From 31351d447cfde0b89d0c1d127517d8f48cca0c08 Mon Sep 17 00:00:00 2001 From: alisceon Date: Sat, 30 May 2026 15:18:13 +0200 Subject: [PATCH] blogbox reverted to alisceon-core --- flake.nix | 1 - nixos/hosts/blogbox/configuration.nix | 446 +++++++------------------- 2 files changed, 114 insertions(+), 333 deletions(-) diff --git a/flake.nix b/flake.nix index f3074c1..32dbd1b 100644 --- a/flake.nix +++ b/flake.nix @@ -175,7 +175,6 @@ system = "x86_64-linux"; nixosModules = serverModules; hmModules = serverHomeModules; - homeManagerUsers = false; }; }; }; diff --git a/nixos/hosts/blogbox/configuration.nix b/nixos/hosts/blogbox/configuration.nix index 22bb128..fabab79 100644 --- a/nixos/hosts/blogbox/configuration.nix +++ b/nixos/hosts/blogbox/configuration.nix @@ -1,114 +1,16 @@ { lib, pkgs, modulesPath, ... }: -let - siteDomain = "blogbox.alisceon.com"; - repoDir = "/home/alisceon/blogbox-site"; - stateDir = "/var/lib/blogbox"; - publicDir = "${stateDir}/www"; - - updateBlogboxSite = pkgs.writeShellApplication { - name = "update-blogbox-site"; - runtimeInputs = [ - pkgs.coreutils - pkgs.git - pkgs.hugo - pkgs.rsync - ]; - text = '' - set -euo pipefail - - if [ ! -d ${lib.escapeShellArg repoDir}/.git ]; then - echo "${repoDir} is not a git checkout yet; skipping Hugo publish" - exit 0 - fi - - install -d -m 0755 ${lib.escapeShellArg stateDir} ${lib.escapeShellArg publicDir} - - git -C ${lib.escapeShellArg repoDir} pull --ff-only - git -C ${lib.escapeShellArg repoDir} submodule sync --recursive - git -C ${lib.escapeShellArg repoDir} submodule update --init --recursive - - rm -rf ${lib.escapeShellArg stateDir}/hugo-public - hugo \ - --source ${lib.escapeShellArg repoDir} \ - --destination ${lib.escapeShellArg stateDir}/hugo-public \ - --minify \ - --cleanDestinationDir - - rsync -a --delete ${lib.escapeShellArg stateDir}/hugo-public/ ${lib.escapeShellArg publicDir}/ - ''; - }; - - updateNamecheapDyndns = pkgs.writeShellApplication { - name = "update-namecheap-dyndns"; - runtimeInputs = [ - pkgs.coreutils - pkgs.ddclient - ]; - text = '' - set -euo pipefail - - : "''${NAMECHEAP_DOMAIN:?Set NAMECHEAP_DOMAIN in /etc/blogbox-namecheap-ddns.env}" - : "''${NAMECHEAP_PASSWORD:?Set NAMECHEAP_PASSWORD in /etc/blogbox-namecheap-ddns.env}" - : "''${NAMECHEAP_HOSTS:?Set NAMECHEAP_HOSTS in /etc/blogbox-namecheap-ddns.env}" - - config_file="''${RUNTIME_DIRECTORY}/ddclient.conf" - install -m 0600 /dev/null "$config_file" - - { - printf 'daemon=0\n' - printf 'cache=/var/cache/blogbox-dyndns/ddclient.cache\n' - printf 'ssl=yes\n' - printf 'protocol=namecheap\n' - printf 'usev4=webv4, webv4=dynamicdns.park-your-domain.com/getip\n' - printf 'server=dynamicdns.park-your-domain.com\n' - printf 'login=%s\n' "$NAMECHEAP_DOMAIN" - printf 'password=%s\n' "$NAMECHEAP_PASSWORD" - printf '%s\n' "$NAMECHEAP_HOSTS" - } > "$config_file" - - ddclient -file "$config_file" - ''; - }; - - ensureBlogboxSwapfile = pkgs.writeShellApplication { - name = "ensure-blogbox-swapfile"; - runtimeInputs = [ - pkgs.coreutils - pkgs.gnugrep - pkgs.util-linux - ]; - text = '' - set -euo pipefail - - if swapon --show=NAME --noheadings | grep -Fxq /swapfile; then - exit 0 - fi - - if [ ! -f /swapfile ] || [ "$(stat -c %s /swapfile)" -ne 8589934592 ]; then - rm -f /swapfile - install -m 0600 /dev/null /swapfile - fallocate -l 8G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=8192 status=none - chmod 0600 /swapfile - fi - - mkswap -f /swapfile - swapon /swapfile - ''; - }; -in { imports = [ "${modulesPath}/virtualisation/oci-image.nix" ../../modules/services/cloud-init.nix + ../../modules/services/forgejo.nix ../../modules/services/nginx.nix ../../modules/services/oci-authorized-keys.nix + ../../modules/services/tor.nix ]; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - oci.efi = lib.mkForce false; - virtualisation.diskSize = lib.mkForce (16 * 1024); - networking = { hostName = "blogbox"; networkmanager.enable = lib.mkForce false; @@ -116,6 +18,11 @@ in 22 80 443 + 22000 + 24601 + ]; + firewall.allowedUDPPorts = [ + 22000 ]; }; @@ -127,72 +34,13 @@ in "virtio_net" "xhci_pci" ]; - kernelParams = lib.mkForce [ - "nvme.shutdown_timeout=10" - "nvme_core.shutdown_timeout=10" - "libiscsi.debug_libiscsi_eh=1" - "crash_kexec_post_notifiers" - "console=tty1" - "console=ttyS0,115200n8" - ]; - kernelPackages = lib.mkForce pkgs.linuxPackages; loader.systemd-boot.configurationLimit = lib.mkForce 3; }; - documentation = { - enable = lib.mkForce false; - man.enable = lib.mkForce false; - doc.enable = lib.mkForce false; - info.enable = lib.mkForce false; - nixos.enable = lib.mkForce false; - }; - - environment = { - defaultPackages = lib.mkForce [ ]; - shells = lib.mkForce [ pkgs.bash ]; - systemPackages = lib.mkForce (with pkgs; [ - curl - git - hugo - vim - ]); - }; - - programs = { - command-not-found.enable = lib.mkForce false; - fish.enable = lib.mkForce false; - fzf.fuzzyCompletion = lib.mkForce false; - xonsh.enable = lib.mkForce false; - }; - - users = { - defaultUserShell = lib.mkForce pkgs.bash; - groups.blogbox-dyndns = { }; - users.alisceon = { - createHome = true; - extraGroups = lib.mkForce [ "wheel" "systemd-journal" ]; - openssh.authorizedKeys.keys = [ - "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPN1Cd2UlHo03Jqgi5Yb4io/3gh/X4wCb8LcmKlpAovQa271CKDBtYOUKn+Fts03g6dBMfaWMty6VGPMGDMONmc= alisceon@electra" - ]; - shell = lib.mkForce pkgs.bash; - }; - users.blogbox-dyndns = { - group = "blogbox-dyndns"; - isSystemUser = true; - }; - }; - - alisceon = { - cloud-init.enable = true; - ociAuthorizedKeys.enable = true; - }; - nix = { settings = { - cores = lib.mkForce 1; - max-jobs = lib.mkForce 1; - min-free = lib.mkForce (256 * 1024 * 1024); - max-free = lib.mkForce (1024 * 1024 * 1024); + min-free = lib.mkForce (512 * 1024 * 1024); + max-free = lib.mkForce (2 * 1024 * 1024 * 1024); }; gc = { dates = lib.mkForce "daily"; @@ -200,9 +48,27 @@ in }; }; - system.autoUpgrade = { - persistent = lib.mkForce false; - randomizedDelaySec = lib.mkForce "4h"; + virtualisation = { + docker.enable = lib.mkForce false; + podman = { + enable = true; + dockerSocket.enable = true; + autoPrune = { + enable = true; + dates = "daily"; + flags = [ "--all" ]; + }; + }; + }; + + users.users.alisceon.extraGroups = [ "systemd-journal" ]; + + alisceon = { + cloud-init = { + enable = true; + defaultShell = "/run/current-system/sw/bin/xonsh"; + }; + ociAuthorizedKeys.enable = true; }; security = { @@ -213,189 +79,105 @@ in sudo-rs.wheelNeedsPassword = false; }; - services = { - openssh.settings = { - KbdInteractiveAuthentication = false; - PasswordAuthentication = false; - PermitRootLogin = lib.mkForce "prohibit-password"; + services.openssh.settings = { + PasswordAuthentication = false; + PermitRootLogin = lib.mkForce "prohibit-password"; + }; + + services.syncthing = { + enable = true; + dataDir = "/var/lib/syncthing"; + guiAddress = "127.0.0.1:8384"; + openDefaultPorts = false; + overrideDevices = false; + overrideFolders = false; + settings = { + gui = { + insecureAdminAccess = false; + insecureSkipHostcheck = false; + }; + options = { + globalAnnounceEnabled = false; + localAnnounceEnabled = false; + listenAddresses = [ + "tcp://0.0.0.0:22000" + "quic://0.0.0.0:22000" + ]; + natEnabled = false; + relaysEnabled = false; + urAccepted = -1; + }; }; + }; - journald.extraConfig = '' - SystemMaxUse=64M - RuntimeMaxUse=32M - ''; + alisceon.forgejo.domain = "forgejo.alisceon.com"; - nginx.virtualHosts.${siteDomain} = { - serverName = siteDomain; + services.gitea-actions-runner.instances.alisceon-core-podman.labels = [ + "podman" + "x86_64" + "amd64" + ]; + + services.nginx.virtualHosts = { + ${"forgejo.alisceon.com"} = { + serverName = "forgejo.alisceon.com"; forceSSL = true; enableACME = true; - root = publicDir; - locations."/".extraConfig = '' - try_files $uri $uri/ =404; - ''; - }; - }; - - systemd = { - tmpfiles.rules = [ - "d ${repoDir} 0755 alisceon users - -" - "d ${stateDir} 0755 alisceon users - -" - "d ${publicDir} 0755 alisceon users - -" - ]; - - services.update-blogbox-site = { - description = "Pull and publish the Blogbox Hugo site"; - after = [ "network-online.target" ]; - wants = [ "network-online.target" ]; - serviceConfig = { - Type = "oneshot"; - User = "alisceon"; - Group = "users"; - ExecStart = lib.getExe updateBlogboxSite; - Nice = 10; - IOSchedulingClass = "idle"; - LockPersonality = true; - MemoryHigh = "384M"; - MemoryMax = "512M"; - NoNewPrivileges = true; - OOMPolicy = "stop"; - PrivateDevices = true; - PrivateIPC = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectSystem = "strict"; - ReadWritePaths = [ - repoDir - stateDir - ]; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_UNIX" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - SystemCallArchitectures = "native"; - TimeoutStartSec = "15min"; - UMask = "0022"; + locations."/" = { + proxyPass = "http://127.0.0.1:3000"; + recommendedProxySettings = true; }; }; - - services.blogbox-dyndns = { - description = "Update Namecheap dynamic DNS records for Blogbox"; - after = [ "network-online.target" ]; - wants = [ "network-online.target" ]; - unitConfig.ConditionPathExists = "/etc/blogbox-namecheap-ddns.env"; - serviceConfig = { - Type = "oneshot"; - User = "blogbox-dyndns"; - Group = "blogbox-dyndns"; - ExecStart = lib.getExe updateNamecheapDyndns; - CacheDirectory = "blogbox-dyndns"; - EnvironmentFile = "/etc/blogbox-namecheap-ddns.env"; - LockPersonality = true; - MemoryMax = "128M"; - MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - OOMPolicy = "stop"; - PrivateDevices = true; - PrivateIPC = true; - PrivateTmp = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - ProtectSystem = "strict"; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_NETLINK" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - RuntimeDirectory = "blogbox-dyndns"; - RuntimeDirectoryMode = "0700"; - SystemCallArchitectures = "native"; - SystemCallErrorNumber = "EPERM"; - SystemCallFilter = "@system-service"; - TimeoutStartSec = "2min"; - UMask = "0177"; - }; - }; - - timers.update-blogbox-site = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnBootSec = "10min"; - OnUnitInactiveSec = "5min"; - Persistent = true; - }; - }; - - timers.blogbox-dyndns = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnBootSec = "5min"; - OnUnitInactiveSec = "10min"; - Persistent = true; + ${"syncthing.alisceon.com"} = { + serverName = "syncthing.alisceon.com"; + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8384"; + recommendedProxySettings = false; + extraConfig = '' + proxy_set_header Host $proxy_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + ''; }; }; }; - systemd.services.nixos-upgrade.serviceConfig = { - IOSchedulingClass = "idle"; - MemoryHigh = "512M"; - MemoryMax = "768M"; - Nice = 15; - OOMPolicy = "stop"; - }; - - systemd.services.growpart.serviceConfig = { - IOSchedulingClass = "idle"; - Nice = 15; - TimeoutStartSec = "2min"; - }; - - systemd.services.blogbox-swapfile = { - description = "Create and enable Blogbox swapfile"; - after = [ - "sshd.service" - "systemd-growfs-root.service" - ]; - wantedBy = [ "multi-user.target" ]; + systemd.services.syncthing = { serviceConfig = { - Type = "oneshot"; - ExecStart = lib.getExe ensureBlogboxSwapfile; - IOSchedulingClass = "idle"; - Nice = 19; - RemainAfterExit = true; - TimeoutStartSec = "20min"; + LockPersonality = true; + PrivateIPC = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectHome = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + ReadWritePaths = [ "/var/lib/syncthing" ]; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_NETLINK" + "AF_UNIX" + ]; + SystemCallArchitectures = "native"; + UMask = "0077"; }; }; - zramSwap = { - enable = true; - memoryPercent = 50; - }; - - virtualisation = { - containers.enable = lib.mkForce false; - docker.enable = lib.mkForce false; - libvirtd = { - enable = lib.mkForce false; - qemu.swtpm.enable = lib.mkForce false; - }; - podman.enable = lib.mkForce false; - }; + environment.systemPackages = with pkgs; [ + curl + git + htop + jq + vim + wget + ]; system.stateVersion = lib.mkForce "25.11"; }