Compare commits
No commits in common. "7fe118d878c1126500d92b3b83ccf4798f1a9103" and "ef210a08493dbd6361aa5e7d9e7a58a903332266" have entirely different histories.
7fe118d878
...
ef210a0849
2
.gitignore
vendored
2
.gitignore
vendored
|
@ -39,5 +39,3 @@ terraform.rc
|
|||
|
||||
# Ignore local output from scripts
|
||||
output/
|
||||
result
|
||||
.direnv/
|
||||
|
|
|
@ -1,14 +1,15 @@
|
|||
[homelab]
|
||||
seattle # K3S control Pi
|
||||
# kelowna # Secondary Pi in cluster
|
||||
[hetzk3s]
|
||||
100.65.241.12 ansible_user=root
|
||||
|
||||
[nas]
|
||||
vancouver
|
||||
[homelab]
|
||||
100.120.232.77 # K3S control Pi
|
||||
100.103.185.70 # Secondary Pi in cluster
|
||||
|
||||
[oracle]
|
||||
minecraft-server ansible_user=ubuntu # Minecraft Server
|
||||
uptime-kuma ansible_user=ubuntu # Uptime Kuma
|
||||
100.108.178.121 ansible_user=ubuntu # Minecraft Server
|
||||
100.102.227.88 ansible_user=ubuntu # Uptime Kuma
|
||||
|
||||
[debian:children]
|
||||
hetzk3s
|
||||
homelab
|
||||
oracle
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: atuin
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: atuin
|
||||
serviceName: atuin
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: atuin
|
||||
spec:
|
||||
containers:
|
||||
- name: atuin
|
||||
image: icr.gmem.ca/atuin-server-sqlite:latest
|
||||
ports:
|
||||
- containerPort: 8888
|
||||
name: web
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: atuin
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: config
|
||||
spec:
|
||||
accessModes: [ "ReadWriteOnce" ]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: atuin
|
||||
spec:
|
||||
selector:
|
||||
app: atuin
|
||||
ports:
|
||||
- name: web
|
||||
port: 8888
|
||||
targetPort: 8888
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: atuin
|
||||
data:
|
||||
ATUIN_OPEN_REGISTRATION: "true"
|
||||
ATUIN_DB_URI: "sqlite:///config/database.sqlite"
|
||||
ATUIN_HOST: "0.0.0.0"
|
||||
ATUIN_PORT: "8888"
|
|
@ -10,7 +10,6 @@ metadata:
|
|||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- atuin.gmem.ca
|
||||
- pw.gmem.ca
|
||||
- icr.gmem.ca
|
||||
- hue.gmem.ca
|
||||
|
@ -101,13 +100,3 @@ spec:
|
|||
name: homebridge
|
||||
port:
|
||||
number: 8581
|
||||
- host: atuin.gmem.ca
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: atuin
|
||||
port:
|
||||
number: 8888
|
||||
|
|
|
@ -7,14 +7,14 @@ metadata:
|
|||
spec:
|
||||
containers:
|
||||
- name: registry
|
||||
image: registry:2.8.2
|
||||
image: registry:2.6.2
|
||||
volumeMounts:
|
||||
- name: registry-repo
|
||||
mountPath: "/var/lib/registry"
|
||||
resources:
|
||||
limits:
|
||||
memory: "256Mi"
|
||||
cpu: "1"
|
||||
cpu: "2"
|
||||
requests:
|
||||
memory: "64Mi"
|
||||
cpu: "100m"
|
||||
|
|
|
@ -22,7 +22,7 @@ spec:
|
|||
name: vaultwarden
|
||||
initContainers:
|
||||
- name: init-litestream
|
||||
image: litestream/litestream:sha-749bc0d
|
||||
image: litestream/litestream:sha-565f7a4
|
||||
args: ['restore', '-if-db-not-exists', '-if-replica-exists', '-v', '/data/db.sqlite3']
|
||||
volumeMounts:
|
||||
- name: data
|
||||
|
@ -62,7 +62,7 @@ spec:
|
|||
mountPath: /data/config.json
|
||||
subPath: vaultwarden.json
|
||||
- name: litestream
|
||||
image: litestream/litestream:sha-749bc0d
|
||||
image: litestream/litestream:sha-565f7a4
|
||||
args: ['replicate']
|
||||
volumeMounts:
|
||||
- name: data
|
||||
|
@ -100,6 +100,7 @@ spec:
|
|||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: nfs-client
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
|
|
@ -42,7 +42,6 @@ let
|
|||
};
|
||||
nixos-config.file = toString ./nas/configuration.nix;
|
||||
"hardware.nix".file = toString ./nas/hardware.nix;
|
||||
"n8n.nix".file = toString ./nas/nixpkgs/n8n.nix;
|
||||
}
|
||||
];
|
||||
|
||||
|
|
|
@ -1,14 +1,11 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
disabledModules = [ "services/misc/n8n.nix" ];
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware.nix
|
||||
<home-manager/nixos>
|
||||
<n8n.nix>
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
auto-optimise-store = true;
|
||||
|
@ -34,10 +31,6 @@
|
|||
n8n = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
webhookUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||
settings = {
|
||||
editorBaseUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||
};
|
||||
};
|
||||
nfs.server.enable = true;
|
||||
samba-wsdd.enable = true;
|
||||
|
@ -100,50 +93,35 @@
|
|||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
logError = "/var/log/nginx/debug.log info";
|
||||
# We can only proxy one port with Tailscale Funnel so we abuse locations instead.
|
||||
virtualHosts."vancouver.gmem.ca" = {
|
||||
default = true;
|
||||
enableACME = false;
|
||||
forceSSL = false;
|
||||
locations."/git/" = {
|
||||
proxyWebsockets = false; # needed if you need to use WebSocket
|
||||
extraConfig =
|
||||
''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
proxyPass = "http://127.0.0.1:8973/";
|
||||
};
|
||||
locations."/n8n/" = {
|
||||
proxyPass = "http://127.0.0.1:5678/";
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
# other Nginx options
|
||||
virtualHosts."n8n.gmem.ca" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
acmeRoot = null;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5678";
|
||||
proxyWebsockets = true; # needed if you need to use WebSocket
|
||||
extraConfig =
|
||||
''
|
||||
proxy_pass_header Authorization;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
gitea = {
|
||||
enable = true;
|
||||
stateDir = "/Primary/gitea";
|
||||
package = pkgs.forgejo;
|
||||
settings = {
|
||||
server = {
|
||||
ROOT_URL = "https://vancouver.scorpion-ghost.ts.net/git/";
|
||||
HTTP_PORT = 8973;
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true;
|
||||
COOKIE_SECURE = true;
|
||||
# required when the target is also TLS server with multiple hosts
|
||||
# "proxy_ssl_server_name on;" +
|
||||
# required when the server wants to use HTTP Authentication
|
||||
"proxy_pass_header Authorization;"
|
||||
;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = { email = "acme@gmem.ca";
|
||||
dnsProvider = "route53";
|
||||
credentialsFile = "/Primary/gabriel/.aws/credentials";
|
||||
# We don't need to wait for propagation since this is a local DNS server
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostId = "e1e29bf4";
|
||||
|
@ -166,8 +144,6 @@
|
|||
lm_sensors
|
||||
screen
|
||||
nix-output-monitor
|
||||
cifs-utils
|
||||
# atuin
|
||||
];
|
||||
|
||||
time.timeZone = "Europe/London";
|
||||
|
|
|
@ -1,93 +0,0 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.n8n;
|
||||
format = pkgs.formats.json {};
|
||||
configFile = format.generate "n8n.json" cfg.settings;
|
||||
in
|
||||
{
|
||||
options.services.n8n = {
|
||||
enable = mkEnableOption (lib.mdDoc "n8n server");
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Open ports in the firewall for the n8n web interface.";
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = format.type;
|
||||
default = {};
|
||||
description = lib.mdDoc ''
|
||||
Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
|
||||
for supported values.
|
||||
'';
|
||||
};
|
||||
|
||||
webhookUrl = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = lib.mdDoc ''
|
||||
WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
|
||||
This cannot be set through configuration and must reside in an environment variable.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.n8n.settings = {
|
||||
# We use this to open the firewall, so we need to know about the default at eval time
|
||||
port = lib.mkDefault 5678;
|
||||
};
|
||||
|
||||
systemd.services.n8n = {
|
||||
description = "N8N service";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = {
|
||||
# This folder must be writeable as the application is storing
|
||||
# its data in it, so the StateDirectory is a good choice
|
||||
N8N_USER_FOLDER = "/var/lib/n8n";
|
||||
HOME = "/var/lib/n8n";
|
||||
N8N_CONFIG_FILES = "${configFile}";
|
||||
WEBHOOK_URL = "${cfg.webhookUrl}";
|
||||
VUE_APP_URL_BASE_API="https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||
N8N_PATH="/n8n/";
|
||||
# Don't phone home
|
||||
N8N_DIAGNOSTICS_ENABLED = "false";
|
||||
N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.n8n}/bin/n8n";
|
||||
Restart = "on-failure";
|
||||
StateDirectory = "n8n";
|
||||
|
||||
# Basic Hardening
|
||||
NoNewPrivileges = "yes";
|
||||
PrivateTmp = "yes";
|
||||
PrivateDevices = "yes";
|
||||
DevicePolicy = "closed";
|
||||
DynamicUser = "true";
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = "read-only";
|
||||
ProtectControlGroups = "yes";
|
||||
ProtectKernelModules = "yes";
|
||||
ProtectKernelTunables = "yes";
|
||||
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
|
||||
RestrictNamespaces = "yes";
|
||||
RestrictRealtime = "yes";
|
||||
RestrictSUIDSGID = "yes";
|
||||
MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
|
||||
LockPersonality = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [ cfg.settings.port ];
|
||||
};
|
||||
};
|
||||
}
|
Loading…
Reference in a new issue