.gitignore

@@ -39,5 +39,3 @@ terraform.rc
 
 # Ignore local output from scripts
 output/
-result
-.direnv/

ansible/inventory

@@ -1,14 +1,15 @@
-[homelab]
-seattle # K3S control Pi
-# kelowna # Secondary Pi in cluster
+[hetzk3s]
+100.65.241.12 ansible_user=root
 
-[nas]
-vancouver
+[homelab]
+100.120.232.77 # K3S control Pi
+100.103.185.70 # Secondary Pi in cluster
 
 [oracle]
-minecraft-server ansible_user=ubuntu # Minecraft Server
-uptime-kuma ansible_user=ubuntu # Uptime Kuma
+100.108.178.121 ansible_user=ubuntu # Minecraft Server
+100.102.227.88 ansible_user=ubuntu # Uptime Kuma
 
 [debian:children]
+hetzk3s
 homelab
 oracle

homelab/atuin.yaml

@@ -1,58 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: atuin
-spec:
-  selector:
-    matchLabels:
-      app: atuin
-  serviceName: atuin
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: atuin
-    spec:
-      containers:
-      - name: atuin
-        image: icr.gmem.ca/atuin-server-sqlite:latest
-        ports:
-        - containerPort: 8888
-          name: web
-        envFrom:
-        - configMapRef:
-            name: atuin
-        volumeMounts:
-        - name: config
-          mountPath: /config
-  volumeClaimTemplates:
-  - metadata:
-      name: config
-    spec:
-      accessModes: [ "ReadWriteOnce" ]
-      resources:
-        requests:
-          storage: 1Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: atuin
-spec:
-  selector:
-    app: atuin
-  ports:
-  - name: web
-    port: 8888
-    targetPort: 8888
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: atuin
-data:
-  ATUIN_OPEN_REGISTRATION: "true"
-  ATUIN_DB_URI: "sqlite:///config/database.sqlite"
-  ATUIN_HOST: "0.0.0.0"
-  ATUIN_PORT: "8888"

homelab/ingress.yml

@@ -10,7 +10,6 @@ metadata:
 spec:
   tls:
   - hosts:
-    - atuin.gmem.ca
     - pw.gmem.ca
     - icr.gmem.ca
     - hue.gmem.ca
@@ -101,13 +100,3 @@ spec:
                 name: homebridge
                 port:
                   number: 8581
-    - host: atuin.gmem.ca
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name:  atuin
-                port:
-                  number: 8888

homelab/registry.yml

@@ -7,14 +7,14 @@ metadata:
 spec:
   containers:
   - name: registry
-    image: registry:2.8.2
+    image: registry:2.6.2
     volumeMounts:
     - name: registry-repo
       mountPath: "/var/lib/registry"
     resources:
       limits:
         memory: "256Mi"
-        cpu: "1"
+        cpu: "2"
       requests:
         memory: "64Mi"
         cpu: "100m"

homelab/vaultwarden.yml

@@ -22,7 +22,7 @@ spec:
             name: vaultwarden
       initContainers:
         - name: init-litestream
-          image: litestream/litestream:sha-749bc0d
+          image: litestream/litestream:sha-565f7a4
           args: ['restore', '-if-db-not-exists', '-if-replica-exists', '-v', '/data/db.sqlite3']
           volumeMounts:
           - name: data
@@ -62,7 +62,7 @@ spec:
           mountPath: /data/config.json
           subPath: vaultwarden.json
       - name: litestream
-        image: litestream/litestream:sha-749bc0d
+        image: litestream/litestream:sha-565f7a4
         args: ['replicate']
         volumeMounts:
         - name: data
@@ -100,6 +100,7 @@ spec:
       resources:
         requests:
           storage: 1Gi
+      storageClassName: nfs-client
 ---
 apiVersion: v1
 kind: Service

krops/krops.nix

@@ -42,7 +42,6 @@ let
       };
       nixos-config.file = toString ./nas/configuration.nix;
       "hardware.nix".file = toString ./nas/hardware.nix;
-      "n8n.nix".file = toString ./nas/nixpkgs/n8n.nix;
     }
   ];
   

krops/nas/configuration.nix

@@ -1,14 +1,11 @@
 { config, pkgs, ... }:
 
