From 00e16adb899959f55344f44691c2b6a6ca25f1f2 Mon Sep 17 00:00:00 2001 From: m3tam3re Date: Fri, 28 Mar 2025 10:13:26 +0100 Subject: [PATCH 1/4] structure changes to flake --- flake.lock | 27 ++++ starter/config.json | 11 ++ starter/configuration.nix | 243 +++++++++-------------------- starter/env/baserow.env | 2 +- starter/env/n8n.env | 1 + starter/flake.lock | 56 ++++++- starter/flake.nix | 19 ++- starter/hardware-configuration.nix | 26 --- 8 files changed, 175 insertions(+), 210 deletions(-) create mode 100644 flake.lock delete mode 100644 starter/hardware-configuration.nix diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..8c618e8 --- /dev/null +++ b/flake.lock @@ -0,0 +1,27 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1741379970, + "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "36fd87baa9083f34f7f5027900b62ee6d09b1f2f", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/starter/config.json b/starter/config.json index e69de29..8154012 100644 --- a/starter/config.json +++ b/starter/config.json @@ -0,0 +1,11 @@ +{ + "username": "m3tam3re", + "hashedPassword": "$6$WiEXGgna68Sm8vIN$oZ9YET4gQt9wtM.rQ0c4y9fYelkIhFV1lvppgYp8LplOstReounIlxKIIlNTLvdE.ZG8LkC03X0ZAyfXe07Z7/", + "sshKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQolhh8u4ZXzr1a+ua6h4iHEgi5WjcD462+6lD+b+fP m3tam3re@m3-kratos", + "domains": { + "portainer": "p-t.m3tam3re.com", + "n8n": "n-t.m3tam3re.com", + "baserow": "b-t.m3tam3re.com" + }, + "rootDevice": "/dev/sda" +} diff --git a/starter/configuration.nix b/starter/configuration.nix index 903a93a..9182872 100644 --- a/starter/configuration.nix +++ b/starter/configuration.nix @@ -1,197 +1,94 @@ { + config, lib, pkgs, + self, ... }: # Read configuration from JSON let jsonConfig = builtins.fromJSON (builtins.readFile ./config.json); -in { - imports = [ - ./disko-config.nix - ./hardware-configuration.nix - ]; - # Enable flakes and nix commands - nix = { - settings = { - experimental-features = ["nix-command" "flakes"]; - # Enable automatic garbage collection - auto-optimise-store = true; + customServicesDir = ./custom-services; + customServicesExists = builtins.pathExists customServicesDir; + + customServices = + if customServicesExists + then + map + (name: ./custom-services + "/${name}") + (builtins.filter + (name: lib.hasSuffix ".nix" name) + (builtins.attrNames (builtins.readDir customServicesDir))) + else []; +in { + imports = + [ + ./disko-config.nix + ] + ++ customServices; + + options.nixosConfig.flake = lib.mkOption { + type = lib.types.path; + description = "Path to the current flake configuration"; + }; + + config = { + nix.settings = { trusted-users = [jsonConfig.username]; }; - # Automatic cleanup of old generations - gc = { - automatic = true; - dates = "weekly"; - options = "--delete-older-than 30d"; + # Set the flake path + nixosConfig.flake = self; + + # Activation script to save the configuration + system.activationScripts.saveFlakeConfig = { + deps = []; + text = '' + rm -rf /etc/nixos/current-systemconfig + mkdir -p /etc/nixos/current-systemconfig + cp -rf ${config.nixosConfig.flake}/* /etc/nixos/current-systemconfig/ + cd /etc/nixos/current-systemconfig + chown -R ${jsonConfig.username}:users /etc/nixos/current-systemconfig + chmod -R u=rwX,g=rX,o=rX /etc/nixos/current-systemconfig + ''; }; - }; - # Boot configuration - boot.loader.grub = { - enable = true; - devices = [jsonConfig.rootDevice]; - efiSupport = true; - efiInstallAsRemovable = true; - }; - - # Networking - networking = { - firewall = { + services.selfHostPlaybook = { enable = true; - # Only allow necessary ports - allowedTCPPorts = [80 443 2222]; # HTTP, HTTPS, and SSH + tier = "starter"; # This determines which services are enabled }; - }; - environment.etc = { - environment-files = { - source = pkgs.copyPathToStore ./env; + # Networking + networking = { + firewall = { + enable = true; + # Only allow necessary ports + allowedTCPPorts = [80 443 2222]; # HTTP, HTTPS, and SSH + }; }; - }; - # System packages - environment.systemPackages = with pkgs; [ - # System utilities - neovim - git - # Docker tools - docker - docker-compose - ]; + environment.etc = { + environment-files = { + source = ./env; + }; + }; + # User configuration + users.users.${jsonConfig.username} = { + isNormalUser = true; + extraGroups = ["wheel" "docker"]; + hashedPassword = jsonConfig.hashedPassword; + openssh.authorizedKeys.keys = [jsonConfig.sshKey]; + # Set default shell to bash + shell = pkgs.bash; + }; - # Enable Docker with recommended settings - virtualisation.docker = { - enable = true; - # Enable docker daemon to start on boot - enableOnBoot = true; - # Use overlay2 storage driver - storageDriver = "overlay2"; - # Enable live restore - liveRestore = true; - }; - - # Services configuration - services = { - # SSH server configuration - openssh = { + programs.git = { enable = true; - settings = { - PermitRootLogin = "no"; - PasswordAuthentication = false; - # Additional security settings - MaxAuthTries = 3; - LoginGraceTime = "30s"; - }; - ports = [2222]; - }; - - # Caddy configuration with security headers - caddy = { - enable = true; - virtualHosts = { - "${jsonConfig.domains.portainer}" = { - extraConfig = '' - reverse_proxy localhost:9000 - header { - # Security headers - Strict-Transport-Security "max-age=31536000; includeSubDomains" - X-Content-Type-Options "nosniff" - X-Frame-Options "DENY" - Referrer-Policy "strict-origin-when-cross-origin" - } - ''; - }; - "${jsonConfig.domains.n8n}" = { - extraConfig = '' - reverse_proxy localhost:5678 - header { - Strict-Transport-Security "max-age=31536000; includeSubDomains" - X-Content-Type-Options "nosniff" - X-Frame-Options "DENY" - Referrer-Policy "strict-origin-when-cross-origin" - } - ''; - }; - "${jsonConfig.domains.baserow}" = { - extraConfig = '' - reverse_proxy localhost:3000 - header { - Strict-Transport-Security "max-age=31536000; includeSubDomains" - X-Content-Type-Options "nosniff" - X-Frame-Options "DENY" - Referrer-Policy "strict-origin-when-cross-origin" - } - ''; - }; + config = { + user.name = jsonConfig.username; + user.email = "${jsonConfig.username}@nixos"; + safe.directory = "/etc/nixos/current-systemconfig"; }; }; }; - # User configuration - users.users.${jsonConfig.username} = { - isNormalUser = true; - extraGroups = ["wheel" "docker"]; - hashedPassword = jsonConfig.hashedPassword; - openssh.authorizedKeys.keys = [jsonConfig.sshKey]; - # Set default shell to bash - shell = pkgs.bash; - }; - - # Container configurations - virtualisation.oci-containers = { - backend = "docker"; - containers = { - "portainer" = { - image = "docker.io/portainer/portainer-ce:latest"; - ports = ["127.0.0.1:9000:9000"]; - volumes = [ - "/etc/localtime:/etc/localtime:ro" - "/var/run/docker.sock:/var/run/docker.sock:ro" - "portainer_data:/data" - ]; - extraOptions = [ - "--network=web" - ]; - }; - - "n8n" = { - image = "docker.io/n8nio/n8n:latest"; - environmentFiles = ["/etc/environment-files/n8n.env"]; - ports = ["127.0.0.1:5678:5678"]; - volumes = ["n8n_data:/home/node/.n8n"]; - extraOptions = ["--network=web"]; - }; - - "baserow" = { - image = "docker.io/baserow/baserow:latest"; - environmentFiles = ["/etc/environment-files/baserow.env"]; - ports = ["127.0.0.1:3000:80"]; - volumes = ["baserow_data:/baserow/data"]; - extraOptions = ["--network=web"]; - }; - }; - }; - - systemd.services.docker-network-web = { - description = "Create Docker Network Web"; - requires = ["docker.service"]; - after = ["docker.service"]; - wantedBy = ["multi-user.target"]; - - # Run on startup if network doesn't exist - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - - script = '' - if ! /run/current-system/sw/bin/docker network ls | grep -q 'web'; then - /run/current-system/sw/bin/docker network create web - fi - ''; - }; - - # System state version (do not change) - system.stateVersion = "24.11"; } diff --git a/starter/env/baserow.env b/starter/env/baserow.env index cd30d72..5e30b1c 100644 --- a/starter/env/baserow.env +++ b/starter/env/baserow.env @@ -1 +1 @@ -BASEROW_PUBLIC_URL=https://BASEROW_DOMAIN +BASEROW_PUBLIC_URL=https://b-t.m3tam3re.com diff --git a/starter/env/n8n.env b/starter/env/n8n.env index c66516e..b3515eb 100644 --- a/starter/env/n8n.env +++ b/starter/env/n8n.env @@ -1,3 +1,4 @@ N8N_HOST=N8N_DOMAIN +WEBHOOK_URL=https://N8N_DOMAIN NODE_ENV=production N8N_ENCRYPTION_KEY=changeme diff --git a/starter/flake.lock b/starter/flake.lock index 742661d..946432d 100644 --- a/starter/flake.lock +++ b/starter/flake.lock @@ -1,5 +1,25 @@ { "nodes": { + "base-config": { + "inputs": { + "nixpkgs": "nixpkgs", + "nixpkgs-unstable": "nixpkgs-unstable" + }, + "locked": { + "lastModified": 1741872348, + "narHash": "sha256-4d0S59c/rR5lcfqeqw3z+k4FlDwyci6dwrwMPgKuO/g=", + "ref": "stable", + "rev": "50af8d01fb5d5d5616bd1d5c38ced9946f863ca4", + "revCount": 6, + "type": "git", + "url": "https://code.m3tam3re.com/m3tam3re/self-host-playbook-base" + }, + "original": { + "ref": "stable", + "type": "git", + "url": "https://code.m3tam3re.com/m3tam3re/self-host-playbook-base" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -7,11 +27,11 @@ ] }, "locked": { - "lastModified": 1739760714, - "narHash": "sha256-SaGuzIQUTC2UPwX0aTm9W4aSEUcq3h6yZbi30piej2U=", + "lastModified": 1741786315, + "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=", "owner": "nix-community", "repo": "disko", - "rev": "be1e4321c9fb3a4bc2c061dafcdb424937a74dad", + "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de", "type": "github" }, "original": { @@ -22,24 +42,44 @@ }, "nixpkgs": { "locked": { - "lastModified": 1739580444, - "narHash": "sha256-+/bSz4EAVbqz8/HsIGLroF8aNaO8bLRL7WfACN+24g4=", + "lastModified": 1741600792, + "narHash": "sha256-yfDy6chHcM7pXpMF4wycuuV+ILSTG486Z/vLx/Bdi6Y=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "8bb37161a0488b89830168b81c48aed11569cb93", + "rev": "ebe2788eafd539477f83775ef93c3c7e244421d3", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-unstable", + "ref": "nixos-24.11", "repo": "nixpkgs", "type": "github" } }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1741708242, + "narHash": "sha256-cNRqdQD4sZpN7JLqxVOze4+WsWTmv2DGH0wNCOVwrWc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "b62d2a95c72fb068aecd374a7262b37ed92df82b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "b62d2a95c72fb068aecd374a7262b37ed92df82b", + "type": "github" + } + }, "root": { "inputs": { + "base-config": "base-config", "disko": "disko", - "nixpkgs": "nixpkgs" + "nixpkgs": [ + "base-config", + "nixpkgs" + ] } } }, diff --git a/starter/flake.nix b/starter/flake.nix index 304c4cf..f114302 100644 --- a/starter/flake.nix +++ b/starter/flake.nix @@ -2,7 +2,14 @@ description = "Self-hosted server setup with Portainer, n8n, and Baserow"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + base-config = { + # url = "path:/home/m3tam3re/p/nix/self-host-playbook-base"; + url = "git+https://code.m3tam3re.com/m3tam3re/self-host-playbook-base?ref=stable"; + }; + nixpkgs = { + url = "github:NixOS/nixpkgs/nixos-24.11"; + follows = "base-config/nixpkgs"; + }; disko = { url = "github:nix-community/disko"; inputs.nixpkgs.follows = "nixpkgs"; @@ -11,15 +18,23 @@ outputs = { self, + base-config, nixpkgs, ... } @ inputs: { - nixosConfigurations.server = nixpkgs.lib.nixosSystem { + nixosConfigurations.nixos = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; modules = [ + (base-config.nixosModules.default { + tier = "starter"; + jsonConfig = builtins.fromJSON (builtins.readFile ./config.json); + }) # Pass tier here inputs.disko.nixosModules.disko ./configuration.nix ]; + specialArgs = { + inherit self; + }; }; }; } diff --git a/starter/hardware-configuration.nix b/starter/hardware-configuration.nix deleted file mode 100644 index 4daad50..0000000 --- a/starter/hardware-configuration.nix +++ /dev/null @@ -1,26 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - lib, - modulesPath, - ... -}: { - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - ]; - - boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"]; - boot.initrd.kernelModules = []; - boot.kernelModules = []; - boot.extraModulePackages = []; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.ens18.useDHCP = lib.mkDefault true; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; -} From 8b7635d56ad63824d8489aaf03ce77bea7f51c4f Mon Sep 17 00:00:00 2001 From: m3tam3re Date: Thu, 3 Apr 2025 09:28:07 +0200 Subject: [PATCH 2/4] +gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d344ba6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +config.json From e653e1640a89348eae47211fa7710c00bd227405 Mon Sep 17 00:00:00 2001 From: m3tam3re Date: Thu, 3 Apr 2025 09:42:57 +0200 Subject: [PATCH 3/4] +version file --- starter/version.json | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 starter/version.json diff --git a/starter/version.json b/starter/version.json new file mode 100644 index 0000000..590ac5d --- /dev/null +++ b/starter/version.json @@ -0,0 +1,8 @@ +{ + "version": "0.1.0", + "minCompatibleVersion": "0.0.0", + "updateUrl": "https://code.m3tam3re.com/m3tam3re/self-host-playbook", + "changelog": { + "0.1.0": ["Management CLI", "Flake rework"] + } +} From 851ffc4ed3cc0dac56910ac3043c710071ed2eac Mon Sep 17 00:00:00 2001 From: m3tam3re Date: Thu, 3 Apr 2025 10:24:42 +0200 Subject: [PATCH 4/4] +version file --- .gitignore | 2 +- starter/config.json | 11 ----------- starter/env/baserow.env | 2 +- 3 files changed, 2 insertions(+), 13 deletions(-) delete mode 100644 starter/config.json diff --git a/.gitignore b/.gitignore index d344ba6..6bf1823 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -config.json +starter/config.json diff --git a/starter/config.json b/starter/config.json deleted file mode 100644 index 8154012..0000000 --- a/starter/config.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "username": "m3tam3re", - "hashedPassword": "$6$WiEXGgna68Sm8vIN$oZ9YET4gQt9wtM.rQ0c4y9fYelkIhFV1lvppgYp8LplOstReounIlxKIIlNTLvdE.ZG8LkC03X0ZAyfXe07Z7/", - "sshKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQolhh8u4ZXzr1a+ua6h4iHEgi5WjcD462+6lD+b+fP m3tam3re@m3-kratos", - "domains": { - "portainer": "p-t.m3tam3re.com", - "n8n": "n-t.m3tam3re.com", - "baserow": "b-t.m3tam3re.com" - }, - "rootDevice": "/dev/sda" -} diff --git a/starter/env/baserow.env b/starter/env/baserow.env index 5e30b1c..cd30d72 100644 --- a/starter/env/baserow.env +++ b/starter/env/baserow.env @@ -1 +1 @@ -BASEROW_PUBLIC_URL=https://b-t.m3tam3re.com +BASEROW_PUBLIC_URL=https://BASEROW_DOMAIN