Cloonar/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: Cloonar:25580ded3bbb9ff805e036fb32b62d2205570315
Branches Tags
Cloonar:master
...
compare: Cloonar:d140a20ed95e8f6a00823ca446050f184a7fab2b
Branches Tags
Cloonar:master

4 commits
25580ded3b ... d140a20ed9

Author SHA1 Message Date
Dominik Polakovics
d140a20ed9 feat: remove tmux from dev and add claude resume shortcut 2026-02-01 15:47:41 +01:00
Dominik Polakovics
0af3423147 feat: add dev host to fleet 2026-02-01 15:36:29 +01:00
Dominik Polakovics
646bbde71c feat: forgejo alerts 2026-02-01 15:23:25 +01:00
Dominik Polakovics
f5a0bc582d feat: fw final switch to forgejo 2026-02-01 15:23:10 +01:00
10 changed files with 31 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

4
fleet.nix
View file

@ -51,6 +51,10 @@
username = "nas"; username = "nas";
key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICS6b97LPUpr7/kWvOcI40s5e+gfbfz0I2/hAPL6zTmU"; key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICS6b97LPUpr7/kWvOcI40s5e+gfbfz0I2/hAPL6zTmU";
} }
{
username = "dev";
key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICS6b97LPUpr7/kWvOcI40s5e+gfbfz0I2/hAPL6zTmU";
}
{ {
username = "amzebs-01"; username = "amzebs-01";

15
hosts/dev/configuration.nix
View file

@ -55,13 +55,18 @@ in
programs.zsh.enable = true; programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh; users.defaultUserShell = pkgs.zsh;
# Auto-attach to tmux on SSH login # Welcome message with Claude Code reminder
environment.interactiveShellInit = '' users.motd = ''
if [[ -n "$SSH_CONNECTION" ]] && [[ -z "$TMUX" ]]; then Welcome to dev
tmux attach-session -t main 2>/dev/null || tmux new-session -s main
fi Claude Code: claude or cr (resume last session)
''; '';
# Short alias for resuming Claude sessions
programs.zsh.shellAliases = {
cr = "claude --resume";
};
# Passwordless sudo for dominik # Passwordless sudo for dominik
security.sudo.extraRules = [{ security.sudo.extraRules = [{
users = [ "dominik" ]; users = [ "dominik" ];

6
hosts/fw/configuration.nix
View file

@ -32,7 +32,6 @@
# microvm # microvm
./modules/microvm.nix ./modules/microvm.nix
./modules/gitea-vm.nix
./modules/forgejo-runner.nix ./modules/forgejo-runner.nix
./modules/dev-microvm.nix ./modules/dev-microvm.nix
# ./modules/vscode-server.nix # Add VS Code Server microvm # ./modules/vscode-server.nix # Add VS Code Server microvm
@ -45,8 +44,7 @@
./modules/web ./modules/web
# git # git
./modules/gitea.nix ./modules/forgejo.nix
./modules/forgejo.nix # Migration: autoStart=false, start after migration script
# ./modules/fwmetrics.nix # ./modules/fwmetrics.nix
# ha customers # ha customers
@ -81,7 +79,7 @@
networkPrefix = "10.42"; networkPrefix = "10.42";
# Systemd services to monitor # Systemd services to monitor
services.victoriametrics.monitoredServices = [ "ai-mailer" "container@git" "microvm@git-runner-" "microvm@fj-runner-" ]; services.victoriametrics.monitoredServices = [ "ai-mailer" "container@forgejo" "microvm@fj-runner-" ];
nixpkgs.overlays = [ nixpkgs.overlays = [
(import ./utils/overlays/packages.nix) (import ./utils/overlays/packages.nix)

