runner-thoreb-telemetria-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ]; - "monolith-forgejo-runner-token.age".publicKeys = [ main_ssh_public_key ]; "lelgenio-cachix.age".publicKeys = [ main_ssh_public_key ]; "monolith-nix-serve-privkey.age".publicKeys = [ main_ssh_public_key ]; "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ]; "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ]; "phantom-renawiki.age".publicKeys = [ main_ssh_public_key ]; - "phantom-forgejo-mailer-password.age".publicKeys = [ main_ssh_public_key ]; } diff --git a/switch-phantom b/switch-phantom deleted file mode 100755 index c824b0c..0000000 --- a/switch-phantom +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh - -nix fmt - -git diff - -nixos-rebuild switch --flake .#phantom \ - --update-input nixpkgs \ - --no-write-lock-file \ - --build-host phantom \ - --target-host phantom \ - "$@" diff --git a/system/configuration.nix b/system/configuration.nix index 93d828c..189fa1c 100644 --- a/system/configuration.nix +++ b/system/configuration.nix @@ -59,7 +59,7 @@ security.rtkit.enable = true; services.openssh = { - enable = false; + enable = true; ports = [ 9022 ]; settings = { PermitRootLogin = "no"; diff --git a/system/monolith-forgejo-runner.nix b/system/monolith-forgejo-runner.nix deleted file mode 100644 index 2fa82b4..0000000 --- a/system/monolith-forgejo-runner.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ pkgs, config, ... }: { - services.gitea-actions-runner = { - package = pkgs.forgejo-actions-runner; - instances.default = { - enable = true; - name = "monolith"; - url = "https://git.lelgenio.xyz"; - tokenFile = config.age.secrets.monolith-forgejo-runner-token.path; - labels = [ - # provide a debian base with nodejs for actions - "debian-latest:docker://node:18-bullseye" - # fake the ubuntu name, because node provides no ubuntu builds - "ubuntu-latest:docker://node:18-bullseye" - # provide native execution on the host - #"native:host" - ]; - }; - }; -} diff --git a/system/secrets.nix b/system/secrets.nix index c94581c..0d0870b 100644 --- a/system/secrets.nix +++ b/system/secrets.nix @@ -6,13 +6,9 @@ ../secrets/monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age; secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.file = ../secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age; - secrets.monolith-forgejo-runner-token.file = - ../secrets/monolith-forgejo-runner-token.age; secrets.rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.file = ../secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age; secrets.monolith-nix-serve-privkey.file = ../secrets/monolith-nix-serve-privkey.age; - secrets.phantom-forgejo-mailer-password.file = - ../secrets/phantom-forgejo-mailer-password.age; }; }