 {
-  disabledModules = [ "services/misc/n8n.nix" ];
   imports =
     [ # Include the results of the hardware scan.
       ./hardware.nix
       <home-manager/nixos>
-      <n8n.nix>
     ];
-
   nix = {
     settings = {
       auto-optimise-store = true;
@@ -34,10 +31,6 @@
     n8n = {
       enable = true;
       openFirewall = true;
-      webhookUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
-      settings = {
-        editorBaseUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
-      };
     };
     nfs.server.enable = true;
     samba-wsdd.enable = true;
@@ -100,50 +93,35 @@
     };
     nginx = {
       enable = true;
-      logError = "/var/log/nginx/debug.log info";
-      # We can only proxy one port with Tailscale Funnel so we abuse locations instead.
-      virtualHosts."vancouver.gmem.ca" =  {
-        default = true;
-        enableACME = false;
-        forceSSL = false;
-        locations."/git/" = {
-          proxyWebsockets = false; # needed if you need to use WebSocket
-          extraConfig =
-            ''
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            '';
-          proxyPass = "http://127.0.0.1:8973/";
-        };
-        locations."/n8n/" = {
-          proxyPass = "http://127.0.0.1:5678/";
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      # other Nginx options
+      virtualHosts."n8n.gmem.ca" =  {
+        enableACME = true;
+        forceSSL = true;
+        acmeRoot = null;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:5678";
           proxyWebsockets = true; # needed if you need to use WebSocket
           extraConfig =
-            ''
-            proxy_pass_header Authorization;
-            '';
-        };
-      };
-    };
-    gitea = {
-      enable = true;
-      stateDir = "/Primary/gitea";
-      package = pkgs.forgejo;
-      settings = {
-        server = {
-          ROOT_URL = "https://vancouver.scorpion-ghost.ts.net/git/";
-          HTTP_PORT = 8973;
-        };
-        service = {
-          DISABLE_REGISTRATION = true;
-          COOKIE_SECURE = true;
+            # required when the target is also TLS server with multiple hosts
+            # "proxy_ssl_server_name on;" +
+            # required when the server wants to use HTTP Authentication
+            "proxy_pass_header Authorization;"
+          ;
         };
       };
     };
   };
 
+  security.acme = {
+    acceptTerms = true;
+    defaults = { email = "acme@gmem.ca";
+                 dnsProvider = "route53";
+                 credentialsFile = "/Primary/gabriel/.aws/credentials";
+                 # We don't need to wait for propagation since this is a local DNS server
+               };
+  };
 
   networking = {
     hostId = "e1e29bf4";
@@ -166,8 +144,6 @@
     lm_sensors
     screen
     nix-output-monitor
-    cifs-utils
-    # atuin
   ];
 
   time.timeZone = "Europe/London";

krops/nas/nixpkgs/n8n.nix

@@ -1,93 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.n8n;
-  format = pkgs.formats.json {};
-  configFile = format.generate "n8n.json" cfg.settings;
-in
-{
-  options.services.n8n = {
-    enable = mkEnableOption (lib.mdDoc "n8n server");
-
-    openFirewall = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc "Open ports in the firewall for the n8n web interface.";
-    };
-
-    settings = mkOption {
-      type = format.type;
-      default = {};
-      description = lib.mdDoc ''
-        Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
-        for supported values.
-      '';
-    };
-
-    webhookUrl = mkOption {
-      type = types.str;
-      default = "";
-      description = lib.mdDoc ''
-        WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
-        This cannot be set through configuration and must reside in an environment variable.
-      '';
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-    services.n8n.settings = {
-      # We use this to open the firewall, so we need to know about the default at eval time
-      port = lib.mkDefault 5678;
-    };
-
-    systemd.services.n8n = {
-      description = "N8N service";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      environment = {
-        # This folder must be writeable as the application is storing
-        # its data in it, so the StateDirectory is a good choice
-        N8N_USER_FOLDER = "/var/lib/n8n";
-        HOME = "/var/lib/n8n";
-        N8N_CONFIG_FILES = "${configFile}";
-        WEBHOOK_URL = "${cfg.webhookUrl}";
-        VUE_APP_URL_BASE_API="https://vancouver.scorpion-ghost.ts.net/n8n/";
-        N8N_PATH="/n8n/";
-        # Don't phone home
-        N8N_DIAGNOSTICS_ENABLED = "false";
-        N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
-      };
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${pkgs.n8n}/bin/n8n";
-        Restart = "on-failure";
-        StateDirectory = "n8n";
-
-        # Basic Hardening
-        NoNewPrivileges = "yes";
-        PrivateTmp = "yes";
-        PrivateDevices = "yes";
-        DevicePolicy = "closed";
-        DynamicUser = "true";
-        ProtectSystem = "strict";
-        ProtectHome = "read-only";
-        ProtectControlGroups = "yes";
-        ProtectKernelModules = "yes";
-        ProtectKernelTunables = "yes";
-        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
-        RestrictNamespaces = "yes";
-        RestrictRealtime = "yes";
-        RestrictSUIDSGID = "yes";
-        MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
-        LockPersonality = "yes";
-      };
-    };
-
-    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.settings.port ];
-    };
-  };
-}