commit df8795157de65eeccd9fa9242f3ddc06aa0dfbeb
parent 7894b41b296c1e5f3f9fa7aa7f38a454d11168ef
Author: Silas Brack <silasbrack@gmail.com>
Date: Sat, 27 Sep 2025 11:36:48 +0200
Add hetzner server
Diffstat:
7 files changed, 202 insertions(+), 21 deletions(-)
diff --git a/.sops.yaml b/.sops.yaml
@@ -3,9 +3,11 @@ keys:
- &desktop age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
- &hosts:
- &server age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
+ - &hetzner age1damatvmepexkts3ayg2rfac0nal24tghxnrrvvmpu76wa4gvd58qyn2nwc
creation_rules:
- path_regex: secrets.yaml
key_groups:
- age:
- *desktop
- *server
+ - *hetzner
diff --git a/Makefile b/Makefile
@@ -1,6 +1,8 @@
.PHONY: deploy
## Deploy configuration to production server
-deploy:
+deploy-digitalocean:
nixos-rebuild test --show-trace --fast --flake .#nixos-s-1vcpu-512mb-10gb-ams3-01 --target-host root@188.166.127.72
+deploy-hetzner:
+ nixos-rebuild test --show-trace --fast --flake .#debian-2gb-hel1-1 --target-host root@46.62.150.48
diff --git a/flake.nix b/flake.nix
@@ -18,7 +18,14 @@
inherit system;
modules = [
sops-nix.nixosModules.sops
- (import ./nixos/configuration.nix)
+ (import ./nixos/configuration-nixos-s-1vcpu-512mb-10gb-ams3-01.nix)
+ ];
+ };
+ nixosConfigurations.debian-2gb-hel1-1 = nixpkgs.lib.nixosSystem {
+ inherit system;
+ modules = [
+ sops-nix.nixosModules.sops
+ (import ./nixos/configuration-debian-2gb-hel1-1.nix)
];
};
# development environment (nix develop)
@@ -30,6 +37,7 @@
in
pkgs.mkShell {
buildInputs = with pkgs; [
+ age
curl
sops
wireguard-tools
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -0,0 +1,163 @@
+{
+ pkgs,
+ modulesPath,
+ ...
+}:
+{
+ # Generic
+ system.stateVersion = "25.05"; # Do not change lightly!
+ environment.systemPackages = with pkgs; [
+ vim
+ wget
+ curl
+ rsync
+ rclone
+ zip
+ unzip
+ ];
+ nix.settings.experimental-features = [
+ "nix-command"
+ "flakes"
+ ];
+ services.openssh.enable = true;
+ networking.firewall = {
+ allowedTCPPorts = [
+ 80
+ 443
+ ];
+ # allowedUDPPorts = [
+ # 10232
+ # ];
+ };
+
+ boot.loader.grub = {
+ enable = false;
+ };
+ fileSystems."/" = {
+ device = "/dev/sda1";
+ fsType = "ext4";
+ };
+ nix.gc = {
+ automatic = true;
+ dates = "weekly";
+ options = "--delete-older-than 30d";
+ };
+ nix.settings.auto-optimise-store = true;
+
+ # Specific
+ networking.hostName = "debian-2gb-hel1-1";
+ time.timeZone = "Europe/Helsinki";
+
+ imports = [
+ # (modulesPath + "/virtualisation/digital-ocean-image.nix")
+ # ./vpn.nix
+ ];
+
+ sops.defaultSopsFile = ../secrets.yaml;
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+ sops.secrets.hetzner_wireguard_key = {
+ restartUnits = [ "wg-quick-wg0.service" ];
+ };
+
+ # networking.wg-quick.interfaces = {
+ # wg0 = {
+ # address = [ "10.100.0.7/24" ];
+ # dns = [ "10.100.0.1" ];
+ # listenPort = 10232;
+ # privateKeyFile = "/run/secrets/hetzner_wireguard_key";
+ # peers = [
+ # {
+ # publicKey = "2jWfr5UmACvuS+0HOfSNgEUYqoqVNnfVDoaatmgEykw=";
+ # allowedIPs = [ "0.0.0.0/0" ];
+ # endpoint = "188.166.127.72:51820";
+ # persistentKeepalive = 25;
+ # }
+ # ];
+ # };
+ # };
+
+ users.users = {
+ root.openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com" # Desktop
+ ];
+ silas = {
+ isNormalUser = true;
+ description = "Silas Brack";
+ home = "/home/silas";
+ extraGroups = [
+ "networkmanager"
+ "wheel"
+ ]; # "keys"
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com" # Desktop
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ0gNM0od3EE/LL27kYQ/s5MOU7LBNc0pWRWROeINij silas@Lorenzas-MacBook-Pro.local" # Lolo's Macbook Pro
+ ];
+ };
+ };
+
+ security.acme = {
+ acceptTerms = true;
+ defaults.email = "silasbrack@gmail.com";
+ };
+ services.nginx = {
+ enable = true;
+ # virtualHosts."freshrss.fnarglebeast.com" = {
+ # forceSSL = true;
+ # enableACME = true;
+ # };
+ # virtualHosts."livebook.fnarglebeast.com" = {
+ # forceSSL = true;
+ # enableACME = true;
+ # locations."/" = {
+ # proxyPass = "http://127.0.0.1:20123";
+ # proxyWebsockets = true; # needed if you need to use WebSocket
+ # extraConfig =
+ # # required when the target is also TLS server with multiple hosts
+ # "proxy_ssl_server_name on;"
+ # +
+ # # required when the server wants to use HTTP Authentication
+ # "proxy_pass_header Authorization;";
+ # };
+ # };
+ virtualHosts."karakeep.fnarglebeast.com" = {
+ forceSSL = true;
+ enableACME = true;
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:8360";
+ };
+ };
+ };
+
+ # sops.secrets.livebook_password_env_file = { };
+ # services.livebook = {
+ # enableUserService = true;
+ # environment = {
+ # LIVEBOOK_PORT = 20123;
+ # LIVEBOOK_IFRAME_PORT = 20124;
+ # };
+ # environmentFile = "/run/secrets/livebook_password_env_file";
+ # extraPackages = with pkgs; [
+ # gcc
+ # gnumake
+ # ];
+ # };
+
+ # sops.secrets.freshrss_password = {
+ # owner = "freshrss";
+ # };
+ # services.freshrss = {
+ # enable = true;
+ # defaultUser = "silas";
+ # passwordFile = "/run/secrets/freshrss_password";
+ # baseUrl = "http://localhost:8080";
+ # virtualHost = "freshrss.fnarglebeast.com";
+ # };
+
+ services.karakeep = {
+ enable = true;
+ extraEnvironment = {
+ PORT = "8360";
+ DISABLE_SIGNUPS = "true";
+ };
+ };
+}
diff --git a/nixos/configuration.nix b/nixos/configuration-nixos-s-1vcpu-512mb-10gb-ams3-01.nix
diff --git a/nixos/vpn.nix b/nixos/vpn.nix
@@ -63,6 +63,11 @@
publicKey = "qmch+NjlcVOxBcOsfwk2SJIcpN58i54131OS9J2yvmM=";
allowedIPs = [ "10.100.0.6/32" ];
}
+ {
+ # Hetzner server
+ publicKey = "QE4UoW2vSQMX8o1liA4MSwe4fE5sUB0+Ari5a/CqkSc=";
+ allowedIPs = [ "10.100.0.7/32" ];
+ }
];
};
};
diff --git a/secrets.yaml b/secrets.yaml
@@ -1,4 +1,5 @@
server_wireguard_key: ENC[AES256_GCM,data:21uPlSLnedqeXxIjS+HhJ0lAD6T/diIkjAAhbrB/a6jSVST9u8YTXWNgZ8w=,iv:pOGONrRuUNS8obDdw6GvEkCO7a+Ym5kOgLH6u+P9QQ0=,tag:cAcDTQ5pU8fV5hDzx+d+5A==,type:str]
+hetzner_wireguard_key: ENC[AES256_GCM,data:mHPlUfbysQdmdxy107G1/Xhi0JB/c3Fz3QYKj6j6VXMVy0d7Lma7nr/G3bE=,iv:UGMm8uDUHUJGeLZ8dVsAiFj+43sHoxZSWF+hPcv8QVs=,tag:YSdMv8xj7cTdT05BVXkKPA==,type:str]
freshrss_password: ENC[AES256_GCM,data:oK/KbYmiux2YdXtNiTVJQUWO5+2K2eDx,iv:v3+cOq6oQGXcp22jDmncoJJFbqF/KZCh9CjcsDTrA50=,tag:aIFGAcfcfkT0QrIsO6lIrQ==,type:str]
livebook_password_env_file: ENC[AES256_GCM,data:aic46wuBFngu24R3U6sGXNuB8zQSj6YWIum8szgt6UDJ3PZpYlCT6yNEEZ/NlQ87C4NUELWPE402qZ/hPqjW0X0HcEpXIBnQ4ZcO8uoI0zbMeLFMgGw3+27Uq3dyfMxfCWfBe/VHGBK1i8hKEZ0xzIdPktyTF/bZUnsXXgKvoJtJToWXMbX0/g==,iv:zhZvELSPfIcjAu/ZDastRCJJXg7z5Q0qdPA+N3UqBjg=,tag:QfdwD/hpb/6zc6SiNWj/8A==,type:str]
sops:
@@ -6,31 +7,31 @@ sops:
- recipient: age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTXRaUkNqVWpVY2NEdGo4
- QUNxbW41VWN3Mkx3NDRqbld0NlMyME5SRjJzCmEyZnVrWnRCcnoxbWE2bXFPQ1pk
- ME81VTIxMlluTW0rYmlHS0tlK1NONk0KLS0tIEhZN1BIdnk4dHRkY3JyTmthZjR6
- aDFtMXJPbzhxYU1RaGVyUjYvc3Z2YUUKHh8Y5iuPB8D0VOxZvXQX61Uoae525ajZ
- vc21qI0li9fBTmKNy0VYHDLvboP83jLNsAMd2To+xHmJimkhiivkew==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2K3F3K1RUSWs5MktaejF6
+ dDdLQTYrYnpEM3gxWTNHWWd6bFFFUnhObHpZCkNCU3BPT29UM0JFSWZDZ0RGSXkw
+ U2YxYzZaZFRvNElyaFBzeW9nTkg0cWMKLS0tIElhdGtOdFNhUW5Sb1pSY1J2L2cr
+ dzUybWZ2NStHQ0doL0xHYWJrZDNlUGcKQdgVBiwsLzTNkRs4F7SNoBk2f0cb7weE
+ 0eD240fbOmC6sghreXT2/QNJFqSt7RETHS21kbKpIcs0PNzVbre03g==
-----END AGE ENCRYPTED FILE-----
- - recipient: age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
+ - recipient: age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBNzNQMkorTkdISUJScUdr
- SW9qUjJNU2hvbmhJRTQ3MG1sY1QxUWNVZ0YwCnpTS0FRKzZpbWpyOEpPMlFCQlhw
- NmVVazNhZHBYdEFnMS9JT0Y2WUo1OTgKLS0tIEJ0Y3huYXJzY3poRkhTeXlOTXRv
- MTFtYnh5Y0ZXMzdhV3ZqUjVLQjAzN0UKEFfu1TlRUHkyGDg2PLWQdm0VfXUiGZDZ
- u5UsCR6bmvAMblGg4bXLmXhH61H97n6aJMS92j+G8uE4BDE1q/y4Tw==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1Q2NqRER0dDQ0RjZyVHhW
+ Ujh0Q09jaW10ZVV0ZEdwMXk4dW5PK2RMNG5VCjIyeGhxcTZLQnJlV1JrOWZYaFBn
+ bzJkc3pIM3ZzSjJpQ0dRNDgyS0JMU2cKLS0tIERhMU5yaGZiK3p0SDh3NGlydmNS
+ dmJ0c215TzhsT0graW8yK1ZZRU84bnMKA4aujo+KfrzDJWxsXtCTP7A2NI6Tgqr5
+ +ZqVubHe9deC4zkuTv0jPs2YxiFP3/D/QI1+B07b+fFBHdLaj/VQ3A==
-----END AGE ENCRYPTED FILE-----
- - recipient: age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
+ - recipient: age1damatvmepexkts3ayg2rfac0nal24tghxnrrvvmpu76wa4gvd58qyn2nwc
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Um1lQ0tVcGh0ZUQ2TGUv
- OG1Qck9iZ0JodkVPNGUwNCt5ZzI2NGxhQ1VvCmF1SmpNL2o5WlQrdTRYSTV0WUY2
- Um5hVUp4ODFLUWx4ckl4WlMxUEhYWEkKLS0tIFBBRWlDWlEvR3g3alY5emNaRVI4
- VTVIMjJSaGVRY3hYbmhzUmFiaCtxVUEKmGFgyEVxF0s8UqrbV9vpVonzEqMdx/9z
- yeAc9I9fdMiakISPvkh9Jkexc4duFS1noGTIAXPfCEriIupol2MVvw==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRkM3VUhabTdxTDRIYU1W
+ V2g5SlN1MUxta3lLRXc0dGRpMG9Mc0xOUWpnCldVdkVVUG80bmdtV3hJNVVrbHdF
+ aDR0UlpWcFZSaXgxWndvTS8xeERjeDAKLS0tIFJUaVdLelR6WURQQkFCdW9WVXFE
+ dXNXQkF5SXZjWHRPNjZaR29YZ1pRQ3MKJvGVAm8M9oIQBHJH1o0NG8x0c4qvgvHr
+ 1T/ghKHZWIpbXzct1LNy+5T10OgRxm5++NKuuuiAXW2XmnkJu1Bc3Q==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-05-26T15:57:13Z"
- mac: ENC[AES256_GCM,data:eNWuQvY/0SNoX57EzSm47Og12oQl5eD5KPUH5rSKn5qXhr+8FYEOVwgN5/8wsODT3yZUGBSd/dCwdB6NeY48PfX5gVSC0gfBL6RwdzQhgGXhQ57nAWOGJ2x+J6vHXnEddlmv5yWbNhM2YQzS1slF4LAL/c7pv6S2n51yo4DUuO4=,iv:SZZ7SleiCD0f+9IZ5K6YDiaWcIZ9QfAzQj6tDQo/NEo=,tag:Q7Q/gPOyYZfyi8rZASPLNA==,type:str]
+ lastmodified: "2025-07-20T16:06:58Z"
+ mac: ENC[AES256_GCM,data:yX2QNz2QFXP9jHAiJ++hpxXeI253fFmF/93WPybxpHSzwHPsgMMby+jgPQkQ16xR+9OXN5qUAOk/EsCaV6nWBXPPM41nL843Paz3vabddJwhvxQoGsS47KbrnFJGZDluT5GA6cU6H+yEGelvmeKeyOyXx9jVn75sFXRNK8elUzU=,iv:OQnoRLmKVVlo1/bakPB3MciZM8gB2xtjvYYKxMdYBpA=,tag:+bVG8ZI5rVXI0ORRda1ThA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2
