diff --git a/flake.nix b/flake.nix index 50ded4e2..72ef444e 100644 --- a/flake.nix +++ b/flake.nix @@ -182,6 +182,8 @@ buildbot-nix.nixosModules.buildbot-master golink.nixosModules.default iceshrimp.nixosModules.default + tangled-sh.nixosModules.knot + tangled-sh.nixosModules.spindle ]; }; }; diff --git a/lib/data/services.toml b/lib/data/services.toml index 1ffe3720..f689638e 100644 --- a/lib/data/services.toml +++ b/lib/data/services.toml @@ -107,7 +107,6 @@ host = "marvin" extUrl = "auth.pyrox.dev" anubis = 8401 - [redlib] port = 6901 host = "marvin" @@ -118,6 +117,18 @@ port = 6931 host = "marvin" tsHost = "scrutiny" +[tangled-knot] +port = 6934 +host = "marvin" +extUrl = "knot.pyrox.dev" +intListenPort = 30106 + +[tangled-spindle] +port = 6935 +host = "marvin" +extUrl = "spindle.pyrox.dev" + + [vaultwarden] port = 6912 host = "marvin" diff --git a/systems/x86_64-linux/marvin/default.nix b/systems/x86_64-linux/marvin/default.nix index 066d0f08..f848298f 100644 --- a/systems/x86_64-linux/marvin/default.nix +++ b/systems/x86_64-linux/marvin/default.nix @@ -34,6 +34,7 @@ ./services/scrutiny.nix ./services/syncthing.nix ./services/tailscale.nix + ./services/tangled.nix ./services/vaultwarden.nix ./services/zfs.nix ]; diff --git a/systems/x86_64-linux/marvin/services/secrets/secrets.nix b/systems/x86_64-linux/marvin/services/secrets/secrets.nix index 780b210b..316db66e 100644 --- a/systems/x86_64-linux/marvin/services/secrets/secrets.nix +++ b/systems/x86_64-linux/marvin/services/secrets/secrets.nix @@ -38,6 +38,7 @@ in "pingvin-secrets.age".publicKeys = marvinDefault; "planka-env.age".publicKeys = marvinDefault; "pocket-id-secrets.age".publicKeys = marvinDefault; + "tangled-knot-secrets.age".publicKeys = marvinDefault; "vaultwarden-vars.age".publicKeys = marvinDefault; "vaultwarden-pgpass.age".publicKeys = marvinDefault; "webmentiond-env.age".publicKeys = marvinDefault; diff --git a/systems/x86_64-linux/marvin/services/secrets/tangled-knot-secrets.age b/systems/x86_64-linux/marvin/services/secrets/tangled-knot-secrets.age new file mode 100644 index 0000000000000000000000000000000000000000..b876131a5cc424535758c688dc17ac86b82e6f2f GIT binary patch literal 1118 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7EOe^ybX17Ucgi%$ zbu+Ncj_`CUPclsja;fqSFvtq=3CT{1a54?{PcsWK2=jL}$mYt|&P}Q?^NK9ZObks) zG%xT7aP{{M3rw~sFU)q&E%tKEi8N2wPV~-l@`c$}RGg@g=9ZWl;>hJ$?pzptE~> znr*?A>62R=7#!*o>XVV3U!1LP5#^Yg>+9_2WMWa^W8f5EmS1ie>E`L=n(b{89_XiC zQWRF~8XBJE9qEx(QCVQf<(iai5@4C3Z(3B88JSh$UgT|>>78K_TvnQ&Zt9bjm~P~q zo)?r-;#pCi-}^nim3>=>9+YF=iXlU7iX zZ05@4<&hrZmXxO-8tPvdQXb}=Qx%lynwXa3nPOs;6Rw@&S?&|=US;m$l4??HZj@M* zR2-6BT;yI>F8SkQ`*5XqoMlSnQUopJ*Iqnr{;5$`utEX%rf0Ug;5<<{wny7+6|p78n`n zYf>CQsnLF7;5I^Q&jBX?p)#&=5L&BQQ{d`kyaXP zYMjL7Q&_H_Yo1sXm|vb%T#{kwo^9!8=~Cw68R%$QXc$oJnVMx7T9s+!qHP&jl^YV2 zQR3xQ>fz~~o9JU<=;N%-x1lvw8DSX7Z{;G*yEo04eg?PM0=Rat4~TVbH>Wf@_a z>uqS}91#=S&pgT;h_GRc@RT ztR3Z2sO{>mU6IZeP+VA=7VK5w;q9aEpPE~&?Nt_KQIQx?UXq>bUr`k7?q6;k5E0_+ z=#$Q+tE;O}ly4SVRG4V)m!7VjXcCl?