newedge/infra
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: newedge:main
Branches Tags
newedge:main newedge:mob/fax-bounce newedge:buna-machine newedge:fax-bounce newedge:mob/phonebook newedge:phonebook newedge:mob/inventree-test newedge:inventree-test newedge:whitehouse-router newedge:mob/vega-backup newedge:mob/router-device newedge:router-device newedge:vega-backup newedge:mob/noreply-mailer newedge:noreply-mailer newedge:mob/vega-ups newedge:b4l-vpn newedge:vega-ups newedge:mob/gitea newedge:gitea
..
compare: newedge:mob/inventree-test
Branches Tags
newedge:mob/fax-bounce newedge:buna-machine newedge:fax-bounce newedge:main newedge:mob/phonebook newedge:phonebook newedge:mob/inventree-test newedge:inventree-test newedge:whitehouse-router newedge:mob/vega-backup newedge:mob/router-device newedge:router-device newedge:vega-backup newedge:mob/noreply-mailer newedge:noreply-mailer newedge:mob/vega-ups newedge:b4l-vpn newedge:vega-ups newedge:mob/gitea newedge:gitea

1 Commits
main ... mob/invent

Author SHA1 Message Date
kurogeek
cf27093134 mob next [ci-skip] [ci skip] [skip ci] 
lastFile:vars/per-machine/rigel/inventree/secret-key/secret
 2025-11-10 17:08:06 +07:00
402 changed files with 1723 additions and 29856 deletions
Expand all files Collapse all files

48
flake.lock generated
View File

@@ -20,11 +20,11 @@
]
},
"locked": {
"lastModified": 1764799743,
"narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
"lastModified": 1761768376,
"narHash": "sha256-AZL8SPJ520NRnLft9Xz4trTECBB510YPRXJnE1OUeXw=",
"ref": "refs/heads/main",
"rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
"revCount": 11417,
"rev": "bbc9486f0e6306f68e11f8aefa243da9f1c8c56f",
"revCount": 10924,
"type": "git",
"url": "https://git.clan.lol/clan/clan-core"
},
@@ -49,11 +49,11 @@
]
},
"locked": {
"lastModified": 1762942435,
"narHash": "sha256-zIWGs5FIytTtJN+dhDb8Yx+q4TQI/yczuL539yVcyPE=",
"rev": "0ee328404b12c65e8106bde9e9fab8abf4ecada4",
"lastModified": 1760612273,
"narHash": "sha256-pP/bSqUHubxAOTI7IHD5ZBQ2Qm11Nb4pXXTPv334UEM=",
"rev": "0099739c78be750b215cbdefafc9ba1533609393",
"type": "tarball",
"url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0ee328404b12c65e8106bde9e9fab8abf4ecada4.tar.gz"
"url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0099739c78be750b215cbdefafc9ba1533609393.tar.gz"
},
"original": {
"type": "tarball",
@@ -88,11 +88,11 @@
]
},
"locked": {
"lastModified": 1764627417,
"narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
"lastModified": 1760701190,
"narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
"owner": "nix-community",
"repo": "disko",
"rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
"rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
"type": "github"
},
"original": {
@@ -162,11 +162,11 @@
]
},
"locked": {
"lastModified": 1764161084,
"narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
"lastModified": 1761339987,
"narHash": "sha256-IUaawVwItZKi64IA6kF6wQCLCzpXbk2R46dHn8sHkig=",
"owner": "nix-darwin",
"repo": "nix-darwin",
"rev": "e95de00a471d07435e0527ff4db092c84998698e",
"rev": "7cd9aac79ee2924a85c211d21fafd394b06a38de",
"type": "github"
},
"original": {
@@ -177,11 +177,11 @@
},
"nix-select": {
"locked": {
"lastModified": 1763303120,
"narHash": "sha256-yxcNOha7Cfv2nhVpz9ZXSNKk0R7wt4AiBklJ8D24rVg=",
"rev": "3d1e3860bef36857a01a2ddecba7cdb0a14c35a9",
"lastModified": 1755887746,
"narHash": "sha256-lzWbpHKX0WAn/jJDoCijIDss3rqYIPawe46GDaE6U3g=",
"rev": "92c2574c5e113281591be01e89bb9ddb31d19156",
"type": "tarball",
"url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/3d1e3860bef36857a01a2ddecba7cdb0a14c35a9.tar.gz"
"url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/92c2574c5e113281591be01e89bb9ddb31d19156.tar.gz"
},
"original": {
"type": "tarball",
@@ -190,11 +190,11 @@
},
"nixos-facter-modules": {
"locked": {
"lastModified": 1764252389,
"narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
"lastModified": 1761137276,
"narHash": "sha256-4lDjGnWRBLwqKQ4UWSUq6Mvxu9r8DSqCCydodW/Jsi8=",
"owner": "nix-community",
"repo": "nixos-facter-modules",
"rev": "5ea68886d95218646d11d3551a476d458df00778",
"rev": "70bcd64225d167c7af9b475c4df7b5abba5c7de8",
"type": "github"
},
"original": {
@@ -238,11 +238,11 @@
]
},
"locked": {
"lastModified": 1764483358,
"narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
"lastModified": 1760998189,
"narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "5aca6ff67264321d47856a2ed183729271107c9c",
"rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
"type": "github"
},
"original": {

17
flake.nix
View File

@@ -41,27 +41,14 @@
./fmt.nix
./shell.nix
./overlays
./modules/nixos
./machines
./routers
./inventories
./overlays
./tests
./modules/clan/flake-module.nix
./modules/nixos/flake-module.nix
];
perSystem =
{ pkgs, system, ... }:
{
_module.args.pkgs = import inputs.nixpkgs {
inherit system;
overlays = [
inputs.self.overlays.packagesOverlay
];
config = { };
};
packages.think = pkgs.think-gtcm;
packages.think-be = pkgs.think-backend-gtcm;
};
}
);
}

80
inventories/default.nix
View File

@@ -3,24 +3,10 @@
inventory = {
tags = {
glom = [
"vega"
"ramus"
];
glom = [ "vega" ];
b4l = [ "rigel" ];
w = [ "sirius" ];
b4l = [
"rigel"
"neptune"
];
phonebox = [
"neptune"
"rigel"
"almach"
"alpheratz"
"mirach"
"adhil"
"buna"
];
fax-bridge = [ ];
};
instances = {
@@ -46,14 +32,6 @@
};
};
tor = {
module = {
name = "tor";
input = "clan-core";
};
roles.server.tags."nixos" = { };
};
w-network = {
module = {
name = "zerotier";
@@ -86,28 +64,18 @@
roles.peer.tags.b4l = { };
};
yggdrasil-phone-network = {
yggdrasil = {
module = {
name = "yggdrasil";
input = "clan-core";
};
roles.default.tags."phonebox" = { };
roles.default.settings.extraPeers = [
"tls://ygg.jjolly.dev:3443"
"tls://[2602:fc24:18:7a42::1]:993"
"tcp://leo.node.3dt.net:9002"
"tcp://ygg-kcmo.incognet.io:8883"
];
};
phonebox = {
module = {
name = "phonebox";
input = "self";
};
roles.default.tags."phonebox" = { };
roles.default.machines."adhil".settings = {
ata-ethernet-iface = "end0";
roles.default.tags."fax-bridge" = { };
};
asterisk = {
module = {
name = "asterisk";
input = "self";
};
};
@@ -174,32 +142,6 @@
};
roles.default.machines.b4l = { };
};
pulse-stream = {
module = {
name = "pulse-stream";
input = "self";
};
roles.default.machines.neptune = {
settings.client-ip-ranges = [
"10.0.0.0/24"
];
};
};
jukebox = {
module = {
name = "jukebox";
input = "self";
};
roles.default.machines.neptune = {
settings = {
binds = [ "wlp1s0" ];
disks.m3 = {
uuid = "105D-319E";
mountOptions = [ "utf8" ];
};
};
};
};
};
};
};

26
inventory.json
View File

@@ -1,25 +1 @@
{
"machines": {
"ramus": {
"installedAt": 1764139649
},
"alpheratz": {
"installedAt": 1764741499
},
"mirach": {
"installedAt": 1764744666
},
"almach": {
"installedAt": 1764745787
},
"neptune": {
"installedAt": 1762147067
},
"adhil": {
"installedAt": 1765277591
},
"buna": {
"installedAt": 1765343708
}
}
}
{}

13
machines/adhil/configuration.nix
View File

@@ -1,13 +0,0 @@
{ ... }:
{
nixpkgs.hostPlatform = {
system = "aarch64-linux";
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
# clan.core.networking.targetHost = "root@";
clan.meta.name = "adhil";
clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
}

56
machines/adhil/disko.nix
View File

@@ -1,56 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/mmc-SD64G_0xfb330ff6";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
end = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "umask=0077" ];
};
};
root = {
name = "root";
end = "-0";
content = {
type = "filesystem";
format = "f2fs";
mountpoint = "/";
extraArgs = [
"-O"
"extra_attr,inode_checksum,sb_checksum,compression"
];
mountOptions = [
"compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
];
};
};
};
};
};
};
};
}

1147
machines/adhil/facter.json
View File

File diff suppressed because it is too large Load Diff

13
machines/almach/configuration.nix
View File

@@ -1,13 +0,0 @@
{ config, ... }:
{
nixpkgs.hostPlatform = {
system = "x86_64-linux";
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
# clan.core.networking.targetHost = "root@";
clan.meta.name = "almach";
clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
}

90
machines/almach/disko.nix
View File

@@ -1,90 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f17";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
size = "1G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "nofail" ];
};
};
system = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
swap = {
size = "4G";
content = {
type = "swap";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
rootFsOptions = {
mountpoint = "none";
compression = "lz4";
acltype = "posixacl";
xattr = "sa";
"com.sun:auto-snapshot" = "true";
};
options.ashift = "12";
datasets = {
"root" = {
type = "zfs_fs";
options.mountpoint = "none";
};
"root/nixos" = {
type = "zfs_fs";
options.mountpoint = "/";
mountpoint = "/";
};
"root/home" = {
type = "zfs_fs";
options.mountpoint = "/home";
mountpoint = "/home";
};
"root/tmp" = {
type = "zfs_fs";
mountpoint = "/tmp";
options = {
mountpoint = "/tmp";
sync = "disabled";
};
};
};
};
};
};
}

3852
machines/almach/facter.json
View File

File diff suppressed because it is too large Load Diff

13
machines/alpheratz/configuration.nix
View File

@@ -1,13 +0,0 @@
{ config, ... }:
{
nixpkgs.hostPlatform = {
system = "x86_64-linux";
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
# clan.core.networking.targetHost = "root@";
clan.meta.name = "alpheratz";
clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
}

90
machines/alpheratz/disko.nix
View File

@@ -1,90 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/mmc-CUTB42_0xaedcfa8b";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
size = "1G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "nofail" ];
};
};
system = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
swap = {
size = "4G";
content = {
type = "swap";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
rootFsOptions = {
mountpoint = "none";
compression = "lz4";
acltype = "posixacl";
xattr = "sa";
"com.sun:auto-snapshot" = "true";
};
options.ashift = "12";
datasets = {
"root" = {
type = "zfs_fs";
options.mountpoint = "none";
};
"root/nixos" = {
type = "zfs_fs";
options.mountpoint = "/";
mountpoint = "/";
};
"root/home" = {
type = "zfs_fs";
options.mountpoint = "/home";
mountpoint = "/home";
};
"root/tmp" = {
type = "zfs_fs";
mountpoint = "/tmp";
options = {
mountpoint = "/tmp";
sync = "disabled";
};
};
};
};
};
};
}

3852
machines/alpheratz/facter.json
View File

File diff suppressed because it is too large Load Diff

14
machines/b4l/configuration.nix
View File

@@ -19,18 +19,4 @@
services.nginx.virtualHosts."${config.networking.fqdn}" = {
enableACME = true;
};
clan.core.vars.generators.acme = {
share = true;
files.email.secret = false;
prompts.email = {
type = "line";
description = "Email for ACME registeration";
};
script = ''
cat $prompts/email > $out/email
'';
};
}

13
machines/buna/configuration.nix
View File

@@ -1,13 +0,0 @@
{ config, ... }:
{
nixpkgs.hostPlatform = {
system = "x86_64-linux";
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
# clan.core.networking.targetHost = "root@";
clan.meta.name = "buna";
clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
}

56
machines/buna/disko.nix
View File

@@ -1,56 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
end = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "umask=0077" ];
};
};
root = {
name = "root";
end = "-0";
content = {
type = "filesystem";
format = "f2fs";
mountpoint = "/";
extraArgs = [
"-O"
"extra_attr,inode_checksum,sb_checksum,compression"
];
mountOptions = [
"compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
];
};
};
};
};
};
};
};
}

4184
machines/buna/facter.json
View File

File diff suppressed because it is too large Load Diff

6
machines/default.nix
View File

@@ -1,4 +1,8 @@
{ inputs, self, ... }:
{
inputs,
self,
...
}:
{
imports = [
inputs.clan-core.flakeModules.default

13
machines/mirach/configuration.nix
View File

@@ -1,13 +0,0 @@
{ config, ... }:
{
nixpkgs.hostPlatform = {
system = "x86_64-linux";
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
# clan.core.networking.targetHost = "root@";
clan.meta.name = "mirach";
clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
}

90
machines/mirach/disko.nix
View File

@@ -1,90 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f33";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
size = "1G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "nofail" ];
};
};
system = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
swap = {
size = "4G";
content = {
type = "swap";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
rootFsOptions = {
mountpoint = "none";
compression = "lz4";
acltype = "posixacl";
xattr = "sa";
"com.sun:auto-snapshot" = "true";
};
options.ashift = "12";
datasets = {
"root" = {
type = "zfs_fs";
options.mountpoint = "none";
};
"root/nixos" = {
type = "zfs_fs";
options.mountpoint = "/";
mountpoint = "/";
};
"root/home" = {
type = "zfs_fs";
options.mountpoint = "/home";
mountpoint = "/home";
};
"root/tmp" = {
type = "zfs_fs";
mountpoint = "/tmp";
options = {
mountpoint = "/tmp";
sync = "disabled";
};
};
};
};
};
};
}

