Sergei Poljanski
71047d179d
Some checks failed
nixos / asxpio-services (push) Failing after 54s
Renovate now runs from its own repository for every repo, with the shared rules in its preset. Extend that preset here and keep only what is specific to this repo (the Ansible var manager, the Paper JRE, the runner and nix notes); drop the workflow that ran it for iac alone. Assisted-by: Claude:opus-5-5
87 lines
2.6 KiB
Nix
87 lines
2.6 KiB
Nix
# asxpio-services: CI runner, Minecraft, XMPP, Xray, SillyTavern.
|
|
{ config, lib, ... }:
|
|
{
|
|
imports = [
|
|
./containers.nix
|
|
./replica.nix
|
|
./runner.nix
|
|
./xmpp.nix
|
|
./xray.nix
|
|
];
|
|
|
|
networking.hostName = lib.mkDefault "asxpio-services";
|
|
networking.domain = "asxp.io";
|
|
system.stateVersion = "26.05";
|
|
|
|
# --- Network -----------------------------------------------------------
|
|
# Interfaces are matched by MAC address: the public one gets IPv4 from
|
|
# DHCP and a static IPv6, the private network hands out 10.10.0.20.
|
|
networking.useDHCP = false;
|
|
networking.useNetworkd = true;
|
|
systemd.network.enable = true;
|
|
systemd.network.networks = {
|
|
"10-public" = {
|
|
matchConfig.MACAddress = "92:00:06:b0:4b:85";
|
|
networkConfig.DHCP = "ipv4";
|
|
address = [ "2a01:4f9:c013:8269::1/64" ];
|
|
routes = [ { Gateway = "fe80::1"; } ];
|
|
};
|
|
"20-private" = {
|
|
matchConfig.MACAddress = "86:00:00:96:39:d0";
|
|
networkConfig.DHCP = "ipv4";
|
|
dhcpV4Config.RouteMetric = 2000;
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
};
|
|
|
|
# --- WireGuard peer of asxpio-ops ---------------------------------------
|
|
sops.defaultSopsFile = lib.mkDefault ../../secrets/asxpio-services.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
sops.secrets."wireguard/private_key" = { };
|
|
sops.secrets."wireguard/preshared_key" = { };
|
|
|
|
networking.wireguard.interfaces.asxpio-services = {
|
|
ips = [
|
|
"10.20.0.20/32"
|
|
"fd69:69:69::20/128"
|
|
];
|
|
privateKeyFile = config.sops.secrets."wireguard/private_key".path;
|
|
peers = [
|
|
{
|
|
name = "asxpio-ops";
|
|
publicKey = "0gRrNiV4FjP6ipczZCRD3dsnK7k7rl6IyjG84fPaJB4=";
|
|
presharedKeyFile = config.sops.secrets."wireguard/preshared_key".path;
|
|
endpoint = "135.181.27.77:60101";
|
|
allowedIPs = [
|
|
"10.20.0.0/24"
|
|
"fd69:69:69::/64"
|
|
];
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
|
|
# --- Firewall -----------------------------------------------------------
|
|
# The Hetzner firewall is the outer layer. Each service opens its own
|
|
# ports next to its definition.
|
|
networking.firewall.interfaces = {
|
|
asxpio-services.allowedTCPPorts = [
|
|
22
|
|
8000
|
|
];
|
|
enp7s0.allowedTCPPorts = [ 22 ];
|
|
};
|
|
|
|
# --- Backup -------------------------------------------------------------
|
|
# The Paper world is copied live (RCON is off, so there is no save-off);
|
|
# its autosave keeps that close enough. What Paper downloads again is
|
|
# left out.
|
|
asxpio.backup = {
|
|
schedule = "*-*-* 04:15:00";
|
|
excludes = [
|
|
"/opt/minecraft/cache"
|
|
"/opt/minecraft/libraries"
|
|
"/opt/minecraft/versions"
|
|
];
|
|
};
|
|
}
|