Add NixOS host modules and runners

.gitea/workflows/nixos-switch-cloud-pc.yml

@@ -5,7 +5,10 @@ on:
   push:
     paths:
       - ".gitea/workflows/nixos-switch-cloud-pc.yml"
-      - "nixos/**"
+      - "nixos/flake.nix"
+      - "nixos/flake.lock"
+      - "nixos/modules/**"
+      - "nixos/hosts/cloud-pc/**"
 
 jobs:
   switch:

.gitea/workflows/nixos-switch-mini-pc.yml

@@ -5,7 +5,10 @@ on:
   push:
     paths:
       - ".gitea/workflows/nixos-switch-mini-pc.yml"
-      - "nixos/**"
+      - "nixos/flake.nix"
+      - "nixos/flake.lock"
+      - "nixos/modules/**"
+      - "nixos/hosts/mini-pc/**"
 
 jobs:
   switch:

nixos/flake.nix

@@ -9,14 +9,14 @@
     nixosConfigurations.cloud-pc = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       modules = [
-        ./hosts/cloud-pc.nix
+        ./hosts/cloud-pc
       ];
     };
 
     nixosConfigurations.mini-pc = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       modules = [
-        ./hosts/mini-pc.nix
+        ./hosts/mini-pc
       ];
     };
   };

nixos/hosts/cloud-pc/default.nix

@@ -1,11 +1,12 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   imports = [
-    ../modules/base.nix
+    ../../modules/base.nix
-    ../modules/docker.nix
+    ../../modules/docker.nix
-    ../modules/firewall.nix
+    ../../modules/libvirtd.nix
-    ./hardware-configuration.nix
+    ../../modules/firewall.nix
+    ./hardware.nix
   ];
 
   networking = {
@@ -46,13 +47,6 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  virtualisation.libvirtd = {
-    enable = true;
-    qemu = {
-      package = pkgs.qemu_kvm;
-    };
-  };
-
   services.zerotierone = {
     enable = true;
     joinNetworks = [
@@ -84,5 +78,12 @@
     "d /mnt/yandex 0755 ada users - -"
   ];
 
+  services.gitea-actions-runner.instances."cloud-pc-nixos" = {
+    name = "cloud-pc-nixos";
+    url = "https://git.example.com"; # поменяй на свой URL
+    tokenFile = "/etc/gitea-runner/cloud-pc-nixos.token";
+    labels = [ "cloud-pc-nixos" ];
+  };
+
   system.stateVersion = "25.11";
 }

nixos/hosts/cloud-pc/hardware.nix

@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f729e8cb-5c37-45fe-bd0a-e511d79bb49c";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/8BA8-38FE";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/hosts/mini-pc/default.nix

@@ -1,21 +1,17 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   imports = [
-    ../modules/base.nix
+    ../../modules/base.nix
-    ../modules/docker.nix
+    ../../modules/docker.nix
-    ../modules/firewall-mini-pc.nix
+    ../../modules/libvirtd.nix
-    ./mini-pc-hardware-configuration.nix
+    ../../modules/firewall-mini-pc.nix
+    ./hardware.nix
   ];
 
   networking = {
     hostName = "mini-pc";
     useDHCP = false;
-    defaultGateway = "192.168.1.1";
-    nameservers = [
-      "192.168.1.1"
-      "1.1.1.1"
-    ];
   };
 
   systemd.network = {
@@ -38,13 +34,6 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  virtualisation.libvirtd = {
-    enable = true;
-    qemu = {
-      package = pkgs.qemu_kvm;
-    };
-  };
-
   services.zerotierone = {
     enable = true;
     joinNetworks = [
@@ -65,5 +54,12 @@
     "d /opt/configs/caddy/lego 0755 ada users - -"
   ];
 
+  services.gitea-actions-runner.instances."mini-pc-nixos" = {
+    name = "mini-pc-nixos";
+    url = "https://git.example.com"; # поменяй на свой URL
+    tokenFile = "/etc/gitea-runner/mini-pc-nixos.token";
+    labels = [ "mini-pc-nixos" ];
+  };
+
   system.stateVersion = "25.11";
 }

nixos/hosts/mini-pc/hardware.nix

@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/a2fc1626-3301-44dd-9d00-fa7e8d216d25";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/73C2-3F45";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/modules/base.nix

@@ -1,10 +1,19 @@
 { pkgs, ... }:
 
 {
-  nix.settings.experimental-features = [
+  nix = {
-    "nix-command"
+    settings = {
-    "flakes"
+      experimental-features = [ "nix-command" "flakes" ];
-  ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  boot.tmp.cleanOnBoot = true;
 
   time.timeZone = "Europe/Moscow";
 
@@ -20,7 +29,6 @@
     extraGroups = [
       "wheel"
       "docker"
-      "libvirtd"
     ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWNsUQmppB6cQccXX1ZaBbFIcmM6RmghsTVbG9TgoZB ada@ada-x1"

nixos/modules/firewall-mini-pc.nix

@@ -2,13 +2,13 @@
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [
-      22
+      22 # SSH
-      53
+      53 # DNS (AdGuard)
-      80
+      80 # HTTP
-      443
+      443 # HTTPS
-      784
+      784 # DNS-over-QUIC
-      853
+      853 # DNS-over-TLS
-      3001
+      3001 # Uptime Kuma
       3015
       4438
       5443
@@ -16,10 +16,10 @@
       10380
     ];
     allowedUDPPorts = [
-      53
+      53 # DNS
-      443
+      443 # QUIC
-      784
+      784 # DNS-over-QUIC
-      9993
+      9993 # ZeroTier
       5443
     ];
   };

nixos/modules/firewall.nix

@@ -2,24 +2,24 @@
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [
-      22
+      22 # SSH
-      139
+      139 # Samba (NetBIOS session)
-      445
+      445 # Samba (SMB)
-      2222
+      2222 # Gitea SSH
       3002
       4567
-      5432
+      5432 # PostgreSQL
       7080
       8081
-      8384
+      8384 # Syncthing web UI
-      22000
+      22000 # Syncthing data transfer
     ];
     allowedUDPPorts = [
-      137
+      137 # Samba (NetBIOS name)
-      138
+      138 # Samba (NetBIOS datagram)
-      9993
+      9993 # ZeroTier
-      21027
+      21027 # Syncthing discovery
-      22000
+      22000 # Syncthing data transfer
     ];
   };
 }

nixos/modules/libvirtd.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu.package = pkgs.qemu_kvm;
+  };
+
+  users.users.ada.extraGroups = [ "libvirtd" ];
+}