3
hosts/fw/modules/dnsmasq.nix
View file

@ -103,8 +103,7 @@
"/mopidy.cloonar.com/${config.networkPrefix}.97.21" "/mopidy.cloonar.com/${config.networkPrefix}.97.21"
"/snapcast.cloonar.com/${config.networkPrefix}.97.21" "/snapcast.cloonar.com/${config.networkPrefix}.97.21"
"/lms.cloonar.com/${config.networkPrefix}.97.21" "/lms.cloonar.com/${config.networkPrefix}.97.21"
"/git.cloonar.com/${config.networkPrefix}.97.50" "/git.cloonar.com/${config.networkPrefix}.97.55"
"/forgejo.cloonar.com/${config.networkPrefix}.97.55"
"/feeds.cloonar.com/188.34.191.144" "/feeds.cloonar.com/188.34.191.144"
"/nukibridge1a753f72.cloonar.smart/${config.networkPrefix}.100.112" "/nukibridge1a753f72.cloonar.smart/${config.networkPrefix}.100.112"
"/allywatch.cloonar.com/${config.networkPrefix}.97.5" "/allywatch.cloonar.com/${config.networkPrefix}.97.5"

4
hosts/fw/modules/firewall.nix
View file

@ -118,7 +118,7 @@
iifname "smart" oifname "server" ip daddr ${config.networkPrefix}.97.20/32 tcp dport { 1883 } counter accept iifname "smart" oifname "server" ip daddr ${config.networkPrefix}.97.20/32 tcp dport { 1883 } counter accept
# Forward to git server # Forward to git server
oifname "server" ip daddr ${config.networkPrefix}.97.50 tcp dport { 22 } counter accept oifname "server" ip daddr ${config.networkPrefix}.97.55 tcp dport { 22 } counter accept
oifname "server" ip daddr ${config.networkPrefix}.97.5 tcp dport { 80, 443 } counter accept oifname "server" ip daddr ${config.networkPrefix}.97.5 tcp dport { 80, 443 } counter accept
# lan and vpn to any # lan and vpn to any
@ -167,7 +167,7 @@
chain prerouting { chain prerouting {
type nat hook prerouting priority filter; policy accept; type nat hook prerouting priority filter; policy accept;
iifname "server" ip daddr ${config.networkPrefix}.96.255 udp dport { 9 } dnat to ${config.networkPrefix}.96.255 iifname "server" ip daddr ${config.networkPrefix}.96.255 udp dport { 9 } dnat to ${config.networkPrefix}.96.255
iifname "wan" tcp dport { 22 } dnat to ${config.networkPrefix}.97.50 iifname "wan" tcp dport { 22 } dnat to ${config.networkPrefix}.97.55
iifname "wan" tcp dport { 80, 443 } dnat to ${config.networkPrefix}.97.5 iifname "wan" tcp dport { 80, 443 } dnat to ${config.networkPrefix}.97.5
iifname "wan" tcp dport { 5000 } dnat to ${config.networkPrefix}.97.51 iifname "wan" tcp dport { 5000 } dnat to ${config.networkPrefix}.97.51
iifname { "wan", "lan" } udp dport { 7777, 7778, 27015 } dnat to ${config.networkPrefix}.97.201 iifname { "wan", "lan" } udp dport { 7777, 7778, 27015 } dnat to ${config.networkPrefix}.97.201

2
hosts/fw/modules/forgejo-runner.nix
View file

@ -51,7 +51,7 @@ in {
services.gitea-actions-runner.instances.${runner} = { services.gitea-actions-runner.instances.${runner} = {
enable = true; enable = true;
url = "https://forgejo.cloonar.com"; url = "https://git.cloonar.com";
name = runner; name = runner;
tokenFile = "/run/secrets/forgejo-runner-token"; tokenFile = "/run/secrets/forgejo-runner-token";
labels = [ labels = [

11
hosts/fw/modules/forgejo.nix
View file

@ -19,13 +19,12 @@ in
users.users.forgejo = user; users.users.forgejo = user;
users.groups.forgejo = group; users.groups.forgejo = group;
# Reuse the existing git.cloonar.com ACME cert from gitea.nix security.acme.certs."git.cloonar.com" = {
security.acme.certs."forgejo.cloonar.com" = {
group = "nginx"; group = "nginx";
}; };
containers.forgejo = { containers.forgejo = {
autoStart = false; # Don't start until migration is complete autoStart = true;
ephemeral = false; # because of ssh key ephemeral = false; # because of ssh key
privateNetwork = true; privateNetwork = true;
hostBridge = "server"; hostBridge = "server";
@ -37,8 +36,7 @@ in
isReadOnly = false; isReadOnly = false;
}; };
"/var/lib/acme/forgejo/" = { "/var/lib/acme/forgejo/" = {
# hostPath = config.security.acme.certs.${domain}.directory; hostPath = config.security.acme.certs.${domain}.directory;
hostPath = config.security.acme.certs."forgejo.cloonar.com".directory;
isReadOnly = true; isReadOnly = true;
}; };
"/run/secrets/forgejo-mailer-password" = { "/run/secrets/forgejo-mailer-password" = {
@ -146,7 +144,6 @@ in
sops.secrets.forgejo-mailer-password = { sops.secrets.forgejo-mailer-password = {
owner = "forgejo"; owner = "forgejo";
# restartUnits removed - would start the container even with autoStart=false restartUnits = [ "container@forgejo.service" ];
# Re-add after migration: restartUnits = [ "container@forgejo.service" ];
}; };
} }

8
hosts/fw/modules/web/proxies.nix
View file

@ -1,13 +1,5 @@
{ config, lib, ... }: { { config, lib, ... }: {
services.nginx.virtualHosts."git.cloonar.com" = { services.nginx.virtualHosts."git.cloonar.com" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "https://git.cloonar.com/";
};
};
services.nginx.virtualHosts."forgejo.cloonar.com" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
acmeRoot = null; acmeRoot = null;

5
hosts/web-arm/modules/grafana/alerting/service/services_down.nix
View file

@ -7,8 +7,9 @@ let
{ name = "Postfix"; service = "postfix.service"; instance = "mail:9100"; } { name = "Postfix"; service = "postfix.service"; instance = "mail:9100"; }
{ name = "Dovecot"; service = "dovecot.service"; instance = "mail:9100"; } { name = "Dovecot"; service = "dovecot.service"; instance = "mail:9100"; }
{ name = "OpenLDAP"; service = "openldap.service"; instance = "mail:9100"; } { name = "OpenLDAP"; service = "openldap.service"; instance = "mail:9100"; }
{ name = "Gitea"; service = "container@git.service"; instance = "fw:9100"; } { name = "Forgejo"; service = "container@forgejo.service"; instance = "fw:9100"; }
{ name = "Gitea Runner"; service = "microvm@git-runner-1.service"; instance = "fw:9100"; } { name = "Forgejo Runner 1"; service = "microvm@fj-runner-1.service"; instance = "fw:9100"; }
{ name = "Forgejo Runner 2"; service = "microvm@fj-runner-2.service"; instance = "fw:9100"; }
{ name = "WireGuard"; service = "wireguard-wg_cloonar.service"; instance = "fw:9100"; } { name = "WireGuard"; service = "wireguard-wg_cloonar.service"; instance = "fw:9100"; }
{ name = "MySQL"; service = "mysql.service"; instance = "amzebs-01:9100"; } { name = "MySQL"; service = "mysql.service"; instance = "amzebs-01:9100"; }
{ name = "Nginx"; service = "nginx.service"; instance = "amzebs-01:9100"; } { name = "Nginx"; service = "nginx.service"; instance = "amzebs-01:9100"; }

8
hosts/web-arm/modules/prometheus.nix
View file

@ -118,10 +118,10 @@
description="homeassistant notification {{$labels.entity}} ({{$labels.friendly_name}}): {{$value}}" description="homeassistant notification {{$labels.entity}} ({{$labels.friendly_name}}): {{$value}}"
} }
ALERT gitea ALERT forgejo
IF rate(promhttp_metric_handler_requests_total{job="gitea", code="500"}[5m]) > 3 IF rate(promhttp_metric_handler_requests_total{job="forgejo", code="500"}[5m]) > 3
ANNOTATIONS { ANNOTATIONS {
description="{{$labels.instance}}: gitea instances error rate went up: {{$value}} errors in 5 minutes" description="{{$labels.instance}}: forgejo instances error rate went up: {{$value}} errors in 5 minutes"
} }
'' ''
]; ];
@ -198,7 +198,7 @@
]; ];
} }
{ {
job_name = "gitea"; job_name = "forgejo";
scrape_interval = "60s"; scrape_interval = "60s";
metrics_path = "/metrics"; metrics_path = "/metrics";