diff --git a/ci/build.sh b/ci/build.sh new file mode 100755 index 0000000..e5c7a26 --- /dev/null +++ b/ci/build.sh @@ -0,0 +1,77 @@ +#!/usr/bin/env bash + +set -euo pipefail + +APP="$1" + +if [ "$APP" = "hugo-chat" ]; then + REPO="https://github.com/C0RR1T/HugoChat.git" +elif [ "$APP" = "cors" ]; then + REPO="https://github.com/noratrieb-lehre/davinci-cors.git" +else + REPO="https://github.com/Noratrieb/$APP.git" +fi + +echo "Checking out $REPO" +git clone "$REPO" ../app +cd ../app + +CURRENT_COMMIT=$(git rev-parse HEAD | cut -c1-8) +echo "Latest commit of $APP is $CURRENT_COMMIT" + +echo "**Commit: \`$CURRENT_COMMIT\`**" >> "$GITHUB_STEP_SUMMARY" + +if [ "$APP" = "hugo-chat" ]; then + IMAGE_PREFIX="docker.noratrieb.dev/hugo-chat" + SERVER_FULL_NAME="$IMAGE_PREFIX-server:$CURRENT_COMMIT" + CLIENT_FULL_NAME="$IMAGE_PREFIX-client:$CURRENT_COMMIT" + + pushd ./HugoServer + echo "Building server" + docker build . -t "$SERVER_FULL_NAME" + docker push "$SERVER_FULL_NAME" + popd + + pushd ./hugo-client + echo "Building client" + docker build . -t "$CLIENT_FULL_NAME" + docker push "$CLIENT_FULL_NAME" + popd + + exit 0 +fi + +if [ "$APP" = "cors" ]; then + IMAGE_PREFIX="docker.noratrieb.dev/cors-school" + SERVER_FULL_NAME="$IMAGE_PREFIX-server:$CURRENT_COMMIT" + CLIENT_FULL_NAME="$IMAGE_PREFIX-client:$CURRENT_COMMIT" + BOT_FULL_NAME="$IMAGE_PREFIX-bot:$CURRENT_COMMIT" + + pushd ./react-frontend + echo "Building frontend" + docker build -t "$CLIENT_FULL_NAME" . + docker push "$CLIENT_FULL_NAME" + popd + + pushd ./rust + echo "Building server" + docker build -t "$SERVER_FULL_NAME" -f Dockerfile.server . + docker push "$SERVER_FULL_NAME" + + echo "Building bot" + docker build -t "$BOT_FULL_NAME" -f Dockerfile.bot . + docker push "$BOT_FULL_NAME" + popd + + exit 0 +fi + +if [ "$APP" = "dockerolat" ]; then + APP="openolat" +fi + +IMAGE_PREFIX="docker.noratrieb.dev/$APP" +IMAGE_FULL_NAME="$IMAGE_PREFIX:$CURRENT_COMMIT" + +docker build . -t "$IMAGE_FULL_NAME" +docker push "$IMAGE_FULL_NAME" diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index 588d0af..7941ae7 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -1,15 +1,11 @@ -{ pkgs, lib, config, my-projects-versions, ... }: +{ pkgs, lib, my-projects-versions, ... }: let - does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { - inherit pkgs; - }; + does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; }; does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: { DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit; }); in { - age.secrets.does_it_build_private_key.file = ../../secrets/does_it_build_private_key.age; - services.caddy.virtualHosts = { "does-it-build.noratrieb.dev" = { logFormat = ""; @@ -39,32 +35,7 @@ in User = "does-it-build"; Group = "does-it-build"; ExecStart = "${lib.getExe' (does-it-build) "does-it-build" }"; - Environment = [ - "DB_PATH=/var/lib/does-it-build/db.sqlite" - "GITHUB_SEND_PINGS=1" - "GITHUB_OWNER=Noratrieb" - "GITHUB_REPO=does-it-build-notifications" - "GITHUB_APP_ID=2263995" # https://github.com/settings/apps/does-it-build - ]; - # GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----... - EnvironmentFile = [ config.age.secrets.does_it_build_private_key.path ]; - - ProtectHome = true; - StateDirectory = "does-it-build"; - ProtectSystem = "strict"; - PrivateTmp = true; - - RemoveIPC = true; - NoNewPrivileges = true; - PrivateDevices = true; - ProtectClock = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - ProtectKernelModules = true; - PrivateMounts = true; - RestrictNamespaces = ""; - RestrictSUIDSGID = true; - ProtectHostname = true; + Environment = "DB_PATH=/var/lib/does-it-build/db.sqlite"; }; }; diff --git a/nix/apps/hugo-chat/default.nix b/nix/apps/hugo-chat/default.nix index 2229650..a62350c 100644 --- a/nix/apps/hugo-chat/default.nix +++ b/nix/apps/hugo-chat/default.nix @@ -9,7 +9,6 @@ let url = "https://github.com/C0RR1T/HugoChat/releases/download/2024-08-05/hugo-client.tar.xz"; sha256 = "sha256:121ai8q6bm7gp0pl1ajfk0k2nrfg05zid61i20z0j5gpb2qyhsib"; - stripRoot = false; }; in { @@ -62,27 +61,35 @@ in "api.hugo-chat.noratrieb.dev" = let cors = pkgs.writeText "cors" '' - @cors_preflight { - method OPTIONS - header Origin * - } + # https://gist.github.com/ryanburnette/d13575c9ced201e73f8169d3a793c1a3 + @cors_preflight{args[0]} method OPTIONS + @cors{args[0]} header Origin {args[0]} - handle @cors_preflight { + handle @cors_preflight{args[0]} { header { - Access-Control-Allow-Origin "*" - Access-Control-Allow-Methods "*" - Access-Control-Allow-Headers "content-type" + Access-Control-Allow-Origin "{args[0]}" + Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" + Access-Control-Allow-Credentials "false" + Access-Control-Allow-Headers "$${args[1]}" + Access-Control-Max-Age "86400" + defer } - respond 204 + respond "" 204 } - + handle @cors{args[0]} { + header { + Access-Control-Allow-Origin "{args[0]}" + Access-Control-Expose-Headers * + defer + } + } ''; in { logFormat = ""; extraConfig = '' - import ${cors} + import ${cors} https://hugo-chat.noratrieb.dev "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type" encode zstd gzip reverse_proxy * localhost:5001 ''; diff --git a/nix/apps/matrix/default.nix b/nix/apps/matrix/default.nix deleted file mode 100644 index 0906cd1..0000000 --- a/nix/apps/matrix/default.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ pkgs, ... }: { - services.matrix-continuwuity = { - enable = true; - settings = { - global = { - server_name = "noratrieb.dev"; - allow_registration = false; - allow_encryption = true; - allow_federation = true; - trusted_servers = [ "matrix.org" ]; - well_known = { - server = "matrix.noratrieb.dev:443"; - client = "https://matrix.noratrieb.dev"; - support_page = "https://noratrieb.dev"; - }; - }; - }; - }; - environment.systemPackages = [ pkgs.matrix-continuwuity ]; - services.caddy.virtualHosts."matrix.noratrieb.dev" = { - extraConfig = '' - encode zstd gzip - - reverse_proxy * http://localhost:6167 - ''; - }; - services.caddy.virtualHosts."matrix.noratrieb.dev:8448" = { - extraConfig = '' - encode zstd gzip - - reverse_proxy * http://localhost:6167 - ''; - }; - networking.firewall.allowedTCPPorts = [ 8448 ]; - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 6167 ]; -} diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index bd5105b..e61608c 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -1,39 +1,25 @@ -{ ... }: { - services.caddy.globalConfig = '' - filesystem garage s3 { - bucket noratrieb.dev - region garage - endpoint http://localhost:3900 - use_path_style - } - ''; +{ pkgs, lib, my-projects-versions, ... }: +let + website = import (pkgs.fetchFromGitHub my-projects-versions.website.fetchFromGitHub); + blog = pkgs.fetchFromGitHub my-projects-versions.blog.fetchFromGitHub; + slides = pkgs.fetchFromGitHub my-projects-versions.slides.fetchFromGitHub; + website-build = website { inherit pkgs slides blog; }; +in +{ services.caddy.virtualHosts = { "noratrieb.dev" = { logFormat = ""; extraConfig = '' encode zstd gzip - - reverse_proxy /.well-known/matrix/* https://matrix.noratrieb.dev { - header_up Host matrix.noratrieb.dev - } - - header -Last-Modified - - header /blog/css/* Cache-Control "max-age=31540000, immutable" - header /blog/fonts/* Cache-Control "max-age=31540000, immutable" - - @txt { - path / - not header Accept *text/html* - } - rewrite @txt /index.txt - + root * ${import ../../packages/caddy-static-prepare { + name = "website"; + src = website-build; + inherit pkgs lib; + }} file_server { - fs garage - # TODO: run precompress script - # etag_file_extensions .sha256 - # precompressed zstd gzip br + etag_file_extensions .sha256 + precompressed zstd gzip br } ''; }; @@ -44,12 +30,5 @@ reverse_proxy * localhost:3902 ''; }; - "womangling.noratrieb.dev" = { - logFormat = ""; - extraConfig = '' - encode zstd gzip - reverse_proxy * localhost:3902 - ''; - }; }; } diff --git a/nix/apps/widetom/default.nix b/nix/apps/widetom/default.nix index a6e549a..c7372fd 100644 --- a/nix/apps/widetom/default.nix +++ b/nix/apps/widetom/default.nix @@ -4,11 +4,10 @@ let src = pkgs.fetchFromGitHub my-projects-versions.widetom.fetchFromGitHub; pname = "widetom"; version = "0.1.0"; - cargoHash = "sha256-riQA+GviHMqiSvoRKcJhM3MGVEIv6urgYyvBZZd4fCc="; + cargoHash = "sha256-AWbdPcDc+QOW7U/FYbqlIsg+3MwfggKCTCw1z/ZbSEE="; meta = { mainProgram = "widertom"; }; - RUSTFLAGS = "-Cforce-frame-pointers=true"; }; in { @@ -32,21 +31,6 @@ in serviceConfig = { DynamicUser = true; ExecStart = lib.getExe widetom; - PrivateDevices = true; - ProtectHome = true; - ProtectClock = true; - ProtectKernelLogs = true; - ProtectHostname = true; - ProtectKernelTunables = true; - CapabilityBoundingSet = ""; - ProtectProc = "noaccess"; - RestrictNamespaces = true; - MemoryDenyWriteExecute = true; - ProtectControlGroups = true; - ProtectKernelModules = true; - SystemCallArchitectures = ""; - SystemCallFilter = "@system-service"; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; }; }; diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh index 5054a61..84107f9 100755 --- a/nix/deploy/smoke-tests.sh +++ b/nix/deploy/smoke-tests.sh @@ -23,9 +23,10 @@ check_dig_answer A "nilstrieb.dev" "161.97.165.1" check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev." # Mail stuff -check_dig_answer MX noratrieb.dev "mail.tutanota.de." -check_dig_answer TXT noratrieb.dev "t-verify=dae826f2ae9f73a71cc247183616b6c9" -check_dig_answer TXT noratrieb.dev "v=spf1 include:spf.tutanota.de -all" +check_dig_answer MX noratrieb.dev "mail.protonmail.ch." +check_dig_answer MX noratrieb.dev "mailsec.protonmail.ch." +check_dig_answer TXT noratrieb.dev "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" +check_dig_answer TXT noratrieb.dev "v=spf1 include:_spf.protonmail.ch ~all" # Check HTTP responses http_hosts=( diff --git a/nix/hive.nix b/nix/hive.nix index eee6101..f31e3b2 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -2,7 +2,7 @@ meta = let nixpkgs-version = builtins.fromJSON (builtins.readFile ./nixpkgs.json); - nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz"); + nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version.commit}.tar.gz"); in { # Override to pin the Nixpkgs version (recommended). This option @@ -66,7 +66,7 @@ wg = { privateIP = "10.0.0.3"; publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0="; - peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ]; + peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ]; }; tags = [ "apps" ]; }; @@ -92,17 +92,6 @@ }; tags = [ "apps" ]; }; - minipc = { - publicIPv4 = null; - publicIPv6 = null; - wg = { - privateIP = "10.0.2.1"; - publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4="; - peers = [ "vps3" ]; - noEndpoint = true; - }; - tags = [ "home" ]; - }; }; }; @@ -190,7 +179,6 @@ ./modules/registry ./modules/backup ./modules/restic - ./modules/snowflake-proxy # apps ./apps/website @@ -213,10 +201,6 @@ ./modules/wg-mesh ./modules/caddy ./modules/garage - ./modules/snowflake-proxy - - # apps - ./apps/matrix ]; system.stateVersion = "23.11"; @@ -230,7 +214,6 @@ ./modules/caddy ./modules/garage ./modules/prometheus - ./modules/snowflake-proxy ./apps/website ]; @@ -246,7 +229,6 @@ ./modules/garage ./modules/backup ./modules/restic - ./modules/snowflake-proxy # apps ./apps/website @@ -302,7 +284,6 @@ ./modules/caddy ./modules/wg-mesh ./modules/garage - ./modules/snowflake-proxy ./apps/fakessh ]; @@ -311,18 +292,4 @@ system.stateVersion = "23.11"; }; - minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: { - imports = [ - ./modules/minipc - ./modules/wg-mesh - ./modules/nas-mount - ./modules/postgres - ./modules/immich - ./modules/tailscale - ./modules/paperless - ./modules/caddy-base - ]; - - system.stateVersion = "25.05"; - }; } diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix deleted file mode 100644 index a33e7b3..0000000 --- a/nix/modules/caddy-base/default.nix +++ /dev/null @@ -1,50 +0,0 @@ -{ pkgs, ... }: -let - caddy = pkgs.caddy.withPlugins { - plugins = [ - "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" - "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" - "github.com/caddy-dns/rfc2136@v1.0.0" - ]; - hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; - }; -in -{ - environment.systemPackages = [ pkgs.caddy ]; - - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics - - networking.firewall = { - allowedTCPPorts = [ - 80 # HTTP - 443 # HTTPS - ]; - allowedUDPPorts = [ - 443 # HTTP/3 via QUIC - ]; - }; - - services.caddy = { - enable = true; - package = caddy; - logFormat = '' - output stdout - format json - ''; - globalConfig = '' - auto_https disable_redirects - - servers { - metrics - } - ''; - virtualHosts = { - ":9010" = { - logFormat = "output discard"; - extraConfig = '' - metrics /metrics - ''; - }; - }; - }; -} diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index bec542b..3df164a 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -1,11 +1,40 @@ -{ pkgs, config, lib, name, ... }: { - imports = [ ../caddy-base ]; +{ pkgs, config, lib, name, ... }: + +let + caddy = pkgs.caddy.withPlugins { + plugins = [ + "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" + "github.com/caddy-dns/rfc2136@v1.0.0" + ]; + hash = "sha256-HdCXbqrrGPZSdHv7bZvGz9T6loVbrfKydTbjTyt5Wt0="; + }; +in +{ + environment.systemPackages = [ caddy ]; + + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics + + networking.firewall = { + allowedTCPPorts = [ + 80 # HTTP + 443 # HTTPS + ]; + allowedUDPPorts = [ + 443 # HTTP/3 via QUIC + ]; + }; age.secrets.caddy_s3_key_secret.file = ../../secrets/caddy_s3_key_secret.age; - systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.caddy_s3_key_secret.path ]; + systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.caddy_s3_key_secret.path; systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage services.caddy = { + enable = true; + package = caddy; + logFormat = '' + output stdout + format json + ''; globalConfig = '' email tls@noratrieb.dev auto_https disable_redirects @@ -41,6 +70,12 @@ respond "This is an HTTPS-only server, silly you. Go to https:// instead." 418 ''; }; + ":9010" = { + logFormat = "output discard"; + extraConfig = '' + metrics /metrics + ''; + }; "${name}.infra.noratrieb.dev" = { logFormat = ""; extraConfig = '' diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix index e3b668a..4138af9 100644 --- a/nix/modules/default/default.nix +++ b/nix/modules/default/default.nix @@ -2,12 +2,9 @@ let pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub); quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub); - networkConfig = networkingConfig."${name}"; in { - deployment.targetHost = - if networkConfig.publicIPv4 == null - then name else "${name}.infra.noratrieb.dev"; + deployment.targetHost = "${name}.infra.noratrieb.dev"; # TODO: ensure that the rust programs have frame pointers @@ -23,8 +20,6 @@ in nixPath = [ "nixpkgs=${nixpkgs-path}" ]; }; - nixpkgs.config.allowUnfree = true; - environment.systemPackages = with pkgs; [ vim wget @@ -32,14 +27,10 @@ in traceroute dnsutils nftables - htop ]; networking.hostName = name; - # Swiss german console tty keyboard layout - console.keyMap = "sg"; - time.timeZone = "Europe/Zurich"; users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ]; @@ -69,7 +60,6 @@ in settings = { PasswordAuthentication = false; - AllowUsers = [ "root" ]; }; }; services.fail2ban = { @@ -89,22 +79,6 @@ in "PRETENSE_PORTS=23,3306,5432,1521" # telnet,mysql,postgres,oracle "PRETENSE_METRICS_PORT=9150" ]; - PrivateDevices = true; - ProtectHome = true; - ProtectClock = true; - ProtectKernelLogs = true; - ProtectHostname = true; - ProtectKernelTunables = true; - CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; - ProtectProc = "ptraceable"; - RestrictNamespaces = true; - MemoryDenyWriteExecute = true; - ProtectControlGroups = true; - ProtectKernelModules = true; - SystemCallArchitectures = ""; - SystemCallFilter = "@system-service"; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; - ProtectSystem = "strict"; }; }; systemd.services.quotdd = { @@ -116,23 +90,6 @@ in ExecStart = "${lib.getExe (quotdd {inherit pkgs;})}"; AmbientCapabilities = "CAP_NET_BIND_SERVICE"; Environment = [ ]; - - PrivateDevices = true; - ProtectHome = true; - ProtectClock = true; - ProtectKernelLogs = true; - ProtectHostname = true; - ProtectKernelTunables = true; - CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; - ProtectProc = "ptraceable"; - RestrictNamespaces = true; - MemoryDenyWriteExecute = true; - ProtectControlGroups = true; - ProtectKernelModules = true; - SystemCallArchitectures = ""; - SystemCallFilter = "@system-service"; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; - ProtectSystem = "strict"; }; }; networking.firewall.allowedTCPPorts = [ @@ -231,22 +188,6 @@ in }; systemd.services.alloy.serviceConfig = { DynamicUser = lib.mkForce false; - PrivateDevices = true; - ProtectClock = true; - ProtectKernelLogs = true; - PrivateMounts = true; - ProtectControlGroups = true; - ProtectHostname = true; - LockPersonality = true; - ProtectKernelTunables = true; - ProtectSystem = true; - ProtectHome = true; - PrivateTmp = true; - NoNewPrivileges = true; - RestrictNamespaces = ""; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; - # TODO: find what's required for /proc/kallsyms (it should be CAP_SYSLOG!) - # CapabilityBoundingSet = "CAP_SYS_PTRACE CAP_BPF CAP_SYSLOG"; }; environment.etc."alloy/config.alloy".text = '' discovery.process "all" { diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix index c013f4f..1d0fb7d 100644 --- a/nix/modules/dns/nilstrieb.dev.nix +++ b/nix/modules/dns/nilstrieb.dev.nix @@ -18,7 +18,7 @@ let vps1 // { TTL = hour1; SOA = { - nameServer = "ns.nilstrieb.dev."; + nameServer = "ns1.nilstrieb.dev."; adminEmail = "void@nilstrieb.dev"; serial = 2024072601; }; @@ -34,7 +34,6 @@ let ]; subdomains = { - ns = dns1; ns1 = dns1; ns2 = dns2; diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index 808e0b1..a618a6c 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -14,10 +14,6 @@ let A = lib.lists.flatten (map (host: if builtins.hasAttr "A" host then host.A else [ ]) hosts); AAAA = lib.lists.flatten (map (host: if builtins.hasAttr "AAAA" host then host.AAAA else [ ]) hosts); }; - - minipc = { - A = [ (a "100.100.2.1") ]; # tailscale IP - }; in with hostsToDns; # vps{1,3,4} contains root noratrieb.dev @@ -41,12 +37,13 @@ let TXT = [ "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" - "t-verify=dae826f2ae9f73a71cc247183616b6c9" # tuta verification - "v=spf1 include:spf.tutanota.de -all" + "v=spf1 include:_spf.protonmail.ch ~all" ]; + MX = [ - (ttl 60 (mx.mx 10 "mail.tutanota.de.")) + (mx.mx 10 "mail.protonmail.ch.") + (mx.mx 20 "mailsec.protonmail.ch.") ]; subdomains = { @@ -66,12 +63,6 @@ let }; }; - womangling = combine [ vps1 vps3 vps4 ]; - - garage = combine [ vps1 vps2 vps3 vps4 ]; - - matrix = vps2; - # --- apps docker = vps1; hugo-chat = vps1 // { @@ -96,26 +87,18 @@ let grafana = vps3; infra.subdomains = hostsToDns; - # --- internal stuff - internal.subdomains = { - immich = minipc; - paperless = minipc; - }; - # --- other verification _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ]; _atproto.TXT = [ "did=did:plc:pqyzoyxk7gfcbxk65mjyncyl" ]; # --- email - _mta-sts.CNAME = [ (cname "mta-sts.tutanota.de.") ]; - mta-sts.CNAME = [ (cname "mta-sts.tutanota.de.") ]; - _domainkey.subdomains = { - s1.CNAME = [ (cname "s1.domainkey.tutanota.de.") ]; - s2.CNAME = [ (cname "s2.domainkey.tutanota.de.") ]; + protonmail.CNAME = [ (cname "protonmail.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; + protonmail2.CNAME = [ (cname "protonmail2.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; + protonmail3.CNAME = [ (cname "protonmail3.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; }; _dmarc.TXT = [ - "v=DMARC1; p=quarantine; adkim=s" + "v=DMARC1; p=quarantine" ]; # retired diff --git a/nix/modules/garage/default.nix b/nix/modules/garage/default.nix index 409dcc6..d50d3c5 100644 --- a/nix/modules/garage/default.nix +++ b/nix/modules/garage/default.nix @@ -20,7 +20,7 @@ in }; services.garage = { enable = true; - package = pkgs.garage_2; + package = pkgs.garage_2_0_0; settings = { metadata_dir = "/var/lib/garage/meta"; data_dir = "/var/lib/garage/data"; @@ -53,12 +53,5 @@ in }; environmentFile = config.age.secrets.garage_secrets.path; }; - services.caddy.virtualHosts."garage.noratrieb.dev" = { - logFormat = ""; - extraConfig = '' - encode zstd gzip - reverse_proxy * localhost:3900 - ''; - }; } diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix deleted file mode 100644 index 9d3b52c..0000000 --- a/nix/modules/immich/default.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ config, pkgs, ... }: { - age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age; - - services.immich = { - enable = true; - mediaLocation = "/mnt/nas/HEY/_Nora/immich"; - secretsFile = config.age.secrets.immich_secrets.path; - host = "0.0.0.0"; - database = { - enableVectors = false; - enableVectorChord = true; - }; - environment = { - IMMICH_TELEMETRY_INCLUDE = "all"; - }; - openFirewall = true; - }; - - services.postgresql = { - ensureDatabases = [ "immich" ]; - ensureUsers = [ - { - name = "immich"; - ensureDBOwnership = true; - } - ]; - authentication = pkgs.lib.mkForce '' - #type database DBuser auth-method - local all all peer - ''; - }; - - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ]; -} diff --git a/nix/modules/minipc/default.nix b/nix/modules/minipc/default.nix deleted file mode 100644 index 39adc61..0000000 --- a/nix/modules/minipc/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ ... }: { - imports = [ ./hardware-configuration.nix ]; - - networking.networkmanager.enable = true; - - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; -} diff --git a/nix/modules/minipc/hardware-configuration.nix b/nix/modules/minipc/hardware-configuration.nix deleted file mode 100644 index b8476f3..0000000 --- a/nix/modules/minipc/hardware-configuration.nix +++ /dev/null @@ -1,42 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { - device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { - device = "/dev/disk/by-uuid/2A59-D3C9"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; - - swapDevices = - [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/nix/modules/nas-mount/default.nix b/nix/modules/nas-mount/default.nix deleted file mode 100644 index 0379576..0000000 --- a/nix/modules/nas-mount/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ ... }: { - fileSystems."