3852
machines/mirach/facter.json
View File

File diff suppressed because it is too large Load Diff

62
machines/neptune/configuration.nix
View File

@@ -1,62 +0,0 @@
{
inputs,
config,
lib,
...
}:
{
nixpkgs.hostPlatform = {
system = "x86_64-linux";
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
clan.core.vars.generators.wireless-credentials = {
files = {
essid.secret = false;
psk.secret = true;
};
prompts = {
essid.persist = true;
psk.persist = true;
};
script = ''
cat "$prompts"/essid > $out/essid
prompt_psk=$(cat "$prompts"/psk)
echo "psk=$prompt_psk" > $out/psk
'';
};
networking.wireless =
let
credentials = config.clan.core.vars.generators.wireless-credentials.files;
in
{
enable = true;
secretsFile = credentials.psk.path;
networks.${credentials.essid.value}.pskRaw = "ext:psk";
};
networking.interfaces.wlp1s0 = {
useDHCP = false;
ipv4.addresses = [
{
address = "10.0.0.9";
prefixLength = 24;
}
];
};
services.yggdrasil.settings.Peers = lib.mkForce [
"tcp://newt.barry.town:1337"
"tls://yg-hkg.magicum.net:32333"
"tls://astrra.space:55535"
];
clan.meta.name = "neptune";
clan.meta.description = "Radxa SBC board for testing. (With vi)";
}

90
machines/neptune/disko.nix
View File

@@ -1,90 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/mmc-CUTB42_0x9d59499c";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
size = "1G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "nofail" ];
};
};
system = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
swap = {
size = "16G";
content = {
type = "swap";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
rootFsOptions = {
mountpoint = "none";
compression = "lz4";
acltype = "posixacl";
xattr = "sa";
"com.sun:auto-snapshot" = "true";
};
options.ashift = "12";
datasets = {
"root" = {
type = "zfs_fs";
options.mountpoint = "none";
};
"root/nixos" = {
type = "zfs_fs";
options.mountpoint = "/";
mountpoint = "/";
};
"root/home" = {
type = "zfs_fs";
options.mountpoint = "/home";
mountpoint = "/home";
};
"root/tmp" = {
type = "zfs_fs";
mountpoint = "/tmp";
options = {
mountpoint = "/tmp";
sync = "disabled";
};
};
};
};
};
};
}

4160
machines/neptune/facter.json
View File

File diff suppressed because it is too large Load Diff

35
machines/ramus/configuration.nix
View File

@@ -1,35 +0,0 @@
{ self, config, ... }:
{
system.stateVersion = "25.11";
nixpkgs.hostPlatform = {
system = "x86_64-linux";
};
clan.meta.name = "ramus";
clan.meta.description = ''
A Hetzner VPS machine own by Alex.
'';
clan.core.sops.defaultGroups = [ "admins" ];
clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
clan.core.vars.generators.acme = {
share = true;
files.email.secret = false;
prompts.email = {
type = "line";
description = "Email for ACME registeration";
};
script = ''
cat $prompts/email > $out/email
'';
};
users.users.nginx.extraGroups = [ "acme" ];
security.acme.acceptTerms = true;
imports = [ ./think-greater-chiangmai.nix ];
}

84
machines/ramus/disko.nix
View File

@@ -1,84 +0,0 @@
{ ... }:
let
hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_107266387";
in
{
boot.loader = {
systemd-boot = {
enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
disko.devices = {
disk = {
"os-${hashDisk os}" = {
type = "disk";
device = os;
content = {
type = "gpt";
partitions = {
ESP = {
size = "1G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "nofail" ];
};
};
system = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
rootFsOptions = {
mountpoint = "none";
compression = "lz4";
acltype = "posixacl";
xattr = "sa";
"com.sun:auto-snapshot" = "true";
};
options.ashift = "12";
datasets = {
"root" = {
type = "zfs_fs";
options.mountpoint = "none";
};
"root/nixos" = {
type = "zfs_fs";
options.mountpoint = "/";
mountpoint = "/";
};
"root/home" = {
type = "zfs_fs";
options.mountpoint = "/home";
mountpoint = "/home";
};
"root/tmp" = {
type = "zfs_fs";
mountpoint = "/tmp";
options = {
mountpoint = "/tmp";
sync = "disabled";
};
};
};
};
};
};
}

2799
machines/ramus/facter.json
View File

File diff suppressed because it is too large Load Diff

136
machines/ramus/think-greater-chiangmai.nix
View File

@@ -1,136 +0,0 @@
{ self, config, ... }:
let
commonSettings = {
APP_NAME = "Laravel";
APP_ENV = "local";
APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
APP_DEBUG = "false";
APP_URL = "http://localhost";
DB_CONNECTION = "mysql";
DB_HOST = "localhost";
DB_PORT = 3306;
DB_DATABASE = "thinkgtcm";
DB_USERNAME = "gtcm";
R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
R2_SECRET_ACCESS_KEY._secret =
config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
LOG_CHANNEL = "stack";
LOG_LEVEL = "debug";
FILESYSTEM_DISK = "local";
BROADCAST_DRIVER = "log";
CACHE_DRIVER = "file";
QUEUE_CONNECTION = "sync";
SESSION_DRIVER = "file";
SESSION_LIFETIME = 120;
MEMCACHED_HOST = "127.0.0.1";
REDIS_HOST = "127.0.0.1";
REDIS_PORT = 6379;
UPLOAD_MAX_FILESIZE = "5000M";
POST_MAX_SIZE = "5000M";
TEST_LOCAL = true;
};
baseDomain = "greaterchiangmai.com";
domain = "think.${baseDomain}";
domainBackend = "think-backend.${baseDomain}";
in
{
imports = [
self.nixosModules.think-gtcm
self.nixosModules.think-backend-gtcm
];
nixpkgs.overlays = [ self.overlays.packagesOverlay ];
clan.core.vars.generators.greaterchiangmai = {
files = {
app_key = {
secret = true;
owner = config.services.think-greaterchiangmai.user;
group = config.services.think-greaterchiangmai.group;
};
};
prompts = {
app_key.persist = true;
};
script = ''
cat $prompts/app_key > $out/app_key
'';
};
clan.core.vars.generators.greaterchiangmai-s3 = {
files = {
access_key_id.secret = false;
secret_access_key = {
secret = true;
owner = config.services.think-greaterchiangmai.user;
group = config.services.think-greaterchiangmai.group;
};
endpoint.secret = false;
region.secret = false;
bucket.secret = false;
};
prompts = {
access_key_id.persist = true;
secret_access_key.persist = true;
endpoint.persist = true;
region.persist = true;
bucket.persist = true;
};
script = ''
cat $prompts/access_key_id > $out/access_key_id
cat $prompts/secret_access_key > $out/secret_access_key
cat $prompts/endpoint > $out/endpoint
cat $prompts/region > $out/region
cat $prompts/bucket > $out/bucket
'';
};
services.think-greaterchiangmai = {
enable = true;
domain = domain;
settings = commonSettings;
};
services.think-backend-greaterchiangmai = {
enable = true;
domain = domainBackend;
settings = commonSettings;
};
security.acme.certs = {
"${domain}" = {
email = config.clan.core.vars.generators.acme.files.email.value;
webroot = "/var/lib/acme/acme-challenge/${domain}";
};
"${domainBackend}" = {
email = config.clan.core.vars.generators.acme.files.email.value;
webroot = "/var/lib/acme/acme-challenge/${domainBackend}";
};
};
services.nginx.virtualHosts.${domain} = {
forceSSL = true;
useACMEHost = domain;
acmeRoot = config.security.acme.certs.${domain}.webroot;
};
services.nginx.virtualHosts.${domainBackend} = {
forceSSL = true;
useACMEHost = domainBackend;
acmeRoot = config.security.acme.certs.${domainBackend}.webroot;
};
}

53
machines/rigel/configuration.nix
View File

@@ -1,4 +1,9 @@
{ config, ... }:
{
inputs,
config,
pkgs,
...
}:
{
imports = [
(import ../../lib/auto-accept-zerotier-members.nix {
@@ -8,8 +13,54 @@
"2bd36db8cc" # kurogeek-thinkpad
];
})
inputs.self.nixosModules.inventree
];
nixpkgs.overlays = [
inputs.self.overlays.default
];
clan.core.vars.generators.inventree = {
files = {
secret-key = {
owner = "inventree";
group = "inventree";
secret = true;
};
oidc-key = {
owner = "inventree";
group = "inventree";
secret = true;
};
admin-password = {
owner = "inventree";
group = "inventree";
secret = true;
};
};
runtimeInputs = [
pkgs.pwgen
pkgs.xkcdpass
];
script = ''
pwgen -s 32 1 > $out/secret-key
pwgen -s 32 1 > $out/oidc-key
xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/admin-password
'';
};
networking.firewall.allowedTCPPorts = [ 80 ];
services.inventree = {
enable = true;
hostName = "rigel.local";
config.site_url = "http://${config.services.inventree.hostName}";
secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
config.adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
};
system.stateVersion = "25.11";
clan.core.sops.defaultGroups = [ "admins" ];
clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

69
modules/clan/asterisk/default.nix Normal file
View File

@@ -0,0 +1,69 @@
{ ... }:
{
_class = "clan.service";
manifest.name = "asterisk";
manifest.description = "Asterisk PBX server";
manifest.categories = [ "System" ];
roles.default = {
perInstance.nixosModule =
{
lib,
...
}:
{
services.asterisk = {
enable = lib.mkDefault true;
confFiles = {
# Dial plan config
"extensions.conf" = ''
exten => 1001,1,Dial(PJSIP/user1,20)
exten => 1002,1,Dial(PJSIP/user2,20)
exten => 100,1,Answer()
same => n,Wait(1)
same => n,Playback(hello-world)
same => n,Hangup()
'';
"pjsip.conf" = ''
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0,[::]
[endpoint_internal](!)
type=endpoint
context=from-internal
disallow=all
allow=ulaw
[auth_userpass](!)
type=auth
auth_type=userpass
[aor_dynamic](!)
type=aor
max_contacts=1
[user1](endpoint_internal)
auth=user1
aors=user1
[user1](auth_userpass)
password=user1
username=user1
[user1](aor_dynamic)
[user2](endpoint_internal)
auth=user2
aors=user2
[user2](auth_userpass)
password=user2
username=user2
[user2](aor_dynamic)
'';
};
};
};
};
}

18
modules/clan/asterisk/flake-module.nix Normal file
View File

@@ -0,0 +1,18 @@
{ lib, ... }:
let
module = lib.modules.importApply ./default.nix { };
in
{
clan.modules = {
asterisk = module;
};
perSystem =
{ ... }:
{
clan.nixosTests.asterisk = {
imports = [ ./tests/vm/default.nix ];
clan.modules."@clan/asterisk" = module;
};
};
}

39
modules/clan/asterisk/tests/vm/default.nix Normal file
View File

@@ -0,0 +1,39 @@
{
pkgs,
...
}:
{
name = "service-asterisk";
clan = {
directory = ./.;
inventory = {
machines.server = { };
instances = {
asterisk-test = {
module.name = "@clan/asterisk";
module.input = "self";
roles.default.machines."server".settings = { };
};
};
};
};
nodes = {
server = {
services.asterisk = {
};
};
};
testScript = ''
start_all()
server.wait_for_unit("asterisk")
# Check that garage is running
server.succeed("systemctl status asterisk")
'';
}

133
modules/clan/jukebox/default.nix
View File

@@ -1,133 +0,0 @@
{ ... }:
{
_class = "clan.service";
manifest.name = "jukebox";
manifest.description = "mpd server, library on removable disks";
manifest.categories = [ "System" ];
roles.default = {
interface =
{ lib, ... }:
{
options = {
baseDir = lib.mkOption {
type = lib.types.str;
default = "/mnt/jukebox";
};
binds = lib.mkOption {
type = with lib.types; listOf str;
default = [ ];
};
disks = lib.mkOption {
type =
with lib.types;
attrsOf (
submodule (
{ name, ... }:
{
options = {
name = lib.mkOption {
type = str;
default = name;
};
uuid = lib.mkOption {
type = str;
};
mountOptions = lib.mkOption {
type = listOf str;
default = [ ];
};
};
}
)
);
default = { };
description = "disks comprising library";
};
};
};
perInstance =
{
settings,
...
}:
{
nixosModule =
{
config,
lib,
pkgs,
...
}:
{
services.pulseaudio.enable = true;
# workaround cookie permissions
services.pulseaudio.tcp.enable = true;
services.pulseaudio.tcp.anonymousClients = {
allowedIpRanges = [ "127.0.0.1" ];
allowAll = true;
};
systemd.tmpfiles.rules = [
"d ${settings.baseDir} 0755 root root"
];
fileSystems =
let
disk2fs =
{
name,
uuid,
mountOptions,
...
}:
lib.nameValuePair "${settings.baseDir}/${name}" {
device = "/dev/disk/by-uuid/${uuid}";
fsType = "auto";
options = [
"noauto"
"nofail"
]
++ mountOptions;
};
in
lib.listToAttrs (lib.mapAttrsToList (_: disk2fs) settings.disks);
services.udev.extraRules =
let
translate-prefix = path: (lib.removePrefix "-" (lib.replaceStrings [ "/" ] [ "-" ] path));
mount-name = name: "${translate-prefix settings.baseDir}-${name}.mount";
disk2rule =
{ name, uuid, ... }:
lib.concatStringsSep ", " [
''ACTION=="add"''
''SUBSYSTEM=="block"''
''ENV{DEVLINKS}=="*/dev/disk/by-uuid/${uuid}*"''
''ENV{SYSTEMD_WANTS}="${mount-name name}"''
];
in
lib.concatMapStringsSep "\n" disk2rule (lib.attrValues settings.disks);
services.mpd = {
enable = true;
musicDirectory = settings.baseDir;
network.listenAddress = "any";
extraConfig = ''
audio_output {
type "pulse"
name "jukebox"
server "localhost"
}
'';
};
networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
allowedTCPPorts = [ config.services.mpd.network.port ];
});
environment.systemPackages = [ pkgs.mpc ];
};
};
};
}

