hosts/losurdo/sourcehut.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config.services) sourcehut;
   4   inherit (config.users) users;
   5   inherit (config.security) gnupg;
   6   domain = "sourcephile.wg";
   7   sourcehut-services = [
   8     "builds"
   9     "dispatch"
  10     "git"
  11     "hg"
  12     "hub"
  13     "lists"
  14     "meta"
  15     "man"
  16     "paste"
  17     "pages"
  18     "todo"
  19   ];
  20 in
  21 {
  22   #boot.isContainer = true;
  23   #networking.firewall.allowedTCPPorts = [ 80 ];
  24   networking.hosts = {
  25     "192.168.42.2" = [ domain ] ++ map (d: "${d}.${domain}") sourcehut-services;
  26   };
  27   networking.nftables.ruleset = ''
  28     table inet filter {
  29       chain output-net {
  30         skuid ${sourcehut.meta.user} \
  31           tcp dport smtp counter \
  32           accept comment "sourcehut: SMTP"
  33       }
  34     }
  35   '';
  36   security.gnupg.secrets = lib.genAttrs [
  37     "sourcehut/network-key"
  38     "sourcehut/service-key"
  39     "sourcehut/webhook-key"
  40     "sourcehut/oauth-client-secret"
  41   ]
  42     (_p: {
  43       systemdConfig.before = [ "metasrht.service" "gitsrht.service" ];
  44       systemdConfig.wantedBy = [ "metasrht.service" "gitsrht.service" ];
  45     });
  46   services.minio = {
  47     enable = true;
  48     accessKey = "12345";
  49     secretKey = "12345678";
  50     #region = "";
  51     browser = true;
  52   };
  53   environment.systemPackages = [ pkgs.minio-client ];
  54   services.sourcehut = {
  55     enable = true;
  56     listenAddress = "localhost";
  57     builds = {
  58       #enable = true;
  59       enableWorker = true;
  60       images.nixos.unstable.x86_64 =
  61         let
  62           systemConfig = { pkgs, ... }: {
  63             # passwordless ssh server
  64             services.openssh = {
  65               enable = true;
  66               permitRootLogin = "yes";
  67               extraConfig = "PermitEmptyPasswords yes";
  68             };
  69
  70             users = {
  71               mutableUsers = false;
  72               # build user
  73               extraUsers."build" = {
  74                 isNormalUser = true;
  75                 uid = 1000;
  76                 extraGroups = [ "wheel" ];
  77                 password = "";
  78               };
  79               users.root.password = "";
  80             };
  81
  82             security.sudo.wheelNeedsPassword = false;
  83             nix.settings.trusted-users = [ "root" "build" ];
  84             documentation.nixos.enable = false;
  85
  86             # builds.sr.ht-image-specific network settings
  87             networking = {
  88               hostName = "build";
  89               dhcpcd.enable = false;
  90               defaultGateway.address = "10.0.2.2";
  91               usePredictableInterfaceNames = false; # so that we just get eth0 and not some weird id
  92               interfaces."eth0".ipv4.addresses = [{
  93                 address = "10.0.2.15";
  94                 prefixLength = 25;
  95               }];
  96               enableIPv6 = false;
  97               nameservers = [
  98                 # OpenNIC anycast
  99                 "185.121.177.177"
 100                 "169.239.202.202"
 101                 # Google as a fallback :(
 102                 "8.8.8.8"
 103               ];
 104               firewall.allowedTCPPorts = [ 22 ]; # allow ssh
 105             };
 106
 107             environment.systemPackages = [
 108               pkgs.gitMinimal
 109               #pkgs.mercurial
 110               pkgs.curl
 111               pkgs.gnupg
 112             ];
 113           };
 114           qemuConfig = { ... }: {
 115             imports = [ systemConfig ];
 116             fileSystems."/".device = "/dev/disk/by-label/nixos";
 117             boot.initrd.availableKernelModules = [
 118               "ahci"
 119               "ehci_pci"
 120               "sd_mod"
 121               "usb_storage"
 122               "usbhid"
 123               "virtio_balloon"
 124               "virtio_blk"
 125               "virtio_pci"
 126               "virtio_ring"
 127               "xhci_pci"
 128             ];
 129             boot.loader = {
 130               grub = {
 131                 version = 2;
 132                 device = "/dev/vda";
 133               };
 134               timeout = 0;
 135             };
 136           };
 137           config = (import (pkgs.path + "/nixos/lib/eval-config.nix") {
 138             inherit pkgs; modules = [ qemuConfig ];
 139             system = "x86_64-linux";
 140           }).config;
 141         in
 142         import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
 143           inherit pkgs lib config;
 144           diskSize = 16000;
 145           format = "qcow2-compressed";
 146           contents = [
 147             {
 148               source = pkgs.writeText "gitconfig" ''
 149                 [user]
 150                   name = builds.sr.ht
 151                   email = build@sr.ht
 152               '';
 153               target = "/home/build/.gitconfig";
 154               user = "build";
 155               group = "users";
 156               mode = "644";
 157             }
 158           ];
 159         };
 160     };
 161
 162     #dispatch.enable = true;
 163     git.enable = true;
 164     #hub.enable = true;
 165     meta.enable = true;
 166     meta.port = 4999;
 167     #man.enable = true;
 168     #pages.enable = true;
 169     #paste.enable = true;
 170     #todo.enable = true;
 171     #lists.enable = true;
 172
 173     postgresql.enable = true;
 174     postfix.enable = true;
 175     redis.enable = true;
 176     nginx.enable = true;
 177     settings = {
 178       "sr.ht" = {
 179         environment = "production";
 180         global-domain = domain;
 181         origin = "http://${domain}";
 182         owner-email = "julm+srht@sourcephile.fr";
 183         owner-name = "Sourcephile";
 184         site-blurb = "software forge";
 185         site-info = "http://${domain}";
 186         site-name = "Sourcephile";
 187         # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen network
 188         network-key = gnupg.secrets."sourcehut/network-key".path;
 189         # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen service
 190         service-key = gnupg.secrets."sourcehut/service-key".path;
 191       };
 192       objects = {
 193         s3-upstream = "localhost";
 194         s3-access-key = "12345";
 195         s3-secret-key = pkgs.writeText "s3-secret-key" "12345678";
 196       };
 197       # nix shell nixpkgs#sourcehut.metasrht -c metasrht-manageuser -t admin -e mymail@gmail.com misuzu
 198       "builds.sr.ht" = {
 199         origin = "http://builds.${domain}";
 200         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 201         oauth-client-id = "299db9f9c2013170";
 202         allow-free = true;
 203       };
 204       "dispatch.sr.ht" = {
 205         origin = "http://dispatch.${domain}";
 206         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 207         oauth-client-id = "299db9f9c2013170";
 208       };
 209       "pages.sr.ht" = {
 210         origin = "http://pages.${domain}";
 211         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 212         oauth-client-id = "299db9f9c2013170";
 213         s3-bucket = "pagesbuck";
 214       };
 215       "paste.sr.ht" = {
 216         origin = "http://paste.${domain}";
 217         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 218         oauth-client-id = "299db9f9c2013170";
 219       };
 220       "man.sr.ht" = {
 221         origin = "http://man.${domain}";
 222         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 223         oauth-client-id = "299db9f9c2013170";
 224       };
 225       "meta.sr.ht" = {
 226         origin = "http://meta.${domain}";
 227         api-origin = "http://localhost:5099";
 228       };
 229       "meta.sr.ht::settings" = {
 230         onboarding-redirect = "http://meta.${domain}";
 231         registration = true;
 232       };
 233       "meta.sr.ht::api" = {
 234         # This is a temporary workaround
 235         #
 236         internal-ipnet = [ "127.0.0.0/8" "::1/128" "192.168.0.0/16" "10.0.0.0/8" ];
 237       };
 238       "todo.sr.ht" = {
 239         origin = "http://todo.${domain}";
 240         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 241         oauth-client-id = "299db9f9c2013170";
 242       };
 243       "git.sr.ht" = {
 244         origin = "http://git.${domain}";
 245         outgoing-domain = "http://git.${domain}";
 246         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 247         oauth-client-id = "299db9f9c2013170";
 248         #repos = "/var/lib/git";
 249       };
 250       "hub.sr.ht" = {
 251         origin = "http://hub.${domain}";
 252         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 253         oauth-client-id = "299db9f9c2013170";
 254       };
 255       "lists.sr.ht" = {
 256         origin = "http://lists.${domain}";
 257         oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 258         oauth-client-id = "299db9f9c2013170";
 259       };
 260       "lists.sr.ht::worker" = {
 261         #sock = "/var/lib/postfix/queue/private/srht-lmtp";
 262       };
 263       # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen webhook
 264       #webhooks.private-key= "U7yd/8mGs/v0O3kId4jpeSghUCa9tqP1fYQwSV8UOqo=";
 265       webhooks.private-key = gnupg.secrets."sourcehut/webhook-key".path;
 266       mail = {
 267         smtp-host = "localhost";
 268         smtp-port = 25;
 269         smtp-user = null;
 270         smtp-password = null;
 271         smtp-from = "sourcehut@sourcephile.fr";
 272         error-to = "julm+sourcehut+error@sourcephile.fr";
 273         error-from = "sourcehut+error@sourcephile.fr";
 274         pgp-privkey = null;
 275         pgp-pubkey = null;
 276         pgp-key-id = null;
 277       };
 278     };
 279   };
 280   services.nginx.virtualHosts = {
 281     "builds.${domain}".forceSSL = lib.mkForce false;
 282     "dispatch.${domain}".forceSSL = lib.mkForce false;
 283     "git.${domain}".forceSSL = lib.mkForce false;
 284     "hub.${domain}".forceSSL = lib.mkForce false;
 285     "lists.${domain}".forceSSL = lib.mkForce false;
 286     "logs.${domain}".forceSSL = lib.mkForce false;
 287     "man.${domain}".forceSSL = lib.mkForce false;
 288     "paste.${domain}".forceSSL = lib.mkForce false;
 289     "pages.${domain}".forceSSL = lib.mkForce false;
 290     "todo.${domain}".forceSSL = lib.mkForce false;
 291     "meta.${domain}" = {
 292       forceSSL = lib.mkForce false;
 293       /*
 294         extraConfig = ''
 295       access_log /var/log/nginx/${domain}/meta/access.log json;
 296       error_log /var/log/nginx/${domain}/meta/error.log warn;
 297         '';
 298       */
 299     };
 300     "${domain}".forceSSL = lib.mkForce false;
 301   };
 302   systemd.services.postgresql = {
 303     /*
 304       connection_limit=64 \
 305       encoding=UTF8 \
 306       lc_collate=fr_FR.UTF-8 \
 307       lc_type=fr_FR.UTF-8 \
 308       owner="${sourcehut.git.postgresql.database}" \
 309       pg_createdb "${sourcehut.git.postgresql.database}" >/dev/null </dev/null
 310
 311       pg_adduser "${sourcehut.git.postgresql.database}" "${sourcehut.git.postgresql.database}" >/dev/null
 312       postStart = lib.mkAfter ''
 313       $PSQL -d "${sourcehut.builds.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 314       GRANT USAGE,CREATE ON schema public TO "${sourcehut.builds.user}";
 315       EOF
 316       $PSQL -d "${sourcehut.dispatch.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 317       GRANT USAGE,CREATE ON schema public TO "${sourcehut.dispatch.user}";
 318       EOF
 319       $PSQL -d "${sourcehut.git.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 320       GRANT USAGE,CREATE ON schema public TO "${sourcehut.git.user}";
 321       EOF
 322       $PSQL -d "${sourcehut.hub.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 323       GRANT USAGE,CREATE ON schema public TO "${sourcehut.hub.user}";
 324       EOF
 325       $PSQL -d "${sourcehut.man.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 326       GRANT USAGE,CREATE ON schema public TO "${sourcehut.man.user}";
 327       EOF
 328       $PSQL -d "${sourcehut.meta.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 329       GRANT USAGE,CREATE ON schema public TO "${sourcehut.meta.user}";
 330       GRANT USAGE,CREATE ON schema public TO "${users.sshsrht.name}";
 331       EOF
 332       $PSQL -d "${sourcehut.pages.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 333       GRANT USAGE,CREATE ON schema public TO "${sourcehut.pages.user}";
 334       EOF
 335       $PSQL -d "${sourcehut.paste.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 336       GRANT USAGE,CREATE ON schema public TO "${sourcehut.paste.user}";
 337       EOF
 338       $PSQL -d "${sourcehut.todo.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 339       GRANT USAGE,CREATE ON schema public TO "${sourcehut.todo.user}";
 340       EOF
 341       $PSQL -d "${sourcehut.lists.postgresql.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 342       GRANT USAGE,CREATE ON schema public TO "${sourcehut.lists.user}";
 343       EOF
 344       '';
 345     */
 346   };
 347 }