From accb4d4c81eb380e3c4ab4c8215fde66fb894847 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Sun, 17 Nov 2024 00:41:09 +0100 Subject: [PATCH 1/7] Move files related to vm02186 to own directory --- infra/{ => vm02186}/flake.nix | 0 infra/{ => vm02186}/gitea-runner.nix | 0 infra/{ => vm02186}/hardware-configuration.nix | 0 infra/{ => vm02186}/procolix-configuration.nix | 7 ++++++- 4 files changed, 6 insertions(+), 1 deletion(-) rename infra/{ => vm02186}/flake.nix (100%) rename infra/{ => vm02186}/gitea-runner.nix (100%) rename infra/{ => vm02186}/hardware-configuration.nix (100%) rename infra/{ => vm02186}/procolix-configuration.nix (96%) diff --git a/infra/flake.nix b/infra/vm02186/flake.nix similarity index 100% rename from infra/flake.nix rename to infra/vm02186/flake.nix diff --git a/infra/gitea-runner.nix b/infra/vm02186/gitea-runner.nix similarity index 100% rename from infra/gitea-runner.nix rename to infra/vm02186/gitea-runner.nix diff --git a/infra/hardware-configuration.nix b/infra/vm02186/hardware-configuration.nix similarity index 100% rename from infra/hardware-configuration.nix rename to infra/vm02186/hardware-configuration.nix diff --git a/infra/procolix-configuration.nix b/infra/vm02186/procolix-configuration.nix similarity index 96% rename from infra/procolix-configuration.nix rename to infra/vm02186/procolix-configuration.nix index 08a6b18..30d8427 100644 --- a/infra/procolix-configuration.nix +++ b/infra/vm02186/procolix-configuration.nix @@ -122,7 +122,12 @@ i18n.defaultLocale = "en_US.UTF-8"; # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.root.hashedPassword = "$y$j9T$WXvLAUqArJJusuC017FCW0$.rfMOeyx/BsClkJFi5hLcynrSk.njWmfiB6Uy.9th3A"; + users.users.root = { + hashedPassword = "$y$j9T$WXvLAUqArJJusuC017FCW0$.rfMOeyx/BsClkJFi5hLcynrSk.njWmfiB6Uy.9th3A"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY" + ]; + }; users.users.procolix = { isNormalUser = true; From 8a53b5242ba0929966f7962717a7199583caa23e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Sun, 17 Nov 2024 00:46:56 +0100 Subject: [PATCH 2/7] Add files related to vm02179 --- infra/vm02179/configuration.nix | 210 +++++++++++++++++++++++ infra/vm02179/gitea-runner.nix | 37 ++++ infra/vm02179/hardware-configuration.nix | 37 ++++ infra/vm02179/token.txt | 1 + 4 files changed, 285 insertions(+) create mode 100644 infra/vm02179/configuration.nix create mode 100644 infra/vm02179/gitea-runner.nix create mode 100644 infra/vm02179/hardware-configuration.nix create mode 100644 infra/vm02179/token.txt diff --git a/infra/vm02179/configuration.nix b/infra/vm02179/configuration.nix new file mode 100644 index 0000000..89c1e76 --- /dev/null +++ b/infra/vm02179/configuration.nix @@ -0,0 +1,210 @@ + +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ./gitea-runner.nix + ./hardware-configuration.nix + ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking = { + hostName = "vm02179"; + domain = "procolix.com"; + interfaces = { + eth0 = { + ipv4 = { + addresses = [ + { + address = "185.206.232.179"; + prefixLength = 24; + } + ]; + }; + ipv6 = { + addresses = [ + { + address = "2a00:51c0:12:1201::179"; + prefixLength = 64; + } + ]; + }; + }; + }; + defaultGateway = { + address = "185.206.232.1"; + interface = "eth0"; + }; + defaultGateway6 = { + address = "2a00:51c0:12:1201::1"; + interface = "eth0"; + }; + nameservers = [ "95.215.185.6" "95.215.185.7" ]; + firewall.enable = false; + nftables = { + enable = true; + ruleset = '' + #!/usr/sbin/nft -f + + flush ruleset + + ########### define usefull variables here ##################### + define wan = eth0 + define ssh_allow = { + 83.161.147.127/32, # host801 ipv4 + 95.215.185.92/32, # host088 ipv4 + 95.215.185.211/32, # host089 ipv4 + 95.215.185.34/32, # nagios2 ipv4 + 95.215.185.181/32, # ansible.procolix.com + 95.215.185.235, # ansible-hq + } + define snmp_allow = { + 95.215.185.31/32, # cacti ipv4 + } + define nrpe_allow = { + 95.215.185.34/32, # nagios2 ipv4 + } + + ########### here starts the automated bit ##################### + table inet filter { + chain input { + type filter hook input priority 0; + policy drop; + + # established/related connections + ct state established,related accept + ct state invalid drop + + # Limit ping requests. + ip protocol icmp icmp type echo-request limit rate over 10/second burst 50 packets drop + ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 50 packets drop + + # loopback interface + iifname lo accept + + # icmp + ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, source-quench, time-exceeded } accept + # Without the nd-* ones ipv6 will not work. + ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert, packet-too-big, parameter-problem, time-exceeded } accept + + # open tcp ports: sshd (22) + tcp dport {ssh} accept + + # open tcp ports: snmp (161) + ip saddr $snmp_allow udp dport {snmp} accept + + # open tcp ports: nrpe (5666) + ip saddr $nrpe_allow tcp dport {nrpe} accept + + # open tcp ports: http (80,443) + tcp dport {http,https} accept + } + chain forward { + type filter hook forward priority 0; + } + chain output { + type filter hook output priority 0; + } + } + + table ip nat { + chain postrouting { + } + chain prerouting { + } + } + ''; + }; + }; + + + # Set your time zone. + time.timeZone = "Europe/Amsterdam"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.root = { + hashedPassword = "$y$j9T$WXvLAUqArJJusuC017FCW0$.rfMOeyx/BsClkJFi5hLcynrSk.njWmfiB6Uy.9th3A"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY" + ]; + }; + + users.users.procolix = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + hashedPassword = "$y$j9T$UH8Dh/poTCCZ3PXk43au6/$iYen8VUEVvv7SIPqteNtTPKktLxny3TbqvjUwhvi.6B"; + openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAotfCIjLoDlHOe+++kVS1xiBPaS8mC5FypgrxDrDVst6SHxMTca2+IScMajzUZajenvNAoZOwIsyAPacT8OHeyFvV5Y7G874Qa+cZVqJxLht9gdXxr1GNabU3RfhhCh272dUeIKIqfgsRsM2HzdnZCMDavS1Yo+f+RhhHhnJIua+NdVFo21vPrpsz+Cd0M1NhojARLajrTHvEXW0KskUnkbfgxT0vL9jeRZxdgMS+a9ZoR5dbzOxQHWfbP8N04Xc+7CweMlvKwlWuAE/xDb5XLNHorfGWFvZuVhptJN8jPaaVS25wsmsF5IbaAuSZfzCtBdFQhIloUhy0L6ZisubHjQ== procolix@sshnode1" + "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuT3C0f3nyQ7SwUvXcFmEYEgwL+crY6iK0Bhoi9yfn4soz3fhfMKyKSwc/0RIlRnrz3xnkyJiV0vFeU7AC1ixbGCS3T9uc0G1x0Yedd9n2yR8ZJmkdyfjZ5KE4YvqZ3f6UZn5Mtj+7tGmyp+ee+clLSHzsqeyDiX0FIgFmqiiAVJD6qeKPFAHeWz9b2MOXIBIw+fSLOpx0rosCgesOmPc8lgFvo+dMKpSlPkCuGLBPj2ObT4sLjc98NC5z8sNJMu3o5bMbiCDR9JWgx9nKj+NlALwk3Y/nzHSL/DNcnP5vz2zbX2CBKjx6ju0IXh6YKlJJVyMsH9QjwYkgDQVmy8amQ== procolix@sshnode2" + ]; + packages = with pkgs; [ + ]; + }; + + users.users.niols = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + hashedPassword = "$y$j9T$zZZ/XQ68cGr6GTIQqSnsh/$I9UEl9JLxq8kWZbVOp.WqUxfcNmrSVMBGSwGalIJ/Z/"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY niols@wallace" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBkQXv/VRZLfV0wNN9PHedmKWyAIfpPUCdaznHZNIDkS niols@orianne/fediversity" + ]; + packages = with pkgs; [ + ]; + }; + + nix = { + settings.trusted-users = [ "@wheel" ]; + }; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + (pkgs.vim_configurable.customize { + name = "vim"; + vimrcConfig.packages.myplugins = with pkgs.vimPlugins; { + start = [ vim-nix ]; # load plugin on startup + }; + vimrcConfig.customRC = '' + " your custom vimrc + set nocompatible + set backspace=indent,eol,start + " Turn on syntax highlighting by default + syntax on + " ... + ''; + }) + wget + ]; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + system.copySystemConfiguration = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.05"; # Did you read the comment? + +} + diff --git a/infra/vm02179/gitea-runner.nix b/infra/vm02179/gitea-runner.nix new file mode 100644 index 0000000..b0c2d54 --- /dev/null +++ b/infra/vm02179/gitea-runner.nix @@ -0,0 +1,37 @@ +{ pkgs, config, ... }: { + + virtualisation.docker.enable = true; + + services.gitea-actions-runner = { + package = pkgs.forgejo-actions-runner; + instances.default = { + enable = true; + name = "vm02179.procolix.com"; + url = "https://git.fediversity.eu"; + # Obtaining the path to the runner token file may differ + token = "MKmFPY4nxfR4zPYHIRLoiJdrrfkGmcRymj0GWOAk"; + labels = [ + "docker:docker://node:16-bullseye" + "native:host" + ]; + hostPackages = with pkgs; [ bash git nix nodejs ]; + settings = { + log.level = "info"; + runner = { + file = ".runner"; + capacity = 8; + timeout = "3h"; + insecure = false; + fetch_timeout = "5s"; + fetch_interval = "2s"; + }; + }; + }; + }; + + ## The Nix configuration of the system influences the Nix configuration + ## in the workflow, and our workflows are often flake-based. + nix.extraOptions = '' + experimental-features = nix-command flakes + ''; +} diff --git a/infra/vm02179/hardware-configuration.nix b/infra/vm02179/hardware-configuration.nix new file mode 100644 index 0000000..94f68e1 --- /dev/null +++ b/infra/vm02179/hardware-configuration.nix @@ -0,0 +1,37 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/119863f8-55cf-4e2f-ac17-27599a63f241"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/D9F4-9BF0"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.ens18.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/infra/vm02179/token.txt b/infra/vm02179/token.txt new file mode 100644 index 0000000..680567c --- /dev/null +++ b/infra/vm02179/token.txt @@ -0,0 +1 @@ +MKmFPY4nxfR4zPYHIRLoiJdrrfkGmcRymj0GWOAk From 40ec7e9c8cc11f747861cfee66635e6bdc2b4b05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Sun, 17 Nov 2024 01:02:23 +0100 Subject: [PATCH 3/7] Make a NixOps4 deployment for action runners --- flake.nix | 1 + infra/flake-part.nix | 47 +++++++++++++++++++++++++++++++++ infra/vm02179/configuration.nix | 11 -------- infra/vm02186/flake.nix | 24 ----------------- 4 files changed, 48 insertions(+), 35 deletions(-) create mode 100644 infra/flake-part.nix delete mode 100644 infra/vm02186/flake.nix diff --git a/flake.nix b/flake.nix index 59a40fc..279345a 100644 --- a/flake.nix +++ b/flake.nix @@ -25,6 +25,7 @@ inputs.nixops4-nixos.modules.flake.default ./deployment/flake-part.nix + ./infra/flake-part.nix ./services/flake-part.nix ]; diff --git a/infra/flake-part.nix b/infra/flake-part.nix new file mode 100644 index 0000000..8b32f1c --- /dev/null +++ b/infra/flake-part.nix @@ -0,0 +1,47 @@ +{ inputs, self, ... }: + +{ + nixops4Deployments.actions-runners = + { providers, ... }: + { + providers.local = inputs.nixops4-nixos.modules.nixops4Provider.local; + + resources = { + vm02179 = { + type = providers.local.exec; + imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ]; + ssh = { + host = "185.206.232.179"; + opts = ""; + hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAsOCOsJ0vNL9fGj0XC25ir8B+k2NlVJzsiVUx+0eWM"; + }; + nixpkgs = inputs.nixpkgs; + nixos.module = { + imports = [ + ./vm02179/configuration.nix + ./vm02186/hardware-configuration.nix + ./vm02179/gitea-runner.nix + ]; + }; + }; + + vm02186 = { + type = providers.local.exec; + imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ]; + ssh = { + host = "185.206.232.186"; + opts = ""; + hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII6mnBgEeyYE4tzHeFNHVNBV6KR+hAqh3PYSqlh0QViW"; + }; + nixpkgs = inputs.nixpkgs; + nixos.module = { + imports = [ + ./vm02186/procolix-configuration.nix + ./vm02186/hardware-configuration.nix + ./vm02186/gitea-runner.nix + ]; + }; + }; + }; + }; +} diff --git a/infra/vm02179/configuration.nix b/infra/vm02179/configuration.nix index 89c1e76..3856086 100644 --- a/infra/vm02179/configuration.nix +++ b/infra/vm02179/configuration.nix @@ -6,12 +6,6 @@ { config, pkgs, ... }: { - imports = - [ # Include the results of the hardware scan. - ./gitea-runner.nix - ./hardware-configuration.nix - ]; - # Use the systemd-boot EFI boot loader. boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; @@ -193,11 +187,6 @@ # Enable the OpenSSH daemon. services.openssh.enable = true; - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - system.copySystemConfiguration = true; - # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave diff --git a/infra/vm02186/flake.nix b/infra/vm02186/flake.nix deleted file mode 100644 index 178f7f6..0000000 --- a/infra/vm02186/flake.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ - inputs = { - nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05"; - snf.url = "git+https://git.fediversity.eu/fediversity/simple-nixos-fediverse.git"; - }; - - outputs = { self, nixpkgs, snf }: - let - vmName = "vm02186"; - - in { - nixosConfigurations.${vmName} = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - - modules = [ - ./procolix-configuration.nix - ./hardware-configuration.nix - ./gitea-runner.nix - ]; - }; - - isoInstallers.${vmName} = snf.mkInstaller nixpkgs self.nixosConfigurations.${vmName}; - }; -} From 69cad1592ecb60071a2b476e1581207ee8efa8d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Sun, 17 Nov 2024 01:03:07 +0100 Subject: [PATCH 4/7] =?UTF-8?q?Rename=20=E2=80=9Cdefault=E2=80=9D=20NixOps?= =?UTF-8?q?4=20deployment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deployment/flake-part.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/flake-part.nix b/deployment/flake-part.nix index 22158ee..2d6626d 100644 --- a/deployment/flake-part.nix +++ b/deployment/flake-part.nix @@ -52,7 +52,7 @@ in } ) self.nixosConfigurations.provisioning; - nixops4Deployments.default = + nixops4Deployments.feditest = { providers, ... }: let From f9f096cff8056c08c9f73eb72f4510e8dbe6e409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 18 Nov 2024 09:51:31 +0100 Subject: [PATCH 5/7] Ooops --- infra/flake-part.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/flake-part.nix b/infra/flake-part.nix index 8b32f1c..8b628e4 100644 --- a/infra/flake-part.nix +++ b/infra/flake-part.nix @@ -19,7 +19,7 @@ nixos.module = { imports = [ ./vm02179/configuration.nix - ./vm02186/hardware-configuration.nix + ./vm02179/hardware-configuration.nix ./vm02179/gitea-runner.nix ]; }; From ae90b3e362fb581721c60a5becddc57689b0bf6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 18 Nov 2024 09:56:32 +0100 Subject: [PATCH 6/7] Add Valentin's SSH keys --- infra/vm02179/configuration.nix | 1 + infra/vm02186/procolix-configuration.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/infra/vm02179/configuration.nix b/infra/vm02179/configuration.nix index 3856086..f3a6b9c 100644 --- a/infra/vm02179/configuration.nix +++ b/infra/vm02179/configuration.nix @@ -131,6 +131,7 @@ hashedPassword = "$y$j9T$WXvLAUqArJJusuC017FCW0$.rfMOeyx/BsClkJFi5hLcynrSk.njWmfiB6Uy.9th3A"; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg" ]; }; diff --git a/infra/vm02186/procolix-configuration.nix b/infra/vm02186/procolix-configuration.nix index 30d8427..a1be544 100644 --- a/infra/vm02186/procolix-configuration.nix +++ b/infra/vm02186/procolix-configuration.nix @@ -126,6 +126,7 @@ hashedPassword = "$y$j9T$WXvLAUqArJJusuC017FCW0$.rfMOeyx/BsClkJFi5hLcynrSk.njWmfiB6Uy.9th3A"; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJg5TlS1NGCRZwMjDgBkXeFUXqooqRlM8fJdBAQ4buPg" ]; }; From e300ff517daaf87088e89f48c10c911a2bb50a70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 18 Nov 2024 11:28:02 +0100 Subject: [PATCH 7/7] Small description of the `infra/` subdirectory --- infra/README.org | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 infra/README.org diff --git a/infra/README.org b/infra/README.org new file mode 100644 index 0000000..2998682 --- /dev/null +++ b/infra/README.org @@ -0,0 +1,25 @@ +#+title: Infra + +This directory contains the definition of the VMs that host our infrastructure. +Their configuration can be updated via NixOps4. Run + +#+begin_src sh +nixops4 deployments list +#+end_src + +to see the available deployments. Given a deployment (eg. ~actions-runners~), run + +#+begin_src sh +nixops4 apply +#+end_src + +* Procolix machines + +These machines are hosted on the Procolix Proxmox instance, to which +non-Procolix members of the project do not have access. They host our stable +infrastructure. + +| Machine | Description | Deployment | +|---------+------------------------+-----------------| +| vm02179 | Forgejo actions runner | actions-runners | +| vm02186 | Forgejo actions runner | actions-runners |