9
modules/clan/jukebox/flake-module.nix
View File

@@ -1,9 +0,0 @@
{ lib, ... }:
let
module = lib.modules.importApply ./default.nix { };
in
{
clan.modules = {
jukebox = module;
};
}

353
modules/clan/phonebox/default.nix
View File

@@ -1,353 +0,0 @@
{ clanLib, ... }:
{
_class = "clan.service";
manifest.name = "phonebox";
manifest.description = "";
manifest.categories = [ "System" ];
roles.default = {
interface =
{ lib, ... }:
{
options.ata-ethernet-iface = lib.mkOption {
type = lib.types.str;
description = "An Ethernet interface that connect to ATA box.";
default = "enp2s0";
};
};
perInstance =
{
roles,
settings,
...
}:
{
nixosModule =
{
lib,
config,
pkgs,
...
}:
let
user = "asterisk";
rtpPortFrom = 10000;
rtpPortTo = 20000;
ata-interface = settings.ata-ethernet-iface;
genServerSIPEndpoint =
{ hostname, address }:
''
[${hostname}](internal_endpoint)
aors=${hostname}
[${hostname}](ip_auth)
endpoint=${hostname}
match=[${address}]
[${hostname}](dynamiic_aor)
contact=sip:[${address}]
'';
genLocalSIPEndpoint =
{ localNumber }:
''
[${localNumber}](internal_endpoint)
aors=${localNumber}
auth=${localNumber}
[${localNumber}](userpass_auth)
username=${localNumber}
password=${localNumber}
[${localNumber}](dynamiic_aor)
max_contacts=1
'';
genLocalExtenConf =
{ localNumber }:
''
exten => ${localNumber},1,Dial(PJSIP/${localNumber},20)
'';
genExtentConf =
{
prefixNumber,
hostname,
localNumber,
}:
let
replaceWithX =
ln: builtins.concatStringsSep "" (builtins.genList (_: "X") (builtins.stringLength ln));
in
''
exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:${builtins.toString (builtins.stringLength prefixNumber)}}@${hostname},30)
'';
getYggdrasilIP =
machineName:
if config.clan.core.vars.generators.yggdrasil.files.address ? value then
clanLib.getPublicValue {
flake = config.clan.core.settings.directory;
machine = machineName;
generator = "yggdrasil";
file = "address";
default = null;
}
else
throw "clanService/yggdrasil is required";
in
{
clan.core.vars.generators.phonebox = {
files = {
server-prefix-number.secret = false;
ata-local-number.secret = false;
};
prompts = {
server-prefix-number = {
type = "line";
description = "Server prefix number: indicate server to connect to [10XX]";
};
ata-local-number = {
type = "line";
description = "Local suffix number: indicate local number on the server [XX00]";
};
};
script = ''
cat $prompts/server-prefix-number > $out/server-prefix-number
cat $prompts/ata-local-number > $out/ata-local-number
'';
};
networking.interfaces = {
${ata-interface} = {
useDHCP = false;
ipv4.addresses = [
{
address = "192.168.254.1";
prefixLength = 24;
}
];
};
};
services.dnsmasq = {
enable = true;
settings = {
bind-dynamic = true;
listen-address = "192.168.254.1";
# enable-ra = true;
domain-needed = true;
domain = "localhost";
dhcp-range = [
"192.168.254.100,192.168.254.100,255.255.255.0,3m"
];
dhcp-leasefile = "/dev/null";
dhcp-option = [
"3,192.168.254.1"
];
interface = [ ata-interface ];
};
};
services.nginx = {
enable = true;
virtualHosts = {
"_" = {
locations."/" = {
proxyPass = "http://192.168.254.100";
extraConfig = ''
client_max_body_size 100M;
'';
};
};
};
};
networking.firewall.allowedUDPPortRanges = [
{
from = rtpPortFrom;
to = rtpPortTo;
}
];
networking.firewall.allowedUDPPorts = [
53
67
5060
];
networking.firewall.allowedTCPPorts = [
53
];
networking.firewall.interfaces =
let
matchAll = if !config.networking.nftables.enable then "zt+" else "zt*";
in
{
"${matchAll}".allowedTCPPorts = [ 80 ];
};
services.asterisk = {
enable = lib.mkDefault true;
confFiles =
let
machines = lib.attrNames roles.default.machines;
nodes = builtins.foldl' (
nodes: name:
nodes
++ [
{
hostname = name;
address = getYggdrasilIP name;
prefixNumber = clanLib.getPublicValue {
flake = config.clan.core.settings.directory;
machine = name;
generator = "phonebox";
file = "server-prefix-number";
default = null;
};
localNumber = clanLib.getPublicValue {
flake = config.clan.core.settings.directory;
machine = name;
generator = "phonebox";
file = "ata-local-number";
default = null;
};
}
]
) [ ] machines;
in
{
"logger.conf" = ''
[general]
dateformat = %F %T.%3q ; ISO 8601 date format with milliseconds
use_callids = yes
appendhostname = no
queue_log = yes
queue_log_to_file = no
queue_log_name = queue_log
queue_log_realtime_use_gmt = no
rotatestrategy = rotate
exec_after_rotate=gzip -9 $\{filename\}.2
[logfiles]
console => notice,warning,error
security => security
messages => notice,warning,error
full => notice,warning,error,verbose,dtmf,fax
syslog.local0 => notice,warning,error
'';
# Dial plan config
"extensions.conf" =
let
serverConf = builtins.foldl' (
config: node:
config
+ (genExtentConf {
inherit (node) prefixNumber hostname localNumber;
})
) "" nodes;
in
''
[from-internal]
exten => 999,1,Answer()
same => n,Playback(hello-world)
same => n,Hangup()
''
+ (genLocalExtenConf {
localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
})
+ serverConf;
"rtp.conf" = ''
[general]
rtpstart=${builtins.toString rtpPortFrom}
rtpend=${builtins.toString rtpPortTo}
'';
"pjsip.conf" =
let
serverConf = builtins.foldl' (
conf: node:
conf
+ (genServerSIPEndpoint {
hostname = node.hostname;
address = node.address;
})
) "" nodes;
in
''
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0
[transport-udp6]
type=transport
protocol=udp
bind=::
[base_endpoint](!)
type=endpoint
disallow=all
allow=ulaw,alaw,g722,gsm
direct_media=no
[internal_endpoint](!,base_endpoint)
context=from-internal
[userpass_auth](!)
type=auth
auth_type=userpass
[ip_auth](!)
type=identify
endpoint=external
[dynamiic_aor](!)
type=aor
''
+ (genLocalSIPEndpoint {
localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
})
+ serverConf;
};
};
systemd.services.asterisk-watcher = {
enable = true;
description = "Asterisk Configuration files watcher";
requires = [ "asterisk.service" ];
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = with pkgs; [
inotify-tools
asterisk
];
script = ''
inotifywait -m -e move /etc/asterisk |
while read path action file; do
case "$file" in
pjsip.conf)
echo "restarting pjsip"
asterisk -rx "pjsip reload"
;;
esac
case "$file" in
extensions.conf)
echo "restarting core"
asterisk -rx "core restart now"
;;
esac
done
'';
};
};
};
};
}

23
modules/clan/phonebox/flake-module.nix
View File

@@ -1,23 +0,0 @@
{
inputs,
self,
...
}:
let
module = ./default.nix;
in
{
clan.modules = {
phonebox = module;
};
perSystem =
{ ... }:
{
clan.nixosTests.service-phonebox = {
imports = [ ./tests/vm/default.nix ];
_module.args = { inherit self inputs; };
clan.modules."@clan/phonebox" = module;
};
};
}

59
modules/clan/phonebox/tests/vm/default.nix
View File

@@ -1,59 +0,0 @@
{
self,
hostPkgs,
config,
inputs,
lib,
...
}:
{
name = "service-phonebox";
result.update-vars =
let
relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
in
hostPkgs.writeShellScriptBin "update-vars" ''
set -x
export PRJ_ROOT=$(git rev-parse --show-toplevel)
${
self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
}/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
'';
clan = {
directory = ./.;
inventory = {
machines.server = { };
instances = {
yggdrasil = {
module.name = "yggdrasil";
roles.default.machines.server = { };
};
phonebox-test = {
module.name = "@clan/phonebox";
module.input = "self";
roles.default.machines."server".settings = {
ata-ethernet-iface = "enp2s0";
};
};
};
};
};
nodes = {
server = {
services.asterisk = {
};
};
};
testScript = ''
start_all()
server.wait_for_unit("asterisk")
server.succeed("systemctl status asterisk")
'';
}

6
modules/clan/phonebox/tests/vm/sops/machines/server/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
"type": "age"
}
]

14
modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/secret
View File

@@ -1,14 +0,0 @@
{
"data": "ENC[AES256_GCM,data:t+zYfcA2f1sdUNBAl+bRGyhPEl5HZFIu+au6heH3+SoHf0zy+Deh25gaVay/oswIg2q806ozjEnTw9q2eaq0VXwMSAWOoTWteI0=,iv:sXoOmfzoCv6GHe21n2Elxr/GTdViI5vfLzMwOLvf1F4=,tag:Fmo9MjEaKV3BehR/bYRdVw==,type:str]",
"sops": {
"age": [
{
"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVlo0YjZFVFF2VkFlSzBL\ndHp4YTQ5RlNxV2FWNnNScTh5d0hXR05RL0NVCnBVUENNNjg0dTFVcmx3N3djZ25l\ncmxYTVVrNGhGSkdwVThoaC9UVTQ3L2sKLS0tIG1uREdFcXNubGxzUUQ1Rkh5Wnlx\nRG5OZmJwaGh2dkt6RSttb0gxZ3FBaEkKZzwUuQmOeBk5kfRfVVdqgNvsTU1Ssb/I\nx9Iv9w/YKHDmmcFLcAbGAHbS0/Js0YqBKZonxEMDdWP/+/F+Pv8LqQ==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-10-31T07:08:30Z",
"mac": "ENC[AES256_GCM,data:CBuTnVIta0eFqlB7ZpDkzPOEGbIQbb5oCpksI4umscB3uE0HM3j4N5r6bCPEcYpehB3qWXuCxlj4NfH7zmp6CDq6Be6bfpB1f8MCwTlPvQUho2f31so3U/g99q6ZyWI2rJO50dzn77bdma3JXo9VQb3uRqJ0mk72IYXFwdHvO9s=,iv:9uwjtGYpqsLcXRoBFmjJjfHUq7R47ZqkrKEXMulw4OY=,tag:4Auq3mnhlusogyW44SJfqg==,type:str]",
"version": "3.11.0"
}
}

1
modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/users/admin
View File

@@ -1 +0,0 @@
../../../users/admin

4
modules/clan/phonebox/tests/vm/sops/users/admin/key.json
View File

@@ -1,4 +0,0 @@
{
"publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
"type": "age"
}

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-local-number/value
View File

@@ -1 +0,0 @@
fake_line_value

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/machines/server
View File

@@ -1 +0,0 @@
../../../../../../sops/machines/server

18
modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/secret
View File

@@ -1,18 +0,0 @@
{
"data": "ENC[AES256_GCM,data:L4fWAVQdQP2tgYPzUnDY5X0=,iv:fWeTc1buW/JI/8qngZwzDp+wq2OTZPGdItqG0Up5eZ8=,tag:RJt6PQdCisDhtbr3ph3fWA==,type:str]",
"sops": {
"age": [
{
"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFK2x0SkcxK2RxTDRvOEpZ\nTS9QNGJxbmZIL2xtUWxyNjA2VDNVWEQzQVc4CkkxeEZDQm1mQVdUUzVIQThDVkV3\nU2lWbnlnb3lqWDZ0NWRqa2RJV0pVK1UKLS0tIHc5eUJBUUtiL0NwZDRnN004UEtr\nYnU2SWlFOGlucTdydGVmZCtGK3NjS28KkNAxwz9MesicLWtViL302AwZYdiTHmd5\nppbwelisNVlsYHSa5ybVDYER4IUz1d8AKO0jtS7qEDfT53R36swSAA==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArbEpzdk0xQTFkM2V0K2xz\nRFhDak0ybkhZUjJJdVI4YTl3cStXT2hTZDBFCmRvQ3ZXYkQ1NktCb004ZE1FS1FF\naSt4RlVXSlRhYWdlQ3htTkdkb2dyVDAKLS0tIG16VFNQM0dnaGVSRmlFRFB0WWtW\nN0dPL08rV01sY3ovRnEvUnNMaWVhd2sKvQIZIo5pPMXKh9Ea3ZgHj99Dn1X3JkmB\noscG8S7HOJh/cw+uITmkuv00TyIA9pid6L1kXvfcfv+tcuY9H1Vg4w==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-10-31T07:08:30Z",
"mac": "ENC[AES256_GCM,data:bmvshL97XNvNYYg0EjkUAQViHpKJ/+A+CGE90/uSM2WXooJF5yzvVJSHLAuYxWM295awN8ygTRUZ2VJ0SyfjzjAyUIH4SxqlrgywqMouyVsiFDAB6R4AmMmbvvC6rSs/TSMOwYC5pchrISbpsE2kmJnAXCqcev6Q0fl8Sa1PSxo=,iv:BuBQCFb3EWfG+bPzgaRDseDq6MJQ/Fs8okvksvEj1bA=,tag:n14VDbQk+zl+XbJPkTRAGg==,type:str]",
"version": "3.11.0"
}
}

