tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Compare commits

base: tbarnouin:8a593936de6b8a3e299d77f6cf167a60e0102961
Branches Tags
tbarnouin:main
...
compare: tbarnouin:51affbb4a3761b0b601b50b9ad42ae0f59d01cb1
Branches Tags
tbarnouin:main

6 commits
8a593936de ... 51affbb4a3

Author SHA1 Message Date
Théo Barnouin
51affbb4a3 Fix pgsql init script
Some checks failed
/ Build Nix targets (push) Has been cancelled
Details
2025-01-28 11:22:42 +01:00
Théo Barnouin
e29eca289e Manage secrets 2025-01-28 11:22:42 +01:00
Théo Barnouin
89fd1f0a24 Fix pgsql init script 2025-01-28 11:22:42 +01:00
Théo Barnouin
7ec275cbe2 Manage secrets 2025-01-28 11:22:42 +01:00
Théo Barnouin
02e59846a6 Manage secrets 2025-01-28 11:22:42 +01:00
Théo Barnouin
e1ac22b278 Fix pgsql init script 2025-01-28 11:22:37 +01:00
14 changed files with 192 additions and 373 deletions
Show stats Expand all files Collapse all files

252
flake.lock generated
View file

@ -46,48 +46,6 @@
"type": "github"
}
},
"authentik-nix": {
"inputs": {
"authentik-src": "authentik-src",
"flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"flake-utils": "flake-utils_2",
"napalm": "napalm",
"nixpkgs": "nixpkgs_2",
"poetry2nix": "poetry2nix",
"systems": "systems_3"
},
"locked": {
"lastModified": 1737810234,
"narHash": "sha256-zTS99/ZE8khNnIWFEsF21E6seR9IizGYkY19t6iK7z4=",
"owner": "nix-community",
"repo": "authentik-nix",
"rev": "1fa3cbed36fb03d2f6ceab981d083af98b5c7d0f",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "authentik-nix",
"type": "github"
}
},
"authentik-src": {
"flake": false,
"locked": {
"lastModified": 1736440980,
"narHash": "sha256-Z3rFFrXrOKaF9NpY/fInsEbzdOWnWqLfEYl7YX9hFEU=",
"owner": "goauthentik",
"repo": "authentik",
"rev": "9d81f0598c7735e2b4616ee865ab896056a67408",
"type": "github"
},
"original": {
"owner": "goauthentik",
"ref": "version/2024.12.2",
"repo": "authentik",
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1725409566,
@ -126,40 +84,6 @@
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1733328505,
"narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-parts": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1736143030,
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems_2"
@ -180,28 +104,7 @@
},
"flake-utils_2": {
"inputs": {
"systems": [
"authentik-nix",
"systems"
]
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"inputs": {
"systems": "systems_4"
"systems": "systems_3"
},
"locked": {
"lastModified": 1731533236,
@ -262,7 +165,7 @@
},
"microvm": {
"inputs": {
"flake-utils": "flake-utils_3",
"flake-utils": "flake-utils_2",
"nixpkgs": [
"nixpkgs"
],
@ -282,54 +185,6 @@
"type": "github"
}
},
"napalm": {
"inputs": {
"flake-utils": [
"authentik-nix",
"flake-utils"
],
"nixpkgs": [
"authentik-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1725806412,
"narHash": "sha256-lGZjkjds0p924QEhm/r0BhAxbHBJE1xMOldB/HmQH04=",
"owner": "willibutz",
"repo": "napalm",
"rev": "b492440d9e64ae20736d3bec5c7715ffcbde83f5",
"type": "github"
},
"original": {
"owner": "willibutz",
"ref": "avoid-foldl-stack-overflow",
"repo": "napalm",
"type": "github"
}
},
"nix-github-actions": {
"inputs": {
"nixpkgs": [
"authentik-nix",
"poetry2nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1729742964,
"narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
"owner": "nix-community",
"repo": "nix-github-actions",
"rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nix-github-actions",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1725634671,
@ -346,38 +201,10 @@
"type": "github"
}
},
"nixpkgs-lib": {
"locked": {
"lastModified": 1735774519,
"narHash": "sha256-CewEm1o2eVAnoqb6Ml+Qi9Gg/EfNAxbRx1lANGVyoLI=",
"type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
},
"original": {
"type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/e9b51731911566bbf7e4895475a87fe06961de0b.tar.gz"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1737632463,
"narHash": "sha256-38J9QfeGSej341ouwzqf77WIHAScihAKCt8PQJ+NH28=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0aa475546ed21629c4f5bbf90e38c846a99ec9e9",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1737885640,
"narHash": "sha256-GFzPxJzTd1rPIVD4IW+GwJlyGwBDV1Tj5FLYwDQQ9sM=",
"lastModified": 1736200483,
"narHash": "sha256-JO+lFN2HsCwSLMUWXHeOad6QUxOuwe9UOAF/iSl1J4I=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "4e96537f163fad24ed9eb317798a79afc85b51b7",
@ -390,44 +217,12 @@
"type": "github"
}
},
"poetry2nix": {
"inputs": {
"flake-utils": [
"authentik-nix",
"flake-utils"
],
"nix-github-actions": "nix-github-actions",
"nixpkgs": [
"authentik-nix",
"nixpkgs"
],
"systems": [
"authentik-nix",
"systems"
],
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1736884309,
"narHash": "sha256-eiCqmKl0BIRiYk5/ZhZozwn4/7Km9CWTbc15Cv+VX5k=",
"owner": "nix-community",
"repo": "poetry2nix",
"rev": "75d0515332b7ca269f6d7abfd2c44c47a7cbca7b",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "poetry2nix",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"authentik-nix": "authentik-nix",
"home-manager": "home-manager_2",
"microvm": "microvm",
"nixpkgs": "nixpkgs_3"
"nixpkgs": "nixpkgs_2"
}
},
"rust-overlay": {
@ -498,21 +293,6 @@
}
},
"systems_3": {
"locked": {
"lastModified": 1689347949,
"narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
"owner": "nix-systems",
"repo": "default-linux",
"rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default-linux",
"type": "github"
}
},
"systems_4": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@ -526,28 +306,6 @@
"repo": "default",
"type": "github"
}
},
"treefmt-nix": {
"inputs": {
"nixpkgs": [
"authentik-nix",
"poetry2nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1730120726,
"narHash": "sha256-LqHYIxMrl/1p3/kvm2ir925tZ8DkI0KA10djk8wecSk=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "9ef337e492a5555d8e17a51c911ff1f02635be15",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "treefmt-nix",
"type": "github"
}
}
},
"root": "root",

64
flake.nix
View file

@ -7,9 +7,10 @@
url = "github:nix-community/home-manager/release-24.11";
inputs.nixpkgs.follows = "nixpkgs";
};
microvm.url = "github:astro/microvm.nix";
microvm.inputs.nixpkgs.follows = "nixpkgs";
authentik-nix.url = "github:nix-community/authentik-nix";
microvm = {
url = "github:astro/microvm.nix";
inputs.nixpkgs.follows = "nixpkgs";
};
agenix.url = "github:yaxitech/ragenix";
};
@ -73,6 +74,21 @@
}
];
};
pgsql = nixpkgs.lib.nixosSystem {
inherit system;
modules = [
agenix.nixosModules.default
"${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
"${inputs.self}/systems/minimalLXCConfig.nix"
"${inputs.self}/services"
{
networking.hostName = "pgsql";
services.vm_postgresql = {
enable = true;
};
}
];
};
onlyoffice = nixpkgs.lib.nixosSystem {
inherit system;
modules = [
@ -170,48 +186,6 @@
}
];
};
authentik = nixpkgs.lib.nixosSystem {
inherit system;
modules = [
agenix.nixosModules.default
inputs.authentik-nix.nixosModules.default
{
services.authentik = {
enable = true;
environmentFile = "/run/secrets/authentik/authentik-env";
settings = {
disable_startup_analytics = true;
avatars = "initials";
};
};
services.vm_authentik = {
enable = true;
};
}
microvm.nixosModules.microvm
"${inputs.self}/systems/minimalMicrovmConfig.nix"
"${inputs.self}/services"
{
microvm = {
volumes = [
{
mountPoint = "/media";
image = "/var/lib/microvms/authentik/media.img";
size = 2048;
}
];
};
services.micro_vm = {
enable = true;
hostname = "authentik";
vm_ip = "192.168.1.25";
vm_cpu = 2;
vm_mem = 2048;
macAddr = "02:00:00:00:00:25";
};
}
];
};
};
};
}

5
secrets.nix
View file

@ -5,6 +5,7 @@ let
forgejo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2NAam+nseSCzJV/1UTyO2LgMjx0xT7/vTOOi5EG9HV root@forgejo-runner";
grafana = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQxvO9vdd2f9aV4F3LEQrrTJaLwLvSLbLtjB9qNxc4z root@grafana";
onlyoffice = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbnzv2/Or4XdQXLDjIbr7oIDTQEvgSMTX4aiNCQk4tC root@onlyoffice";
postgresql = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJW7qA7j1sICuu1RAfs9ifR9dmOlHq45tKu1ga7CKaob root@pgsql";
systems = [forgejo grafana];
in {
@ -14,4 +15,8 @@ in {
"services/grafana/secrets/kuma-token.age".publicKeys = [tbarnouin grafana];
"services/onlyoffice/secrets/office-dbpass.age".publicKeys = [tbarnouin onlyoffice];
"services/onlyoffice/secrets/office-jwtpass.age".publicKeys = [tbarnouin onlyoffice];
"services/postgresql/secrets/nextcloudDBPass.age".publicKeys = [ tbarnouin postgresql ];
"services/postgresql/secrets/giteaDBPass.age".publicKeys = [ tbarnouin postgresql ];
"services/postgresql/secrets/authentikDBPass.age".publicKeys = [ tbarnouin postgresql ];
"services/postgresql/secrets/grafanaDBPass.age".publicKeys = [ tbarnouin postgresql ];
}

22
secrets/initialPassword.age
View file

@ -1,13 +1,13 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB5SjZL
dXhYcTh4RjBrUmhSSzBaWXRNZUQ3V1NVRTBZUzNLeUZCYkJmWGpNClZwMU9ldXRK
OGhZNXlFcEE1YzNGSVIwdzBXbFN4SlNWUWMwOGlEMnRQUG8KLT4gc3NoLWVkMjU1
MTkgTVRPMXBnIHJSKzh1ZzZGeUJldW15Z2o3ejBqUC9EYUlNcHd5ZEEyRTNTQ2xS
STEwaGMKSHNVL1l3cnVQOHIwQTZZN0VqWHgvaXh0UmFxdEE3eWZqaXZFZjQwS05h
dwotPiBzc2gtZWQyNTUxOSB3bkVVcHcgVG9KYmRZenoyczJVQjhYbGkrQXdOclRJ
anhyVS9va3ZxcGVlR3BKV2xoVQplQk15MFhUdzF1REV3Qkt0dElaTTA4aTVBcGNH
ckxTWHh2dFVvUlo2V2JjCi0+ID9BQCstZ3JlYXNlCnVVWno2OEl1NVVNRy9VSHky
TjhGVDFHVjV2ME1GV0o0bHY0NlFoRGFyK2xvSlJudHNBCi0tLSBRd2hIUFV6Tndk
Z0pTenY1YUpEbldvcG1RdzdWUTZVYjRKMkNrZnpOTklRCo2ITrJB/w2tgDVxFe9e
jrmYkqnpujXppfQHXMhDGzdIPrAIEJrEMJp95sdz4EFqqk5mgu3K
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBIZzc3
NEpKbjZKaHNJTkUwbUVVWkRNYzRVZ1g3aHFWbmw0RjByQy9DNUY0ClBraUZmM29P
dW9RZXNhUVZQajQ0VVZzN3E2ZjlQa2hIN2QrOG4vamVhUTAKLT4gc3NoLWVkMjU1
MTkgTVRPMXBnIFBFbFVLNFBSdmQxeWhkWFcyRkdidUJDMHVhcWtuM0RNYU9MN25G
bWtqaGMKM1dDYTJjY3lwQlRGSU1nSERxWkYzck1JU21kaDBvelgyMUhXd2NabzFJ
QQotPiBzc2gtZWQyNTUxOSB3bkVVcHcgN3NVYnF3blJYdk9NMlpFeHBkSWpmL3hX
SVlZakZ0VG5SZjJzODNKZ2UzRQpXeWhBWm1GU2czTzhZN3hvQXErQ2xzWlBrdGM3
bjFmQXRTQzJTNzlXeUFRCi0+ICZEazJMXy1ncmVhc2Ugb0Qga15CMW83OGAKSEk5
ek9EV09TMm4vUGJEWDgwRnY4b0I3Z3ZxQk5GS0x5eEgyNFUvS2h3Ci0tLSA0RHBw
WXNxTGtDUHlVQ2ZHWk5WeGtuTTVseDFHeWxBcFZzNFRwUWptZHRvClgW5JGwRhTf
X5W+zQOJKbaiChYCtdqrPnEd4tRJMnMtm19UIUnR7asWmDdl8LU7DvodK4UA
-----END AGE ENCRYPTED FILE-----

18
services/grafana/secrets/grafana-db.age
View file

@ -1,10 +1,12 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyArbVYy
QVAralludnhwNVJSMC9WeFAya3J5NUtuemx0TWNid084b3gwNHdRCjlqMVR5K0sx
TTdOT2NEYzMwRCtyWUY2eGVOUmpsKzU4SENiSmJxYzdqWWsKLT4gc3NoLWVkMjU1
MTkgd25FVXB3IDlQTWpieUFDTDluV3VlaEV6ak9FRlJ4VVY1NlJWNkdIR1VKcmdl
RThjeHcKMjlSQ3lFMVI0NlRReDIvbjFRQ2FQclc0S0VnRTFCeUp0S25VVW44NDVQ
UQotPiAqTmpzJVctZ3JlYXNlCkYzVkUKLS0tIGpiaGhyMWl5VjMvZ2REVXJXb3FV
V25rTjRORDVXTDZZVG9MbnZFRUU4NlUKsUTcVfmpxX5claATFT9wTiFd2DFLJ9KV
+Un8kZobFeAjeLCZ3r/Cb8vUtw==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBINHll
clhGaUlhZ0VIZUV1b0lzYVpvbEVrUk1SRmdla2s5MVJRT0pYM2tVCldnMWprYVpo
cHNkTGlUWHU4SzdwZDVkSlYxeUJXNlJ6TGpVVVdvVzErdlEKLT4gc3NoLWVkMjU1
MTkgd25FVXB3IDhEOUt2anYvMjg0ejlhZk9NQy9aMi9zV3hHVzhsOXRlbHU4d2hL
bi9lQk0KRUNpcnRVaXBWOGZEN0xSaURwanBEODhkWkVuYnBVbCs1V0c0YzBMOVlo
bwotPiBCR3wtZ3JlYXNlIEVZc2Zcfgo3SHl2UUV2TUFSUVZnbjJ0WDdWb0lRTUFz
bzhGNTd5dzdTN3VpUjBXdVZ5NGJwMkNLMTZncjFjTDNOQm5tVllZCmFZejlaS1FL
UFZwK3hMT05KQ20ybS8yT0lCU0FaM280R1prRnVBCi0tLSB1MWoxYzJ2bVNuTTZN
eDE1dzFoNjBmc0dacXZrMXJkMUpKU3JReE93VEVnCmIawaa6DCtgRRHcp0kS6MCl
1MOX+wYg6YIE7UJ5cx6w9cQVIO4sfkx8e8U=
-----END AGE ENCRYPTED FILE-----

22
services/grafana/secrets/grafana-oauth_secret.age
View file

@ -1,13 +1,13 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBtMm9n
VGJyeEdFckZjWHNybm94b2crSE0wclE1QlRXZkVGMVk4U1hMdFJBCnhQL3FSdW9l
cUdNNThIdDVwQkxZWEQ2ZXZuekpKcWxQNy9jZlVoTVArZEkKLT4gc3NoLWVkMjU1
MTkgd25FVXB3IEtwTmV3ckQybkd3L3R0TFp0a2JMTzNiMmdyNkNyVkdHUkQyd0Fm
cGkxamMKeGNCSmF6TCtkVXZ5WG5Cd1F6WmkxWjlRZ0FCZ0p1NklPcmw1bFJ6dFNv
ZwotPiAoLWdyZWFzZSAzfUpGL0QgOEtFWXdwCnJCNTFoeTQzUVJlejRUakRqREVy
WS8zTmh3aUptcE56RDBqMld3NXNKZwotLS0gRnlBdEc1cVZOeDFQblAwOVN1MDUx
Yko2UEJ6UE14Z3haUW5XWjJzNFVodwrg7eJ6dnbIAjvsz/XoktAot7G1+u1UJsAE
QkLEtM7DpcFEvESO3JOhuIO/l6qoWjDuksh7yNhdLv2uOKa7ZpM5Q0DGFnRke3Qk
RU2E2UU4w30cmAXFm75NT2T9Po0R182Px25gV7fvfNHMHmONFJZRqNxS2IUDS20W
hDqk+ea9mnYNG1icpmYPj56OpKt+mqrf6kSFuU+R6zwIcoKpMR2wCA==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB3YTc2
dFJoTkttVnYwNW0rY2pDWmVXV25aQTNvR2tKY3pZVmlvZlVrWkhNCkFXZkxrMXAz
dVhrVXhVMnJOZ2ZlTE1LS1ZyckJuMHB0a2NjNDVIZFJGNlUKLT4gc3NoLWVkMjU1
MTkgd25FVXB3IEZVT1dYZHprQXJpR3JjVzRWcVQ1WHcyTkxkZHNqM2syWkNzOHpQ
OUx1VW8KVWlzSVhPZnhZcmJEMzFabytQY0MwbWNQenJRcUxvV2w5aW9LV3Fickh1
MAotPiBHTCcvQy1ncmVhc2UgTV1zNgpZNWswWE5DdEZXVVBzeFR3R2taZFpHakxS
MEppblllczc3bWt0NmJzZDZrZTlYblJIWDQKLS0tIFJHWWVQL3VvTHF1OVBITXFH
WVlhcUlrRldLQWNUZVJIOGY5OUtIZzlmdFkKHUb1KkIRJuEKk430LNP8gNQpDtlo
ifMWwhBcrDDOUxQSpEow42sgbIbCpvHt+gMgMCz2sLbdBnEUfCAIuG2SRZF3sfvD
JxY8/0mtK0upF+7jb3oCeGN9ah+gGoHEwKjRnBP6zFHG+yRMNQEiqO5h07JGEtrV
junjkEC11HAgybtC+gzr7Visx91cyK52ZIsNdg0AI9wM6EGUIX3quC3zGpw=
-----END AGE ENCRYPTED FILE-----

20
services/grafana/secrets/kuma-token.age
View file

@ -1,13 +1,11 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBTQUxm
NFREMUViaURWUURzNmxXMjRaZXlYVWczUUs5TXJ0WXIrdEhHTXljCnlBeEhhUmdq
eGlYbTV3eEg5blBaRnIwRWcycmJOd3NZZUpLMUU3RXo2SGsKLT4gc3NoLWVkMjU1
MTkgd25FVXB3IGlZVURNTGdzMGozbnJBMFdoRTI0aDhoeXk0UkxMYVFYaERXWHo2
RjRLVzQKbjhDQWQrSlF3enRDcE5lcXRDYitvcDdlT3pEbjNUMDRDbE9tUGdUZWY4
SQotPiBRTCcuLWdyZWFzZQpHVGFOQ0NSZ2c5V1MvZ3UxZXZ6UFhaQ1pBT0NGa0RB
MmVnakZMcTBLWnhEK3NWaGJEeU1Xd01lT1pWQ3N5aHFqCmlHelRmdUkrT0c1ZTZP
VmJRQVlweURMd3htM2IvN3o4NDM0MjduQ0w1a1VaRjBjcgotLS0gTmRzWC9VZjhv
N0VjUnZjbUpCdWIvaVNSRFlObVc3T0NDMEpKWVFVS2RTOAoVROmS4bW4nX6JXqWC
DAcXSN8GvUVqrbnh7W6KHpPLvUc3AK1dZ6cKqb91WOQVBpEOfjWqd7tE8Rp+IAa7
/22y3xxHOz46gLDI4Byyjw==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB1OE5Y
T3FiL3VKNG1HRDZHcHpDMGtvaDR1V25tT1dOYXRRM0VEUjYyb3c4CkRkSE95dkpp
SnVROXcyZGNmTkZUNjFtQnF5dDRRc2syaWoydGk0V0FBRWcKLT4gc3NoLWVkMjU1
MTkgd25FVXB3IG5yMjlBYThRMkdYZjVIWVhIbXk3UjNMTmtKTktkQTlVaEdqZDEw
d0NYUzgKbEo4bnVpOEFlT05PdWo2bGFlVTMzVmJOODFpTzErWDYvRm5tNk4wbm1G
WQotPiA5NHEtZ3JlYXNlIFlHI3NaIFNBfDIgKzBARwoxL1BNNzNQWkU1elZqVDhr
NEJURHI2TQotLS0gWFBJUXpmRU95S1p1eDR0cC9Pajc2aUZJL0JFbU5XWDZpU2Va
SGcvaHJDVQr9/6z8OCUSXg88ib9iqQAGp7ozAaslowdoONR/gSUelziKvaCEP/Cc
1GQOMJy8W2Q/oBwAavq+qi4QKTSYXQ5dDmkip8fBU+Df14euww==
-----END AGE ENCRYPTED FILE-----

