Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-04-02 02:00:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: Luj:3e615b11a3a911002a69942d67857cc271c7ffca
Branches Tags
Luj:main
..
compare: Luj:f3ba2a1c8b674092b0bbea21901ba436af191149
Branches Tags
Luj:main

No commits in common. "3e615b11a3a911002a69942d67857cc271c7ffca" and "f3ba2a1c8b674092b0bbea21901ba436af191149" have entirely different histories.
3e615b11a3 ... f3ba2a1c8b

11 changed files with 52 additions and 106 deletions
Show stats Expand all files Collapse all files

14
lon.lock
View file

@ -81,6 +81,16 @@
"url": "https://github.com/nix-community/home-manager/archive/fc52a210b60f2f52c74eac41a8647c1573d2071d.tar.gz", "url": "https://github.com/nix-community/home-manager/archive/fc52a210b60f2f52c74eac41a8647c1573d2071d.tar.gz",
"hash": "sha256-TY0jUwR3EW0fnS0X5wXMAVy6h4Z7Y6a3m+Yq++C9AyE=" "hash": "sha256-TY0jUwR3EW0fnS0X5wXMAVy6h4Z7Y6a3m+Yq++C9AyE="
}, },
"homepage": {
"type": "GitHub",
"fetchType": "tarball",
"owner": "JulienMalka",
"repo": "homepage",
"branch": "main",
"revision": "29e779d8600b1c1e6235570a3614a54f8ec8126e",
"url": "https://github.com/JulienMalka/homepage/archive/29e779d8600b1c1e6235570a3614a54f8ec8126e.tar.gz",
"hash": "sha256-YuwHCXEbrzuEyRy1/2bX4Rux/nqmzRZ8H44+83JQNV8="
},
"impermanence": { "impermanence": {
"type": "GitHub", "type": "GitHub",
"fetchType": "tarball", "fetchType": "tarball",
@ -165,9 +175,9 @@
"type": "Git", "type": "Git",
"fetchType": "git", "fetchType": "git",
"branch": "truly-deterministic", "branch": "truly-deterministic",
"revision": "78564e5f2c4fad5175f709560e6ee75d30115b22", "revision": "caf3169829647809805caaf968c8c0d4015ef187",
"url": "https://git.dgnum.eu/Luj/stateless-uptime-kuma.git", "url": "https://git.dgnum.eu/Luj/stateless-uptime-kuma.git",
"hash": "sha256-I5uHrQvwKvJMFSOJfEZRZyc5ZElD0tCGfFVDaBfcLNM=", "hash": "sha256-tux43mzd1rrlpTEhcQ9PiJBse9+SGEcWY/9F8cxX+Po=",
"submodules": false "submodules": false
}, },
"unstable": { "unstable": {

31
machines/biblios/garage.nix
View file

@ -68,35 +68,4 @@ in
config.machine.meta.ips.public.ipv6 config.machine.meta.ips.public.ipv6
]; ];
machine.meta.probes.monitors."s3.luj.fr - IPv4".accepted_statuscodes = [ "403" ];
machine.meta.probes.monitors."s3.luj.fr - IPv6".accepted_statuscodes = [ "403" ];
machine.meta.probes.monitors."cdn.luj.fr - IPv4".accepted_statuscodes = [ "404" ];
machine.meta.probes.monitors."cdn.luj.fr - IPv6".accepted_statuscodes = [ "404" ];
machine.meta.probes.monitors = {
"luj.fr - IPv4" = {
url = "https://${config.machine.meta.ips.public.ipv4}";
type = "http";
accepted_statuscodes = [ "200-299" ];
notificationIDList = [ 1 ];
headers = ''
{
"Host": "luj.fr"
}
'';
};
"luj.fr - IPv6" = {
url = "https://[${config.machine.meta.ips.public.ipv6}]";
type = "http";
accepted_statuscodes = [ "200-299" ];
notificationIDList = [ 1 ];
headers = ''
{
"Host": "luj.fr"
}
'';
};
};
} }

