Compare commits
No commits in common. "master" and "development" have entirely different histories.
master
...
developmen
13 changed files with 46 additions and 963 deletions
92
flake.lock
generated
92
flake.lock
generated
|
|
@ -170,11 +170,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1738453229,
|
||||
"narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
|
||||
"lastModified": 1736143030,
|
||||
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
|
||||
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -351,11 +351,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739757849,
|
||||
"narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
|
||||
"lastModified": 1736373539,
|
||||
"narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
|
||||
"rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -373,11 +373,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739570999,
|
||||
"narHash": "sha256-eCc0/Q4bPpe4/AS+uzIrHLJcR6BxPQ69q2kD0/Qe6rU=",
|
||||
"lastModified": 1736373539,
|
||||
"narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "254d47082e23dbf72fdeca1da6fe1da420f478d8",
|
||||
"rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -480,11 +480,11 @@
|
|||
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739709805,
|
||||
"narHash": "sha256-8/OuhPELneYOtncScsPrAwmlzBNSAFotoTKd6JxU6OA=",
|
||||
"lastModified": 1737481937,
|
||||
"narHash": "sha256-FJ0ATgYWavH3ZeA0ofTEMS+22HqYN2Lqu3G6IsqbKIg=",
|
||||
"owner": "fort-nix",
|
||||
"repo": "nix-bitcoin",
|
||||
"rev": "bff10a66e50f6a3387b3e5acbbdf2519c624e8bc",
|
||||
"rev": "dc4d14e07324e43b8773e3eb5eb2a10c6b469287",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -521,11 +521,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739553546,
|
||||
"narHash": "sha256-L4ou3xfOr17EAe836djRoQ7auVkYOREMtiQa82wVGqU=",
|
||||
"lastModified": 1737421067,
|
||||
"narHash": "sha256-/hgw8fDKDpko0XqOw1e9tX8lS2Hqecg7W/JsONun6Qc=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "353846417f985e74fdc060555f17939e4472ea2c",
|
||||
"rev": "cae8d1c4a3bd37be5887203fe3b0c3a860c53a07",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -559,11 +559,11 @@
|
|||
},
|
||||
"nix-secrets": {
|
||||
"locked": {
|
||||
"lastModified": 1740164526,
|
||||
"narHash": "sha256-lpKNY9qLoIT1XbLzeY+tmkV1DjQQ3mWYWjko+necYhM=",
|
||||
"lastModified": 1737899664,
|
||||
"narHash": "sha256-iZpzTSERNQ5UvFfEzrBLuEmcRUGjBSal7ShtXurYq8Q=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "ddf31a3a72504f36577ec341fbc84aa8f3dd3318",
|
||||
"revCount": 283,
|
||||
"rev": "a9844a78dcbdc8a84679835112970d80822b113c",
|
||||
"revCount": 257,
|
||||
"type": "git",
|
||||
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
|
||||
},
|
||||
|
|
@ -605,11 +605,11 @@
|
|||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1739451785,
|
||||
"narHash": "sha256-3ebRdThRic9bHMuNi2IAA/ek9b32bsy8F5R4SvGTIog=",
|
||||
"lastModified": 1737370608,
|
||||
"narHash": "sha256-hFA6SmioeqvGW/XvZa9bxniAeulksCOcj3kokdNT/YE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "1128e89fd5e11bb25aedbfc287733c6502202ea9",
|
||||
"rev": "300081d0cc72df578b02d914df941b8ec62240e6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -621,11 +621,11 @@
|
|||
},
|
||||
"nixpkgs-unstable_2": {
|
||||
"locked": {
|
||||
"lastModified": 1739866667,
|
||||
"narHash": "sha256-EO1ygNKZlsAC9avfcwHkKGMsmipUk1Uc0TbrEZpkn64=",
|
||||
"lastModified": 1737746512,
|
||||
"narHash": "sha256-nU6AezEX4EuahTO1YopzueAXfjFfmCHylYEFCagduHU=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "73cf49b8ad837ade2de76f87eb53fc85ed5d4680",
|
||||
"rev": "825479c345a7f806485b7f00dbe3abb50641b083",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -653,11 +653,11 @@
|
|||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1740162160,
|
||||
"narHash": "sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM=",
|
||||
"lastModified": 1737893696,
|
||||