<7g3BZdR=A=bjkk9*}6{6;xpm=wy=Q7ZS>K zgQdl1)_g6#+Nw(n=O=|Metp2EB(1;4J~UVNwECW~PSyKg*n(C|YAQsFKVaCn;QLmV zpI5ToYQ#3ja3p@-C>&C!n|0e=Mdg2YP@5?0GA8}=nMYK=?lO4nTEP6tf99owY_ETw VR*Y^vq^)Nb{NnAbjHHGJ3jhNnd_VvI literal 0 HcmV?d00001 diff --git a/systems/x86_64-linux/marvin/services/tangled.nix b/systems/x86_64-linux/marvin/services/tangled.nix new file mode 100644 index 00000000..28f83f67 --- /dev/null +++ b/systems/x86_64-linux/marvin/services/tangled.nix @@ -0,0 +1,43 @@ +{ + config, + lib, + ... +}: +let + cfg = config.services.tangled-knot; + dk = lib.py.data.services.tangled-knot; + ds = lib.py.data.services.tangled-spindle; +in +{ + services = { + tangled-knot = { + enable = true; + gitUser = "git"; + stateDir = "/var/lib/tangled-knot"; + repo.scanPath = "${cfg.stateDir}/repos"; + server = { + listenAddr = "0.0.0.0:${toString dk.port}"; + hostname = dk.extUrl; + internalListenAddr = "127.0.0.1:${toString dk.intListenPort}"; + secretFile = config.age.secrets.tangled-knot-secrets.path; + }; + }; + tangled-spindle = { + enable = true; + server = { + listenAddr = "0.0.0.0:${ds.port}"; + hostname = ds.extUrl; + owner = "did:plc:5cqzysioqzttihsnbsaxrggu"; + }; + pipelines.workflowTimeout = "10m"; + }; + openssh.ports = [ 2222 ]; + openssh.settings.AllowUsers = [ "git" ]; + openssh.settings.AllowGroups = [ "git" ]; + }; + age.secrets.tangled-knot-secrets = { + file = ./secrets/tangled-knot-secrets.age; + owner = "git"; + group = "git"; + }; +} diff --git a/systems/x86_64-linux/prefect/services/caddy.nix b/systems/x86_64-linux/prefect/services/caddy.nix index 5e48229a..5907f5d9 100644 --- a/systems/x86_64-linux/prefect/services/caddy.nix +++ b/systems/x86_64-linux/prefect/services/caddy.nix @@ -241,6 +241,17 @@ in } ''; }; + # Tangled Services + ${pns.tangled-knot.extUrl} = { + extraConfig = '' + reverse_proxy ${marvin}:${toString pns.tangled-knot.port} + ''; + }; + ${pns.tangled-spindle.extUrl} = { + extraConfig = '' + reverse_proxy ${marvin}:${toString pns.tangled-spindle.port} + ''; + }; # Simple Tailscale Hosts @@ -273,32 +284,40 @@ in refresh_period 10m } ''; - # layer4 { - # 0.0.0.0:465 { - # route { - # proxy { - # proxy_protocol v2 - # upstream ${marvinIP}:${mail.intSMTPS} - # } - # } - # } - # 0.0.0.0:993 { - # route { - # proxy { - # proxy_protocol v2 - # upstream ${marvinIP}:${mail.intIMAPS} - # } - # } - # } - # 0.0.0.0:4190 { - # route { - # proxy { - # proxy_protocol v2 - # upstream ${marvinIP}:${mail.intManageSieve} - # } - # } - # } - # } + extraConfig = '' + layer4 { + :22 { + @a ssh + route @a { + proxy ${marvinIP}:2222 + } + } + # 0.0.0.0:465 { + # route { + # proxy { + # proxy_protocol v2 + # upstream ${marvinIP}:${mail.intSMTPS} + # } + # } + # } + # 0.0.0.0:993 { + # route { + # proxy { + # proxy_protocol v2 + # upstream ${marvinIP}:${mail.intIMAPS} + # } + # } + # } + # 0.0.0.0:4190 { + # route { + # proxy { + # proxy_protocol v2 + # upstream ${marvinIP}:${mail.intManageSieve} + # } + # } + # } + } + ''; }; systemd.services.caddy.serviceConfig.CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; systemd.services.caddy.serviceConfig.AmbientCapabilities = "CAP_NET_BIND_SERVICE";