82ecd61f5c
Change-Id: I6c6847fac56f0a9a1a2209792e00a3aec5e672b9 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10809 Autosubmit: aspen <root@gws.fyi> Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
96 lines
2 KiB
Nix
96 lines
2 KiB
Nix
{ depot, ... }:
|
|
|
|
let
|
|
inherit (depot.users.aspen)
|
|
terraform
|
|
;
|
|
|
|
in
|
|
terraform.workspace "bbbg"
|
|
{
|
|
plugins = (p: with p; [
|
|
aws
|
|
cloudflare
|
|
]);
|
|
}
|
|
{
|
|
machine = terraform.nixosMachine {
|
|
name = "bbbg";
|
|
instanceType = "t3a.small";
|
|
rootVolumeSizeGb = 250;
|
|
extraIngressPorts = [ 80 443 ];
|
|
configuration = { pkgs, lib, config, depot, ... }: {
|
|
imports = [
|
|
./module.nix
|
|
"${depot.third_party.agenix.src}/modules/age.nix"
|
|
];
|
|
|
|
services.openssh.enable = true;
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedProxySettings = true;
|
|
};
|
|
|
|
networking.firewall.enable = false;
|
|
|
|
programs.zsh.enable = true;
|
|
|
|
users.users.grfn = {
|
|
isNormalUser = true;
|
|
initialPassword = "password";
|
|
extraGroups = [
|
|
"wheel"
|
|
"networkmanager"
|
|
"audio"
|
|
"docker"
|
|
];
|
|
shell = pkgs.zsh;
|
|
openssh.authorizedKeys.keys = [
|
|
depot.users.aspen.keys.main
|
|
];
|
|
};
|
|
|
|
security.sudo.extraRules = [{
|
|
groups = [ "wheel" ];
|
|
commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
|
|
}];
|
|
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
age.secrets = {
|
|
bbbg.file =
|
|
depot.users.aspen.secrets."bbbg.age";
|
|
};
|
|
|
|
services.bbbg.enable = true;
|
|
services.bbbg.database.enable = true;
|
|
services.bbbg.proxy.enable = true;
|
|
services.bbbg.domain = "bbbg.gws.fyi";
|
|
|
|
security.acme.defaults.email = "root@gws.fyi";
|
|
security.acme.acceptTerms = true;
|
|
};
|
|
};
|
|
|
|
dns = {
|
|
data.cloudflare_zone.gws-fyi = {
|
|
name = "gws.fyi";
|
|
};
|
|
|
|
resource.cloudflare_record.bbbg = {
|
|
zone_id = "\${data.cloudflare_zone.gws-fyi.id}";
|
|
name = "bbbg";
|
|
type = "A";
|
|
value = "\${aws_instance.bbbg_machine.public_ip}";
|
|
proxied = false;
|
|
};
|
|
};
|
|
}
|