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/users/admin
View File

@@ -1 +0,0 @@
../../../../../../sops/users/admin

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/server-prefix-number/value
View File

@@ -1 +0,0 @@
fake_line_value

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/state-version/version/value
View File

@@ -1 +0,0 @@
25.11

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/address/value
View File

@@ -1 +0,0 @@
202:fe87:1ca6:3cfd:e095:c2b1:321c:c391

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/machines/server
View File

@@ -1 +0,0 @@
../../../../../../sops/machines/server

18
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/secret
View File

@@ -1,18 +0,0 @@
{
"data": "ENC[AES256_GCM,data:0LwQxArH6fpIYpGIEzPtjh8elyKSaed7L+KqgnIlPVneR0UbsbOM6p5kVGTRPh5LWH6jmkURCqc2c5oT5CNLBePLQcgvtfLDSFWyyPrD9WtBSPu+YGF7K51JUUIkX07//LqTQQaM5Uu/STQRIoL1BD0Tofk2woA=,iv:3rSDqBj8N9RsSLijZm7mUUjUhiLHc2yidGkil8NvCD8=,tag:F8zlw9pfMjZdJSObDePLsQ==,type:str]",
"sops": {
"age": [
{
"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0NnVzT0lOWnFTUU85c0d5\nZ0Q1b0xkS1NWbWVsc0o1emxLOW5NRU52REFZCjRkUGJHaDhyazdFdkxWaW1XVW53\nb25pUXlDRmhrTHlIWGl6RDJBZ2hTOW8KLS0tIGsxQmlQejkvQk9wTmtMQzZJa2dB\na0piOGlyMzVrTmNOUEhtaDNTWHdwTDAKroQG8KlnWZ6gwu1y0mr0gGezDF1jsS0Y\nC1LUAarHl+lY51sw+HJT88Y9mDfLjvYIMHKS33zdJuBXbNpoIfWyzA==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQVJhYkI1eEFYL0d5OE1F\nSStqV0xPb0pybyt2QWd4SEpiaDhlNDJicTA0CkgrVU9FcThuQktaMThTaXBmWHNV\nd2tpMVVYT21TWUFvMS9wakl4RyszTGsKLS0tIHVVeDdoMUJQaURMOGFkM3dNa3ZG\nMmVPdEg3bmdZZHgwaGpnbFFKUTdvcUUKTaxEfp19+9AJihqx51m0cLz6IuR5pvnT\nt90kZxq+BH3/6gjiDlhwzqztnMbdqQYcVuCDVp/1aVWfThABUZ92aQ==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-12-05T04:42:06Z",
"mac": "ENC[AES256_GCM,data:1/u3c/wf2Gh6PPeVTKKGBxG1FWvN7hyuzx3Qa7yU3yKCD7LDHrrzTbQkFHDo1ZrXixK5NICCw48BWA0Jao0kItu6aU1Dbk5PexZI9ls1eyaDS7nwtZuHKDSEtDYu/kx5kZgQKH9tsokLqKlcoeocS0Mp1tjvUSQsiZFaYsuKaM4=,iv:gCPqFgpwjSONn/JN3dpJOk1BXtdd9cvIAz/NKPuAdKg=,tag:j8upk9sgDiYj5lmfU4V+OQ==,type:str]",
"version": "3.11.0"
}
}

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/users/admin
View File

@@ -1 +0,0 @@
../../../../../../sops/users/admin

3
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/publicKey/value
View File

@@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAIC8cazhgQ+1Hqdm8Z43J5ooymP2ytrBEvdfXYz0ryp8=
-----END PUBLIC KEY-----

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
View File

@@ -1 +0,0 @@
201:b9d:4329:71c2:79ca:3648:e86d:4236

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
View File

@@ -1 +0,0 @@
../../../../../../sops/machines/server

18
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
View File

@@ -1,18 +0,0 @@
{
"data": "ENC[AES256_GCM,data:bAJv40t1hkgMBz4boOEIw9GIY/4UFYI2WZidRrU88ky0JDBwSmHDnxuBFRpdjfAx7sO9d6vSHxAmaf45NlTKwnkUJnaIW0NK+979lXbLV+AG0suc4Vci6fsdbAHofR//3DfTYs03HoALkRUgRemTl7kQtdMB6E6LN02OE19HSVuFjMiEipwosmFfMoR69ZZuPSzNg1uVnw==,iv:LbZZGbwkXc71PAKgjD2CvXJVtyiqgi+cNsBzbulPyIk=,tag:VPESc2Y8SdU5CovQinZleA==,type:str]",
"sops": {
"age": [
{
"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2L3FzSkh3UTkvdTR6eEVE\nNnYrcnAydUl4QnJSbWJRbFFQODFmSld1YkJZCnNFUHp6YjQ3WW0vVHh5dXZBMzFJ\nYWRnZWNHN2dkL1JBWHNrZTcvTHI5S3MKLS0tIGpnekxneURuMWFkQ1RLTEszTFhi\nUUkzR2ljTXFhb1c2RDhpeFJXaXpYakUK/fLOqjNR2LML7uN3fiB9GdhWTDcr0wn4\n37ESeS1kx0EobRMaDVu8GPZovcdypFOOPiuUpEu6hIEdwvl736oDSA==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQWE2L3F1RW9oNlQzR0I3\nZDJoZ1hIM2N0Mm1aQ1IrN1gweWZxeWVGdUdzCmlIZXdKYm8rUGkvVVpiY1BJZmlD\nN0MwRHN3dUNrRU9McjNFMXpranJGU1UKLS0tIG1yMmJGaEp1cU1iZGdqdzRUTWZW\nZzZrVkRuOTBTcnFuaTE1Um1ISUxBaTQKf842rL3N7Gl1QfrIURWiu26LwO0ERkP4\nvfXN2HH1jjp2pblQF9qb+5vmUsaX1pPSY1R+YMvUK7wIwOb9zyIfmQ==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-10-31T07:50:02Z",
"mac": "ENC[AES256_GCM,data:/c1jqMSLd9/fxm1PxtRITr3qkjtrlJ/5wJgEVkraAqU6XTuzSyseMhdeWLL2Fy2OunT/+alM6VpaliBmcZqRkSSGngbuvMsujDiJLgUXQ8wNhMcK7ln/dqFMcA+RYGxihGEMwuPKs3yOVKj9PDzFYnm6TUCFkU/heotI/hQ1lQI=,iv:EsWsi4r4DctMLvi4WmqKe0D1NTHwYVKCcxKQ+6grzYg=,tag:28dmpzF/6dbvGIriaBVKPw==,type:str]",
"version": "3.11.0"
}
}

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
View File

@@ -1 +0,0 @@
../../../../../../sops/users/admin

1
modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-subnet/value
View File

@@ -1 +0,0 @@
301:b9d:4329:71c2::/64

42
modules/clan/pulse-stream/default.nix
View File

@@ -1,42 +0,0 @@
{ ... }:
{
_class = "clan.service";
manifest.name = "pulse-stream";
manifest.description = "stream audio to attached speakers";
manifest.categories = [ "System" ];
roles.default = {
interface =
{ lib, ... }:
{
options.client-ip-ranges = lib.mkOption {
type = lib.types.listOf lib.types.str;
description = "ip subnets permitted to stream to the server";
default = [ ];
};
};
perInstance =
{
roles,
settings,
...
}:
{
nixosModule =
{ ... }:
{
services.pulseaudio = {
enable = true;
systemWide = true;
tcp = {
enable = true;
anonymousClients.allowedIpRanges = settings.client-ip-ranges;
anonymousClients.allowAll = true;
};
zeroconf.publish.enable = true;
};
networking.firewall.allowedTCPPorts = [ 4713 ];
};
};
};
}

9
modules/clan/pulse-stream/flake-module.nix
View File

@@ -1,9 +0,0 @@
{ lib, ... }:
let
module = lib.modules.importApply ./default.nix { };
in
{
clan.modules = {
pulse-stream = module;
};
}

5
modules/nixos/default.nix Normal file
View File

@@ -0,0 +1,5 @@
{
flake.nixosModules = {
inventree = import ../nixos/inventree;
};
}

6
modules/nixos/flake-module.nix
View File

@@ -3,11 +3,5 @@
common = {
imports = [ ./common.nix ];
};
think-gtcm = {
imports = [ ./think-gtcm.nix ];
};
think-backend-gtcm = {
imports = [ ./think-backend-gtcm.nix ];
};
};
}

386
modules/nixos/inventree/default.nix Normal file
View File

@@ -0,0 +1,386 @@
{
lib,
config,
pkgs,
...
}:
let
inherit (lib)
mkEnableOption
mkOption
types
mkIf
;
configFormat = pkgs.formats.json { };
cfg = config.services.inventree;
pkg = cfg.package;
configFile = "${cfg.dataDir}/config.json";
inventree-invoke = pkgs.writeShellApplication {
name = "inventree-invoke";
text = ''
export INVENTREE_CONFIG_FILE=${configFile}
export INVENTREE_SECRET_KEY_FILE=${cfg.secretKeyFile}
export PYTHONPATH=${pkg.pythonPath}
exec -a "$0" ${pkgs.python3Packages.invoke}/bin/invoke -r ${cfg.package}/opt/inventree "$@"
'';
};
in
{
options.services.inventree = {
enable = mkEnableOption "InvenTree parts manager";
package = lib.mkOption {
type = types.package;
default = pkgs.inventree;
description = ''
InvenTree package to use
'';
};
hostName = mkOption {
type = types.str;
description = "FQDN for the InvenTree instance.";
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/inventree";
example = "/var/lib/inventree";
description = ''
The default path for all inventree data.
'';
};
secretKeyFile = mkOption {
type = types.path;
default = "${cfg.dataDir}/secret_key.txt";
description = ''
Path to a file containing the secret key
'';
};
config = mkOption {
type = types.submodule ({
freeformType = configFormat.type;
options = {
adminUser = mkOption {
type = types.str;
default = "admin";
};
adminPasswordFile = mkOption {
type = types.path;
description = "Path to password file for user `admin`";
};
site_url = mkOption {
type = types.str;
default = "https://${cfg.hostName}";
};
static_root = mkOption {
type = types.path;
default = "${cfg.dataDir}/static";
description = ''
Static file storage
'';
};
media_root = mkOption {
type = types.path;
default = "${cfg.dataDir}/media_root";
description = "Media root directory";
};
backup_dir = mkOption {
type = types.path;
default = "${cfg.dataDir}/backups";
description = "Backup directory";
};
oidc_private_key_file = mkOption {
type = types.path;
default = "${cfg.dataDir}/oidc.key";
};
};
});
default = { };
description = ''
Config options, see https://docs.inventree.org/en/stable/start/config/
for details
'';
};
serverStartTimeout = mkOption {
type = types.str;
default = "10min";
description = ''
TimeoutStartSec for the server systemd service.
See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStartSec=
for more details
'';
};
serverStopTimeout = mkOption {
type = types.str;
default = "5min";
description = ''
TimeoutStopSec for the server systemd service.
See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStopSec=
for more details
'';
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ inventree-invoke ];
systemd.tmpfiles.rules = (
map (dir: "d ${dir} 0755 inventree inventree") [
"${cfg.dataDir}"
"${cfg.dataDir}/static"
"${cfg.dataDir}/media_root"
"${cfg.dataDir}/backups"
]
);
services.inventree.config = {
plugins_enabled = false;
plugin_file = "${cfg.dataDir}/plugins.txt";
plugin_dir = "${cfg.dataDir}/plugins";
database = {
ENGINE = "postgresql";
NAME = "inventree";
HOST = "/run/postgresql";
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ "inventree" ];
ensureUsers = [
{
name = "inventree";
ensureDBOwnership = true;
}
];
};
users.users.inventree = {
group = "inventree";
isSystemUser = true;
description = "InvenTree daemon user";
};
users.groups.inventree = { };
services.nginx.enable = true;
services.nginx.virtualHosts.${cfg.hostName} = {
locations =
let
unixPath = config.systemd.sockets.inventree-gunicorn.socketConfig.ListenStream;
in
{
"/" = {
extraConfig = ''
client_max_body_size 100M;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
proxyPass = "http://unix:${unixPath}";
};
"/static/" = {
alias = "${cfg.config.static_root}/";
extraConfig = ''
expires 30d;
'';
};
"/media/" = {
alias = "${cfg.config.media_root}/";
extraConfig = ''
auth_request /auth;
'';
};
"/auth" = {
extraConfig = ''
internal;
'';
proxyPass = "http://unix:${unixPath}:/auth/";
};
};
};
systemd.targets.inventree = {
description = "Target for all InvenTree services";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
};
systemd.services.inventree-config = {
description = "Inventree config generation";
wantedBy = [ "inventree.target" ];
partOf = [ "inventree.target" ];
before = [
"inventree-static.service"
"inventree-gunicorn.service"
"inventree-qcluster.service"
];
serviceConfig = {
# User = "root";
# Group = "root";
User = "inventree";
Group = "inventree";
Type = "oneshot";
RemainAfterExit = true;
PrivateTmp = true;
};
environment = {
INVENTREE_CONFIG_FILE = configFile;
INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
INVENTREE_AUTO_UPDATE = "1";
INVENTREE_PLUGINS_ENABLED = "1";
INVENTREE_PLUGIN_NOINSTALL = "1";
INVENTREE_STATIC_ROOT = cfg.config.static_root;
INVENTREE_MEDIA_ROOT = cfg.config.media_root;
INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
INVENTREE_DB_NAME = cfg.config.database.NAME;
INVENTREE_DB_HOST = cfg.config.database.HOST;
INVENTREE_DB_USER = "inventree";
INVENTREE_ADMIN_USER = cfg.config.adminUser;
INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
INVENTREE_SITE_URL = cfg.config.site_url;
PYTHONPATH = pkg.pythonPath;
};
script = ''
set -euo pipefail
umask u=rwx,g=,o=
# chown inventree:inventree ${configFile}
${pkg}/opt/inventree/src/backend/InvenTree/manage.py migrate
'';
};
systemd.services.inventree-static = {
description = "InvenTree static migration";
wantedBy = [ "inventree.target" ];
partOf = [ "inventree.target" ];
before = [ "inventree-gunicorn.service" ];
environment = {
INVENTREE_CONFIG_FILE = configFile;
INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
INVENTREE_AUTO_UPDATE = "1";
INVENTREE_PLUGINS_ENABLED = "1";
INVENTREE_PLUGIN_NOINSTALL = "1";
INVENTREE_STATIC_ROOT = cfg.config.static_root;
INVENTREE_MEDIA_ROOT = cfg.config.media_root;
INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
INVENTREE_DB_NAME = cfg.config.database.NAME;
INVENTREE_DB_HOST = cfg.config.database.HOST;
INVENTREE_DB_USER = "inventree";
INVENTREE_ADMIN_USER = cfg.config.adminUser;
INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
INVENTREE_SITE_URL = cfg.config.site_url;
PYTHONPATH = pkg.pythonPath;
};
serviceConfig = {
User = "inventree";
Group = "inventree";
StateDirectory = "inventree";
#RuntimeDirectory = "inventree";
PrivateTmp = true;
ExecStart = ''
${pkg}/opt/inventree/src/backend/InvenTree/manage.py collectstatic --no-input
'';
};
};
systemd.services.inventree-gunicorn = {
description = "InvenTree Gunicorn server";
requiredBy = [ "inventree.target" ];
partOf = [ "inventree.target" ];
#wantedBy = [ "inventree.target" ];
environment = {
INVENTREE_CONFIG_FILE = configFile;
INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
INVENTREE_AUTO_UPDATE = "1";
INVENTREE_PLUGINS_ENABLED = "1";
INVENTREE_PLUGIN_NOINSTALL = "1";
INVENTREE_STATIC_ROOT = cfg.config.static_root;
INVENTREE_MEDIA_ROOT = cfg.config.media_root;
INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
INVENTREE_DB_NAME = cfg.config.database.NAME;
INVENTREE_DB_HOST = cfg.config.database.HOST;
INVENTREE_DB_USER = "inventree";
INVENTREE_ADMIN_USER = cfg.config.adminUser;
INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
INVENTREE_SITE_URL = cfg.config.site_url;
PYTHONPATH = pkg.pythonPath;
};
serviceConfig = {
User = "inventree";
Group = "inventree";
StateDirectory = "inventree";
#RuntimeDirectory = "inventree";
PrivateTmp = true;
ExecStart = ''
${pkg.gunicorn}/bin/gunicorn InvenTree.wsgi \
--pythonpath ${pkg}/opt/inventree/src/backend/InvenTree
'';
};
};
systemd.sockets.inventree-gunicorn = {
wantedBy = [ "sockets.target" ];
partOf = [ "inventree.target" ];
socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
};
systemd.services.inventree-qcluster = {
description = "InvenTree qcluster server";
requiredBy = [ "inventree.target" ];
wantedBy = [ "inventree.target" ];
partOf = [ "inventree.target" ];
environment = {
INVENTREE_CONFIG_FILE = configFile;
INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
INVENTREE_AUTO_UPDATE = "1";
INVENTREE_PLUGINS_ENABLED = "0";
INVENTREE_PLUGIN_NOINSTALL = "1";
INVENTREE_STATIC_ROOT = cfg.config.static_root;
INVENTREE_MEDIA_ROOT = cfg.config.media_root;
INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
INVENTREE_DB_NAME = cfg.config.database.NAME;
INVENTREE_DB_HOST = cfg.config.database.HOST;
INVENTREE_DB_USER = "inventree";
INVENTREE_ADMIN_USER = cfg.config.adminUser;
INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
INVENTREE_SITE_URL = cfg.config.site_url;
PYTHONPATH = pkg.pythonPath;
};
serviceConfig = {
User = "inventree";
Group = "inventree";
StateDirectory = "inventree";
#RuntimeDirectory = "inventree";
PrivateTmp = true;
ExecStart = ''
${pkg}/opt/inventree/src/backend/InvenTree/manage.py qcluster
'';
};
};
};
}

