rewrite and refactor a lot, delete redundant configs
This commit is contained in:
parent
ca61775d84
commit
c191adcc99
44 changed files with 334 additions and 1607 deletions
|
|
@ -31,9 +31,7 @@ in {
|
|||
jade = {
|
||||
flatpak.enable = true;
|
||||
desktop = {
|
||||
enable = true;
|
||||
compositing.enable = true;
|
||||
creative.enable = true;
|
||||
syncthing.enable = true;
|
||||
kdeconnect.enable = true;
|
||||
cloud.enable = true;
|
||||
|
|
@ -41,10 +39,7 @@ in {
|
|||
mail.enable = true;
|
||||
gaming.enable = true;
|
||||
};
|
||||
helix.enable = true;
|
||||
zellij.enable = true;
|
||||
terminal.enable = true;
|
||||
# zsh.enable = true;
|
||||
};
|
||||
|
||||
hardware.trackpoint = {
|
||||
|
|
|
|||
|
|
@ -1,49 +0,0 @@
|
|||
{ pkgs, inputs, ... }:
|
||||
{
|
||||
imports = [ inputs.arion.nixosModules.arion ];
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.arion = {
|
||||
backend = "docker";
|
||||
projects.calckey.settings = {
|
||||
networks.calcnet.name = "calcnet";
|
||||
services = {
|
||||
"web".service = {
|
||||
image = "docker.io/thatonecalculator/calckey";
|
||||
container_name = "calckey_web";
|
||||
restart = "unless-stopped";
|
||||
depends_on = [ "db" "redis" ];
|
||||
ports = [ "3000:3000" ];
|
||||
networks = [ "calcnet" ];
|
||||
environment = {
|
||||
"NODE_ENV" = "production";
|
||||
};
|
||||
volumes = [
|
||||
"/calckey/files:/calckey/files"
|
||||
"/calckey/config:/calckey/.config:ro"
|
||||
];
|
||||
};
|
||||
"redis".service = {
|
||||
image = "docker.io/redis:7.0-alpine";
|
||||
container_name = "calckey_redis";
|
||||
restart = "unless-stopped";
|
||||
networks = [ "calcnet" ];
|
||||
volumes = [ "/calckey/redis:/data" ];
|
||||
};
|
||||
"db".service = {
|
||||
image = "docker.io/postgres:12.2-alpine";
|
||||
container_name = "calckey_db";
|
||||
restart = "unless-stopped";
|
||||
networks = [ "calcnet" ];
|
||||
environment = {
|
||||
POSTGRES_PASSWORD = "calckey";
|
||||
POSTGRES_USER = "calckey";
|
||||
POSTGRES_DB = "calckey";
|
||||
};
|
||||
volumes = [
|
||||
"/calckey/db:/var/lib/postgresql/data"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,109 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../common.nix
|
||||
../../modules/zsh.nix
|
||||
../../modules/neovim.nix
|
||||
../../modules/firewall.nix
|
||||
|
||||
./proxy.nix
|
||||
./calckey.nix
|
||||
];
|
||||
|
||||
jade = {
|
||||
neovim.enable = true;
|
||||
zsh.enable = true;
|
||||
};
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
networking.hostName = "katzencafe"; # Define your hostname.
