Rename hosts again

2026-01-21 21:01:34 +01:00 · 2025-09-05 19:07:20 +02:00 · 2025-09-05 19:07:20 +02:00 · 8b82dd4e18
commit 8b82dd4e18
parent d4ef1575ff
15 changed files with 0 additions and 0 deletions
--- a/hosts/observer/default.nix
+++ b/hosts/observer/default.nix
@ -0,0 +1,80 @@
+{ config, ... }:
+{
+  system.stateVersion = "24.11";
+
+  meta = {
+    domains.validate = true;
+    ports.validate = true;
+  };
+
+  custom = {
+    sops = {
+      enable = true;
+      agePublicKey = "age1dnru7l0agvnw3t9kmx60u4vh5u4tyd49xdve53zspxkznnp9f34qtec9dl";
+    };
+
+    boot.loader.grub.enable = true;
+
+    services = {
+      resolved.enable = true;
+      tailscale = {
+        enable = true;
+        ssh.enable = true;
+      };
+
+      gatus = {
+        enable = true;
+        domain = "status.${config.custom.services.tailscale.domain}";
+        domainsToMonitor = config.meta.domains.globalList;
+        endpoints = {
+          "alerts" = {
+            group = "Monitoring";
+            path = "/v1/health";
+            extraConditions = [ "[BODY].healthy == true" ];
+          };
+          "grafana".group = "Monitoring";
+          "logs".group = "Monitoring";
+          "git ssh" = {
+            protocol = "ssh";
+            domain = "git.sstork.dev";
+          };
+          "speedtest".protocol = "http";
+        };
+      };
+
+      ntfy = {
+        enable = true;
+        domain = "alerts.${config.custom.services.tailscale.domain}";
+      };
+
+      grafana = {
+        enable = true;
+        domain = "grafana.${config.custom.services.tailscale.domain}";
+      };
+
+      victorialogs = {
+        enable = true;
+        domain = "logs.${config.custom.services.tailscale.domain}";
+      };
+
+      caddy.virtualHosts =
+        let
+          inherit (config.custom) services;
+        in
+        {
+          gatus = {
+            inherit (services.gatus) domain port;
+          };
+          ntfy = {
+            inherit (services.ntfy) domain port;
+          };
+          grafana = {
+            inherit (services.grafana) domain port;
+          };
+          victorialogs = {
+            inherit (services.victorialogs) domain port;
+          };
+        };
+    };
+  };
+}
--- a/hosts/observer/disko.nix
+++ b/hosts/observer/disko.nix
@ -0,0 +1,36 @@
+{
+  disko.devices = {
+    disk.main = {
+      device = "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            size = "1M";
+            type = "EF02";
+          };
+          root = {
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg.pool = {
+      type = "lvm_vg";
+      lvs.root = {
+        size = "100%FREE";
+        content = {
+          type = "filesystem";
+          format = "ext4";
+          mountpoint = "/";
+          mountOptions = [ "defaults" ];
+        };
+      };
+    };
+  };
+}
--- a/hosts/observer/hardware.nix
+++ b/hosts/observer/hardware.nix
@ -0,0 +1,47 @@
+{ modulesPath, inputs, ... }:
+{
+  imports = [
+    inputs.disko.nixosModules.default
+    "${modulesPath}/profiles/qemu-guest.nix"
+  ];
+
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+
+  zramSwap.enable = true;
+