4
machines/core-security/default.nix
View file

@ -122,8 +122,8 @@
security.acme.certs."ca.luj".server = lib.mkForce "https://127.0.0.1:8444/acme/acme/directory"; security.acme.certs."ca.luj".server = lib.mkForce "https://127.0.0.1:8444/acme/acme/directory";
machine.meta.probes.monitors."ca.luj - IPv4".url = lib.mkForce "https://100.100.45.14/health"; machine.meta.monitors."ca.luj - IPv4".url = lib.mkForce "https://100.100.45.14/health";
machine.meta.probes.monitors."ca.luj - IPv6".url = lib.mkForce "https://[fd7a:115c:a1e0::e]/health"; machine.meta.monitors."ca.luj - IPv6".url = lib.mkForce "https://[fd7a:115c:a1e0::e]/health";
systemd.services."step-ca".after = [ "keycloak.service" ]; systemd.services."step-ca".after = [ "keycloak.service" ];

26
machines/gustave/nsd.nix
View file

@ -101,8 +101,30 @@ lib.mkMerge [
networking.firewall.allowedUDPPorts = [ 53 ]; networking.firewall.allowedUDPPorts = [ 53 ];
networking.firewall.allowedTCPPorts = [ 53 ]; networking.firewall.allowedTCPPorts = [ 53 ];
# Page server disabled for now machine.meta.zones."luj.fr".TXT = [ "homepage.luj.luj-static.page" ];
#machine.meta.zones."luj.fr".TXT = [ "homepage.luj.luj-static.page" ];
machine.meta.monitors = {
"luj.fr - IPv4" = {
url = "https://${config.machine.meta.ips.public.ipv4}";
type = "http";
accepted_statuscodes = [ "200-299" ];
headers = ''
{
"Host": "luj.fr"
}
'';
};
"luj.fr - IPv6" = {
url = "https://[${config.machine.meta.ips.public.ipv6}]";
type = "http";
accepted_statuscodes = [ "200-299" ];
headers = ''
{
"Host": "luj.fr"
}
'';
};
};
} }

17
machines/lambda/uptime-kuma.nix
View file

@ -8,20 +8,15 @@
}: }:
let let
monitorsFromConfig = lib.mkMerge ( probesFromConfig = lib.mkMerge (
lib.mapAttrsToList (_: value: value.config.machine.meta.probes.monitors) nixosConfigurations lib.mapAttrsToList (_: value: value.config.machine.meta.monitors) nixosConfigurations
); );
pagesFromConfig = lib.mkMerge (
lib.mapAttrsToList (_: value: value.config.machine.meta.probes.status_pages) nixosConfigurations
);
in in
{ {
services.uptime-kuma = { services.uptime-kuma = {
enable = true; enable = true;
package = pkgs.unstable.uptime-kuma; package = pkgs.uptime-kuma-beta;
settings = { settings = {
NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt"; NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
}; };
@ -36,16 +31,14 @@ in
}; };
}; };
age.secrets."stateless-uptime-kuma-password".file = age.secrets."stateless-uptime-kuma-password".file = ../../secrets/stateless-uptime-kuma-password.age;
../../secrets/stateless-uptime-kuma-password.age;
nixpkgs.overlays = [ nixpkgs.overlays = [
(import "${inputs.stateless-uptime-kuma}/overlay.nix") (import "${inputs.stateless-uptime-kuma}/overlay.nix")
]; ];
statelessUptimeKuma = { statelessUptimeKuma = {
enableService = true; enableService = true;
probesConfig.monitors = monitorsFromConfig; probesConfig.monitors = probesFromConfig;
probesConfig.status_pages = pagesFromConfig;
extraFlags = [ extraFlags = [
"-s" "-s"
"-v DEBUG" "-v DEBUG"

7
machines/tower/default.nix
View file

@ -60,8 +60,7 @@
services.openssh.enable = true; services.openssh.enable = true;
programs.ssh.knownHosts."darwin-build-box.winter.cafe".publicKey = programs.ssh.knownHosts."darwin-build-box.winter.cafe".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0io9E0eXiDIEHvsibXOxOPveSjUPIr1RnNKbUkw3fD";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0io9E0eXiDIEHvsibXOxOPveSjUPIr1RnNKbUkw3fD";
services.nginx.virtualHosts."photos.julienmalka.me" = { services.nginx.virtualHosts."photos.julienmalka.me" = {
enableACME = true; enableACME = true;
@ -132,8 +131,8 @@
root = "/home/gitlab-runner/artifacts"; root = "/home/gitlab-runner/artifacts";
}; };
machine.meta.probes.monitors."phd.julienmalka.me - IPv4".accepted_statuscodes = [ "401" ]; machine.meta.monitors."phd.julienmalka.me - IPv4".accepted_statuscodes = [ "401" ];
machine.meta.probes.monitors."phd.julienmalka.me - IPv6".accepted_statuscodes = [ "401" ]; machine.meta.monitors."phd.julienmalka.me - IPv6".accepted_statuscodes = [ "401" ];
systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/home/gitlab-runner/artifacts" ]; systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/home/gitlab-runner/artifacts" ];