|
||||
# Pick only one of the below networking options.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.jade = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim gitMinimal # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
];
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
services.jitsi-meet = {
|
||||
enable = true;
|
||||
hostName = "meet.katzen.cafe";
|
||||
};
|
||||
services.jitsi-videobridge.openFirewall = true;
|
||||
|
||||
services.murmur = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
registerHostname = "mumble.katzen.cafe";
|
||||
sslKey = "/var/lib/acme/mumble.katzen.cafe/key.pem";
|
||||
sslCert = "/var/lib/acme/mumble.katzen.cafe/cert.pem";
|
||||
};
|
||||
|
||||
containers = {
|
||||
"phtanumb-wiki" = {
|
||||
autoStart = true;
|
||||
forwardPorts = [
|
||||
{
|
||||
containerPort = 8080;
|
||||
hostPort = 8099;
|
||||
protocol = "tcp";
|
||||
}
|
||||
];
|
||||
bindMounts = {
|
||||
"/var/mediawiki" = {
|
||||
hostPath = "/phtanum-b/wiki";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
config = { config, pkgs, ... }: {
|
||||
services.mediawiki = {
|
||||
enable = true;
|
||||
name = "phtanum-b";
|
||||
virtualHost.listen = [
|
||||
{
|
||||
#ip = "127.0.0.1";
|
||||
port = 8080;
|
||||
ssl = false;
|
||||
}
|
||||
];
|
||||
virtualHost.adminAddr = "admin@katzen.cafe";
|
||||
passwordFile = "/var/mediawiki/passwordFile";
|
||||
extraConfig = ''
|
||||
# Disable anonymous editing
|
||||
$wgGroupPermissions['*']['edit'] = false;
|
||||
'';
|
||||
};
|
||||
|
||||
system.stateVersion = "22.11";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ "virtio_gpu" ];
|
||||
boot.kernelParams = [ "console=tty" ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0ce40e38-b9ef-4d84-b678-10745b7fedb4";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/DEBB-944F";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/9cb23bf3-128c-4847-8f72-f14f4aaa5026"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
{ inputs, config, pkgs, ... }:
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "jade@schrottkatze.de";
|
||||
defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
defaults.webroot = "/var/lib/acme/acme-challenge";
|
||||
certs = {
|
||||
"ck.katzen.cafe" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"meet.katzen.cafe" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"wiki.phtanum-b.katzen.cafe" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"mumble.katzen.cafe" = {
|
||||
group = "murmur";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = {
|
||||
"ck.katzen.cafe" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 8M;
|
||||
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
'';
|
||||
};
|
||||
};
|
||||
"wiki.phtanum-b.katzen.cafe" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8099";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -31,9 +31,7 @@
|
|||
jade = {
|
||||
flatpak.enable = true;
|
||||
desktop = {
|
||||
enable = true;
|
||||
compositing.enable = true;
|
||||
creative.enable = true;
|
||||
syncthing.enable = true;
|
||||
kdeconnect.enable = true;
|
||||
cloud.enable = true;
|
||||
|
|
@ -42,10 +40,7 @@
|
|||
ios-compat.enable = true;
|
||||
mail.enable = true;
|
||||
};
|
||||
zellij.enable = true;
|
||||
terminal.enable = true;
|
||||
helix.enable = true;
|
||||
zsh.enable = true;
|
||||
};
|
||||
boot = {
|
||||
loader = {
|
||||
|
|
|
|||
|
|
@ -62,9 +62,7 @@ in {
|
|||
jade = {
|
||||
flatpak.enable = true;
|
||||
desktop = {
|
||||
enable = true;
|
||||
compositing.enable = true;
|
||||
creative.enable = true;
|
||||
syncthing.enable = true;
|
||||
kdeconnect.enable = true;
|
||||
cloud.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,59 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ inputs, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../common.nix
|
||||
./proxy.nix
|
||||
./vaultwarden.nix
|
||||
./nextcloud.nix
|
||||
./mumble.nix
|
||||
./microbin.nix
|
||||
../../modules/neovim.nix
|
||||
../../modules/zsh.nix
|
||||
../../modules/firewall.nix
|
||||
#./synapse.nix
|
||||
./penpot.nix
|
||||
];
|
||||
|
||||
#systemd.services.wordsofgod-bot.enable = true;
|
||||
|
||||
systemd.services.wordsofgod-bot = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig.ExecStart = "${inputs.wordsofgod.packages."x86_64-linux".default}/bin/wordsofgod";
|
||||
serviceConfig.EnvironmentFile = "/etc/wordsofgod-bot/wordsofgod.env";
|
||||
};
|
||||
|
||||
services = {
|
||||
openssh.permitRootLogin = "without-password";
|
||||
fail2ban = {
|
||||
enable = true;
|
||||
bantime-increment.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
jade = {
|
||||
neovim.enable = true;
|
||||
zsh.enable = true;
|
||||
};
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
environment.systemPackages = [ inputs.wordsofgod ];
|
||||
|
||||
networking.hostName = "schrottserver"; # Define your hostname.
