commit a0a647fb5b0608680002c8fcfcd22472f977536d · kot.pink/core

+158 -1
flake.nix
···

       120
       120
        
                 pkgs.litecli

     

       121
       121
        
                 pkgs.websocat

     

       122
       122
        
                 pkgs.tailwindcss

     

       123
       123
       +
                 pkgs.nixos-shell

     

       123
       124
        
               ];

     

       124
       125
        
               shellHook = ''

     

       125
       126
        
                 cp -f ${htmx-src} appview/pages/static/htmx.min.js

     
···

       150
       151
        
             };

     

       151
       152
        
           });

     

       152
       153
        
       

     

       153
       153
       -
           nixosModules.default = {

     

       154
       154
       +
           nixosModules.appview = {

     

       154
       155
        
             config,

     

       155
       156
        
             pkgs,

     

       156
       157
        
             lib,

     
···

       196
       197
        
                 };

     

       197
       198
        
               };

     

       198
       199
        
             };

     

       200
       200
       +
       

     

       201
       201
       +
           nixosModules.knotserver = {

     

       202
       202
       +
             config,

     

       203
       203
       +
             pkgs,

     

       204
       204
       +
             lib,

     

       205
       205
       +
             ...

     

       206
       206
       +
           }:

     

       207
       207
       +
             with lib; {

     

       208
       208
       +
               options = {

     

       209
       209
       +
                 services.tangled-knotserver = {

     

       210
       210
       +
                   enable = mkOption {

     

       211
       211
       +
                     type = types.bool;

     

       212
       212
       +
                     default = false;

     

       213
       213
       +
                     description = "Enable a tangled knotserver";

     

       214
       214
       +
                   };

     

       215
       215
       +
       

     

       216
       216
       +
                   appviewEndpoint = mkOption {

     

       217
       217
       +
                     type = types.str;

     

       218
       218
       +
                     default = "https://tangled.sh";

     

       219
       219
       +
                     description = "Appview endpoint";

     

       220
       220
       +
                   };

     

       221
       221
       +
       

     

       222
       222
       +
                   gitUser = mkOption {

     

       223
       223
       +
                     type = types.str;

     

       224
       224
       +
                     default = "git";

     

       225
       225
       +
                     description = "User that hosts git repos and performs git operations";

     

       226
       226
       +
                   };

     

       227
       227
       +
       

     

       228
       228
       +
                   repo = {

     

       229
       229
       +
                     scanPath = mkOption {

     

       230
       230
       +
                       type = types.path;

     

       231
       231
       +
                       default = "/home/git";

     

       232
       232
       +
                       description = "Path where repositories are scanned from";

     

       233
       233
       +
                     };

     

       234
       234
       +
       

     

       235
       235
       +
                     mainBranch = mkOption {

     

       236
       236
       +
                       type = types.str;

     

       237
       237
       +
                       default = "main";

     

       238
       238
       +
                       description = "Default branch name for repositories";

     

       239
       239
       +
                     };

     

       240
       240
       +
                   };

     

       241
       241
       +
       

     

       242
       242
       +
                   server = {

     

       243
       243
       +
                     listenAddr = mkOption {

     

       244
       244
       +
                       type = types.str;

     

       245
       245
       +
                       default = "0.0.0.0:5555";

     

       246
       246
       +
                       description = "Address to listen on";

     

       247
       247
       +
                     };

     

       248
       248
       +
       

     

       249
       249
       +
                     internalListenAddr = mkOption {

     

       250
       250
       +
                       type = types.str;

     

       251
       251
       +
                       default = "127.0.0.1:5444";

     

       252
       252
       +
                       description = "Internal address for inter-service communication";

     

       253
       253
       +
                     };

     

       254
       254
       +
       

     

       255
       255
       +
                     secret = mkOption {

     

       256
       256
       +
                       type = types.str;

     

       257
       257
       +
                       example = "super-secret-key";

     

       258
       258
       +
                       description = "Secret key provided by appview (required)";

     

       259
       259
       +
                     };

     

       260
       260
       +
       

     

       261
       261
       +
                     dbPath = mkOption {

     

       262
       262
       +
                       type = types.path;

     

       263
       263
       +
                       default = "knotserver.db";

     

       264
       264
       +
                       description = "Path to the database file";

     

       265
       265
       +
                     };

     

       266
       266
       +
       

     

       267
       267
       +
                     hostname = mkOption {

     

       268
       268
       +
                       type = types.str;

     

       269
       269
       +
                       example = "knot.tangled.sh";

     

       270
       270
       +
                       description = "Hostname for the server (required)";

     

       271
       271
       +
                     };

     

       272
       272
       +
       

     

       273
       273
       +
                     dev = mkOption {

     

       274
       274
       +
                       type = types.bool;

     

       275
       275
       +
                       default = false;

     

       276
       276
       +
                       description = "Enable development mode (disables signature verification)";

     

       277
       277
       +
                     };

     

