Ryan Lahfa
344cc26d8e
Some checks failed
Check meta / check_dns (pull_request) Successful in 18s
Run pre-commit on all files / check (push) Successful in 25s
Check meta / check_meta (pull_request) Successful in 18s
Check workflows / check_workflows (pull_request) Successful in 24s
Build all the nodes / bridge01 (pull_request) Failing after 28s
Build all the nodes / geo01 (pull_request) Failing after 25s
Build all the nodes / compute01 (pull_request) Failing after 31s
Build all the nodes / geo02 (pull_request) Failing after 25s
Build all the nodes / rescue01 (pull_request) Failing after 26s
Build all the nodes / storage01 (pull_request) Failing after 25s
Build all the nodes / vault01 (pull_request) Failing after 26s
Build all the nodes / web02 (pull_request) Failing after 26s
Build all the nodes / web01 (pull_request) Failing after 26s
Build all the nodes / web03 (pull_request) Failing after 28s
Run pre-commit on all files / check (pull_request) Successful in 24s
Our colmena knows how to deal with families of system types, e.g. NixOS systems or Liminix-based systems. This is a step 1 towards supporting our APs in our infrastructure. Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>
82 lines
1.9 KiB
Nix
82 lines
1.9 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
nixpkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
domain = "netbird.dgnum.eu";
|
|
|
|
s = name: config.age.secrets.${name}.path;
|
|
in
|
|
{
|
|
services = {
|
|
netbird.server = {
|
|
enable = true;
|
|
|
|
package = nixpkgs.nixos.unstable.netbird;
|
|
|
|
inherit domain;
|
|
|
|
enableNginx = true;
|
|
|
|
coturn.enable = lib.mkForce false;
|
|
|
|
relay = {
|
|
environmentFile = s "netbird-relay_environment_file";
|
|
metricsPort = 9094;
|
|
};
|
|
|
|
dashboard = {
|
|
settings = {
|
|
AUTH_AUTHORITY = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird";
|
|
AUTH_AUDIENCE = "dgn_netbird";
|
|
AUTH_CLIENT_ID = "dgn_netbird";
|
|
};
|
|
};
|
|
|
|
management = {
|
|
oidcConfigEndpoint = "https://sso.dgnum.eu/oauth2/openid/dgn_netbird/.well-known/openid-configuration";
|
|
|
|
dnsDomain = "dgnum";
|
|
|
|
metricsPort = 9092;
|
|
|
|
settings = {
|
|
DataStoreEncryptionKey._secret = s "netbird-data_store_encryption_key_file";
|
|
|
|
PKCEAuthorizationFlow.ProviderConfig = {
|
|
Audience = "dgn_netbird";
|
|
ClientID = "dgn_netbird";
|
|
AuthorizationEndpoint = "https://sso.dgnum.eu/ui/oauth2";
|
|
TokenEndpoint = "https://sso.dgnum.eu/oauth2/token";
|
|
};
|
|
|
|
IdpManagerConfig.ClientConfig.ClientID = "dgn_netbird";
|
|
|
|
DeviceAuthorizationFlow = {
|
|
Provider = "none";
|
|
ProviderConfig = {
|
|
Audience = "dgn_netbird";
|
|
ClientID = "dgn_netbird";
|
|
};
|
|
};
|
|
|
|
Relay = {
|
|
Addresses = [ "rels://${domain}:443" ];
|
|
CredentialsTTL = "24h";
|
|
Secret._secret = s "netbird-relay_secret_file";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
nginx.virtualHosts.${domain} = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
};
|
|
};
|
|
|
|
dgn-backups.jobs.netbird.settings.paths = [ "/var/lib/netbird-mgmt" ];
|
|
}
|