107 lines
4.1 KiB
Nix
107 lines
4.1 KiB
Nix
{
|
|
description = "Forgejo CI Runners";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
srvos.url = "github:numtide/srvos";
|
|
disko.url = "github:nix-community/disko";
|
|
# sops-nix - secrets with mozilla sops
|
|
# https://github.com/Mic92/sops-nix
|
|
sops-nix = {
|
|
url = "github:Mic92/sops-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
|
|
nixConfig = {
|
|
extra-substituters = [
|
|
"https://nix-community.cachix.org"
|
|
"https://hsndev.cachix.org"
|
|
];
|
|
extra-trusted-public-keys = [
|
|
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
|
"hsndev.cachix.org-1:vN1/XGBZtMLnTFYDmTLDrullgZHSUYY3Kqt+Yg/C+tE="
|
|
];
|
|
trusted-users = ["root" "gitea-runner"];
|
|
};
|
|
|
|
outputs = { self, sops-nix, nixpkgs, srvos, disko, ... }@inputs:
|
|
let
|
|
linuxMachineName = "linux";
|
|
lib = nixpkgs.lib;
|
|
inherit (self) outputs;
|
|
in {
|
|
nixosConfigurations =
|
|
{
|
|
"fj-hetzner-aarch64-01" = lib.nixosSystem {
|
|
system = "aarch64-linux";
|
|
specialArgs = {inherit inputs outputs;};
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
srvos.nixosModules.hardware-hetzner-cloud
|
|
srvos.nixosModules.server
|
|
srvos.nixosModules.mixins-systemd-boot
|
|
disko.nixosModules.disko
|
|
./agents/fj-hetzner-aarch64.nix
|
|
(import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
|
|
{
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
networking.hostName = "fj-hetzner-aarch64-01";
|
|
users.users.root.openssh.authorizedKeys.keys =
|
|
[
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
|
];
|
|
services.openssh.enable = true;
|
|
services.openssh.settings.PermitRootLogin = "without-password";
|
|
}];
|
|
};
|
|
"fj-shadowfax-01" = lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs outputs;};
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
./hardware/shadowfax-kubevirt.nix
|
|
srvos.nixosModules.server
|
|
srvos.nixosModules.mixins-systemd-boot
|
|
disko.nixosModules.disko
|
|
./agents/fj-shadowfax-x86_64.nix
|
|
(import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/sda" ]; })
|
|
{
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
networking.hostName = "fj-shadowfax-01";
|
|
users.users.root.openssh.authorizedKeys.keys =
|
|
[
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
|
];
|
|
services.openssh.enable = true;
|
|
# services.openssh.settings.PermitRootLogin = "without-password";
|
|
}];
|
|
};
|
|
"fj-shadowfax-02" = lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs outputs;};
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
./hardware/shadowfax-kubevirt.nix
|
|
srvos.nixosModules.server
|
|
srvos.nixosModules.mixins-systemd-boot
|
|
disko.nixosModules.disko
|
|
./agents/fj-shadowfax-x86_64.nix
|
|
(import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/sda" ]; })
|
|
{
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
networking.hostName = "fj-shadowfax-02";
|
|
users.users.root.openssh.authorizedKeys.keys =
|
|
[
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
|
|
];
|
|
services.openssh.enable = true;
|
|
# services.openssh.settings.PermitRootLogin = "without-password";
|
|
}];
|
|
};
|
|
};
|
|
};
|
|
}
|