+  networking.useDHCP = false;
+  systemd.network = {
+    enable = true;
+    networks."10-enp1s0" = {
+      matchConfig.Name = "enp1s0";
+      linkConfig.RequiredForOnline = "routable";
+      networkConfig.DHCP = "no";
+      address = [
+        "49.13.231.235/32"
+        "2a01:4f8:1c1e:76fe::1/64"
+      ];
+      routes = [
+        {
+          Gateway = "172.31.1.1";
+          GatewayOnLink = true;
+        }
+        { Gateway = "fe80::1"; }
+      ];
+      dns = [
+        "1.1.1.1"
+        "8.8.8.8"
+        "2606:4700:4700::1111"
+        "2001:4860:4860::8888"
+      ];
+    };
+  };
+}
--- a/hosts/observer/secrets.json
+++ b/hosts/observer/secrets.json
@ -0,0 +1,29 @@
+{
+  "seb-password": "ENC[AES256_GCM,data:laGJomW5c5TB3alpPgZKElQ3Y46OBxPrA0AxVNgx/09oSuG0EM63cnnkwZkrTeZxqjBH2UOryLqCr9DUr9mhZsovqNtZ2t8Uzg==,iv:GpBQNm1jspU8PCN+SzfAUKSps3YySg6JJVYOLOFetOI=,tag:2nARGI9XwzLfJFRhDyGBSw==,type:str]",
+  "tailscale": {
+    "auth-key": "ENC[AES256_GCM,data:UYOACjPi7HKh3qB0yD5N8PlzvTXfzNr7qNfmLrj/KbBb4S0KDTI5xIFHpk3wkTwc+0d2RMMfpoJEnM68x5c=,iv:o36k4vtsnSThDQNIMIPBQHJ92WodbIyVC42L1t8Fvzg=,tag:6RqIP+fAv/ByYhxF12P4qg==,type:str]",
+    "service-auth-key": "ENC[AES256_GCM,data:xM5+oTT6UBS+eE2hibdxFSWXz6al3fdDpq6vglJjwjTPSg1RF7VrVKZuczJqefD+y7/1GkRLiX5Lx5tSwA==,iv:vYZExfvn2C6ZEPqORAOFtpkXr7Kfc1JTdlhOIFhK3Rk=,tag:PrqQ/VnQveypEfUaCBEPpQ==,type:str]"
+  },
+  "healthchecks": {
+    "ping-key": "ENC[AES256_GCM,data:wlrgEbJ9B57kjmB+0hof/fJOBb4tcA==,iv:ibMBpcrSocLBhtumsSV00+KVN6Pi4SzE7soCkZcU4fY=,tag:wqYBB0Bi3M+UYinhd8pY+w==,type:str]"
+  },
+  "grafana": {
+    "admin-password": "ENC[AES256_GCM,data:VXM9heVazDBVltWvzlMrKTjeSmpArPvz9ZhTlPs=,iv:owHyuoupNQO09aRBgU2phIwxg22U1rUqKyYbw2193m4=,tag:EPiRny2k2Gw2kONyyzLpug==,type:str]"
+  },
+  "sops": {
+    "age": [
+      {
+        "recipient": "age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5",
+        "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvd29MSnZKanp3OXZxNHhv\nVks2ajgwb25qVnVDSWIvZWh1MytGTFBHL1dvCmhDNEF2R3Zac29HVHdLdXljYjJs\nalZYZDF2MjR2cWdBNWZYQXh1OElSWTgKLS0tIHY0eDJhRlVqbUtJQkFSTUh6cFor\nTWhBRXFNb3p1NU5udW9SU1Q4L2YyaVUKUMopZJ68KwiAknBFvz01X0TvBVH+1amz\nPxhHWvrcY54s8vfw9gk6LiN3o4vlZVCSfzHGLGoXxFeylc6RTM4CIw==\n-----END AGE ENCRYPTED FILE-----\n"
+      },
+      {
+        "recipient": "age1dnru7l0agvnw3t9kmx60u4vh5u4tyd49xdve53zspxkznnp9f34qtec9dl",
+        "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhSDhRQmpXaGdocDMvaS9u\na0ZyOEtNT2N4bG01NERFQTErc1hFaE1xWFFVClA4YjBwdGVhbTZ3dE9ZSFV2M1Zu\nZCtuVHN4R0NMQU16UXFRdVVqQlJLazgKLS0tIDdmWVc4ejFNRWVhY1piSTBXU0cx\nV1F2cjlmRWNKWkN1U3hwNWl6U2lEb1kKgsj22mpgxpgA5oXTXhoA5DtkySqqcn17\nOrpUiZmfOABXEZ0b5pnkAD06aW+7j2SqajYpvguxIrD9x1w562FmZA==\n-----END AGE ENCRYPTED FILE-----\n"
+      }
+    ],
+    "lastmodified": "2025-08-17T19:05:59Z",
+    "mac": "ENC[AES256_GCM,data:iZfbKq3DbJjY+Lb55ZhPEzHyQZbQ2efgqPo5DGiCTRuYjGroJgoZ+tF290NtGpGd8C8dWch2sOsDuMXTRrflE5XmlXl66itjGNi/3T/a/3H89AbXfeFoPK7QwiE88zoOqbBO8fDr40SvPtn70w1gxmoCFR7RPbZdY9ZvQr1SbSI=,iv:jRzSxMi3DWEbmkA1QVvQny1viswbyU8pFld6gWA5U5s=,tag:vZaJu/KpITME+YJ0MJxuaw==,type:str]",
+    "unencrypted_suffix": "_unencrypted",
+    "version": "3.10.2"
+  }
+}