Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-03-27 06:10:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Updated nix for 22.11 (4)

Browse source
This commit is contained in:
Julien Malka 2023-01-05 17:15:06 +01:00
parent 3b57581c17
commit f6862a1944
Signed by: Luj
GPG key ID: 6FC74C847011FD83
2 changed files with 81 additions and 77 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
modules/bincache/default.nix
View file

@ -18,7 +18,7 @@ with lib;
users.users.nix-serve = {
isSystemUser = true;
};
nix.allowedUsers = [ "nix-serve" ];
nix.settings.allowed-users = [ "nix-serve" ];
users.users.nix-serve.group = "nix-serve";
users.groups.nix-serve = { };
@ -32,5 +32,6 @@ with lib;
port = port;
};
} (mkSubdomain cfg.subdomain port));
}
(mkSubdomain cfg.subdomain port));
}

153
modules/drone/default.nix
View file

@ -14,85 +14,88 @@ in
};
};
config = mkIf cfg.enable (recursiveUpdate {
config = mkIf cfg.enable (recursiveUpdate
{
users.users.drone = {
isNormalUser = true;
createHome = true;
home = "/home/drone";
extraGroups = [ drone config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
users.groups.drone = { };
luj.hmgr.drone.luj.programs.git.enable = true;
nix.allowedUsers = [ drone ];
sops.secrets.drone = { };
sops.secrets.ssh-drone-pub = {
owner = drone;
path = "/home/drone/.ssh/id_ed25519.pub";
mode = "0644";
format = "binary";
sopsFile = ../../secrets/ssh-drone-pub;
};
sops.secrets.ssh-drone-priv = {
owner = drone;
path = "/home/drone/.ssh/id_ed25519";
mode = "0600";
format = "binary";
sopsFile = ../../secrets/ssh-drone-priv;
};
systemd.services.drone-server = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"DRONE_DATABASE_DATASOURCE=postgres:///drone?host=/run/postgresql"
"DRONE_DATABASE_DRIVER=postgres"
"DRONE_SERVER_PORT=:3030"
"DRONE_USER_CREATE=username:JulienMalka,admin:true"
"DRONE_REGISTRATION_CLOSED=true"
];
ExecStart = "${pkgs.drone}/bin/drone-server";
User = drone;
Group = drone;
users.users.drone = {
isNormalUser = true;
createHome = true;
home = "/home/drone";
extraGroups = [ drone config.users.groups.keys.name ];
passwordFile = config.sops.secrets.user-julien-password.path;
};
};
users.groups.drone = { };
luj.hmgr.drone.luj.programs.git.enable = true;
nix.settings.allowed-users = [ drone ];
services.postgresql = {
enable = true;
ensureDatabases = [ drone ];
ensureUsers = [{
name = drone;
ensurePermissions = {
"DATABASE ${drone}" = "ALL PRIVILEGES";
sops.secrets.drone = { };
sops.secrets.ssh-drone-pub = {
owner = drone;
path = "/home/drone/.ssh/id_ed25519.pub";
mode = "0644";
format = "binary";
sopsFile = ../../secrets/ssh-drone-pub;
};
sops.secrets.ssh-drone-priv = {
owner = drone;
path = "/home/drone/.ssh/id_ed25519";
mode = "0600";
format = "binary";
sopsFile = ../../secrets/ssh-drone-priv;
};
systemd.services.drone-server = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"DRONE_DATABASE_DATASOURCE=postgres:///drone?host=/run/postgresql"
"DRONE_DATABASE_DRIVER=postgres"
"DRONE_SERVER_PORT=:3030"
"DRONE_USER_CREATE=username:JulienMalka,admin:true"
"DRONE_USER_CREATE=username:camillemndn, admin:true"
"DRONE_REGISTRATION_CLOSED=true"
];
ExecStart = "${pkgs.drone}/bin/drone-server";
User = drone;
Group = drone;
};
}];
};
systemd.services.drone-runner-exec = {
description = "Drone Exec Runner";
startLimitIntervalSec = 5;
serviceConfig = {
User = drone;
Group = drone;
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
};
wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.openssh ];
};
} (recursiveUpdate (mkSubdomain cfg.subdomain port) (mkVPNSubdomain cfg.subdomain port)));
services.postgresql = {
enable = true;
ensureDatabases = [ drone ];
ensureUsers = [{
name = drone;
ensurePermissions = {
"DATABASE ${drone}" = "ALL PRIVILEGES";
};
}];
};
systemd.services.drone-runner-exec = {
description = "Drone Exec Runner";
startLimitIntervalSec = 5;
serviceConfig = {
User = drone;
Group = drone;
EnvironmentFile = [ config.sops.secrets.drone.path ];
Environment = [
"DRONE_SERVER_HOST=${cfg.subdomain}.julienmalka.me"
"DRONE_SERVER_PROTO=https"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec service run";
};
wantedBy = [ "multi-user.target" ];
path = [ pkgs.nixUnstable pkgs.git pkgs.openssh ];
};
}
(recursiveUpdate (mkSubdomain cfg.subdomain port) (mkVPNSubdomain cfg.subdomain port)));
}