You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
105 lines
3.1 KiB
105 lines
3.1 KiB
{
|
|
description = "NixOS Infrastructure";
|
|
|
|
inputs = {
|
|
nixos.follows = "nixpkgs-unstable";
|
|
nixpkgs.follows = "nixpkgs-unstable";
|
|
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
|
nixos-hardware.url = "github:NixOS/nixos-hardware";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, nixos-hardware, ... }:
|
|
let
|
|
# Global domain
|
|
domain = "domain.com";
|
|
git_url = "git+https://git.${domain}/owner/infra.git";
|
|
|
|
# Per-user mapping of auth (login) and sudo keys
|
|
key_mappings = {
|
|
alice = {
|
|
auth = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceAuthKeyPlaceholder alice@host"
|
|
];
|
|
sudo = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceSudoKeyPlaceholder alice-admin@host"
|
|
];
|
|
};
|
|
bob = {
|
|
auth = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobAuthKeyPlaceholder bob@host"
|
|
];
|
|
sudo = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobSudoKeyPlaceholder bob-admin@host"
|
|
];
|
|
};
|
|
};
|
|
|
|
sharedModules = [
|
|
./modules/users.nix
|
|
./modules/auto-update.nix
|
|
./modules/nginx.nix
|
|
];
|
|
|
|
# Central subdomain -> service mapping.
|
|
# Each entry can set:
|
|
# description human-readable label (used as the gatus monitor name)
|
|
# ports.http local port nginx proxies to
|
|
# websockets enable WebSocket proxying
|
|
# gatus_health health-check path monitored by gatus (e.g. "/health").
|
|
# Leave empty/unset to hide this host from the status page.
|
|
vhosts = {
|
|
"auth.${domain}" = {
|
|
description = "Keycloak";
|
|
ports = {"http" = 8080; };
|
|
gatus_health = "/health";
|
|
};
|
|
"status.${domain}" = {
|
|
description = "Gatus status page";
|
|
ports = {"http" = 8081; };
|
|
gatus_health = "/";
|
|
};
|
|
"pad.${domain}" = {
|
|
# TODO: not implemented (hidden from gatus until gatus_health is set)
|
|
description = "HedgeDoc";
|
|
ports = {"http" = 3001; "httpws" = 3001; };
|
|
websockets = true;
|
|
};
|
|
"git.${domain}" = {
|
|
description = "Gitea";
|
|
ports = { "http" = 3000; "ssh" = 22; };
|
|
gatus_health = "/";
|
|
};
|
|
};
|
|
|
|
baseArgs = {
|
|
inherit domain git_url key_mappings vhosts;
|
|
};
|
|
in {
|
|
nixosConfigurations = {
|
|
auth.domain.com = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = baseArgs // {
|
|
domains = [ "auth.${domain}" "status.${domain}" ];
|
|
};
|
|
modules = [
|
|
./machines/auth.domain.com/configuration.nix
|
|
./machines/auth.domain.com/hardware-configuration.nix
|
|
./modules/keycloak.nix
|
|
./modules/gatus_service.nix
|
|
] ++ sharedModules;
|
|
};
|
|
|
|
status.domain.com = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = baseArgs // {
|
|
domains = [ "pad.${domain}" "git.${domain}" ];
|
|
};
|
|
modules = [
|
|
./machines/status.domain.com/configuration.nix
|
|
./machines/status.domain.com/hardware-configuration.nix
|
|
./modules/gitea.nix
|
|
] ++ sharedModules;
|
|
};
|
|
};
|
|
};
|
|
}
|
|
|