"narHash": "sha256-FV16HsdY2KY/6ixpizYH+SVuLdDCa5WvJVHglMtvQ74=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "11415c7ae8539d6292f2928317ee7a8410b28bb9",
|
||||
"rev": "7db27bab4129d44b0433dd45fa9a30f7a0795db3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -669,11 +669,11 @@
|
|||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1739866667,
|
||||
"narHash": "sha256-EO1ygNKZlsAC9avfcwHkKGMsmipUk1Uc0TbrEZpkn64=",
|
||||
"lastModified": 1737746512,
|
||||
"narHash": "sha256-nU6AezEX4EuahTO1YopzueAXfjFfmCHylYEFCagduHU=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "73cf49b8ad837ade2de76f87eb53fc85ed5d4680",
|
||||
"rev": "825479c345a7f806485b7f00dbe3abb50641b083",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -698,11 +698,11 @@
|
|||
"treefmt-nix": "treefmt-nix_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739623149,
|
||||
"narHash": "sha256-9hyreNdQtQaFzWAx38CHiKHFQ8vAc/J2/kXeT7Nwy6s=",
|
||||
"lastModified": 1737731711,
|
||||
"narHash": "sha256-6ubhKkCkBMuqFMjzeg+/2L5dNipKKf1KE9i8r8inyEg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "6b2c62b91a10a773e705f55e8b34a19c8b1f3728",
|
||||
"rev": "841155edf9c4578f2f9a7bd6993e1da2ce73b35c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -719,11 +719,11 @@
|
|||
"treefmt-nix": "treefmt-nix_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1740190061,
|
||||
"narHash": "sha256-hhOK+U42wxh5PQr3GUdNR6i/xgjv6e+dq+AefaleGu4=",
|
||||
"lastModified": 1737896356,
|
||||
"narHash": "sha256-JVZPYiBjllZqFjb6mmmdEQDmAkZCbXSNjOGRJWO52PA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "c730bf6c124d3bbb66ee6aac920d5ad7f0e15759",
|
||||
"rev": "5ee047c2c9ca4400689d913843351c2c7e4f56fb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -742,11 +742,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1738508923,
|
||||
"narHash": "sha256-4DaDrQDAIxlWhTjH6h/+xfG05jt3qDZrZE/7zDLQaS4=",
|
||||
"lastModified": 1737372689,
|
||||
"narHash": "sha256-nH3zK2ki0fd5o5qvbGHxukE4qnOLJa1uCzoDObG5vrE=",
|
||||
"owner": "NuschtOS",
|
||||
"repo": "search",
|
||||
"rev": "86e2038290859006e05ca7201425ea5b5de4aecb",
|
||||
"rev": "570cc17bbc25650eb7d69e4fcda8cfd2f1656922",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -805,11 +805,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739262228,
|
||||
"narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
|
||||
"lastModified": 1737411508,
|
||||
"narHash": "sha256-j9IdflJwRtqo9WpM0OfAZml47eBblUHGNQTe62OUqTw=",
|
||||
"owner": "mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
|
||||
"rev": "015d461c16678fc02a2f405eb453abb509d4e1d4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -907,11 +907,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1738953846,
|
||||
"narHash": "sha256-yrK3Hjcr8F7qS/j2F+r7C7o010eVWWlm4T1PrbKBOxQ=",
|
||||
"lastModified": 1737483750,
|
||||
"narHash": "sha256-5An1wq5U8sNycOBBg3nsDDgpwBmR9liOpDGlhliA6Xo=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "4f09b473c936d41582dd744e19f34ec27592c5fd",
|
||||
"rev": "f2cc121df15418d028a59c9737d38e3a90fbaf8f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
|
|
@ -30,27 +30,10 @@ in {
|
|||
../common/optional/openssh.nix
|
||||
|
||||
../common/optional/distributed-builds/local-machine.nix
|
||||
# ../common/optional/nixos-containers/semitamaps.nix
|
||||
# ../common/optional/nixos-containers/vaultwarden.nix
|
||||
# ../common/optional/nixos-containers/xmpp.nix
|
||||
|
||||
../common/optional/fail2ban.nix
|
||||
../common/optional/restic-backup.nix
|
||||
../common/optional/forgejo.nix
|
||||
|
||||
outputs.nixosModules.nixosAutoUpgrade
|
||||
];
|
||||
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
paths = [
|
||||
"/persist/"
|
||||
];
|
||||
exclude = [
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
efi.canTouchEfiVariables = false;
|
||||
|
|
@ -79,15 +62,6 @@ in {
|
|||
user = "admin";
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
directories = [
|
||||
"/var/lib/tailscale"
|
||||
];
|
||||
};
|
||||
|
||||
