hosts/losurdo/sourcehut.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config.services) sourcehut;
   4   inherit (config.users) users;
   5   inherit (config.security) gnupg;
   6   domain = "sourcephile.wg";
   7   sourcehut-services = [
   8     "builds"
   9     "dispatch"
  10     "git"
  11     "hg"
  12     "hub"
  13     "lists"
  14     "meta"
  15     "man"
  16     "paste"
  17     "pages"
  18     "todo"
  19   ];
  20 in
  21 {
  22   #boot.isContainer = true;
  23   #networking.firewall.allowedTCPPorts = [ 80 ];
  24   networking.hosts = {
  25     "192.168.42.2" = [ domain ] ++ map (d: "${d}.${domain}") sourcehut-services;
  26   };
  27   networking.nftables.ruleset = ''
  28     table inet filter {
  29       chain output-net {
  30         skuid ${sourcehut.meta.user} \
  31           tcp dport smtp counter \
  32           accept comment "sourcehut: SMTP"
  33       }
  34     }
  35   '';
  36   security.gnupg.secrets = lib.genAttrs [
  37     "sourcehut/network-key"
  38     "sourcehut/service-key"
  39     "sourcehut/webhook-key"
  40     "sourcehut/oauth-client-secret"
  41   ]
  42     (_p: {
  43       systemdConfig.before = [ "metasrht.service" "gitsrht.service" ];
  44       systemdConfig.wantedBy = [ "metasrht.service" "gitsrht.service" ];
  45     });
  46   services.minio = {
  47     enable = true;
  48     accessKey = "12345";
  49     secretKey = "12345678";
  50     #region = "";
  51     browser = true;
  52   };
  53   environment.systemPackages = [ pkgs.minio-client ];
  54   services.sourcehut = {
  55     enable = true;
  56     listenAddress = "localhost";
  57     builds = {
  58       #enable = true;
  59       enableWorker = true;
  60       images.nixos.unstable.x86_64 =
  61         let
  62           systemConfig = { pkgs, ... }: {
  63             # passwordless ssh server
  64             services.openssh = {
  65               enable = true;
  66               permitRootLogin = "yes";
  67               extraConfig = "PermitEmptyPasswords yes";
  68             };
  69
  70             users = {
  71               mutableUsers = false;
  72               # build user
  73               extraUsers."build" = {
  74                 isNormalUser = true;
  75                 uid = 1000;
  76                 extraGroups = [ "wheel" ];
  77                 password = "";
  78               };
  79               users.root.password = "";
  80             };
  81
  82             security.sudo.wheelNeedsPassword = false;
  83             nix.settings.trusted-users = [ "root" "build" ];
  84             documentation.nixos.enable = false;
  85
  86             # builds.sr.ht-image-specific network settings
  87             networking = {
  88               hostName = "build";
  89               dhcpcd.enable = false;
  90               defaultGateway.address = "10.0.2.2";
  91               usePredictableInterfaceNames = false; # so that we just get eth0 and not some weird id
  92               interfaces."eth0".ipv4.addresses = [{
  93                 address = "10.0.2.15";
  94                 prefixLength = 25;
  95               }];
  96               enableIPv6 = false;
  97               nameservers = [
  98                 # OpenNIC anycast
  99                 "185.121.177.177"
 100                 "169.239.202.202"
 101                 # Google as a fallback :(
 102                 "8.8.8.8"
 103               ];
 104               firewall.allowedTCPPorts = [ 22 ]; # allow ssh
 105             };
 106
 107             environment.systemPackages = [
 108               pkgs.gitMinimal
 109               #pkgs.mercurial
 110               pkgs.curl
 111               pkgs.gnupg
 112             ];
 113           };
 114           qemuConfig = { ... }: {
 115             imports = [ systemConfig ];
 116             fileSystems."/".device = "/dev/disk/by-label/nixos";
 117             boot.initrd.availableKernelModules = [
 118               "ahci"
 119               "ehci_pci"
 120               "sd_mod"
 121               "usb_storage"
 122               "usbhid"
 123               "virtio_balloon"
 124               "virtio_blk"
 125               "virtio_pci"
 126               "virtio_ring"
 127               "xhci_pci"
 128             ];
 129             boot.loader = {
 130               grub = {
 131                 device = "/dev/vda";
 132               };
 133               timeout = 0;
 134             };
 135           };
 136           config = (import (pkgs.path + "/nixos/lib/eval-config.nix") {
 137             inherit pkgs; modules = [ qemuConfig ];
 138             system = "x86_64-linux";
 139           }).config;
 140         in
 141         import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
 142           inherit pkgs lib config;
 143           diskSize = 16000;
 144           format = "qcow2-compressed";
 145           contents = [
 146             {
 147               source = pkgs.writeText "gitconfig" ''
 148                 [user]
 149                   name = builds.sr.ht
 150                   email = build@sr.ht
 151               '';
 152               target = "/home/build/.gitconfig";
 153               user = "build";
 154               group = "users";
 155               mode = "644";
 156             }
 157           ];
 158         };
 159     };
 160
 161     #dispatch.enable = true;
 162     git.enable = true;
 163     #hub.enable = true;
 164     meta.enable = true;
 165     meta.port = 4999;
 166     #man.enable = true;
 167     #pages.enable = true;
 168     #paste.enable = true;
 169     #todo.enable = true;
 170     #lists.enable = true;
 171
 172     postgresql.enable = true;
 173     postfix.enable = true;
 174     redis.enable = true;
 175     nginx.enable = true;
 176     settings = {
 177       "sr.ht" = {
 178         environment = "production";
 179         global-domain = domain;
 180         origin = "http://${domain}";
 181         owner-email = "julm+srht@sourcephile.fr";
 182         owner-name = "Sourcephile";
 183         site-blurb = "software forge";
 184         site-info = "http://${domain}";
 185         site-name = "Sourcephile";
 186         # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen network
 187         network-key = gnupg.secrets."sourcehut/network-key".path;
 188         # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen service
 189         service-key = gnupg.secrets."sourcehut/service-key".path;
 190       };
 191       objects = {
 192         s3-upstream = "localhost";
 193         s3-access-key = "12345";
 194         s3-secret-key = pkgs.writeText "s3-secret-key" "12345678";
 195       };
 196       # nix shell nixpkgs#sourcehut.metasrht -c metasrht-manageuser -t admin -e mymail@gmail.com misuzu
 197       "builds.sr.ht" = {
 198         origin = "http://builds.${domain}";
 199         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 200         oauth-client-id = "299db9f9c2013170";
 201         allow-free = true;
 202       };
 203       "dispatch.sr.ht" = {
 204         origin = "http://dispatch.${domain}";
 205         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 206         oauth-client-id = "299db9f9c2013170";
 207       };
 208       "pages.sr.ht" = {
 209         origin = "http://pages.${domain}";
 210         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 211         oauth-client-id = "299db9f9c2013170";
 212         s3-bucket = "pagesbuck";
 213       };
 214       "paste.sr.ht" = {
 215         origin = "http://paste.${domain}";
 216         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 217         oauth-client-id = "299db9f9c2013170";
 218       };
 219       "man.sr.ht" = {
 220         origin = "http://man.${domain}";
 221         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 222         oauth-client-id = "299db9f9c2013170";
 223       };
 224       "meta.sr.ht" = {
 225         origin = "http://meta.${domain}";
 226         api-origin = "http://localhost:5099";
 227       };
 228       "meta.sr.ht::settings" = {
 229         onboarding-redirect = "http://meta.${domain}";
 230         registration = true;
 231       };
 232       "meta.sr.ht::api" = {
 233         # This is a temporary workaround
 234         #
 235         internal-ipnet = [ "127.0.0.0/8" "::1/128" "192.168.0.0/16" "10.0.0.0/8" ];
 236       };
 237       "todo.sr.ht" = {
 238         origin = "http://todo.${domain}";
 239         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 240         oauth-client-id = "299db9f9c2013170";
 241       };
 242       "git.sr.ht" = {
 243         origin = "http://git.${domain}";
 244         outgoing-domain = "http://git.${domain}";
 245         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 246         oauth-client-id = "299db9f9c2013170";
 247         #repos = "/var/lib/git";
 248       };
 249       "hub.sr.ht" = {
 250         origin = "http://hub.${domain}";
 251         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 252         oauth-client-id = "299db9f9c2013170";
 253       };
 254       "lists.sr.ht" = {
 255         origin = "http://lists.${domain}";
 256         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 257         oauth-client-id = "299db9f9c2013170";
 258       };
 259       "lists.sr.ht::worker" = {
 260         #sock = "/var/lib/postfix/queue/private/srht-lmtp";
 261       };
 262       # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen webhook
 263       #webhooks.private-key= "U7yd/8mGs/v0O3kId4jpeSghUCa9tqP1fYQwSV8UOqo=";
 264       webhooks.private-key = gnupg.secrets."sourcehut/webhook-key".path;
 265       mail = {
 266         smtp-host = "localhost";
 267         smtp-port = 25;
 268         smtp-user = null;
 269         smtp-password = null;
 270         smtp-from = "sourcehut@sourcephile.fr";
 271         error-to = "julm+sourcehut+error@sourcephile.fr";
 272         error-from = "sourcehut+error@sourcephile.fr";
 273         pgp-privkey = null;
 274         pgp-pubkey = null;
 275         pgp-key-id = null;
 276       };
 277     };
 278   };
 279   services.nginx.virtualHosts = {
 280     "builds.${domain}".forceSSL = lib.mkForce false;
 281     "dispatch.${domain}".forceSSL = lib.mkForce false;
 282     "git.${domain}".forceSSL = lib.mkForce false;
 283     "hub.${domain}".forceSSL = lib.mkForce false;
 284     "lists.${domain}".forceSSL = lib.mkForce false;
 285     "logs.${domain}".forceSSL = lib.mkForce false;
 286     "man.${domain}".forceSSL = lib.mkForce false;
 287     "paste.${domain}".forceSSL = lib.mkForce false;
 288     "pages.${domain}".forceSSL = lib.mkForce false;
 289     "todo.${domain}".forceSSL = lib.mkForce false;
 290     "meta.${domain}" = {
 291       forceSSL = lib.mkForce false;
 292       /*
 293         extraConfig = ''
 294       access_log /var/log/nginx/${domain}/meta/access.log json;
 295       error_log /var/log/nginx/${domain}/meta/error.log warn;
 296         '';
 297       */
 298     };
 299     "${domain}".forceSSL = lib.mkForce false;
 300   };
 301   systemd.services.postgresql = {
 302     /*
 303       connection_limit=64 \
 304       encoding=UTF8 \
 305       lc_collate=fr_FR.UTF-8 \
 306       lc_type=fr_FR.UTF-8 \
 307       owner="${sourcehut.git.postgresql.database}" \
 308       pg_createdb "${sourcehut.git.postgresql.database}" >/dev/null </dev/null
 309
 310       pg_adduser "${sourcehut.git.postgresql.database}" "${sourcehut.git.postgresql.database}" >/dev/null
 311       postStart = lib.mkAfter ''
 312       $PSQL -d "${sourcehut.builds.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 313       GRANT USAGE,CREATE ON schema public TO "${sourcehut.builds.user}";
 314       EOF
 315       $PSQL -d "${sourcehut.dispatch.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 316       GRANT USAGE,CREATE ON schema public TO "${sourcehut.dispatch.user}";
 317       EOF
 318       $PSQL -d "${sourcehut.git.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 319       GRANT USAGE,CREATE ON schema public TO "${sourcehut.git.user}";
 320       EOF
 321       $PSQL -d "${sourcehut.hub.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 322       GRANT USAGE,CREATE ON schema public TO "${sourcehut.hub.user}";
 323       EOF
 324       $PSQL -d "${sourcehut.man.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 325       GRANT USAGE,CREATE ON schema public TO "${sourcehut.man.user}";
 326       EOF
 327       $PSQL -d "${sourcehut.meta.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 328       GRANT USAGE,CREATE ON schema public TO "${sourcehut.meta.user}";
 329       GRANT USAGE,CREATE ON schema public TO "${users.sshsrht.name}";
 330       EOF
 331       $PSQL -d "${sourcehut.pages.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 332       GRANT USAGE,CREATE ON schema public TO "${sourcehut.pages.user}";
 333       EOF
 334       $PSQL -d "${sourcehut.paste.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 335       GRANT USAGE,CREATE ON schema public TO "${sourcehut.paste.user}";
 336       EOF
 337       $PSQL -d "${sourcehut.todo.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 338       GRANT USAGE,CREATE ON schema public TO "${sourcehut.todo.user}";
 339       EOF
 340       $PSQL -d "${sourcehut.lists.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 341       GRANT USAGE,CREATE ON schema public TO "${sourcehut.lists.user}";
 342       EOF
 343       '';
 344     */
 345   };
 346 }