7
modules/homepage/default.nix
View file

@ -1,5 +1,6 @@
{ {
lib, lib,
inputs,
config, config,
... ...
}: }:
@ -17,11 +18,7 @@ in
services.nginx.virtualHosts."julienmalka.me" = { services.nginx.virtualHosts."julienmalka.me" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/" = { root = inputs.homepage;
extraConfig = ''
return 301 https://luj.fr$request_uri;
'';
};
}; };
}; };
} }

4
modules/jackett/default.nix
View file

@ -45,10 +45,6 @@ in
); );
inherit (cfg) user group; inherit (cfg) user group;
}; };
machine.meta.probes.monitors."jackett.luj - IPv4".accepted_statuscodes = [ "400" ];
machine.meta.probes.monitors."jackett.luj - IPv6".accepted_statuscodes = [ "400" ];
} }
(mkIf cfg.nginx.enable (mkVPNSubdomain cfg.nginx.subdomain port)) (mkIf cfg.nginx.enable (mkVPNSubdomain cfg.nginx.subdomain port))

24
modules/meta/default.nix
View file

@ -43,27 +43,9 @@
default = with profiles; [ base ]; default = with profiles; [ base ];
}; };
probes = { monitors = mkOption {
monitors = lib.mkOption { default = { };
type = types.attrsOf (pkgs.formats.json { }).type; type = types.attrsOf (pkgs.formats.json { }).type;
default = { };
};
tags = lib.mkOption {
type = types.attrsOf (pkgs.formats.json { }).type;
default = { };
};
notifications = lib.mkOption {
type = types.attrsOf (pkgs.formats.json { }).type;
default = { };
};
status_pages = lib.mkOption {
type = types.attrsOf (pkgs.formats.json { }).type;
default = { };
};
settings = lib.mkOption {
type = types.attrsOf (pkgs.formats.json { }).type;
default = { };
};
}; };
defaultInterface = mkOption { defaultInterface = mkOption {

4
modules/nginx/default.nix
View file

@ -59,7 +59,7 @@ in
''; '';
systemConfig = _: { systemConfig = _: {
machine.meta.probes.monitors = lib.mkIf (name != "default") { machine.meta.monitors = lib.mkIf (name != "default") {
"${name} - IPv4" = { "${name} - IPv4" = {
url = "https://${ url = "https://${
if (hasSuffix "luj" name) then if (hasSuffix "luj" name) then
@ -69,7 +69,6 @@ in
}"; }";
type = "http"; type = "http";
accepted_statuscodes = [ "200-299" ]; accepted_statuscodes = [ "200-299" ];
notificationIDList = [ 1 ];
headers = '' headers = ''
{ {
"Host": "${name}" "Host": "${name}"
@ -85,7 +84,6 @@ in
}]"; }]";
type = "http"; type = "http";
accepted_statuscodes = [ "200-299" ]; accepted_statuscodes = [ "200-299" ];
notificationIDList = [ 1 ];
headers = '' headers = ''
{ {
"Host": "${name}" "Host": "${name}"

20
profiles/base.nix
View file

@ -123,24 +123,4 @@
VfXtULncAiEA2gmqdr+ugFz5tvPdKwanroTiMTUMhhCRYVlQlyTApyQ= VfXtULncAiEA2gmqdr+ugFz5tvPdKwanroTiMTUMhhCRYVlQlyTApyQ=
-----END CERTIFICATE-----'' -----END CERTIFICATE-----''
]; ];
machine.meta.probes = {
status_pages."public" = {
title = "Public Services";
description = "State of my public infrastructure";
showTags = false;
publicGroupList =
lib.optionals ((builtins.length (lib.attrNames config.machine.meta.probes.monitors)) > 0)
[
{
name = config.networking.hostName;
weight = 1;
monitorList = builtins.filter (e: (lib.hasInfix ".luj.fr" e) || !(lib.hasInfix ".luj" e)) (
lib.attrNames config.machine.meta.probes.monitors
);
}
];
};
};
} }