Major update for linode and Nebula
* Consolidate Linode into a single file * Convert gitea and matrix to using Nebula connections * Have Linode proxy to Nebula connections instead of Tailscale * Update Acme to use DNS-01 * Update Flake to pull from branch that supports ACME 5.x client
This commit is contained in:
Greg Hellings
Generated
+6
-6
@@ -496,16 +496,16 @@
|
||||
},
|
||||
"nixunstable": {
|
||||
"locked": {
|
||||
"lastModified": 1784356753,
|
||||
"narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
|
||||
"owner": "nixos",
|
||||
"lastModified": 1784700541,
|
||||
"narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
|
||||
"owner": "geri1701",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
|
||||
"rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"owner": "geri1701",
|
||||
"ref": "lego-v5-acme-spike",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
|
||||
@@ -28,7 +28,8 @@
|
||||
nix-hardware.url = "github:nixos/nixos-hardware";
|
||||
nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
|
||||
nixvimunstable.url = "github:nix-community/nixvim/main";
|
||||
nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
#nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
|
||||
nurpkgs.url = "github:nix-community/NUR";
|
||||
vsext.url = "github:nix-community/nix-vscode-extensions";
|
||||
wsl = {
|
||||
|
||||
@@ -1,31 +1,65 @@
|
||||
{
|
||||
pkgs,
|
||||
pkgs',
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
homepage = "127.0.0.1:30080";
|
||||
nextcloudPort = 8080;
|
||||
sshPort = 2222;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./git.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./matrix.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
];
|
||||
|
||||
age.secrets = {
|
||||
acme.file = ../../../secrets/acme.age;
|
||||
nextcloudadmin = {
|
||||
file = ../../../secrets/nextcloudadmin.age;
|
||||
owner = "nextcloud";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
graphviz
|
||||
nix-du
|
||||
pgloader
|
||||
podman-compose
|
||||
pkgs'.upgrade-pg-cluster
|
||||
];
|
||||
|
||||
greg = {
|
||||
backup.jobs = {
|
||||
nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
pre = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-pre";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --on";
|
||||
}
|
||||
);
|
||||
post = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-post";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --off";
|
||||
}
|
||||
);
|
||||
};
|
||||
greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
};
|
||||
};
|
||||
gitea-runner = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
extraLabels = [
|
||||
"vps:host"
|
||||
"blog:host"
|
||||
@@ -37,19 +71,22 @@
|
||||
enable = true;
|
||||
isLighthouse = true;
|
||||
};
|
||||
proxies."immich.thehellings.com" = {
|
||||
genAliases = false;
|
||||
target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
|
||||
ssl = true;
|
||||
};
|
||||
tailscale.enable = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [ "100.88.91.27" ];
|
||||
firewall.allowedTCPPorts = [
|
||||
sshPort
|
||||
80
|
||||
443
|
||||
];
|
||||
hostName = "linode";
|
||||
nameservers = [
|
||||
"10.157.0.2"
|
||||
"100.96.198.104"
|
||||
];
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
@@ -60,10 +97,242 @@
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
dnsPropagationCheck = false;
|
||||
dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
|
||||
email = "greg.hellings@gmail.com";
|
||||
extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
|
||||
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
};
|
||||
certs."thehellings.com" = {
|
||||
dnsProvider = "linode";
|
||||
environmentFile = config.age.secrets.acme.path;
|
||||
extraDomainNames = [
|
||||
"*.thehellings.com"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
|
||||
anubis = {
|
||||
instances = {
|
||||
git = {
|
||||
enable = true;
|
||||
settings = {
|
||||
BIND = "/run/anubis/anubis-git/anubis.sock";
|
||||
COOKIE_DOMAIN = "thehellings.com";
|
||||
SERVE_ROBOTS_TXT = true;
|
||||
SLOG_LEVEL = "DEBUG";
|
||||
TARGET = "http://git.k3s.nebula.thehellings.com";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
haproxy = {
|
||||
enable = true;
|
||||
config = ''
|
||||
global
|
||||
nbthread 4
|
||||
maxconn 80
|
||||
log /dev/log local0
|
||||
|
||||
defaults
|
||||
timeout connect 500s
|
||||
timeout client 500s
|
||||
timeout server 1h
|
||||
|
||||
listen gitsshd
|
||||
bind *:${toString sshPort}
|
||||
timeout client 1h
|
||||
mode tcp
|
||||
server git-isaiah isaiah.nebula.thehellings.com:32222
|
||||
server git-jeremiah jeremiah.nebula.thehellings.com:32222
|
||||
server git-zeke zeke.nebula.thehellings.com:32222
|
||||
|
||||
frontend https
|
||||
bind *:80
|
||||
bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
|
||||
|
||||
http-request redirect scheme https unless { ssl_fc }
|
||||
http-request add-header X-Forwarded-Proto https
