setup colmena for deployment

hosts/freun-dev/configuration.nix

@@ -0,0 +1,142 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, ssh, ... }:
+
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "freun-dev"; # Define your hostname.
+  networking.domain = "freun.dev";
+  networking.useDHCP = false;
+  networking.nftables.enable = true;
+
+  systemd.network = {
+    enable = true;
+    networks.static = {
+      name = "enp1s0";
+      address = [
+        "65.21.145.150/32"
+        "2a01:4f9:c011:9ac1::1/64"
+      ];
+      routes = [
+        { Gateway = "fe80::1"; }
+        {
+          Gateway = "172.31.1.1";
+          GatewayOnLink = true;
+        }
+      ];
+      dns = [
+        # Hetzner
+        "185.12.64.1"
+        "185.12.64.2"
+        "2a01:4ff:ff00::add:1"
+        "2a01:4ff:ff00::add:2"
+        # Quad9
+        "9.9.9.9"
+        "149.112.112.112"
+        "2620:fe::fe"
+        "2620:fe::9"
+      ];
+    };
+  };
+
+  services.networkd-dispatcher = {
+    enable = true;
+    rules."50-tailscale" = {
+      onState = [ "routable" ];
+      script = ''
+        #!${pkgs.runtimeShell}
+        ${pkgs.ethtool}/bin/ethtool -K ${config.systemd.network.networks.static.name} rx-udp-gro-forwarding on rx-gro-list off
+      '';
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Helsinki";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkbOptions in tty.
+  # };
+
+
+  # Configure keymap in X11
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = [ pkgs.nh ];
+    openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+  };
+  users.users.root.openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+
+  nix.settings.trusted-users = [ "jokke" ];
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    htop
+    git
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  modules.firewall = {
+    enable = true;
+    allInterfaces = [ "ssh" ];
+  };
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.11"; # Did you read the comment?
+}

hosts/freun-dev/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./services.nix
+    ./secrets.nix
+  ];
+}

hosts/freun-dev/hardware-configuration.nix

@@ -0,0 +1,41 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_scsi" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/f594ffbc-4553-42e4-8206-4d762c94b4c3";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/46F1-18E3";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/d9955575-d4e0-4a49-a3c5-41f54110d12b"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/freun-dev/secrets.nix

@@ -0,0 +1,25 @@
+{ lib, config, ... }:
+{
+  age.secrets = lib.listToAttrs
+    (
+      map (secret: { name = secret; value = { file = ../../secrets/${secret}.age; }; }) [
+        "gotosocial"
+        "hastebin-tokens"
+        "immich"
+        "readeck"
+        "storage-box-credentials"
+        "vaultwarden"
+        "donetick"
+        "dnote"
+      ]
+    ) // {
+    smtp-password = {
+      file = ../../secrets/smtp-password.age;
+      owner =
+        if (config.services.grafana.enable) then
+          config.systemd.services.grafana.serviceConfig.User
+        else
+          "root";
+    };
+  };
+}

hosts/freun-dev/services.nix

@@ -0,0 +1,165 @@
+{ pkgs, config, ... }:
+let
+  immichDataDir = "/mnt/storage/immich";
+  syncthingDataDir = "/mnt/storage/syncthing";
+  smtp = {
+    host = "horologium.uberspace.de";
+    port = 587;
+    username = "noreply@${config.networking.domain}";
+    from = "noreply@${config.networking.domain}";
+    heloName = config.networking.domain;
+  };
+  secrets = config.age.secrets;
+in
+{
+  services.postgresql.package = pkgs.postgresql_16;
+  virtualisation.podman.enable = true;
+  virtualisation.oci-containers.backend = "podman";
+
+  modules.storageBoxMounts = {
+    ${immichDataDir} = {
+      path = "/backup/immich";
+      user = "u407959";
+      uid = config.users.users.${config.services.immich.user}.uid;
+      gid = config.users.groups.${config.services.immich.user}.gid;
+    };
+
+    ${syncthingDataDir} = {
+      path = "/backup/syncthing";
+      user = "u407959";
+      uid = config.users.users.${config.services.syncthing.user}.uid;
+      gid = config.users.groups.${config.services.syncthing.user}.gid;
+    };
+  };
+
+  services = {
+    hastebin = {
+      enable = true;
+      subdomain = "bin";
+    };
+
+    readeck = {
+      enable = true;
+      subdomain = "read";
+      settings.email = {
+        host = smtp.host;
+        port = smtp.port;
+        username = smtp.username;
+        encryption = "starttls";
+        from = smtp.from;
+        from_noreply = smtp.from;
+      };
+    };
+
+    donetick = {
+      enable = true;
+      subdomain = "do";
+      settings = {
+        email = {
+          host = smtp.host;
+          port = smtp.port;
+          email = smtp.username;
+        };
+      };
+    };
+
+    grafana = {
+      enable = true;
+      subdomain = "graph";
+      settings = {
+        server.http_port = 3005;
+        smtp = {
+          enabled = true;
+          host = smtp.host;
+          port = smtp.port;
+          user = smtp.username;
+          from_address = smtp.from;
+        };
+      };
+    };
+
+    owncast = {
+      enable = true;
+      subdomain = "stream";
+    };
+
+    gtrackmap = {
+      enable = true;
+      subdomain = "trackmap";
+      port = 3001;
+    };
+
+    invidious = {
+      enable = true;
+      subdomain = "vid";
+    };
+
+    syncthing = {
+      enable = true;
+      subdomain = "sync";
+      dataDir = syncthingDataDir;
+    };
+
+    tailscale.enable = true;
+
+    gotosocial = {
+      enable = true;
+      subdomain = "social";
+      settings = {
+        port = 3002;
+        smtp-host = smtp.host;
+        smtp-port = smtp.port;
+        smtp-username = smtp.username;
+        smtp-from = smtp.from;
+        instance-languages = [ "de" "fi" "en" ];
+      };
+    };
+
+    vaultwarden = {
+      enable = true;
+      subdomain = "pw";
+      config = {
+        YUBICO_CLIENT_ID = 86799;
+        SMTP_HOST = smtp.host;
+        SMTP_FROM = smtp.from;
+        SMTP_FROM_NAME = "Vaultwarden";
+        SMTP_USERNAME = smtp.username;
+        SMTP_PORT = smtp.port;
+        HELO_NAME = smtp.heloName;
+      };
+    };
+
+    workout-tracker = {
+      enable = true;
+      subdomain = "fit";
+      port = 3004;
+    };
+
+    workout-sync = {
+      enable = true;
+      subdomain = "ws";
+    };
+
+    immich = {
+      enable = true;
+      subdomain = "img";
+      mediaLocation = immichDataDir;
+      timezone = "Europe/Helsinki";
+      settings.job = {
+        thumbnailGeneration.concurrency = 8;
+        videoConversion.concurrency = 2;
+      };
+    };
+
+    dnote = {
+      enable = true;
+      subdomain = "note";
+      environment = {
+        SmtpHost = smtp.host;
+        SmtpPort = smtp.port;
+        SmtpUsername = smtp.username;
+      };
+      environmentFile = secrets.dnote.path;
+    };
+  };
+}