Compare commits
No commits in common. "7fe118d878c1126500d92b3b83ccf4798f1a9103" and "ef210a08493dbd6361aa5e7d9e7a58a903332266" have entirely different histories.
7fe118d878
...
ef210a0849
2
.gitignore
vendored
2
.gitignore
vendored
|
@ -39,5 +39,3 @@ terraform.rc
|
||||||
|
|
||||||
# Ignore local output from scripts
|
# Ignore local output from scripts
|
||||||
output/
|
output/
|
||||||
result
|
|
||||||
.direnv/
|
|
||||||
|
|
|
@ -1,14 +1,15 @@
|
||||||
[homelab]
|
[hetzk3s]
|
||||||
seattle # K3S control Pi
|
100.65.241.12 ansible_user=root
|
||||||
# kelowna # Secondary Pi in cluster
|
|
||||||
|
|
||||||
[nas]
|
[homelab]
|
||||||
vancouver
|
100.120.232.77 # K3S control Pi
|
||||||
|
100.103.185.70 # Secondary Pi in cluster
|
||||||
|
|
||||||
[oracle]
|
[oracle]
|
||||||
minecraft-server ansible_user=ubuntu # Minecraft Server
|
100.108.178.121 ansible_user=ubuntu # Minecraft Server
|
||||||
uptime-kuma ansible_user=ubuntu # Uptime Kuma
|
100.102.227.88 ansible_user=ubuntu # Uptime Kuma
|
||||||
|
|
||||||
[debian:children]
|
[debian:children]
|
||||||
|
hetzk3s
|
||||||
homelab
|
homelab
|
||||||
oracle
|
oracle
|
|
@ -1,58 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: atuin
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: atuin
|
|
||||||
serviceName: atuin
|
|
||||||
replicas: 1
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: atuin
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: atuin
|
|
||||||
image: icr.gmem.ca/atuin-server-sqlite:latest
|
|
||||||
ports:
|
|
||||||
- containerPort: 8888
|
|
||||||
name: web
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: atuin
|
|
||||||
volumeMounts:
|
|
||||||
- name: config
|
|
||||||
mountPath: /config
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
name: config
|
|
||||||
spec:
|
|
||||||
accessModes: [ "ReadWriteOnce" ]
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 1Gi
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: atuin
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: atuin
|
|
||||||
ports:
|
|
||||||
- name: web
|
|
||||||
port: 8888
|
|
||||||
targetPort: 8888
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: atuin
|
|
||||||
data:
|
|
||||||
ATUIN_OPEN_REGISTRATION: "true"
|
|
||||||
ATUIN_DB_URI: "sqlite:///config/database.sqlite"
|
|
||||||
ATUIN_HOST: "0.0.0.0"
|
|
||||||
ATUIN_PORT: "8888"
|
|
|
@ -10,7 +10,6 @@ metadata:
|
||||||
spec:
|
spec:
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- atuin.gmem.ca
|
|
||||||
- pw.gmem.ca
|
- pw.gmem.ca
|
||||||
- icr.gmem.ca
|
- icr.gmem.ca
|
||||||
- hue.gmem.ca
|
- hue.gmem.ca
|
||||||
|
@ -101,13 +100,3 @@ spec:
|
||||||
name: homebridge
|
name: homebridge
|
||||||
port:
|
port:
|
||||||
number: 8581
|
number: 8581
|
||||||
- host: atuin.gmem.ca
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: atuin
|
|
||||||
port:
|
|
||||||
number: 8888
|
|
||||||
|
|
|
@ -7,14 +7,14 @@ metadata:
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: registry
|
- name: registry
|
||||||
image: registry:2.8.2
|
image: registry:2.6.2
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: registry-repo
|
- name: registry-repo
|
||||||
mountPath: "/var/lib/registry"
|
mountPath: "/var/lib/registry"
|
||||||
resources:
|
resources:
|
||||||
limits:
|
limits:
|
||||||
memory: "256Mi"
|
memory: "256Mi"
|
||||||
cpu: "1"
|
cpu: "2"
|
||||||
requests:
|
requests:
|
||||||
memory: "64Mi"
|
memory: "64Mi"
|
||||||
cpu: "100m"
|
cpu: "100m"
|
||||||
|
|
|
@ -22,7 +22,7 @@ spec:
|
||||||
name: vaultwarden
|
name: vaultwarden
|
||||||
initContainers:
|
initContainers:
|
||||||
- name: init-litestream
|
- name: init-litestream
|
||||||
image: litestream/litestream:sha-749bc0d
|
image: litestream/litestream:sha-565f7a4
|
||||||
args: ['restore', '-if-db-not-exists', '-if-replica-exists', '-v', '/data/db.sqlite3']
|
