Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 2 Projects Releases Packages Wiki Activity Actions

Compare commits

base: Skynet:34b2ef6a8464b811b003f93a5f19c502d9939148
Branches Tags
Skynet:main
Skynet:test-nixos-pelican
Skynet:#76-Nuked-Backup
Skynet:#70-logging-dns
Skynet:#56-external-dns
Skynet:#52-dns-for-non-nixos
Skynet:second-interface-routing
Skynet:add_automx2
..
compare: Skynet:b13683e40c4f55b20145a7f251a76ab0d1b484d6
Branches Tags
Skynet:test-nixos-pelican
Skynet:main
Skynet:#76-Nuked-Backup
Skynet:#70-logging-dns
Skynet:#56-external-dns
Skynet:#52-dns-for-non-nixos
Skynet:second-interface-routing
Skynet:add_automx2

No commits in common. "34b2ef6a8464b811b003f93a5f19c502d9939148" and "b13683e40c4f55b20145a7f251a76ab0d1b484d6" have entirely different histories.
34b2ef6a84 ... b13683e40c

10 changed files with 51 additions and 389 deletions
Show stats Expand all files Collapse all files

16
applications/pelican/Notes.md
View file

@ -1,16 +0,0 @@
# Notes on Pelican
## Panel
* ``pelican-install`` is in env that can be used to isntall
* then go to ``panel-address.skynet.ie/installer`` to finish the setup
## Wing
In the config the ssl must be set as so:
```yaml
ssl:
enabled: true
cert: /var/lib/acme/skynet/fullchain.pem
key: /var/lib/acme/skynet/key.pem
```

29
applications/pelican/nginx.nix
View file

@ -1,10 +1,6 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
{ lib, config, pkgs, ... }:
with lib;
let
appUser = "nginx";
name = "panel";
module = "pelican-panel";
@ -12,14 +8,15 @@ with lib; let
serverName = "${name}.<DOMAIN NAME>";
dataDir = "/var/www/pelican/public";
port = 443;
in {
in
{
options.modules.nginx.${name} = {
enable = mkEnableOption "Enable ${name}";
};
config = mkIf cfg.enable {
modules.${module}.enable = true;
networking.firewall.allowedTCPPorts = [port];
networking.firewall.allowedTCPPorts = [ port ];
services.phpfpm.pools.${appUser} = {
user = appUser;
@ -39,13 +36,7 @@ in {
services.nginx.virtualHosts."${serverName}" = {
root = "${dataDir}";
listen = [
{
inherit port;
addr = "0.0.0.0";
ssl = true;
}
];
listen = [{ inherit port; addr="0.0.0.0"; ssl=true; }];
forceSSL = true;
enableACME = true;
@ -80,7 +71,7 @@ in {
extraConfig = ''
try_files $uri $uri/ /index.php?$query_string;
'';
};
};
"/favicon.ico".extraConfig = ''
access_log off;
@ -92,7 +83,7 @@ in {
log_not_found off;
'';
"~ \\.php$" = {
"~ \\.php$" = {
extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:${config.services.phpfpm.pools.${appUser}.socket};
@ -116,4 +107,4 @@ in {
};
};
};
}
}

39
applications/pelican/panel/panel.nix
View file

@ -1,10 +1,5 @@
{
inputs,
pkgs,
lib,
config,
...
}:
{ inputs, pkgs, lib, config, ... }:
with lib; let
cfg = config.modules.pelican-panel;
dir = "/var/www/pelican";
@ -31,18 +26,12 @@ in {
pkgs.php83Extensions.zip
pkgs.php83Extensions.intl
pkgs.php83Extensions.sqlite3
(import ./pelican-install.nix {
inherit pkgs;
inherit dir;
})
(import ./pelican-update.nix {
inherit pkgs;
inherit dir;
})
( import ./pelican-install.nix { inherit pkgs; inherit dir; } )
( import ./pelican-update.nix { inherit pkgs; inherit dir; } )
];
systemd.timers."pelican-cron" = {
wantedBy = ["timers.target"];
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "5m";
OnUnitActiveSec = "1m";
@ -60,16 +49,16 @@ in {
};
systemd.services.pelican-queue = {
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = "nginx";
Group = "nginx";
Restart = "always";
ExecStart = "${pkgs.php83}/bin/php ${dir}/artisan queue:work --tries=3";
startLimitInterval = 180;
startLimitBurst = 30;
RestartSec = "5";
User = "nginx";
Group = "nginx";
Restart = "always";
ExecStart = "${pkgs.php83}/bin/php ${dir}/artisan queue:work --tries=3";
startLimitInterval = 180;
startLimitBurst = 30;
RestartSec = "5";
};
};
};
}
}

10
applications/pelican/pelican-panel-install.nix → applications/pelican/panel/pelican-install.nix
View file

@ -1,7 +1,5 @@
{
pkgs,
dir,
}:
{ pkgs, dir }:
pkgs.writeShellScriptBin "pelican-install" ''
DIR=${dir}
@ -24,7 +22,7 @@ pkgs.writeShellScriptBin "pelican-install" ''
echo "Setting permissions ..."
chmod -R 755 storage/* bootstrap/cache/
chown -R nginx:acme $DIR
chown -R nginx:nginx $DIR
echo "Pelican panel installed successfully"
''
''

10
applications/pelican/pelican-panel-update.nix → applications/pelican/panel/pelican-update.nix
View file

@ -1,7 +1,5 @@
{
pkgs,
dir,
}:
{ pkgs, dir }:
pkgs.writeShellScriptBin "pelican-update" ''
DIR=${dir}
@ -36,7 +34,7 @@ pkgs.writeShellScriptBin "pelican-update" ''
php artisan migrate --seed --force
echo "Setting permissions ..."
chown -R nginx:acme $DIR
chown -R nginx:nginx $DIR
echo "Restart Pelican queue service ..."
systemctl restart pelican-queue.service
@ -45,4 +43,4 @@ pkgs.writeShellScriptBin "pelican-update" ''
php artisan up
echo "Pelican panel updated successfully"
''
''

279
applications/pelican/pelican.nix
View file

@ -1,279 +0,0 @@
{
inputs,
pkgs,
lib,
config,
...
}:
with lib; let
name = "pelican";
cfg = config.services.skynet."${name}";
php_pool = name;
domain_panel = "${cfg.panel.domain.sub}.${cfg.panel.domain.base}.${cfg.panel.domain.tld}";
in {
imports = [
];
options.services.skynet."${name}" = {
panel = {
enable = mkEnableOption "Pelican Panel";
dir = mkOption {
type = types.str;
default = "/var/www/pelican";
};
domain = {
tld = mkOption {
type = types.str;
default = "ie";
};
base = mkOption {
type = types.str;
default = "skynet";
};
sub = mkOption {
type = types.str;
#default = name;
default = "panel-test";
};
};
};
wing = {
enable = mkEnableOption "Pelican Wing";
node_name = mkOption {
type = types.str;
};
};
};
config = mkMerge [
(mkIf cfg.panel.enable {
services.skynet.acme.domains = [
domain_panel
];
# using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
services.skynet.dns.records = [
{
record = cfg.panel.domain.sub;
r_type = "CNAME";
value = config.services.skynet.host.name;
}
];
environment.systemPackages = let
dir = cfg.panel.dir;
in [
pkgs.curl
pkgs.gnutar
pkgs.unzip
pkgs.php83
pkgs.php83Packages.composer
pkgs.php83Extensions.gd
pkgs.php83Extensions.mysqli
pkgs.php83Extensions.mbstring
pkgs.php83Extensions.bcmath
pkgs.php83Extensions.xml
pkgs.php83Extensions.curl
pkgs.php83Extensions.zip
pkgs.php83Extensions.intl
pkgs.php83Extensions.sqlite3
(import ./pelican-panel-install.nix {
inherit pkgs;
inherit dir;
})
(import ./pelican-panel-update.nix {
inherit pkgs;
inherit dir;
})
];
systemd.timers."pelican-cron" = {
wantedBy = ["timers.target"];
timerConfig = {
OnBootSec = "5m";
OnUnitActiveSec = "1m";
Unit = "pelican-cron.service";
};
};
systemd.services."pelican-cron" = {
script = ''
${pkgs.php83}/bin/php ${cfg.panel.dir}/artisan schedule:run >> /dev/null 2>&1
'';
serviceConfig = {
Type = "oneshot";
};
};
systemd.services.pelican-queue = {
wantedBy = ["multi-user.target"];
serviceConfig = {
User = config.services.nginx.user;
Group = config.services.nginx.group;
Restart = "always";
ExecStart = "${pkgs.php83}/bin/php -q ${cfg.panel.dir}/artisan queue:work --tries=3";
startLimitInterval = 180;
startLimitBurst = 30;
RestartSec = "5";
};
};
services.phpfpm.pools.${php_pool} = {
user = config.services.nginx.user;
group = config.services.nginx.group;
settings = {
"listen.owner" = config.services.nginx.user;
"listen.group" = config.services.nginx.group;
"listen.mode" = "0600";
"pm" = "dynamic";
"pm.max_children" = 75;
"pm.start_servers" = 10;
"pm.min_spare_servers" = 5;
"pm.max_spare_servers" = 20;
"pm.max_requests" = 500;
"catch_workers_output" = 1;
};
};
services.nginx.virtualHosts."${domain_panel}" = {
root = "${cfg.panel.dir}/public";
forceSSL = true;
useACMEHost = "skynet";
extraConfig = ''
index index.html index.htm index.php;
charset utf-8;
access_log off;
error_log /var/log/nginx/pelican.app-error.log error;
client_max_body_size 100m;
client_body_timeout 120s;
sendfile off;
ssl_session_cache shared:SSL:10m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
ssl_prefer_server_ciphers on;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header Content-Security-Policy "frame-ancestors 'self'";
add_header X-Frame-Options DENY;
add_header Referrer-Policy same-origin;
'';
locations = {
"/" = {
extraConfig = ''
try_files $uri $uri/ /index.php?$query_string;
'';
};
"/favicon.ico".extraConfig = ''
access_log off;
log_not_found off;
'';
"/robots.txt".extraConfig = ''
access_log off;
log_not_found off;
'';
"~ \\.php$" = {
extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:${config.services.phpfpm.pools.${php_pool}.socket};
fastcgi_index index.php;
include ${config.services.nginx.package}/conf/fastcgi_params;
fastcgi_param PHP_VALUE "upload_max_filesize = 100M \n post_max_size=100M";
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTP_PROXY "";
fastcgi_intercept_errors off;
fastcgi_buffer_size 16k;
fastcgi_buffers 4 16k;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
'';
};
"~ /\\.ht".extraConfig = ''
deny all;
'';
};
};
})
(mkIf cfg.wing.enable {
services.skynet.acme.domains = [
"${cfg.wing.node_name}.${domain_panel}"
];
# using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
services.skynet.dns.records = [
{
record = "${cfg.wing.node_name}.${cfg.panel.domain.sub}";
r_type = "CNAME";
value = config.services.skynet.host.name;
}
];
services.nginx.virtualHosts = {
"${cfg.wing.node_name}.${domain_panel}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".proxyPass = "http://127.0.0.1:8080";
};
};
networking.firewall.allowedTCPPorts = [8080 8443];
virtualisation.docker.enable = true;
environment.systemPackages = [
(pkgs.callPackage ./pelican-wing-package.nix {})
];
users.groups.pelican = {};
users.users.pelican = {
#createHome = true;
isSystemUser = true;
#home = "/etc/pelican";
group = "pelican";
extraGroups = ["docker" "acme"];
# X11 is to ensure the directory can be traversed
#homeMode = "711";
};
systemd.services.pelican-wings = {
description = "Wings Daemon";
after = ["docker.service"];
requires = ["docker.service"];
partOf = ["docker.service"];
serviceConfig = {
User = "root";
WorkingDirectory = "/etc/pelican";
LimitNOFILE = 4096;
PIDFile = "/var/run/wings/daemon.pid";
ExecStart = "/run/current-system/sw/bin/wings";
Restart = "on-failure";
startLimitInterval = 180;
startLimitBurst = 30;
RestartSec = "5";
};
wantedBy = ["multi-user.target"];
};
})
];
}

15
applications/pelican/pelican-wing-package.nix → applications/pelican/wings/package.nix
View file

@ -1,10 +1,5 @@
{
stdenv,
lib,
fetchurl,
docker,
gnutar,
}:
{ stdenv, lib, fetchurl, docker, gnutar }:
stdenv.mkDerivation rec {
pname = "pelican-wings";
version = "v1.0.0-beta6";
@ -14,11 +9,11 @@ stdenv.mkDerivation rec {
hash = "sha256-a2T4BjqS8Hy5YqwDEJpbvGqqsrVjdRhxvJLgk3MCXag=";
};
buildInputs = [docker gnutar];
buildInputs = [ docker gnutar ];
phases = ["installPhase"];
phases = [ "installPhase" ];
installPhase = ''
install -D $src $out/bin/wings
'';
}
}

23
applications/pelican/wings/wings.nix
View file

@ -1,10 +1,5 @@
{
inputs,
pkgs,
lib,
config,
...
}:
{ inputs, pkgs, lib, config, ... }:
with lib; let
cfg = config.modules.pelican-wings;
in {
@ -15,19 +10,19 @@ in {
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [8080 8443];
networking.firewall.allowedTCPPorts = [ 8080 8443 ];
virtualisation.docker.enable = true;
environment.systemPackages = [
(pkgs.callPackage ./package.nix {})
( pkgs.callPackage ./package.nix {} )
];
systemd.services.pelican-wings = {
description = "Wings Daemon";
after = ["docker.service"];
requires = ["docker.service"];
partOf = ["docker.service"];
after = [ "docker.service" ];
requires = [ "docker.service" ];
partOf = [ "docker.service" ];
serviceConfig = {
User = "root";
@ -41,7 +36,7 @@ in {
RestartSec = "5";
};
wantedBy = ["multi-user.target"];
wantedBy = [ "multi-user.target" ];
};
};
}
}

3
flake.nix
View file

@ -148,9 +148,6 @@
# metrics
ariia = import ./machines/ariia.nix;
# games server - panel/host
optimus = import ./machines/optimus.nix;
};
};
}

16
machines/optimus.nix → machines/retired/optimus.nix
View file

@ -16,8 +16,8 @@ Notes:
...
}: let
# name of the server, sets teh hostname and record for it
name = "optimus-test";
ip_pub = "193.1.99.85";
name = "optimus";
ip_pub = "193.1.99.112";
hostname = "${name}.skynet.ie";
host = {
ip = ip_pub;
@ -26,7 +26,7 @@ Notes:
};
in {
imports = [
../applications/pelican/pelican.nix
../applications/games.nix
];
deployment = {
@ -39,13 +39,7 @@ in {
services.skynet = {
host = host;
#backup.enable = true;
pelican = {
panel.enable = true;
wing = {
enable = true;
node_name = "node01";
};
};
backup.enable = true;
games.enable = true;
};
}