292
modules/nixos/think-backend-gtcm.nix
View File

@@ -1,292 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.think-backend-greaterchiangmai;
think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
defaultUser = "gtcm";
defaultGroup = "gtcm";
php = pkgs.php83;
artisan-be = pkgs.writeScriptBin "gtcm-be" ''
#! ${pkgs.runtimeShell}
cd ${think-backend-gtcm}
sudo() {
if [[ "$USER" != ${cfg.user} ]]; then
exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
else
exec "$@"
fi
}
sudo ${lib.getExe php} artisan "$@"
'';
in
{
options.services.think-backend-greaterchiangmai = {
enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/think-backend.greaterchiangmai.com";
description = ''A place where to store states'';
};
user = lib.mkOption {
type = lib.types.str;
default = defaultUser;
description = "User account under which this runs.";
};
group = lib.mkOption {
type = lib.types.str;
default = defaultGroup;
defaultText = "${defaultGroup}";
description = "Group under which the website runs.";
};
package = lib.mkPackageOption pkgs "think-backend-gtcm" { };
domain = lib.mkOption {
type = lib.types.str;
default = "think-backend.greaterchiangmai.com";
example = "forum.example.com";
description = "Domain to serve on.";
};
settings = lib.mkOption {
type =
with lib.types;
attrsOf (
nullOr (
either
(oneOf [
bool
int
port
path
str
])
(submodule {
options = {
_secret = lib.mkOption {
type = nullOr str;
description = ''
The path to a file containing the value the
option should be set to in the final
configuration file.
'';
};
};
})
)
);
default = { };
description = ''
Options for settings environment variables
'';
example = lib.literalExpression ''
{
APP_NAME = "Laravel";
APP_ENV = "local";
APP_KEY = "key";
APP_DEBUG = true;
APP_URL = "http://localhost";
LOG_CHANNEL = "stack";
LOG_DEPRECATIONS_CHANNEL = "null";
LOG_LEVEL = "debug";
DB_CONNECTION = "mysql";
DB_HOST = "127.0.0.1";
DB_PORT = "3306";
DB_DATABASE = "laravel";
DB_USERNAME = "root";
DB_PASSWORD = "";
}
'';
};
};
config = lib.mkIf cfg.enable {
users.users.${cfg.user} = lib.mkForce {
isSystemUser = true;
home = cfg.dataDir;
createHome = true;
homeMode = "755";
group = cfg.group;
};
users.groups.${cfg.group} = { };
services.phpfpm.pools.think-backend-gtcm = {
inherit (cfg) user group;
phpPackage = php;
settings = {
"listen.owner" = config.services.nginx.user;
"listen.group" = config.services.nginx.group;
"listen.mode" = "0600";
"pm" = lib.mkDefault "dynamic";
"pm.max_children" = lib.mkDefault 10;
"pm.max_requests" = lib.mkDefault 500;
"pm.start_servers" = lib.mkDefault 2;
"pm.min_spare_servers" = lib.mkDefault 1;
"pm.max_spare_servers" = lib.mkDefault 3;
};
phpOptions = ''
error_log = syslog
log_errors = on
'';
};
environment.systemPackages = [
artisan-be
];
services.think-backend-greaterchiangmai.settings = {
APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
};
systemd.services.think-backend-gtcm-setup = {
description = "think-backend.greaterchiangmai installation";
requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
before = [ "phpfpm-think-backend-gtcm.service" ];
requires = [ "mysql.service" ];
after = [ "mysql.service" ];
serviceConfig = {
type = "oneshot";
RemainAfterExit = true;
User = cfg.user;
UMask = 77;
WorkingDirectory = "${think-backend-gtcm}";
RuntimeDirectory = "think-backend-gtcm/cache";
RuntimeDirectoryMode = 700;
};
path = [ pkgs.replace-secret ];
script =
let
isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
gtcmEnvVars = lib.generators.toKeyValue {
mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
mkValueString =
v:
with builtins;
if isInt v then
toString v
else if isString v then
v
else if true == v then
"true"
else if false == v then
"false"
else if isSecret v then
hashString "sha256" v._secret
else
throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
};
};
secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
mkSecretReplacement = file: ''
replace-secret ${
lib.escapeShellArgs [
(builtins.hashString "sha256" file)
file
"${cfg.dataDir}/.env"
]
}
'';
secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
filteredConfig = lib.converge (lib.filterAttrsRecursive (
_: v:
!lib.elem v [
{ }
null
]
)) cfg.settings;
gtcmEnv = pkgs.writeText "gtcm-be.env" (gtcmEnvVars filteredConfig);
in
''
# error handling
set -euo pipefail
# create .env file
install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
${secretReplacements}
if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
fi
# migrate & seed db
${lib.getExe php} artisan key:generate --force
${lib.getExe php} artisan migrate --force
${lib.getExe php} artisan config:cache
'';
};
systemd.tmpfiles.rules = [
"d ${cfg.dataDir} 0710 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/cache 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/public 0750 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/public/uploads 0750 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/app 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/fonts 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework/cache 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework/views 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/logs 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/uploads 0700 ${cfg.user} ${cfg.group} - -"
];
networking.firewall.allowedTCPPorts = [
80
443
];
services.nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedBrotliSettings = true;
recommendedProxySettings = true;
virtualHosts."${cfg.domain}" = {
root = "${think-backend-gtcm}/public";
locations = {
"/" = {
index = "index.php";
tryFiles = "$uri $uri/ /index.php?$query_string";
};
"~ \\.php$".extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
'';
"~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
extraConfig = "expires 365d;";
};
};
};
};
services.mysql = {
enable = true;
package = lib.mkForce pkgs.mariadb;
ensureDatabases = [ cfg.settings.DB_DATABASE ];
ensureUsers = [
{
name = cfg.settings.DB_USERNAME;
ensurePermissions = {
"${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
};
}
];
};
};
}

295
modules/nixos/think-gtcm.nix
View File

@@ -1,295 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.think-greaterchiangmai;
think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
defaultUser = "gtcm";
defaultGroup = "gtcm";
php = pkgs.php83;
artisan = pkgs.writeScriptBin "gtcm" ''
#! ${pkgs.runtimeShell}
cd ${think-gtcm}
sudo() {
if [[ "$USER" != ${cfg.user} ]]; then
exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
else
exec "$@"
fi
}
sudo ${lib.getExe php} artisan "$@"
'';
in
{
options.services.think-greaterchiangmai = {
enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/think.greaterchiangmai.com";
description = ''A place where to store states'';
};
user = lib.mkOption {
type = lib.types.str;
default = defaultUser;
description = "User account under which this runs.";
};
group = lib.mkOption {
type = lib.types.str;
default = defaultGroup;
defaultText = "${defaultGroup}";
description = "Group under which the website runs.";
};
package = lib.mkPackageOption pkgs "think-gtcm" { };
packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
domain = lib.mkOption {
type = lib.types.str;
default = "think.greaterchiangmai.com";
example = "forum.example.com";
description = "Domain to serve on.";
};
settings = lib.mkOption {
type =
with lib.types;
attrsOf (
nullOr (
either
(oneOf [
bool
int
port
path
str
])
(submodule {
options = {
_secret = lib.mkOption {
type = nullOr str;
description = ''
The path to a file containing the value the
option should be set to in the final
configuration file.
'';
};
};
})
)
);
default = { };
description = ''
Options for settings environment variables
'';
example = lib.literalExpression ''
{
APP_NAME = "Laravel";
APP_ENV = "local";
APP_KEY = "key";
APP_DEBUG = true;
APP_URL = "http://localhost";
LOG_CHANNEL = "stack";
LOG_DEPRECATIONS_CHANNEL = "null";
LOG_LEVEL = "debug";
DB_CONNECTION = "mysql";
DB_HOST = "127.0.0.1";
DB_PORT = "3306";
DB_DATABASE = "laravel";
DB_USERNAME = "root";
DB_PASSWORD = "";
}
'';
};
};
config = lib.mkIf cfg.enable {
users.users.${cfg.user} = {
isSystemUser = true;
home = cfg.dataDir;
createHome = true;
homeMode = "755";
group = cfg.group;
};
users.groups.${cfg.group} = { };
services.phpfpm.pools.think-gtcm = {
inherit (cfg) user group;
phpPackage = php;
settings = {
"listen.owner" = config.services.nginx.user;
"listen.group" = config.services.nginx.group;
"listen.mode" = "0600";
"pm" = lib.mkDefault "dynamic";
"pm.max_children" = lib.mkDefault 10;
"pm.max_requests" = lib.mkDefault 500;
"pm.start_servers" = lib.mkDefault 2;
"pm.min_spare_servers" = lib.mkDefault 1;
"pm.max_spare_servers" = lib.mkDefault 3;
};
phpOptions = ''
error_log = syslog
log_errors = on
'';
};
environment.systemPackages = [
artisan
];
services.think-greaterchiangmai.settings = {
APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
};
systemd.services.think-gtcm-setup = {
description = "think.greaterchiangmai installation";
requiredBy = [ "phpfpm-think-gtcm.service" ];
before = [ "phpfpm-think-gtcm.service" ];
requires = [ "mysql.service" ];
after = [ "mysql.service" ];
serviceConfig = {
type = "oneshot";
RemainAfterExit = true;
User = cfg.user;
UMask = 77;
WorkingDirectory = "${think-gtcm}";
RuntimeDirectory = "think-gtcm/cache";
RuntimeDirectoryMode = 700;
};
path = [ pkgs.replace-secret ];
script =
let
isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
gtcmEnvVars = lib.generators.toKeyValue {
mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
mkValueString =
v:
with builtins;
if isInt v then
toString v
else if isString v then
v
else if true == v then
"true"
else if false == v then
"false"
else if isSecret v then
hashString "sha256" v._secret
else
throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
};
};
secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
mkSecretReplacement = file: ''
replace-secret ${
lib.escapeShellArgs [
(builtins.hashString "sha256" file)
file
"${cfg.dataDir}/.env"
]
}
'';
secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
filteredConfig = lib.converge (lib.filterAttrsRecursive (
_: v:
!lib.elem v [
{ }
null
]
)) cfg.settings;
gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
in
''
# error handling
set -euo pipefail
# create .env file
install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
${secretReplacements}
if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
fi
# migrate & seed db
${lib.getExe php} artisan key:generate --force
${lib.getExe php} artisan migrate --force
${lib.getExe php} artisan config:cache
'';
};
systemd.tmpfiles.rules = [
"d ${cfg.dataDir} 0710 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/cache 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/public 0750 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/public/uploads 0750 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/app 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/fonts 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework/cache 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/framework/views 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/logs 0700 ${cfg.user} ${cfg.group} - -"
"d ${cfg.dataDir}/storage/uploads 0700 ${cfg.user} ${cfg.group} - -"
];
networking.firewall.allowedTCPPorts = [
80
443
];
services.nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedBrotliSettings = true;
recommendedProxySettings = true;
virtualHosts."${cfg.domain}" = {
root = "${think-gtcm}/public";
locations = {
"/" = {
index = "index.php";
tryFiles = "$uri $uri/ /index.php?$query_string";
};
"~ \\.php$".extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
'';
"~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
extraConfig = "expires 365d;";
};
};
};
};
services.mysql = {
enable = true;
package = pkgs.mariadb;
ensureDatabases = [ cfg.settings.DB_DATABASE ];
ensureUsers = [
{
name = cfg.settings.DB_USERNAME;
ensurePermissions = {
"${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
};
}
];
};
};
}