args: ['restore', '-if-db-not-exists', '-if-replica-exists', '-v', '/data/db.sqlite3']
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: data
|
- name: data
|
||||||
|
@ -62,7 +62,7 @@ spec:
|
||||||
mountPath: /data/config.json
|
mountPath: /data/config.json
|
||||||
subPath: vaultwarden.json
|
subPath: vaultwarden.json
|
||||||
- name: litestream
|
- name: litestream
|
||||||
image: litestream/litestream:sha-749bc0d
|
image: litestream/litestream:sha-565f7a4
|
||||||
args: ['replicate']
|
args: ['replicate']
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: data
|
- name: data
|
||||||
|
@ -100,6 +100,7 @@ spec:
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: 1Gi
|
storage: 1Gi
|
||||||
|
storageClassName: nfs-client
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Service
|
kind: Service
|
||||||
|
|
|
@ -42,7 +42,6 @@ let
|
||||||
};
|
};
|
||||||
nixos-config.file = toString ./nas/configuration.nix;
|
nixos-config.file = toString ./nas/configuration.nix;
|
||||||
"hardware.nix".file = toString ./nas/hardware.nix;
|
"hardware.nix".file = toString ./nas/hardware.nix;
|
||||||
"n8n.nix".file = toString ./nas/nixpkgs/n8n.nix;
|
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -1,14 +1,11 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
disabledModules = [ "services/misc/n8n.nix" ];
|
|
||||||
imports =
|
imports =
|
||||||
[ # Include the results of the hardware scan.
|
[ # Include the results of the hardware scan.
|
||||||
./hardware.nix
|
./hardware.nix
|
||||||
<home-manager/nixos>
|
<home-manager/nixos>
|
||||||
<n8n.nix>
|
|
||||||
];
|
];
|
||||||
|
|
||||||
nix = {
|
nix = {
|
||||||
settings = {
|
settings = {
|
||||||
auto-optimise-store = true;
|
auto-optimise-store = true;
|
||||||
|
@ -34,10 +31,6 @@
|
||||||
n8n = {
|
n8n = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
webhookUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
|
||||||
settings = {
|
|
||||||
editorBaseUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
nfs.server.enable = true;
|
nfs.server.enable = true;
|
||||||
samba-wsdd.enable = true;
|
samba-wsdd.enable = true;
|
||||||
|
@ -100,50 +93,35 @@
|
||||||
};
|
};
|
||||||
nginx = {
|
nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
logError = "/var/log/nginx/debug.log info";
|
recommendedProxySettings = true;
|
||||||
# We can only proxy one port with Tailscale Funnel so we abuse locations instead.
|
recommendedTlsSettings = true;
|
||||||
virtualHosts."vancouver.gmem.ca" = {
|
# other Nginx options
|
||||||
default = true;
|
virtualHosts."n8n.gmem.ca" = {
|
||||||
enableACME = false;
|
enableACME = true;
|
||||||
forceSSL = false;
|
forceSSL = true;
|
||||||
locations."/git/" = {
|
acmeRoot = null;
|
||||||
proxyWebsockets = false; # needed if you need to use WebSocket
|
locations."/" = {
|
||||||
extraConfig =
|
proxyPass = "http://127.0.0.1:5678";
|
||||||
''
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
'';
|
|
||||||
proxyPass = "http://127.0.0.1:8973/";
|
|
||||||
};
|
|
||||||
locations."/n8n/" = {
|
|
||||||
proxyPass = "http://127.0.0.1:5678/";
|
|
||||||
proxyWebsockets = true; # needed if you need to use WebSocket
|
proxyWebsockets = true; # needed if you need to use WebSocket
|
||||||
extraConfig =
|
extraConfig =
|
||||||
''
|
# required when the target is also TLS server with multiple hosts
|
||||||
proxy_pass_header Authorization;
|
# "proxy_ssl_server_name on;" +
|
||||||
'';
|
# required when the server wants to use HTTP Authentication
|
||||||
};
|
"proxy_pass_header Authorization;"
|
||||||
};
|
;
|
||||||
};
|
|
||||||
gitea = {
|
|
||||||
enable = true;
|
|
||||||
stateDir = "/Primary/gitea";
|
|
||||||
package = pkgs.forgejo;
|
|
||||||
settings = {
|
|
||||||
server = {
|
|
||||||
ROOT_URL = "https://vancouver.scorpion-ghost.ts.net/git/";
|
|
||||||
HTTP_PORT = 8973;
|
|
||||||
};
|
|
||||||
service = {
