oibot/Tobserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Setup checker

Browse source
This commit is contained in:
Tobias Ostner 2026-04-13 18:47:06 +02:00
parent 85b5c2bce6
commit 063d40937f
4 changed files with 206 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

148
flake.lock generated
View file

@ -1,12 +1,145 @@
{
"nodes": {
"checker": {
"inputs": {
"clj-nix": "clj-nix",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1776095659,
"narHash": "sha256-3xXKVCwzjNKjctilYZWXcejxeE+9FPVLZaVuciFQmAI=",
"ref": "refs/heads/main",
"rev": "57fe47b20e85ab3b8eba87a1a24d5ae46f1beaa7",
"revCount": 32,
"type": "git",
"url": "https://codeberg.org/oibot/checker.git"
},
"original": {
"type": "git",
"url": "https://codeberg.org/oibot/checker.git"
}
},
"clj-nix": {
"inputs": {
"devshell": "devshell",
"nix-fetcher-data": "nix-fetcher-data",
"nixpkgs": [
"checker",
"nixpkgs"
]
},
"locked": {
"lastModified": 1773151887,
"narHash": "sha256-YUiehwe2iTlwYSrnJ1pcw7KDNX+U42xlTx/2k/mo0P8=",
"owner": "jlesquembre",
"repo": "clj-nix",
"rev": "27dac4466c9d3939f6a4925bc09e0cb1d8f32d9c",
"type": "github"
},
"original": {
"owner": "jlesquembre",
"repo": "clj-nix",
"type": "github"
}
},
"devshell": {
"inputs": {
"nixpkgs": [
"checker",
"clj-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1768818222,
"narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
"owner": "numtide",
"repo": "devshell",
"rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"flake-parts": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1719745305,
"narHash": "sha256-xwgjVUpqSviudEkpQnioeez1Uo2wzrsMaJKJClh+Bls=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "c3c5ecc05edc7dafba779c6c1a61cd08ac6583e9",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"nix-fetcher-data": {
"inputs": {
"flake-parts": "flake-parts",
"nixpkgs": [
"checker",
"clj-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1755022803,
"narHash": "sha256-/QtBdVfZlrRJW5enUoWlBE2wrLXJBMJ45X0rZh0jiaU=",
"owner": "jlesquembre",
"repo": "nix-fetcher-data",
"rev": "9da3926b1459d6ff15268072d1c51351b82811b9",
"type": "github"
},
"original": {
"owner": "jlesquembre",
"repo": "nix-fetcher-data",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1770136044,
"narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
"lastModified": 1775811116,
"narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
"rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-lib": {
"locked": {
"lastModified": 1717284937,
"narHash": "sha256-lIbdfCsf8LMFloheeE6N31+BMIeixqyQWbSr2vk79EQ=",
"type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz"
},
"original": {
"type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1775811116,
"narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
"type": "github"
},
"original": {
@ -18,7 +151,8 @@
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs",
"checker": "checker",
"nixpkgs": "nixpkgs_2",
"sops-nix": "sops-nix"
}
},
@ -29,11 +163,11 @@
]
},
"locked": {
"lastModified": 1775682595,
"narHash": "sha256-0E9PohY/VuESLq0LR4doaH7hTag513sDDW5n5qmHd1Q=",
"lastModified": 1775971308,
"narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "d2e8438d5886e92bc5e7c40c035ab6cae0c41f76",
"rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
"type": "github"
},
"original": {

9
flake.nix
View file

@ -3,14 +3,20 @@
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
checker.url = "git+https://codeberg.org/oibot/checker.git";
};
outputs = { self, nixpkgs, sops-nix, ... }:
outputs = { self, nixpkgs, sops-nix, checker, ... }:
let
system = "x86_64-linux";
in {
nixosConfigurations.tobserver = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = {
inherit checker;
};
modules = [
sops-nix.nixosModules.sops
./hardware-configuration.nix
@ -20,6 +26,7 @@
./modules/mempool.nix
./modules/nextcloud.nix
./modules/totap.nix
./modules/checker.nix
];
};
};

53
modules/checker.nix Normal file
View file

@ -0,0 +1,53 @@
{ config, pkgs, checker, ... }:
let
checkerPkg = checker.packages.${pkgs.stdenv.hostPlatform.system}.default;
in
{
users.users.checker = {
isSystemUser = true;
group = "checker";
home = "/var/lib/checker";
createHome = true;
};
users.groups.checker = {};
sops.secrets."checker/env" = {
owner = "checker";
group = "checker";
mode = "0400";
};
systemd.services.checker = {
description = "Checker a personal assistant";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
User = "checker";
Group = "checker";
WorkingDirectory = "/var/lib/checker";
ExecStart = "${checkerPkg}/bin/checker";
EnvironmentFile = config.sops.secrets."checker/env".path;
Restart = "always";
RestartSec = 5;
NowNewPrivileges = true;
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = true;
ReadWritePaths = [ "/var/lib/checker" ];
};
};
services.nginx.virtualHosts."checker.tobiasostner.de" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:3001";
};
};
}

6
secrets/tobserver.yaml
View file

@ -3,6 +3,8 @@ mempool:
mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str]
nextcloud:
admin-pass: ENC[AES256_GCM,data:3xufFHvcm5g5+jn+B4qxRljuWDqDXo1mLu4IlSuax7Cz+3ZoOuNXoCXoiaY=,iv:WaWeu/a45Vuz+HvO7m0dUlCGCexk4IX/ijURmb/7jPU=,tag:ytRjS89AmHiGOhKymViTrg==,type:str]
checker:
env: ENC[AES256_GCM,data:Iavqm2Tc+8M5n0/M1VbjVxYptRKlCxwi6RwoXH6jy2wRXWgrqkSknKnw6RIq+KmOVsRIe0Krz/JxSpgudnOF+wHnfwWRGHNVyl+o20ZAwZvNCYsK4HhANFdfY+TCvGIMVLzs+N/pRh7ynsDf+52zd1IhTZJk7ibQ8YiMLKQdZKM7uEDLamjNVrzCtdJM+pyNeDu5TOLtfR3ma0h1v70xidJUTzl1jlaGfv3hLuiQnhspYZOXh3rmFdO+/ICY2TVBkA/Irz1ghe14Cuf4S90uDKtpe65b+r7r7mVgaEnNvXMprCqIs/H8ekHzRXpoKDiCt7KYxCQFIvzFoDSbQ+NZvOLjDkMQFH3o/zZs5PZurmPYwiXjjkuRkhDaiqpv7t1ylRkaT35VQaXiJ5jMP2KIbrSKT7eJlHY3W4kwWImmOoHKDOJAQlSweontHvkcLLrxSzRxN9TuYV6TcZ0ZvdxBUOuKxiV+/m2r+lPGoNXLWURHNyh+QbOZYvXKdAhDNbbTrzgFgi03vD2euhwTORiia5GMWziCtR4r/mAgD3NK9adIcpwVoYy7EQx/TECNtYT4qNHOGpg9HCBGKVDCd1Ho,iv:NOc6iW2JaHse+52AQJNkY1jqFk6GAIyHf9wITvsKPPM=,tag:GKF/MjBU364lr7lG4vrwnA==,type:str]
sops:
age:
- recipient: age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
@ -23,7 +25,7 @@ sops:
cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-11T17:27:25Z"
mac: ENC[AES256_GCM,data:0926uedsIZ1GyhtTJjedMPds3zGvANUlRH6ro0abt391OfJ+b1z/pgjT7bRxiJNCOZITKfkaWoXR0529PK00dZAI2Z70lX2oDftNEtBzX+cq994m0s3HlfjaChqRwpFfxxX7sYbyvGqQRJxxgbiMfloyNeps55ODKXGXYwNKYog=,iv:PRHplnL6SUBwx1+wpi8uvWKZvHurhdiexIJr0kjQ8ao=,tag:uwDy9B7uP0khPorbc2woRA==,type:str]
lastmodified: "2026-04-13T16:18:47Z"
mac: ENC[AES256_GCM,data:En7+/DW4k5KkoyEXYIH8xZyBv8cRjzYQgIVA8PzfRx1YhquEnfS538kU3i79iKJrQHucmr8PtCO7oPCwrus5xzTeRmn6iVIcTzAqJigyd3Nf4yjgE24isay79jZGq62q05YTaYbQpVfQCoCUK5U/S1AJXte/l5dSYQL614K1eQ0=,iv:Tlp7BBJr/Nu3SAVIPofSTuDx5PSr84mUaOT9fLJN/Jw=,tag:lQLO7tzm3VAP2pPxKo5uWw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0