diff --git a/.sops.yaml b/.sops.yaml index d6cc05b..7f329f8 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -15,6 +15,7 @@ keys: - &netboot age14uarclad0ty5supc8ep09793xrnwkv8a4h9j0fq8d8lc92n2dadqkf64vw - &gpd-win4 age1ceg548u5ma6rgu3xgvd254y5xefqrdqfqhcjsjp3255q976fgd2qaua53d - &nb age1exny8unxynaw03yu8ppahu5z28uermghr8ag34e7kdqnaduq9stsyettzz + - &amzebs-01 age1xcgc6u7fmc2trgxtdtf5nhrd7axzweuxlg0ya9jre3sdrg6c6easecue9w creation_rules: - path_regex: ^[^/]+\.yaml$ @@ -71,6 +72,14 @@ creation_rules: - *dominik2 - *nb - *web-arm + - path_regex: hosts/amzebs-01/[^/]+\.yaml$ + key_groups: + - age: + - *bitwarden + - *dominik + - *dominik2 + - *nb + - *amzebs-01 - path_regex: hosts/mail/[^/]+\.yaml$ key_groups: - age: @@ -120,6 +129,7 @@ creation_rules: - *netboot - *fw - *fw-new + - *amzebs-01 - path_regex: utils/modules/victoriametrics/[^/]+\.yaml$ key_groups: - age: @@ -132,3 +142,4 @@ creation_rules: - *netboot - *fw - *fw-new + - *amzebs-01 diff --git a/fleet.nix b/fleet.nix index 65144e9..bc49e64 100644 --- a/fleet.nix +++ b/fleet.nix @@ -47,6 +47,10 @@ username = "gpd-win4"; key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILjfS2DtS8PQgkf86dU+EVu5t+r/QlCWmY7+RPYprQrO"; } + { + username = "amzebs-01"; + key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINMkFZ60SPl8pzEtGrFq1+n6ZkDuNe3xJaccJMjr3y/q"; + } ]; in { imports = builtins.map create_users users; diff --git a/hosts/amzebs-01/configuration.nix b/hosts/amzebs-01/configuration.nix index 4e467e1..28c34a6 100644 --- a/hosts/amzebs-01/configuration.nix +++ b/hosts/amzebs-01/configuration.nix @@ -6,9 +6,11 @@ ./modules/mysql.nix ./modules/web/stack.nix + ./modules/laravel-storage.nix ./utils/modules/autoupgrade.nix ./utils/modules/promtail + ./utils/modules/victoriametrics ./utils/modules/borgbackup.nix ./hardware-configuration.nix diff --git a/hosts/amzebs-01/hardware-configuration.nix b/hosts/amzebs-01/hardware-configuration.nix index eab29d8..c6895f0 100644 --- a/hosts/amzebs-01/hardware-configuration.nix +++ b/hosts/amzebs-01/hardware-configuration.nix @@ -13,7 +13,7 @@ # Update these with actual device UUIDs and paths after installation fileSystems."/boot" = { - device = "/dev/disk/by-uuid/CHANGEME"; + device = "/dev/sda15"; fsType = "vfat"; }; diff --git a/hosts/amzebs-01/modules/laravel-storage.nix b/hosts/amzebs-01/modules/laravel-storage.nix new file mode 100644 index 0000000..92e8884 --- /dev/null +++ b/hosts/amzebs-01/modules/laravel-storage.nix @@ -0,0 +1,27 @@ +{ ... }: +{ + # Create Laravel storage directories for all API instances + # These directories are required for Laravel to function properly + systemd.tmpfiles.rules = [ + # api.ebs.cloonar.dev + "d /var/www/api.ebs.cloonar.dev/storage/framework/cache 0775 api_ebs_cloonar_dev nginx -" + "d /var/www/api.ebs.cloonar.dev/storage/framework/sessions 0775 api_ebs_cloonar_dev nginx -" + "d /var/www/api.ebs.cloonar.dev/storage/framework/views 0775 api_ebs_cloonar_dev nginx -" + "d /var/www/api.ebs.cloonar.dev/storage/logs 0775 api_ebs_cloonar_dev nginx -" + "d /var/www/api.ebs.cloonar.dev/bootstrap/cache 0775 api_ebs_cloonar_dev nginx -" + + # api.ebs.amz.at + "d /var/www/api.ebs.amz.at/storage/framework/cache 0775 api_ebs_amz_at nginx -" + "d /var/www/api.ebs.amz.at/storage/framework/sessions 0775 api_ebs_amz_at nginx -" + "d /var/www/api.ebs.amz.at/storage/framework/views 0775 api_ebs_amz_at nginx -" + "d /var/www/api.ebs.amz.at/storage/logs 0775 api_ebs_amz_at nginx -" + "d /var/www/api.ebs.amz.at/bootstrap/cache 0775 api_ebs_amz_at nginx -" + + # api.stage.ebs.amz.at + "d /var/www/api.stage.ebs.amz.at/storage/framework/cache 0775 api_stage_ebs_amz_at nginx -" + "d /var/www/api.stage.ebs.amz.at/storage/framework/sessions 0775 api_stage_ebs_amz_at nginx -" + "d /var/www/api.stage.ebs.amz.at/storage/framework/views 0775 api_stage_ebs_amz_at nginx -" + "d /var/www/api.stage.ebs.amz.at/storage/logs 0775 api_stage_ebs_amz_at nginx -" + "d /var/www/api.stage.ebs.amz.at/bootstrap/cache 0775 api_stage_ebs_amz_at nginx -" + ]; +} diff --git a/hosts/amzebs-01/modules/mysql.nix b/hosts/amzebs-01/modules/mysql.nix index f506bf7..ff416ee 100644 --- a/hosts/amzebs-01/modules/mysql.nix +++ b/hosts/amzebs-01/modules/mysql.nix @@ -13,17 +13,31 @@ bind-address = "0.0.0.0"; }; }; + }; - # Create read-only user for remote access on initial MySQL setup - initialScript = pkgs.writeShellScript "mysql-init.sql" '' + # Create read-only user for remote access after MySQL starts + systemd.services.mysql-setup-readonly-user = { + description = "Setup MySQL read-only user"; + after = [ "mysql.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + User = "root"; + }; + script = '' PASSWORD=$(cat ${config.sops.secrets.mysql-readonly-password.path}) ${pkgs.mariadb}/bin/mysql -u root <