mirror of https://gitlab.crans.org/nounous/nixos
Suppression chene (passage sur debian)
pigeonmoelleux
parent
58c435f98b
commit
aff8abfd8f
12
.sops.yaml
12
.sops.yaml
|
|
@ -1,6 +1,5 @@
|
||||||
keys:
|
keys:
|
||||||
# Hosts keys are age keys derived from the host ssh key.
|
# Hosts keys are age keys derived from the host ssh key.
|
||||||
- &chene age1p9h7wl3j2fl40gacknt4y95rqkaat8gntrqesx05xcg6yav8tuuqxrqv7h
|
|
||||||
- &neo age1ed9esfstrdhfl3650mv4j3mjyum70245f903ye6g0f5t2ept73nqyksh3g
|
- &neo age1ed9esfstrdhfl3650mv4j3mjyum70245f903ye6g0f5t2ept73nqyksh3g
|
||||||
- &redite age1utlywxylme0z3jenv4uz8ftcwteg9877y3zf46fu7zwjjwa05g7q88w8t0
|
- &redite age1utlywxylme0z3jenv4uz8ftcwteg9877y3zf46fu7zwjjwa05g7q88w8t0
|
||||||
- &two age1zlpu6qum5xcl07hnsndp78tllqph5jz7q8fr5ntxr88202xq9u9s9r2y7x
|
- &two age1zlpu6qum5xcl07hnsndp78tllqph5jz7q8fr5ntxr88202xq9u9s9r2y7x
|
||||||
|
|
@ -18,7 +17,6 @@ creation_rules:
|
||||||
- *_aeltheos
|
- *_aeltheos
|
||||||
- *_pigeonmoelleux
|
- *_pigeonmoelleux
|
||||||
age :
|
age :
|
||||||
- *chene
|
|
||||||
- *neo
|
- *neo
|
||||||
- *redite
|
- *redite
|
||||||
- *two
|
- *two
|
||||||
|
|
@ -29,13 +27,3 @@ creation_rules:
|
||||||
- pgp:
|
- pgp:
|
||||||
- *_aeltheos
|
- *_aeltheos
|
||||||
- *_pigeonmoelleux
|
- *_pigeonmoelleux
|
||||||
|
|
||||||
# Secrets for chene.
|
|
||||||
- path_regex: secrets/chene.yaml
|
|
||||||
key_groups:
|
|
||||||
- pgp:
|
|
||||||
- *_aeltheos
|
|
||||||
- *_pigeonmoelleux
|
|
||||||
- *_korenstin
|
|
||||||
age :
|
|
||||||
- *chene
|
|
||||||
|
|
|
||||||
|
|
@ -28,11 +28,6 @@
|
||||||
|
|
||||||
flake = with nixpkgs.lib; {
|
flake = with nixpkgs.lib; {
|
||||||
nixosConfigurations = {
|
nixosConfigurations = {
|
||||||
chene = nixosSystem {
|
|
||||||
specialArgs = inputs;
|
|
||||||
modules = [ ./hosts/vm/chene ];
|
|
||||||
};
|
|
||||||
|
|
||||||
neo = nixosSystem {
|
neo = nixosSystem {
|
||||||
specialArgs = inputs;
|
specialArgs = inputs;
|
||||||
modules = [ ./hosts/vm/neo ];
|
modules = [ ./hosts/vm/neo ];
|
||||||
|
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{ ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./networking.nix
|
|
||||||
|
|
||||||
../../../modules
|
|
||||||
../../../modules/services/onlyoffice.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
networking.hostName = "chene";
|
|
||||||
boot.loader.grub.devices = [ "/dev/sda" ];
|
|
||||||
|
|
||||||
system.stateVersion = "23.11";
|
|
||||||
}
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/2f28760d-08fe-4614-8e58-1f6fb4482545";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.ens19.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
}
|
|
||||||
|
|
@ -1,53 +0,0 @@
|
||||||
{ ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
networking = {
|
|
||||||
interfaces = {
|
|
||||||
ens18 = {
|
|
||||||
|
|
||||||
ipv4 = {
|
|
||||||
addresses = [{
|
|
||||||
address = "172.16.10.148";
|
|
||||||
prefixLength = 24;
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
|
|
||||||
ipv6 = {
|
|
||||||
addresses = [{
|
|
||||||
address = "fd00::10:0:ff:fe01:4810";
|
|
||||||
prefixLength = 64;
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
ens19 = {
|
|
||||||
|
|
||||||
ipv4 = {
|
|
||||||
addresses = [{
|
|
||||||
address = "172.16.3.148";
|
|
||||||
prefixLength = 24;
|
|
||||||
}];
|
|
||||||
routes = [{
|
|
||||||
address = "0.0.0.0";
|
|
||||||
via = "172.16.3.99";
|
|
||||||
prefixLength = 0;
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
|
|
||||||
ipv6 = {
|
|
||||||
addresses = [{
|
|
||||||
address = "2a0c:700:3::ff:fe01:4803";
|
|
||||||
prefixLength = 64;
|
|
||||||
}];
|
|
||||||
routes = [{
|
|
||||||
address = "::";
|
|
||||||
via = "2a0c:700:3::ff:fe00:9903";
|
|
||||||
prefixLength = 0;
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,76 +0,0 @@
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
let
|
|
||||||
format = pkgs.formats.json { };
|
|
||||||
|
|
||||||
jwtSecretFileTemplate = format.generate "local.json" {
|
|
||||||
services = {
|
|
||||||
CoAuthoring = {
|
|
||||||
token = {
|
|
||||||
enable = {
|
|
||||||
request = {
|
|
||||||
inbox = true;
|
|
||||||
outbox = true;
|
|
||||||
};
|
|
||||||
browser = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
secret = {
|
|
||||||
inbox = {
|
|
||||||
string = "$ONLYOFFICE_PASS";
|
|
||||||
};
|
|
||||||
outbox = {
|
|
||||||
string = "$ONLYOFFICE_PASS";
|
|
||||||
};
|
|
||||||
session = {
|
|
||||||
string = "$ONLYOFFICE_PASS";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
jwtSecretFile = "/var/lib/onlyoffice/local.json";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets = {
|
|
||||||
onlyoffice-pass = {
|
|
||||||
sopsFile = ../../secrets/chene.yaml;
|
|
||||||
owner = "onlyoffice";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.onlyoffice = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
port = 8000;
|
|
||||||
|
|
||||||
hostname = "onlyoffice.crans.org";
|
|
||||||
postgresHost = "tealc.adm.crans.org";
|
|
||||||
postgresName = "onlyoffice";
|
|
||||||
postgresUser = "onlyoffice";
|
|
||||||
postgresPasswordFile = config.sops.secrets.onlyoffice-pass.path;
|
|
||||||
|
|
||||||
jwtSecretFile = jwtSecretFile;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.onlyoffice-docservice-secret = {
|
|
||||||
description = "Écriture du JWT Secret File pour OnlyOffice";
|
|
||||||
|
|
||||||
wantedBy = [ "onlyoffice-docservice.service" ];
|
|
||||||
before = [ "onlyoffice-docservice.service" ];
|
|
||||||
|
|
||||||
path = [ pkgs.envsubst ];
|
|
||||||
script = ''
|
|
||||||
ONLYOFFICE_PASS="$(<${config.sops.secrets.onlyoffice-pass.path})";
|
|
||||||
"envsubst -i ${jwtSecretFileTemplate} -o ${jwtSecretFile}"
|
|
||||||
'';
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
User = "onlyoffice";
|
|
||||||
Group = "onlyoffice";
|
|
||||||
|
|
||||||
Type = "simple";
|
|
||||||
StateDirectory = "onlyoffice";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,61 +0,0 @@
|
||||||
onlyoffice-pass: ENC[AES256_GCM,data:+BoxNQR+dunewcQJFpJCNPcOfcjaz5JS+A==,iv:/NYnwZrPWkzNSFAlMw1tAKSHcdzRCYuNjNqKcoieyYs=,tag:g90i7FneDpN/lM27hXFnjg==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1p9h7wl3j2fl40gacknt4y95rqkaat8gntrqesx05xcg6yav8tuuqxrqv7h
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQOVNlMzJVWGk2TDNzQ0RB
|
|
||||||
SnRRanVuc29YWS9ub2JBTGFXaE9pYWJXU0ZJCko3WCtwRVQ1V2JYTmM1RC9vQWl4
|
|
||||||
TXBwM1ZoK1lyTUlmTkd5WjhVVE5uYUkKLS0tIENhRmR3NTZNT1NZT3EvaHhpcDds
|
|
||||||
R0t6N3Rud2tkUWdTS0drMHdNOWNXWVkKq7wZ+ipcmbgQbriC7tvk6zADOreIMtMN
|
|
||||||
eWZWmxRL5aI7zeWe0/AbryatgurmYSoat4sTRembZkUOELmNPcwUlw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2024-06-21T18:07:38Z"
|
|
||||||
mac: ENC[AES256_GCM,data:7LBKELXBVj4iyTjp5lpRjLew80TurDMcu5Dv6gpnKedDxijqTtO/WEwXii1ySllRVwoErfDedpN2hervGEGii7a3+rQazHYxc9lQNdGouHEBI60bJpkeozLsdF1ePkQYrCxCZCIQnXj6rb3ib4Uxh9rkaojw3dIENmfKgFaGUFI=,iv:m0Hktx/XOJXh8vqt+M1XsRCUNtqFN7F+r/RusNg1wbs=,tag:nu+W4JzbYDCaAeBfSyGtQQ==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2024-06-21T18:07:20Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMAwEdD9k5IbiyAQ/9GIzyP4luwkNoZ5RXFCruzqmM15H+Lq5rpKsXB31j6aW0
|
|
||||||
xzA7SMyH3qTNBANJrFpmrAXxdAz5Vy7+VbaGPG74jDSe228xbzwGjY6olxuxAoR3
|
|
||||||
MtFaIpySNtW4jXXrL7XwJre1NtIndxaJncw4pObrYGORXMhyXYchEscPRumgX+Rf
|
|
||||||
pPiYOnyhExZQvhGPumzJlcBypiCVlfJnvMtg4ACmyMIZFSe62kPyrpYZCHJYE3T1
|
|
||||||
oSdkK94eV1LlqwcQiB0Fib2rWA8Mj7tU4LTfrTcYXTH87Gd68xo5M8Mnbj13+MLz
|
|
||||||
juFR5vjWwKVHA29hzI7JJQm4r/8othFJdFel4rn0z+aPI4ladlL+l5o+FQ2hoMWg
|
|
||||||
TsPXBE5S7nMNDQuDUCAWYcydJ3wuNcbh8yKusLN2KeDo/ShjuzHMrlzYtz7hxW4K
|
|
||||||
0NEVflqnginHtndjDPHj4C+K8074LP7uQ/W+ikSWLkIAX9h2JW3Q/0IOrEN2nggJ
|
|
||||||
NuLMCqf5o54dcO7AWBVXvDbik/ADcbXrsINUTsvpv2TAQ/ID4sYVvJTVbluXqnwx
|
|
||||||
9lRGO1mZvahvZN+DQ0keF3TV8G1ocHCVWUPRXQDXcWB9rMOh3xF1tKDMYhAZOJlg
|
|
||||||
ah812H1gPrHyF04Ohi5lc0cO2aUMBSey1rqhue2VjwwBdSIrFrpoYq3Vkt+UnkPS
|
|
||||||
XAGIWm+RXjwzI1QYYafFXN35FAScb1O9o9hOJT/tT3FEKuEWItTKt4boPrP6qfeY
|
|
||||||
ngbHQ1F76diVOGFHqsMdU+dioJpwELBuT6+/OxR3YAc1Wa5XMdJSQlhsjfRH
|
|
||||||
=2kF0
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: "0xDF6D6CE9E95E26E8"
|
|
||||||
- created_at: "2024-06-21T18:07:20Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA/HTIsSK0VBlARAAqMcFp7WL19VRmhZHXS6mmbABRuiPRLQ+Of+LpA7hRrlw
|
|
||||||
YI7qPcTqNHUgOl9uwuv3mSustX370mWBNaT7B8S/5URZCnvdtxqrVH/rGJUOk79x
|
|
||||||
sMkiyEHCJmkm/iykef1XF6tCZUoAMjuTNQbn1dn+bcj1AKdR9pVZcKvjmR90J2Ho
|
|
||||||
pfoSRxYcFI2zN8SN7EesMUJ59mOw3q8fLQAHlPi/QQI3fN09HG4PiV2q26QrlNTM
|
|
||||||
aru+y95kOBpsA/mFyjTG4axNG4cuKFMmq0mp1RJMeXpYB5MGBnKAhkP7jGAcDK9o
|
|
||||||
SUk5t+vRLD/KKj8ozDcjrM/YIGLZ+LNdfKO/eJL3yXSBZ7yZ2VWO4FlEXzEACusx
|
|
||||||
8H+EXVy3++0zFUQlcLgYrulwtJfEV0GhtB86pKsu5QQwvHz3EvK3sTLSQXNpkp8r
|
|
||||||
Z/0+Ja6ZMWT9wIfD34+HRvKScUSRm2SwcFnQx+Wp15pCA8lY/Vr39KkVolCNFB5O
|
|
||||||
gJ9pVQM02IH1Oc0x37/dOyDFQ0wvCx7lmxzyeuOrhq2i+Q8r4s9VU6MTbU/b/pZg
|
|
||||||
rbVwz0aiuOB54Q9IuXPyR0EGvkWjWvjrRseBOtHOkeqnH7Ri+swNBww07fYiqR76
|
|
||||||
EHvdLUuGWxz2TvDHgq/TnhDjA6VYv23x+Ip9Unlp3Et6ry0yLyia3Fb2HuRXJFvS
|
|
||||||
XAF2YtYgA2Hz7RjaL3Pm96LsTg6cDWdf5d1wtVG5nubrs44eKB+pJ2UlWWLKFrf3
|
|
||||||
48fkhzzWZ5DftwBI3hKiy1kZPvbOhydCCGS6t5ZqkEmWSHkyRX2TXOu+WqOh
|
|
||||||
=cmCK
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: "0xFA47BDA260489ADA"
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.8.1
|
|
||||||
Loading…
Reference in New Issue