initial commit
This commit is contained in:
commit
7019a44685
|
|
@ -0,0 +1 @@
|
|||
hardware-configuration.nix
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
{ config, pkgs, ... }:
|
||||
let
|
||||
unstable = import
|
||||
(builtins.fetchTarball https://github.com/nixos/nixpkgs/tarball/nixpkgs-unstable)
|
||||
# reuse the current configuration
|
||||
{ config = config.nixpkgs.config; };
|
||||
in
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./modules/gitea.nix
|
||||
./modules/podman.nix
|
||||
#./modules/mailserver.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
searxng
|
||||
eza
|
||||
wget
|
||||
unzip
|
||||
dive
|
||||
podman-tui
|
||||
podman-compose
|
||||
git
|
||||
#niv
|
||||
];
|
||||
|
||||
users.groups.data = {};
|
||||
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.defaults.email = "1111700bh@gmail.com";
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/vda";
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.settings.PermitRootLogin = "yes";
|
||||
|
||||
users.users.root = {
|
||||
password = "qqcTch4m";
|
||||
};
|
||||
|
||||
services.kavita = {
|
||||
enable = true;
|
||||
package = unstable.kavita;
|
||||
tokenKeyFile = "/mnt/tokenKey.file";
|
||||
dataDir = "/mnt/kavita";
|
||||
};
|
||||
|
||||
services.searx = {
|
||||
enable = true;
|
||||
settings.server.port = 8080;
|
||||
settings.server.bind_address = "127.0.0.1";
|
||||
settings.server.base_url = "https://searx.vitrial.xyz";
|
||||
settings.server.secret_key = "secretkey";
|
||||
settings.enabled_plugins = [
|
||||
"Basic Calculator"
|
||||
"Hash plugin"
|
||||
"Tor check plugin"
|
||||
"Open Access DOI rewrite"
|
||||
"Hostnames plugin"
|
||||
"Unit converter plugin"
|
||||
"Tracker URL remover"
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."searx.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:8080";
|
||||
};
|
||||
virtualHosts."kavita.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:5000";
|
||||
};
|
||||
virtualHosts."stash.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:5124";
|
||||
};
|
||||
virtualHosts."homarr.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:7575";
|
||||
};
|
||||
virtualHosts."dash.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:3001";
|
||||
};
|
||||
virtualHosts."vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".root = "/mnt/www/vitrial/";
|
||||
};
|
||||
virtualHosts."vim.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".root = "/mnt/www/vim";
|
||||
};
|
||||
virtualHosts."software.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".root = "/mnt/www/software";
|
||||
};
|
||||
virtualHosts."home.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".root = "/mnt/www/homepage/";
|
||||
};
|
||||
};
|
||||
|
||||
users.users."root".openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPEfmeIfrU6kIbREche1Pm+Z6SiSDbBC8nK2PFMdPbBc34ov5sRIpC1d8oS+2U3SjOsommYk5Ws1/LLyK7aOm2PkF4LjkS/3y45JjaDZci3QMbZN2pAPIIM/O7nOEe+0jEWOmWTr+V0WqB2FLgTq7UC+S9oYMrxAX7dY8hjPZZHqPY7BCvjg8M1+OtklgI423K9cQUun0wL38ysq5yDGLy6XXM+v+n8kxyG+nA0rOh8KptJrRMwRaW1zX4RNMTHwnjfCBLYber1CihPUIquHeYhuD7SouYMwIeFlbJaZh3rcGY/cIvqOvKH1VhSU0Cq5rb5ER/gkM5MwEDdJzSVS7VH93nRU03gWN+yHjHY7A/+HWS36CB4vDwNujYwOBNstuIpCebiiTXoOcR9h1CMJBh+V2snUtjHyNOc+lBHZ2a2QiCmjuN6Alw8DBU1nDadB8qka3vbOHGVPSocOhBmDrJ5ziZstrkRsv8B0Lzf8Pbi+N/wVODETZSGiU6emFb1Qk= vitrial"
|
||||
];
|
||||
|
||||
users.users."kavita".openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPEfmeIfrU6kIbREche1Pm+Z6SiSDbBC8nK2PFMdPbBc34ov5sRIpC1d8oS+2U3SjOsommYk5Ws1/LLyK7aOm2PkF4LjkS/3y45JjaDZci3QMbZN2pAPIIM/O7nOEe+0jEWOmWTr+V0WqB2FLgTq7UC+S9oYMrxAX7dY8hjPZZHqPY7BCvjg8M1+OtklgI423K9cQUun0wL38ysq5yDGLy6XXM+v+n8kxyG+nA0rOh8KptJrRMwRaW1zX4RNMTHwnjfCBLYber1CihPUIquHeYhuD7SouYMwIeFlbJaZh3rcGY/cIvqOvKH1VhSU0Cq5rb5ER/gkM5MwEDdJzSVS7VH93nRU03gWN+yHjHY7A/+HWS36CB4vDwNujYwOBNstuIpCebiiTXoOcR9h1CMJBh+V2snUtjHyNOc+lBHZ2a2QiCmjuN6Alw8DBU1nDadB8qka3vbOHGVPSocOhBmDrJ5ziZstrkRsv8B0Lzf8Pbi+N/wVODETZSGiU6emFb1Qk= vitrial"
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
system.stateVersion = "18.09";
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
#imports = let
|
||||
# # replace this with an actual commit id or tag
|
||||
# commit = "298b235f664f925b433614dc33380f0662adfc3f";
|
||||
#in [
|
||||
# "${builtins.fetchTarball {
|
||||
# url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
|
||||
# # replace this with an actual hash
|
||||
# sha256 = "004949033dprls9qg849yks2rbjdlf5hr2v8pk890gyxaffj2m1c";
|
||||
# }}/modules/sops"
|
||||
#];
|
||||
|
||||
|
||||
#sops.age.keyFile = "/secrets/age/keys.txt";
|
||||
|
||||
services.nginx.clientMaxBodySize = "512m";
|
||||
services.nginx.virtualHosts."git.vitrial.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000/";
|
||||
};
|
||||
};
|
||||
|
||||
#sops.secrets."postgres/gitea_dbpass" = {
|
||||
# sopsFile = ../.secrets/postgres.yaml; # bring your own password file
|
||||
# owner = config.services.gitea.user;
|
||||
#};
|
||||
|
||||
#services.gitea = {
|
||||
# enable = true;
|
||||
# appName = "My awesome Gitea server"; # Give the site a name
|
||||
# database = {
|
||||
# type = "postgres";
|
||||
# passwordFile = config.sops.secrets."postgres/gitea_dbpass".path;
|
||||
# };
|
||||
# domain = "gitea.vitrial.xyz";
|
||||
# rootUrl = "http://gitea.vitrial.xyz/";
|
||||
# httpPort = 3001;
|
||||
#};
|
||||
#services.postgresql = {
|
||||
# ensureDatabases = [ config.services.gitea.user ];
|
||||
# ensureUsers = [
|
||||
# {
|
||||
# name = config.services.gitea.database.user;
|
||||
# ensurePermissions."DATABASE ${config.services.gitea.database.name}" = "ALL PRIVILEGES";
|
||||
# }
|
||||
# ];
|
||||
#};
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
lfs.enable = true;
|
||||
stateDir = "/mnt/gitea";
|
||||
useWizard = false; # broken
|
||||
group = "data";
|
||||
settings = {
|
||||
server = {
|
||||
HTTP_PORT = 3000;
|
||||
ROOT_URL = "http://git.vitrial.xyz:3000/";
|
||||
DOMAIN = "git.vitrial.xyz";
|
||||
SSH_DOMAIN = "git.vitrial.xyz";
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true;
|
||||
};
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
MAX_SIZE = 65536;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
{ config, pkgs, ... }: {
|
||||
imports = [
|
||||
(builtins.fetchTarball {
|
||||
# Pick a release version you are interested in and set its hash, e.g.
|
||||
url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-23.05/nixos-mailserver-nixos-23.05.tar.gz";
|
||||
# To get the sha256 of the nixos-mailserver tarball, we can use the nix-prefetch-url command:
|
||||
# release="nixos-23.05"; nix-prefetch-url "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz" --unpack
|
||||
sha256 = "1ngil2shzkf61qxiqw11awyl81cr7ks2kv3r3k243zz7v2xakm5c";
|
||||
})
|
||||
];
|
||||
|
||||
mailserver = {
|
||||
enable = true;
|
||||
fqdn = "mail.vitrial.xyz";
|
||||
domains = [ "vitrial.xyz" ];
|
||||
|
||||
# A list of all login accounts. To create the password hashes, use
|
||||
# nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
|
||||
loginAccounts = {
|
||||
"vitrial@vitrial.xyz" = {
|
||||
hashedPasswordFile = "/var/passwd-hash/vitrial";
|
||||
aliases = ["postmaster@vitrial.com"];
|
||||
};
|
||||
};
|
||||
|
||||
# Use Let's Encrypt certificates. Note that this needs to set up a stripped
|
||||
# down nginx and opens port 80.
|
||||
certificateScheme = "acme-nginx";
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,220 @@
|
|||
# Auto-generated using compose2nix v0.3.1-pre.
|
||||
{ pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
# Runtime
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
defaultNetwork.settings = {
|
||||
# Required for container networking to be able to use names.
|
||||
dns_enabled = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Enable container name DNS for non-default Podman networks.
|
||||
# https://github.com/NixOS/nixpkgs/issues/226365
|
||||
networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ];
|
||||
|
||||
virtualisation.oci-containers.backend = "podman";
|
||||
|
||||
# Containers
|
||||
virtualisation.oci-containers.containers."db" = {
|
||||
image = "postgres:16";
|
||||
environment = {
|
||||
"APP_DEBUG" = "0";
|
||||
"APP_ENV" = "prod";
|
||||
"CORS_ALLOW_ORIGIN" = "^https?://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?$";
|
||||
"DB_DRIVER" = "pdo_pgsql";
|
||||
"DB_HOST" = "db";
|
||||
"DB_NAME" = "koillection";
|
||||
"DB_PASSWORD" = "1840842";
|
||||
"DB_PORT" = "5432";
|
||||
"DB_USER" = "koillection";
|
||||
"DB_VERSION" = "16";
|
||||
"HTTPS_ENABLED" = "1";
|
||||
"JWT_PUBLIC_KEY" = "%kernel.project_dir%/config/jwt/public.pem";
|
||||
"JWT_SECRET_KEY" = "%kernel.project_dir%/config/jwt/private.pem";
|
||||
"PHP_MEMORY_LIMIT" = "512M";
|
||||
"PHP_TZ" = "Europe/Paris";
|
||||
"POSTGRES_DB" = "";
|
||||
"POSTGRES_PASSWORD" = "";
|
||||
"POSTGRES_USER" = "";
|
||||
"UPLOAD_MAX_FILESIZE" = "20M";
|
||||
};
|
||||
volumes = [
|
||||
"/usr/volumes/postgresql:/var/lib/postgresql/data:rw"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=db"
|
||||
"--network=docker-compose_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-db" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."koillection" = {
|
||||
image = "koillection/koillection";
|
||||
environment = {
|
||||
"APP_DEBUG" = "0";
|
||||
"APP_ENV" = "prod";
|
||||
"CORS_ALLOW_ORIGIN" = "^https?://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?$";
|
||||
"DB_DRIVER" = "pdo_pgsql";
|
||||
"DB_HOST" = "db";
|
||||
"DB_NAME" = "koillection";
|
||||
"DB_PASSWORD" = "1840842";
|
||||
"DB_PORT" = "5432";
|
||||
"DB_USER" = "koillection";
|
||||
"DB_VERSION" = "16";
|
||||
"HTTPS_ENABLED" = "1";
|
||||
"JWT_PUBLIC_KEY" = "%kernel.project_dir%/config/jwt/public.pem";
|
||||
"JWT_SECRET_KEY" = "%kernel.project_dir%/config/jwt/private.pem";
|
||||
"PHP_MEMORY_LIMIT" = "512M";
|
||||
"PHP_TZ" = "Europe/Paris";
|
||||
"UPLOAD_MAX_FILESIZE" = "20M";
|
||||
};
|
||||
volumes = [
|
||||
"/usr/volumes/koillection/uploads:/uploads:rw"
|
||||
];
|
||||
ports = [
|
||||
"5124:80/tcp"
|
||||
];
|
||||
dependsOn = [
|
||||
"db"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=koillection"
|
||||
"--network=docker-compose_default"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services."podman-koillection" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers."homarr" = {
|
||||
image = "ghcr.io/ajnart/homarr:latest";
|
||||
volumes = [
|
||||
"/usr/volumes/homarr/configs:/app/data/configs:rw"
|
||||
"/usr/volumes/homarr/data:/data:rw"
|
||||
"/usr/volumes/homarr/icons:/app/public/icons:rw"
|
||||
#"/var/run/docker.sock:/var/run/docker.sock:rw"
|
||||
];
|
||||
ports = [
|
||||
"7575:7575/tcp"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=homarr"
|
||||
"--network=docker-compose_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-homarr" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers."dash" = {
|
||||
image = "mauricenino/dashdot:latest";
|
||||
volumes = [
|
||||
"/:/mnt/host:ro"
|
||||
"/mnt:/mnt/host/mnt:ro"
|
||||
"/media:/mnt/host/media:ro"
|
||||
];
|
||||
ports = [
|
||||
"3001:3001/tcp"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=dash"
|
||||
"--network=docker-compose_default"
|
||||
"--privileged"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-dash" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-docker-compose_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-docker-compose-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
# Networks
|
||||
systemd.services."podman-network-docker-compose_default" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStop = "podman network rm -f docker-compose_default";
|
||||
};
|
||||
script = ''
|
||||
podman network inspect docker-compose_default || podman network create docker-compose_default
|
||||
'';
|
||||
partOf = [ "podman-compose-docker-compose-root.target" ];
|
||||
wantedBy = [ "podman-compose-docker-compose-root.target" ];
|
||||
};
|
||||
|
||||
# Root service
|
||||
# When started, this will automatically create all resources and start
|
||||
# the containers. When stopped, this will teardown all resources.
|
||||
systemd.targets."podman-compose-docker-compose-root" = {
|
||||
unitConfig = {
|
||||
Description = "Root target generated by compose2nix.";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue