From 1bc23db49c2144020925f1cdb76aed82ff95f5d9 Mon Sep 17 00:00:00 2001 From: Crony Akatsuki Date: Fri, 9 May 2025 18:12:15 +0200 Subject: [PATCH] feat(servers): add bragi the poet. --- flake.nix | 20 +++++++++ hosts/bragi/configuration.nix | 41 +++++++++++++++++ hosts/bragi/disk-config.nix | 54 +++++++++++++++++++++++ modules/servers/bragi/audiobookshelf.nix | 22 +++++++++ modules/servers/bragi/default.nix | 7 +++ modules/servers/bragi/secrets.nix | 9 ++++ modules/servers/bragi/storage-box.nix | 19 ++++++++ secrets/rclone.age | 13 ++++++ secrets/secrets.nix | 4 +- secrets/traefik.age | Bin 719 -> 829 bytes secrets/wg-desktop.age | Bin 895 -> 1005 bytes secrets/wg-heimdall.age | Bin 1096 -> 1206 bytes 12 files changed, 188 insertions(+), 1 deletion(-) create mode 100644 hosts/bragi/configuration.nix create mode 100644 hosts/bragi/disk-config.nix create mode 100644 modules/servers/bragi/audiobookshelf.nix create mode 100644 modules/servers/bragi/default.nix create mode 100644 modules/servers/bragi/secrets.nix create mode 100644 modules/servers/bragi/storage-box.nix create mode 100644 secrets/rclone.age diff --git a/flake.nix b/flake.nix index 8ef310a..6bd72d7 100644 --- a/flake.nix +++ b/flake.nix @@ -114,6 +114,15 @@ path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.baldur; }; }; + + bragi = { + hostname = "bragi"; + profiles.system = { + sshUser = "root"; + user = "root"; + path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.bragi; + }; + }; }; nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration { @@ -161,6 +170,17 @@ ]; }; + bragi = nixpkgs.lib.nixosSystem { + system = "aarch64-linux"; + modules = [ + disko.nixosModules.disko + agenix.nixosModules.default + ./hosts/bragi/configuration.nix + ./modules/servers/general + ./modules/servers/bragi + ]; + }; + nixos = nixpkgs.lib.nixosSystem { specialArgs = {inherit inputs;}; modules = [ diff --git a/hosts/bragi/configuration.nix b/hosts/bragi/configuration.nix new file mode 100644 index 0000000..8c03738 --- /dev/null +++ b/hosts/bragi/configuration.nix @@ -0,0 +1,41 @@ +{ + modulesPath, + lib, + pkgs, + ... +}: { + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + (modulesPath + "/profiles/qemu-guest.nix") + ./disk-config.nix + ]; + + networking.hostName = "bragi"; + + boot.loader.grub = { + efiSupport = true; + efiInstallAsRemovable = true; + }; + + environment.systemPackages = map lib.lowPrio [ + pkgs.curl + pkgs.neovim + pkgs.gitMinimal + ]; + + networking.useNetworkd = true; + systemd.network.enable = true; + systemd.network.networks."10-wan" = { + matchConfig.Name = "enp1s0"; # either ens3 or enp1s0 depending on system, check 'ip addr' + networkConfig.DHCP = "ipv4"; + address = [ + # replace this address with the one assigned to your instance + "2a01:4f9:c012:26aa::1/64" + ]; + routes = [ + {Gateway = "fe80::1";} + ]; + }; + + system.stateVersion = "24.05"; +} diff --git a/hosts/bragi/disk-config.nix b/hosts/bragi/disk-config.nix new file mode 100644 index 0000000..8f36ed4 --- /dev/null +++ b/hosts/bragi/disk-config.nix @@ -0,0 +1,54 @@ +{lib, ...}: { + disko.devices = { + disk.disk1 = { + device = lib.mkDefault "/dev/sda"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + boot = { + name = "boot"; + size = "1M"; + type = "EF02"; + }; + esp = { + name = "ESP"; + size = "500M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + name = "root"; + size = "100%"; + content = { + type = "lvm_pv"; + vg = "pool"; + }; + }; + }; + }; + }; + lvm_vg = { + pool = { + type = "lvm_vg"; + lvs = { + root = { + size = "100%FREE"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + mountOptions = [ + "defaults" + ]; + }; + }; + }; + }; + }; + }; +} diff --git a/modules/servers/bragi/audiobookshelf.nix b/modules/servers/bragi/audiobookshelf.nix new file mode 100644 index 0000000..acbd2b3 --- /dev/null +++ b/modules/servers/bragi/audiobookshelf.nix @@ -0,0 +1,22 @@ +{...}: { + services.audiobookshelf = { + enable = true; + }; + + services.traefik.dynamicConfigOptions.http = { + services.audiobookshelf.loadBalancer.servers = [ + { + url = "http://localhost:8000"; + } + ]; + + routers.audiobookshelf = { + rule = "Host(`abs.cronyakatsuki.xyz`)"; + tls = { + certResolver = "porkbun"; + }; + service = "audiobookshelf"; + entrypoints = "websecure"; + }; + }; +} diff --git a/modules/servers/bragi/default.nix b/modules/servers/bragi/default.nix new file mode 100644 index 0000000..5d58b51 --- /dev/null +++ b/modules/servers/bragi/default.nix @@ -0,0 +1,7 @@ +{...}: { + imports = [ + ./audiobookshelf.nix + ./storage-box.nix + ./secrets.nix + ]; +} diff --git a/modules/servers/bragi/secrets.nix b/modules/servers/bragi/secrets.nix new file mode 100644 index 0000000..0d4565b --- /dev/null +++ b/modules/servers/bragi/secrets.nix @@ -0,0 +1,9 @@ +{ + age = { + secrets = { + rclone = { + file = ../../../secrets/rclone.age; + }; + }; + }; +} diff --git a/modules/servers/bragi/storage-box.nix b/modules/servers/bragi/storage-box.nix new file mode 100644 index 0000000..094f388 --- /dev/null +++ b/modules/servers/bragi/storage-box.nix @@ -0,0 +1,19 @@ +{ + config, + pkgs, + ... +}: { + environment.systemPackages = [pkgs.rclone]; + + fileSystems."/mnt" = { + device = "storage:"; + fsType = "rclone"; + options = [ + "nodev" + "nofail" + "allow_other" + "args2env" + "config=${config.age.secrets.rclone.path}" + ]; + }; +} diff --git a/secrets/rclone.age b/secrets/rclone.age new file mode 100644 index 0000000..8d3b4a7 --- /dev/null +++ b/secrets/rclone.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-ed25519 2P4nKw qCVX3JMWNQLJXRSVASI2wq4833CucZ8dkp7SHItiVBs +np04RcZXq7QnSTG68F2tk7nfaB8yKATEO+qVEZQJ4/E +-> ssh-ed25519 6+hQpQ rWsDHc5UWMkyjSkc+S/Y0G5c4sn2nm8uiwdHiFLxCVI +oIU9myTYDBjYE7K7YEH3D9CJ4hNkxKJBqxtEkbSulpA +-> ssh-ed25519 l/ODWA y/9+1Qy6hby0aCMikyadjl28Ft66G44pBQhJcmbvxnk +sRFnG61r72tDGYz+WRnNFmnLpFQ9+ZfsZj+6nMAtEV8 +-> ssh-ed25519 7+5K3Q Yk4gRMySBLoMZx1PLolMXB5mr0vl8jhemD5gWDhX4nQ +BCr8IzKrJAq4i++4tstMQdBax08naE6zXcBc5NG2PM4 +-> ssh-ed25519 fd/ZLQ DvoaL9OybtLLMfZ5PjrxZ65rrWoj1V+GVvqfBUOyJmE +eiNmcBTdSm7ppdRzo8CGgc7aYF0zINhwlSCdJjtHb1o +--- 1nEcpDp4PWeRi0LHEgeLKaq1OyLFPv5oi4viiTPpXXQ +@ՇM,eAEn*w?Iu)w^G?(Mڒњ-hAƂfCOF_58g̛8UYMe0UCs+D( 2͐xU!]u@8C"& v :A \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index c7811ad..35ec08f 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -3,6 +3,7 @@ let heimdall = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs+qYjpeAEHPFUQeatNkhKbXz8+A1VAl21jgifDYJK8"; loki = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+xpWCoBEO/pzAwS1ZZEsiLSarvSVkdxQEo49xma2PV"; baldur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvZ7Z8GS4+1+9D6u/BDit4Eij5Ubbii2dzJ/+ecT8iR"; + bragi = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBKMV2vqlDvIkUefl5oEuVjVtjgFLEXyDKX2LWhVQsWT"; # USERS root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJLduAXHWJiglmfRfkBGKffzVWkJP6porxIzw6+Zz3W crony@cronyakatsuki.xyz"; @@ -10,9 +11,10 @@ let users = [ root ]; - systems = [heimdall loki baldur]; + systems = [heimdall loki baldur bragi]; in { "traefik.age".publicKeys = systems ++ users; "wg-heimdall.age".publicKeys = systems ++ users; "wg-desktop.age".publicKeys = systems ++ users; + "rclone.age".publicKeys = systems ++ users; } diff --git a/secrets/traefik.age b/secrets/traefik.age index 92a86c264a6f683bab578abc24392bf546f7fbb5..836d85f2b0ca5e4eb4679bc870b520a6e66d8b34 100644 GIT binary patch delta 759 zcmX@lx|eN&PQ7u6cSL!4UWAc`fg_)0Kq+3K~RFGScsb!L>XL>+YV3d1k zPHt(1N1$6eS8-)JnmKK>FSq7e59#MG~ z8EN|EMG>xf`GuvXl|e;ek=iafRgONHPFemL1+G<*h5;t}?)t9iJ~7ue^)?Pv$T!UK za!OAs&v#7s%kzy4OL23I^2klE3@9l`*Y{7U^hpdiE;mgn_H;FLkb2Uhf!DZf@@C=I`X=QIh2n zkmQ#hWUgNxZk%tKks4l@S?*imUS3vdXq0J`&Xs0h=IQ7aS(=zynd0kb7U<_>;qFsr z>TeO4rf=#OnHA+1Tw>wunrCcoz@@9JtKbw7=x=5jl4X&uou6N5o?GSTs9l`zBz9wYI9u5(UPe`BL zSi|yE)h4DU`hHa3+ej^=`m*Cw-38ve7;fUu>X(&ci(WnVp9rV5=v7;_uOXVZ&911i zJ*}d;9xEvD-ISckdMrlPHVs7OtMH`Z$J!rA4`z8yXl_W_n}=7Mqv*_-6%pS{OQ8`nZ{J<%JnKFVk#6c`1V7Umf_78+NU6_-btIvE!S z8kzWogjINDcm|snra8LS=NgwKReGeBb4|%ti`m|mr?*%~)O6$I;)3co?j;`z7JU0N zJI^Nh_$}eetvj@%#F97d=NGy3-My>qjQ_rb$QZkGPTKn)uj!ioWLlm`%ui)DON%nY z9+jZi40A0~7KH^(=~!*C+L=rL(|n6nllhGA=6-RSUZS#6F+(eVdzcadC!j zYKoDmsiCEUnRZ5CL7+m0x2dsHMyjumQ<`&-zhPO1lWSf?kqG^DITa>$Rd5B?gP(e_Zd1O#}YH7AfV3c=}i)UcEZ={)JYNGGN zkK*+O1^$6SS%xOr#@_x$nW?6RnW0{OnH51!VW}p*$z?$q;l56Od2U7~nfY9P<%T}N zg_RkJnGw!;2E`#2Y3}(RmC1&|`6=Fs=Gn%jZr(;=;W-A$j_K$=G1oTrHV#xMNXp4{ zO)1RI%Qnsk^{X;YbxX^4vG6K$H_mYL$@k33a(8p93^$B056to9%FW1d*DlWqEB4WM zvoy{rFEuhqEU_^6PEAX8HPKJZ2sBGi$99|xjqOEUQTYo#m8|G_aVeDz> z5vCmy=2+%tXrvwB=H?h>=$;nIrK_u}5Nzn=R$N$-dW;>}lwi z?~-nq=j9Ro+Cx7}J8#!$uT}91kN(7FFV6&qn3BkUB{@+N}sCne+_{73bIuw_!ANw{ZJu4_;}m#&>cadC!j zYKoDmsiCEUnRZ5CL7;-KVMV%WWl>0xNo16JmRV4Vr)zO$R&hu{nX`L|sYSY9h?#d{ zx>V`#3keu`6$WmQ_Kr%!l>t4We)W|otmyM@KX zkK*A@`N6K{h8bRo?iE?-RbF0(9%;d4xgHtL&WS!r;if)@!N#Gfg`rVSM(JFRg^{@d zAtokCW}YryrilS*Wr;o^#)U!dUfHH*8I``3Ndc*bp}9WpRmGFfGK$w5xEDs6m8BRL zg=?F*`{o!HC7C3r=T;P^hWiIZBBo=xZ6&M>778G;o>gpPK>AQPmM`Zg| zraO5j=H?h#L{$WtX#3VDdsmf~oBJAYT??3Nr@UnztF-!8)dwltzP`Qf_}k@(-|@=* z=0y_iWiK~x^xJj4>UMqU$={YU<2)u;-misZuM^(3^|zM=MjFnT z#;5)1RrV=~*!vf)FFt-!wZcJ5iNTWT%tj@bZETw4d*u`N!GX zb8@8MU3smR)jK6$oS9rK9$tCdXh%=IQ{=T(?w{Vb*lA`Rnt$2(BzwdvjlkKqp79|e zpCrC=oV2N0xKCZ2AQ`98krJ~7ue^)?PvF!0Wd zvb0FbFez{k&MfgTFn3G!3G&SM$#%|*2sg_N&(1LLcT7*q^m24{{xzUFnJpZc=jjtxtZnJ! zS(52z5T0FHQC}XRAD*0%63W$L+PLZO->}a;+_z5sE1dr)XP)^T&%4bkmMcz#esqiu zxx(Ld;q=@&jyZO5{k^y3G>(6%IjNgev|ZuqLH}RjYQMYFjrMPvU-pHkuR}eE#h7#2 z=kE?u{z;2=xOZRk&JKlTvBJ; zB2`oyv@i7F7S2P*{I5CxzVpPCIlv^e{QO#B#wIuUX+<}VoP8MAXEa0LbI9XE+Zvbb z6Idg#Y3Y*A&hddUsFkN(hRs9D2F> z$0JprC=r%})@JFBO~uO=%C2c%V0y88fAqsztt(EpVimb7_pd4w5=eA1(0uVOaZ`Q$ z#gfKrzq~kScm32^n8W?pRlVfZnybaLQ*SKIyyfwI=hCSUyw%JbemMkhS+s*)VOOwN zQvSo!COelMw9EK$Sf6Rd9HwvQeznQ|WvtEkR4dZFDpaOuVc#s>)>ZC0_x>%}7gA$& z^VP~(TJAh^c;5I|%O0Pmz3bq@ZI1U1GT6l9>cYD(%@e;OdS~C)4VCNFWW7Ex{y#tS zLzre-Lfj$AxuOr8!~*^#hObnKo5=QX{k6v$Wu`k5%kBNDUi2>by=~L~6-_MD_vT(n WI~;mWKzG{XR?|mjGCeXp8K(g=#@tK* delta 1028 zcmdnSd4gktPJM1=cwkPHYoSkMsgp@*NlJLWc3EYqM{-U^YE+IJ5S6QN0X;y)Sfs2Kauc2{Nl3!+GvSoy~hjVH{WlmmBWl(02x4)lXj%8T# z#E;_P{*h@W`Ua66=9T^-WoAZM{t=nZX|6$8*+~^urXDV(7Csg!Ar|KDQEmoYIfkWS z?h!#2CT^u^QDG%nE}q6o9))GzWjH40N&oYYFdlrVcq?wyo zRs~ubM?{2LL>8qRL}Z$VM`XDhxj6ayL>U!?m1O(728MWYrE4c;2O0V17et!s=N9Hz z1cyeMq?G2RCHp0t8U$8kq$GM)Ryt;cmIr%s>FVk#IQeB6Rhk)jRHhdB8wQ6u7DgCW zI(zw98hR#|2ReF$J4YGT7gksnmpElwaBcGD-tcce*QUsvStr}McPdU5xmN31BYVuy z?nC60%;tapSi>UEz5Exex4OR8_K;u(&-|5PIiZTX+7;ygw&tu$w08PXAszQ8FTDRG zr=3XP{uzZ+CMP~T%OO4M%e}3a*xnlEH`(9O`1?&$#O~p>?U& z5ozZTe|Apaucd;zfsbA6TW9nCD5-z#d@a-BtL4)$i|{RrC&*{&F+a5p)0lhzC&=VSZK%`R-GI#)ibHP)T!oo#nRr zyFXI%^2Bndy=r*&YYyL$B;GB|A=>Zs`PwQsxtw2K`EaWEdEpgt3SA6uTXkOSHIaGu z`9->E=d=$*ac|TSVv0Ja-FHeR_~rR&J;7%t@jZD~u{?ICY`E8n8cBDzdixX|VWAY` Z^HG1!b{?oX-xMRB5WOJ(HLrBYeE_i#tsDRV