|
|
||||||
DISABLE_REGISTRATION = true;
|
|
||||||
COOKIE_SECURE = true;
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults = { email = "acme@gmem.ca";
|
||||||
|
dnsProvider = "route53";
|
||||||
|
credentialsFile = "/Primary/gabriel/.aws/credentials";
|
||||||
|
# We don't need to wait for propagation since this is a local DNS server
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
hostId = "e1e29bf4";
|
hostId = "e1e29bf4";
|
||||||
|
@ -166,8 +144,6 @@
|
||||||
lm_sensors
|
lm_sensors
|
||||||
screen
|
screen
|
||||||
nix-output-monitor
|
nix-output-monitor
|
||||||
cifs-utils
|
|
||||||
# atuin
|
|
||||||
];
|
];
|
||||||
|
|
||||||
time.timeZone = "Europe/London";
|
time.timeZone = "Europe/London";
|
||||||
|
|
|
@ -1,93 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
cfg = config.services.n8n;
|
|
||||||
format = pkgs.formats.json {};
|
|
||||||
configFile = format.generate "n8n.json" cfg.settings;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
options.services.n8n = {
|
|
||||||
enable = mkEnableOption (lib.mdDoc "n8n server");
|
|
||||||
|
|
||||||
openFirewall = mkOption {
|
|
||||||
type = types.bool;
|
|
||||||
default = false;
|
|
||||||
description = lib.mdDoc "Open ports in the firewall for the n8n web interface.";
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = mkOption {
|
|
||||||
type = format.type;
|
|
||||||
default = {};
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
|
|
||||||
for supported values.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
webhookUrl = mkOption {
|
|
||||||
type = types.str;
|
|
||||||
default = "";
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
|
|
||||||
This cannot be set through configuration and must reside in an environment variable.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
|
||||||
services.n8n.settings = {
|
|
||||||
# We use this to open the firewall, so we need to know about the default at eval time
|
|
||||||
port = lib.mkDefault 5678;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.n8n = {
|
|
||||||
description = "N8N service";
|
|
||||||
after = [ "network.target" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
environment = {
|
|
||||||
# This folder must be writeable as the application is storing
|
|
||||||
# its data in it, so the StateDirectory is a good choice
|
|
||||||
N8N_USER_FOLDER = "/var/lib/n8n";
|
|
||||||
HOME = "/var/lib/n8n";
|
|
||||||
N8N_CONFIG_FILES = "${configFile}";
|
|
||||||
WEBHOOK_URL = "${cfg.webhookUrl}";
|
|
||||||
VUE_APP_URL_BASE_API="https://vancouver.scorpion-ghost.ts.net/n8n/";
|
|
||||||
N8N_PATH="/n8n/";
|
|
||||||
# Don't phone home
|
|
||||||
N8N_DIAGNOSTICS_ENABLED = "false";
|
|
||||||
N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
|
|
||||||
};
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "simple";
|
|
||||||
ExecStart = "${pkgs.n8n}/bin/n8n";
|
|
||||||
Restart = "on-failure";
|
|
||||||
StateDirectory = "n8n";
|
|
||||||
|
|
||||||
# Basic Hardening
|
|
||||||
NoNewPrivileges = "yes";
|
|
||||||
PrivateTmp = "yes";
|
|
||||||
PrivateDevices = "yes";
|
|
||||||
DevicePolicy = "closed";
|
|
||||||
DynamicUser = "true";
|
|
||||||
ProtectSystem = "strict";
|
|
||||||
ProtectHome = "read-only";
|
|
||||||
ProtectControlGroups = "yes";
|
|
||||||
ProtectKernelModules = "yes";
|
|
||||||
ProtectKernelTunables = "yes";
|
|
||||||
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
|
|
||||||
RestrictNamespaces = "yes";
|
|
||||||
RestrictRealtime = "yes";
|
|
||||||
RestrictSUIDSGID = "yes";
|
|
||||||
MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
|
|
||||||
LockPersonality = "yes";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall = mkIf cfg.openFirewall {
|
|
||||||
allowedTCPPorts = [ cfg.settings.port ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
Loading…
Reference in a new issue