tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: tbarnouin:d6eb45c45ac8da5eeb68382ded065d4fc7a12fbd
Branches Tags
tbarnouin:main
..
compare: tbarnouin:0638a5d2e64c8fddd58cef166fc5f8cd83034829
Branches Tags
tbarnouin:main

No commits in common. "d6eb45c45ac8da5eeb68382ded065d4fc7a12fbd" and "0638a5d2e64c8fddd58cef166fc5f8cd83034829" have entirely different histories.
d6eb45c45a ... 0638a5d2e6

6 changed files with 36 additions and 76 deletions
Show stats Expand all files Collapse all files

1
secrets.nix
View file

@ -29,7 +29,6 @@ in {
"services/postgresql/secrets/authentikDBPass.age".publicKeys = [tbarnouin postgresql];
"services/postgresql/secrets/grafanaDBPass.age".publicKeys = [tbarnouin postgresql];
"services/postgresql/secrets/onlyofficeDBPass.age".publicKeys = [tbarnouin postgresql];
"secrets/postgresql-lapi-key.age".publicKeys = [tbarnouin postgresql];
"services/nginx/secrets/cs-lapi-key.age".publicKeys = [tbarnouin nginx];
"services/minimalConfig/secrets/cs-lapi-key.age".publicKeys = users ++ systems;

13
secrets/postgresql-lapi-key.age
View file

@ -1,13 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBabEhV
SnYvWTR6NkE1U2xUM3huNzZ3bUdXRVh0MTJoUjhTY2taNmY2MFdvCnpmNTMzMWM0
enhiMHQyWEpCYmxXZ3I3aStXYlh6UStrbFMvTTJwYjNOY2cKLT4gc3NoLWVkMjU1
MTkgc2luZ3ZRIHRHY0dNbUt0aTJQdzNGTGRXeC9jbVVoVmN2WFpRaHZIU0Qvb0c3
eUdhMXcKSi9NZEtjRENLNXFuVUVLdUlYbkNlT0EzeUVOSzJYcXlZcVRDaWFqMXVi
WQotPiBVb0wtZ3JlYXNlIGYrIEosIHpFRHBvbzI5ICljS0UKTmljdnFHQzBRTWxu
ZXpEdkhheHE5WVVJVVpXdzFaZC9HQ28KLS0tIDdmc3dNNGVYcC91QmQrcmhGaHhZ
WkNEa3FOcHZIU3loQmVDd29hd2ZqSXMKksjTw4Gh1PDeQpRnX5cg6uSv3hRRPL50
4xKqLKC7kmEoSU3PXSrNYV5yppD4V+LTnj/WRXgoBD9A89ul9PLvbmJpcxzB5SVS
+gAi73lGkRFhFrYv5eCzsIWgCfVhQZ/LeyN9ak56/OisJm0YOKntWPEN/NKjVi1x
AvFJ2jF+4bSy+BaDK0qTecHbnVfS8uW4lBr3FE7Tfj83TpI=
-----END AGE ENCRYPTED FILE-----

11
services/grafana/default.nix
View file

@ -189,7 +189,7 @@ in {
job_name = "jellyfin";
static_configs = [
{
targets = ["192.168.1.42:9002"];
targets = ["192.168.1.42:9100"];
}
];
}
@ -256,15 +256,6 @@ in {
}
];
}
{
job_name = "crowdsec_postgresql";
metrics_path = "/metrics";
static_configs = [
{
targets = ["192.168.1.13:6060"];
}
];
}
];
};
loki = {

81
services/postgresql/default.nix
View file

@ -11,10 +11,6 @@ in {
};
config = lib.mkIf cfg.enable {
age.secrets = {
postgresql-lapi-key = {
file = ../../secrets/postgresql-lapi-key.age;
owner = "crowdsec";
};
nextcloudDBPass = {
file = ./secrets/nextcloudDBPass.age;
owner = "postgres";
@ -36,58 +32,39 @@ in {
owner = "postgres";
};
};
services = {
crowdsec = {
hub.collections = [
"crowdsecurity/pgsql"
];
settings.lapi.credentialsFile = "${config.age.secrets.postgresql-lapi-key.path}";
localConfig = {
acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=postgresql.service" ];
labels = {
type = "syslog";
};
}
];
};
};
postgresql = {
enable = true;
package = pkgs.postgresql_16;
enableTCPIP = true;
settings.port = 5432;
authentication = "
host nextcloud nextcloud 192.168.1.45/32 md5
host gitea gitea 192.168.1.14/32 md5
host authentik authentik 192.168.1.125/32 md5
host grafana grafana 192.168.1.27/32 md5
host onlyoffice onlyoffice 192.168.1.46/32 md5
";
initialScript = pkgs.writeText "init-sql-script" ''
CREATE ROLE nextcloud WITH LOGIN CREATEDB;
CREATE DATABASE nextcloud;
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
services.postgresql = {
enable = true;
package = pkgs.postgresql_16;
enableTCPIP = true;
settings.port = 5432;
authentication = "
host nextcloud nextcloud 192.168.1.45/32 md5
host gitea gitea 192.168.1.14/32 md5
host authentik authentik 192.168.1.125/32 md5
host grafana grafana 192.168.1.27/32 md5
host onlyoffice onlyoffice 192.168.1.46/32 md5
";
initialScript = pkgs.writeText "init-sql-script" ''
CREATE ROLE nextcloud WITH LOGIN CREATEDB;
CREATE DATABASE nextcloud;
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
CREATE ROLE gitea WITH LOGIN CREATEDB;
CREATE DATABASE gitea;
GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea;
CREATE ROLE gitea WITH LOGIN CREATEDB;
CREATE DATABASE gitea;
GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea;
CREATE ROLE authentik WITH LOGIN CREATEDB;
CREATE DATABASE authentik;
GRANT ALL PRIVILEGES ON DATABASE authentik TO authentik;
CREATE ROLE authentik WITH LOGIN CREATEDB;
CREATE DATABASE authentik;
GRANT ALL PRIVILEGES ON DATABASE authentik TO authentik;
CREATE ROLE grafana WITH LOGIN CREATEDB;
CREATE DATABASE grafana;
GRANT ALL PRIVILEGES ON DATABASE grafana TO grafana;
CREATE ROLE grafana WITH LOGIN CREATEDB;
CREATE DATABASE grafana;
GRANT ALL PRIVILEGES ON DATABASE grafana TO grafana;
CREATE ROLE onlyoffice WITH LOGIN CREATEDB;
CREATE DATABASE onlyoffice;
GRANT ALL PRIVILEGES ON DATABASE onlyoffice TO onlyoffice;
'';
};
CREATE ROLE onlyoffice WITH LOGIN CREATEDB;
CREATE DATABASE onlyoffice;
GRANT ALL PRIVILEGES ON DATABASE onlyoffice TO onlyoffice;
'';
};
# Stolen from https://discourse.nixos.org/t/assign-password-to-postgres-user-declaratively/9726/3
# This is an awful situation

3
systems/minimalLXCConfig.nix
View file

@ -112,6 +112,9 @@
}
];
};
fail2ban = {
enable = true;
};
crowdsec = {
enable = true;
package = pkgs.crowdsec;

3
systems/minimalVMConfig.nix
View file

@ -99,6 +99,9 @@
}
];
};
fail2ban = {
enable = true;
};
crowdsec = {
enable = true;
package = pkgs.crowdsec;