AZ-Intec-GmbH/AZ-NIX-SERVERS
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
Sascha König
2026-05-05 08:30:51 +02:00
commit c0e781bf00
107 changed files with 7024 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
hosts/AZ-PRM-1/configuration.nix Normal file
View File

@@ -0,0 +1,41 @@
{pkgs, ...}: {
imports = [
./hardware-configuration.nix
./disko-config.nix
];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "AZ-PRM-1";
networking.networkmanager.enable = true;
time.timeZone = "Europe/Berlin";
i18n.defaultLocale = "de_DE.UTF-8";
environment.systemPackages = with pkgs; [
neovim
git
python3
python3Packages.pysmb
];
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
};
services.openssh = {
enable = true;
ports = [2022];
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
};
networking.firewall.allowedTCPPorts = [587];
system.stateVersion = "25.05";
}

11
hosts/AZ-PRM-1/default.nix Normal file
View File

@@ -0,0 +1,11 @@
{
imports = [
../common
./configuration.nix
./secrets.nix
./services
];
extraServices = {
podman.enable = true;
};
}

34
hosts/AZ-PRM-1/disko-config.nix Normal file
View File

@@ -0,0 +1,34 @@
{
disko.devices = {
disk = {
main = {
type = "disk";
device = "/dev/sda";
content = {
type = "gpt";
partitions = {
esp = {
size = "512M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = ["defaults" "umask=0077"];
};
};
root = {
size = "100%";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
mountOptions = ["noatime" "nodiratime" "discard"];
};
};
};
};
};
};
};
}

17
hosts/AZ-PRM-1/hardware-configuration.nix Normal file
View File

@@ -0,0 +1,17 @@
{
config,
lib,
pkgs,
...
}: {
virtualisation.hypervGuest.enable = true;
boot.initrd.availableKernelModules = ["sd_mod" "sr_mod" "hv_storvsc"];
boot.initrd.kernelModules = [];
boot.kernelModules = [];
boot.extraModulePackages = [];
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

37
hosts/AZ-PRM-1/secrets.nix Normal file
View File

@@ -0,0 +1,37 @@
{
age = {
secrets = {
azion-env = {
file = ../../secrets/azion-env.age;
};
traefik-env = {
file = ../../secrets/traefik-env.age;
};
kestra-config = {
file = ../../secrets/kestra-config.age;
mode = "644";
};
kestra-env = {file = ../../secrets/kestra-env.age;};
kestra-secrets = {file = ../../secrets/kestra-secrets.age;};
n8n-env = {
file = ../../secrets/n8n-env-prm.age;
};
pgadmin-pw = {
file = ../../secrets/pgadmin-pw.age;
owner = "pgadmin";
};
pg-cert = {
file = ../../secrets/server.crt.age;
owner = "postgres";
group = "postgres";
mode = "0644";
};
pg-key = {
file = ../../secrets/server.key.age;
owner = "postgres";
group = "postgres";
mode = "0600";
};
};
};
}

36
hosts/AZ-PRM-1/services/azion-scheduler.nix Normal file
View File

@@ -0,0 +1,36 @@
{
config,
lib,
inputs,
pkgs,
...
}: let
serviceName = "azion-scheduler";
proxyServiceName = "${serviceName}-proxy";
servicePort = config.m3ta.ports.get serviceName;
schedulerProxyPort = config.m3ta.ports.get proxyServiceName;
in {
services.azion-scheduler = {
enable = true;
package = inputs.azion-scheduler.packages.${pkgs.stdenv.hostPlatform.system}.default;
port = servicePort;
proxyPort = schedulerProxyPort;
environmentFile = config.age.secrets.azion-env.path;
};
# Traefik configuration
services.traefik.dynamicConfigOptions.http = {
services.${serviceName}.loadBalancer.servers = [
{url = "http://localhost:${toString servicePort}/";}
];
routers.${serviceName} = {
rule = "Host(`azion.l.az-gruppe.com`)";
tls = {
certResolver = "ionos";
};
service = serviceName;
entrypoints = "websecure";
};
};
}

