A complete reformatting to match nixpkgs-fmt
This commit is contained in:
Greg Hellings
+66
-65
@@ -1,78 +1,79 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./git.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./matrix.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
];
|
||||
imports = [
|
||||
./git.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./matrix.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
];
|
||||
|
||||
greg = {
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
greg = {
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host chronicles.shire-zebra.ts.net"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/backup_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host chronicles.shire-zebra.ts.net"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/backup_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
|
||||
networking = {
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [
|
||||
"100.88.91.27"
|
||||
];
|
||||
};
|
||||
networking = {
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [
|
||||
"100.88.91.27"
|
||||
];
|
||||
};
|
||||
|
||||
age.secrets.runner-deployer = {
|
||||
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
age.secrets.runner-deployer = {
|
||||
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
services.deployer = {
|
||||
executor = "shell";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
|
||||
};
|
||||
};
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
services.deployer = {
|
||||
executor = "shell";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
|
||||
};
|
||||
};
|
||||
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "gitlab-runner";
|
||||
};
|
||||
users.groups.gitlab-runner = {};
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "gitlab-runner";
|
||||
};
|
||||
users.groups.gitlab-runner = { };
|
||||
|
||||
systemd.services."gitlab-runner".serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "gitlab-runner";
|
||||
};
|
||||
systemd.services."gitlab-runner".serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "gitlab-runner";
|
||||
};
|
||||
|
||||
security.sudo.extraRules = [{
|
||||
users = [ "gitlab-runner" ];
|
||||
commands = [{
|
||||
command = "/run/current-system/sw/bin/systemctl";
|
||||
options = [ "NOPASSWD" ];
|
||||
} {
|
||||
command = "/run/current-system/sw/bin/podman";
|
||||
options = [ "NOPASSWD" ];
|
||||
}];
|
||||
}];
|
||||
security.sudo.extraRules = [{
|
||||
users = [ "gitlab-runner" ];
|
||||
commands = [{
|
||||
command = "/run/current-system/sw/bin/systemctl";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
{
|
||||
command = "/run/current-system/sw/bin/podman";
|
||||
options = [ "NOPASSWD" ];
|
||||
}];
|
||||
}];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
graphviz
|
||||
nix-du
|
||||
pgloader
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
graphviz
|
||||
nix-du
|
||||
pgloader
|
||||
];
|
||||
}
|
||||
|
||||
+38
-37
@@ -1,44 +1,45 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
srcDomain = "src.thehellings.com";
|
||||
sshPort = 2222;
|
||||
in {
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "http://git.thehellings.lan";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
greg.proxies."registry.thehellings.com" = {
|
||||
target = "https://registry.thehellings.lan:5000";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = "client_max_body_size 250m;";
|
||||
};
|
||||
srcDomain = "src.thehellings.com";
|
||||
sshPort = 2222;
|
||||
in
|
||||
{
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "http://git.thehellings.lan";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
greg.proxies."registry.thehellings.com" = {
|
||||
target = "https://registry.thehellings.lan:5000";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = "client_max_body_size 250m;";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = builtins.concatStringsSep "\n" [
|
||||
"global"
|
||||
" daemon"
|
||||
" maxconn 20"
|
||||
|
||||
"defaults"
|
||||
" timeout connect 500s"
|
||||
" timeout client 500s"
|
||||
" timeout server 1h"
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = builtins.concatStringsSep "\n" [
|
||||
"global"
|
||||
" daemon"
|
||||
" maxconn 20"
|
||||
|
||||
"listen gitsshd"
|
||||
" bind *:${toString sshPort}"
|
||||
" timeout client 1h"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:22"
|
||||
];
|
||||
};
|
||||
"defaults"
|
||||
" timeout connect 500s"
|
||||
" timeout client 500s"
|
||||
" timeout server 1h"
|
||||
|
||||
"listen gitsshd"
|
||||
" bind *:${toString sshPort}"
|
||||
" timeout client 1h"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:22"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+49
-47
@@ -4,59 +4,61 @@
|
||||
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
domain = "${config.networking.domain}";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
domain = "${config.networking.domain}";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
in
|
||||
{
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
# Server the '.well-known' files to find the Matrix API server
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
# Server the '.well-known' files to find the Matrix API server
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
# This is needed so that servers contacting hellings.com can find
|
||||
# the actual application server at matrix.thehellings.com
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = { "m.server" = "${fqdn}:443"; };
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
# This is needed so that servers contacting hellings.com can find
|
||||
# the actual application server at matrix.thehellings.com
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = { "m.server" = "${fqdn}:443"; };
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
|
||||
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
||||
};
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
};
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
|
||||
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
||||
};
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
};
|
||||
|
||||
# Reverse proxy in front of the actual Matrix server
|
||||
"${fqdn}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
# Reverse proxy in front of the actual Matrix server
|
||||
"${fqdn}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
# Not the appropriate place for the chat client
|
||||
locations."/".extraConfig = "return 404;";
|
||||
# Not the appropriate place for the chat client
|
||||
locations."/".extraConfig = "return 404;";
|
||||
|
||||
locations."/_matrix" = {
|
||||
proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
locations."/_matrix" = {
|
||||
proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Open networking ports for the server
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
# Open networking ports for the server
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
}
|
||||
|
||||
+30
-30
@@ -1,38 +1,38 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
|
||||
age.secrets.nextcloudadmin.owner = "nextcloud";
|
||||
age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
|
||||
age.secrets.nextcloudadmin.owner = "nextcloud";
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud29;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud29;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."next.thehellings.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
services.nginx.virtualHosts."next.thehellings.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
|
||||
# Otherwise nginx errors looking for the nextcloud sock file
|
||||
systemd.services.nginx.after = [ "nextcloud.service" ];
|
||||
# Otherwise nginx errors looking for the nextcloud sock file
|
||||
systemd.services.nginx.after = [ "nextcloud.service" ];
|
||||
|
||||
greg.backup.jobs.nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
id = "rbfco-rvmis";
|
||||
};
|
||||
greg.backup.jobs.nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
id = "rbfco-rvmis";
|
||||
};
|
||||
}
|
||||
|
||||
+28
-28
@@ -1,36 +1,36 @@
|
||||
{ ... }:
|
||||
let
|
||||
homepage = "127.0.0.1:30080";
|
||||
homepage = "127.0.0.1:30080";
|
||||
in
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
# If there are recommended settings, let's use them!
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
# If there are recommended settings, let's use them!
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
# Actually serve the content from here
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
# needs explicit port to match what gitlab-runner sees when pulling
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies."thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
# Actually serve the content from here
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
# needs explicit port to match what gitlab-runner sees when pulling
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies."thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
}
|
||||
|
||||
+55
-55
@@ -1,63 +1,63 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.upgrade-pg-cluster
|
||||
];
|
||||
environment.systemPackages = [
|
||||
pkgs.upgrade-pg-cluster
|
||||
];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [
|
||||
"nextcloud"
|
||||
];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [ {
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [
|
||||
"nextcloud"
|
||||
];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
}];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [
|
||||
"nextcloud"
|
||||
];
|
||||
};
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [
|
||||
"nextcloud"
|
||||
];
|
||||
};
|
||||
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
id = "9pwvg-s257a";
|
||||
};
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
id = "9pwvg-s257a";
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user