|
||||
|
||||
http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
|
||||
|
||||
option http-server-close
|
||||
option http-keep-alive
|
||||
|
||||
#option httplog
|
||||
#declare capture response len 80
|
||||
#http-response capture res.hdr(Location) id 0
|
||||
|
||||
use_backend git if { hdr(host) -i src.thehellings.com }
|
||||
use_backend git if { req_ssl_sni -i src.thehellings.com }
|
||||
use_backend next if { hdr(host) -i next.thehellings.com }
|
||||
use_backend next if { req_ssl_sni -i next.thehellings.com }
|
||||
use_backend matrix if { hdr(host) -i matrix.thehellings.com }
|
||||
use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
|
||||
use_backend web if { hdr(host) -i thehellings.com }
|
||||
use_backend web if { req_ssl_sni -i thehellings.com }
|
||||
|
||||
backend git
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
http-request set-header Host git.k3s.nebula.thehellings.com
|
||||
server git-isaiah isaiah.nebula.thehellings.com:80
|
||||
server git-jeremiah jeremiah.nebula.thehellings.com:80
|
||||
server git-zeke zeke.nebula.thehellings.com:80
|
||||
|
||||
backend matrix
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
http-request set-header Host matrix.k3s.nebula.thehellings.com
|
||||
server git-isaiah isaiah.nebula.thehellings.com:80
|
||||
server git-jeremiah jeremiah.nebula.thehellings.com:80
|
||||
server git-zeke zeke.nebula.thehellings.com:80
|
||||
|
||||
backend web
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
server web-container ${homepage}
|
||||
|
||||
backend next
|
||||
log global
|
||||
mode http
|
||||
balance roundrobin
|
||||
option accept-unsafe-violations-in-http-response
|
||||
retries 3
|
||||
option forwardfor
|
||||
#http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
|
||||
server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
|
||||
'';
|
||||
};
|
||||
|
||||
immich-public-proxy = {
|
||||
enable = true;
|
||||
immichUrl = "https://immich.shire-zebra.ts.net";
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud33;
|
||||
appstoreEnable = true;
|
||||
hostName = "localhost";
|
||||
https = false;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "http";
|
||||
trusted_domains = [ "next.thehellings.com" ];
|
||||
trusted_proxies = [
|
||||
"localhost"
|
||||
"127.0.0.1"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Move to :8080 so that we can run haproxy as the primary HTTP service
|
||||
nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
|
||||
{
|
||||
addr = "127.0.0.1";
|
||||
port = nextcloudPort;
|
||||
}
|
||||
];
|
||||
|
||||
openssh.settings.PasswordAuthentication = false;
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [ "nextcloud" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
haproxy = {
|
||||
after = [
|
||||
"nextcloud.service"
|
||||
"network-online.target"
|
||||
];
|
||||
wants = [
|
||||
"nextcloud.service"
|
||||
"network-online.target"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
|
||||
|
||||
# Actually serve the content from here
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,148 +0,0 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
srcDomain = "src.thehellings.com";
|
||||
sshPort = 2222;
|
||||
in
|
||||
{
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
#proxy_ssl_verify off;
|
||||
#proxy_ssl_server_name on;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Http-Version $server_protocol;
|
||||
proxy_set_header User-Agent $http_user_agent;
|
||||
client_max_body_size 100000m;
|
||||
|
||||
#proxy_set_header Host $host;
|
||||
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
#proxy_set_header X-Forwarded-Proto $scheme;
|
||||
#proxy_set_header X-Forwarded-Ssl on;
|
||||
|
||||
# Ultimate AI Block List v1.7 20250924
|
||||
# https://perishablepress.com/ultimate-ai-block-list/
|
||||
|
||||
if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
|
||||
return 444;
|
||||
}
|
||||
if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
|
||||
return 444;
|
||||
}
|
||||
'';
|
||||
};
|
||||
#greg.proxies."registry.thehellings.com" = {
|
||||
#target = "https://gitea.shire-zebra.ts.net:5000";
|
||||
#ssl = true;
|
||||
#genAliases = false;
|
||||
#extraConfig = ''
|
||||
#proxy_set_header X-Forwarded-Proto https;
|
||||
#proxy_set_header X-Forwarded-Ssl on;
|
||||
#client_max_body_size 25000m;
|
||||
#'';
|
||||
#};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
services = {
|
||||
anubis = {
|
||||
instances = {
|
||||
git = {
|
||||
enable = true;
|
||||
settings = {
|
||||
BIND = "/run/anubis/anubis-git/anubis.sock";
|
||||
COOKIE_DOMAIN = "thehellings.com";
|
||||
SERVE_ROBOTS_TXT = true;
|
||||
TARGET = "https://gitea.shire-zebra.ts.net/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
haproxy = {
|
||||
enable = true;
|
||||
config = ''
|
||||
global
|
||||
daemon
|
||||
maxconn 20
|
||||
|
||||
defaults
|
||||
timeout connect 500s
|
||||
timeout client 500s
|
||||
timeout server 1h
|
||||
|
||||
listen gitsshd
|
||||
bind *:${toString sshPort}
|
||||
timeout client 1h
|
||||
mode tcp
|
||||
server git-isaiah isaiah.shire-zebra.ts.net:32222
|
||||
server git-jeremiah jeremiah.shire-zebra.ts.net:32222
|
||||
server git-zeke zeke.shire-zebra.ts.net:32222
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
haproxy = {
|
||||
after = [
|
||||
"network-online.target"
|
||||
];
|
||||
wants = [
|
||||
"network-online.target"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
|
||||
}
|
||||
@@ -1,70 +0,0 @@
|
||||
# Registration of new users is disabled for the public, but I can create
|
||||
# them by the following commands:
|
||||
# nix run nixpkgs.matrix-synapse
|
||||
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
|
||||
{ config, ... }:
|
||||
let
|
||||
domain = "${config.networking.domain}";
|
||||
fqdn = "matrix.${domain}";
|
||||
in
|
||||
{
|
||||
greg.proxies."${fqdn}" = {
|
||||
extraConfig = ''
|
||||
error_log /var/log/nginx/debug.log debug;
|
||||
proxy_ssl_verify off;
|
||||
proxy_ssl_server_name on;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
genAliases = false;
|
||||
ssl = true;
|
||||
target = "https://matrix.shire-zebra.ts.net";
|
||||
};
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
# Server the '.well-known' files to find the Matrix API server
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
# This is needed so that servers contacting hellings.com can find
|
||||
# the actual application server at matrix.thehellings.com
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = {
|
||||
"m.server" = "${fqdn}:443";
|
||||
};
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = {
|
||||
"base_url" = "https://${fqdn}";
|
||||
};
|
||||
"m.identity_server" = {
|
||||
"base_url" = "https://vector.im";
|
||||
};
|
||||
};
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Open networking ports for the server
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
age.secrets.nextcloudadmin = {
|
||||
file = ../../../secrets/nextcloudadmin.age;
|
||||
owner = "nextcloud";
|
||||
};
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud33;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."next.thehellings.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
|
||||
# Otherwise nginx errors looking for the nextcloud sock file
|
||||
systemd.services.nginx.after = [ "nextcloud.service" ];
|
||||
|
||||
greg.backup.jobs.nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
pre = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-pre";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --on";
|
||||
}
|
||||
);
|
||||
post = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "nextcloud-backup-post";
|
||||
runtimeInputs = [ config.services.nextcloud.occ ];
|
||||
text = "nextcloud-occ maintenance:mode --off";
|
||||
}
|
||||
);
|
||||
};
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
{ ... }:
|
||||
let
|
||||
homepage = "127.0.0.1:30080";
|
||||
in
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
clientMaxBodySize = "25000m"; # To help with uploading container images
|
||||
# If there are recommended settings, let's use them!
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
# Actually serve the content from here
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies = {
|
||||
"thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
podman-compose
|
||||
];
|
||||
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,63 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
pkgs',
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
environment.systemPackages = [ pkgs'.upgrade-pg-cluster ];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [ "nextcloud" ];
|
||||
};
|
||||
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
};
|
||||
}
|
||||
@@ -12,3 +12,20 @@ spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- gitea
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-direct
|
||||
spec:
|
||||
rules:
|
||||
- host: git.k3s.nebula.thehellings.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: gitea-release-http
|
||||
port:
|
||||
name: http
|
||||
|
||||
@@ -13,3 +13,20 @@ spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- matrix
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: matrix-direct
|
||||
spec:
|
||||
rules:
|
||||
- host: matrix.k3s.nebula.thehellings.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: dendrite
|
||||
port:
|
||||
number: 8008
|
||||
|
||||
Binary file not shown.
@@ -62,6 +62,9 @@ in
|
||||
# Demo of how to create it
|
||||
"matrix.age".publicKeys = everyone;
|
||||
"tailscale.age".publicKeys = everyone;
|
||||
|
||||
"acme.age".publicKeys = everyone;
|
||||
|
||||
# At the point where you want to use it, put
|
||||
# age.secrets.matrix.file = ../../secrets/matrix.age;
|
||||
# Then you can reference the file at /run/agenix/matrix
|
||||
|
||||
Reference in New Issue
Block a user