wow
This commit is contained in:
parent
d825c4a1f8
commit
f6dbcc2b4f
20 changed files with 540 additions and 26 deletions
123
hosts/server/hikari/hako/services/quadlet/authentik.nix
Normal file
123
hosts/server/hikari/hako/services/quadlet/authentik.nix
Normal file
|
|
@ -0,0 +1,123 @@
|
|||
{ config, ... }:
|
||||
|
||||
let
|
||||
inherit (config.virtualisation.quadlet) containers networks;
|
||||
authentikEnv = config.sops.secrets."containers/authentik.env".path;
|
||||
outpostEnv = config.sops.secrets."containers/authentik-outpost.env".path;
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"containers/authentik.env" = {
|
||||
sopsFile = ../../secrets/authentik.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [
|
||||
"authentik-db.service"
|
||||
"authentik-server.service"
|
||||
"authentik-worker.service"
|
||||
];
|
||||
};
|
||||
|
||||
"containers/authentik-outpost.env" = {
|
||||
sopsFile = ../../secrets/authentik-outpost.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [ "authentik-outpost-ldap.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.quadlet = {
|
||||
networks.authentik = { };
|
||||
|
||||
containers = {
|
||||
authentik-db = {
|
||||
containerConfig = {
|
||||
image = "docker.io/library/postgres:16-alpine";
|
||||
networks = [ networks.authentik.ref ];
|
||||
networkAliases = [ "postgresql" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/authentik/postgres_data:/var/lib/postgresql/data:Z"
|
||||
];
|
||||
environmentFiles = [ authentikEnv ];
|
||||
healthCmd = "pg_isready -d authentik -U authentik";
|
||||
healthInterval = "30s";
|
||||
healthRetries = 5;
|
||||
healthStartPeriod = "20s";
|
||||
healthTimeout = "5s";
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
authentik-server = {
|
||||
containerConfig = {
|
||||
image = "ghcr.io/goauthentik/server:2026.5.0";
|
||||
exec = "server";
|
||||
networks = [ networks.authentik.ref ];
|
||||
publishPorts = [
|
||||
"9080:9000"
|
||||
"9443:9443"
|
||||
];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/authentik/media:/media:Z"
|
||||
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
|
||||
];
|
||||
environmentFiles = [ authentikEnv ];
|
||||
};
|
||||
|
||||
unitConfig = {
|
||||
Requires = [ containers."authentik-db".ref ];
|
||||
After = [ containers."authentik-db".ref ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
authentik-worker = {
|
||||
containerConfig = {
|
||||
image = "ghcr.io/goauthentik/server:2026.5.0";
|
||||
exec = "worker";
|
||||
user = "root";
|
||||
networks = [ networks.authentik.ref ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/authentik/certs:/certs:Z"
|
||||
"/home/imnyang/Docker/authentik/media:/media:Z"
|
||||
"/home/imnyang/Docker/authentik/custom-templates:/templates:Z"
|
||||
"/var/run/docker.sock:/var/run/docker.sock"
|
||||
];
|
||||
environmentFiles = [ authentikEnv ];
|
||||
};
|
||||
|
||||
unitConfig = {
|
||||
Requires = [ containers."authentik-db".ref ];
|
||||
After = [ containers."authentik-db".ref ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
authentik-outpost-ldap = {
|
||||
containerConfig = {
|
||||
image = "ghcr.io/goauthentik/ldap:2026.5.0";
|
||||
entrypoint = [ "/ldap" ];
|
||||
user = "1000";
|
||||
networks = [ networks.authentik.ref ];
|
||||
publishPorts = [
|
||||
"389:3389"
|
||||
"636:6636"
|
||||
];
|
||||
environmentFiles = [ outpostEnv ];
|
||||
};
|
||||
|
||||
unitConfig = {
|
||||
Requires = [ containers."authentik-server".ref ];
|
||||
After = [ containers."authentik-server".ref ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
36
hosts/server/hikari/hako/services/quadlet/conduit.nix
Normal file
36
hosts/server/hikari/hako/services/quadlet/conduit.nix
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
{ config, ... }:
|
||||
|
||||
let
|
||||
inherit (config.virtualisation.quadlet) networks;
|
||||
in
|
||||
{
|
||||
virtualisation.quadlet = {
|
||||
networks.conduit = { };
|
||||
|
||||
containers.conduit = {
|
||||
containerConfig = {
|
||||
image = "docker.io/matrixconduit/matrix-conduit:latest";
|
||||
networks = [ networks.conduit.ref ];
|
||||
publishPorts = [ "6167:6167" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/conduit/db:/var/lib/matrix-conduit:Z"
|
||||
];
|
||||
environments = {
|
||||
CONDUIT_ADDRESS = "0.0.0.0";
|
||||
CONDUIT_ALLOW_CHECK_FOR_UPDATES = "true";
|
||||
CONDUIT_ALLOW_FEDERATION = "true";
|
||||
CONDUIT_ALLOW_REGISTRATION = "true";
|
||||
CONDUIT_CONFIG = "";
|
||||
CONDUIT_DATABASE_BACKEND = "rocksdb";
|
||||
CONDUIT_DATABASE_PATH = "/var/lib/matrix-conduit/";
|
||||
CONDUIT_MAX_REQUEST_SIZE = "20000000";
|
||||
CONDUIT_PORT = "6167";
|
||||
CONDUIT_SERVER_NAME = "mizuki.guru";
|
||||
CONDUIT_TRUSTED_SERVERS = "[\"matrix.org\"]";
|
||||
};
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
};
|
||||
}
|
||||
25
hosts/server/hikari/hako/services/quadlet/paste.nix
Normal file
25
hosts/server/hikari/hako/services/quadlet/paste.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{ config, ... }:
|
||||
|
||||
let
|
||||
inherit (config.virtualisation.quadlet) networks;
|
||||
in
|
||||
{
|
||||
virtualisation.quadlet = {
|
||||
networks.paste = { };
|
||||
|
||||
containers.paste = {
|
||||
containerConfig = {
|
||||
image = "git.mizuki.guru/imnyang/paste:latest";
|
||||
networks = [ networks.paste.ref ];
|
||||
publishPorts = [ "11108:8000" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/paste.mizuki.guru/uploads:/app/uploads:Z"
|
||||
"/home/imnyang/Docker/paste.mizuki.guru/config.toml:/app/config.toml:Z"
|
||||
];
|
||||
environments.ROCKET_ADDRESS = "0.0.0.0";
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
};
|
||||
}
|
||||
152
hosts/server/hikari/hako/services/quadlet/thetree.nix
Normal file
152
hosts/server/hikari/hako/services/quadlet/thetree.nix
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
{ config, ... }:
|
||||
|
||||
let
|
||||
inherit (config.virtualisation.quadlet) containers networks;
|
||||
appEnv = config.sops.secrets."containers/thetree-app.env".path;
|
||||
databaseEnv = config.sops.secrets."containers/thetree-database.env".path;
|
||||
searchEnv = config.sops.secrets."containers/thetree-search.env".path;
|
||||
rustfsEnv = config.sops.secrets."containers/thetree-rustfs.env".path;
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"containers/thetree-app.env" = {
|
||||
sopsFile = ../../secrets/thetree-app.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [ "thetree-app.service" ];
|
||||
};
|
||||
|
||||
"containers/thetree-database.env" = {
|
||||
sopsFile = ../../secrets/thetree-database.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [ "thetree-database.service" ];
|
||||
};
|
||||
|
||||
"containers/thetree-search.env" = {
|
||||
sopsFile = ../../secrets/thetree-search.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [ "thetree-search.service" ];
|
||||
};
|
||||
|
||||
"containers/thetree-rustfs.env" = {
|
||||
sopsFile = ../../secrets/thetree-rustfs.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [ "thetree-rustfs.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.quadlet = {
|
||||
networks.thetree = { };
|
||||
|
||||
containers = {
|
||||
thetree-database = {
|
||||
containerConfig = {
|
||||
image = "docker.io/library/mongo:latest";
|
||||
networks = [ networks.thetree.ref ];
|
||||
networkAliases = [ "db" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/thetree/db:/data/db:Z"
|
||||
];
|
||||
environmentFiles = [ databaseEnv ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
thetree-redis = {
|
||||
containerConfig = {
|
||||
image = "docker.io/library/redis:latest";
|
||||
networks = [ networks.thetree.ref ];
|
||||
networkAliases = [ "redis" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/thetree/redis:/data:Z"
|
||||
];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
thetree-search = {
|
||||
containerConfig = {
|
||||
image = "docker.io/getmeili/meilisearch:v1.23";
|
||||
networks = [ networks.thetree.ref ];
|
||||
networkAliases = [ "search" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/thetree/meili_data:/meili_data:Z"
|
||||
];
|
||||
environmentFiles = [ searchEnv ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
thetree-rustfs = {
|
||||
containerConfig = {
|
||||
image = "docker.io/rustfs/rustfs:latest";
|
||||
networks = [ networks.thetree.ref ];
|
||||
networkAliases = [
|
||||
"rustfs"
|
||||
"thetree.rustfs"
|
||||
];
|
||||
publishPorts = [
|
||||
"9000:9000"
|
||||
"9001:9001"
|
||||
];
|
||||
podmanArgs = [ "--security-opt=no-new-privileges:true" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/thetree/rustfs/data:/data:Z"
|
||||
"/home/imnyang/Docker/thetree/rustfs/logs:/app/logs:Z"
|
||||
"/home/imnyang/Docker/thetree/rustfs/certs:/opt/tls:Z"
|
||||
];
|
||||
environmentFiles = [ rustfsEnv ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
thetree-app = {
|
||||
containerConfig = {
|
||||
image = "ghcr.io/wjdgustn/thetree:master";
|
||||
networks = [ networks.thetree.ref ];
|
||||
publishPorts = [ "51337:3000" ];
|
||||
addHosts = [ "host.docker.internal:host-gateway" ];
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/thetree/skins:/usr/src/app/skins:Z"
|
||||
"/home/imnyang/Docker/thetree/customStatic:/usr/src/app/customStatic:Z"
|
||||
"/home/imnyang/Docker/thetree/plugins:/usr/src/app/plugins:Z"
|
||||
"/home/imnyang/Docker/thetree/cache:/usr/src/app/cache:Z"
|
||||
"/home/imnyang/Docker/thetree/frontend:/usr/src/app/frontend:Z"
|
||||
"/home/imnyang/Docker/thetree/config:/usr/src/app/config:Z"
|
||||
"/etc/timezone:/etc/timezone:ro"
|
||||
"/etc/localtime:/etc/localtime:ro"
|
||||
];
|
||||
environmentFiles = [ appEnv ];
|
||||
};
|
||||
|
||||
unitConfig = {
|
||||
Requires = [
|
||||
containers."thetree-database".ref
|
||||
containers."thetree-redis".ref
|
||||
containers."thetree-search".ref
|
||||
containers."thetree-rustfs".ref
|
||||
];
|
||||
After = [
|
||||
containers."thetree-database".ref
|
||||
containers."thetree-redis".ref
|
||||
containers."thetree-search".ref
|
||||
containers."thetree-rustfs".ref
|
||||
];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
50
hosts/server/hikari/hako/services/quadlet/today.nix
Normal file
50
hosts/server/hikari/hako/services/quadlet/today.nix
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
{ config, ... }:
|
||||
|
||||
let
|
||||
inherit (config.virtualisation.quadlet) builds;
|
||||
webhookEnv = config.sops.secrets."containers/today-webhook.env".path;
|
||||
in
|
||||
{
|
||||
sops.secrets."containers/today-webhook.env" = {
|
||||
sopsFile = ../../secrets/today-webhook.env;
|
||||
format = "dotenv";
|
||||
key = "";
|
||||
mode = "0400";
|
||||
restartUnits = [ "today-webhook.service" ];
|
||||
};
|
||||
|
||||
virtualisation.quadlet = {
|
||||
builds = {
|
||||
today-isangjeong.buildConfig = {
|
||||
file = "/home/imnyang/Docker/today.isangjeong/Dockerfile";
|
||||
workdir = "/home/imnyang/Docker/today.isangjeong";
|
||||
tag = "localhost/today-isangjeong";
|
||||
};
|
||||
};
|
||||
|
||||
containers = {
|
||||
today-isangjeong = {
|
||||
containerConfig = {
|
||||
image = builds.today-isangjeong.ref;
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/today.isangjeong/logs:/code/app/temp/logs:Z"
|
||||
];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
|
||||
today-webhook = {
|
||||
containerConfig = {
|
||||
image = "git.mizuki.guru/imnyang/today.webhook:latest";
|
||||
volumes = [
|
||||
"/home/imnyang/Docker/today.webhook/logs:/code/app/temp/logs:Z"
|
||||
];
|
||||
environmentFiles = [ webhookEnv ];
|
||||
};
|
||||
|
||||
serviceConfig.Restart = "always";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue