Initial commit

hosts/server/natsu/services/caddy.nix

@@ -0,0 +1,122 @@
+{ pkgs, ... }:
+
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts."http://natsu.icn.mizuki.guru".extraConfig = ''
+      respond "우응" 200
+    '';
+    virtualHosts."https://file.mizuki.guru".extraConfig = ''
+        reverse_proxy 10.11.8.112 {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+          header_up X-Forwarded-For {remote_host}
+      }
+    '';
+    virtualHosts."http://file.mizuki.guru".extraConfig = ''
+        reverse_proxy 10.11.8.112 {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+          header_up X-Forwarded-For {remote_host}
+      }
+    '';
+
+    virtualHosts."auth.mizuki.guru".extraConfig = ''
+      reverse_proxy 10.11.8.102:9080
+    '';
+
+    virtualHosts."plutos.dazzle.st".extraConfig = ''
+      reverse_proxy epc.hikari.mizuki.arpa:3000
+    '';
+
+    virtualHosts."event.dazzle.st".extraConfig = ''
+      reverse_proxy 10.11.8.102:9794
+    '';
+
+    virtualHosts."pve.hikari.icn.mizuki.guru".extraConfig = ''
+      reverse_proxy https://10.11.8.100:8006 {
+               header_up X-Real-Ip {remote_host}
+               header_up X-Http-Version {http.request.proto}
+               transport http {
+                       tls_insecure_skip_verify
+               }
+       }
+    '';
+
+    virtualHosts."cockpit.hikari.icn.mizuki.guru".extraConfig = ''
+      reverse_proxy https://10.11.8.100:9090 {
+              header_up X-Real-Ip {remote_host}
+              header_up X-Http-Version {http.request.proto}
+              transport http {
+                      tls_insecure_skip_verify
+              }
+      }
+    '';
+
+    virtualHosts."cache.mizuki.guru".extraConfig = ''
+      reverse_proxy 127.0.0.1:5000
+    '';
+
+    virtualHosts."paste.mizuki.guru".extraConfig = ''
+      reverse_proxy 10.11.8.102:11108
+    '';
+    virtualHosts."komodo.mizuki.guru".extraConfig = ''
+      reverse_proxy 10.11.8.102:9120
+    '';
+
+    virtualHosts."ena.mizuki.guru".extraConfig = ''
+      basic_auth {
+        imnyang $2a$10$zA83XKt84pcXiwfkuvNmKOpQ5Cw0IP6m/.1AX0ahkVQaPOzrmFlxm
+      }
+      reverse_proxy 10.20.31.103:3000
+    '';
+
+    virtualHosts."akiyama.mizuki.guru".extraConfig = ''
+      rewrite / /index.avif
+      root * /var/static/akiyama.mizuki.guru
+      file_server
+    '';
+
+    virtualHosts."chef.mizuki.guru".extraConfig = ''
+      root * /var/static/chef.mizuki.guru
+      rewrite / /CyberChef_v10.22.1.html
+      file_server {
+        precompressed br gzip
+      }
+      header {
+        Cache-Control "public, max-age=31536000"
+      }
+    '';
+
+    virtualHosts."blog.imnya.ng".extraConfig = ''
+      reverse_proxy 127.0.0.1:4321
+    '';
+    virtualHosts."netbird.mizuki.guru".extraConfig = ''
+      # Native gRPC (needs HTTP/2 cleartext to backend)
+      @grpc header Content-Type application/grpc*
+      reverse_proxy @grpc h2c://127.0.0.1:8081
+
+      # Combined server paths (relay, signal, management, OAuth2)
+      @backend path /relay* /ws-proxy/* /api/* /oauth2/*
+      reverse_proxy @backend 127.0.0.1:8081
+
+      # Dashboard (everything else)
+      reverse_proxy /* 127.0.0.1:8080
+    '';
+
+    package = pkgs.caddy.withPlugins {
+      plugins = [
+        "github.com/caddy-dns/cloudflare@v0.2.2"
+        "github.com/aksdb/caddy-cgi/v2@v2.2.6"
+        "github.com/shift72/caddy-geo-ip@v0.6.0"
+        "github.com/lolPants/caddy-requestid@v1.1.2"
+        "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
+        "github.com/caddyserver/ntlm-transport@v0.1.2"
+        "github.com/ueffel/caddy-brotli@v1.6.0"
+        "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
+        "github.com/neodyme-labs/user_agent_parse@v0.0.1"
+      ];
+      hash = "sha256-n0LkDBE3JB3zrGYND0EGrKXC+CT0SzRiIjj0QXNZZ8k=";
+    };
+  };
+}

hosts/server/natsu/services/forgejo-runner.nix

@@ -0,0 +1,67 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  runnerSecret = key: {
+    sopsFile = ../secrets/forgejo-runner.yaml;
+    inherit key;
+    owner = "root";
+    group = "root";
+  };
+in
+{
+  sops.secrets."forgejo-runner/token" = runnerSecret "forgejo-runner/token";
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.my-forgejo-instance = {
+      enable = true;
+      name = "natsu-cicd";
+      tokenFile = config.sops.secrets."forgejo-runner/token".path;
+      url = "https://git.mizuki.guru/";
+      labels = [
+        "node-24:docker://node:24-bookworm"
+        "nixos-latest:docker://nixos/nix"
+        "native:host"
+        "AArch64:host"
+        "ubuntu-latest:docker://git.mizuki.guru/packages/act:ubuntu-latest-aarch64"
+      ];
+
+      # act 엔진의 컨테이너 보안 가드 및 디렉토리 이탈 방지 설정 주입
+      settings = {
+        container = {
+          # 호스트 측의 임시 디렉토리 마운트 허용 범위를 명시
+          valid_volumes = [
+            "/var/run/docker.sock"
+            "/tmp"
+            "/run/user"
+          ];
+          # 컨테이너 내 작업 디렉토리를 절대 경로로 고정하여 탈출 방지
+          workdir = "/workspace";
+        };
+        runner = {
+          # act 실행 환경 내부 임시 경로 강제 고정
+          envs = {
+            ACT_TEMP_DIR = "/tmp/act";
+          };
+        };
+      };
+
+      hostPackages = with pkgs; [
+        bash
+        git
+        python3
+        docker
+        docker-compose
+        docker-buildx
+        nodejs
+        bun
+        wget
+        curl
+      ];
+    };
+  };
+}