17
services/onlyoffice/secrets/office-dbpass.age
View file

@ -1,11 +1,10 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBocWVS
dS9jdG85QSsza20rbWhBVkwvQXF1dWxYNDMrSURhMk5RSktFNGhFCjJGY1pPazdV
b3ZJMGVaNC9VcGxoZzlhZWFSYUkzM0hFdUNCaFRXSDNqV2sKLT4gc3NoLWVkMjU1
MTkgSXpNcXdRIDhMeStYYW1RWEg4ZHFReFF6QjhONE1SUi9wbTVMVi9vQmRxS1dM
SWlmU2cKRkdlK1pIRDAzd3laVXg5Q0dIQllQbkF1cjhVeEpwa1c5d0xWVUFxMThW
awotPiA3US1ncmVhc2UKUmFCODRUSi9zdzdlcitUaXNwTHg1eHE5QjhmVEZaa09P
dUphRkRkajRXTmpWUUh3U1ZySk0xNUhLaVpCaWlVCi0tLSBWQkprbFBXOWNjU3pt
UVpza3ZjSDk4QllEQnpIU3BoNzU5L3RLS1hOZHRFCqYg1Z912qrGFWLIfhSyoKiW
r0cvLu4276n5bEw0rUzpyPrr1QaXHdOyjdNOrlc=
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBxVVZD
ZUFVVTZESHNCb01Kc0pPb3dKOXZKR0RYS0ZQcXhvQ2RzbXNKRGpJCjFaV3AyQUY2
OTB1L0JrZTlFMy9keElTS01IVS92YWRBSVRuKzFFL2pSVU0KLT4gc3NoLWVkMjU1
MTkgSXpNcXdRIGI4U202VWRydGhVSzhJUFpLeDJZZkVoeFIzZFRQRjhYcWcybkhr
ZWM4MFkKSXpzT3E2OXRJVjc3V05XaUxCNW1aQm5kKzlrYzhWRUxoWndCaTRqa2Q4
MAotPiBWLWdyZWFzZSAyOGsxIFI2R3EgIT0ueSBDd2o9NGp9CkZBCi0tLSBWRlc4
RFFYOEkvUmY3TUFSa0lmZ3kvMG9IdGxUakhvMWhPWjhzOXhERmZrCkil25ySWO1w
BYB6Wt5MfsL7I5Izfdfpw0lqniC5r/4oh+lDQUcvsi1vQx+BRe8=
-----END AGE ENCRYPTED FILE-----

17
services/onlyoffice/secrets/office-jwtpass.age
View file

@ -1,10 +1,11 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBybjlG
ZXVqakxMNjB5L1dDZnZnMW92M3lpTnhwMU1qMXdVYmQ1RXZwTFJnCkV6L3lKSXA1
Y0FqQ0htUzdRTXFqVitIVUp1K2VKc2RUNTlQNWJLVTBFNDAKLT4gc3NoLWVkMjU1
MTkgSXpNcXdRIDVXRUlBcHRucDc3ZzM4SG9UUUY0dzNJV2ZlWkRncXVGWm5Gd2xp
U0E2d0kKOGNTUXhFL2xDZTNPK2MrVTA0Qjduci9rS201UDJYaDlaajV3Q091VEFq
RQotPiBxZy1ncmVhc2UgPmYydCBwfG8gPCBhWGFgYUYqLwpYZWMKLS0tIHlrbkd1
b1dQdTJKVXhYMlhJdmhCU01iT0ZpRC9BZEVXSXhsWDBjc09yMkEKi3aQtU6pMcZ+
F+DZFI/hTYJ3AXYhkyTlNK47SzF4Ut6RLqzvUAT0scIf1kGepzITUg==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyAvVWNp
a1BjZG8vWC81SlhUT09SSERWUGtzNGtFYzYwbjJYTEZZL1VZKzFZCjA5djJNQ0tJ
SEIvSjVCaDVaK1FvUG8yNW4rd0N4cTdTLy9PT0p3WFd5bUUKLT4gc3NoLWVkMjU1
MTkgSXpNcXdRIFp1TmhSSlRKdkFSeUN6YnJwV2pXWVFyZTBkWWZNOG8vbDFrenlu
QWF3VGcKUmNMbUVkbnpwQ3M5bnJTSjdGYWZiSldncWtwU3BZenZ2OWZ2YStrTHlh
SQotPiAwRS1ncmVhc2UgT2lrPQo3YVREamovMVhQSSttUXNiNkVZMW83alFDaDRv
N1JzOXg2b1dTNWxja2oyYlNaSS8KLS0tIFQzc1Bqdmt4Zkc4NVZBOHM5b1NNL0dC
L1lRTjA2enE3NlFDRkN3cmV0MjQKEI287XlTGhe+gTmysPhQXPNALUj3QzDnmznB
dnY2NmBArjrXnanMONycttWH2hwz1Q==
-----END AGE ENCRYPTED FILE-----

