diff --git a/nixos/boxes/colony/vms/shill/containers/colony-psql.nix b/nixos/boxes/colony/vms/shill/containers/colony-psql.nix new file mode 100644 index 0000000..7d1cf21 --- /dev/null +++ b/nixos/boxes/colony/vms/shill/containers/colony-psql.nix @@ -0,0 +1,69 @@ +{ lib, ... }: { + nixos.systems.colony-psql = { + system = "x86_64-linux"; + nixpkgs = "mine"; + + assignments = { + internal = { + name = "colony-psql-ctr"; + domain = lib.my.colony.domain; + ipv4.address = "${lib.my.colony.start.ctrs.v4}4"; + ipv6 = { + iid = "::4"; + address = "${lib.my.colony.start.ctrs.v6}4"; + }; + }; + }; + + configuration = { lib, pkgs, config, assignments, ... }: + let + inherit (lib) mkMerge mkIf; + inherit (lib.my) networkdAssignment; + in + { + config = mkMerge [ + { + my = { + deploy.enable = false; + server.enable = true; + + secrets = { + key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkly/tnPmoX05lDjEpQOkllPqYA0PY92pOKqvx8Po02"; + }; + + firewall = { + tcp.allowed = [ 5432 ]; + }; + }; + + systemd = { + network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal; + }; + + services = { + postgresql = { + package = pkgs.postgresql_14; + enable = true; + enableTCPIP = true; + ensureUsers = [ + { + name = "root"; + ensurePermissions = { + "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES"; + }; + } + ]; + }; + }; + } + (mkIf config.my.build.isDevVM { + virtualisation = { + forwardPorts = [ + { from = "host"; host.port = 55432; guest.port = 5432; } + ]; + }; + }) + ]; + }; + }; +} diff --git a/nixos/boxes/colony/vms/shill/containers/default.nix b/nixos/boxes/colony/vms/shill/containers/default.nix index 4425b90..4e17621 100644 --- a/nixos/boxes/colony/vms/shill/containers/default.nix +++ b/nixos/boxes/colony/vms/shill/containers/default.nix @@ -2,5 +2,6 @@ imports = [ ./middleman ./vaultwarden.nix + ./colony-psql.nix ]; } diff --git a/nixos/boxes/colony/vms/shill/default.nix b/nixos/boxes/colony/vms/shill/default.nix index cf82a7e..8f432ea 100644 --- a/nixos/boxes/colony/vms/shill/default.nix +++ b/nixos/boxes/colony/vms/shill/default.nix @@ -101,6 +101,7 @@ }) { middleman = {}; vaultwarden = {}; + colony-psql = {}; }; }; } diff --git a/nixos/modules/tmproot.nix b/nixos/modules/tmproot.nix index 5440e42..da5f14a 100644 --- a/nixos/modules/tmproot.nix +++ b/nixos/modules/tmproot.nix @@ -235,6 +235,16 @@ in } ]; }) + (mkIf config.services.postgresql.enable { + my.tmproot.persistence.config.directories = [ + { + directory = "/var/lib/postgresql"; + mode = "0750"; + user = "postgres"; + group = "postgres"; + } + ]; + }) (mkIf config.my.build.isDevVM { fileSystems = mkVMOverride { # Hijack the "root" device for persistence in the VM diff --git a/secrets/cloudflare-credentials.conf.age b/secrets/cloudflare-credentials.conf.age index 628f2e2..5fc75c3 100644 --- a/secrets/cloudflare-credentials.conf.age +++ b/secrets/cloudflare-credentials.conf.age @@ -1,10 +1,10 @@ age-encryption.org/v1 --> ssh-ed25519 H162lQ a/oJHGIB43DHpX/EUdal2ZyOlf+zYUbNwztGSP1iuGE -W8bd1I0rgDMEc18zjpP0d4dyp4PGd19/8vJFlVOsGSs --> X25519 cjqYOE0e9IHvWvcGyOPDNTcNR6Ynv8TdRCoHiBx4UzI -/EzNz/SSzvs9DbCGr28B4/jwZMnpUxoBtDOt9Ombv4Y --> x]-grease -fRt2HHsTmZbotWaLfgPZ4PT76A ---- M2/lLzEUiSmSuoPhtO/QAg+CPPvnBBMQhisX66A/aKE -bDl Γ -Gg-2JbtI:B1?Vۗz}3qI> { =H')U")HS1--pYƅHtn[ݟ-l|Uolg \ No newline at end of file +-> ssh-ed25519 H162lQ /adzwW9x7USsH5CdsioRijyAty8oWd/+cAMwUjIUlFc +wZ37SG3kMPAFv6b7XUsQODXJyf0+2UGYO4W4ZYITIx4 +-> X25519 hgS0FxBoQ+aE8XPP9C+py9MG6olCCX2MNo8ySfdI3S4 +0MFoKWao1FSvPSSbvgPvoW/9IhenHbcFfRdF8QCiX6Y +-> W-r]SXB-grease #sr)tHY s)\!y phJi@. +i9yJp2IczY7G/4sEX5Lmzyn3KOxca7/pDQ +--- UAo0KfTO0IzWS7mj5vWRzMLT3wrrgIpr2PYUYKSDSIQ +D%I5 b awqS(Vj_]=D󂻱 +Y2_ uz> 6bywaOB>f$Xq%_cѬVe[0pbَno}`0|0ӌkȟ \ No newline at end of file diff --git a/secrets/dhparams.pem.age b/secrets/dhparams.pem.age index 0dde440..9b78b66 100644 Binary files a/secrets/dhparams.pem.age and b/secrets/dhparams.pem.age differ diff --git a/secrets/pdns-file-records.key.age b/secrets/pdns-file-records.key.age index 8faa5cf..1da9c9f 100644 Binary files a/secrets/pdns-file-records.key.age and b/secrets/pdns-file-records.key.age differ diff --git a/secrets/user-passwd.txt.age b/secrets/user-passwd.txt.age index d05c3bd..743018f 100644 --- a/secrets/user-passwd.txt.age +++ b/secrets/user-passwd.txt.age @@ -1,17 +1,21 @@ age-encryption.org/v1 --> ssh-ed25519 SKXJUw fW7jrhrKwP6iyzZmVgb7vJ2UcNJF/5WD4yMdIAHkmjY -2oxq2j4imOCs+SS7X8B6l+lfyxS1oc2pP9Yn5xH2TYg --> ssh-ed25519 B9K/XQ k2wmCaqbN607JztgylqS0HnB0VDDirJdTT0A/YcWmDc -p50mr15TcNSosXhqOp1piJ4zovntXupDN0wKyuQcLOI --> ssh-ed25519 H162lQ gB7vN1QOBBwgGnQm01/Qgi5BOKROqiGUeRhl5o0Fshs -RahbmvQtsVZqWp0Aw+p5nNPiiLy9Bx5CIUlNBDUHqvk --> ssh-ed25519 b6YMqg GRHZS+hPYYtvmdWjubBWHWRcW6tN1CH8ad/uQIy94UY -YoW/7nXuDsFRpHfz0gxHcq86yp28k36jeDeE5rgWbu0 --> ssh-ed25519 Lqn0Yw QMRSGRz5JwLBxTHP2rcG13IUvQzB+0hlWDqYZFvC1n4 -Nn/4hg59WRT6/89nS7i+gQ8lH/xnPV5U8tVL7jzqrQU --> X25519 GStCgfxXuAFeZEZi0REzF57PASJgsUjJKqhbxOWGMG4 -P13cOlKyoec4dxraCm/FYNbkSQiG13X2qqLeYJNxb8w --> o-grease -9eVgGIr20m1qCUJk3smZBflaLXQrMcMM ---- 2Z86MUDSQR+ZsPLWzR8zO74BFfmy9C5HDd6mabW7fuY -THیቍ;VjD?