JuliusFreudenberger/nix-config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Configure Renovate #1

Open
renovate-bot wants to merge 7 commits from renovate/configure into main
pull from: renovate/configure
merge into: JuliusFreudenberger:main
Conversation 0 Commits 7 Files changed 13 +29 -228
13 changed files with 29 additions and 228 deletions
Download patch file Download diff file Expand all files Collapse all files

64
modules/arcane.nix
View file

@ -1,64 +0,0 @@
{
config,
lib,
...
}:
let
cfg = config.services.arcane;
in {
options.services.arcane = {
enable = lib.mkEnableOption "arcane, a modern Docker management UI";
appUrl = lib.mkOption {
description = "External URL arcane will be reachable from, without protocol";
type = lib.types.str;
};
secretFile = lib.mkOption {
description = ''
Agenix secret containing the following needed environment variables in dotenv notation:
- ENCRYPTION_KEY
- JWT_SECRET
- OIDC_CLIENT_ID
- OIDC_CLIENT_SECRET
- OIDC_ISSUER_URL
- OIDC_ADMIN_CLAIM
- OIDC_ADMIN_VALUE
'';
};
};
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
arcane = {
image = "ghcr.io/getarcaneapp/arcane:v1.11.2";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
];
environment = {
APP_URL = "https://${cfg.appUrl}";
PUID = "1000";
PGID = "1000";
LOG_LEVEL = "info";
LOG_JSON = "false";
OIDC_ENABLED = "true";
OIDC_SCOPES = "openid email profile groups";
DATABASE_URL = "file:data/arcane.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(2500)&_txlock=immediate";
};
environmentFiles = [
cfg.secretFile.path
];
networks = [
"traefik"
];
labels = {
"traefik.enable" = "true";
"traefik.http.routers.arcane.middlewares" = "arcane-oidc-auth@file";
"traefik.http.routers.arcane.rule" = "Host(`${cfg.appUrl}`)";
"traefik.http.services.arcane.loadbalancer.server.port" = "3552";
};
extraOptions = [
''--mount=type=volume,source=arcane-data,target=/app/data,volume-driver=local''
];
};
};
};
}

3
modules/beszel-hub.nix
View file

@ -6,7 +6,6 @@
let
cfg = config.services.beszel-docker;
version = "0.18.7";
in {
@ -21,7 +20,7 @@ in {
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
beszel = {
image = "henrygd/beszel:${version}";
image = "henrygd/beszel:0.18.7@sha256:a849ad80814b6a1a3be665304dcace5d4854b3bed7bde4dd1227e8ce1b82d477";
autoStart = true;
networks = [
"traefik"

2
modules/dockhand.nix
View file

@ -17,7 +17,7 @@ in {
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
dockhand = {
image = "fnsys/dockhand:v1.0.32";
image = "fnsys/dockhand:v1.0.32@sha256:cda754fc7ccb4acd0ecc37cc37b9cf0d2b933bf19de89d47957b26ecf109a543";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
];

2
modules/hawser.nix
View file

@ -27,7 +27,7 @@ in {
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
hawser = {
image = "ghcr.io/finsys/hawser:0.2.42";
image = "ghcr.io/finsys/hawser:0.2.42@sha256:79f926e8d8fe31c0dfe90858f90b69bfd4cfbb113472605620b91a4b444dd557";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
];

4
modules/netbird-client.nix
View file

@ -9,8 +9,6 @@ let
cfg = config.services.netbird-client;
clientVersion = "0.72.4";
clientConfiguration = lib.types.submodule {
options = {
setupKey = lib.mkOption {
@ -64,7 +62,7 @@ in {
virtualisation.oci-containers.containers = lib.mkIf (cfg.docker.setupKey != null) {
netbird = {
image = "netbirdio/netbird:${clientVersion}-rootless";
image = "netbirdio/netbird:0.72.4-rootless@sha256:d42136aabccb82c5237d2ee73febde237e13e850727bcb6bbf5b3c8717ece142";
autoStart = true;
hostname = "${config.networking.hostName}-docker";
networks = [

9
modules/netbird-docker.nix
View file

@ -10,9 +10,6 @@ let
cfg = config.services.netbird-docker;
netbirdCfg = config.services.netbird;
serverVersion = "0.72.4";
dashboardVersion = "2.39.0";
in {
options.services.netbird-docker = {
@ -60,7 +57,7 @@ in {
services.netbird.useRoutingFeatures = lib.mkDefault "server";
virtualisation.oci-containers.containers = {
netbird-dashboard = {
image = "netbirdio/dashboard:v${dashboardVersion}";
image = "netbirdio/dashboard:v2.39.0";
autoStart = true;
networks = [
"traefik"
@ -94,7 +91,7 @@ in {
];
};
netbird-server = {
image = "netbirdio/netbird-server:${serverVersion}";
image = "netbirdio/netbird-server:0.72.4@sha256:9ab98a37002517204010ee88a0c7f5e76b1fe6e2a736043db60efb7a02fbded3";
autoStart = true;
networks = [
"traefik"
@ -172,7 +169,7 @@ in {
];
};
netbird-proxy = {
image = "netbirdio/reverse-proxy:${serverVersion}";
image = "netbirdio/reverse-proxy:0.72.4@sha256:3104d5ca3a76ac224d268b9cc1d2f983eaf6fefbbb1cc78c3dbecd07f9d2a7e0";
autoStart = true;
ports = [
"51820:51820/udp"

72
modules/newt.nix
View file

@ -1,72 +0,0 @@
{
pkgs,
config,
lib,
...
}:
let
cfg = config.services.newt-docker;
in {
options.services.newt-docker = {
enable = lib.mkEnableOption "Newt, user space tunnel client for Pangolin";
pangolinEndpoint = lib.mkOption {
description = "External URL of the Pangolin instance";
type = lib.types.str;
};
connectionSecret = lib.mkOption {
description = "Secrets for Pangolin authentication.";
type = lib.types.anything;
};
};
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
newt = {
image = "fosrl/newt:1.9.0";
autoStart = true;
networks = [
"pangolin"
];
environment = {
PANGOLIN_ENDPOINT = cfg.pangolinEndpoint;
DOCKER_SOCKET = "/var/run/docker.sock";
};
environmentFiles = [ cfg.connectionSecret.path ];
volumes = [
"/var/run/docker.sock:/var/run/docker.sock:ro"
];
extraOptions = [
"--add-host=host.docker.internal:host-gateway"
];
};
};
systemd.services."docker-newt" = {
after = [
"docker-network-newt.service"
];
requires = [
"docker-network-newt.service"
];
};
systemd.services."docker-network-newt" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
};
script = ''
docker network inspect pangolin || docker network create pangolin --ipv4 --ipv6 --subnet=172.18.0.0/16 --gateway=172.18.0.1
'';
};
networking.firewall.extraCommands = ''
iptables -A INPUT -p icmp --source 100.89.128.0/24 -j ACCEPT
iptables -A INPUT -p tcp --source 172.18.0.0/12 --dport 22 -j ACCEPT
'';
};
}

53
modules/pangolin.nix
View file

@ -1,53 +0,0 @@
{
pkgs-unstable,
utils,
config,
lib,
...
}: {
services = {
pangolin = {
enable = true;
package = pkgs-unstable.fosrl-pangolin;
openFirewall = true;
settings = {
app = {
save_logs = true;
log_failed_attempts = true;
};
domains = {
domain1 = {
prefer_wildcard_cert = true;
};
};
flags = {
disable_signup_without_invite = true;
disable_user_create_org = true;
};
};
};
};
systemd.services.gerbil.serviceConfig.ExecStart = lib.mkForce (utils.escapeSystemdExecArgs [
(lib.getExe pkgs-unstable.fosrl-gerbil)
"--reachableAt=http://localhost:${toString config.services.gerbil.port}"
"--generateAndSaveKeyTo=${toString config.services.pangolin.dataDir}/config/key"
"--remoteConfig=http://localhost:3001/api/v1/gerbil/get-config"
]);
}
# Settings needed on the host
#
# services = {
# pangolin = {
# dnsProvider = "";
# baseDomain = "";
# letsEncryptEmail = "";
# environmentFile = config.age.secrets."".path;
# };
# traefik = {
# environmentFiles = [ config.age.secrets."".path ];
# };
# };

3
modules/pocket-id.nix
View file

@ -7,7 +7,6 @@ let
cfg = config.services.pocket-id-docker;
pocketidCfg = config.services.pocket-id;
version = "2.8.0";
in {
@ -18,7 +17,7 @@ in {
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
pocket-id = {
image = "ghcr.io/pocket-id/pocket-id:v${version}";
image = "ghcr.io/pocket-id/pocket-id:v2.8.0@sha256:a073640418b2cfc8587c488a7270580b3ab95cae2c543f5d64bbbe1fd7ccbae8";
autoStart = true;
networks = [
"traefik"

21
modules/portainer_agent.nix
View file

@ -1,21 +0,0 @@
{
...
}: {
virtualisation.oci-containers.containers = {
portainer_agent = {
image = "portainer/agent:2.33.2";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
"/var/lib/docker/volumes:/var/lib/docker/volumes"
"/:/host"
];
environment = {
EDGE = "1";
CAP_HOST_MANAGEMENT = "1";
};
extraOptions = [
''--mount=type=volume,source=portainer_agent,target=/data,volume-driver=local''
];
};
};
}

2
modules/traefik-oidc.nix
View file

@ -105,7 +105,7 @@ in {
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
traefik = {
image = "traefik:v3.6.6";
image = "traefik:v3.7.5@sha256:d6858791f9e74df44ca4014166647c41cdc2abd3bf2a71b832ca4e1c6a91b257";
cmd = [
"--providers.docker=true"
"--providers.docker.exposedByDefault=false"

3
modules/traefik.nix
View file

@ -7,7 +7,6 @@
let
cfg = config.services.traefik-docker;
version = "3.7.5";
in {
@ -30,7 +29,7 @@ in {
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
traefik = {
image = "traefik:v${version}";
image = "traefik:v3.7.5@sha256:d6858791f9e74df44ca4014166647c41cdc2abd3bf2a71b832ca4e1c6a91b257";
cmd = [
"--providers.docker=true"
"--providers.docker.endpoint=http://docker-socket-proxy:2375"

19
renovate.json Normal file
View file

@ -0,0 +1,19 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"prHourlyLimit": 0,
"nix": {
"enabled": true
},
"customManagers": [
{
"customType": "regex",
"datasourceTemplate": "docker",
"fileMatch": [
".+\\.nix$"
],
"matchStrings": [
"\\s+image\\s+=\\s+\"(?<depName>.*?):(?<currentValue>.*?)(@(?<digest>sha256:[a-z0-9]{64}))?\""
]
}
]
}