draft AZ-PRM-1 config

hosts/AZ-CLD-1/secrets.nix

@@ -7,13 +7,22 @@
       n8n-env = {
         file = ../../secrets/n8n-env.age;
       };
+      n8n-db = {
+        file = ../../secrets/n8n-db.age;
+      };
       outline-env = {
         file = ../../secrets/outline-env.age;
 	owner = "outline";
       };
-      vaultwarden-env = {
+      outline-db = {
+        file = ../../secrets/outline-db.age;
+      };
+      vaultwarden-db = {
         file = ../../secrets/vaultwarden-env.age;
       };
+      vaultwarden-env = {
+        file = ../../secrets/vaultwarden-db.age;
+      };
       hetzner-s3-az-intern-secret-key = {
         file = ../../secrets/hetzner-s3-az-intern-secret-key.age;
 	owner = "outline";

hosts/AZ-PRM-1/configuration.nix

@@ -0,0 +1,129 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./disko-config.nix
+  ];
+
+  boot.loader.grub = {
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  networking.hostName = "AZ-CLD-1"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "de_DE.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # services.pulseaudio.enable = true;
+  # OR
+  # services.pipewire = {
+  #   enable = true;
+  #   pulse.enable = true;
+  # };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.alice = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  #   packages = with pkgs; [
+  #     tree
+  #   ];
+  # };
+
+  # programs.firefox.enable = true;
+
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
+  environment.systemPackages = with pkgs; [
+    neovim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    git
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    ports = [2022];
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+    };
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 587 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/AZ-PRM-1/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ../common
+    ./configuration.nix
+    ./secrets.nix
+    ./services
+  ];
+}

hosts/AZ-PRM-1/disko-config.nix

@@ -0,0 +1,39 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/vda"; # CHANGE ME
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02"; # for GRUB MBR
+              priority = 1;
+            };
+            esp = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = ["defaults" "umask=0077"];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+                mountOptions = ["noatime" "nodiratime" "discard"];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/AZ-PRM-1/hardware-configuration.nix

@@ -0,0 +1,28 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/AZ-PRM-1/secrets.nix

@@ -0,0 +1,39 @@
+{
+  age = {
+    secrets = {
+      traefik-env = {
+        file = ../../secrets/traefik-env.age;
+      };
+      baserow-db = {
+        file = ../../secrets/baserow-db.age;
+      };
+      kestra-db = {
+        file = ../../secrets/kestra-db.age;
+      };
+      n8n-env = {
+        file = ../../secrets/n8n-env.age;
+      };
+      n8n-db = {
+        file = ../../secrets/n8n-db.age;
+      };
+      pg-cert = {
+        file = ../../secrets/server.crt.age;
+        owner = "root";
+        group = "postgres";
+        mode = "0640";
+      };
+      pg-key = {
+        file = ../../secrets/server.key.age;
+        owner = "root";
+        group = "postgres";
+        mode = "0600";
+      };
+      vaultwarden-env = {
+        file = ../../secrets/vaultwarden-env.age;
+      };
+      vaultwarden-db = {
+        file = ../../secrets/vaultwarden-db.age;
+      };
+    };
+  };
+}

hosts/AZ-PRM-1/services/containers/baserow.nix

@@ -0,0 +1,26 @@
+{config, ...}: {
+  virtualisation.oci-containers.containers."baserow" = {
+    image = "docker.io/baserow/baserow:1.34.2";
+    environmentFiles = [config.age.secrets.baserow-env.path];
+    ports = ["127.0.0.1:3032:80"];
+    volumes = ["baserow_data:/baserow/data"];
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.11" "--network=web"];
+  };
+  # Traefik configuration specific to baserow
+  services.traefik.dynamicConfigOptions.http = {
+    services.baserow.loadBalancer.servers = [
+      {
+        url = "http://localhost:3032/";
+      }
+    ];
+
+    routers.baserow = {
+      rule = "Host(`db.i.az-intec.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = "baserow";
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/AZ-PRM-1/services/containers/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    #./baserow.nix
+    #./kestra.nix
+  ];
+}

hosts/AZ-PRM-1/services/containers/kestra.nix

@@ -0,0 +1,34 @@
+{ config, ... }: {
+  virtualisation.oci-containers.containers."kestra" = {
+    image = "docker.io/kestra/kestra:latest";
+    environmentFiles = [ config.age.secrets.kestra-env.path ];
+    cmd = [ "server" "standalone" "--config" "/etc/config/application.yaml"];
+    ports = [ "127.0.0.1:3031:8080" ];
+    user = "root";
+    volumes = [
+      "/var/run/docker.sock:/var/run/docker.sock"
+      "${config.age.secrets.kestra-config.path}:/etc/config/application.yaml"
+      "kestra_data:/app/storage"
+      "/tmp/kestra-wd:/tmp/kestra-wd"
+    ];
+    extraOptions =
+      [ "--add-host=postgres:10.89.0.1" "--ip=10.89.0.12" "--network=web" ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /tmp/kestra-wd 0750 1000 1000 - -"
+  ];
+
+  # Traefik configuration specific to littlelink
+  services.traefik.dynamicConfigOptions.http = {
+    services.kestra.loadBalancer.servers =
+      [{ url = "http://localhost:3031/"; }];
+
+    routers.kestra = {
+      rule = "Host(`k.i.az-intec.com`)";
+      tls = { certResolver = "ionos"; };
+      service = "kestra";
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/AZ-PRM-1/services/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./n8n.nix
+    ./postgres.nix
+    ./traefik.nix
+    ./vaultwarden.nix
+  ];
+}

hosts/AZ-PRM-1/services/n8n.nix

@@ -0,0 +1,26 @@
+{config, ...}: {
+  services.n8n = {
+    enable = true;
+    webhookUrl = "https://wf.az-group.com";
+  };
+  systemd.services.n8n.serviceConfig = {
+    EnvironmentFile = ["${config.age.secrets.n8n-env.path}"];
+  };
+  # Traefik configuration specific to n8n
+  services.traefik.dynamicConfigOptions.http = {
+    services.n8n.loadBalancer.servers = [
+      {
+        url = "http://localhost:5678/";
+      }
+    ];
+
+    routers.n8n = {
+      rule = "Host(`wf.i.az-intec.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = "n8n";
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/AZ-PRM-1/services/postgres.nix

@@ -0,0 +1,68 @@
+{config, pkgs, ...}: {
+  services.postgresql = {
+    enable = true;
+    enableTCPIP = true;
+    package = pkgs.postgresql_17;
+    settings = {
+        ssl = true;
+        ssl_cert_file = config.age.secrets.pg-cert.path;
+        ssl_key_file  = config.age.secrets.pg-key.path;
+    };
+    extensions = with pkgs.postgresql17Packages; [
+      pgvector
+    ];
+    initialScript = pkgs.writeText "backend-initScript" ''
+      CREATE USER baserow WITH ENCRYPTED PASSWORD 'baserow';
+      CREATE DATABASE baserow;
+      ALTER DATABASE baserow OWNER to baserow;
+
+      CREATE USER kestra WITH ENCRYPTED PASSWORD 'kestra';
+      CREATE DATABASE kestra;
+      ALTER DATABASE kestra OWNER to kestra;
+
+      CREATE USER n8n WITH ENCRYPTED PASSWORD 'n8n';
+      CREATE DATABASE n8n;
+      ALTER DATABASE n8n OWNER to n8n;
+
+      CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'n8n';
+      CREATE DATABASE vaultwarden;
+      ALTER DATABASE vaultwarden OWNER to vaultwarden;
+    '';
+    authentication = pkgs.lib.mkOverride 10 ''
+      # Local connections (Unix socket)
+      local   all         postgres    peer
+      local   n8n         n8n         scram-sha-256
+      local   vaultwarden vaultwarden scram-sha-256
+
+      # Localhost connections (IPv4 and IPv6)
+      host    all          postgres     127.0.0.1/32    scram-sha-256
+      host    all          postgres     ::1/128         scram-sha-256
+  
+      host    n8n          n8n          127.0.0.1/32    scram-sha-256
+      host    n8n          n8n          ::1/128         scram-sha-256
+
+      host    vaultwarden  vaultwarden  127.0.0.1/32    scram-sha-256
+      host    vaultwarden  vaultwarden  ::1/128         scram-sha-256
+
+      # Podman network connections
+      host    baserow      baserow      10.89.0.0/24    scram-sha-256
+      host    kestra       kestra       10.89.0.0/24    scram-sha-256
+
+      # Deny all other connections
+      local   all       all       reject
+      host    all       all       0.0.0.0/0      reject
+      host    all       all       ::/0           reject
+    '';
+  };
+  services.postgresqlBackup = {
+    enable = true;
+    startAt = "03:10:00";
+    databases = ["baserow" "kestra" "n8n" "vaultwarden"];
+  };
+  networking.firewall = {
+    extraCommands = ''
+      iptables -A INPUT -p tcp -s 127.0.0.1 --dport 5432 -j ACCEPT
+      iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport 5432 -j ACCEPT
+    '';
+  };
+}

hosts/AZ-PRM-1/services/traefik.nix

@@ -0,0 +1,74 @@
+{config, ...}: {
+  services.traefik = {
+    enable = true;
+    staticConfigOptions = {
+      log = {level = "WARN";};
+      certificatesResolvers = {
+        ionos = {
+          acme = {
+            email = "sascha.koenig@azintec.com";
+            storage = "/var/lib/traefik/acme.json";
+            caserver = "https://acme-v02.api.letsencrypt.org/directory";
+            dnsChallenge = {
+              provider = "ionos";
+              resolvers = ["1.1.1.1:53" "8.8.8.8:53"];
+              propagation = {
+                delayBeforeChecks = 60;
+                disableChecks = true;
+              };
+            };
+          };
+        };
+      };
+      api = {};
+      entryPoints = {
+        web = {
+          address = ":80";
+          http.redirections.entryPoint = {
+            to = "websecure";
+            scheme = "https";
+          };
+        };
+        websecure = {
+          address = ":443";
+        };
+      };
+    };
+    dynamicConfigOptions = {
+      http = {
+        services = {
+          dummy = {
+            loadBalancer.servers = [
+              {url = "http://192.168.0.1";} # Diese URL wird nie verwendet
+            ];
+          };
+        };
+        middlewares = {
+          auth = {
+            basicAuth = {
+              users = ["sascha.koenig:$apr1$1xqdta2b$DIVNvvp5iTUGNccJjguKh."];
+            };
+          };
+        };
+
+        routers = {
+          api = {
+            rule = "Host(`r.az-gruppe.com`)";
+            service = "api@internal";
+            middlewares = ["auth"];
+            entrypoints = ["websecure"];
+            tls = {
+              certResolver = "ionos";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  systemd.services.traefik.serviceConfig = {
+    EnvironmentFile = ["${config.age.secrets.traefik-env.path}"];
+  };
+
+  networking.firewall.allowedTCPPorts = [80 443];
+}

hosts/AZ-PRM-1/services/vaultwarden.nix

@@ -0,0 +1,30 @@
+{config, ...}: {
+  services.vaultwarden = {
+    enable = true;
+    backupDir = "/var/backup/vaultwarden";
+    config = {
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 3030;
+    };
+    environmentFile = "${config.age.secrets.vaultwarden-env.path}";
+  };
+
+  # Traefik configuration for headscale
+  services.traefik.dynamicConfigOptions.http = {
+    services.vaultwarden.loadBalancer.servers = [
+      {
+        url = "http://localhost:3030/";
+      }
+    ];
+
+    routers.vaultwarden = {
+      rule = "Host(`pw.i.az-intec.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = "vaultwarden";
+      entrypoints = "websecure";
+    };
+  };
+}
+