modules/system/containers: enable nat for container interfaces

assets/ssh.nix

@@ -14,6 +14,7 @@
     ude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDm3M/i/4wP2BM4+9hHAOMospwvlBZ+FT+pJtVgaaMq nikodem@rabulinski.com";
     kogata = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGK7H4Z29d72HJlI69Vt0YLOyuPcn9XxYjvMZfql80z0 nikodem@rabulinski.com";
     hijiri = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFXVPUBYAMn9H3efG/ldWl/ySmZV0CXleyH7E5nKf/N7 nikodem@rabulinski.com";
+    tsukasa = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPKXcihNVgsStMstnZYvh+Ai+JsydX3vu4O0yhlN+zw niko@tsukasa";
   };
 
   system = {
@@ -23,5 +24,6 @@
     ude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDZW15ObZ6XG776pdEvs9yqSuIiWlbGveEVA774Ri9/o root@ude";
     kogata = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPN/SXBcIB1WN8GIhYrQrqzFGuVkEP4o0E+x0uQ4f2l";
     hijiri = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILsTkICNuUwGqrToisTViFCBoql39+DFYVZSWj7vfbXK";
+    tsukasa = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKy32XGCkB0KOUm4f0ybrutfAzR7+baifM2yv5KuYV7 root@tsukasa";
   };
 }

hosts/default.nix

@@ -29,30 +29,15 @@
 
       baseNixos = inputs.nixpkgs.lib.nixosSystem {
         modules = [
-          inputs.agenix.nixosModules.age
+          self.nixosModules.combined
-          inputs.disko.nixosModules.disko
-          inputs.mailserver.nixosModules.default
-          inputs.home-manager.nixosModules.home-manager
-          inputs.nvidia-patch.nixosModules.nvidia-patch
-          inputs.attic.nixosModules.atticd
-          inputs.lix-module.nixosModules.default
-          self.nixosModules.settei
           sharedOptions
-          {
-            disabledModules = [
-              "services/networking/atticd.nix"
-            ];
-          }
         ];
         specialArgs.configurationName = "base";
       };
 
       baseDarwin = inputs.darwin.lib.darwinSystem {
         modules = [
-          inputs.agenix.darwinModules.age
+          self.darwinModules.combined
-          inputs.home-manager.darwinModules.home-manager
-          inputs.lix-module.nixosModules.default
-          self.darwinModules.settei
           sharedOptions
         ];
         specialArgs.configurationName = "base";

hosts/kazuki/default.nix

@@ -15,7 +15,6 @@
         ./storage.nix
         ./ntfy.nix
         ./zitadel.nix
-        ./forgejo.nix
         ./prometheus.nix
       ];
 

hosts/kazuki/forgejo.nix

@@ -1,62 +0,0 @@
-{ config, ... }:
-{
-  age.secrets.rab-lol-cf = {
-    file = ../../secrets/rab-lol-cf.age;
-    owner = config.services.nginx.user;
-  };
-
-  services.forgejo = {
-    enable = true;
-    settings = {
-      server = {
-        DOMAIN = "git.rab.lol";
-        ROOT_URL = "https://git.rab.lol/";
-      };
-      oauth2_client = {
-        REGISTER_EMAIL_CONFIRM = false;
-        ENABLE_AUTO_REGISTRATION = true;
-        ACCOUNT_LINKING = "auto";
-        UPDATE_AVATAR = true;
-      };
-      service = {
-        DISABLE_REGISTRATION = false;
-        ALLOW_ONLY_INTERNAL_REGISTRATION = false;
-        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-      };
-      federation.ENABLED = true;
-    };
-    repositoryRoot = "/storage-box/forgejo/repos";
-    lfs = {
-      enable = true;
-      contentDir = "/storage-box/forgejo/lfs";
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedTlsSettings = true;
-    virtualHosts."git.rab.lol" = {
-      forceSSL = true;
-      enableACME = true;
-      acmeRoot = null;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:3000";
-        extraConfig = ''
-          proxy_set_header Connection $http_connection;
-          proxy_set_header Upgrade $http_upgrade;
-        '';
-      };
-    };
-  };
-
-  users.users.nginx.extraGroups = [ "acme" ];
-  security.acme.acceptTerms = true;
-  security.acme.certs."git.rab.lol" = {
-    dnsProvider = "cloudflare";
-    credentialsFile = config.age.secrets.rab-lol-cf.path;
-    email = "nikodem@rabulinski.com";
-  };
-}