# enable tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
networking = {
|
||||
hostName = "cloudnix";
|
||||
nameservers = ["8.8.8.8"];
|
||||
|
|
|
|||
|
|
@ -1,34 +0,0 @@
|
|||
{pkgs, ...}: {
|
||||
|
||||
environment.systemPackages = [pkgs.fail2ban];
|
||||
|
||||
environment.etc = {
|
||||
"fail2ban/filter.d/nginx-bruteforce.conf".text = ''
|
||||
[Definition]
|
||||
failregex = ^<HOST>.*(GET|POST).* (404|444|403|400) .*$
|
||||
'';
|
||||
};
|
||||
|
||||
services.fail2ban = {
|
||||
enable = true;
|
||||
maxretry = 5;
|
||||
ignoreIP = [
|
||||
];
|
||||
bantime-increment = {
|
||||
enable = true;
|
||||
multipliers = "1 2 4 8 16 32 64";
|
||||
maxtime = "168h";
|
||||
};
|
||||
jails = {
|
||||
nginx-spam.settings = {
|
||||
filter = "nginx-bruteforce";
|
||||
action = "iptables-allports";
|
||||
logpath = "/var/log/nginx/access.log";
|
||||
backend = "auto";
|
||||
findtime = 600;
|
||||
bantime = 600;
|
||||
maxretry = 10;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
configVars,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
forgejoDomain = configVars.domains.forgejo;
|
||||
forgejoPort = configVars.networking.addresses.forgejo.port;
|
||||
in {
|
||||
|
||||
imports = [./nginx/forgejo.nix];
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/forgejo"
|
||||
];
|
||||
};
|
||||
|
||||
users.groups.git = {
|
||||
gid = 1009;
|
||||
};
|
||||
|
||||
users.users.git = {
|
||||
isNormalUser = true;
|
||||
home = "/var/lib/forgejo";
|
||||
uid = 1009;
|
||||
extraGroups = ["git"];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
authorizedKeysFiles = lib.mkForce [ "/var/lib/forgejo/.ssh/authorized_keys" ];
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
package = pkgs.forgejo;
|
||||
database.type = "sqlite3";
|
||||
lfs.enable = true;
|
||||
user = "git";
|
||||
group = "git";
|
||||
settings = {
|
||||
server = {
|
||||
RUN_USER = "git";
|
||||
DOMAIN = "git.${forgejoDomain}";
|
||||
ROOT_URL = "https://git.${forgejoDomain}/";
|
||||
HTTP_PORT = forgejoPort;
|
||||
SSH_USER = "git";
|
||||
};
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
{configVars, ...}: let
|
||||
email = configVars.email.user;
|
||||
domain = configVars.domains.forgejo;
|
||||
forgejoIp = configVars.networking.addresses.forgejo.localAddress;
|
||||
forgejoPort = configVars.networking.addresses.forgejo.port;
|
||||
in {
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = email;
|
||||
};
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts."git.${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 1024M;
|
||||
'';
|
||||
locations."/" = {
|
||||
proxyPass = "http://${forgejoIp}:${toString forgejoPort}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
{configVars, ...}: let
|
||||
email = configVars.email.user;
|
||||
domain = configVars.domains.xmpp;
|
||||
in {
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = email;
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts."${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
root = "/srv/hello/";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
{configVars, ...}: let
|
||||
email = configVars.email.user;
|
||||
domain = configVars.domains.vaultwarden;
|
||||
vaultwardenIp = configVars.networking.addresses.vaultwarden.localAddress;
|
||||
vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
|
||||
in {
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = email;
|
||||
};
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts."password.${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${vaultwardenIp}:${toString vaultwardenPort}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,92 +0,0 @@
|
|||
{configVars, ...}: let
|
||||
email = configVars.email.user;
|
||||
xmppDomain = configVars.domains.xmpp;
|
||||
xmppIp = configVars.networking.addresses.xmpp.localAddress;
|
||||
xmppPort = configVars.networking.addresses.xmpp.ports.xmpp-http;
|
||||
in {
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
users.groups.www-data = {
|
||||
gid = 33;
|