5
overlays/default.nix
View File

@@ -1,6 +1,7 @@
{ ... }:
{ inputs, ... }:
{
flake.overlays = {
packagesOverlay = import ../pkgs/overlay.nix;
default = final: prev: import (../pkgs/overlay.nix) inputs final prev;
};
}

145
pkgs/inventree/default.nix Normal file
View File

@@ -0,0 +1,145 @@
{
stdenvNoCC,
python3,
fetchFromGitHub,
fetchYarnDeps,
yarnConfigHook,
nodejs,
}:
let
version = "unstable-2025-05-09";
src = fetchFromGitHub {
owner = "inventree";
repo = "InvenTree";
rev = "e0acfaa762da0dd7b2822b567202210ca8b7dbd3";
hash = "sha256-K+cqErDUmgPO7625P3jp7+7BOYEfyJ1nElae6RlJvvI=";
};
frontend = stdenvNoCC.mkDerivation {
name = "inventree-frontend";
inherit version src;
yarnOfflineCache = fetchYarnDeps {
yarnLock = "${src}/src/frontend/yarn.lock";
hash = "sha256-KpWuYCrkGN+4UnwV1STEbTL0FWcLZ7Wq8a8ST55OpGM=";
};
nativeBuildInputs = [
yarnConfigHook
nodejs
];
patchPhase = ''
runHook prePatch
cd src/frontend
runHook postPatch
'';
buildPhase = ''
echo "Running lingui"
./node_modules/.bin/lingui compile --typescript
echo building lib
./node_modules/.bin/tsc --p ./tsconfig.lib.json
./node_modules/.bin/vite --config vite.lib.config.ts build
echo "Running tsc"
./node_modules/.bin/tsc
echo "Running vite"
./node_modules/.bin/vite build --emptyOutDir --outDir $out
'';
};
in
python3.pkgs.buildPythonApplication rec {
pname = "InvenTree";
inherit version src;
format = "other";
dependencies = with python3.pkgs; [
coreapi
cryptography
distutils
dj-rest-auth
django_4
django-allauth
django-allauth.optional-dependencies.openid
django-allauth.optional-dependencies.mfa
django-allauth.optional-dependencies.socialaccount
django-cleanup
django-cors-headers
django-dbbackup
django-error-report-2
django-filter
django-flags
django-formtools
django-ical
django-js-asset
django-maintenance-mode
django-markdownify
django-money
django-mptt
django-redis
django-oauth-toolkit
django-otp
django-q-sentry
django-q2
django-redis
django-sesame
django-sql-utils
django-structlog
django-stdimage
django-taggit
django-user-sessions
django-weasyprint
djangorestframework
djangorestframework-simplejwt
djangorestframework-simplejwt.optional-dependencies.crypto
django-xforwardedfor-middleware
drf-spectacular
dulwich
feedparser
gunicorn
pdf2image
pillow
pint
pip-licenses
pypdf
python-barcode
python-barcode.optional-dependencies.images
python-dotenv
pyyaml
qrcode
qrcode.optional-dependencies.pil
rapidfuzz
sentry-sdk
tablib
tablib.optional-dependencies.xls
tablib.optional-dependencies.xlsx
tablib.optional-dependencies.yaml
weasyprint
whitenoise
psycopg2
fido2
];
nativeCheckInputs = with python3.pkgs; [ django-slowtests ];
installPhase = ''
mkdir -p $out/opt/inventree
cp -r . $out/opt/inventree
echo "Installing frontend"
mkdir -p $out/opt/inventree/src/backend/InvenTree/web/static/web
cp -r ${frontend}/* $out/opt/inventree/src/backend/InvenTree/web/static/web/
cp -r ${frontend}/.* $out/opt/inventree/src/backend/InvenTree/web/static/web/
'';
passthru = {
pythonPath = python3.pkgs.makePythonPath dependencies;
gunicorn = python3.pkgs.gunicorn;
inherit frontend;
};
}

29
pkgs/overlay.nix
View File

@@ -1,4 +1,27 @@
final: prev: {
think-gtcm = final.callPackage ./think-gtcm.nix { };
think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
inputs: final: prev: {
pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
(py-final: py-prev: {
django-dbbackup = py-final.callPackage ./python/django-dbbackup { };
django-error-report-2 = py-final.callPackage ./python/django-error-report-2 { };
django-flags = py-final.callPackage ./python/django-flags { };
django-ical = py-final.callPackage ./python/django-ical { };
django-markdownify = py-final.callPackage ./python/django-markdownify { };
django-money = py-final.callPackage ./python/django-money { };
django-q-sentry = py-final.callPackage ./python/django-q-sentry { };
django-recurrence = py-final.callPackage ./python/django-recurrence { };
django-slowtests = py-final.callPackage ./python/django-slowtests { };
django-structlog = py-final.callPackage ./python/django-structlog { };
django-stdimage = py-final.callPackage ./python/django-stdimage { };
django-user-sessions = py-final.callPackage ./python/django-user-sessions { };
django-weasyprint = py-final.callPackage ./python/django-weasyprint { };
django-xforwardedfor-middleware = py-final.callPackage ./python/django-xforwardedfor-middleware { };
pip-licenses = py-final.callPackage ./python/pip-licenses { };
py-moneyed = py-final.callPackage ./python/py-moneyed { };
pytest-pycodestyle = py-final.callPackage ./python/pytest-codestyle { };
sentry-sdk = py-final.callPackage ./python/sentry-sdk { };
})
];
inventree = final.callPackage ./inventree { python3 = final.python312; };
}

42
pkgs/python/django-dbbackup/default.nix Normal file
View File

@@ -0,0 +1,42 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
django_4,
pytz,
}:
buildPythonPackage rec {
pname = "django-dbbackup";
version = "4.2.1";
pyproject = true;
src = fetchFromGitHub {
owner = "jazzband";
repo = "django-dbbackup";
rev = version;
hash = "sha256-GD+f9mbImGPQ6MOUK3ftHqiGv7TT39jNQsFvd0dnnWU=";
};
build-system = [
setuptools
wheel
];
dependencies = [
django_4
pytz
];
pythonImportsCheck = [ "dbbackup" ];
meta = {
description = "Management commands to help backup and restore your project database and media files";
homepage = "https://github.com/jazzband/django-dbbackup";
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [ ];
mainProgram = "django-dbbackup";
};
}

37
pkgs/python/django-error-report-2/default.nix Normal file
View File

@@ -0,0 +1,37 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
django,
}:
buildPythonPackage rec {
pname = "django-error-report-2";
version = "0.4.2";
pyproject = true;
src = fetchFromGitHub {
owner = "matmair";
repo = "django-error-report-2";
rev = version;
hash = "sha256-ZCaslqgruJxM8345/jSlZGruM+27H9hvwL0wtPkUzc0=";
};
build-system = [
setuptools
wheel
];
dependencies = [ django ];
pythonImportsCheck = [ "error_report" ];
meta = {
description = "Log/View Django server errors";
homepage = "https://github.com/matmair/django-error-report-2";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

37
pkgs/python/django-flags/default.nix Normal file
View File

@@ -0,0 +1,37 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
django,
}:
buildPythonPackage rec {
pname = "django-flags";
version = "5.0.13";
pyproject = true;
src = fetchFromGitHub {
owner = "cfpb";
repo = "django-flags";
rev = version;
hash = "sha256-WPMfFYoP6WaVzZmVtqAz4LlY761aCRyPhd5npc8bOOI=";
};
build-system = [
setuptools
wheel
];
dependencies = [ django ];
pythonImportsCheck = [ "flags" ];
meta = {
description = "Feature flags for Django projects";
homepage = "https://github.com/cfpb/django-flags";
license = lib.licenses.cc0;
maintainers = with lib.maintainers; [ ];
};
}

46
pkgs/python/django-ical/default.nix Normal file
View File

@@ -0,0 +1,46 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
setuptools-scm,
wheel,
django,
django-recurrence,
icalendar,
}:
buildPythonPackage rec {
pname = "django-ical";
version = "1.9.2";
pyproject = true;
src = fetchFromGitHub {
owner = "jazzband";
repo = "django-ical";
rev = version;
hash = "sha256-DUe0loayGcUS7MTyLn+g0KBxbIY7VsaoQNHGSMbMI3U=";
};
build-system = [
setuptools
setuptools-scm
wheel
];
dependencies = [
django
django-recurrence
icalendar
];
pythonImportsCheck = [ "django_ical" ];
meta = {
description = "ICal feeds for Django based on Django's syndication feed framework";
homepage = "https://github.com/jazzband/django-ical";
changelog = "https://github.com/jazzband/django-ical/blob/${src.rev}/CHANGES.rst";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

39
pkgs/python/django-markdownify/default.nix Normal file
View File

@@ -0,0 +1,39 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
bleach,
django,
markdown,
}:
buildPythonPackage rec {
pname = "django-markdownify";
version = "0.9.5";
pyproject = true;
src = fetchFromGitHub {
owner = "erwinmatijsen";
repo = "django-markdownify";
rev = version;
hash = "sha256-KYU8p8NRD4EIS/KhOk9nvmXCf0RWEc+IFZ57YtsDSWE=";
};
build-system = [ setuptools ];
dependencies = [
bleach
django
markdown
];
pythonImportsCheck = [ "markdownify" ];
meta = {
description = "Markdown template filter for Django";
homepage = "https://github.com/erwinmatijsen/django-markdownify";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

41
pkgs/python/django-money/default.nix Normal file
View File

@@ -0,0 +1,41 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
django,
py-moneyed,
}:
buildPythonPackage rec {
pname = "django-money";
version = "3.2";
pyproject = true;
src = fetchFromGitHub {
owner = "django-money";
repo = "django-money";
rev = version;
hash = "sha256-eL26NsreUqtMJ26TmvmB53EJI4Sjs7qjFDnnt4N0vdI=";
};
build-system = [
setuptools
wheel
];
dependencies = [
django
py-moneyed
];
pythonImportsCheck = [ "djmoney" ];
meta = {
description = "Money fields for Django forms and models";
homepage = "https://github.com/django-money/django-money";
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [ ];
};
}

37
pkgs/python/django-q-sentry/default.nix Normal file
View File

@@ -0,0 +1,37 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
poetry-core,
setuptools,
sentry-sdk,
}:
buildPythonPackage rec {
pname = "django-q-sentry";
version = "0.1.6";
pyproject = true;
src = fetchFromGitHub {
owner = "danielwelch";
repo = "django-q-sentry";
rev = "d3a43a90c82734244d5ebf3295652223053f1354";
hash = "sha256-3C7A+X18c7p19HWD/uPRtAMf29VjmrfXXh2z5PPOREY=";
};
build-system = [
poetry-core
setuptools
];
dependencies = [ sentry-sdk ];
pythonImportsCheck = [ "django_q_sentry" ];
meta = {
description = "Bringing Sentry error tracking to Django Q";
homepage = "https://github.com/danielwelch/django-q-sentry";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

56
pkgs/python/django-recurrence/default.nix Normal file
View File

@@ -0,0 +1,56 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
pdm-backend,
django,
flake8,
pytest,
pytest-cov,
pytest-django,
pytest-sugar,
python-dateutil,
sphinx,
sphinx-rtd-theme,
tox,
}:
buildPythonPackage rec {
pname = "django-recurrence";
version = "1.12.1";
pyproject = true;
src = fetchFromGitHub {
owner = "jazzband";
repo = "django-recurrence";
rev = version;
hash = "sha256-Q33zyMa1wI13RNLxynGAJHlagahpnFHCmZbHp0aPC/w=";
};
build-system = [ pdm-backend ];
dependencies = [
django
flake8
pytest
pytest-cov
pytest-django
pytest-sugar
python-dateutil
sphinx
sphinx-rtd-theme
tox
];
pythonRelaxDeps = true;
pythonImportsCheck = [ "recurrence" ];
meta = {
description = "Utility for working with recurring dates in Django";
homepage = "https://github.com/django-recurrence/django-recurrence";
changelog = "https://github.com/django-recurrence/django-recurrence/blob/${src.rev}/CHANGES.rst";
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [ ];
};
}

38
pkgs/python/django-slowtests/default.nix Normal file
View File

@@ -0,0 +1,38 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
django_4,
}:
buildPythonPackage rec {
pname = "django-slowtests";
version = "1.1.1";
pyproject = true;
src = fetchFromGitHub {
owner = "realpython";
repo = "django-slow-tests";
rev = version;
hash = "sha256-gW9AZiMpXJp1m2X1cbm6GdZ9cH+TFqjNLQJFmsvGjB0=";
};
build-system = [
setuptools
wheel
];
dependencies = [ django_4 ];
pythonImportsCheck = [ "django_slowtests" ];
meta = {
description = "Locate your slowest tests";
homepage = "https://github.com/realpython/django-slow-tests";
changelog = "https://github.com/realpython/django-slow-tests/blob/${src.rev}/CHANGELOG.rst";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

51
pkgs/python/django-stdimage/default.nix Normal file
View File

@@ -0,0 +1,51 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
setuptools-scm,
wheel,
django,
pillow,
gettext,
}:
buildPythonPackage rec {
pname = "django-stdimage";
version = "6.0.2";
pyproject = true;
src = fetchFromGitHub {
owner = "codingjoe";
repo = "django-stdimage";
rev = version;
hash = "sha256-uwVU3Huc5fitAweShJjcMW//GBeIpJcxqKKLGo/EdIs=";
};
build-system = [
setuptools
setuptools-scm
wheel
];
dependencies = [
django
pillow
];
nativeBuildInputs = [ gettext ];
preBuild = ''
echo "bla bla"
echo $PATH
'';
pythonImportsCheck = [ "stdimage" ];
meta = {
description = "";
homepage = "https://github.com/codingjoe/django-stdimage";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

48
pkgs/python/django-structlog/default.nix Normal file
View File

@@ -0,0 +1,48 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
asgiref,
django,
django-ipware,
structlog,
celery,
django-extensions,
}:
buildPythonPackage rec {
pname = "django-structlog";
version = "9.1.1";
pyproject = true;
src = fetchFromGitHub {
owner = "jrobichaud";
repo = "django-structlog";
rev = version;
hash = "sha256-SEigOdlXZtfLAgRgGkv/eDNDAiiHd7YthRJ/H6e1v5U=";
};
build-system = [ setuptools ];
dependencies = [
asgiref
django
django-ipware
structlog
];
optional-dependencies = {
celery = [ celery ];
commands = [ django-extensions ];
};
pythonImportsCheck = [ "django_structlog" ];
meta = {
description = "";
homepage = "https://github.com/jrobichaud/django-structlog";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

39
pkgs/python/django-user-sessions/default.nix Normal file
View File

@@ -0,0 +1,39 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
setuptools-scm,
wheel,
django,
}:
buildPythonPackage rec {
pname = "django-user-sessions";
version = "2.0.0";
pyproject = true;
src = fetchFromGitHub {
owner = "jazzband";
repo = "django-user-sessions";
rev = version;
hash = "sha256-Wexy6G2pZ8LTnqtJkBZIePV7qhQW8gu/mKiQfZtgf/o=";
};
build-system = [
setuptools
setuptools-scm
wheel
];
dependencies = [ django ];
pythonImportsCheck = [ "user_sessions" ];
meta = {
description = "Extend Django sessions with a foreign key back to the user, allowing enumerating all user's sessions";
homepage = "http://github.com/jazzband/django-user-sessions";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

38
pkgs/python/django-weasyprint/default.nix Normal file
View File

@@ -0,0 +1,38 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
django,
weasyprint,
}:
buildPythonPackage rec {
pname = "django-weasyprint";
version = "2.4.0";
pyproject = true;
src = fetchFromGitHub {
owner = "fdemmer";
repo = "django-weasyprint";
rev = "v${version}";
hash = "sha256-eSh1p+5MyYb6GIEgSdlFxPzVCenlkwSCTkTzgKjezIg=";
};
build-system = [ setuptools ];
dependencies = [
django
weasyprint
];
pythonImportsCheck = [ "django_weasyprint" ];
meta = {
description = "A Django class-based view generating PDF resposes using WeasyPrint";
homepage = "https://github.com/fdemmer/django-weasyprint";
changelog = "https://github.com/fdemmer/django-weasyprint/blob/${src.rev}/CHANGELOG.md";
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ ];
};
}

37
pkgs/python/django-xforwardedfor-middleware/default.nix Normal file
View File

@@ -0,0 +1,37 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
django,
}:
buildPythonPackage rec {
pname = "django-xforwardedfor-middleware";
version = "2.0";
pyproject = true;
src = fetchFromGitHub {
owner = "allo-";
repo = "django-xforwardedfor-middleware";
rev = "v${version}";
hash = "sha256-dDXSb17kXOSeIgY6wid1QFHhUjrapasWgCEb/El51eA=";
};
build-system = [
setuptools
wheel
];
dependencies = [ django ];
pythonImportsCheck = [ "x_forwarded_for" ];
meta = {
description = "Use the X-Forwarded-For header to get the real ip of a request";
homepage = "https://github.com/allo-/django-xforwardedfor-middleware";
license = lib.licenses.publicDomain;
maintainers = with lib.maintainers; [ ];
};
}

74
pkgs/python/pip-licenses/default.nix Normal file
View File

@@ -0,0 +1,74 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
setuptools-scm,
wheel,
prettytable,
tomli,
autopep8,
black,
docutils,
isort,
mypy,
pip-tools,
pypandoc,
pytest-cov,
pytest-pycodestyle,
pytest-runner,
tomli-w,
twine,
}:
buildPythonPackage rec {
pname = "pip-licenses";
version = "5.0.0";
pyproject = true;
src = fetchFromGitHub {
owner = "raimon49";
repo = "pip-licenses";
rev = "v-${version}";
hash = "sha256-6xw6BCuXSzNcwkpHaEFC5UPpubPUwhx/pg6vZq2er7A=";
};
build-system = [
setuptools
setuptools-scm
wheel
];
dependencies = [
prettytable
tomli
];
optional-dependencies = {
dev = [
autopep8
black
docutils
isort
mypy
pip-tools
pypandoc
pytest-cov
pytest-pycodestyle
pytest-runner
tomli-w
twine
wheel
];
};
pythonImportsCheck = [ "piplicenses" ];
meta = {
description = "Dump the license list of packages installed with pip";
homepage = "https://github.com/raimon49/pip-licenses";
changelog = "https://github.com/raimon49/pip-licenses/blob/${src.rev}/CHANGELOG.md";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

42
pkgs/python/py-moneyed/default.nix Normal file
View File

@@ -0,0 +1,42 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
babel,
typing-extensions,
}:
buildPythonPackage rec {
pname = "py-moneyed";
version = "3.0";
pyproject = true;
src = fetchFromGitHub {
owner = "py-moneyed";
repo = "py-moneyed";
rev = "v${version}";
hash = "sha256-k0ZbLwog6TYxKDLZV7eH1Br8buMPfpOkgp+pMN/qdB8=";
};
build-system = [
setuptools
wheel
];
dependencies = [
babel
typing-extensions
];
pythonImportsCheck = [ "moneyed" ];
meta = {
description = "Provides Currency and Money classes for use in your Python code";
homepage = "http://github.com/py-moneyed/py-moneyed";
changelog = "https://github.com/py-moneyed/py-moneyed/blob/${src.rev}/CHANGES.rst";
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [ ];
};
}

43
pkgs/python/sentry-sdk/default.nix Normal file
View File

@@ -0,0 +1,43 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
setuptools,
wheel,
certifi,
urllib3,
}:
buildPythonPackage rec {
pname = "sentry-sdk";
version = "2.26.1";
pyproject = true;
src = fetchFromGitHub {
owner = "getsentry";
repo = "sentry-python";
rev = version;
hash = "sha256-Wl8yq2X9GuPcqaS93hkKXs2cDzz282Xceaai4NjbVZY=";
fetchSubmodules = true;
};
build-system = [
setuptools
wheel
];
dependencies = [
certifi
urllib3
];
pythonImportsCheck = [ "sentry_sdk" ];
meta = {
description = "The official Python SDK for Sentry.io";
homepage = "https://github.com/getsentry/sentry-python";
changelog = "https://github.com/getsentry/sentry-python/blob/${src.rev}/CHANGELOG.md";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ ];
};
}

32
pkgs/think-backend-gtcm.nix
View File

@@ -1,32 +0,0 @@
{
fetchgit,
php,
dataDir ? "/var/lib/think-backend-gtcm",
}:
let
repoSrc = fetchgit {
url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
rev = "7c17aa78436538241c09fc7d633904d3c063011e";
hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
};
src = "${repoSrc}/think-backend.greaterchiangmai.com";
in
php.buildComposerProject2 (finalAttrs: {
pname = "think-backend-gtcm";
version = "1.0.0";
inherit src;
installPhase = ''
runHook preInstall
mkdir -p $out
cp -R * $out
rm -rf $out/storage
ln -s ${dataDir}/.env $out/.env
ln -s ${dataDir}/storage $out/storage
runHook postInstall
'';
composerStrictValidation = false;
vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
})

32
pkgs/think-gtcm.nix
View File

@@ -1,32 +0,0 @@
{
fetchgit,
php,
dataDir ? "/var/lib/think-gtcm",
}:
let
repoSrc = fetchgit {
url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
rev = "7c17aa78436538241c09fc7d633904d3c063011e";
hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
};
src = "${repoSrc}/think.greaterchiangmai.com";
in
php.buildComposerProject2 (finalAttrs: {
pname = "think-gtcm";
version = "1.0.0";
inherit src;
installPhase = ''
runHook preInstall
mkdir -p $out
cp -R * $out
rm -rf $out/storage
ln -s ${dataDir}/.env $out/.env
ln -s ${dataDir}/storage $out/storage
runHook postInstall
'';
composerStrictValidation = false;
vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
})

39
routers/white-house/configuration.nix
View File

@@ -25,7 +25,6 @@ in
"${inputs.liminix}/modules/vlan"
"${inputs.liminix}/modules/ssh"
"${inputs.liminix}/modules/bridge"
"${inputs.liminix}/modules/health-check"
"${modulesPath}/profiles/gateway.nix"
];
@@ -49,46 +48,14 @@ in
name = "resolvconf";
up = ''
( in_outputs ${name}
echo "nameserver 208.67.222.222" >> resolv.conf
echo "nameserver 208.67.220.220" >> resolv.conf
echo "nameserver 1.1.1.1" >> resolv.conf
echo "nameserver 1.0.0.1" >> resolv.conf
echo "nameserver 8.8.8.8" >> resolv.conf
echo "nameserver $(output ${config.services.wan} ns1)" > resolv.conf
echo "nameserver $(output ${config.services.wan} ns2)" >> resolv.conf
chmod 0444 resolv.conf
)
'';
}
);
services.reAddDefaultroute =
let
threshold = 3;
healthCheck = pkgs.writeAshScript "ping-check" { } "ping 1.1.1.1";
in
pkgs.liminix.services.longrun rec {
# dependencies = [ config.services.wan ];
name = "hack-default-route";
run = ''
fails=0
while sleep 10 ; do
${healthCheck}
if test $? -gt 0; then
fails=$(expr $fails + 1)
else
fails=0
fi
echo fails $fails/${toString threshold} for ${name}
if test "$fails" -gt "${toString threshold}" ; then
echo [+] adding default route
${config.services.defaultroute4}/${config.services.defaultroute4.name}/up
${config.services.defaultroute6}/${config.services.defaultroute6.name}/up
echo bounced
fails=0
fi
done
'';
};
profile.gateway = {
lan = {
interfaces = with config.hardware.networkInterfaces; [
@@ -156,7 +123,7 @@ in
defaultProfile.packages = with pkgs; [
busybox
iw
nftables
iptables
];
}

6
sops/machines/adhil/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
"type": "age"
}
]

6
sops/machines/almach/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age1m2e4c3gv7mxyg839gf0lfsh8wvygx3rn8u5cwnn99vw2w43ssers40tlq8",
"type": "age"
}
]

6
sops/machines/alpheratz/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age17c9908f08w2w0ajprep4p60a7hd27cznrnxmq4mxwznvgzjuhymsxttd3d",
"type": "age"
}
]

6
sops/machines/buna/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
"type": "age"
}
]

6
sops/machines/mirach/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age15k6cz0lj207608gdlgxq6l2n5zsflvg0lw8qqlvkyk0xddc4kqvq9nh6ex",
"type": "age"
}
]

6
sops/machines/neptune/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
"type": "age"
}
]

6
sops/machines/ramus/key.json
View File

@@ -1,6 +0,0 @@
[
{
"publickey": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
"type": "age"
}
]

