hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Wire Forge-native release infrastructure
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Details
Build Rust / Cargo Test (push) Successful in 4m14s
Details
Build Site / Next.js Build (push) Failing after 6s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Details
Lint Governance / BEP Metadata (push) Successful in 0s
Details
Build: Android / Android Rust Core Stub (push) Failing after 23s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 05:51:12 -07:00
parent 97c569fb35
commit 002bd382e9
199 changed files with 14268 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

101
nixos/hosts/burrow-forge/default.nix
View file

@ -60,8 +60,13 @@ in
self.nixosModules.burrow-forge-runner
self.nixosModules.burrow-forgejo-nsc
self.nixosModules.burrow-authentik
self.nixosModules.burrow-garage
self.nixosModules.burrow-headscale
self.nixosModules.burrow-nix-cache
self.nixosModules.burrow-observability
self.nixosModules.burrow-zulip
self.nixosModules.burrow-openbao
self.nixosModules.burrow-jitsi
];
system.stateVersion = "24.11";
@ -108,6 +113,24 @@ in
group = "forgejo";
mode = "0440";
};
age.secrets.burrowGrafanaAdminPassword = {
file = ../../../secrets/infra/grafana-admin-password.age;
owner = "grafana";
group = "grafana";
mode = "0400";
};
age.secrets.burrowGrafanaSecretKey = {
file = ../../../secrets/infra/grafana-secret-key.age;
owner = "grafana";
group = "grafana";
mode = "0400";
};
age.secrets.burrowGrafanaOidcClientSecret = {
file = ../../../secrets/infra/grafana-oidc-client-secret.age;
owner = "grafana";
group = "grafana";
mode = "0400";
};
age.secrets.burrowTailscaleOidcClientSecret = {
file = ../../../secrets/infra/tailscale-oidc-client-secret.age;
owner = "root";
@ -138,6 +161,12 @@ in
group = "root";
mode = "0400";
};
age.secrets.burrowAuthentikGoogleWifClientSecret = {
file = ../../../secrets/infra/authentik-google-wif-client-secret.age;
owner = "root";
group = "root";
mode = "0400";
};
age.secrets.burrowAuthentikUiTestPassword = {
file = ../../../secrets/infra/authentik-ui-test-password.age;
owner = "root";
@ -192,8 +221,8 @@ in
};
networking.extraHosts = ''
127.0.0.1 burrow.net git.burrow.net auth.burrow.net ts.burrow.net chat.burrow.net nsc-autoscaler.burrow.net
::1 burrow.net git.burrow.net auth.burrow.net ts.burrow.net chat.burrow.net nsc-autoscaler.burrow.net
127.0.0.1 burrow.net git.burrow.net auth.burrow.net ts.burrow.net chat.burrow.net graphs.burrow.net vault.burrow.net meet.burrow.net inbox.burrow.net nsc-autoscaler.burrow.net
::1 burrow.net git.burrow.net auth.burrow.net ts.burrow.net chat.burrow.net graphs.burrow.net vault.burrow.net meet.burrow.net inbox.burrow.net nsc-autoscaler.burrow.net
'';
services.burrow.forge = {
@ -235,15 +264,20 @@ in
enable = true;
envFile = config.age.secrets.burrowAuthentikEnv.path;
forgejoClientSecretFile = config.age.secrets.burrowForgejoOidcClientSecret.path;
grafanaClientSecretFile = config.age.secrets.burrowGrafanaOidcClientSecret.path;
grafanaAccessGroupName = contributors.groups.users;
headscaleClientSecretFile = config.age.secrets.burrowHeadscaleOidcClientSecret.path;
tailscaleClientSecretFile = config.age.secrets.burrowTailscaleOidcClientSecret.path;
defaultExternalApplicationSlug = "tailscale";
googleClientIDFile = config.age.secrets.burrowAuthentikGoogleClientId.path;
googleClientSecretFile = config.age.secrets.burrowAuthentikGoogleClientSecret.path;
googleAccountMapFile = config.age.secrets.burrowAuthentikGoogleAccountMap.path;
googleWifClientSecretFile = config.age.secrets.burrowAuthentikGoogleWifClientSecret.path;
googleWifAccessGroupName = contributors.groups.automation;
googleLoginMode = "redirect";
userGroupName = contributors.groups.users;
adminGroupName = contributors.groups.admins;
extraGroupNames = [ contributors.groups.automation ];
tailscaleAccessGroupName = contributors.groups.users;
bootstrapUsers = bootstrapUsers;
linearAcsUrl = "https://api.linear.app/auth/sso/d0ca13dc-ac41-4824-8aab-e0ca352fc3de/acs";
@ -258,12 +292,75 @@ in
zulipAccessGroupName = contributors.groups.users;
};
services.grafana = {
enable = true;
settings = {
server = {
domain = "graphs.burrow.net";
root_url = "https://graphs.burrow.net/";
http_addr = "127.0.0.1";
http_port = 3001;
enforce_domain = true;
};
analytics = {
reporting_enabled = false;
check_for_updates = false;
check_for_plugin_updates = false;
};
security = {
admin_user = "admin";
admin_password = "$__file{${config.age.secrets.burrowGrafanaAdminPassword.path}}";
secret_key = "$__file{${config.age.secrets.burrowGrafanaSecretKey.path}}";
cookie_secure = true;
cookie_samesite = "strict";
disable_gravatar = true;
};
users = {
allow_sign_up = false;
auto_assign_org = true;
auto_assign_org_role = "Viewer";
};
auth = {
disable_login_form = false;
oauth_auto_login = false;
};
"auth.generic_oauth" = {
enabled = true;
name = "burrow.net";
allow_sign_up = true;
auto_login = true;
client_id = "graphs.burrow.net";
client_secret = "$__file{${config.age.secrets.burrowGrafanaOidcClientSecret.path}}";
scopes = "openid profile email groups";
auth_url = "https://auth.burrow.net/application/o/grafana/authorize/";
token_url = "https://auth.burrow.net/application/o/grafana/token/";
api_url = "https://auth.burrow.net/application/o/grafana/userinfo/";
role_attribute_path = "contains(groups[*], 'burrow-admins') && 'Admin' || 'Viewer'";
};
};
};
services.caddy.virtualHosts."graphs.burrow.net".extraConfig = ''
encode gzip zstd
reverse_proxy 127.0.0.1:3001
'';
services.burrow.headscale = {
enable = true;
oidcClientSecretFile = config.age.secrets.burrowHeadscaleOidcClientSecret.path;
bootstrapUsers = headscaleBootstrapUsers;
};
services.burrow.garage = {
enable = true;
enableApiProxy = true;
enableWebProxy = true;
};
services.burrow.nixCache.enable = true;
services.burrow.observability.enable = true;
services.burrow.zulip = {
enable = true;
administratorEmail = identities.contact.canonicalEmail;