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# default settings for stateful data; don't change unless reinstall with newer version
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/e8d88849-3746-4c24-9ecd-09921645ef81";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/0107-0E2C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
{ inputs, config, pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = [ inputs.karton.defaultPackage."x86_64-linux" ];
|
||||
systemd.services.karton = {
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = {
|
||||
#MICROBIN_AUTH_USERNAME = "jade";
|
||||
KARTON_HASH_IDS = "";
|
||||
KARTON_EDITABLE = "";
|
||||
KARTON_PRIVATE = "";
|
||||
KARTON_HIGHLIGHTSYNTAX = "";
|
||||
KARTON_PUBLIC_PATH = "https://s10e.de";
|
||||
KARTON_QR = "";
|
||||
KARTON_URL_EP = "u";
|
||||
KARTON_RAW_EP = "r";
|
||||
KARTON_PASTA_EP = "p";
|
||||
};
|
||||
script = "${inputs.karton.defaultPackage."x86_64-linux"}/bin/karton";
|
||||
#scriptArgs = "--auth-password ${builtins.readFile ../secret-data/mb-pass} --auth-username jade --editable --hash-ids --no-listing --highlightsyntax --public-path https://s10e.de --qr";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
RootDirectory="/";
|
||||
WorkingDirectory = "/karton";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [ murmur ];
|
||||
services.murmur = {
|
||||
enable = true;
|
||||
registerHostname = "mumble.schrottkatze.de";
|
||||
};
|
||||
}
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
config = {
|
||||
dbtype = "pgsql";
|
||||
dbuser = "nextcloud";
|
||||
dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
|
||||
dbname = "nextcloud";
|
||||
adminpassFile = "${../../secret-data/nextcloud-admin-pass}";
|
||||
adminuser = "root";
|
||||
};
|
||||
package = pkgs.nextcloud25;
|
||||
extraApps = with pkgs.nextcloud25Packages.apps; {
|
||||
inherit bookmarks calendar contacts news tasks;
|
||||
};
|
||||
extraAppsEnable = true;
|
||||
hostName = "wolke.schrottkatze.de";
|
||||
https = true;
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# ensure that postgres is running *before* running the setup
|
||||
systemd.services."nextcloud-setup" = {
|
||||
requires = ["postgresql.service"];
|
||||
after = ["postgresql.service"];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,75 +0,0 @@
|
|||
{ pkgs, inputs, ... }:
|
||||
{
|
||||
imports = [ inputs.arion.nixosModules.arion ];
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.arion = {
|
||||
backend = "docker";
|
||||
projects.penpot.settings = {
|
||||
networks.penpot.name = "penpot";
|
||||
services = {
|
||||
"penpot-backend".service = {
|
||||
image = "penpotapp/backend:latest";
|
||||
volumes = [ "/penpot_assets:/opt/data/assets" ];
|
||||
depends_on = [ "penpot-postgres" "penpot-redis" ];
|
||||
networks = [ "penpot" ];
|
||||
environment = {
|
||||
"PENPOT_FLAGS" = "enable-registration enable-login-with-password disable-email-verification enable-smtp enable-prepl-server";
|
||||
"PENPOT_PREPL_HOST" = "0.0.0.0";
|
||||
|
||||
"PENPOT_PUBLIC_URI" = "https://pp.schrottkatze.de";
|
||||
|
||||
"PENPOT_DATABASE_URI" = "postgresql://penpot-postgres/penpot";
|
||||
"PENPOT_DATABASE_USERNAME" = "penpot";
|
||||
"PENPOT_DATABASE_PASSWORD" = "penpot";
|
||||
"PENPOT_REDIS_URI" = "redis://penpot-redis/0";
|
||||
|
||||
"PENPOT_ASSETS_STORAGE_BACKEND" = "assets-fs";
|
||||
"PENPOT_STORAGE_ASSETS_FS_DIRECTORY" = "/opt/data/assets";
|
||||
|
||||
"PENPOT_TELEMETRY_ENABLED" = "false";
|
||||
|
||||
"PENPOT_SMTP_DEFAULT_FROM" = "Penpot <noreply-pp@schrottkatze.de>";
|
||||
"PENPOT_SMTP_DEFAULT_REPLY_TO" = "Penpot <noreply-pp@schrottkatze.de>";
|
||||
"PENPOT_SMTP_HOST" = "smtp.migadu.com";
|
||||
"PENPOT_SMTP_PORT" = "587";
|
||||
"PENPOT_SMTP_USERNAME" = "noreply-pp@schrottkatze.de";
|
||||
"PENPOT_SMTP_PASSWORD" = "${builtins.readFile ../../secret-data/penpot-smtp-pass}";
|
||||
"PENPOT_SMTP_TLS" = "true";
|
||||
"PENPOT_SMTP_SSL" = "false";
|
||||
};
|
||||
};
|
||||
"penpot-frontend".service = {
|
||||
image = "penpotapp/frontend:latest";
|
||||
ports = [ "9001:80" ];
|
||||
volumes = [ "/penpot_assets:/opt/data/assets" ];
|
||||
depends_on = [ "penpot-backend" "penpot-exporter" ];
|
||||
networks = [ "penpot" ];
|