       278
       278
       +
                   };

     

       279
       279
       +
                 };

     

       280
       280
       +
               };

     

       281
       281
       +
       

     

       282
       282
       +
               config = mkIf config.services.tangled-knotserver.enable {

     

       283
       283
       +
                 nixpkgs.overlays = [self.overlays.default];

     

       284
       284
       +
       

     

       285
       285
       +
                 environment.systemPackages = with pkgs; [git];

     

       286
       286
       +
       

     

       287
       287
       +
                 users.users.git = {

     

       288
       288
       +
                   isSystemUser = true;

     

       289
       289
       +
                   home = "/home/git";

     

       290
       290
       +
                   createHome = true;

     

       291
       291
       +
                   shell = "${pkgs.shadow}/bin/nologin";

     

       292
       292
       +
                   uid = 1000;

     

       293
       293
       +
                   group = "git";

     

       294
       294
       +
                   extraGroups = ["sudo"];

     

       295
       295
       +
                 };

     

       296
       296
       +
       

     

       297
       297
       +
                 users.groups.git = {};

     

       298
       298
       +
       

     

       299
       299
       +
                 services.openssh = {

     

       300
       300
       +
                   enable = true;

     

       301
       301
       +
                   extraConfig = ''

     

       302
       302
       +
                     Match User git

     

       303
       303
       +
                     AuthorizedKeysCommand ${pkgs.keyfetch}/bin/keyfetch -repoguard-path ${pkgs.repoguard}/bin/repoguard

     

       304
       304
       +
                     AuthorizedKeysCommandUser nobody

     

       305
       305
       +
                   '';

     

       306
       306
       +
                 };

     

       307
       307
       +
       

     

       308
       308
       +
                 systemd.services.knotserver = {

     

       309
       309
       +
                   description = "knotserver service";

     

       310
       310
       +
                   after = ["network.target" "sshd.service"];

     

       311
       311
       +
                   wantedBy = ["multi-user.target"];

     

       312
       312
       +
                   serviceConfig = {

     

       313
       313
       +
                     User = "git";

     

       314
       314
       +
                     WorkingDirectory = "/home/git";

     

       315
       315
       +
                     Environment = [

     

       316
       316
       +
                       "KNOT_REPO_SCAN_PATH=${config.services.tangled-knotserver.repo.scanPath}"

     

       317
       317
       +
                       "APPVIEW_ENDPOINT=${config.services.tangled-knotserver.appviewEndpoint}"

     

       318
       318
       +
                       "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${config.services.tangled-knotserver.server.internalListenAddr}"

     

       319
       319
       +
                       "KNOT_SERVER_LISTEN_ADDR=${config.services.tangled-knotserver.server.listenAddr}"

     

       320
       320
       +
                       "KNOT_SERVER_SECRET=${config.services.tangled-knotserver.server.secret}"

     

       321
       321
       +
                       "KNOT_SERVER_HOSTNAME=${config.services.tangled-knotserver.server.hostname}"

     

       322
       322
       +
                     ];

     

       323
       323
       +
                     ExecStart = "${pkgs.knotserver}/bin/knotserver";

     

       324
       324
       +
                     Restart = "always";

     

       325
       325
       +
                   };

     

       326
       326
       +
                 };

     

       327
       327
       +
       

     

       328
       328
       +
                 networking.firewall.allowedTCPPorts = [22];

     

       329
       329
       +
               };

     

       330
       330
       +
             };

     

       331
       331
       +
       

     

       332
       332
       +
           nixosConfigurations.knotVM = nixpkgs.lib.nixosSystem {

     

       333
       333
       +
             system = "x86_64-linux";

     

       334
       334
       +
             modules = [

     

       335
       335
       +
               self.nixosModules.knotserver

     

       336
       336
       +
               ({

     

       337
       337
       +
                 config,

     

       338
       338
       +
                 pkgs,

     

       339
       339
       +
                 ...

     

       340
       340
       +
               }: {

     

       341
       341
       +
                 virtualisation.memorySize = 2048;

     

       342
       342
       +
                 virtualisation.cores = 2;

     

       343
       343
       +
                 services.getty.autologinUser = "root";

     

       344
       344
       +
                 environment.systemPackages = with pkgs; [curl vim git];

     

       345
       345
       +
                 services.tangled-knotserver = {

     

       346
       346
       +
                   enable = true;

     

       347
       347
       +
                   server = {

     

       348
       348
       +
                     secret = "21c9c8b2a405bcfb14694481e32bab09d842c2f4cc0437906b68015d32f15b97";

     

       349
       349
       +
                     hostname = "localhost:6000";

     

       350
       350
       +
                     listenAddr = "0.0.0.0:6000";

     

       351
       351
       +
                   };

     

       352
       352
       +
                 };

     

       353
       353
       +
               })

     

       354
       354
       +
             ];

     

       355
       355
       +
           };

     

       199
       356
        
         };

     

       200
       357
        
       }