1
sops/secrets/adhil-age.key/groups/admins
View File

@@ -1 +0,0 @@
../../../groups/admins

46
sops/secrets/adhil-age.key/secret
View File

@@ -1,46 +0,0 @@
{
"data": "ENC[AES256_GCM,data:DXK8BjWBriLUvOP2jz+48QP87iolYrob32o2D13EID/wiRoJDzz4Txr1AobrHa1NU791coXU2r7gteWA5KjYudXEgQW2opDjPFw=,iv:jLBLq3KqTvuntbLLCCMB8cVTGejetM7oGYV2j9rRlrw=,tag:0h3UtQ4tTDgGxksKmRoSVw==,type:str]",
"sops": {
"age": [
{
"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBET3d5UTJRNExVRkppSE5I\ncG02V0lDcGZnTmdLRVBkWUlWS3hUaWVaa1NJCkV3V2pseDFQV3RvR0N4cjNqaEk4\naGRkaDBMQnJIc1BlMCtvVW94M0dkYTAKLS0tIHRySkpXMzJiMzFrUU1UekdPUmVi\nMmZiRXBSc3FXMndVNjRqc2xTSlU3RTAK/erwb450pgiQAdYQlrVe32BEiaFIthl2\nUVQTCHQILnxyfC19ZOmlAnSuhXXrj7XdAQmK40DLb0A52QpFC2EP9w==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0dFdWFOdGgrR0hsemYr\nOGpFV1VqQS8vRHA3UURXMEQ2ZDJHcWNCVzBZCitvZTZYdDYzYm8xQzlYNHNVYmRt\nMWNzbitjaUxMSXN5WHp2SVhPY29XY0EKLS0tIGJOSUFBOU1RMHBnQWJsQkg0cFlp\nZ2c5QU5aeDlUMG1KTlMzQ1FPMldTeEUKxyt4xdySOfB8Fa8KjPytjjq0oGgeFBlo\n+uT97/DvDbiBfGaZPaSyJPRP+Mca0yQz9nltCOm7qz68BEjboFKUEw==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGU1YU05Y1Zm\nZ0Q4RDB5ZFc4cndmaTVTRXc1MXNmdllocGdVa2xrREQwa1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPNEJKRkdxc1RkRWJ5d3diQzhuTjBy\nV1VNYXRKV2JXMGpPbWEycUlJSUh3Ci0tLSB2Y2dMV0M2OWwyUVRzZVNCZm91a3FL\nQnlFTjV0dnFhZWkxd2tNOWZScUMwCri3NvW7zXusWvELSRNc4kLfAc6JTbR8q4KS\nqu8E80e4gwng53PpHkmK0pBRYnJbZUf5DPITOy1mrbnNGMh6Nbs=\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI3YWUzWWxp\nUSszSGNybG9oMitaUXludExlKzVOVFNNVkJteFpadWhtMDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiTDJ2VGI5VjZZU0xKdTY4czhiT0RP\nbmZtU1ZQZERLNzk0MHpQM2gzdTVNCi0tLSBheWw4OVk5SzJYbW5ZZWl6SFRraXVK\nKzgrODM2alJON1FqTXczOW5JaWN3CpdplHYscbileaUWp0wSuirTOZUefZNUkbyh\nCqwS2/3JZ2IMhAYLfLoeVRbp7OrncmQF7L3KuvPPaE7WjAYwYug=\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRMU0NKM2Fh\nQm9uYzYwQnNSWUdReGV1QXFXaXRORUJobURKOTFBbFoxRm8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSVVgrL3RicHh2OEgvbC9xSzhjKzNz\nYnRIa0Qyc1I1cUhVZmJkSGk5YU1nCi0tLSBPb3Nud0Q3TjZMMkJvRGZNWklQSlFZ\nNHVndHNjZmljVExmNzNYdzRrZmJRCgwWFdIGjZJfugyk8GSk9zPE/cgERs9E48S9\nVjUEetmVvRPj3jOsseyrF8KF4ZAppo7u10WXKvTZOBTDISpCW0U=\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUoyTlhwOWVSNG1vbGdz\ncDJwc3ZTUjI4OUpLN3lnQWJvME0vbzkyTVJJCkJMbXUwbnVDMG5oNjVJR25wSVZw\nYjEyMWk2Y2pCa2N5ZTlka2tNTFVybXMKLS0tIE45akZVUWdsQmRUWFhuVmdhYTR5\nZ1hKVytCb2pvM0c5UDJlVVBUdXNxS2MKnQXRfa5eXzos/rAa3KUNtzKwXWuyqvU4\naMSGMpzI62JYrzv51od2sJVOPog0jrUsaIFx8rp6nuYsqRZ1fmDzKg==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUmdlRldqaFFrZWp5eU5y\nSTRPeTVHdVFOYldkYVdKcFl6dklRMXpVWTE4Ci9KWUhJcnREMzJyNExZSFk0TFJl\nYmlVK1E5ZlFGWlJRZWwreVY3MWtHUzQKLS0tIElDNEl4UXFFNTJyODB6UnhaT3gw\nK1ViUzFLYjFTemcweERlaDNnR0FsaEkKJjG/XkynVLGQVdywXn0cM0db7X7aYrpP\nxYAUaS5SM7Ny0x3sEyP0+KdsWjBuHfi/CVsiTdBJ8CDpwkYSrpw5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnNpbUV3Z25weGFmTVg5\nOFV6cjl1eHJXemYzbitQNW9tSmNwaWdtQTA4Ci9ueHRSMndKVnJjVTFDQ044NEhs\nUEpuNnpSZDJjZzJuNjFMQ2ZVQWZ2b28KLS0tIE9LMjhPUndWNVBMR3QxQ041Qnc2\nbXR1U1VOWUxPd1ZBMzBxbGEvS2tFK2sKGnpSdS9f3sNFLstp8ONYTRqZVU7ujFAE\nqwTq4BJUlffEc9JXnvS/ZaC7O1yKmz8V5coKSHlbn+IyrZPbx9scaQ==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGd1emMzZkxPRjU1Ylcr\nRlVXbHBnTVV3eU9QU3NxYzBKYUJ5cVg1SXpjClNOYUZBNXMwdHJEVlNoRjdRZWVC\ndTluVVdtdkZDVDcwaGFGZUM4MEE3WUUKLS0tIGlHVVprTjhYQmJva1dQT0ZrdkE0\nNHZZTnhnWi94eURxR3ZCczlCeWxZVmsKOKXVYQAMftId6wXOsI+G/1/xPuVCLZOh\nrDzvaUbipkBTdZ/DXXvXf2f1fDcIqXXtPJyBD7Yh/6+KIPxf8wjVVA==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-12-09T04:18:54Z",
"mac": "ENC[AES256_GCM,data:VpfhhVlfPQB94009yErF8NJl+BbhBgc/dAPNyvqQzqORpXsPa9DXjae+giPkRXhTS+263NIglUbPiNqZedj0d9ep78gj/rCupmYcGSsX0gqwFfwj50xX0qWDgs6Z5b7QytDlDPiNOCYM287Q7XLob7CcvAM46Ulo3vx/QKD76Qc=,iv:SBwlzN4PIEPo/iZl/VpkcgNtxqlyNOjqi5y9UGzWQgI=,tag:0/0mKGEQtGOrXYSsn+inmw==,type:str]",
"version": "3.11.0"
}
}

1
sops/secrets/adhil-age.key/users/kurogeek
View File

@@ -1 +0,0 @@
../../../users/kurogeek

1
sops/secrets/almach-age.key/groups/admins
View File

@@ -1 +0,0 @@
../../../groups/admins

46
sops/secrets/almach-age.key/secret
View File

@@ -1,46 +0,0 @@
{
"data": "ENC[AES256_GCM,data:qkIwSe6DxrWpmUgMi6G8srenbwUuMHSKXgzL/nybITl8iXTfoLBucjlPp6JpBmfs2NdOEqWS2+QUcnVRAueH9rbABKeAVdoGdio=,iv:NHplT1IbuYfyq8n2Nqq6TBRFi+nTtOOreyprIlXwWHg=,tag:/BU417a9kYMhgexskyE0Qg==,type:str]",
"sops": {
"age": [
{
"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBObGdiWjBtTkR3alBDTEdm\nb25kbWY5WkFUd1dsanZ5M2FjQm11TnBVdWdZCnNOSE45cFMwallGRVZuMTdlVTBO\naTVnS29vQk9QZVJyaGRzTGNNcUdGQ00KLS0tICsxZ3NtVlVoc2FpQUMxSm9uZWF3\ncjZXcDVwZ0pUcDlqOGN2aGxmME43NXcK28S/SKkLgXJWQ5sdDxcGyoO74e0MaxeM\nx1kGfiKJBLqok+wNOPO9SFHbWY/ITH5RdV8iLchPBe2VM9IuC0nZ4g==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsb3dPMGhpdHE5SlBQK3hu\ncEJqL0JaZk1rOE5MS0krUHpyMUNMUkhyMFdzCmM3V25vS3U2WENycmZIRC81Y2k0\nSEJTekNaNTFMZy85VHh4MENvbUk3Uk0KLS0tIGExYUFNVlRZeThQRHlKVDZWU1Jn\ncUNRd1cwZU1SL3BKOGZZaFErR3F3NkUKnILS6XWSl2MaQ+FAZvRAZzgJxL4OWl+v\ntDxXBBCapOeoLgRH61Q06JnDjgBCz14QIROgZP9Zji/HsdSeRiKR0A==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhLejJLVEk2\nR0dtY0FJQUYyd3JObitPdEcweWVUang5ZUdEcTg1UlJUMFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpvUS80dk92MjBnN1N6Y284RGE4T0tR\nemN5Wks5dS9vdWRBTU1YYlo3UXBZCi0tLSBEb0pmU2xGMFFjazZ4em5uT0wyZUZW\nT1JqdjZjTDRwUUJLNzAvYTFreXp3Cqfcpn+UlJE63ymHbremaZ8X+wDDQw3gPGmX\nav9dmxfLCPLwwTbd3e8N98Jnc0OwGUiKTavtjpph9ygThvo86jE=\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNqaHoxdk83\nSnFNRXg4TzZLY3BSOXNSdWVrby90V1Q2Q2RRUi9xZGZ2Q1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpZM05YUEFYNEVRM0FSYkpKY05pc0hq\nWWRzTzFWSUZRNmI2NENDL3RyNVkwCi0tLSBPMURucGFSdHJER0tqUlRHb2NmNmYw\nVTZsN295QUJZQ1BObERGYjlESGUwCuYMMiu6NyO8Q/lvBHI7muzQOZfaL3Ny3S3E\nE7TlShnbLEsDxApvBV1KJaiYY21Z+1Up9DM0xQskFBYQCya3APo=\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEw4eHIya0RX\neE5Nalk3YWs2R1ZFcmp6OEIvSDhPMVlZYk5TcTQwbXBpMlkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYMURZbG5lNlYwMUdVSUtsRlJqWEhj\nbHdvZVdpTGt4ZzhRZERpWWJkbG5ZCi0tLSBJMG93d1ZPa1Z3WWVDSjJ2ZXEwRDJD\nQ0cyQUxlaTdycXhGVVRzSnAvakJvCgoORUSoqTGsS5hvnV3hJNIz1Y9pTR7foSz8\nXMd/f3TObHeokHsejbxx2yMDLPt5fD1MWc5MioLyMNMpwjqq+T8=\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYWZ3a1ljTVhQZFNHTGxP\nQnEzdm9QM1ZqMGZEMVF1UzczeG5LYW8wam44Cm9GKzc2c0M4dEgramE5VlBQK3NQ\nTkdlajFFRzU1aXorV0tuL2M5cENQRkEKLS0tIERWcFd0MXAzYVZOdlgxSDcybk1O\nMkQwM1l5UGRVaHdtNCsyR2Y0VXRSSkkK3Bmoxs/GeybD/cwQf2d8QGdTVa2tfKXp\nTExxPuwsrb+/uaooHbCefv35r8jAmH67fJPM8IjyrcmW9HQpvL9R6w==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SGlpbnpUejhLVVNBVWN0\nMklqalJvT2NTL1VhcVIyUDRMQTJ3cUdHVWtJCmpWV1B6QkRwUHZ6K2pzNDJFSmpi\nZWlpNXo0aXM3Qlk0ejlMWDZ3RXFLN1kKLS0tIFYyYnB4VmhWQUoxNmlBMXZQT3ZX\ndW55WktEOGhua3Y3a091a1ZLbXV6ZzgKqQ9g37DyZNJDyjarEKqnftB4l8JCyCpx\nVJLSsjC4kvQCMhRsgZuLZaoICNRgOQiPIW8+N+bqNQ/WxcoOZM2z1w==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z0x5NUJnK2RqYXNzT2l5\nbkd1UWgzTnFpcFQ1Y2RPQlFKSktRV3kvcFFrCkRyOXRDNHFHY2QrdGhrM2JEbzQ0\nb0xPb21qd2NjRGUzVUhBdW5sVkVld1kKLS0tIEVNQUwza3luSCtEblphYnBlbmJT\ndm5IMVJUc2hBVVRrZEROUzI0YllRVHMKIq8EbkeEXMDDh+MEQqkU7BtdlMTmeGYn\nHgizD8RFh4/0A2MifmMD/9OarqSNQXvQi8z2rTVctLMcLCfuAf53uQ==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOFFUdmRIQjVXblRGNjFq\nUmNaYUgzY2hsaXRrUXRZQzFrTWloUG5xbnh3Ck1hYWJXZytEQzJjWWVGblZ3WGhV\nc3FSNXpPMVU2ODdDL3RNT2FTT21iNXMKLS0tIC9xK3NGRnRudVQ5RFFsVGI5MEtF\nSlljWXhUVXVhc2JmZ3k2RE43ak1ScGcKGaUeC/5UFHVLu9NETJTIVsOd+NnXphZ0\nQImkKtlJXxQ4OBJWGP7Ybm5h4mWiqqVWIrkodyH+qo1/EyOwZ7OjgA==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-12-03T07:06:11Z",
"mac": "ENC[AES256_GCM,data:rEbXQH/lqWkL6EG+DoRNQtNTY0rIXQDR5aK/VFfZLCQw5RYTOdnnAeK93z5uV/jSJ6PdwCPFLbCKF34+aKwSS1xVrLp2oZb0aK1J85sP5V41+r385rxB/0BZP7dk4IaAkEOnU39qoyo0hCYROJ95V+97JhdvV7Y0l2zXypdLuNM=,iv:MqXHtyaOb4di969TLoAyhl0Kpo/JsfUU6pS9Jwes2oI=,tag:2JSV57+uAEQPNm8ODmCocQ==,type:str]",
"version": "3.11.0"
}
}

1
sops/secrets/almach-age.key/users/kurogeek
View File

@@ -1 +0,0 @@
../../../users/kurogeek

Some files were not shown because too many files have changed in this diff Show More