<`:ƨ*yAӁs/Zf?;QhwY N9U/0wBq.O8, U/7T_NVzyU/F:Hu5 \ No newline at end of file +-> ssh-ed25519 SKXJUw CsKtHFHS/9MNiNGT/O+bxx+btotr9riXwJWgHAplcXQ +W6kL/S4y1aFstYGOIhrwJfXx2uhswH3uSdyJzRCAtHM +-> ssh-ed25519 wbGjmA 7em05wqUq9PA9CZ9MlnNSxdeknvN0lrS0yYxUTtGawE +TyAI9Pu0DJodhdT5sBodIaBxPg3VBmXcq18IIHtFs3I +-> ssh-ed25519 B9K/XQ ZAVd8XBFPOJ6hC2WunnkGmEifYOHcUhYQIi4gvsLajc +5hPdqVBWi9OtqQPyq4gz4CX6vVpuLGQURufTCnDNYgM +-> ssh-ed25519 H162lQ wKj8wzesVAOzm5o4VB9NEBSr+xlr0VjR/A48NL+6uls +lpmijvrflnMeVT6R2YcUmLFljFxZsTeVziErcQ7GKuk +-> ssh-ed25519 b6YMqg ykVDRMnyBsh6+HN/A/5lT3K36wgJZggIcjlsPSc3byM +HF5qzv2Lf2s87OHi/0++shAjF4+xr5NAHL/9lncMHRU +-> ssh-ed25519 Lqn0Yw 4+F3gxpsI9QnbCHWpLz29CUj3RAeXSH7PHkuFw3E7T8 +yzZAylZ7QAV7ufljd4VEBys8sNd8JodWqN5f0JzRI/g +-> X25519 YMeCBP/yDOGPs04ihx7NkZSpqEotUHKs3yMRkg9JWAI +Li1FOGm6NIAPGVQRj3HYiyKiR/ZSk35vnOK/ia59IQU +-> tjxC(g-grease +817wn107V7X7yjCXvKBMt/55PWcEYdm6ZDOdoZC5A3s+iRFVpLvGmxlkEVxQCqsA +K4WG/Ye5PC/raEjsS8/6AqHs4E+JSfuZjm47fVclbu3kp8Yu3BaLEa9glucxBQbc +X0A +--- C/lfT3RLOrCR2mOv6Q0aDyEVUrq4GzdVpHhj7Ly2ov4 +&Ǩq) Wh&3M}]REe%tX*Xl 0hl[@]8'G>peSfݙPJY۔FLz1?"ݲε)G_ \ No newline at end of file diff --git a/secrets/vaultwarden.env.age b/secrets/vaultwarden.env.age index 9fc3560..e4f548f 100644 --- a/secrets/vaultwarden.env.age +++ b/secrets/vaultwarden.env.age @@ -1,12 +1,12 @@ age-encryption.org/v1 --> ssh-ed25519 Lqn0Yw ybVbnUjgm3QGOZPv9A/q6zPXjZbuYe4krqe+qjrkziw -SIEEGlziouUT3pzxw+C7p2IO2sDJ3xmaTrHaDGFgLOs --> X25519 bq/2lRh9a3BwhwR6o9TXeuXA5AGdtlrQm8/JOyAzUEU -I5xRPDb6rUcNBXqOXefFkO2HvlYIJAG+OFkZygywkqg --> 0g#WDK-grease .DWBEk* -Vf8DHmVCY3bfTT+CPPm5dELSid+aZJquOxjEccmkZXVKtefHlwLRx6Dh3HT5IZqR -Pl2j/4SQvVf1MrPjtbkMwBhxh9zPZa7WQIBGeF6oB2kl9vyc65lXpaxRSMs2eVsv - ---- /eCT0Rqu+we6CXUSP3dpd+blpQxwOG0t5rDiGfffXPs -F -f~"[%?}1P~ҋ$Nrnh*y _Ʌ!*h\MߑxsFd3u/$9  Р&iv \ No newline at end of file +-> ssh-ed25519 Lqn0Yw 527NE0GoR6SQTwb1hmgpxn4APXMb2oW3/VNjjbwtnx8 +9jWxt9FYx8G4pyPVtU8mp33QuurzQHI4Npt+79ej2qU +-> X25519 wW5ClCuDyZvFJOA/aeitGr5yr29DOdULnUlPRz1sDk0 +db70JP2sIH3T8NsMHqnTCGNE1tY7PyjGKOKmzNE632Q +-> zGd-grease * _!K!a] 3C\vn +sOkK0VjY4v3j6XcG +--- CHljgmb9kcrECrIM2Ve+Wp5AkGWeIQb0Bhh9sgEtD5U +K=XK9 ,qj)=Gau{N V,2N$w +kzO @#Fǝ +̻CF3PzNG,3Pw]-VʞoԞmz +e \ No newline at end of file