add forgejo

git.nix

@@ -0,0 +1,49 @@
+{ config, pkgs, lib, ... }:
+let
+  domain = "git.kamoshi.org";
+  user   = "forgejo";
+  state  = "/var/lib/forgejo";
+in
+{
+  users = {
+    users.${user} = {
+      description     = "Forgejo Service";
+      home            = state;
+      group           = user;
+      useDefaultShell = true;
+      isSystemUser    = true;
+    };
+    groups.${user} = {};
+  };
+
+  services = {
+    forgejo = {
+      enable = true;
+      user   = user;
+      group  = user;
+      stateDir = state;
+      # https://forgejo.org/docs/latest/admin/config-cheat-sheet/
+      settings = {
+        server = {
+          HTTP_PORT = 3200;
+          HTTP_ADDR = "127.0.0.1";
+          DOMAIN = domain;
+          ROOT_URL = "https://${domain}/";
+          LANDING_PAGE = "explore";
+        };
+
+        service = {
+          DISABLE_REGISTRATION = lib.mkForce true;
+        };
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:3200/";
+      };
+    };
+  };
+}

hosts/kamoshi/configuration.nix

@@ -3,8 +3,9 @@
   imports =
     [
       /etc/nixos/hardware-configuration.nix
-      ./profiles/freshrss.nix
-      ./profiles/cgit.nix
+      # /profiles/freshrss.nix
+      # ./profiles/cgit.nix
+      # ./profiles/kotori.nix
     ];
 
   # Use the GRUB 2 boot loader.
@@ -33,11 +34,11 @@
 
   networking = {
     hostName = "kamoshi";
-    nat = {
-      enable = true;
-      externalInterface = "eth0";
-      internalInterfaces = [ "wg0" ];
-    };
+    # nat = {
+    #   enable = true;
+    #   externalInterface = "eth0";
+    #   internalInterfaces = [ "wg0" ];
+    # };
     firewall = {
       enable = true;
       allowedTCPPorts = [
@@ -45,46 +46,46 @@
         80           # nginx
         443          # nginx TLS
         2222         # ssh
-        22070 22067  # syncthing relay
-      ];
-      allowedUDPPorts = [
-        42069 # wireguard
-      ];
-      interfaces = {
-        "wg0" = {
-          allowedTCPPorts = [
-            8384 22000    # syncthing
-          ];
-          allowedUDPPorts = [
-            22000 21027   # syncthing
+        # 22070 22067  # syncthing relay
       ];
+      # allowedUDPPorts = [
+      #   42069 # wireguard
+      # ];
+      # interfaces = {
+      #   "wg0" = {
+      #     allowedTCPPorts = [
+      #       8384 22000    # syncthing
+      #     ];
+      #     allowedUDPPorts = [
+      #       22000 21027   # syncthing
+      #     ];
+      #   };
+      # };
     };
-      };
-    };
-    wireguard.interfaces = {
-      "wg0" = {
-        ips = [ "10.100.0.1/24" ];
-        listenPort = 42069;
-        postSetup = ''
-          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
-        '';
-        postShutdown = ''
-          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
-        '';
-        privateKeyFile = "/root/secrets/wireguard/kamoshi";
-
-        peers = [
-          {
-            publicKey = "26lQ3qCZrZ3hAqLIDfQNrmFQSQv983TeyXpJUY59QkI=";
-            allowedIPs = [ "10.100.0.2/32" ];
-          }
-          {
-            publicKey = "W3HCbtf/m/MUZSTTq/Dr9w0mfHjH5eYfOxWtq+eLFXw=";
-            allowedIPs = [ "10.100.0.3/32" ];
-          }
-        ];
-      };
-    };
+    # wireguard.interfaces = {
+    #   "wg0" = {
+    #     ips = [ "10.100.0.1/24" ];
+    #     listenPort = 42069;
+    #     postSetup = ''
+    #       ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+    #     '';
+    #     postShutdown = ''
+    #       ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+    #     '';
+    #     privateKeyFile = "/root/secrets/wireguard/kamoshi";
+    #
+    #     peers = [
+    #       {
+    #         publicKey = "26lQ3qCZrZ3hAqLIDfQNrmFQSQv983TeyXpJUY59QkI=";
+    #         allowedIPs = [ "10.100.0.2/32" ];
+    #       }
+    #       {
+    #         publicKey = "W3HCbtf/m/MUZSTTq/Dr9w0mfHjH5eYfOxWtq+eLFXw=";
+    #         allowedIPs = [ "10.100.0.3/32" ];
+    #       }
+    #     ];
+    #   };
+    # };
   };
 
   time.timeZone = "Europe/Warsaw";
@@ -101,9 +102,9 @@
     vim
     wget
     neovim
-    neofetch
-    nushell
-    wireguard-tools
+    # neofetch
+    # nushell
+    # wireguard-tools
   ];
 
   services = {
@@ -133,25 +134,25 @@
         };
       };
     };
-    syncthing = {
-      enable = true;
-      user = "kamov";
-      dataDir = "/home/kamov/sync";
-      configDir = "/home/kamov/sync/.config";
-      guiAddress = "0.0.0.0:8384";
-      extraOptions.gui = {
-        user = "admin";
-        password = "admin";
-      };
-      # public relay options
-      relay = {
-        enable = true;
-        providedBy = "kamoshi.org";
-        statusPort = 22070;
-        port = 22067;
-        globalRateBps = 25000;
-      };      
-    };
+    # syncthing = {
+    #   enable = true;
+    #   user = "kamov";
+    #   dataDir = "/home/kamov/sync";
+    #   configDir = "/home/kamov/sync/.config";
+    #   guiAddress = "0.0.0.0:8384";
+    #   extraOptions.gui = {
+    #     user = "admin";
+    #     password = "admin";
+    #   };
+    #   # public relay options
+    #   relay = {
+    #     enable = true;
+    #     providedBy = "kamoshi.org";
+    #     statusPort = 22070;
+    #     port = 22067;
+    #     globalRateBps = 25000;
+    #   };
+    # };
   };
 
   security.acme = {
@@ -159,20 +160,6 @@
     defaults.email = "maciej@kamoshi.org";
   };
 
-  virtualisation = {
-    docker.enable = true;
-    oci-containers = {
-      backend = "docker";
-      containers = {
-        kotori = {
-          image = "kamov/kotori";
-          environmentFiles = [ /root/secrets/kotori.env ];
-          autoStart = true;
-        };
-      };
-    };
-  };
-
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It's perfectly fine and recommended to leave

hosts/kamoshi/profiles/cgit.nix

@@ -8,6 +8,7 @@ in
     isSystemUser = true;
     description = "git user";
     home = home;
+    group = "users";
     shell = "${pkgs.git}/bin/git-shell";
     openssh.authorizedKeys.keyFiles = [
       /root/secrets/ssh/kamov.pub

kotori.nix

@@ -0,0 +1,19 @@
+{ config, pkgs, ... }:
+{
+  virtualisation = {
+    podman = {
+      enable = true;
+      dockerCompat = true;
+    };
+    oci-containers = {
+      backend = "podman";
+      containers = {
+        kotori = {
+          image = "kamov/kotori:latest";
+          environmentFiles = [ /root/.secrets/kotori.env ];
+          autoStart = true;
+        };
+      };
+    };
+  };
+}

nix.nix

@@ -0,0 +1,31 @@
+{ config, pkgs, ... }:
+{
+  system = {
+    autoUpgrade = {
+      enable = true;
+      allowReboot = true;
+    };
+  };
+
+  nix = {
+    optimise.automatic = true;
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  networking = {
+    firewall = {
+      enable = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    git
+    vim
+    wget
+    neovim
+  ];
+}

ssh.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, ... }:
+{
+  users.users.kamov = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "www" ];
+    openssh.authorizedKeys.keyFiles = [ /root/.ssh/kamov.pub ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 22 2222 ];
+
+  services = {
+    endlessh = {
+      enable = true;
+      port = 22;
+    };
+    openssh = {
+      enable = true;
+      ports = [ 2222 ];
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+  };
+}

web.nix

@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+{
+  # Group for people who can edit the website
+  users.groups.www = {};
+
+  # Directory for web content
+  systemd.tmpfiles.rules = [
+    "d /var/www/kamoshi.org 775 root www"
+  ];
+
+  # Automatically renew certs
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "maciej@kamoshi.org";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services = {
+    nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+
+      virtualHosts."kamoshi.org" = {
+        root = "/var/www/kamoshi.org";
+        forceSSL = true;
+        enableACME = true;
+
+        listen = [
+          { addr = "[::]";    port = 80; ssl = false; }
+          { addr = "0.0.0.0"; port = 80; ssl = false; }
+          { addr = "[::]";    port = 443; ssl = true; }
+          { addr = "0.0.0.0"; port = 443; ssl = true; }
+        ];
+      };
+    };
+  };
+}