/mnt/nas" = { - device = "nas:/volume1/homes"; - fsType = "nfs"; - }; -} diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix deleted file mode 100644 index 5cb60cb..0000000 --- a/nix/modules/paperless/default.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ config, ... }: -let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in { - age.secrets.paperless_env.file = ../../secrets/paperless_env.age; - - services.paperless = { - enable = true; - consumptionDir = "${nasDir}/consume"; - address = "0.0.0.0"; - port = 8010; - environmentFile = config.age.secrets.paperless_env.path; - settings = { - PAPERLESS_TIME_ZONE = "Europe/Zurich"; - PAPERLESS_ADMIN_USER = "nora"; - PAPERLESS_OCR_LANGUAGE = "deu+eng"; - }; - exporter = { - enable = true; - directory = "${nasDir}/export_minipc"; - onCalendar = "02:25:00"; - }; - }; - - networking.firewall.allowedTCPPorts = [ 8010 ]; -} diff --git a/nix/modules/postgres/default.nix b/nix/modules/postgres/default.nix deleted file mode 100644 index 79f0e6a..0000000 --- a/nix/modules/postgres/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ pkgs, ... }: { - config.services.postgresql = { - enable = true; - package = pkgs.postgresql_18; - }; -} diff --git a/nix/modules/prometheus/default.nix b/nix/modules/prometheus/default.nix index ef04088..334c311 100644 --- a/nix/modules/prometheus/default.nix +++ b/nix/modules/prometheus/default.nix @@ -85,13 +85,6 @@ scrape_interval = "1h"; static_configs = [{ targets = [ "localhost:7846" ]; }]; } - { - job_name = "immich"; - static_configs = [ - { targets = [ "minipc.local:8081" ]; labels = { server = "minipc"; }; } - { targets = [ "minipc.local:8082" ]; labels = { server = "minipc"; }; } - ]; - } ]; }; @@ -226,7 +219,6 @@ pyroscope = pkgs.fetchzip { url = "https://github.com/grafana/pyroscope/releases/download/v1.14.0/pyroscope_1.14.0_linux_amd64.tar.gz"; sha256 = "sha256:005539bp2a2kac8ff6vz77g0niav81rggha1bsfx454fw4dyli4y"; - stripRoot = false; }; pyroscopeConfig = { analytics.reporting_enabled = false; diff --git a/nix/modules/snowflake-proxy/default.nix b/nix/modules/snowflake-proxy/default.nix deleted file mode 100644 index acc34c6..0000000 --- a/nix/modules/snowflake-proxy/default.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ ... }: { - services.snowflake-proxy.enable = true; -} diff --git a/nix/modules/tailscale/default.nix b/nix/modules/tailscale/default.nix deleted file mode 100644 index 9756f48..0000000 --- a/nix/modules/tailscale/default.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ ... }: { - networking.nftables.enable = true; - - services.tailscale = { - enable = true; - extraUpFlags = [ "--advertise-exit-node" ]; - useRoutingFeatures = "server"; - }; - - systemd.services.tailscaled.serviceConfig.Environment = [ - "TS_DEBUG_FIREWALL_MODE=nftables" - ]; -} diff --git a/nix/modules/wg-mesh/default.nix b/nix/modules/wg-mesh/default.nix index 636dc13..abb904a 100644 --- a/nix/modules/wg-mesh/default.nix +++ b/nix/modules/wg-mesh/default.nix @@ -35,9 +35,7 @@ in let peerConfig = (builtins.getAttr peer networkingConfig).wg; in { inherit (peerConfig) publicKey; - endpoint = - if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint - then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null; + endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}"; allowedIPs = [ "${peerConfig.privateIP}/32" ]; # sometimes there's some weirdness....?? persistentKeepalive = 25; diff --git a/nix/my-projects.json b/nix/my-projects.json index cfe25d6..d17941d 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -1,4 +1,31 @@ { + "website": { + "commit": "57c4a239da5d17eafde4ade165f3c6706639a9b4", + "fetchFromGitHub": { + "owner": "Noratrieb", + "repo": "website", + "rev": "57c4a239da5d17eafde4ade165f3c6706639a9b4", + "hash": "sha256-or6mCQjbc7tWAzzAKQpznZv+2vWJMhyzqxBPwRE2HKw=" + } + }, + "blog": { + "commit": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2", + "fetchFromGitHub": { + "owner": "Noratrieb", + "repo": "blog", + "rev": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2", + "hash": "sha256-LvQ41eJzOvI7mLYDTvlFwGZ2TKrZO26rasydqnEZ/t4=" + } + }, + "slides": { + "commit": "0401f35c22b124b69447655f0c537badae9e223c", + "fetchFromGitHub": { + "owner": "Noratrieb", + "repo": "slides", + "rev": "0401f35c22b124b69447655f0c537badae9e223c", + "hash": "sha256-K1Me4wf/GSfoc1PGWVJygPyTVV8SXienxUrzXkdCrjQ=" + } + }, "pretense": { "commit": "270b01fc1118dfd713c1c41530d1a7d98f04527d", "fetchFromGitHub": { @@ -18,12 +45,12 @@ } }, "does-it-build": { - "commit": "5518c49d7c6348ba01f286ce031f5322bbd9f786", + "commit": "81790825173d87f89656f66f12a123bc99e2f6f1", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "5518c49d7c6348ba01f286ce031f5322bbd9f786", - "hash": "sha256-nOV0n2THZXG/fC3lgPW2gDeWn7bYIZydCTIkKJ+U898=" + "rev": "81790825173d87f89656f66f12a123bc99e2f6f1", + "hash": "sha256-MCgGDd7Sg+BiG8L20Bbz8bHMB/Xuc1ztOVwv/b37BnQ=" } }, "upload.files.noratrieb.dev": { @@ -45,12 +72,12 @@ } }, "widetom": { - "commit": "387f6ff587b66186332cf5cfba90c966bba0695c", + "commit": "33d1738799618d72fe2b86896f766cbfea58dc76", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "widetom", - "rev": "387f6ff587b66186332cf5cfba90c966bba0695c", - "hash": "sha256-0PCal2czxBlgDh59TM7o94C9PG3a98YYUJ887/BYeEA=" + "rev": "33d1738799618d72fe2b86896f766cbfea58dc76", + "hash": "sha256-lSjlDozwKRLF62jsDaWo+8+rcQdeEgurEnuw00hk3o8=" } } } diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 8d760b2..e63baef 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,6 +1,5 @@ { - "nixos-25.11": { - "lastUpdated": "2026-05-28T12:57:27.843Z", - "commit": "b77b3de8775677f84492abe84635f87b0e153f0f" - } + "channel": "nixos-25.05", + "lastUpdated": "2025-08-03T11:42:11.747Z", + "commit": "59e69648d345d6e8fef86158c555730fa12af9de" } diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index adb5d54..1c0cfb7 100644 Binary files a/nix/secrets/backup_s3_secret.age and b/nix/secrets/backup_s3_secret.age differ diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index d231b80..2db341f 100644 Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index 21dbaca..311dad5 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08 -vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs ---- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY -j9KyȰ0*ÜbɿY0I3v+D"*/g`o#ص \ No newline at end of file +-> ssh-ed25519 qM6TYg py66rUtQIWm6K163vaJaoAseekNA70yQKMDH1FkWYVc +rP7T1akj7LmzIcJeoK+mq+GfOjWpnWFnSpUhIA9Vihc +--- UjRtQl6/Gz3QPiLhSyksrsRvFoCjiCKi4D0HdBb1dJY +q(mzhkH9:M>c=ά֦M L1 \ No newline at end of file diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age deleted file mode 100644 index a1a6080..0000000 Binary files a/nix/secrets/does_it_build_private_key.age and /dev/null differ diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index 609822d..fba1c4f 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw -M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E ---- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys -G6?U'ry@b $MZ`@kv]6_۟Nق $!mVkgA]yW,d';Ȧ핒 ܎ \ No newline at end of file +-> ssh-ed25519 qM6TYg DlJpvGP2I1iGodnEufzr0qCAmmU6XiKbnNCRJmjPsHs +upNAkX1DPfs7AJi+/hUKKcehn7tTcR0knW8W+kP1u/k +--- ZEI6vM0+n33fVLPssJyEWYW/xNgoa0/2BIZeG3NzBrk +-r ` +gR/n|S\h}LRE@𚇂OjF"Vv-q˓xjf ­f=aI8Ѧl C \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index ce127e4..de68b3e 100644 Binary files a/nix/secrets/garage_secrets.age and b/nix/secrets/garage_secrets.age differ diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index d009691..1e0c2c4 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,13 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8 -A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0 --> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8 -CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc --> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY -aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM --> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk -2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8 --> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4 -sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk ---- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc -uM?C0Z& rSgWp8{*6yqð% \ No newline at end of file +-> ssh-ed25519 qM6TYg SrZQBYLsUcrDu6ds1fJAyjM+mHPpAW04U6yRqA/TjH8 +LZUTPquz+YNmlRWrXwY2fvXsVwOEM/uhzWcaf7WsY5o +-> ssh-ed25519 91VHug sVXnaD5sruvFKnPwldWzlH8KUIeZ/toWqYe/F2tfBX0 +CapfF55c1MvBDcDywNpnS4blYwD0HrPyrcncMRbl5lo +-> ssh-ed25519 XzACZQ WqU7ebK4SnCyxP4zxIdmMDAaH7mk2HpgvUwbFWhoNWs +wm0ZtnIQCKZW+WJIDtAIdOQkvp5LLyvTQ2vNFC7C26U +-> ssh-ed25519 51bcvA xtMa2mIZ7GHOFJEcpZjr13vOovJsyo9fMWAnm66pxEg +DqNSop7GSDMvsDzu9NK5ubf2xWMLX1fFLSiZUA42RUU +-> ssh-ed25519 vT7ExA 24tU87648MvZgbvt9PNWBUQsQBDyeBd2QV0jiKGMwWs +mSuA/G6ZjRYhG3TMGt8SQ8aqK8s9s81YBslBwQLr4Fg +--- sr5nQObjSdkQ+eILGm+p/nnD1XxrcCXwVY70INFlZMU +ʛ.)uT}nw?]4^jk*y"#ON*6}yI.7TS-R \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index eecd4fc..f208dab 100644 Binary files a/nix/secrets/grafana_admin_password.age and b/nix/secrets/grafana_admin_password.age differ diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index 0465eba..110f671 100644 Binary files a/nix/secrets/hugochat_db_password.age and b/nix/secrets/hugochat_db_password.age differ diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age deleted file mode 100644 index cecada9..0000000 --- a/nix/secrets/immich_secrets.age +++ /dev/null @@ -1,6 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo -nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA ---- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao -x ll w\vS-!V]}g΃[>e;n0n!;L -+ \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 19d8d77..e0ebd1e 100644 --- a/nix/secrets/killua_env.age +++ b/nix/secrets/killua_env.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg w8lK7Dhc3CzenrzJTI32uTNgXVyBUKJf7F1xGG6AV2Q -wBlK8pbH1M0NBeAFjwLyyuOKT2jk+o1BwjkQPNc9pvY ---- 5hl/tchAPOurJ+fDLDB5/l/MuqrSTjV2Pnhc1Dy7Uhk -a.A hUwq<.dzXМ&;ⶸ9ۻͮc:z`D XLʳh\Yǝ'U^+^3k5t4 \ No newline at end of file +-> ssh-ed25519 qM6TYg 5HRKvL31uap1+SLnv05qGlV2nAq8Oduk3GNPoQAUyWo +RYng6wk2+XalYE/2N71L7dUpajuNycKs6naYSL9RZt0 +--- 2SyDL6m1ZyW7Lam875/RBW3sWP17/8Ceop7cB4ewx/o +%xD~ +% E އN#7䌪E2@۷"[JX*a0pR(FC7OLڤϠ={oёa[5C]:Z>rm \ No newline at end of file diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age index 48f95c0..06a17c0 100644 Binary files a/nix/secrets/knot_dns_rfc2136_key_config.age and b/nix/secrets/knot_dns_rfc2136_key_config.age differ diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age index fc3744f..f52b624 100644 Binary files a/nix/secrets/knot_dns_rfc2136_key_envvar.age and b/nix/secrets/knot_dns_rfc2136_key_envvar.age differ diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index 1c85165..2f5e05d 100644 Binary files a/nix/secrets/loki_env.age and b/nix/secrets/loki_env.age differ diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age index 05d0b31..336a71a 100644 --- a/nix/secrets/minio_env_file.age +++ b/nix/secrets/minio_env_file.age @@ -1,8 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg sx4kKW1m2RrcVkyxDMdDgh5jcwfrRDAFYa0EJBZKFnI -WPbchNFC7tTqC4DrIw7hUZSNNxE64kkXZdXB6/VFhj4 --> ssh-ed25519 XzACZQ GXDgzIGU4X6/oOr5hcI7SoorcowGPJHx/0X2+gj+Sk0 -NATuZ7IZ0QwM9/GtaYdLXjBs6X0enhpVgWvGVpyqOO0 ---- xMESjwLO7fJhwd0HnYzypoh3s6YRx86vSdXovvSBoHg -9I{֝ʼؐZd{YrXB= -l] Hܴ`lRΙRw8Qi4*t#͂ƚmȟ+6hS&VἙ';J0] = \ No newline at end of file +-> ssh-ed25519 qM6TYg t4OIcjhlaEBxFFK/VibGcE0D5zb4LrMv0zS1vxMKxHA +/OIYeC0s9Jd5R6MaLQPHlgscrSkNwpdK1doADIZwmHE +-> ssh-ed25519 XzACZQ 7ieKRLiY3EzGlRcAzxnhzDQkUMmpNutUViBeMrSkWkM +qxeyBVm6aHDH7oQXDShuEqUGY9W8bp2vHfWvJEssfLg +--- RuCRpuvvN5pIBe4zMaF0X0J5oW2z9ytkSfwKdkQlqo4 +t9͆//d3fY.h dg", ssh-ed25519 yMKb8Q IornZ92EjvlpeFh0JuSElL/iH1pEblFxfXp9QrTuelA -Js60AJA93bYHGsTEX8S94B7h37kh7vkWktcvbNJlg5Q ---- OiyTon34BUPU3DCFrMdc9FdDeLB2AquG97fgMQpDbRk -A/nn8)0y? C DV5_C©~Z&Rm8*;*~"[Zٌb2VI4J!,(Z^W%zV6-76Au2M8S5LD[O&C"ZF[ \ No newline at end of file diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index cea6275..65db4ad 100644 Binary files a/nix/secrets/pyroscope_s3_secret.age and b/nix/secrets/pyroscope_s3_secret.age differ diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index 9422a04..fedeb03 100644 Binary files a/nix/secrets/registry_htpasswd.age and b/nix/secrets/registry_htpasswd.age differ diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index 11fe1a4..8232f02 100644 Binary files a/nix/secrets/registry_s3_key_secret.age and b/nix/secrets/registry_s3_key_secret.age differ diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age index da31522..dc88b9b 100644 --- a/nix/secrets/restic_backup.age +++ b/nix/secrets/restic_backup.age @@ -1,14 +1,15 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg rRl7WcBUycyZnCXeuPgeCPUBRjl5fXbvErOtESs9Pjo -ra1UlArViFAgu3ldeOQ/I6/rsaSr0yGSMjQSl2V3JSc --> ssh-ed25519 91VHug Q8+LWlf3zKenc9Nw0SrC5IgHcUr9SkK3Se/exTlUs1g -jf1PEQiL1p6zg/VEFriXef5Oj6tiUMgXd6fvrxRTfew --> ssh-ed25519 XzACZQ L4Xe5fEXnXVCgoUmTnOoT+8SNx4Tcxuak6sKQBMU/V8 -Jt/U6vVTY6dOa8p/CZAZ6mkSvYAvz4k61W2vMfQIWb4 --> ssh-ed25519 51bcvA UWQ3aY+PLAPfYXaV6lcmVb22cuq8Tjjlr/YQv0LvXnE -lgUQBRTZ0/1UFGsiA5JMUvW2KJ/+Gz/Q8y8qk3pGozU --> ssh-ed25519 vT7ExA Xbbo3IR8gsXyQCuIzOwBWXqvEBAHm2L9oDPAgQoqkX0 -+Txx4q4u7sQnAykGwvi2sEBQNKf1ODkgMk0E2fD5AFg ---- KVYftap0YUB0g3a9/IdYghEHZMD0C7kJY+cvmQDG1no -˪ͭ 8gjYH}D>a!o)ˌv+M$J[+j -v;?l2a Rg+%!Ԍ `߱=CuE`o%XͼrLaYlX:F`_'ψ焧B⦁W70o Q \ No newline at end of file +-> ssh-ed25519 qM6TYg HodUMahq+fafwLXzUaC/Y2E2btbeC32/CwBPL7y5hlg +67R4TdZQNacpJLHCa+GdsycwWGekicCPhcOAQer7Uek +-> ssh-ed25519 91VHug ffJ4wwzD4G1wbS7XyQM4vQwjyv4llGHog9RxI5+JZXE +ybHjj+2DqadF21NjHHqB64zu+fWscbNFe/5zvgDIFP8 +-> ssh-ed25519 XzACZQ i7RCIUKgmO7BtDysfZ5wsBLbXwu2x0a2qOnmm9AdBHw ++VRFX+3yf4WHMoagaQOEl3Z0W0VWN0v1PqUrunfQrZM +-> ssh-ed25519 51bcvA ywiVAHSTYuHmuM7f0lrRHDR89B30BPi/u0esMNloJQc +0wbsh2I2pzhahpm662E3ulw76/YyvtTXBtS0mtg1/pM +-> ssh-ed25519 vT7ExA 7iK8tSFGz3EvsQw4bUkDMQSQdKshxFQTRLFo6wmVp3M +dsoqzeXaH8Wf9/VwZd483vi6bbkfwKcaPJllHoDFNEE +--- JR+WkrSCQyDgBaW016W/jnoT7UdeLUYAztu+zZ4Jk5U +c&qc3 +k`lo-;_{c9k*``"U][ƿLOH$?T߸$kNr" ~XRB}5cqKY=oH"u +s a7eAz#Iکf~M~AY2B!? \ No newline at end of file diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index ba1bd52..dcd8703 100644 Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index f02c447..8209c40 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -6,7 +6,6 @@ let vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C"; vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz"; vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ"; - minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG"; in { "widetom_bot_token.age".publicKeys = [ vps1 ]; @@ -29,10 +28,6 @@ in "pyroscope_s3_secret.age".publicKeys = [ vps3 ]; "restic_backup.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; - "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA - "does_it_build_private_key.age".publicKeys = [ vps4 ]; - "immich_secrets.age".publicKeys = [ minipc ]; - "paperless_env.age".publicKeys = [ minipc ]; "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ]; "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; @@ -42,5 +37,4 @@ in "wg_private_vps3.age".publicKeys = [ vps3 ]; "wg_private_vps4.age".publicKeys = [ vps4 ]; "wg_private_vps5.age".publicKeys = [ vps5 ]; - "wg_private_minipc.age".publicKeys = [ minipc ]; } diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 003343f..f976afd 100644 Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age deleted file mode 100644 index 42f873b..0000000 Binary files a/nix/secrets/website_s3_key_write.age and /dev/null differ diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index 59f797a..6b10eba 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0 -xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ ---- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE - -F0eҍY-{sh]ƬfApB^1e0!3s"j@=rRs(+" \ No newline at end of file +-> ssh-ed25519 LZU5Eg 2I80UG4n18vxvqUJXwKeAPqelD83nX/n8XHi/XVq208 +mDoUzJu9KfUFyzJPoLPU+xhSbGesECEQZSSrc38HA54 +--- J9+vPA8z+/8jcO/V9iVZ3tWJF4TUe+nD6fmjH6f5dmc +st v@<(xEh]8e-$K00T!œ<"5 SC#FZ wab \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 64d55f0..d713bf5 100644 Binary files a/nix/secrets/wg_private_dns2.age and b/nix/secrets/wg_private_dns2.age differ diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age deleted file mode 100644 index 1d0e1be..0000000 --- a/nix/secrets/wg_private_minipc.age +++ /dev/null @@ -1,7 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE -3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM ---- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w -@ -q,YL3)eqaK@]exC -tv-G!}Ji$=* \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index 5dd33e1..b1907ab 100644 Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index dbdcbd2..c83e0a1 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8 -Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I ---- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ -CqC!n ƈ,bA8"MeNьnM[(֡XͤX+~ؓSnKXi8> \ No newline at end of file +-> ssh-ed25519 91VHug YHHrtch+bKHxenRqMPSvqqby7odUGontauTfAfTAhlw +VDY1jPyeClwpg7Tq604rU+Po+nue7cBRqhIEdc8iiAk +--- mUabX/gruf9Erp4OeRmCEwd7KR2aTApviipXyCL1P+g + ɤR-Gu:7+"S5SS3\RpM?s0$@$) \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index f9b5098..e98d0a5 100644 Binary files a/nix/secrets/wg_private_vps3.age and b/nix/secrets/wg_private_vps3.age differ diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age index 0674d3a..0bd98e8 100644 --- a/nix/secrets/wg_private_vps4.age +++ b/nix/secrets/wg_private_vps4.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 51bcvA soCOaoBhsAvjaw29hw6Q9JkrLGbfQEwgszOIl38+CB8 -uj17MiT/crUT+LXF9TEylo131FV1cKQbNXQNWCI1djw ---- MAVo3X1mO0iUC0mEo4wbbDbK19hKxB/zEcfqfR4Bxsw -2}[I,sW/8KDkjzH,(nyߔ8uq.^PrͪCM`)1fy,XOҡ \ No newline at end of file +-> ssh-ed25519 51bcvA kyLCrT3jFu1BszuLMnyP0ej1kL5OvnAu/R6vR+PtYWU +n70Krz1NA1BHhMrJQprm+LBBhY8AeQwI1PvHbF628OE +--- VbdM9HH1CM+4f6z/5oSId9DW6Gi1+q3IuCE6qPKg1mM +@TY(QLYGHGnk ,]&%UfMWqxJk_kh(y k|*=Ik \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index 5bef662..e7eefdb 100644 --- a/nix/secrets/wg_private_vps5.age +++ b/nix/secrets/wg_private_vps5.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0 -/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE ---- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA -!p%~)6- Hy*e g pXѷӖk وm4bnx6de \ No newline at end of file +-> ssh-ed25519 vT7ExA 2giKg2lnsURC0VqDT8Ibfn9jvkIJUOwIZkRN0Px8OSo +g3ZQzVSDVUl/BX3tAktgkFk5lVKgplZa+vtLYSd+RW8 +--- 9ZTtNf9EG2B6oDyWYST8QiNGQHdYgQ5PoHzEHwW2eY8 +М?M-b>[;^]v|. +IylMs|N5Uj +:ʦET \ No newline at end of file diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index 05e6159..15060a6 100644 --- a/nix/secrets/widetom_bot_token.age +++ b/nix/secrets/widetom_bot_token.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE -DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA ---- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY -~'t/!Fb[k"yfiܨLGg!FqZaA3 -iE`v8<1Fmpx~)gc7R&%U'XDD \ No newline at end of file +-> ssh-ed25519 qM6TYg Xds9FlVzv4E6ZFFTH6zZwG8ewomPq5R3S3/8jDN7zw0 +l1EWvQR0RK865mVQVuCFuo+02HTzrHHlsY9r+E2/Nfc +--- n9KSdsLECG7uH0yD5GsWC/1mTDMXi/JLDJ++oUycTEs +Lw-b}T6kXS ҢF3q4yhz?hS8b=1)P*{˺S>(V+1y#*iBS \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index 374e672..d5f7e6f 100644 Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ diff --git a/nix/update-nixpkgs.mjs b/nix/update-nixpkgs.mjs index 4b3c155..fa63e62 100644 --- a/nix/update-nixpkgs.mjs +++ b/nix/update-nixpkgs.mjs @@ -1,22 +1,23 @@ import fs from "node:fs/promises"; const path = `${import.meta.dirname}/nixpkgs.json`; -const channels = JSON.parse(await fs.readFile(path)); +const nixpkgs = JSON.parse(await fs.readFile(path)); -for (const [channel, nixpkgs] of Object.entries(channels)) { - const res = await fetch( - `https://api.github.com/repos/NixOS/nixpkgs/commits/${channel}` +const res = await fetch( + `https://api.github.com/repos/NixOS/nixpkgs/commits/${nixpkgs.channel}` +); + +if (!res.ok) { + throw new Error( + `get commit for ${name}: ${res.status} - ${await res.text()}` ); - if (!res.ok) { - throw new Error( - `get commit for ${channel}: ${res.status} - ${await res.text()}` - ); - } - const body = await res.json(); - if (body.sha !== nixpkgs.commit) { - nixpkgs.commit = body.sha; - nixpkgs.lastUpdated = new Date().toISOString(); - } } -await fs.writeFile(path, JSON.stringify(channels, null, 2) + "\n"); +const body = await res.json(); + +if (body.sha !== nixpkgs.commit) { + nixpkgs.commit = body.sha; + nixpkgs.lastUpdated = new Date().toISOString(); + + await fs.writeFile(path, JSON.stringify(nixpkgs, null, 2) + "\n"); +} diff --git a/secrets-git-crypt/caddy_s3_key_secret b/secrets-git-crypt/caddy_s3_key_secret index 63db25f..955a6d8 100644 Binary files a/secrets-git-crypt/caddy_s3_key_secret and b/secrets-git-crypt/caddy_s3_key_secret differ diff --git a/secrets-git-crypt/does_it_build_private_key b/secrets-git-crypt/does_it_build_private_key deleted file mode 100644 index dca73aa..0000000 Binary files a/secrets-git-crypt/does_it_build_private_key and /dev/null differ diff --git a/secrets-git-crypt/immich_secrets b/secrets-git-crypt/immich_secrets deleted file mode 100644 index 8ad329d..0000000 Binary files a/secrets-git-crypt/immich_secrets and /dev/null differ diff --git a/secrets-git-crypt/paperless_env b/secrets-git-crypt/paperless_env deleted file mode 100644 index 21295ce..0000000 Binary files a/secrets-git-crypt/paperless_env and /dev/null differ diff --git a/secrets-git-crypt/website_s3_key_write b/secrets-git-crypt/website_s3_key_write deleted file mode 100644 index 3ba1e60..0000000 Binary files a/secrets-git-crypt/website_s3_key_write and /dev/null differ diff --git a/secrets-git-crypt/wg_private_minipc b/secrets-git-crypt/wg_private_minipc deleted file mode 100644 index 73a8795..0000000 Binary files a/secrets-git-crypt/wg_private_minipc and /dev/null differ