||||
};
|
||||
"penpot-exporter".service = {
|
||||
image = "penpotapp/exporter:latest";
|
||||
networks = [ "penpot" ];
|
||||
environment = {
|
||||
"PENPOT_PUBLIC_URI" = "http://penpot-frontend";
|
||||
"PENPOT_REDIS_URI" = "redis://penpot-redis/0";
|
||||
};
|
||||
};
|
||||
"penpot-postgres".service = {
|
||||
image = "postgres:15";
|
||||
stop_signal = "SIGINT";
|
||||
volumes = [ "/penpot_postgres_v15:/var/lib/postgresql/data" ];
|
||||
networks = [ "penpot" ];
|
||||
environment = {
|
||||
"POSTGRES_INITDB_ARGS" = "--data-checksums";
|
||||
"POSTGRES_DB" = "penpot";
|
||||
"POSTGRES_USER" = "penpot";
|
||||
"POSTGRES_PASSWORD" = "penpot";
|
||||
};
|
||||
};
|
||||
"penpot-redis".service = {
|
||||
image = "redis:7";
|
||||
networks = [ "penpot" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,124 +0,0 @@
|
|||
{ inputs, config, pkgs, ... }:
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "jade@schrottkatze.de";
|
||||
certs = {
|
||||
"schrottkatze.de" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"vw.schrottkatze.de" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"wolke.schrottkatze.de" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"s10e.de" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"synapse.schrottkatze.de" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
"pp.schrottkatze.de" = {
|
||||
group = "nginx";
|
||||
keyType = "rsa4096";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [ inputs.meowsite.packages."x86_64-linux".default inputs.gumseite.packages."x86_64-linux".default ];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = {
|
||||
"schrottkatze.de" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
root = "${inputs.meowsite.packages."x86_64-linux".default}";
|
||||
};
|
||||
"vw.schrottkatze.de" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8812"; #changed the default rocket port due to some conflict
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
locations."/notifications/hub" = {
|
||||
proxyPass = "http://localhost:3012";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
locations."/notifications/hub/negotiate" = {
|
||||
proxyPass = "http://localhost:8812";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
"wolke.schrottkatze.de" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
"pp.schrottkatze.de" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:9001";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
"s10e.de" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8080$request_uri";
|
||||
};
|
||||
};
|
||||
"synapse.schrottkatze.de" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
http2 = true;
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."~ ^(/_matrix|/_synapse/client)" = {
|
||||
proxyPass = "http://localhost:8008";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $host;
|
||||
client_max_body_size 2G;
|
||||
'';
|
||||
};
|
||||
extraConfig = "proxy_http_version 1.1;";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
services = {
|
||||
matrix-synapse = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server_name = "synapse.schrottkatze.de";
|
||||
};
|
||||
};
|
||||
postgresql = {
|
||||
enable = true;
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE "matrix-synapse";
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
|
||||
#initdbArgs = [
|
||||
#"--locale=C"
|
||||
#"--encoding=UTF8"
|
||||
#];
|
||||
ensureDatabases = [ "matrix-synapse" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "matrix-synapse";
|
||||
ensurePermissions."DATABASE \"matrix-synapse\"" = "ALL PRIVILEGES";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
#backupDir = "/vw-backups";
|
||||
config = {
|
||||
DATA_FOLDER = "/var/lib/bitwarden_rs/";
|
||||
DATABASE_URL = "/var/lib/bitwarden_rs/db.sqlite3";
|
||||
LOG_FILE = "/var/log/bitwarden";
|
||||
WEBSOCKET_ENABLED = true;
|
||||
WEBSOCKET_ADDRESS = "0.0.0.0";
|
||||
WEBSOCKET_PORT = 3012;
|
||||
SIGNUPS_VERIFY = true;
|
||||
ROCKET_LOG = "debug";
|
||||
ENABLE_WAL = false;
|
||||
ADMIN_TOKEN = builtins.readFile ../../secret-data/vaultwarden-admin-token;
|
||||
DOMAIN = "https://vw.schrottkatze.de";
|
||||
SMTP_TIMEOUT = 15;
|
||||
ROCKET_PORT = 8812;
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue