reudy-net/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use the panel from its own flake (reudy-net/panel)

Browse source 
The panel's code moved to git.reudy.net/reudy-net/panel, which provides a
package and a NixOS module. This config now pulls it in as the `panel`
flake input and only sets services.reudy-panel options, so panel updates
are `nix flake update panel` instead of edits in this repo.

The input uses ssh because the reudy-net org is not visible anonymously.
The generated service, directories, Caddy vhost, routes import and reload
units are unchanged apart from store paths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
This commit is contained in:
agent 2026-09-27 17:56:01 +00:00
parent 3c416dc6e9
commit e7bf1acd93
9 changed files with 42 additions and 5925 deletions
Download patch file Download diff file Expand all files Collapse all files

97
panel.nix
View file

@ -1,89 +1,14 @@
{ config, lib, pkgs, ... }:
{ ... }:
let
forgejoServer = config.services.forgejo.settings.server;
in
# The panel itself lives in its own repository (reudy-net/panel) and is pulled
# in as the `panel` flake input. To deploy a new panel version:
# nix flake update panel && sudo nixos-rebuild switch --flake .#vps
{
environment.systemPackages = [
(pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
];
users.groups.panelroutes = { };
users.users.reudy.extraGroups = [ "panelroutes" ];
users.users.caddy.extraGroups = [ "panelroutes" ];
systemd.tmpfiles.rules = [
"d /var/lib/containers 0750 reudy panelroutes -"
"d /var/lib/containers/stacks 0750 reudy panelroutes -"
"d /var/lib/containers/volumes 0750 reudy panelroutes -"
"d /var/lib/containers/routes 0750 reudy panelroutes -"
"d /var/lib/containers/state 0750 reudy panelroutes -"
"d /var/lib/containers/state/apps 0750 reudy panelroutes -"
"d /var/lib/containers/backups 0750 reudy panelroutes -"
"f /var/lib/containers/routes/routes.caddy 0640 reudy panelroutes -"
];
systemd.services.panel-api = {
description = "Minimal panel API service";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = [
pkgs.podman
pkgs.podman-compose
pkgs.curl
pkgs.coreutils
pkgs.zip
pkgs.unzip
pkgs.git
pkgs.util-linux # flock, used by panelctl to serialise routes file writes
pkgs.openssh # cloning repositories over ssh with the panel's deploy key
];
serviceConfig = {
Type = "simple";
User = "reudy";
Group = "panelroutes";
Restart = "always";
RestartSec = 3;
WorkingDirectory = "/var/lib/containers";
ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}";
};
environment = {
PANEL_API_BIND = "127.0.0.1";
PANEL_API_PORT = "9911";
PANEL_BASE_DIR = "/var/lib/containers";
PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
PANEL_FRONTEND_DIR = "${./panel/frontend}";
# Forgejo integration (repo picker, private clones, commit links).
# The API is reached on localhost; clones use the public URLs.
PANEL_FORGEJO_URL = lib.removeSuffix "/" forgejoServer.ROOT_URL;
PANEL_FORGEJO_API_URL = "http://${forgejoServer.HTTP_ADDR}:${toString forgejoServer.HTTP_PORT}";
PANEL_FORGEJO_SSH_URL = "ssh://${forgejoServer.BUILTIN_SSH_SERVER_USER}@${forgejoServer.DOMAIN}:${toString forgejoServer.SSH_PORT}";
};
services.reudy-panel = {
enable = true;
domain = "panel.reudy.net";
autheliaAddress = "127.0.0.1:9091";
# Runs as reudy with the shared panelroutes group, keeps everything in
# /var/lib/containers and picks up the local Forgejo automatically.
};
services.caddy.virtualHosts."panel.reudy.net".extraConfig = ''
forward_auth 127.0.0.1:9091 {
uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
}
reverse_proxy 127.0.0.1:9911
'';
systemd.paths."caddy-routes-reload" = {
wantedBy = [ "multi-user.target" ];
pathConfig = {
PathChanged = "/var/lib/containers/routes/routes.caddy";
};
};
systemd.services."caddy-routes-reload" = {
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service";
};
};
}
}