82
services/postgresql/default.nix
View file

@ -10,43 +10,79 @@ in {
enable = lib.mkEnableOption "Enable minimal config";
};
config = lib.mkIf cfg.enable {
age.secrets = {
nextcloudDBPass = {
file = ./secrets/nextcloudDBPass.age;
owner = "postgres";
};
giteaDBPass = {
file = ./secrets/giteaDBPass.age;
owner = "postgres";
};
authentikDBPass = {
file = ./secrets/authentikDBPass.age;
owner = "postgres";
};
grafanaDBPass = {
file = ./secrets/grafanaDBPass.age;
owner = "postgres";
};
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_16;
enableTCPIP = true;
settings.port = 5432;
ensureDatabases = [
"gitea"
"nextcloud"
"netbox"
"authentik"
"grafana"
];
ensureUsers = [
{
name = "gitea";
ensureDBOwnership = true;
}
{
name = "nextcloud";
ensureDBOwnership = true;
}
];
authentication = "
host nextcloud nextcloud 192.168.1.44/32 md5
host gitea gitea 192.168.1.14/32 md5
host netbox netbox 192.168.1.45/32 md5
host authentik authentik 192.168.1.125/32 md5
host grafana grafana 192.168.1.27/32 md5
";
# Not great, not in prod, cleartext pass
# waiting for ensureUsers.*.passwordFile option
# https://github.com/NixOS/nixpkgs/pull/326306
initialScript = pkgs.writeText "init-sql-script" ''
alter user gitea with password 'password';
alter user nextcloud with password 'password';
CREATE ROLE nextcloud WITH LOGIN CREATEDB;
CREATE DATABASE nextcloud;
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
CREATE ROLE gitea WITH LOGIN CREATEDB;
CREATE DATABASE gitea;
GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea;
CREATE ROLE authentik WITH LOGIN CREATEDB;
CREATE DATABASE authentik;
GRANT ALL PRIVILEGES ON DATABASE authentik TO authentik;
CREATE ROLE grafana WITH LOGIN CREATEDB;
CREATE DATABASE grafana;
GRANT ALL PRIVILEGES ON DATABASE grafana TO grafana;
'';
};
# Stolen from https://discourse.nixos.org/t/assign-password-to-postgres-user-declaratively/9726/3
# This is an awful situation
systemd.services.postgresql.postStart = let
nextcloudDBPass = config.age.secrets.nextcloudDBPass.path;
giteaDBPass = config.age.secrets.giteaDBPass.path;
authentikDBPass = config.age.secrets.authentikDBPass.path;
grafanaDBPass = config.age.secrets.grafanaDBPass.path;
in ''
$PSQL -tA <<'EOF'
DO $$
DECLARE password TEXT;
BEGIN
password := trim(both from replace(pg_read_file('${nextcloudDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE nextcloud WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${giteaDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE gitea WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${authentikDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE authentik WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${grafanaDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE grafana WITH PASSWORD '''%s''';', password);
END $$;
EOF
'';
networking.firewall.allowedTCPPorts = [5432];
};
}

11
services/postgresql/secrets/authentikDBPass.age Normal file
View file

@ -0,0 +1,11 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBDODRK
d2pTZktDczVpSjBYdWNSVFdUL1k2TVlmMzlJRnAxQ0dhcXV3elhjCkd2V3BXVWMw
YUdtYTFzUGZyaU05R0dPWGNHYVR2TWYvbUtSdSt4TUlVQ00KLT4gc3NoLWVkMjU1
MTkgc2luZ3ZRIDZ5L3I2ZmErNjNuYnh5QTRwNkNVVGhLSE9JMjZROFU0ZnMrelQw
WUJmQ1UKL2Y1T3pER2ZIdUloTTl1dU13RWRKL2tQangycTBzWHJ5dVByYVNuNVdY
WQotPiBrRTwnPigtZ3JlYXNlCit3QldhZUhmZ2kzS3VHK1pweGRxQ1V1eFA2eEtu
bmJWRzZqdjY0SUNlZFNaVG92dXRnCi0tLSBIb0JVbk42aVowT1p4cEtVbUJneFRP
dmNlZTdBcm9OZUVuOUxIbUc2VUZNCsahsNPPKDASJc0LKL+vxvXC81q3fBoSz9c3
Vxw9grzRH+aWXhKY+cxrOl6WOXTjCQ==
-----END AGE ENCRYPTED FILE-----

11
services/postgresql/secrets/giteaDBPass.age Normal file
View file

@ -0,0 +1,11 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyAxUGZT
Y1JMSE5MNTlmR3N2ZXJQV2xoK3BTNWZJa21uVjhac0VQOTd2YVZnClJqbnNEWFln
NTZncyttV0RBU2NBbkRrME1mNjluaFkrQ3pMTWhBR2VPTEUKLT4gc3NoLWVkMjU1
MTkgc2luZ3ZRIEZBVytVcWZ2QVRmQm1BblZ1UEgxWVRwTFgxU1BJRFRiUUdGa2Ny
bnJJMmcKRms5bUtDdHUvS1BzTFViOTJ5RnhuQ212aWFWSHFXdm9uYVZjcU9sWHlz
awotPiBRLWdyZWFzZSBkP1RWKHxtCi9LQWdLV0hwRTFhQzhSb2Y5Z2QzY2xWd1ZS
dFhoZGFRbnNIS2loeUZDVUZpd3VsTllLc0xva1ExYVpXRHY4ZwotLS0gbVd5NWZq
NDkvY3JUbkMyS1o0U0hiMkMxUjdFTTBqWGZDT3ZpUnNYQThUOAqBMtKcCEvvDrTm
Rz3S4csriN1X6gGEOURKVmKDXO5P8O7yMGzRjl8MkpSOIw==
-----END AGE ENCRYPTED FILE-----

12
services/postgresql/secrets/grafanaDBPass.age Normal file
View file

@ -0,0 +1,12 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBQT3I4
MFB6SzNuTlFXbkdOcTlERnZTbmYvTEJUamlKS2tmWmpnZ1loTmhBCkpBaHVtbWQ5
QUFQTE5YR0VUSW15MHhlQkRxVVRyb0NQck5BbXM5NmtCdlEKLT4gc3NoLWVkMjU1
MTkgc2luZ3ZRIHF5VXZqOXhlR0lMRDRrTk90bUw3dDIwN2NieGpjOHUvUUliTDBh
WG1VbDQKWjZ5NGZrQW1OS2tDL3JId0Q2WU1rdndmQ2svUE5nYlh6QVBUY29iSzFt
VQotPiAjLWdyZWFzZQpuSWxGdGhlU3NYUWh2RTU1R1dYYzg0OG1ndjRLUnA5UjlQ
ckxncDNUR2puQkhNOFJFNVgybkVPczRyUmJwanZFCmV6endjbmlKRXpIaVZ3Nith
Z0dDZ00rUGxzbGxpVnZoV3pIYUk1Q3J0R0RDWW1ITFpNWXMybi9YT1dBeAotLS0g
OFl1aktFMDh0b3lQdmoyOXcvZ1doTVh4U3JZd0hpcDAyc1J3QlZLZklLawoL8YjP
b+cpjtpje2h4fuxNLvEviqW92K6t8l4wf0sVlDtiH2Qf6FnwSYYkElb5
-----END AGE ENCRYPTED FILE-----

12
services/postgresql/secrets/nextcloudDBPass.age Normal file
View file

@ -0,0 +1,12 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBxaU02
T0swYkQ2S2cxblRuM2ZHZ0F4WmMzNDd5ZHJLcVF5SjJiYWhJS1NNCm9pcTRCWHJL
RWVUTEJTalEwOHh0aDlJZHF5S0NWN01zY3hMVG91SHk4NWcKLT4gc3NoLWVkMjU1
MTkgc2luZ3ZRIHdoL0F2MHY4VWxTWDR1c1c4bTh2eHVQU0FoWDFwdHhsZE16Wms4
UXFFaXMKSFZhTi9TRUh3akNvNStlQ0w2T1FnRTdOWFhZaXh6RGYrQ0NlUkdyejAv
UQotPiAlJilLPy1ncmVhc2UgUWB3RApyZVFkR1Y0SXdFSUxzUzAvZVZuWEthODY3
Y3dVbVFWMGR3ZURqZXdsSzE4KzVNdzFlS2dRcW5maG5MQ3Y4SEdZCnlLMUlKWG1Q
eFpLTUtRCi0tLSBsU1pRemZQZmhDK21SbVRvQW9NSFlCdG9YR0ttRlM2NXUzTjM0
ajRBc05zCo0JQrIpSdXQTgcTULp18sAFF1aGwlgthv6lSetqlQLeusaEuVnR/rf2
G3ecxNZ2TA==
-----END AGE ENCRYPTED FILE-----