||||
};
|
||||
|
||||
users.users.nginx = {
|
||||
isSystemUser = true;
|
||||
uid = 60;
|
||||
extraGroups = ["www-data"];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/www/${xmppDomain} 0777 root root"
|
||||
];
|
||||
|
||||
services.httpd.virtualHosts."root" = {
|
||||
hostName = "${xmppDomain}";
|
||||
documentRoot = "/var/www/${xmppDomain}";
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = email;
|
||||
certs = {
|
||||
"${xmppDomain}" = {
|
||||
webroot = "/var/www/${xmppDomain}";
|
||||
email = email;
|
||||
extraDomainNames = [
|
||||
"chat.${xmppDomain}"
|
||||
];
|
||||
group = "www-data";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts."chat.${xmppDomain}" = {
|
||||
# enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 10G;
|
||||
'';
|
||||
sslCertificate = "/var/lib/acme/${xmppDomain}/fullchain.pem";
|
||||
sslCertificateKey = "/var/lib/acme/${xmppDomain}/key.pem";
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://${xmppIp}:${toString xmppPort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host "${xmppDomain}";
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering off;
|
||||
tcp_nodelay on;
|
||||
'';
|
||||
};
|
||||
"/xmpp-websocket" = {
|
||||
proxyPass = "http://${xmppIp}:${toString xmppPort}/xmpp-websocket";
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
|
||||
proxy_set_header Host "${xmppDomain}";
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 900s;
|
||||
'';
|
||||
};
|
||||
"/upload/" = {
|
||||
extraConfig = ''
|
||||
proxy_buffering off;
|
||||
proxy_set_header Host $host;
|
||||
# pass PUT requests to mod_http_upload for processing
|
||||
if ($request_method = PUT) {
|
||||
proxy_pass http://${xmppIp}:${toString xmppPort};
|
||||
}
|
||||
alias /var/lib/prosody/http_upload; # storage path of mod_http_upload. NGINX will serve these files to the clients.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,119 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
configVars,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
containerName = "forgejo";
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
hostAddress = configVars.networking.addresses.forgejo.hostAddress;
|
||||
localAddress = configVars.networking.addresses.forgejo.localAddress;
|
||||
forgejoPort = configVars.networking.addresses.forgejo.port;
|
||||
forgejoDomain = configVars.domains.forgejo;
|
||||
cloudnixIp = configVars.networking.addresses.cloudnix.ip;
|
||||
sops-nix = inputs.sops-nix;
|
||||
in {
|
||||
networking = {
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = ["ve-+"];
|
||||
externalInterface = "enp1s0";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/nixos-containers/${containerName}"
|
||||
];
|
||||
};
|
||||
imports = [../nginx/forgejo.nix];
|
||||
|
||||
containers."${containerName}" = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = hostAddress;
|
||||
localAddress = localAddress;
|
||||
nixpkgs = pkgs.path;
|
||||
bindMounts = {
|
||||
"/etc/ssh/ssh_host_ed25519_key" = {
|
||||
hostPath = "/etc/ssh/ssh_host_ed25519_key";
|
||||
isReadOnly = true;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
secretsDirectory = builtins.toString inputs.nix-secrets;
|
||||
secretsFile = "${secretsDirectory}/secrets.yaml";
|
||||
in {
|
||||
networking = {
|
||||
defaultGateway = cloudnixIp;
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
forgejoPort
|
||||
];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = "${secretsFile}";
|
||||
validateSopsFiles = false;
|
||||
|
||||
age = {
|
||||
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.vim
|
||||
pkgs.git
|
||||
pkgs.lsof
|
||||
];
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
package = pkgs.forgejo;
|
||||
database.type = "sqlite3";
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.${forgejoDomain}";
|
||||
ROOT_URL = "https://git.${forgejoDomain}/";
|
||||
HTTP_PORT = forgejoPort;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
configVars,
|
||||
...
|
||||
}: let
|
||||
containerName = "semitamaps";
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
hostAddress = configVars.networking.addresses.semitamaps.hostAddress;
|
||||
localAddress = configVars.networking.addresses.semitamaps.localAddress;
|
||||
workingDirectory = "/var/www/semitamaps";
|
||||
in {
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/run/sockets 0660 www-data www-data -"
|
||||
];
|
||||
|
||||
networking = {
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = ["ve-+"];
|
||||
externalInterface = "enp1s0";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/nixos-containers/${containerName}"
|
||||
];
|
||||
};
|
||||
|
||||
imports = [
|
||||
../nginx/semitamaps.nix
|
||||
];
|
||||
|
||||
containers."${containerName}" = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = hostAddress;
|
||||
localAddress = localAddress;
|
||||
nixpkgs = pkgs.path;
|
||||
bindMounts = {
|
||||
"/etc/ssh/ssh_host_ed25519_key" = {
|
||||
hostPath = "/etc/ssh/ssh_host_ed25519_key";
|
||||
isReadOnly = true;
|
||||
};
|
||||
"/var/run/sockets" = {
|
||||
hostPath = "/var/run/sockets";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
rejectPackets = true;
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${workingDirectory} 0750 www-data www-data"
|
||||
"d ${workingDirectory}/.venv 0750 www-data www-data"
|
||||
"d ${workingDirectory}/public/uploads 0775 www-data www-data"
|
||||
];
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.vim
|
||||
pkgs.git
|
||||
];
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
systemd.services.semitamaps = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network.target"];
|
||||
description = "Deploys and serves semitamaps";
|
||||
environment = {
|
||||
};
|
||||
serviceConfig = {
|
||||
WorkingDirectory = "${workingDirectory}";
|
||||
ExecStartPre = pkgs.writeShellScript "semitamaps-prestart" ''
|
||||
set -e
|
||||
|
||||
GITCMD="${pkgs.openssh}/bin/ssh -i /etc/ssh/ssh_host_ed25519_key"
|
||||
if [ ! -d ${workingDirectory}/.git ]; then
|
||||
export GIT_SSH_COMMAND=$GITCMD
|
||||
${pkgs.git}/bin/git clone git@git.bitlab21.com:sam/semitamaps.com.git ${workingDirectory}
|
||||
fi
|
||||
${pkgs.poetry}/bin/poetry install
|
||||
'';
|
||||
ExecStart = pkgs.writeShellScript "semitamaps-start" ''
|
||||
.venv/bin/python .venv/bin/uvicorn --workers 4 --uds /var/run/sockets/semitamaps.sock app:app
|
||||
'';
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
|
||||
programs.ssh.knownHosts = {
|
||||
"git.bitlab21.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALNd2BGf64heYjWT9yt0fVmngepiHRIMsL7au/MRteg";
|
||||
};
|
||||
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,110 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
configVars,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
containerName = "vaultwarden";
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
hostAddress = configVars.networking.addresses.vaultwarden.hostAddress;
|
||||
localAddress = configVars.networking.addresses.vaultwarden.localAddress;
|
||||
vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
|
||||
cloudnixIp = configVars.networking.addresses.cloudnix.ip;
|
||||
sops-nix = inputs.sops-nix;
|
||||
in {
|
||||
networking = {
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = ["ve-+"];
|
||||
externalInterface = "enp1s0";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/nixos-containers/${containerName}"
|
||||
];
|
||||
};
|
||||
|
||||
imports = [../nginx/vaultwarden.nix];
|
||||
|
||||
containers."${containerName}" = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = hostAddress;
|
||||
localAddress = localAddress;
|
||||
nixpkgs = pkgs.path;
|
||||
bindMounts = {
|
||||
"/etc/ssh/ssh_host_ed25519_key" = {
|
||||
hostPath = "/etc/ssh/ssh_host_ed25519_key";
|
||||
isReadOnly = true;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
secretsDirectory = builtins.toString inputs.nix-secrets;
|
||||
secretsFile = "${secretsDirectory}/secrets.yaml";
|
||||
in {
|
||||
networking = {
|
||||
