refector
This commit is contained in:
parent
42f15beccf
commit
ed42006971
21 changed files with 271 additions and 366 deletions
58
modules/mizukios/features/caddy/common.nix
Normal file
58
modules/mizukios/features/caddy/common.nix
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
cloudflareIpRanges = [
|
||||
"103.21.244.0/22"
|
||||
"103.22.200.0/22"
|
||||
"103.31.4.0/22"
|
||||
"104.16.0.0/13"
|
||||
"104.24.0.0/14"
|
||||
"108.162.192.0/18"
|
||||
"131.0.72.0/22"
|
||||
"141.101.64.0/18"
|
||||
"162.158.0.0/15"
|
||||
"172.64.0.0/13"
|
||||
"173.245.48.0/20"
|
||||
"188.114.96.0/20"
|
||||
"190.93.240.0/20"
|
||||
"197.234.240.0/22"
|
||||
"198.41.128.0/17"
|
||||
"2400:cb00::/32"
|
||||
"2606:4700::/32"
|
||||
"2803:f800::/32"
|
||||
"2405:b500::/32"
|
||||
"2405:8100::/32"
|
||||
"2a06:98c0::/29"
|
||||
"2c0f:f248::/32"
|
||||
];
|
||||
in
|
||||
{
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
email = "imnyang@pm.me";
|
||||
openFirewall = true;
|
||||
package = pkgs.caddy.withPlugins {
|
||||
plugins = [
|
||||
"github.com/caddy-dns/cloudflare@v0.2.4"
|
||||
"github.com/aksdb/caddy-cgi/v2@v2.2.6"
|
||||
"github.com/shift72/caddy-geo-ip@v0.6.0"
|
||||
"github.com/lolPants/caddy-requestid@v1.1.2"
|
||||
"github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
|
||||
"github.com/caddyserver/ntlm-transport@v0.1.2"
|
||||
"github.com/ueffel/caddy-brotli@v1.6.0"
|
||||
"github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
|
||||
"github.com/neodyme-labs/user_agent_parse@v0.0.1"
|
||||
];
|
||||
hash = "sha256-r4MgRk8HpKYx7f8FmA3PKgD/5ZNTIHpQvlE+zRbP0lw=";
|
||||
};
|
||||
globalConfig = ''
|
||||
admin unix//run/caddy/admin.socket
|
||||
storage file_system /var/lib/caddy
|
||||
servers {
|
||||
trusted_proxies static ${builtins.concatStringsSep " " cloudflareIpRanges}
|
||||
client_ip_headers Cf-Connecting-Ip
|
||||
}
|
||||
debug
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -11,29 +11,38 @@ pkgs.writeShellApplication {
|
|||
];
|
||||
|
||||
text = ''
|
||||
set -e
|
||||
set -euo pipefail
|
||||
|
||||
TARGET_NAME="''${1:-$(hostname)}"
|
||||
TARGET_NAME="$(hostname -s)"
|
||||
FLAKE_PATH="."
|
||||
UPLOAD_CACHE=true
|
||||
UPLOAD_CACHE=false
|
||||
MAX_JOBS="''${NIX_BUILD_MAX_JOBS:-4}"
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--upload) UPLOAD_CACHE=true ;;
|
||||
--no-upload) UPLOAD_CACHE=false ;;
|
||||
--help|-h)
|
||||
echo "사용법: nr [호스트명] [--upload|--no-upload]"
|
||||
exit 0
|
||||
;;
|
||||
-*)
|
||||
echo "알 수 없는 옵션입니다: $1" >&2
|
||||
exit 2
|
||||
;;
|
||||
*) TARGET_NAME="$1" ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
EXTRA_BUILD_FLAGS=()
|
||||
BUILD_FLAGS=(--max-jobs "$MAX_JOBS")
|
||||
if [ "$TARGET_NAME" = "kazusa" ]; then
|
||||
EXTRA_BUILD_FLAGS+=("--max-substituter-jobs" "2")
|
||||
BUILD_FLAGS+=("--max-substitution-jobs" "2")
|
||||
fi
|
||||
|
||||
echo "시스템 빌드 중... $TARGET_NAME"
|
||||
# shellcheck disable=SC2086
|
||||
BUILD_PATH=$(nom build "$FLAKE_PATH#nixosConfigurations.$TARGET_NAME.config.system.build.toplevel" \
|
||||
"''${EXTRA_BUILD_FLAGS[@]}" \
|
||||
"''${BUILD_FLAGS[@]}" \
|
||||
--print-out-paths --no-link)
|
||||
|
||||
echo "스위치 중..."
|
||||
|
|
@ -47,4 +56,4 @@ pkgs.writeShellApplication {
|
|||
|
||||
echo "스위치 완료!"
|
||||
'';
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,16 +6,40 @@ pkgs.writeShellApplication {
|
|||
nix-output-monitor
|
||||
openssh
|
||||
coreutils
|
||||
nix
|
||||
attic-client
|
||||
];
|
||||
|
||||
text = ''
|
||||
set -e
|
||||
set -euo pipefail
|
||||
|
||||
TARGET_NAME=""
|
||||
if [ $# -gt 0 ]; then
|
||||
TARGET_NAME="$1"
|
||||
fi
|
||||
FLAKE_PATH="."
|
||||
UPLOAD_CACHE=false
|
||||
MAX_JOBS="''${NIX_BUILD_MAX_JOBS:-4}"
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--upload) UPLOAD_CACHE=true ;;
|
||||
--no-upload) UPLOAD_CACHE=false ;;
|
||||
--help|-h)
|
||||
echo "사용법: nrr <호스트명> [--upload|--no-upload]"
|
||||
exit 0
|
||||
;;
|
||||
-*)
|
||||
echo "알 수 없는 옵션입니다: $1" >&2
|
||||
exit 2
|
||||
;;
|
||||
*)
|
||||
if [ -n "$TARGET_NAME" ]; then
|
||||
echo "호스트명은 하나만 지정할 수 있습니다." >&2
|
||||
exit 2
|
||||
fi
|
||||
TARGET_NAME="$1"
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
declare -A HOST_MAP
|
||||
HOST_MAP["hikari"]="10.11.8.100"
|
||||
|
|
@ -43,17 +67,20 @@ pkgs.writeShellApplication {
|
|||
fi
|
||||
|
||||
echo "시스템 빌드 중..."
|
||||
BUILD_PATH=$(nom build "$FLAKE_PATH#nixosConfigurations.$TARGET_NAME.config.system.build.toplevel" --print-out-paths --no-link --eval-cache --accept-flake-config)
|
||||
BUILD_PATH=$(nom build "$FLAKE_PATH#nixosConfigurations.$TARGET_NAME.config.system.build.toplevel" \
|
||||
--max-jobs "$MAX_JOBS" --print-out-paths --no-link)
|
||||
|
||||
echo "시스템 복사 중... ($BUILD_PATH -> $TARGET_IP)"
|
||||
nix copy --to "ssh://imnyang@$TARGET_IP" "$BUILD_PATH"
|
||||
nix copy --substitute-on-destination --to "ssh://imnyang@$TARGET_IP" "$BUILD_PATH"
|
||||
|
||||
echo "스위치 중..."
|
||||
# shellcheck disable=SC2029
|
||||
ssh "imnyang@$TARGET_IP" "sudo nix-env --profile /nix/var/nix/profiles/system --set \"$BUILD_PATH\" && sudo $BUILD_PATH/bin/switch-to-configuration switch"
|
||||
|
||||
echo "캐시 업로드 중..."
|
||||
attic push imnyang "$BUILD_PATH" || echo "푸시 실패"
|
||||
if [ "$UPLOAD_CACHE" = true ]; then
|
||||
echo "캐시 업로드 중..."
|
||||
attic push imnyang "$BUILD_PATH" || echo "푸시 실패"
|
||||
fi
|
||||
|
||||
echo "배포 완료!"
|
||||
'';
|
||||
|
|
|
|||
6
modules/mizukios/features/remote/authorized-keys.nix
Normal file
6
modules/mizukios/features/remote/authorized-keys.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{ ... }:
|
||||
{
|
||||
users.users.imnyang.openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@mizuki"
|
||||
];
|
||||
}
|
||||
Loading…
Reference in a new issue