* [rulkc] [PATCH] nix: introduce initial generic configuration
@ 2026-07-21 21:12 maxmoskm
0 siblings, 0 replies; 3+ messages in thread
From: maxmoskm @ 2026-07-21 21:12 UTC (permalink / raw)
From: Maxim Moskalets <Maxim.Moskalets at kaspersky.com>
Add a NixOS configuration for cgit server as initial.
Services added:
- cgit (over HTTP)
- gitolite
- git-daemon
- sshd
- fail2ban
- firewall (iptables as default backend)
Nix and NixOS used for versionability and reproducibility of the
system. As bonus, it also provides a way to easily deploy the system
on different machines.
Signed-off-by: Maxim Moskalets <Maxim.Moskalets at kaspersky.com>
---
.gitignore | 3 +
README.md | 30 ++++
config/admins.nix | 15 ++
config/default.nix | 10 ++
config/disko.nix | 33 ++++
config/nix.nix | 3 +
config/programs/default.nix | 5 +
config/programs/neovim.nix | 8 +
config/services/default.nix | 6 +
config/services/fail2ban.nix | 15 ++
config/services/ssh.nix | 10 ++
config/virtualisation.nix | 15 ++
flake.lock | 69 +++++++
flake.nix | 47 +++++
modules/default.nix | 6 +
modules/hostings/beget.nix | 34 ++++
modules/hostings/default.nix | 6 +
modules/hostings/selectel.nix | 29 +++
modules/services/cgit.nix | 58 ++++++
modules/services/default.nix | 6 +
modules/services/gitolite.nix | 230 ++++++++++++++++++++++++
pkgs/by-name/gr/grokmirror/package.nix | 33 ++++
pkgs/default.nix | 7 +
servers/cgit-hardware-configuration.nix | 36 ++++
servers/cgit.nix | 23 +++
25 files changed, 737 insertions(+)
create mode 100644 .gitignore
create mode 100644 README.md
create mode 100644 config/admins.nix
create mode 100644 config/default.nix
create mode 100644 config/disko.nix
create mode 100644 config/nix.nix
create mode 100644 config/programs/default.nix
create mode 100644 config/programs/neovim.nix
create mode 100644 config/services/default.nix
create mode 100644 config/services/fail2ban.nix
create mode 100644 config/services/ssh.nix
create mode 100644 config/virtualisation.nix
create mode 100644 flake.lock
create mode 100644 flake.nix
create mode 100644 modules/default.nix
create mode 100644 modules/hostings/beget.nix
create mode 100644 modules/hostings/default.nix
create mode 100644 modules/hostings/selectel.nix
create mode 100644 modules/services/cgit.nix
create mode 100644 modules/services/default.nix
create mode 100644 modules/services/gitolite.nix
create mode 100644 pkgs/by-name/gr/grokmirror/package.nix
create mode 100644 pkgs/default.nix
create mode 100644 servers/cgit-hardware-configuration.nix
create mode 100644 servers/cgit.nix
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c27297c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+*.patch
+*.qcow2
+/result
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..1b71883
--- /dev/null
+++ b/README.md
@@ -0,0 +1,30 @@
+# LANDAU servers configurations
+
+## Installation
+
+Run the following command to install NixOS to remote host:
+
+```bash
+nixos-anywhere --flake .#cgit root@<host ip>
+```
+
+After installation, run `nixos-rebuild switch` to apply changes. You can also use `--build-host` and `--remote-host` options to build on a different machine.
+
+For first-time setup on new hosting, hardware configuration is required. Use `--generate-hardware-config nixos-generate-config ./servers/cgit-hardware-configuration.nix` to generate it.
+
+## Run locally
+
+You can also run this configuration locally in a VM:
+
+```bash
+nixos-rebuild build-vm --flake .#cgit
+./result/bin/run-cgit-vm
+```
+
+Now you can access the [server](http://localhost:8080/) for debug purposes.
+
+## Nix-related checklist
+
+- [ ] Format all files with `nix run nixpkgs#nixfmt-tree`
+- [ ] Check for any warnings with `nix flake check`
+- [ ] Update lock file (if needed) with `nix flake update`
diff --git a/config/admins.nix b/config/admins.nix
new file mode 100644
index 0000000..340166c
--- /dev/null
+++ b/config/admins.nix
@@ -0,0 +1,15 @@
+{
+ users.users = {
+ moskalets = {
+ isNormalUser = true;
+ description = "Maxim Moskalets";
+ extraGroups = [
+ "wheel"
+ ];
+ openssh.authorizedKeys.keys = [
+ # YubiKey
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDH+C8vzOOqDx7un96FhGewfE6UufLHys3Y3ke6WxoV05XPWc+d/1T9wCU7escUgdOUI90+Ps/0Os4PzfP0znOE08Xj+6nZsRSkhu+WEFyRu8e86NRoCEIk2u8WNxMhR112taT6bLf/TRWzDyai159sKz7PhuIW/uP/SwsIzpr+AWhBVzzT0Ytz3QVX4JCrRYXyuFwTLNIFRzziKBP69nkl/KKwRdULGIzlGXqHTOzLLL26sSWuGTaZg3ao+DfLV5gmL3VkU9jEyF2OVodsxmQ3qeoRRsHlSy7FmQeCg4I3uhbi/v8bR1xyhfn7YLaKfFkuTnK0EfFfbRTPLyWglwb3yeulkUg3oDc4AKSoks3Dzi53LBSEI//5Yw3nfFu3Hu85UgZQ6A9lRolrkibjKil1s8yodU5vSGKtGkh98U//KzXDEHOLqZ7mfY+hvvY11oQ0KOLYzgYX9hwvMgYTa3dmzADRfs/PMfOqja1TDsVvnHNnIfmjNe8WojbBPzB8ytmTDpMERIAONwyR2p0Bf6fon04hQu/yyc/iE+zbn/JDf9LYbj4+yr6RpRJXbbh5KsfXAJ6vf0XBEkdV5KymD1N6Ni44lGFwg5clDs3rj5K/liSZK4joyqUaUtzGi0DxwT1lypl87iJpw0cThCOr80fVl4FiyEkTjZjMc0UP/cA6BQ== cardno:29_610_165"
+ ];
+ };
+ };
+}
diff --git a/config/default.nix b/config/default.nix
new file mode 100644
index 0000000..7a7be0f
--- /dev/null
+++ b/config/default.nix
@@ -0,0 +1,10 @@
+{
+ imports = [
+ ./admins.nix
+ ./disko.nix
+ ./nix.nix
+ ./programs
+ ./services
+ ./virtualisation.nix
+ ];
+}
diff --git a/config/disko.nix b/config/disko.nix
new file mode 100644
index 0000000..7366aee
--- /dev/null
+++ b/config/disko.nix
@@ -0,0 +1,33 @@
+{
+ disko.devices.disk.main = {
+ type = "disk";
+ content = {
+ type = "gpt";
+ partitions = {
+ boot = {
+ name = "boot";
+ size = "1M";
+ type = "EF02";
+ };
+ esp = {
+ size = "256M";
+ type = "EF00";
+ content = {
+ type = "filesystem";
+ format = "vfat";
+ mountpoint = "/boot";
+ };
+ };
+ root = {
+ name = "root";
+ size = "100%";
+ content = {
+ type = "filesystem";
+ format = "ext4";
+ mountpoint = "/";
+ };
+ };
+ };
+ };
+ };
+}
diff --git a/config/nix.nix b/config/nix.nix
new file mode 100644
index 0000000..1e0ea0d
--- /dev/null
+++ b/config/nix.nix
@@ -0,0 +1,3 @@
+{
+ system.stateVersion = "26.05";
+}
diff --git a/config/programs/default.nix b/config/programs/default.nix
new file mode 100644
index 0000000..73b5f39
--- /dev/null
+++ b/config/programs/default.nix
@@ -0,0 +1,5 @@
+{
+ imports = [
+ ./neovim.nix
+ ];
+}
diff --git a/config/programs/neovim.nix b/config/programs/neovim.nix
new file mode 100644
index 0000000..b7360ff
--- /dev/null
+++ b/config/programs/neovim.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+ programs.neovim = {
+ enable = true;
+ viAlias = true;
+ vimAlias = true;
+ };
+}
diff --git a/config/services/default.nix b/config/services/default.nix
new file mode 100644
index 0000000..366b226
--- /dev/null
+++ b/config/services/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./fail2ban.nix
+ ./ssh.nix
+ ];
+}
diff --git a/config/services/fail2ban.nix b/config/services/fail2ban.nix
new file mode 100644
index 0000000..050fb93
--- /dev/null
+++ b/config/services/fail2ban.nix
@@ -0,0 +1,15 @@
+{
+ services.fail2ban = {
+ enable = true;
+
+ bantime = "30m";
+ maxretry = 5;
+
+ bantime-increment = {
+ enable = true;
+ maxtime = "3d";
+ factor = "4";
+ rndtime = "10m";
+ };
+ };
+}
diff --git a/config/services/ssh.nix b/config/services/ssh.nix
new file mode 100644
index 0000000..46164ef
--- /dev/null
+++ b/config/services/ssh.nix
@@ -0,0 +1,10 @@
+{ lib, ... }:
+{
+ services.openssh = {
+ allowSFTP = false;
+ settings = {
+ PermitRootLogin = "no";
+ AllowGroups = lib.mkDefault [ "wheel" ];
+ };
+ };
+}
diff --git a/config/virtualisation.nix b/config/virtualisation.nix
new file mode 100644
index 0000000..498aa43
--- /dev/null
+++ b/config/virtualisation.nix
@@ -0,0 +1,15 @@
+{ config, lib, ... }:
+{
+ virtualisation.vmVariant = {
+ services.getty.autologinUser = "root";
+ virtualisation = {
+ memorySize = 4 * 1024;
+ cores = 4;
+ forwardPorts = map (port: {
+ from = "host";
+ host.port = port + 8000;
+ guest.port = port;
+ }) config.networking.firewall.allowedTCPPorts;
+ };
+ };
+}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..2ec93a4
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,69 @@
+{
+ "nodes": {
+ "disko": {
+ "inputs": {
+ "nixpkgs": [
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1781152676,
+ "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+ "owner": "nix-community",
+ "repo": "disko",
+ "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nix-community",
+ "repo": "disko",
+ "type": "github"
+ }
+ },
+ "nixpkgs": {
+ "locked": {
+ "lastModified": 1782847225,
+ "narHash": "sha256-JC9PjqKYG9ve5U8aDOLQipp3+KLANBHUvGdLZlxzdKI=",
+ "owner": "NixOS",
+ "repo": "nixpkgs",
+ "rev": "95ca1e203c0750115fd4a6f17d5a245dfe6b1edd",
+ "type": "github"
+ },
+ "original": {
+ "owner": "NixOS",
+ "ref": "nixos-26.05",
+ "repo": "nixpkgs",
+ "type": "github"
+ }
+ },
+ "root": {
+ "inputs": {
+ "disko": "disko",
+ "nixpkgs": "nixpkgs",
+ "srvos": "srvos"
+ }
+ },
+ "srvos": {
+ "inputs": {
+ "nixpkgs": [
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1782959762,
+ "narHash": "sha256-foGp7WLUoX50QN1VzBDkdDOkxkRGGPoXQdgMbEFqBYs=",
+ "owner": "nix-community",
+ "repo": "srvos",
+ "rev": "9228f1ec58f3af7cb7cb09aaa7db138c96d7e97e",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nix-community",
+ "repo": "srvos",
+ "type": "github"
+ }
+ }
+ },
+ "root": "root",
+ "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..4c6b9da
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,47 @@
+{
+ description = "LANDAU infrastructure";
+
+ inputs = {
+ nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+ disko = {
+ url = "github:nix-community/disko";
+ inputs.nixpkgs.follows = "nixpkgs";
+ };
+ srvos = {
+ url = "github:nix-community/srvos";
+ inputs.nixpkgs.follows = "nixpkgs";
+ };
+ };
+
+ outputs =
+ {
+ nixpkgs,
+ disko,
+ srvos,
+ ...
+ }@attrs:
+ let
+ makeServerSystem =
+ modules: extraConfig:
+ nixpkgs.lib.nixosSystem {
+ specialArgs = attrs;
+ system = "x86_64-linux";
+ modules = [
+ disko.nixosModules.disko
+ srvos.nixosModules.server
+ ./config
+ ./modules
+ ./pkgs
+ ]
+ ++ modules;
+ }
+ // extraConfig;
+ in
+ {
+ nixosConfigurations = {
+ cgit = makeServerSystem [ ./servers/cgit.nix ] { };
+ };
+
+ inherit (nixpkgs) formatter;
+ };
+}
diff --git a/modules/default.nix b/modules/default.nix
new file mode 100644
index 0000000..59a8985
--- /dev/null
+++ b/modules/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./hostings
+ ./services
+ ];
+}
diff --git a/modules/hostings/beget.nix b/modules/hostings/beget.nix
new file mode 100644
index 0000000..4ee53ce
--- /dev/null
+++ b/modules/hostings/beget.nix
@@ -0,0 +1,34 @@
+{
+ config,
+ lib,
+ ...
+}:
+
+{
+ options.hostings.beget.enable = lib.mkEnableOption "Server on Beget platform";
+
+ # See https://beget.com/ru/kb/faq/cloud/sozdanie-servera-iz-svoego-obraza
+ config = lib.mkIf config.hostings.beget.enable {
+ disko.devices.disk.main.device = "/dev/vda";
+
+ boot.loader.grub.efiSupport = false;
+
+ services.qemuGuest.enable = true;
+ services.cloud-init = {
+ enable = true;
+ network.enable = true;
+ settings = {
+ datasource_list = [
+ "NoCloud"
+ "ConfigDrive"
+ ];
+ };
+ };
+
+ networking = {
+ useDHCP = false;
+ useNetworkd = true;
+ networkmanager.enable = false;
+ };
+ };
+}
diff --git a/modules/hostings/default.nix b/modules/hostings/default.nix
new file mode 100644
index 0000000..cab83b2
--- /dev/null
+++ b/modules/hostings/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./beget.nix
+ ./selectel.nix
+ ];
+}
diff --git a/modules/hostings/selectel.nix b/modules/hostings/selectel.nix
new file mode 100644
index 0000000..0880dbe
--- /dev/null
+++ b/modules/hostings/selectel.nix
@@ -0,0 +1,29 @@
+{
+ config,
+ lib,
+ ...
+}:
+
+{
+ options.hostings.selectel.enable = lib.mkEnableOption "Server on Selectel platform";
+
+ # See https://docs.selectel.ru/en/cloud-servers/images/create-custom-image/
+ config = lib.mkIf config.hostings.selectel.enable {
+ disko.devices.disk.main.device = "/dev/sda";
+
+ boot.loader.grub.efiSupport = false;
+
+ services.qemuGuest.enable = true;
+ services.cloud-init = {
+ enable = true;
+ network.enable = true;
+ settings = {
+ datasource_list = [
+ "ConfigDrive"
+ "Ec2"
+ "None"
+ ];
+ };
+ };
+ };
+}
diff --git a/modules/services/cgit.nix b/modules/services/cgit.nix
new file mode 100644
index 0000000..20bc939
--- /dev/null
+++ b/modules/services/cgit.nix
@@ -0,0 +1,58 @@
+{
+ config,
+ lib,
+ ...
+}:
+let
+ host = "git.rulkc.org";
+ mkAssetPath = file: toString (./. + "/../../git.rulkc.org/cgit/${file}");
+in
+{
+ options.landau.services.cgit.enable = lib.mkEnableOption "cgit configured for LANDAU";
+
+ config = lib.mkIf config.landau.services.cgit.enable {
+ services.nginx.virtualHosts.${host}.locations = {
+ "= /cgit.png".alias = mkAssetPath "cgit.png";
+ "= /cgit.css".alias = mkAssetPath "cgit.css";
+ "= /favicon.ico".alias = mkAssetPath "favicon.ico";
+ };
+
+ services.cgit.${host} = {
+ enable = true;
+ user = "git";
+ group = "git";
+ scanPath = "/var/lib/git";
+ gitHttpBackend.checkExportOkFiles = false;
+ settings = {
+ # Features
+ enable-git-config = true;
+ enable-http-clone = true;
+ enable-index-owner = true;
+ snapshots = "tar.gz zip";
+
+ # Appearance
+ root-title = "LANDAU git repositories";
+ root-desc = "Git repositories for Linux kernel Advanced for Next-gen Devices & Architectures";
+
+ clone-url =
+ "https://${host}/$CGIT_REPO_URL git://${host}/$CGIT_REPO_URL"
+ + (if config.landau.services.gitolite.enable then " ssh://git@${host}/$CGIT_REPO_URL" else "");
+ section-from-path = 3;
+ max-stats = "quarter";
+ cache-root = "/var/cache/cgit";
+ cache-size = 1000;
+ };
+ };
+
+ services.gitDaemon = {
+ enable = true;
+ basePath = "/var/lib/git";
+ exportAll = true;
+ };
+
+ networking.firewall.allowedTCPPorts = [
+ 80
+ 9418
+ ];
+ };
+}
diff --git a/modules/services/default.nix b/modules/services/default.nix
new file mode 100644
index 0000000..fe0d440
--- /dev/null
+++ b/modules/services/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./cgit.nix
+ ./gitolite.nix
+ ];
+}
diff --git a/modules/services/gitolite.nix b/modules/services/gitolite.nix
new file mode 100644
index 0000000..583ff9e
--- /dev/null
+++ b/modules/services/gitolite.nix
@@ -0,0 +1,230 @@
+{ config, lib, ... }:
+{
+ options.landau.services.gitolite.enable = lib.mkEnableOption "gitolite configured for LANDAU";
+
+ config = lib.mkIf config.landau.services.gitolite.enable {
+ services.openssh = {
+ enable = lib.mkForce true;
+ settings.AllowGroups = lib.mkForce null;
+ };
+ services.gitolite = {
+ enable = true;
+ adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDorHQviBgliQSwdk0b/vLbGdRADutxkz58hexR8MfNv RULKC gitolite";
+ extraGitoliteRc = ''
+ # configuration variables for gitolite
+
+ # This file is in perl syntax. But you do NOT need to know perl to edit it --
+ # just mind the commas, use single quotes unless you know what you're doing,
+ # and make sure the brackets and braces stay matched up!
+
+ # (Tip: perl allows a comma after the last item in a list also!)
+
+ # HELP for commands can be had by running the command with "-h".
+
+ # HELP for all the other FEATURES can be found in the documentation (look for
+ # "list of non-core programs shipped with gitolite" in the master index) or
+ # directly in the corresponding source file.
+
+ %RC = (
+
+ # ------------------------------------------------------------------
+
+ # default umask gives you perms of '0700'; see the rc file docs for
+ # how/why you might change this
+ UMASK => 0027,
+
+ # look for "git-config" in the documentation
+ GIT_CONFIG_KEYS => 'gitweb\..*',
+
+ # comment out if you don't need all the extra detail in the logfile
+ LOG_EXTRA => 1,
+ # logging options
+ # 1. leave this section as is for 'normal' gitolite logging (default)
+ # 2. uncomment this line to log ONLY to syslog:
+ # LOG_DEST => 'syslog',
+ # 3. uncomment this line to log to syslog and the normal gitolite log:
+ # LOG_DEST => 'syslog,normal',
+ # 4. prefixing "repo-log," to any of the above will **also** log just the
+ # update records to "gl-log" in the bare repo directory:
+ # LOG_DEST => 'repo-log,normal',
+ # LOG_DEST => 'repo-log,syslog',
+ # LOG_DEST => 'repo-log,syslog,normal',
+ # syslog 'facility': defaults to 'local0', uncomment if needed. For example:
+ # LOG_FACILITY => 'local4',
+
+ # roles. add more roles (like MANAGER, TESTER, ...) here.
+ # WARNING: if you make changes to this hash, you MUST run 'gitolite
+ # compile' afterward, and possibly also 'gitolite trigger POST_COMPILE'
+ ROLES => {
+ READERS => 1,
+ WRITERS => 1,
+ },
+
+ # enable caching (currently only Redis). PLEASE RTFM BEFORE USING!!!
+ # CACHE => 'Redis',
+
+ # ------------------------------------------------------------------
+
+ # rc variables used by various features
+
+ # the 'info' command prints this as additional info, if it is set
+ # SITE_INFO => 'Please see http://blahblah/gitolite for more help',
+
+ # the CpuTime feature uses these
+ # display user, system, and elapsed times to user after each git operation
+ # DISPLAY_CPU_TIME => 1,
+ # display a warning if total CPU times (u, s, cu, cs) crosses this limit
+ # CPU_TIME_WARN_LIMIT => 0.1,
+
+ # the Mirroring feature needs this
+ # HOSTNAME => "foo",
+
+ # TTL for redis cache; PLEASE SEE DOCUMENTATION BEFORE UNCOMMENTING!
+ # CACHE_TTL => 600,
+
+ # ------------------------------------------------------------------
+
+ # suggested locations for site-local gitolite code (see cust.html)
+
+ # this one is managed directly on the server
+ # LOCAL_CODE => "$ENV{HOME}/local",
+
+ # or you can use this, which lets you put everything in a subdirectory
+ # called "local" in your gitolite-admin repo. For a SECURITY WARNING
+ # on this, see http://gitolite.com/gitolite/non-core.html#pushcode
+ # LOCAL_CODE => "$rc{GL_ADMIN_BASE}/local",
+
+ # ------------------------------------------------------------------
+
+ # List of commands and features to enable
+
+ ENABLE => [
+
+ # COMMANDS
+
+ # These are the commands enabled by default
+ 'help',
+ 'desc',
+ 'info',
+ 'perms',
+ 'writable',
+
+ # Uncomment or add new commands here.
+ 'create',
+ 'fork',
+ 'mirror',
+ 'readme',
+ 'sudo',
+ # 'sskm',
+ 'D',
+ 'symbolic-ref',
+
+ # These FEATURES are enabled by default.
+
+ # essential (unless you're using smart-http mode)
+ 'ssh-authkeys',
+
+ # creates git-config entries from gitolite.conf file entries like 'config foo.bar = baz'
+ 'git-config',
+
+ # creates git-daemon-export-ok files; if you don't use git-daemon, comment this out
+ 'daemon',
+
+ # creates projects.list file; if you don't use gitweb, comment this out
+ 'gitweb',
+
+ # These FEATURES are disabled by default; uncomment to enable. If you
+ # need to add new ones, ask on the mailing list :-)
+
+ # user-visible behaviour
+
+ # prevent wild repos auto-create on fetch/clone
+ # 'no-create-on-read',
+ # no auto-create at all (don't forget to enable the 'create' command!)
+ # 'no-auto-create',
+
+ # access a repo by another (possibly legacy) name
+ # 'Alias',
+
+ # give some users direct shell access. See documentation in
+ # sts.html for details on the following two choices.
+ # "Shell $ENV{HOME}/.gitolite.shell-users",
+ # 'Shell alice bob',
+
+ # set default roles from lines like 'option default.roles-1 = ...', etc.
+ # 'set-default-roles',
+
+ # show more detailed messages on deny
+ # 'expand-deny-messages',
+
+ # show a message of the day
+ # 'Motd',
+
+ # system admin stuff
+
+ # enable mirroring (don't forget to set the HOSTNAME too!)
+ # 'Mirroring',
+
+ # allow people to submit pub files with more than one key in them
+ # 'ssh-authkeys-split',
+
+ # selective read control hack
+ # 'partial-copy',
+
+ # manage local, gitolite-controlled, copies of read-only upstream repos
+ # 'upstream',
+
+ # updates 'description' file instead of 'gitweb.description' config item
+ # 'cgit',
+
+ # allow repo-specific hooks to be added
+ # 'repo-specific-hooks',
+
+ # performance, logging, monitoring...
+
+ # be nice
+ # 'renice 10',
+
+ # log CPU times (user, system, cumulative user, cumulative system)
+ # 'CpuTime',
+
+ # syntactic_sugar for gitolite.conf and included files
+
+ # allow backslash-escaped continuation lines in gitolite.conf
+ # 'continuation-lines',
+
+ # create implicit user groups from directory names in keydir/
+ # 'keysubdirs-as-groups',
+
+ # allow simple line-oriented macros
+ # 'macros',
+
+ # Kindergarten mode
+
+ # disallow various things that sensible people shouldn't be doing anyway
+ # 'Kindergarten',
+ ],
+
+ POST_COMPILE =>
+ [
+ 'post-compile/ssh-authkeys',
+ 'post-compile/update-git-configs',
+ 'post-compile/update-gitweb-access-list',
+ 'post-compile/update-git-daemon-access-list',
+ ],
+ );
+
+ $GITWEB_PROJECTS_LIST = "/var/lib/git/projects.list";
+
+ # ------------------------------------------------------------------------------
+ # per perl rules, this should be the last line in such a file:
+ 1;
+
+ # Local variables:
+ # mode: perl
+ # End:
+ # vim: set syn=perl:
+ '';
+ };
+ };
+}
diff --git a/pkgs/by-name/gr/grokmirror/package.nix b/pkgs/by-name/gr/grokmirror/package.nix
new file mode 100644
index 0000000..866758d
--- /dev/null
+++ b/pkgs/by-name/gr/grokmirror/package.nix
@@ -0,0 +1,33 @@
+{
+ lib,
+ stdenv,
+ python3Packages,
+ fetchFromGitHub,
+}:
+
+python3Packages.buildPythonPackage (finalAttrs: {
+ pname = "grokmirror";
+ version = "2.0.12";
+ format = "setuptools";
+
+ __structuredAttrs = true;
+
+ src = fetchFromGitHub {
+ owner = "mricon";
+ repo = "grokmirror";
+ tag = "v${finalAttrs.version}";
+ hash = "sha256-4UwVcE5IYUmAkgbLTFg5Rw5yZUZWkok3iw7LO8pplV4=";
+ };
+
+ propagatedBuildInputs = with python3Packages; [
+ packaging
+ requests
+ ];
+
+ meta = {
+ homepage = "https://github.com/mricon/grokmirror";
+ description = "Framework to smartly mirror git repositories";
+ license = lib.licenses.gpl3Only;
+ maintainers = with lib.maintainers; [ maxmosk ];
+ };
+})
diff --git a/pkgs/default.nix b/pkgs/default.nix
new file mode 100644
index 0000000..4617bf9
--- /dev/null
+++ b/pkgs/default.nix
@@ -0,0 +1,7 @@
+{ nixpkgs, ... }:
+let
+ by-name-overlay = import "${nixpkgs}/pkgs/top-level/by-name-overlay.nix" ./by-name;
+in
+{
+ nixpkgs.overlays = [ by-name-overlay ];
+}
diff --git a/servers/cgit-hardware-configuration.nix b/servers/cgit-hardware-configuration.nix
new file mode 100644
index 0000000..f5108e4
--- /dev/null
+++ b/servers/cgit-hardware-configuration.nix
@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations. Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+ config,
+ lib,
+ pkgs,
+ modulesPath,
+ ...
+}:
+
+{
+ imports = [
+ (modulesPath + "/profiles/qemu-guest.nix")
+ ];
+
+ boot.initrd.availableKernelModules = [
+ "ata_piix"
+ "uhci_hcd"
+ "virtio_pci"
+ "sr_mod"
+ "virtio_blk"
+ ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ ];
+ boot.extraModulePackages = [ ];
+
+ # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+ # (the default) this is the recommended approach. When using systemd-networkd it's
+ # still possible to use this option, but it's recommended to use it in conjunction
+ # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+ networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
+
+ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/servers/cgit.nix b/servers/cgit.nix
new file mode 100644
index 0000000..e5a32da
--- /dev/null
+++ b/servers/cgit.nix
@@ -0,0 +1,23 @@
+{
+ config,
+ pkgs,
+ lib,
+ modulesPath,
+ ...
+}:
+{
+ imports = [
+ (modulesPath + "/installer/scan/not-detected.nix")
+ (modulesPath + "/profiles/qemu-guest.nix")
+ ./cgit-hardware-configuration.nix
+ ];
+
+ networking.hostName = "cgit";
+
+ landau.services = {
+ cgit.enable = true;
+ gitolite.enable = true;
+ };
+
+ hostings.beget.enable = true;
+}
--
2.54.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* [rulkc] [PATCH] nix: introduce initial generic configuration
2026-05-23 23:47 maximmosk4
@ 2026-05-25 16:46 ` slava
0 siblings, 0 replies; 3+ messages in thread
From: slava @ 2026-05-25 16:46 UTC (permalink / raw)
On Sun, 2026-05-24 at 02:47 +0300, Maxim Moskalets wrote:
> From b79db7775ef24c75cd85becf98618d16344d2daf Mon Sep 17 00:00:00
> 2001
> From: Maxim Moskalets <Maxim.Moskalets at kaspersky.com>
> Date: Fri, 22 May 2026 23:55:35 +0300
> Subject: [PATCH] nix: introduce initial generic configuration
>
Where is the commit message? It is completely not clear what this patch
is about and what is the goal of the patch. Every patch MUST HAVE a
clear and precise commit message.
Thanks,
Slava.
> Signed-off-by: Maxim Moskalets <Maxim.Moskalets at kaspersky.com>
> ---
> config/default.nix | 8 +++++
> config/disko.nix | 33 +++++++++++++++++
> config/nix.nix | 8 +++++
> config/programs/default.nix | 5 +++
> config/programs/neovim.nix | 8 +++++
> config/services/default.nix | 6 ++++
> config/services/firewall.nix | 3 ++
> config/services/ssh.nix | 21 +++++++++++
> flake.lock | 48
> +++++++++++++++++++++++++
> flake.nix | 37 +++++++++++++++++++
> modules/admins.nix | 39 ++++++++++++++++++++
> modules/default.nix | 7 ++++
> modules/hostings/beget.nix | 34 ++++++++++++++++++
> modules/hostings/default.nix | 6 ++++
> modules/hostings/selectel.nix | 29 +++++++++++++++
> modules/services/default.nix | 3 ++
> modules/services/landau-cgit.nix | 42 ++++++++++++++++++++++
> servers/cgit-hardware-configuration.nix | 2 ++
> servers/cgit.nix | 21 +++++++++++
> 19 files changed, 360 insertions(+)
> create mode 100644 config/default.nix
> create mode 100644 config/disko.nix
> create mode 100644 config/nix.nix
> create mode 100644 config/programs/default.nix
> create mode 100644 config/programs/neovim.nix
> create mode 100644 config/services/default.nix
> create mode 100644 config/services/firewall.nix
> create mode 100644 config/services/ssh.nix
> create mode 100644 flake.lock
> create mode 100644 flake.nix
> create mode 100644 modules/admins.nix
> create mode 100644 modules/default.nix
> create mode 100644 modules/hostings/beget.nix
> create mode 100644 modules/hostings/default.nix
> create mode 100644 modules/hostings/selectel.nix
> create mode 100644 modules/services/default.nix
> create mode 100644 modules/services/landau-cgit.nix
> create mode 100644 servers/cgit-hardware-configuration.nix
> create mode 100644 servers/cgit.nix
>
> diff --git a/config/default.nix b/config/default.nix
> new file mode 100644
> index 0000000..764f222
> --- /dev/null
> +++ b/config/default.nix
> @@ -0,0 +1,8 @@
> +{
> + imports = [
> + ./disko.nix
> + ./nix.nix
> + ./programs
> + ./services
> + ];
> +}
> diff --git a/config/disko.nix b/config/disko.nix
> new file mode 100644
> index 0000000..7366aee
> --- /dev/null
> +++ b/config/disko.nix
> @@ -0,0 +1,33 @@
> +{
> + disko.devices.disk.main = {
> + type = "disk";
> + content = {
> + type = "gpt";
> + partitions = {
> + boot = {
> + name = "boot";
> + size = "1M";
> + type = "EF02";
> + };
> + esp = {
> + size = "256M";
> + type = "EF00";
> + content = {
> + type = "filesystem";
> + format = "vfat";
> + mountpoint = "/boot";
> + };
> + };
> + root = {
> + name = "root";
> + size = "100%";
> + content = {
> + type = "filesystem";
> + format = "ext4";
> + mountpoint = "/";
> + };
> + };
> + };
> + };
> + };
> +}
> diff --git a/config/nix.nix b/config/nix.nix
> new file mode 100644
> index 0000000..5b8037c
> --- /dev/null
> +++ b/config/nix.nix
> @@ -0,0 +1,8 @@
> +{
> + nix.settings.experimental-features = [
> + "nix-command"
> + "flakes"
> + ];
> +
> + system.stateVersion = "25.11";
> +}
> diff --git a/config/programs/default.nix
> b/config/programs/default.nix
> new file mode 100644
> index 0000000..73b5f39
> --- /dev/null
> +++ b/config/programs/default.nix
> @@ -0,0 +1,5 @@
> +{
> + imports = [
> + ./neovim.nix
> + ];
> +}
> diff --git a/config/programs/neovim.nix b/config/programs/neovim.nix
> new file mode 100644
> index 0000000..d4abca3
> --- /dev/null
> +++ b/config/programs/neovim.nix
> @@ -0,0 +1,8 @@
> +{
> + programs.neovim = {
> + enable = true;
> + defaultEditor = true;
> + viAlias = true;
> + vimAlias = true;
> + };
> +}
> diff --git a/config/services/default.nix
> b/config/services/default.nix
> new file mode 100644
> index 0000000..88c5d35
> --- /dev/null
> +++ b/config/services/default.nix
> @@ -0,0 +1,6 @@
> +{
> + imports = [
> + ./firewall.nix
> + ./ssh.nix
> + ];
> +}
> diff --git a/config/services/firewall.nix
> b/config/services/firewall.nix
> new file mode 100644
> index 0000000..09045f4
> --- /dev/null
> +++ b/config/services/firewall.nix
> @@ -0,0 +1,3 @@
> +{
> + networking.firewall.enable = true;
> +}
> diff --git a/config/services/ssh.nix b/config/services/ssh.nix
> new file mode 100644
> index 0000000..edf5651
> --- /dev/null
> +++ b/config/services/ssh.nix
> @@ -0,0 +1,21 @@
> +let
> + ports = [
> + 22
> + 8822
> + ];
> +in
> +{
> + services.openssh = {
> + enable = true;
> + allowSFTP = false;
> + inherit ports;
> + settings = {
> + PasswordAuthentication = false;
> + PermitRootLogin = "no";
> + AllowGroups = [ "wheel" ];
> + KbdInteractiveAuthentication = false;
> + };
> + };
> +
> + networking.firewall.allowedTCPPorts = ports;
> +}
> diff --git a/flake.lock b/flake.lock
> new file mode 100644
> index 0000000..6414d27
> --- /dev/null
> +++ b/flake.lock
> @@ -0,0 +1,48 @@
> +{
> + "nodes": {
> + "disko": {
> + "inputs": {
> + "nixpkgs": [
> + "nixpkgs"
> + ]
> + },
> + "locked": {
> + "lastModified": 1779226674,
> + "narHash": "sha256-
> wuOkjI6pRiN4sEn/EPBRnNW5cmcpvd7xtIM8y5LooAs=",
> + "owner": "nix-community",
> + "repo": "disko",
> + "rev": "65fb947964bd44fc0008faf77d1fcb7a9f40bb32",
> + "type": "github"
> + },
> + "original": {
> + "owner": "nix-community",
> + "repo": "disko",
> + "type": "github"
> + }
> + },
> + "nixpkgs": {
> + "locked": {
> + "lastModified": 1779102034,
> + "narHash": "sha256-
> vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=",
> + "owner": "NixOS",
> + "repo": "nixpkgs",
> + "rev": "687f05a9184cad4eaf905c48b63649e3a86f5433",
> + "type": "github"
> + },
> + "original": {
> + "owner": "NixOS",
> + "ref": "nixos-25.11",
> + "repo": "nixpkgs",
> + "type": "github"
> + }
> + },
> + "root": {
> + "inputs": {
> + "disko": "disko",
> + "nixpkgs": "nixpkgs"
> + }
> + }
> + },
> + "root": "root",
> + "version": 7
> +}
> diff --git a/flake.nix b/flake.nix
> new file mode 100644
> index 0000000..cd8d8e1
> --- /dev/null
> +++ b/flake.nix
> @@ -0,0 +1,37 @@
> +{
> + description = "LANDAU infrastructure";
> +
> + inputs = {
> + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
> + disko = {
> + url = "github:nix-community/disko";
> + inputs.nixpkgs.follows = "nixpkgs";
> + };
> + };
> +
> + outputs =
> + {
> + nixpkgs,
> + disko,
> + ...
> + }:
> + let
> + makeServerSystem =
> + modules: extraConfig:
> + nixpkgs.lib.nixosSystem {
> + system = "x86_64-linux";
> + modules = [
> + disko.nixosModules.disko
> + ./config
> + ./modules
> + ]
> + ++ modules;
> + }
> + // extraConfig;
> + in
> + {
> + nixosConfigurations = {
> + cgit = makeServerSystem [ ./servers/cgit.nix ] { };
> + };
> + };
> +}
> diff --git a/modules/admins.nix b/modules/admins.nix
> new file mode 100644
> index 0000000..2d7e7e8
> --- /dev/null
> +++ b/modules/admins.nix
> @@ -0,0 +1,39 @@
> +{
> + config,
> + lib,
> + ...
> +}:
> +
> +{
> + options.admins = {
> + all = lib.mkEnableOption "All availiable admins";
> + moskalets = lib.mkEnableOption "Maxim Moskalets admin";
> + };
> +
> + config.users.users =
> + let
> + makeAdmin =
> + user: description: extraAttrs:
> + lib.mkIf (config.admins.${user} || config.admins.all) {
> + isNormalUser = true;
> + inherit description;
> + extraGroups = [
> + "wheel"
> + ];
> + }
> + // extraAttrs;
> + in
> + {
> + moskalets = makeAdmin "moskalets" "Maxim Moskalets" {
> + # $ argon2 $(openssl rand -base64 18) -id -t 4 -m 18 -p 4
> + # <password>
> + initialHashedPassword = null;
> +
> + # YubiKey
> + openssh.authorizedKeys.keys = [
> + "ssh-rsa
> AAAAB3NzaC1yc2EAAAADAQABAAACAQDH+C8vzOOqDx7un96FhGewfE6UufLHys3Y3ke6W
> xoV05XPWc+d/1T9wCU7escUgdOUI90+Ps/0Os4PzfP0znOE08Xj+6nZsRSkhu+WEFyRu8
> e86NRoCEIk2u8WNxMhR112taT6bLf/TRWzDyai159sKz7PhuIW/uP/SwsIzpr+AWhBVzz
> T0Ytz3QVX4JCrRYXyuFwTLNIFRzziKBP69nkl/KKwRdULGIzlGXqHTOzLLL26sSWuGTaZ
> g3ao+DfLV5gmL3VkU9jEyF2OVodsxmQ3qeoRRsHlSy7FmQeCg4I3uhbi/v8bR1xyhfn7Y
> LaKfFkuTnK0EfFfbRTPLyWglwb3yeulkUg3oDc4AKSoks3Dzi53LBSEI//5Yw3nfFu3Hu
> 85UgZQ6A9lRolrkibjKil1s8yodU5vSGKtGkh98U//KzXDEHOLqZ7mfY+hvvY11oQ0KOL
> YzgYX9hwvMgYTa3dmzADRfs/PMfOqja1TDsVvnHNnIfmjNe8WojbBPzB8ytmTDpMERIAO
> NwyR2p0Bf6fon04hQu/yyc/iE+zbn/JDf9LYbj4+yr6RpRJXbbh5KsfXAJ6vf0XBEkdV5
> KymD1N6Ni44lGFwg5clDs3rj5K/liSZK4joyqUaUtzGi0DxwT1lypl87iJpw0cThCOr80
> fVl4FiyEkTjZjMc0UP/cA6BQ== cardno:29_610_165
> +"
> + ];
> + };
> + };
> +}
> diff --git a/modules/default.nix b/modules/default.nix
> new file mode 100644
> index 0000000..a1f9a42
> --- /dev/null
> +++ b/modules/default.nix
> @@ -0,0 +1,7 @@
> +{
> + imports = [
> + ./admins.nix
> + ./hostings
> + ./services
> + ];
> +}
> diff --git a/modules/hostings/beget.nix b/modules/hostings/beget.nix
> new file mode 100644
> index 0000000..4ee53ce
> --- /dev/null
> +++ b/modules/hostings/beget.nix
> @@ -0,0 +1,34 @@
> +{
> + config,
> + lib,
> + ...
> +}:
> +
> +{
> + options.hostings.beget.enable = lib.mkEnableOption "Server on
> Beget platform";
> +
> + # See
> https://beget.com/ru/kb/faq/cloud/sozdanie-servera-iz-svoego-obraza
> + config = lib.mkIf config.hostings.beget.enable {
> + disko.devices.disk.main.device = "/dev/vda";
> +
> + boot.loader.grub.efiSupport = false;
> +
> + services.qemuGuest.enable = true;
> + services.cloud-init = {
> + enable = true;
> + network.enable = true;
> + settings = {
> + datasource_list = [
> + "NoCloud"
> + "ConfigDrive"
> + ];
> + };
> + };
> +
> + networking = {
> + useDHCP = false;
> + useNetworkd = true;
> + networkmanager.enable = false;
> + };
> + };
> +}
> diff --git a/modules/hostings/default.nix
> b/modules/hostings/default.nix
> new file mode 100644
> index 0000000..cab83b2
> --- /dev/null
> +++ b/modules/hostings/default.nix
> @@ -0,0 +1,6 @@
> +{
> + imports = [
> + ./beget.nix
> + ./selectel.nix
> + ];
> +}
> diff --git a/modules/hostings/selectel.nix
> b/modules/hostings/selectel.nix
> new file mode 100644
> index 0000000..0880dbe
> --- /dev/null
> +++ b/modules/hostings/selectel.nix
> @@ -0,0 +1,29 @@
> +{
> + config,
> + lib,
> + ...
> +}:
> +
> +{
> + options.hostings.selectel.enable = lib.mkEnableOption "Server on
> Selectel platform";
> +
> + # See
> https://docs.selectel.ru/en/cloud-servers/images/create-custom-image/
> + config = lib.mkIf config.hostings.selectel.enable {
> + disko.devices.disk.main.device = "/dev/sda";
> +
> + boot.loader.grub.efiSupport = false;
> +
> + services.qemuGuest.enable = true;
> + services.cloud-init = {
> + enable = true;
> + network.enable = true;
> + settings = {
> + datasource_list = [
> + "ConfigDrive"
> + "Ec2"
> + "None"
> + ];
> + };
> + };
> + };
> +}
> diff --git a/modules/services/default.nix
> b/modules/services/default.nix
> new file mode 100644
> index 0000000..83797f7
> --- /dev/null
> +++ b/modules/services/default.nix
> @@ -0,0 +1,3 @@
> +{
> + imports = [ ./landau-cgit.nix ];
> +}
> diff --git a/modules/services/landau-cgit.nix
> b/modules/services/landau-cgit.nix
> new file mode 100644
> index 0000000..66412a9
> --- /dev/null
> +++ b/modules/services/landau-cgit.nix
> @@ -0,0 +1,42 @@
> +{
> + config,
> + lib,
> + ...
> +}:
> +let
> + host = "git.rulkc.org";
> + mkAssetPath = file: toString (./. +
> "/../../git.rulkc.org/cgit/${file}");
> +in
> +{
> + options.services.landau-cgit.enable = lib.mkEnableOption "cgit
> configured for LANDAU";
> +
> + config = lib.mkIf config.services.landau-cgit.enable {
> + services.nginx.virtualHosts.${host}.locations = {
> + "= /cgit.png".alias = mkAssetPath "cgit.png";
> + "= /cgit.css".alias = mkAssetPath "cgit.css";
> + "= /favicon.ico".alias = mkAssetPath "favicon.ico";
> + };
> +
> + services.cgit.${host} = {
> + enable = true;
> + scanPath = "/var/lib/git";
> + gitHttpBackend.checkExportOkFiles = false;
> + settings = {
> + # Features
> + enable-git-config = true;
> + enable-http-clone = true;
> + enable-index-owner = true;
> + snapshots = "tar.gz zip";
> +
> + # Appearance
> + root-title = "LANDAU git repositories";
> + root-desc = "Git repositories for Linux kernel Advanced for
> Next-gen Devices & Architectures";
> +
> + clone-url = "https://${host}/$CGIT_REPO_URL
> git://git.rulkc.org/$CGIT_REPO_URL ssh://git@${host}/$CGIT_REPO_URL";
> + section-from-path = 3;
> + max-stats = "quarter";
> + };
> + };
> + networking.firewall.allowedTCPPorts = [ 80 ];
> + };
> +}
> diff --git a/servers/cgit-hardware-configuration.nix b/servers/cgit-
> hardware-configuration.nix
> new file mode 100644
> index 0000000..2cc9b40
> --- /dev/null
> +++ b/servers/cgit-hardware-configuration.nix
> @@ -0,0 +1,2 @@
> +{ }
> +#throw "Run nixos-anywhere with `--generate-hardware-config nixos-
> generate-config ./servers/cgit-hardware-configuration.nix`"
> diff --git a/servers/cgit.nix b/servers/cgit.nix
> new file mode 100644
> index 0000000..916dc33
> --- /dev/null
> +++ b/servers/cgit.nix
> @@ -0,0 +1,21 @@
> +{
> + config,
> + pkgs,
> + lib,
> + modulesPath,
> + ...
> +}:
> +{
> + imports = [
> + (modulesPath + "/installer/scan/not-detected.nix")
> + (modulesPath + "/profiles/qemu-guest.nix")
> + ./cgit-hardware-configuration.nix
> + ];
> +
> + networking.hostname = "cgit";
> +
> + services.landau-cgit.enable = true;
> + hostings.beget.enable = true;
> +
> + admins.moskalets = true;
> +}
^ permalink raw reply [flat|nested] 3+ messages in thread
* [rulkc] [PATCH] nix: introduce initial generic configuration
@ 2026-05-23 23:47 maximmosk4
2026-05-25 16:46 ` slava
0 siblings, 1 reply; 3+ messages in thread
From: maximmosk4 @ 2026-05-23 23:47 UTC (permalink / raw)
>From b79db7775ef24c75cd85becf98618d16344d2daf Mon Sep 17 00:00:00 2001
From: Maxim Moskalets <Maxim.Moskalets at kaspersky.com>
Date: Fri, 22 May 2026 23:55:35 +0300
Subject: [PATCH] nix: introduce initial generic configuration
Signed-off-by: Maxim Moskalets <Maxim.Moskalets at kaspersky.com>
---
config/default.nix | 8 +++++
config/disko.nix | 33 +++++++++++++++++
config/nix.nix | 8 +++++
config/programs/default.nix | 5 +++
config/programs/neovim.nix | 8 +++++
config/services/default.nix | 6 ++++
config/services/firewall.nix | 3 ++
config/services/ssh.nix | 21 +++++++++++
flake.lock | 48 +++++++++++++++++++++++++
flake.nix | 37 +++++++++++++++++++
modules/admins.nix | 39 ++++++++++++++++++++
modules/default.nix | 7 ++++
modules/hostings/beget.nix | 34 ++++++++++++++++++
modules/hostings/default.nix | 6 ++++
modules/hostings/selectel.nix | 29 +++++++++++++++
modules/services/default.nix | 3 ++
modules/services/landau-cgit.nix | 42 ++++++++++++++++++++++
servers/cgit-hardware-configuration.nix | 2 ++
servers/cgit.nix | 21 +++++++++++
19 files changed, 360 insertions(+)
create mode 100644 config/default.nix
create mode 100644 config/disko.nix
create mode 100644 config/nix.nix
create mode 100644 config/programs/default.nix
create mode 100644 config/programs/neovim.nix
create mode 100644 config/services/default.nix
create mode 100644 config/services/firewall.nix
create mode 100644 config/services/ssh.nix
create mode 100644 flake.lock
create mode 100644 flake.nix
create mode 100644 modules/admins.nix
create mode 100644 modules/default.nix
create mode 100644 modules/hostings/beget.nix
create mode 100644 modules/hostings/default.nix
create mode 100644 modules/hostings/selectel.nix
create mode 100644 modules/services/default.nix
create mode 100644 modules/services/landau-cgit.nix
create mode 100644 servers/cgit-hardware-configuration.nix
create mode 100644 servers/cgit.nix
diff --git a/config/default.nix b/config/default.nix
new file mode 100644
index 0000000..764f222
--- /dev/null
+++ b/config/default.nix
@@ -0,0 +1,8 @@
+{
+ imports = [
+ ./disko.nix
+ ./nix.nix
+ ./programs
+ ./services
+ ];
+}
diff --git a/config/disko.nix b/config/disko.nix
new file mode 100644
index 0000000..7366aee
--- /dev/null
+++ b/config/disko.nix
@@ -0,0 +1,33 @@
+{
+ disko.devices.disk.main = {
+ type = "disk";
+ content = {
+ type = "gpt";
+ partitions = {
+ boot = {
+ name = "boot";
+ size = "1M";
+ type = "EF02";
+ };
+ esp = {
+ size = "256M";
+ type = "EF00";
+ content = {
+ type = "filesystem";
+ format = "vfat";
+ mountpoint = "/boot";
+ };
+ };
+ root = {
+ name = "root";
+ size = "100%";
+ content = {
+ type = "filesystem";
+ format = "ext4";
+ mountpoint = "/";
+ };
+ };
+ };
+ };
+ };
+}
diff --git a/config/nix.nix b/config/nix.nix
new file mode 100644
index 0000000..5b8037c
--- /dev/null
+++ b/config/nix.nix
@@ -0,0 +1,8 @@
+{
+ nix.settings.experimental-features = [
+ "nix-command"
+ "flakes"
+ ];
+
+ system.stateVersion = "25.11";
+}
diff --git a/config/programs/default.nix b/config/programs/default.nix
new file mode 100644
index 0000000..73b5f39
--- /dev/null
+++ b/config/programs/default.nix
@@ -0,0 +1,5 @@
+{
+ imports = [
+ ./neovim.nix
+ ];
+}
diff --git a/config/programs/neovim.nix b/config/programs/neovim.nix
new file mode 100644
index 0000000..d4abca3
--- /dev/null
+++ b/config/programs/neovim.nix
@@ -0,0 +1,8 @@
+{
+ programs.neovim = {
+ enable = true;
+ defaultEditor = true;
+ viAlias = true;
+ vimAlias = true;
+ };
+}
diff --git a/config/services/default.nix b/config/services/default.nix
new file mode 100644
index 0000000..88c5d35
--- /dev/null
+++ b/config/services/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./firewall.nix
+ ./ssh.nix
+ ];
+}
diff --git a/config/services/firewall.nix b/config/services/firewall.nix
new file mode 100644
index 0000000..09045f4
--- /dev/null
+++ b/config/services/firewall.nix
@@ -0,0 +1,3 @@
+{
+ networking.firewall.enable = true;
+}
diff --git a/config/services/ssh.nix b/config/services/ssh.nix
new file mode 100644
index 0000000..edf5651
--- /dev/null
+++ b/config/services/ssh.nix
@@ -0,0 +1,21 @@
+let
+ ports = [
+ 22
+ 8822
+ ];
+in
+{
+ services.openssh = {
+ enable = true;
+ allowSFTP = false;
+ inherit ports;
+ settings = {
+ PasswordAuthentication = false;
+ PermitRootLogin = "no";
+ AllowGroups = [ "wheel" ];
+ KbdInteractiveAuthentication = false;
+ };
+ };
+
+ networking.firewall.allowedTCPPorts = ports;
+}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..6414d27
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,48 @@
+{
+ "nodes": {
+ "disko": {
+ "inputs": {
+ "nixpkgs": [
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1779226674,
+ "narHash": "sha256-wuOkjI6pRiN4sEn/EPBRnNW5cmcpvd7xtIM8y5LooAs=",
+ "owner": "nix-community",
+ "repo": "disko",
+ "rev": "65fb947964bd44fc0008faf77d1fcb7a9f40bb32",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nix-community",
+ "repo": "disko",
+ "type": "github"
+ }
+ },
+ "nixpkgs": {
+ "locked": {
+ "lastModified": 1779102034,
+ "narHash": "sha256-vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=",
+ "owner": "NixOS",
+ "repo": "nixpkgs",
+ "rev": "687f05a9184cad4eaf905c48b63649e3a86f5433",
+ "type": "github"
+ },
+ "original": {
+ "owner": "NixOS",
+ "ref": "nixos-25.11",
+ "repo": "nixpkgs",
+ "type": "github"
+ }
+ },
+ "root": {
+ "inputs": {
+ "disko": "disko",
+ "nixpkgs": "nixpkgs"
+ }
+ }
+ },
+ "root": "root",
+ "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..cd8d8e1
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,37 @@
+{
+ description = "LANDAU infrastructure";
+
+ inputs = {
+ nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+ disko = {
+ url = "github:nix-community/disko";
+ inputs.nixpkgs.follows = "nixpkgs";
+ };
+ };
+
+ outputs =
+ {
+ nixpkgs,
+ disko,
+ ...
+ }:
+ let
+ makeServerSystem =
+ modules: extraConfig:
+ nixpkgs.lib.nixosSystem {
+ system = "x86_64-linux";
+ modules = [
+ disko.nixosModules.disko
+ ./config
+ ./modules
+ ]
+ ++ modules;
+ }
+ // extraConfig;
+ in
+ {
+ nixosConfigurations = {
+ cgit = makeServerSystem [ ./servers/cgit.nix ] { };
+ };
+ };
+}
diff --git a/modules/admins.nix b/modules/admins.nix
new file mode 100644
index 0000000..2d7e7e8
--- /dev/null
+++ b/modules/admins.nix
@@ -0,0 +1,39 @@
+{
+ config,
+ lib,
+ ...
+}:
+
+{
+ options.admins = {
+ all = lib.mkEnableOption "All availiable admins";
+ moskalets = lib.mkEnableOption "Maxim Moskalets admin";
+ };
+
+ config.users.users =
+ let
+ makeAdmin =
+ user: description: extraAttrs:
+ lib.mkIf (config.admins.${user} || config.admins.all) {
+ isNormalUser = true;
+ inherit description;
+ extraGroups = [
+ "wheel"
+ ];
+ }
+ // extraAttrs;
+ in
+ {
+ moskalets = makeAdmin "moskalets" "Maxim Moskalets" {
+ # $ argon2 $(openssl rand -base64 18) -id -t 4 -m 18 -p 4
+ # <password>
+ initialHashedPassword = null;
+
+ # YubiKey
+ openssh.authorizedKeys.keys = [
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDH+C8vzOOqDx7un96FhGewfE6UufLHys3Y3ke6WxoV05XPWc+d/1T9wCU7escUgdOUI90+Ps/0Os4PzfP0znOE08Xj+6nZsRSkhu+WEFyRu8e86NRoCEIk2u8WNxMhR112taT6bLf/TRWzDyai159sKz7PhuIW/uP/SwsIzpr+AWhBVzzT0Ytz3QVX4JCrRYXyuFwTLNIFRzziKBP69nkl/KKwRdULGIzlGXqHTOzLLL26sSWuGTaZg3ao+DfLV5gmL3VkU9jEyF2OVodsxmQ3qeoRRsHlSy7FmQeCg4I3uhbi/v8bR1xyhfn7YLaKfFkuTnK0EfFfbRTPLyWglwb3yeulkUg3oDc4AKSoks3Dzi53LBSEI//5Yw3nfFu3Hu85UgZQ6A9lRolrkibjKil1s8yodU5vSGKtGkh98U//KzXDEHOLqZ7mfY+hvvY11oQ0KOLYzgYX9hwvMgYTa3dmzADRfs/PMfOqja1TDsVvnHNnIfmjNe8WojbBPzB8ytmTDpMERIAONwyR2p0Bf6fon04hQu/yyc/iE+zbn/JDf9LYbj4+yr6RpRJXbbh5KsfXAJ6vf0XBEkdV5KymD1N6Ni44lGFwg5clDs3rj5K/liSZK4joyqUaUtzGi0DxwT1lypl87iJpw0cThCOr80fVl4FiyEkTjZjMc0UP/cA6BQ== cardno:29_610_165
+"
+ ];
+ };
+ };
+}
diff --git a/modules/default.nix b/modules/default.nix
new file mode 100644
index 0000000..a1f9a42
--- /dev/null
+++ b/modules/default.nix
@@ -0,0 +1,7 @@
+{
+ imports = [
+ ./admins.nix
+ ./hostings
+ ./services
+ ];
+}
diff --git a/modules/hostings/beget.nix b/modules/hostings/beget.nix
new file mode 100644
index 0000000..4ee53ce
--- /dev/null
+++ b/modules/hostings/beget.nix
@@ -0,0 +1,34 @@
+{
+ config,
+ lib,
+ ...
+}:
+
+{
+ options.hostings.beget.enable = lib.mkEnableOption "Server on Beget platform";
+
+ # See https://beget.com/ru/kb/faq/cloud/sozdanie-servera-iz-svoego-obraza
+ config = lib.mkIf config.hostings.beget.enable {
+ disko.devices.disk.main.device = "/dev/vda";
+
+ boot.loader.grub.efiSupport = false;
+
+ services.qemuGuest.enable = true;
+ services.cloud-init = {
+ enable = true;
+ network.enable = true;
+ settings = {
+ datasource_list = [
+ "NoCloud"
+ "ConfigDrive"
+ ];
+ };
+ };
+
+ networking = {
+ useDHCP = false;
+ useNetworkd = true;
+ networkmanager.enable = false;
+ };
+ };
+}
diff --git a/modules/hostings/default.nix b/modules/hostings/default.nix
new file mode 100644
index 0000000..cab83b2
--- /dev/null
+++ b/modules/hostings/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./beget.nix
+ ./selectel.nix
+ ];
+}
diff --git a/modules/hostings/selectel.nix b/modules/hostings/selectel.nix
new file mode 100644
index 0000000..0880dbe
--- /dev/null
+++ b/modules/hostings/selectel.nix
@@ -0,0 +1,29 @@
+{
+ config,
+ lib,
+ ...
+}:
+
+{
+ options.hostings.selectel.enable = lib.mkEnableOption "Server on Selectel platform";
+
+ # See https://docs.selectel.ru/en/cloud-servers/images/create-custom-image/
+ config = lib.mkIf config.hostings.selectel.enable {
+ disko.devices.disk.main.device = "/dev/sda";
+
+ boot.loader.grub.efiSupport = false;
+
+ services.qemuGuest.enable = true;
+ services.cloud-init = {
+ enable = true;
+ network.enable = true;
+ settings = {
+ datasource_list = [
+ "ConfigDrive"
+ "Ec2"
+ "None"
+ ];
+ };
+ };
+ };
+}
diff --git a/modules/services/default.nix b/modules/services/default.nix
new file mode 100644
index 0000000..83797f7
--- /dev/null
+++ b/modules/services/default.nix
@@ -0,0 +1,3 @@
+{
+ imports = [ ./landau-cgit.nix ];
+}
diff --git a/modules/services/landau-cgit.nix b/modules/services/landau-cgit.nix
new file mode 100644
index 0000000..66412a9
--- /dev/null
+++ b/modules/services/landau-cgit.nix
@@ -0,0 +1,42 @@
+{
+ config,
+ lib,
+ ...
+}:
+let
+ host = "git.rulkc.org";
+ mkAssetPath = file: toString (./. + "/../../git.rulkc.org/cgit/${file}");
+in
+{
+ options.services.landau-cgit.enable = lib.mkEnableOption "cgit configured for LANDAU";
+
+ config = lib.mkIf config.services.landau-cgit.enable {
+ services.nginx.virtualHosts.${host}.locations = {
+ "= /cgit.png".alias = mkAssetPath "cgit.png";
+ "= /cgit.css".alias = mkAssetPath "cgit.css";
+ "= /favicon.ico".alias = mkAssetPath "favicon.ico";
+ };
+
+ services.cgit.${host} = {
+ enable = true;
+ scanPath = "/var/lib/git";
+ gitHttpBackend.checkExportOkFiles = false;
+ settings = {
+ # Features
+ enable-git-config = true;
+ enable-http-clone = true;
+ enable-index-owner = true;
+ snapshots = "tar.gz zip";
+
+ # Appearance
+ root-title = "LANDAU git repositories";
+ root-desc = "Git repositories for Linux kernel Advanced for Next-gen Devices & Architectures";
+
+ clone-url = "https://${host}/$CGIT_REPO_URL git://git.rulkc.org/$CGIT_REPO_URL ssh://git@${host}/$CGIT_REPO_URL";
+ section-from-path = 3;
+ max-stats = "quarter";
+ };
+ };
+ networking.firewall.allowedTCPPorts = [ 80 ];
+ };
+}
diff --git a/servers/cgit-hardware-configuration.nix b/servers/cgit-hardware-configuration.nix
new file mode 100644
index 0000000..2cc9b40
--- /dev/null
+++ b/servers/cgit-hardware-configuration.nix
@@ -0,0 +1,2 @@
+{ }
+#throw "Run nixos-anywhere with `--generate-hardware-config nixos-generate-config ./servers/cgit-hardware-configuration.nix`"
diff --git a/servers/cgit.nix b/servers/cgit.nix
new file mode 100644
index 0000000..916dc33
--- /dev/null
+++ b/servers/cgit.nix
@@ -0,0 +1,21 @@
+{
+ config,
+ pkgs,
+ lib,
+ modulesPath,
+ ...
+}:
+{
+ imports = [
+ (modulesPath + "/installer/scan/not-detected.nix")
+ (modulesPath + "/profiles/qemu-guest.nix")
+ ./cgit-hardware-configuration.nix
+ ];
+
+ networking.hostname = "cgit";
+
+ services.landau-cgit.enable = true;
+ hostings.beget.enable = true;
+
+ admins.moskalets = true;
+}
--
2.51.2
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-21 21:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-21 21:12 [rulkc] [PATCH] nix: introduce initial generic configuration maxmoskm
-- strict thread matches above, loose matches on Subject: below --
2026-05-23 23:47 maximmosk4
2026-05-25 16:46 ` slava
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®