home/terminal/ssh/default.nix

@@ -6,7 +6,6 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (osConfig.modules.meta) hostname;
 in
 mkIf config.programs.ssh.enable {
   programs.ssh = {
@@ -17,7 +16,7 @@ mkIf config.programs.ssh.enable {
         user = "deck";
         port = 22;
       };
-      vm = mkIf (hostname == "marr") {
+      vm = mkIf (osConfig.networking.hostName == "marr") {
         hostname = "192.168.122.152";
         user = "ny";
         port = 22;

hosts/raptus/default.nix

@@ -14,7 +14,6 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
     ./disk-config.nix
     ./forgejo.nix
-    ./forgejo-runner.nix
     ./headscale
     ./fail2ban.nix
   ];
@@ -42,7 +41,7 @@ in
       settings = {
         server = {
           url = "https://rusty.ccnlc.eu";
-          max_content_length = "1000MB";
+          max_content_length = "50MB";
           timeout = "30s";
           expose_version = false;
           expose_list = false;
@@ -77,6 +76,8 @@ in
     };
   };
 
+  services.headscale.enable = true;
+
   networking = {
     nftables.enable = true;
     firewall = {
@@ -84,42 +85,37 @@ in
       allowedTCPPorts = [
         80 # for acme challenges
         443
-      ];
+      ] ++ [ config.services.endlessh.port ];
     };
   };
 
   age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
-  security = {
+  security.acme.defaults.email = "admin@ccnlc.eu";
-    polkit.enable = true;
+  security.acme.acceptTerms = true;
 
-    acme = {
+  services.nginx = {
-      defaults.email = "admin@ccnlc.eu";
+    package = pkgs.nginxQuic;
-      acceptTerms = true;
+    enable = true;
-    };
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    clientMaxBodySize = "50M";
+    virtualHosts = builtins.listToAttrs [
+      (mkVHost "rusty.ccnlc.eu" 8000 true)
+    ];
   };
 
-  services = {
+  services.endlessh = {
-    fail2ban.enable = true;
+    enable = true;
-    headscale.enable = true;
+    port = 22;
-
-    nginx = {
-      package = pkgs.nginxQuic;
-      enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      clientMaxBodySize = "100M";
-      virtualHosts = builtins.listToAttrs [
-        (mkVHost "rusty.ccnlc.eu" 8000 true)
-      ];
-    };
-
-    endlessh = {
-      enable = true;
-      port = 22;
-      openFirewall = true;
-    };
   };
 
+  services.fail2ban.enable = true;
+
+  environment.systemPackages = map lib.lowPrio [
+    pkgs.curl
+    pkgs.gitMinimal
+  ];
+
   system.stateVersion = "24.11";
 }

hosts/raptus/forgejo-runner.nix

@@ -1,49 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit (lib) mkIf;
-  inherit (config.modules.meta) hostname;
-
-  cfg = config.services.forgejo;
-in
-{
-  config = mkIf cfg.enable {
-    services.gitea-actions-runner = {
-      package = pkgs.forgejo-runner;
-
-      instances."${hostname}" = {
-        enable = true;
-        name = "${hostname}";
-        tokenFile = config.age.secrets.forgejo-runner-token.path;
-        url = "https://git.ccnlc.eu";
-
-        labels = [
-          "debian-latest:docker://node:18-bullseye"
-          "ubuntu-latest:docker://node:18-bullseye"
-        ];
-
-        settings = {
-          runner = {
-            capacity = 2;
-            timeout = "2h";
-
-            shutdown_timeout = "5s";
-          };
-
-          cache.enabled = true;
-
-          container = {
-            force_pull = false;
-            force_rebuild = false;
-          };
-        };
-      };
-    };
-
-    virtualisation.docker.enable = true;
-  };
-}

hosts/raptus/forgejo.nix

@@ -16,6 +16,21 @@ in
       "L+ ${config.services.forgejo.customDir}/public/robots.txt - - - - ${robots.outPath}"
     ];
 
+  services.gitea-actions-runner = {
+    instances."raptus" = {
+      enable = true;
+      name = "raptus";
+      tokenFile = config.age.secrets.forgejo-runner-token.path;
+      url = "https://git.ccnlc.eu";
+      labels = [
+        "debian-latest:docker://node:18-bullseye"
+        "nixos:docker://ghcr.io/nydragon/runner@sha256:2d353515d7461fe493cb69f538ebf188944b0de8fd2613a652636fc75098acac"
+      ];
+    };
+  };
+
+  virtualisation.docker.enable = true;
+
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
   services.nginx = {

options/default.nix

@@ -2,7 +2,6 @@
   imports = [
     ./media.nix
     ./fs.nix
-    ./meta.nix
 
     ./services
     ./system

options/meta.nix

@@ -1,14 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib) mkOption;
-  inherit (lib.types) nullOr str;
-in
-{
-  options.modules.meta = {
-    hostname = mkOption {
-      default = null;
-      type = nullOr str;
-      description = "The system's hostname.";
-    };
-  };
-}

options/system/networking/default.nix

@@ -1,13 +1,6 @@
-{ config, ... }:
-let
-  inherit (config.modules.meta) hostname;
-in
 {
   imports = [
     ./wifi.nix
     ./bluetooth.nix
   ];
-  config = {
-    networking.hostName = hostname;
-  };
 }

parts/lib/functions.nix

@@ -43,7 +43,7 @@ in
           "${self}/hosts/${hostname}"
           "${self}/options"
           "${self}/modules"
-          { modules.meta.hostname = hostname; }
+          { networking.hostName = hostname; }
         ] ++ extraModules;
         specialArgs = {
           inherit inputs inputs';