modules/default.nix

@@ -26,7 +26,24 @@ in
       inherit (config) perInput;
       isLinux = true;
     };
-    default = settei;
+    combined = {
+      imports = [
+        settei
+        inputs.agenix.nixosModules.age
+        inputs.disko.nixosModules.disko
+        inputs.mailserver.nixosModules.default
+        inputs.home-manager.nixosModules.home-manager
+        inputs.nvidia-patch.nixosModules.nvidia-patch
+        inputs.attic.nixosModules.atticd
+        inputs.lix-module.nixosModules.default
+        {
+          disabledModules = [
+            "services/networking/atticd.nix"
+          ];
+        }
+      ];
+    };
+    default = combined;
   };
 
   flake.darwinModules = rec {
@@ -34,6 +51,14 @@ in
       inherit (config) perInput;
       isLinux = false;
     };
-    default = settei;
+    combined = {
+      imports = [
+        settei
+        inputs.agenix.darwinModules.age
+        inputs.home-manager.darwinModules.home-manager
+        inputs.lix-module.nixosModules.default
+      ];
+    };
+    default = combined;
   };
 }

modules/system/containers.nix

@@ -75,7 +75,7 @@ let
         };
     };
 
-  linuxConfig = lib.optionalAttrs isLinux {
+  linuxConfig = lib.optionalAttrs (isLinux && config.settei.containers != {}) {
     containers = lib.mapAttrs (
       _: container:
       container
@@ -95,6 +95,11 @@ let
         privateNetwork = lib.mkForce true;
       }
     ) config.settei.containers;
+
+    networking.nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+    };
   };
 
   darwinConfig = lib.optionalAttrs (!isLinux) {

secrets/kanidm-admin-pass.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 84j9mw W4+Z4WjOyUl4mWPqVykNWRhf2/8qfVOSM7QCFPNMZTA
+0ndQjslMwjQqguN25nBQtCchpCLhoD/vrxh1yNVeTNw
+-> ssh-ed25519 GKhvwg H8XcFJDZTA3IzxmK6wbB+PVM2gCZ4ysAPjL5j0LgeE0
+kehTMRIVOZ5ubtO7w8WF+gU3sjYXMQtd5hH+wcv3uSE
+--- 72ntrRbWq8pdkk/GrsVupTttfY9t+w3l+2KQbQyNn/I
+iydìû$vVl TK$4G[€â· ©âMI[™#t—¹ °ôz:‰ñÍÙr9~½ESÃA»6Œ}×µ

secrets/kanidm-idm-admin-pass.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 84j9mw 8zYeVXx36dpC8TxMdoM1GdERoNNj902KwTF4h/r4inM
+n3mYra0BeM4gWsZ7Roilu14o/GajX1iWw0fcy0q31yc
+-> ssh-ed25519 GKhvwg cqd7YmVpbxqZxaVluHDZ8Yw0gNfJCKMmoWa4mEoXym8
+Gbcj+PJaqyPRRGX4olr7mmJ5IoEGlQaogYbj7i9E/98
+--- LoQPWI+m8s3NjalUh0+xdW54c8lgddBmhPoIiPbmR8I
+‘ê¢èÒ–Æœ܉ ÈY
+ž9˜ä­Å!4<>šÞ2DV³£P²·‘9¡N<C2A1>]G;ÎÏ?ˆÐ‰S± '

secrets/secrets.nix

@@ -89,4 +89,12 @@ in
     keys.system.ude
     keys.other.bootstrap
   ];
+  "kanidm-admin-pass.age".publicKeys = [
+    keys.system.kazuki
+    keys.other.bootstrap
+  ];
+  "kanidm-idm-admin-pass.age".publicKeys = [
+    keys.system.kazuki
+    keys.other.bootstrap
+  ];
 }

services/default.nix

@@ -1,5 +1,7 @@
 {
   imports = [
     ./attic.nix
+    ./kanidm.nix
+    ./forgejo.nix
   ];
 }

services/forgejo.nix

@@ -0,0 +1,69 @@
+{
+  services.forgejo = {
+    host = "kazuki";
+    ports = [ 3000 ];
+    config =
+      { config, ... }:
+      {
+        age.secrets.rab-lol-cf = {
+          file = ../secrets/rab-lol-cf.age;
+          owner = config.services.nginx.user;
+        };
+
+        services.forgejo = {
+          enable = true;
+          settings = {
+            server = {
+              DOMAIN = "git.rab.lol";
+              ROOT_URL = "https://git.rab.lol/";
+            };
+            oauth2_client = {
+              REGISTER_EMAIL_CONFIRM = false;
+              ENABLE_AUTO_REGISTRATION = true;
+              ACCOUNT_LINKING = "auto";
+              UPDATE_AVATAR = true;
+            };
+            service = {
+              DISABLE_REGISTRATION = false;
+              ALLOW_ONLY_INTERNAL_REGISTRATION = false;
+              ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+            };
+            federation.ENABLED = true;
+          };
+          repositoryRoot = "/storage-box/forgejo/repos";
+          lfs = {
+            enable = true;
+            contentDir = "/storage-box/forgejo/lfs";
+          };
+        };
+
+        services.nginx = {
+          enable = true;
+          recommendedProxySettings = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+          recommendedTlsSettings = true;
+          virtualHosts."git.rab.lol" = {
+            forceSSL = true;
+            enableACME = true;
+            acmeRoot = null;
+            locations."/" = {
+              proxyPass = "http://127.0.0.1:3000";
+              extraConfig = ''
+                proxy_set_header Connection $http_connection;
+                proxy_set_header Upgrade $http_upgrade;
+              '';
+            };
+          };
+        };
+
+        users.users.nginx.extraGroups = [ "acme" ];
+        security.acme.acceptTerms = true;
+        security.acme.certs."git.rab.lol" = {
+          dnsProvider = "cloudflare";
+          credentialsFile = config.age.secrets.rab-lol-cf.path;
+          email = "nikodem@rabulinski.com";
+        };
+      };
+  };
+}

services/kanidm.nix

@@ -0,0 +1,85 @@
+{
+  services.kanidm =
+    let
+      port = 8443;
+      domain = "auth.rabulinski.com";
+    in
+    {
+      host = "kazuki";
+      ports = [ port ];
+      config =
+        { config, pkgs, ... }:
+        let
+          cert = config.security.acme.certs.${domain};
+        in
+        {
+          age.secrets.rabulinski-com-cf = {
+            file = ../secrets/rabulinski-com-cf.age;
+            owner = config.services.nginx.user;
+          };
+          age.secrets.kanidm-admin-pass = {
+            file = ../secrets/kanidm-admin-pass.age;
+            owner = "kanidm";
+          };
+          age.secrets.kanidm-idm-admin-pass = {
+            file = ../secrets/kanidm-idm-admin-pass.age;
+            owner = "kanidm";
+          };
+
+          services.kanidm = {
+            enableServer = true;
+            package = pkgs.kanidmWithSecretProvisioning;
+            serverSettings = {
+              bindaddress = "127.0.0.1:${toString port}";
+              inherit domain;
+              origin = "https://${domain}";
+              trust_x_forward_for = true;
+              tls_chain = "${cert.directory}/fullchain.pem";
+              tls_key = "${cert.directory}/key.pem";
+            };
+            provision = {
+              enable = true;
+              idmAdminPasswordFile = config.age.secrets.kanidm-idm-admin-pass.path;
+              adminPasswordFile = config.age.secrets.kanidm-admin-pass.path;
+            };
+          };
+
+          systemd.services.kanidm.serviceConfig = {
+            SupplementaryGroups = [ cert.group ];
+          };
+
+          users.users.nginx.extraGroups = [ "acme" ];
+          networking.firewall.allowedTCPPorts = [
+            80
+            443
+          ];
+
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+            recommendedGzipSettings = true;
+            recommendedOptimisation = true;
+            recommendedTlsSettings = true;
+            virtualHosts."auth.rabulinski.com" = {
+              forceSSL = true;
+              enableACME = true;
+              acmeRoot = null;
+              locations."/" = {
+                proxyPass = "https://localhost:${toString port}";
+                proxyWebsockets = true;
+                extraConfig = ''
+                  proxy_ssl_verify off;
+                  proxy_ssl_name ${domain};
+                '';
+              };
+            };
+          };
+
+          security.acme.certs.${domain} = {
+            dnsProvider = "cloudflare";
+            credentialsFile = config.age.secrets.rabulinski-com-cf.path;
+            reloadServices = [ "kanidm" ];
+          };
+        };
+    };
+}