defaultGateway = cloudnixIp;
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
vaultwardenPort
|
||||
];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = "${secretsFile}";
|
||||
validateSopsFiles = false;
|
||||
|
||||
age = {
|
||||
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.vim
|
||||
pkgs.git
|
||||
pkgs.lsof
|
||||
];
|
||||
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
config = {
|
||||
ROCKET_ADDRESS = "0.0.0.0";
|
||||
ROCKET_PORT = vaultwardenPort;
|
||||
ROCKET_LOG = "critical";
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,281 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
configVars,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
containerName = "xmpp";
|
||||
xmppDomain = configVars.domains.xmpp;
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
hostAddress = configVars.networking.addresses.xmpp.hostAddress;
|
||||
externalIp = configVars.networking.addresses.cloudnix.ip;
|
||||
localAddress = configVars.networking.addresses.xmpp.localAddress;
|
||||
sops-nix = inputs.sops-nix;
|
||||
xmppPorts = configVars.networking.addresses.xmpp.ports;
|
||||
xmppUDPPorts =
|
||||
[
|
||||
xmppPorts.coturn
|
||||
xmppPorts.coturn-tls
|
||||
]
|
||||
++ lib.range xmppPorts.coturn-min-udp xmppPorts.coturn-max-udp;
|
||||
xmppTCPPorts = [
|
||||
xmppPorts.coturn
|
||||
xmppPorts.coturn-tls
|
||||
xmppPorts.xmpp-https
|
||||
xmppPorts.xmpp-http
|
||||
xmppPorts.xmpp-s2s
|
||||
xmppPorts.xmpp-c2s
|
||||
xmppPorts.xmpp-c2s-legacy-tls
|
||||
xmppPorts.xmpp-s2s-tls
|
||||
];
|
||||
in {
|
||||
networking = {
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = ["ve-+"];
|
||||
externalInterface = "enp1s0";
|
||||
};
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = xmppTCPPorts;
|
||||
allowedUDPPorts = xmppUDPPorts;
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
../nginx/xmpp.nix
|
||||
];
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/nixos-containers/${containerName}"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/prosody 0750"
|
||||
];
|
||||
|
||||
containers."${containerName}" = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = hostAddress;
|
||||
localAddress = localAddress;
|
||||
nixpkgs = pkgs.path;
|
||||
bindMounts = {
|
||||
"/etc/ssh/ssh_host_ed25519_key" = {
|
||||
hostPath = "/etc/ssh/ssh_host_ed25519_key";
|
||||
isReadOnly = true;
|
||||
};
|
||||
"/var/lib/prosody" = {
|
||||
hostPath = "/var/lib/prosody";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/var/lib/acme/${xmppDomain}/" = {
|
||||
hostPath = "/var/lib/acme/${xmppDomain}/";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
forwardPorts =
|
||||
lib.map (port: {
|
||||
protocol = "tcp";
|
||||
containerPort = port;
|
||||
hostPort = port;
|
||||
})
|
||||
xmppTCPPorts
|
||||
++ lib.map (port: {
|
||||
protocol = "udp";
|
||||
containerPort = port;
|
||||
hostPort = port;
|
||||
})
|
||||
xmppUDPPorts;
|
||||
config = {
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
secretsDirectory = builtins.toString inputs.nix-secrets;
|
||||
secretsFile = "${secretsDirectory}/secrets.yaml";
|
||||
in {
|
||||
users.groups.www-data = {
|
||||
gid = 33;
|
||||
};
|
||||
|
||||
users.users.prosody = {
|
||||
isSystemUser = true;
|
||||
uid = 149;
|
||||
extraGroups = ["www-data"];
|
||||
};
|
||||
|
||||
users.users.turnserver = {
|
||||
isSystemUser = true;
|
||||
uid = 249;
|
||||
extraGroups = ["www-data"];
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
rejectPackets = true;
|
||||
allowedTCPPorts = xmppTCPPorts ++ [80 443];
|
||||
allowedUDPPorts = xmppUDPPorts;
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = "${secretsFile}";
|
||||
validateSopsFiles = false;
|
||||
|
||||
age = {
|
||||
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
};
|
||||
secrets = {
|
||||
"software/coturn/static-auth-secret" = {
|
||||
mode = "0644";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.vim
|
||||
pkgs.git
|
||||
pkgs.prosody
|
||||
pkgs.coturn
|
||||
];
|
||||
|
||||
sops.templates."prosody_secrets.lua" = {
|
||||
mode = "444";
|
||||
content = ''
|
||||
turn_external_secret = "${config.sops.placeholder."software/coturn/static-auth-secret"}";
|
||||
'';
|
||||
};
|
||||
|
||||
services.prosody = {
|
||||
enable = true;
|
||||
package = pkgs.prosody.override {
|
||||
withCommunityModules = [
|
||||
"turn_external"
|
||||
"conversejs"
|
||||
"admin_web"
|
||||
"external_services"
|
||||
"http_altconnect"
|
||||
];
|
||||
};
|
||||
extraModules = [
|
||||
"server_contact_info"
|
||||
"http_file_share"
|
||||
"external_services"
|
||||
"turn_external"
|
||||
"conversejs"
|
||||
"admin_web"
|
||||
"http"
|
||||
"websocket"
|
||||
"http_altconnect"
|
||||
];
|
||||
allowRegistration = true;
|
||||
extraConfig = ''
|
||||
Include "${config.sops.templates."prosody_secrets.lua".path}"
|
||||
registration_invite_only = true;
|
||||
allow_user_invites = true;
|
||||
cross_domain_bosh = true;
|
||||
cross_domain_websocket = true;
|
||||
turn_external_host = "turn.${xmppDomain}";
|
||||
turn_external_port = ${toString xmppPorts.coturn};
|
||||
http_default_host = "${xmppDomain}";
|
||||
certificates = "certs"
|
||||
consider_websocket_secure = true
|
||||
external_services = {
|
||||
{
|
||||
port="${toString xmppPorts.coturn}";
|
||||
transport="tcp";
|
||||
type="stun";
|
||||
host="turn.${xmppDomain}"
|
||||
};
|
||||
{
|
||||
port="${toString xmppPorts.coturn}";
|
||||
transport="udp";
|
||||
type="turn";
|
||||
host="turn.${xmppDomain}"
|
||||
};
|
||||
}
|
||||
s2s_direct_tls_ports = { ${toString xmppPorts.xmpp-s2s-tls} }
|
||||
legacy_ssl_ports = { ${toString xmppPorts.xmpp-c2s-legacy-tls} }
|
||||
legacy_ssl_ssl = {
|
||||
certificate = "/var/lib/acme/${xmppDomain}/cert.pem";
|
||||
key = "/var/lib/acme/${xmppDomain}/key.pem";
|
||||
}
|
||||
contact_info = {
|
||||
admin = { "mailto:admin@${xmppDomain}", "xmpp:admin@${xmppDomain}" };
|
||||
}
|
||||
'';
|
||||
modules.bosh = true;
|
||||
s2sRequireEncryption = true;
|
||||
c2sRequireEncryption = true;
|
||||
s2sSecureAuth = false;
|
||||
admins = ["root@${xmppDomain}"];
|
||||
ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
|
||||
ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
|
||||
httpFileShare.domain = "upload.${xmppDomain}";
|
||||
virtualHosts."${xmppDomain}" = {
|
||||
enabled = true;
|
||||
ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
|
||||
ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
|
||||
extraConfig = ''
|
||||
http_external_url = "https://chat.${xmppDomain}/"
|
||||
invites_page = "https://chat.${xmppDomain}/register?t={invite.token}"
|
||||
http_paths = {
|
||||
invites_page = "/invite";
|
||||
invites_register_web = "/register";
|
||||
}
|
||||
disco_items = {
|
||||
{ "upload.${xmppDomain}.com" },
|
||||
{ "rooms.${xmppDomain}.com" },
|
||||
{ "turn.${xmppDomain}.com" },
|
||||
}
|
||||
|
||||
'';
|
||||
domain = "${xmppDomain}";
|
||||
};
|
||||
muc = [
|
||||
{
|
||||
domain = "conference.${xmppDomain}";
|
||||
}
|
||||
];
|
||||
uploadHttp = {
|
||||
domain = "https://upload.${xmppDomain}";
|
||||
uploadFileSizeLimit = "1000000000"; # 1 gb file-size limit
|
||||
uploadExpireAfter = "31557600"; # files deleted after 1 year
|
||||
};
|
||||
};
|
||||
|
||||
services.coturn = {
|
||||
enable = true;
|
||||
realm = "turn.${xmppDomain}";
|
||||
use-auth-secret = true;
|
||||
static-auth-secret-file = config.sops.secrets."software/coturn/static-auth-secret".path;
|
||||
tls-listening-port = xmppPorts.coturn-tls;
|
||||
cert = "/var/lib/acme/${xmppDomain}/cert.pem";
|
||||
pkey = "/var/lib/acme/${xmppDomain}/key.pem";
|
||||
min-port = xmppPorts.coturn-min-udp;
|
||||
max-port = xmppPorts.coturn-max-udp;
|
||||
extraConfig = ''
|
||||
external-ip = ${externalIp}/${localAddress}
|
||||
log = /var/log/turnserver.log
|
||||
verbose
|
||||
'';
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -5,7 +5,6 @@
|
|||
email
|
||||
metrics-server
|
||||
xmpp
|
||||
domains
|
||||
;
|
||||
locations = {
|
||||
mediaDataMountPoint = "/media/media";
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue