aboutsummaryrefslogtreecommitdiff
path: root/modules/services
diff options
context:
space:
mode:
Diffstat (limited to 'modules/services')
-rw-r--r--modules/services/drone/default.nix39
-rw-r--r--modules/services/drone/runner-docker/default.nix40
-rw-r--r--modules/services/drone/runner-exec/default.nix58
-rw-r--r--modules/services/drone/server/default.nix48
-rw-r--r--modules/services/gitea/default.nix86
-rw-r--r--modules/services/sourcegraph/default.nix55
6 files changed, 0 insertions, 326 deletions
diff --git a/modules/services/drone/default.nix b/modules/services/drone/default.nix
deleted file mode 100644
index dedf120..0000000
--- a/modules/services/drone/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-# A docker-based CI/CD system
-#
-# Inspired by [1]
-# [1]: https://github.com/Mic92/dotfiles/blob/master/nixos/eve/modules/drone.nix
-{ lib, ... }: {
- imports = [ ./runner-docker ./runner-exec ./server ];
-
- options.my.services.drone = with lib; {
- enable = mkEnableOption "Drone CI";
- vhostName = mkOption {
- type = types.str;
- example = "drone.fcuny.net";
- description = "Name for the virtual host";
- };
- runners = mkOption {
- type = with types; listOf (enum [ "exec" "docker" ]);
- default = [ ];
- example = [ "exec" "docker" ];
- description = "Types of runners to enable";
- };
- admin = mkOption {
- type = types.str;
- default = "fcuny";
- example = "admin";
- description = "Name of the admin user";
- };
- port = mkOption {
- type = types.port;
- default = 3030;
- example = 8080;
- description = "Internal port of the Drone UI";
- };
- sharedSecretFile = mkOption {
- type = types.str;
- example = "/run/secrets/drone-rpc.env";
- description = "Shared RPC secret to inject into server and runners";
- };
- };
-}
diff --git a/modules/services/drone/runner-docker/default.nix b/modules/services/drone/runner-docker/default.nix
deleted file mode 100644
index 428a8d6..0000000
--- a/modules/services/drone/runner-docker/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
- cfg = config.my.services.drone;
- hasRunner = (name: builtins.elem name cfg.runners);
- dockerPkg = pkgs.drone-runner-docker;
-in
-{
- config = lib.mkIf (cfg.enable && hasRunner "docker") {
- systemd.services.drone-runner-docker = {
- wantedBy = [ "multi-user.target" ];
- after = [ "docker.socket" ]; # Needs the socket to be available
- # might break deployment
- restartIfChanged = false;
- confinement.enable = true;
- serviceConfig = {
- Environment = [
- "DRONE_SERVER_HOST=${cfg.vhostName}"
- "DRONE_SERVER_PROTO=https"
- "DRONE_RUNNER_CAPACITY=10"
- "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}"
- ];
- BindPaths = [ "/var/run/docker.sock" ];
- EnvironmentFile = [ cfg.sharedSecretFile ];
- ExecStart = "${dockerPkg}/bin/drone-runner-docker";
- User = "drone-runner-docker";
- Group = "drone-runner-docker";
- };
- };
-
- # Make sure it is activated in that case
- virtualisation.docker.enable = true;
-
- users.users.drone-runner-docker = {
- isSystemUser = true;
- group = "drone-runner-docker";
- extraGroups = [ "docker" ]; # Give access to the daemon
- };
- users.groups.drone-runner-docker = { };
- };
-}
diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix
deleted file mode 100644
index cbfbb9d..0000000
--- a/modules/services/drone/runner-exec/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
- cfg = config.my.services.drone;
- hasRunner = (name: builtins.elem name cfg.runners);
- execPkg = pkgs.drone-runner-exec;
-in
-{
- config = lib.mkIf (cfg.enable && hasRunner "exec") {
- systemd.services.drone-runner-exec = {
- wantedBy = [ "multi-user.target" ];
- # might break deployment
- restartIfChanged = false;
- confinement.enable = true;
- confinement.packages = with pkgs; [ git gnutar bash nixUnstable gzip ];
- path = with pkgs; [ git gnutar bash nixUnstable gzip ];
- serviceConfig = {
- Environment = [
- "DRONE_SERVER_HOST=${cfg.vhostName}"
- "DRONE_SERVER_PROTO=https"
- "DRONE_RUNNER_CAPACITY=10"
- "CLIENT_DRONE_RPC_HOST=127.0.0.1:${toString cfg.port}"
- "PAGER=cat"
- ];
- BindPaths = [
- "/nix/var/nix/daemon-socket/socket"
- "/var/run/docker.sock"
- ];
- BindReadOnlyPaths = [
- "/etc/resolv.conf:/etc/resolv.conf"
- "/etc/resolvconf.conf:/etc/resolvconf.conf"
- "/etc/passwd:/etc/passwd"
- "/etc/group:/etc/group"
- "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
- "${
- config.environment.etc."ssl/certs/ca-certificates.crt".source
- }:/etc/ssl/certs/ca-certificates.crt"
- "${
- config.environment.etc."ssh/ssh_known_hosts".source
- }:/etc/ssh/ssh_known_hosts"
- "/etc/machine-id"
- # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing
- "/nix/"
- ];
- EnvironmentFile = [ cfg.sharedSecretFile ];
- ExecStart = "${execPkg}/bin/drone-runner-exec";
- User = "drone-runner-exec";
- Group = "drone-runner-exec";
- };
- };
-
- users.users.drone-runner-exec = {
- isSystemUser = true;
- group = "drone-runner-exec";
- extraGroups = [ "docker" ]; # Give access to the daemon
- };
- users.groups.drone-runner-exec = { };
- };
-}
diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix
deleted file mode 100644
index 77f4ee2..0000000
--- a/modules/services/drone/server/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
- cfg = config.my.services.drone;
- secrets = config.age.secrets;
-in
-{
- config = lib.mkIf cfg.enable {
- systemd.services.drone-server = {
- wantedBy = [ "multi-user.target" ];
- serviceConfig = {
- EnvironmentFile = [ cfg.sharedSecretFile ];
- Environment = [
- "DRONE_DATABASE_DRIVER=sqlite3"
- "DRONE_DATABASE_DATASOURCE=/var/lib/drone-server/drone.sqlite"
- "DRONE_SERVER_HOST=${cfg.vhostName}"
- "DRONE_SERVER_PROTO=https"
- "DRONE_SERVER_PORT=:${toString cfg.port}"
- "DRONE_USER_CREATE=username:${cfg.admin},admin:true"
- "DRONE_JSONNET_ENABLED=true"
- "DRONE_STARLARK_ENABLED=true"
- ];
- StateDirectory = "drone-server";
- ExecStart = "${pkgs.drone}/bin/drone-server";
- User = "drone";
- Group = "drone";
- };
- };
-
- users.users.drone = {
- isSystemUser = true;
- createHome = true;
- group = "drone";
- };
-
- users.groups.drone = { };
-
- services.nginx.virtualHosts."${cfg.vhostName}" = {
- forceSSL = true;
- enableACME = true;
- locations."/" = {
- proxyPass = "http://127.0.0.1:${toString cfg.port}";
- proxyWebsockets = true;
- };
- };
-
- my.services.backup = { paths = [ "/var/lib/droner-server" ]; };
- };
-}
diff --git a/modules/services/gitea/default.nix b/modules/services/gitea/default.nix
deleted file mode 100644
index 32c04d4..0000000
--- a/modules/services/gitea/default.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
- cfg = config.my.services.gitea;
- robots-deny = pkgs.writeText "robots.txt" ''
- User-agent: *
- Disallow: /
- '';
-in
-{
- options.my.services.gitea = with lib; {
- enable = mkEnableOption "gitea git server";
- stateDir = mkOption {
- type = types.str;
- example = "/var/lib/gitea";
- description = "gitea base directory";
- };
- };
-
- config = lib.mkIf cfg.enable {
- users.users.git = {
- description = "Gitea Service";
- home = cfg.stateDir;
- useDefaultShell = true;
- group = "git";
- isSystemUser = true;
- };
- users.groups.git = { };
-
- services.gitea = {
- enable = true;
- user = "git";
- domain = "git.fcuny.net";
- appName = "git.fcuny.net";
- rootUrl = "https://git.fcuny.net/";
- httpAddress = "127.0.0.1";
- httpPort = 8002;
- settings = {
- log = {
- LEVEL = "Error";
- };
- service = {
- ENABLE_USER_HEATMAP = false;
- };
- other = {
- SHOW_FOOTER_VERSION = false;
- };
- metrics = {
- ENABLED = true;
- ENABLED_ISSUE_BY_REPOSITORY = true;
- };
- repository = {
- ENABLE_PUSH_CREATE_USER = true;
- DEFAULT_BRANCH = "main";
- };
- server = {
- DISABLE_SSH = true;
- };
- };
- dump.enable = false;
- database = {
- type = "sqlite3";
- user = "git";
- };
- };
-
- services.nginx.virtualHosts."git.fcuny.net" = {
- forceSSL = true;
- enableACME = true;
- locations."/" = {
- proxyPass = "http://127.0.0.1:8002";
- proxyWebsockets = true;
- };
- locations."= /robots.txt".alias = robots-deny;
- };
-
- services.prometheus.scrapeConfigs = [{
- job_name = "gitea";
- metrics_path = "/metrics";
- scheme = "https";
- scrape_interval = "30s";
- static_configs = [{ targets = [ "git.fcuny.net" ]; }];
- }];
-
- my.services.backup = { paths = [ cfg.stateDir ]; };
- };
-}
diff --git a/modules/services/sourcegraph/default.nix b/modules/services/sourcegraph/default.nix
deleted file mode 100644
index 4fd0b8d..0000000
--- a/modules/services/sourcegraph/default.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
- cfg = config.my.services.sourcegraph;
- secrets = config.age.secrets;
-in
-{
- options.my.services.sourcegraph = with lib; {
- enable = mkEnableOption "sourcegraph server";
- vhostName = mkOption {
- type = types.str;
- example = "cs.fcuny.net";
- description = "Name for the virtual host";
- };
- };
-
- config = lib.mkIf cfg.enable {
- virtualisation.oci-containers.containers.sourcegraph = {
- image = "sourcegraph/server:3.31.2";
-
- ports = [ "127.0.0.1:7080:7080" ];
-
- volumes = [
- "/var/lib/sourcegraph/etc:/etc/sourcegraph"
- "/var/lib/sourcegraph/data:/var/opt/sourcegraph"
- ];
-
- # Sourcegraph needs a higher nofile limit, it logs warnings
- # otherwise (unclear whether it actually affects the service).
- extraOptions = [ "--ulimit" "nofile=10000:10000" ];
- };
-
- services.nginx.virtualHosts."${cfg.vhostName}" = {
- forceSSL = true;
- useACMEHost = cfg.vhostName;
- listen = [
- {
- addr = "100.85.232.66";
- port = 443;
- ssl = true;
- }
- {
- addr = "100.85.232.66";
- port = 80;
- ssl = false;
- }
- ];
- locations."/" = { proxyPass = "http://127.0.0.1:7080"; };
- };
-
- security.acme.certs."${cfg.vhostName}" = {
- dnsProvider = "gcloud";
- credentialsFile = secrets."acme/credentials".path;
- };
- };
-}
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-06 06:23:05 +0000