summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGrisha Shipunov2026-07-26 20:32:54 +0000
committerGrisha Shipunov2026-08-01 19:00:44 +0000
commitcc89163f31ee00b1402b1ebf6070eda29d4c97f9 (patch)
tree97acde7d124a4a6b35158eb58678b68ba92e919f
parentd1f771dd9eeb680cbd7ffef5a8667dae5bbb4837 (diff)
:authentik: yeet
-rw-r--r--flake.lock325
-rw-r--r--flake.nix11
-rw-r--r--microvms/auth/authentik.nix17
-rw-r--r--microvms/auth/default.nix78
-rw-r--r--microvms/auth/secrets.yaml39
5 files changed, 27 insertions, 443 deletions
diff --git a/flake.lock b/flake.lock
index 592d9b6..868bf9a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,48 +1,5 @@
{
"nodes": {
- "authentik-nix": {
- "inputs": {
- "authentik-src": "authentik-src",
- "flake-compat": "flake-compat",
- "flake-parts": "flake-parts",
- "flake-utils": "flake-utils",
- "nixpkgs": "nixpkgs",
- "pyproject-build-systems": "pyproject-build-systems",
- "pyproject-nix": "pyproject-nix",
- "systems": "systems",
- "uv2nix": "uv2nix"
- },
- "locked": {
- "lastModified": 1785488913,
- "narHash": "sha256-5kEMR7Pbaldsz5PBYJ6z5o1AxxdnWbGoDkFngl4SXFI=",
- "owner": "nix-community",
- "repo": "authentik-nix",
- "rev": "d9a66712def0b044b86dc13f7a319641bbd2a34b",
- "type": "github"
- },
- "original": {
- "owner": "nix-community",
- "repo": "authentik-nix",
- "type": "github"
- }
- },
- "authentik-src": {
- "flake": false,
- "locked": {
- "lastModified": 1784731584,
- "narHash": "sha256-/HdXzjjvuSW7zjbCNJKm3Fj8gvIwfrDf8mOYev0yuIg=",
- "owner": "goauthentik",
- "repo": "authentik",
- "rev": "0c67ea476be6319f1b2a41cb0f5ed128af37b99b",
- "type": "github"
- },
- "original": {
- "owner": "goauthentik",
- "ref": "version/2026.5.6",
- "repo": "authentik",
- "type": "github"
- }
- },
"crane": {
"locked": {
"lastModified": 1781825982,
@@ -63,22 +20,6 @@
"locked": {
"lastModified": 1767039857,
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
- "owner": "edolstra",
- "repo": "flake-compat",
- "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
- "type": "github"
- },
- "original": {
- "owner": "edolstra",
- "repo": "flake-compat",
- "type": "github"
- }
- },
- "flake-compat_2": {
- "flake": false,
- "locked": {
- "lastModified": 1767039857,
- "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
"owner": "NixOS",
"repo": "flake-compat",
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
@@ -90,63 +31,6 @@
"type": "github"
}
},
- "flake-parts": {
- "inputs": {
- "nixpkgs-lib": "nixpkgs-lib"
- },
- "locked": {
- "lastModified": 1782949081,
- "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
- "owner": "hercules-ci",
- "repo": "flake-parts",
- "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
- "type": "github"
- },
- "original": {
- "owner": "hercules-ci",
- "repo": "flake-parts",
- "type": "github"
- }
- },
- "flake-utils": {
- "inputs": {
- "systems": [
- "authentik-nix",
- "systems"
- ]
- },
- "locked": {
- "lastModified": 1731533236,
- "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
- "owner": "numtide",
- "repo": "flake-utils",
- "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
- "type": "github"
- },
- "original": {
- "owner": "numtide",
- "repo": "flake-utils",
- "type": "github"
- }
- },
- "flake-utils_2": {
- "inputs": {
- "systems": "systems_2"
- },
- "locked": {
- "lastModified": 1731533236,
- "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
- "owner": "numtide",
- "repo": "flake-utils",
- "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
- "type": "github"
- },
- "original": {
- "owner": "numtide",
- "repo": "flake-utils",
- "type": "github"
- }
- },
"gitignore": {
"inputs": {
"nixpkgs": [
@@ -201,11 +85,11 @@
"spectrum": "spectrum"
},
"locked": {
- "lastModified": 1785486846,
- "narHash": "sha256-bWmnG2nQJe05AReeeJo5WVA3dqGwTeh7N8+sWivrO1Y=",
+ "lastModified": 1784666190,
+ "narHash": "sha256-xgfS6slV7J3baMooNN1UuBi51RIgg9y0DbCxfSA0668=",
"owner": "microvm-nix",
"repo": "microvm.nix",
- "rev": "c103a89f25e6d2c98cee242474fe6867d3266677",
+ "rev": "fa5340ac684cdce8a22b6d4a0bcebb0cc999275e",
"type": "github"
},
"original": {
@@ -216,14 +100,14 @@
},
"nixos-hardware": {
"inputs": {
- "nixpkgs": "nixpkgs_2"
+ "nixpkgs": "nixpkgs"
},
"locked": {
- "lastModified": 1785232496,
- "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
+ "lastModified": 1784723954,
+ "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
"owner": "NixOS",
"repo": "nixos-hardware",
- "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
+ "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
"type": "github"
},
"original": {
@@ -235,68 +119,37 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1785090369,
- "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
- "owner": "NixOS",
- "repo": "nixpkgs",
- "rev": "624af665418d3c65d544145b4d34ad696439570e",
- "type": "github"
- },
- "original": {
- "owner": "NixOS",
- "ref": "nixos-unstable",
- "repo": "nixpkgs",
- "type": "github"
- }
- },
- "nixpkgs-lib": {
- "locked": {
- "lastModified": 1782614948,
- "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
- "owner": "nix-community",
- "repo": "nixpkgs.lib",
- "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
- "type": "github"
- },
- "original": {
- "owner": "nix-community",
- "repo": "nixpkgs.lib",
- "type": "github"
- }
- },
- "nixpkgs-unstable": {
- "locked": {
- "lastModified": 1785454630,
- "narHash": "sha256-Lr/ImHlbXabw7KPWfXWY4kkiiHb24PkmBZVVIm28V/c=",
- "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746",
+ "lastModified": 1767892417,
+ "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+ "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
"type": "tarball",
- "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1044798.1559d3daa3ec/nixexprs.tar.xz"
+ "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
}
},
- "nixpkgs_2": {
+ "nixpkgs-unstable": {
"locked": {
- "lastModified": 1767892417,
- "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
- "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+ "lastModified": 1784796856,
+ "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
+ "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
"type": "tarball",
- "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+ "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
}
},
- "nixpkgs_3": {
+ "nixpkgs_2": {
"locked": {
- "lastModified": 1785386831,
- "narHash": "sha256-xQPrEWR75P2lZ/p9pAzIeMd4PtkckDLj6ojo+tWjZQw=",
- "rev": "21ea275a7c46aef9d4d6ddc962e6d562e9d94183",
+ "lastModified": 1784856561,
+ "narHash": "sha256-/HjbyQqfFs3cG7o/zJ25RPaLZqS9a88z6vOGhMoZwRs=",
+ "rev": "597283ad8aa0b331c788e97c4c262d58877074ef",
"type": "tarball",
- "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.6503.21ea275a7c46/nixexprs.tar.xz"
+ "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.5984.597283ad8aa0/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
@@ -305,7 +158,7 @@
},
"pre-commit": {
"inputs": {
- "flake-compat": "flake-compat_2",
+ "flake-compat": "flake-compat",
"gitignore": "gitignore",
"nixpkgs": [
"lanzaboote",
@@ -326,67 +179,14 @@
"type": "github"
}
},
- "pyproject-build-systems": {
- "inputs": {
- "nixpkgs": [
- "authentik-nix",
- "nixpkgs"
- ],
- "pyproject-nix": [
- "authentik-nix",
- "pyproject-nix"
- ],
- "uv2nix": [
- "authentik-nix",
- "uv2nix"
- ]
- },
- "locked": {
- "lastModified": 1785115949,
- "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=",
- "owner": "pyproject-nix",
- "repo": "build-system-pkgs",
- "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9",
- "type": "github"
- },
- "original": {
- "owner": "pyproject-nix",
- "repo": "build-system-pkgs",
- "type": "github"
- }
- },
- "pyproject-nix": {
- "inputs": {
- "nixpkgs": [
- "authentik-nix",
- "nixpkgs"
- ]
- },
- "locked": {
- "lastModified": 1784591072,
- "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=",
- "owner": "pyproject-nix",
- "repo": "pyproject.nix",
- "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3",
- "type": "github"
- },
- "original": {
- "owner": "pyproject-nix",
- "repo": "pyproject.nix",
- "type": "github"
- }
- },
"root": {
"inputs": {
- "authentik-nix": "authentik-nix",
- "flake-utils": "flake-utils_2",
"lanzaboote": "lanzaboote",
"microvm": "microvm",
"nixos-hardware": "nixos-hardware",
- "nixpkgs": "nixpkgs_3",
+ "nixpkgs": "nixpkgs_2",
"nixpkgs-unstable": "nixpkgs-unstable",
"sops-nix": "sops-nix",
- "tmux-yank": "tmux-yank",
"website": "website"
}
},
@@ -447,85 +247,14 @@
"url": "https://spectrum-os.org/git/spectrum"
}
},
- "systems": {
- "locked": {
- "lastModified": 1689347949,
- "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
- "owner": "nix-systems",
- "repo": "default-linux",
- "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
- "type": "github"
- },
- "original": {
- "owner": "nix-systems",
- "repo": "default-linux",
- "type": "github"
- }
- },
- "systems_2": {
- "locked": {
- "lastModified": 1681028828,
- "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
- "owner": "nix-systems",
- "repo": "default",
- "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
- "type": "github"
- },
- "original": {
- "owner": "nix-systems",
- "repo": "default",
- "type": "github"
- }
- },
- "tmux-yank": {
- "flake": false,
- "locked": {
- "lastModified": 1689770565,
- "narHash": "sha256-/5HPaoOx2U2d8lZZJo5dKmemu6hKgHJYq23hxkddXpA=",
- "owner": "tmux-plugins",
- "repo": "tmux-yank",
- "rev": "acfd36e4fcba99f8310a7dfb432111c242fe7392",
- "type": "github"
- },
- "original": {
- "owner": "tmux-plugins",
- "repo": "tmux-yank",
- "type": "github"
- }
- },
- "uv2nix": {
- "inputs": {
- "nixpkgs": [
- "authentik-nix",
- "nixpkgs"
- ],
- "pyproject-nix": [
- "authentik-nix",
- "pyproject-nix"
- ]
- },
- "locked": {
- "lastModified": 1785147819,
- "narHash": "sha256-udwe836AZe8BYU+YqVc51QLuOeWKoGEmPIMF0ImUfTQ=",
- "owner": "pyproject-nix",
- "repo": "uv2nix",
- "rev": "0983f54345137c2dd528ce2c28cb56c2cbdceb2a",
- "type": "github"
- },
- "original": {
- "owner": "pyproject-nix",
- "repo": "uv2nix",
- "type": "github"
- }
- },
"website": {
"flake": false,
"locked": {
- "lastModified": 1785506714,
- "narHash": "sha256-7Zk2FFyvVp7/8UpXj46sMHCOo7PC3mjoi43jSozWhhk=",
+ "lastModified": 1783249380,
+ "narHash": "sha256-7ZDaGKok/PgLZt3GcA5GCtzkKwCFAQc9lgwvP7W2UcM=",
"ref": "refs/heads/main",
- "rev": "1b7746fb6d1e84b2f0a73d3d819a2721023190ec",
- "revCount": 4,
+ "rev": "e23b89512dba31a8c37854d9586cf8036aa55eb0",
+ "revCount": 3,
"type": "git",
"url": "https://git.oxapentane.com/website.git"
},
diff --git a/flake.nix b/flake.nix
index 8fc8ea8..f80186e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,7 +4,6 @@
# nixpkgs-unstable.url = "github:gshipunov/nixpkgs?ref=nixos-unstable";
nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
- flake-utils.url = "github:numtide/flake-utils";
sops-nix = {
url = "github:Mic92/sops-nix";
@@ -24,19 +23,10 @@
inputs.nixpkgs.follows = "nixpkgs-unstable";
};
- authentik-nix = {
- url = "github:nix-community/authentik-nix";
- };
-
website = {
url = "git+https://git.oxapentane.com/website.git";
flake = false;
};
-
- tmux-yank = {
- url = "github:tmux-plugins/tmux-yank";
- flake = false;
- };
};
outputs =
@@ -60,7 +50,6 @@
"cgit"
];
microvm-unstable-list = [
- "auth"
"immich"
];
diff --git a/microvms/auth/authentik.nix b/microvms/auth/authentik.nix
deleted file mode 100644
index a1257ee..0000000
--- a/microvms/auth/authentik.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ config, inputs, ... }:
-{
- imports = [
- inputs.authentik-nix.nixosModules.default
- ];
- sops.secrets."authentik/env" = { };
- services.authentik = {
- enable = true;
- environmentFile = config.sops.secrets."authentik/env".path;
- settings = {
- log_level = "debug";
- disable_startup_analytics = true;
- avatars = "initials";
- postgresql.host = "/run/postgresql";
- };
- };
-}
diff --git a/microvms/auth/default.nix b/microvms/auth/default.nix
deleted file mode 100644
index 734ef43..0000000
--- a/microvms/auth/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ config, lib, ... }:
-let
- mac = "02:00:00:00:00:01";
-in
-{
- imports = [
- ./authentik.nix
- ];
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/0xa-proxy" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-
- microvm = {
- hypervisor = "cloud-hypervisor";
- vsock.cid = 3 + 1;
- mem = 2 * 1024;
- vcpu = 2;
- interfaces = [
- {
- type = "tap";
- id = "uvm-auth";
- mac = mac;
- }
- ];
- shares = [
- {
- source = "/nix/store";
- mountPoint = "/nix/.ro-store";
- tag = "store";
- proto = "virtiofs";
- socket = "store.socket";
- }
- ]
- ++
- map
- (dir: {
- source = dir;
- mountPoint = "/${dir}";
- tag = dir;
- proto = "virtiofs";
- socket = "${dir}.socket";
- })
- [
- "etc"
- "var"
- "home"
- ];
- };
-
- networking.useNetworkd = true;
- networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
- systemd.network = {
- enable = true;
- networks."11-host" = {
- matchConfig.MACAddress = mac;
- networkConfig = {
- Address = "10.99.99.11/24";
- DHCP = "no";
- };
- routes = [
- {
- Gateway = "10.99.99.1";
- Destination = "0.0.0.0/0";
- Metric = 1024;
- }
- ];
- };
- };
-
- networking.hostName = "auth";
- system.stateVersion = "24.11";
-}
diff --git a/microvms/auth/secrets.yaml b/microvms/auth/secrets.yaml
deleted file mode 100644
index 87d2f31..0000000
--- a/microvms/auth/secrets.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-authentik:
- env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str]
-wg:
- 0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str]
-sops:
- age:
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE
- NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281
- QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ
- QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl
- W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive
- wWGaYQ==
- -----END AGE ENCRYPTED FILE-----
- - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU
- TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1
- eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY
- WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY
- eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV
- iaiVrA==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt
- TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk
- OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214
- V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN
- 8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-01-21T00:19:40Z"
- mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str]
- unencrypted_suffix: _unencrypted
- version: 3.9.3