80
hosts/AZ-PRM-1/services/bpi.nix Normal file
View File

@@ -0,0 +1,80 @@
{
config,
lib,
pkgs,
...
}: let
serviceName = "bpi";
servicePort = config.m3ta.ports.get serviceName;
appDir = "/var/lib/bpi/app";
in {
users.users.bpi = {
isSystemUser = true;
group = "bpi";
home = "/var/lib/bpi";
createHome = true;
};
users.groups.bpi = {};
systemd.services.bpi = {
description = "AZ INTEC Basispreis Index";
after = ["network-online.target"];
wants = ["network-online.target"];
wantedBy = ["multi-user.target"];
path = with pkgs; [
git
nodejs
openssh
];
environment = {
PORT = toString servicePort;
HOME = "/var/lib/bpi";
BPI_BACKUP_DIR = "/var/lib/bpi/backups";
BPI_MAX_BACKUPS = "10";
};
preStart = ''
set -euo pipefail
if [ ! -d "${appDir}/.git" ]; then
rm -rf "${appDir}"
git clone --depth=1 https://git.az-gruppe.com/AZ-Intec-GmbH/BPI.git "${appDir}"
else
git -C "${appDir}" pull --ff-only
fi
if [ ! -f "${appDir}/server.js" ]; then
echo "${appDir}/server.js fehlt. Bitte server.js in das BPI Repository committen."
exit 1
fi
'';
serviceConfig = {
Type = "simple";
User = "bpi";
Group = "bpi";
StateDirectory = "bpi";
WorkingDirectory = "/var/lib/bpi";
ExecStart = "${pkgs.nodejs}/bin/node ${appDir}/server.js";
Restart = "on-failure";
RestartSec = "10s";
};
};
services.traefik.dynamicConfigOptions.http = {
services.bpi.loadBalancer.servers = [
{url = "http://localhost:${toString servicePort}/";}
];
routers.bpi = {
rule = "Host(`bpi.l.az-gruppe.com`)";
tls = {
certResolver = "ionos";
};
service = "bpi";
entrypoints = "websecure";
};
};
}

15
hosts/AZ-PRM-1/services/containers/default.nix Normal file
View File

@@ -0,0 +1,15 @@
{lib, ...}: {
imports = [
#./baserow.nix
./kestra.nix
./stirling-pdf.nix
];
system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
if ! /run/current-system/sw/bin/podman network exists web; then
/run/current-system/sw/bin/podman network create web --subnet=10.89.0.0/24 --internal
fi
if ! /run/current-system/sw/bin/podman network exists web-dev; then
/run/current-system/sw/bin/podman network create web-dev --subnet=10.89.1.0/24 --internal
fi
'';
}

38
hosts/AZ-PRM-1/services/containers/kestra.nix Normal file
View File

@@ -0,0 +1,38 @@
{config, ...}: let
serviceName = "kestra";
servicePort = config.m3ta.ports.get serviceName;
in {
virtualisation.oci-containers.containers."${serviceName}" = {
image = "docker.io/kestra/kestra:latest";
environmentFiles = [
config.age.secrets.kestra-env.path
config.age.secrets.kestra-secrets.path
];
cmd = ["server" "standalone" "--config" "/etc/config/application.yaml"];
ports = ["127.0.0.1:${toString servicePort}:8080"];
user = "root";
volumes = [
"/var/run/podman/podman.sock:/var/run/docker.sock"
"${config.age.secrets.kestra-config.path}:/etc/config/application.yaml"
"kestra_data:/app/storage"
"/tmp/kestra-wd:/tmp/kestra-wd"
];
extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.12" "--network=web"];
};
systemd.tmpfiles.rules = [
"d /tmp/kestra-wd 0750 1000 1000 - -"
];
# Traefik configuration specific to kestra
services.traefik.dynamicConfigOptions.http = {
services.kestra.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];
routers.kestra = {
rule = "Host(`k.l.az-gruppe.com`)";
tls = {certResolver = "ionos";};
service = "kestra";
entrypoints = "websecure";
};
};
}

30
hosts/AZ-PRM-1/services/containers/stirling-pdf.nix Normal file
View File

@@ -0,0 +1,30 @@
{config, ...}: let
serviceName = "stirling-pdf";
servicePort = config.m3ta.ports.get serviceName;
in {
virtualisation.oci-containers.containers."${serviceName}" = {
image = "docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest-fat";
ports = ["127.0.0.1:${toString servicePort}:8080"];
environment = {
SECURITY_ENABLELOGIN = "False";
DISABLE_ADDITIONAL_FEATURES = "False";
};
volumes = [
"stirling_pdf_data:/usr/share/tessdata"
"stirling_pdf_configs:/configs"
];
extraOptions = ["--ip=10.89.0.13" "--network=web"];
};
services.traefik.dynamicConfigOptions.http = {
services.${serviceName}.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];
routers.${serviceName} = {
rule = "Host(`pdf.l.az-gruppe.com`)";
tls = {certResolver = "ionos";};
service = serviceName;
entrypoints = "websecure";
};
};
}

14
hosts/AZ-PRM-1/services/default.nix Normal file
View File

@@ -0,0 +1,14 @@
{
imports = [
./containers
./azion-scheduler.nix
./bpi.nix
./n8n.nix
./netbird.nix
./pgadmin.nix
./postgres.nix
./printing.nix
./traefik.nix
./traefik-routing.nix
];
}

32
hosts/AZ-PRM-1/services/n8n.nix Normal file
View File

@@ -0,0 +1,32 @@
{config, ...}: let
serviceName = "n8n";
servicePort = config.m3ta.ports.get serviceName;
in {
services.n8n = {
enable = true;
environment = {
WEBHOOK_URL = "https://wf.l.az-gruppe.com";
NODES_EXCLUDE = "[]";
};
};
systemd.services.n8n.serviceConfig = {
EnvironmentFile = ["${config.age.secrets.n8n-env.path}"];
};
# Traefik configuration specific to n8n
services.traefik.dynamicConfigOptions.http = {
services.${serviceName}.loadBalancer.servers = [
{
url = "http://localhost:${toString servicePort}/";
}
];
routers.${serviceName} = {
rule = "Host(`wf.l.az-gruppe.com`)";
tls = {
certResolver = "ionos";
};
service = serviceName;
entrypoints = "websecure";
};
};
}

31
hosts/AZ-PRM-1/services/netbird.nix Normal file
View File

@@ -0,0 +1,31 @@
{pkgs, ...}: {
services.netbird = {
enable = true;
package = pkgs.unstable.netbird;
};
systemd.services.netbird = {
environment = {
NB_DISABLE_SSH_CONFIG = "true";
};
path = [
pkgs.shadow
pkgs.util-linux
];
};
programs.ssh.extraConfig = ''
Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
PreferredAuthentications password,publickey,keyboard-interactive
PasswordAuthentication yes
PubkeyAuthentication yes
BatchMode no
ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
CheckHostIP no
LogLevel ERROR
'';
networking.firewall.checkReversePath = "loose";
}

21
hosts/AZ-PRM-1/services/pgadmin.nix Normal file
View File

@@ -0,0 +1,21 @@
{config, ...}: let
serviceName = "pgadmin";
servicePort = config.m3ta.ports.get serviceName;
in {
services.pgadmin = {
enable = true;
initialPasswordFile = "${config.age.secrets.pgadmin-pw.path}";
initialEmail = "sascha.koenig@azintec.com";
};
# Traefik configuration specific to pgadmin
services.traefik.dynamicConfigOptions.http = {
services.pgadmin.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];
routers.pgadmin = {
rule = "Host(`pg.l.az-gruppe.com`)";
tls.certResolver = "ionos";
service = "pgadmin";
entrypoints = "websecure";
};
};
}

67
hosts/AZ-PRM-1/services/postgres.nix Normal file
View File

@@ -0,0 +1,67 @@
{
config,
pkgs,
...
}: {
services.postgresql = {
enable = true;
enableTCPIP = true;
package = pkgs.postgresql_17;
settings = {
ssl = true;
ssl_cert_file = config.age.secrets.pg-cert.path;
ssl_key_file = config.age.secrets.pg-key.path;
};
extensions = with pkgs.postgresql17Packages; [
pgvector
];
initialScript = pkgs.writeText "backend-initScript" ''
CREATE USER baserow WITH ENCRYPTED PASSWORD 'baserow';
CREATE DATABASE baserow;
ALTER DATABASE baserow OWNER to baserow;
CREATE USER kestra WITH ENCRYPTED PASSWORD 'kestra';
CREATE DATABASE kestra;
ALTER DATABASE kestra OWNER to kestra;
CREATE USER n8n WITH ENCRYPTED PASSWORD 'n8n';
CREATE DATABASE n8n;
ALTER DATABASE n8n OWNER to n8n;
CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'n8n';
CREATE DATABASE vaultwarden;
ALTER DATABASE vaultwarden OWNER to vaultwarden;
'';
authentication = pkgs.lib.mkOverride 10 ''
# Local connections (Unix socket)
local all postgres peer
local n8n n8n scram-sha-256
# Localhost connections (IPv4 and IPv6)
host all postgres 127.0.0.1/32 scram-sha-256
host all postgres ::1/128 scram-sha-256
host n8n n8n 127.0.0.1/32 scram-sha-256
host n8n n8n ::1/128 scram-sha-256
# Podman network connections
host baserow baserow 10.89.0.0/24 scram-sha-256
host kestra kestra 10.89.0.0/24 scram-sha-256
# Deny all other connections
host all all 0.0.0.0/0 reject
host all all ::/0 reject
'';
};
services.postgresqlBackup = {
enable = true;
startAt = "03:10:00";
databases = ["baserow" "kestra" "n8n"];
};
networking.firewall = {
extraCommands = ''
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 5432 -j ACCEPT
iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport 5432 -j ACCEPT
'';
};
}

40
hosts/AZ-PRM-1/services/printing.nix Normal file
View File

@@ -0,0 +1,40 @@
{pkgs, ...}: {
# CUPS Druckdienst für PDF-Druck aus n8n
# Drucker: Kyocera TASKalfa 4054ci @ 192.168.152.137
services.printing = {
enable = true;
drivers = with pkgs; [
cups-filters # driverless IPP Everywhere Support
];
};
# Avahi für mDNS/IPP-Druckererkennung
services.avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
# Kyocera TASKalfa 4054ci deklarativ einrichten
hardware.printers = {
ensurePrinters = [
{
name = "JW2OG";
location = "Buero";
description = "Kyocera TASKalfa 4054ci";
deviceUri = "ipps://192.168.152.137:443/ipp/print";
model = "everywhere";
ppdOptions = {
PageSize = "A4";
};
}
];
ensureDefaultPrinter = "JW2OG";
};
# n8n braucht Zugriff auf lp/lpr zum Drucken
systemd.services.n8n = {
path = [pkgs.cups];
serviceConfig.SupplementaryGroups = ["lp"];
};
}

7
hosts/AZ-PRM-1/services/samba.nix Normal file
View File

@@ -0,0 +1,7 @@
{pkgs, ...}: {
services.samba = {
enable = true;
package = pkgs.samba4Full;
openFirewall = true;
};
}

31
hosts/AZ-PRM-1/services/traefik-routing.nix Normal file
View File

@@ -0,0 +1,31 @@
{
services.traefik.dynamicConfigOptions.http = {
services.ptrg.loadBalancer.servers = [{url = "http://192.168.152.102:7784/";}];
routers.prtg = {
rule = "Host(`m.l.az-gruppe.com`)";
tls = {certResolver = "ionos";};
service = "ptrg";
entrypoints = "websecure";
};
services.AZHA.loadBalancer.servers = [{url = "http://192.168.152.47:8123/";}];
routers.AZHA = {
rule = "Host(`ha.l.az-gruppe.com`)";
tls = {certResolver = "ionos";};
service = "AZHA";
entrypoints = "websecure";
};
services.AZDESK.loadBalancer.servers = [
{
url = "https://azdesk.az-group.local:443/";
}
];
routers.AZDESK = {
rule = "Host(`it-ticket.l.az-gruppe.com`)";
tls = {certResolver = "ionos";};
service = "AZDESK";
entrypoints = "websecure";
};
};
}

92
hosts/AZ-PRM-1/services/traefik.nix Normal file
View File

@@ -0,0 +1,92 @@
{config, ...}: let
httpPort = config.m3ta.ports.get "traefik";
httpsPort = config.m3ta.ports.get "traefik-ssl";
in {
services.traefik = {
enable = true;
staticConfigOptions = {
log = {level = "WARN";};
serversTransport.insecureSkipVerify = true;
certificatesResolvers = {
ionos = {
acme = {
email = "sascha.koenig@azintec.com";
storage = "/var/lib/traefik/acme.json";
caserver = "https://acme-v02.api.letsencrypt.org/directory";
dnsChallenge = {
provider = "ionos";
resolvers = ["1.1.1.1:53" "8.8.8.8:53"];
propagation = {
delayBeforeChecks = 60;
disableChecks = true;
};
};
};
};
};
api = {};
entryPoints = {
web = {
address = ":${toString httpPort}";
http.redirections.entryPoint = {
to = "websecure";
scheme = "https";
};
};
websecure = {
address = ":${toString httpsPort}";
http.tls = {
certResolver = "ionos";
domains = [
{
main = "l.az-gruppe.com";
sans = ["*.l.az-gruppe.com"];
}
];
};
};
};
};
dynamicConfigOptions = {
http = {
services = {
dummy = {
loadBalancer.servers = [
{url = "http://192.168.0.1";}
];
};
};
middlewares = {
auth = {
basicAuth = {
users = ["sascha.koenig:$apr1$1xqdta2b$DIVNvvp5iTUGNccJjguKh."];
};
};
};
routers = {
api = {
rule = "Host(`r.l.az-gruppe.com`)";
service = "api@internal";
middlewares = ["auth"];
entrypoints = ["websecure"];
tls = {
certResolver = "ionos";
domains = [
{
main = "l.az-gruppe.com";
sans = ["*.l.az-gruppe.com"];
}
];
};
};
};
};
};
};
systemd.services.traefik.serviceConfig = {
EnvironmentFile = ["${config.age.secrets.traefik-env.path}"];
};
networking.firewall.allowedTCPPorts = [httpPort httpsPort];
}