fixed organization, added nix files from bowl
This commit is contained in:
Anish Lakhwara
parent
6446ab7ce4
commit
8af4b6faf9
|
|
@ -1,147 +0,0 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
||||||
|
|
||||||
{ config, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ # Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./common.nix
|
|
||||||
./box.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
# Use the GRUB 2 boot loader.
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
|
||||||
boot.loader.grub = {
|
|
||||||
enable = true;
|
|
||||||
device = "nodev";
|
|
||||||
version = 2;
|
|
||||||
efiSupport = true;
|
|
||||||
enableCryptodisk = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
boot.initrd.secrets = {
|
|
||||||
"/keyfile0.bin" = /etc/secrets/initrd/keyfile0.bin;
|
|
||||||
"/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin;
|
|
||||||
};
|
|
||||||
|
|
||||||
boot.initrd.luks.devices = {
|
|
||||||
"root" = {
|
|
||||||
#name = "root";
|
|
||||||
device = "/dev/disk/by-uuid/f37f3222-47d7-42d8-b400-363320a31853"; # UUID for /dev/nvme01np2
|
|
||||||
preLVM = true;
|
|
||||||
allowDiscards = true;
|
|
||||||
keyFile = "/keyfile0.bin";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Data mount
|
|
||||||
fileSystems."/data" = {
|
|
||||||
device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; # UUID for /dev/mapper/crypted-data
|
|
||||||
encrypted = {
|
|
||||||
enable = true;
|
|
||||||
label = "crypted-data";
|
|
||||||
blkDev = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; # UUID for /dev/sda1
|
|
||||||
keyFile = "/keyfile1.bin";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# boot.loader.grub.efiInstallAsRemovable = true;
|
|
||||||
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
|
||||||
# Define on which hard drive you want to install Grub.
|
|
||||||
# boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
|
||||||
|
|
||||||
networking.hostName = "box"; # Define your hostname.
|
|
||||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
|
||||||
|
|
||||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
|
||||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
|
||||||
# replicates the default behaviour.
|
|
||||||
networking.useDHCP = false;
|
|
||||||
networking.interfaces.enp0s31f6.useDHCP = true;
|
|
||||||
networking.interfaces.enp3s0.useDHCP = true;
|
|
||||||
networking.interfaces.wlp4s0.useDHCP = true;
|
|
||||||
|
|
||||||
# OpenVPN
|
|
||||||
services.openvpn.servers = {
|
|
||||||
officeVPN =
|
|
||||||
{ config = ''
|
|
||||||
config /home/anish/usr/work/ThreatDefence/vpn/anishcarbon19.ovpn '';
|
|
||||||
autoStart = false;
|
|
||||||
updateResolvConf = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
# Configure network proxy if necessary
|
|
||||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
|
||||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
|
||||||
|
|
||||||
# Select internationalisation properties.
|
|
||||||
# i18n = {
|
|
||||||
# consoleFont = "Lat2-Terminus16";
|
|
||||||
# consoleKeyMap = "us";
|
|
||||||
# defaultLocale = "en_US.UTF-8";
|
|
||||||
# };
|
|
||||||
|
|
||||||
# Set your time zone.
|
|
||||||
# time.timeZone = "Europe/Amsterdam";
|
|
||||||
|
|
||||||
# List packages installed in system profile. To search, run:
|
|
||||||
# $ nix search wget
|
|
||||||
# environment.systemPackages = with pkgs; [
|
|
||||||
# wget vim
|
|
||||||
# ];
|
|
||||||
|
|
||||||
# Some programs need SUID wrappers, can be configured further or are
|
|
||||||
# started in user sessions.
|
|
||||||
# programs.mtr.enable = true;
|
|
||||||
# programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# Enable the OpenSSH daemon.
|
|
||||||
services.openssh.enable = true;
|
|
||||||
services.openssh.permitRootLogin = "yes";
|
|
||||||
|
|
||||||
# Open ports in the firewall.
|
|
||||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
|
||||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
|
||||||
# Or disable the firewall altogether.
|
|
||||||
# networking.firewall.enable = false;
|
|
||||||
|
|
||||||
# Enable CUPS to print documents.
|
|
||||||
# services.printing.enable = true;
|
|
||||||
|
|
||||||
# Enable sound.
|
|
||||||
sound.enable = true;
|
|
||||||
# hardware.pulseaudio.enable = true;
|
|
||||||
|
|
||||||
# Enable the X11 windowing system.
|
|
||||||
# services.xserver.enable = true;
|
|
||||||
# services.xserver.layout = "us";
|
|
||||||
# services.xserver.xkbOptions = "eurosign:e";
|
|
||||||
|
|
||||||
# Enable touchpad support.
|
|
||||||
# services.xserver.libinput.enable = true;
|
|
||||||
|
|
||||||
# Enable the KDE Desktop Environment.
|
|
||||||
# services.xserver.displayManager.sddm.enable = true;
|
|
||||||
# services.xserver.desktopManager.plasma5.enable = true;
|
|
||||||
|
|
||||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
|
||||||
users.users.anish = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
|
||||||
hashedPassword = "MO0Pbd2O4eIlA";
|
|
||||||
};
|
|
||||||
|
|
||||||
# This value determines the NixOS release with which your system is to be
|
|
||||||
# compatible, in order to avoid breaking some software such as database
|
|
||||||
# servers. You should change this only after NixOS release notes say you
|
|
||||||
# should.
|
|
||||||
system.stateVersion = "19.09"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/ade0752d-84d3-4e39-865b-9027ba2d5c67";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot/efi" =
|
|
||||||
{ device = "/dev/disk/by-uuid/1715-278E";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/b790abb4-ba5f-4476-8f09-b0fc575414aa"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
nix.maxJobs = lib.mkDefault 4;
|
|
||||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
|
||||||
}
|
|
||||||
74
machines/bowl.nix
Normal file
74
machines/bowl.nix
Normal file
|
|
@ -0,0 +1,74 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
./taskd.nix
|
||||||
|
./nextcloud.nix
|
||||||
|
./networking.nix
|
||||||
|
# ./wireguard.nix
|
||||||
|
# ./shiori.nix
|
||||||
|
./shaarli.nix
|
||||||
|
# ./shaarli-tokudan.nix
|
||||||
|
# ./mod-wallabag.nix
|
||||||
|
# ./pkg-wallabag.nix
|
||||||
|
./navidrome.nix
|
||||||
|
./pkg-navidrome.nix
|
||||||
|
# ./wallabag.nix
|
||||||
|
./headphones.nix
|
||||||
|
./dns.nix
|
||||||
|
./backup.nix
|
||||||
|
./monitoring.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.loader.grub.devices = [ "/dev/sda" ];
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
|
boot.loader.grub.enableCryptodisk = true;
|
||||||
|
boot.loader.supportsInitrdSecrets = true;
|
||||||
|
|
||||||
|
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||||
|
boot.initrd.availableKernelModules = ["virtio-pci"];
|
||||||
|
boot.initrd.network = {
|
||||||
|
enable = true;
|
||||||
|
ssh = {
|
||||||
|
enable = true;
|
||||||
|
port = 2222;
|
||||||
|
authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box
|
||||||
|
"];
|
||||||
|
hostKeys = [ "/host_ecdsa_key" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.initrd.luks.devices = {
|
||||||
|
"enc-pv" = {
|
||||||
|
name = "enc-pv";
|
||||||
|
preLVM = true;
|
||||||
|
device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c";
|
||||||
|
allowDiscards = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.initrd.secrets = {
|
||||||
|
"/host_ecdsa_key" = "/host_ecdsa_key";
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
boot.cleanTmpDir = true;
|
||||||
|
boot.kernelModules = [ "dm-snapshot" ];
|
||||||
|
|
||||||
|
users.users.anish = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" ];
|
||||||
|
hashedPassword = "MO0Pbd2O4eIlA";
|
||||||
|
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.root.initialHashedPassword = "";
|
||||||
|
services.openssh.permitRootLogin = "prohibit-password";
|
||||||
|
networking.hostName = "bowl";
|
||||||
|
services.openssh.enable = true;
|
||||||
|
services.logind.lidSwitch = "ignore";
|
||||||
|
system.stateVersion = "20.09";
|
||||||
|
time.timeZone = "Australia/Brisbane";
|
||||||
|
}
|
||||||
34
modules/backup.nix
Normal file
34
modules/backup.nix
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
{
|
||||||
|
# Assumes the remote borg backup server has already been initialized
|
||||||
|
# borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive>
|
||||||
|
services.borgbackup.jobs = {
|
||||||
|
backupTaskwarriorRsync = {
|
||||||
|
paths = [ "/var/lib/taskserver" ];
|
||||||
|
doInit = true;
|
||||||
|
repo = "20779@hk-s020.rsync.net:taskwarrior" ;
|
||||||
|
encryption = {
|
||||||
|
mode = "repokey-blake2";
|
||||||
|
passCommand = "cat /run/keys/rsync";
|
||||||
|
};
|
||||||
|
environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
|
||||||
|
compression = "auto,lzma";
|
||||||
|
startAt = "weekly";
|
||||||
|
extraArgs = "--remote-path=borg1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.borgbackup.jobs = {
|
||||||
|
backupShaarliRsync = {
|
||||||
|
paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ];
|
||||||
|
doInit = true;
|
||||||
|
repo = "20779@hk-s020.rsync.net:shaarli" ;
|
||||||
|
encryption = {
|
||||||
|
mode = "repokey-blake2";
|
||||||
|
passCommand = "cat /run/keys/rsync";
|
||||||
|
};
|
||||||
|
environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
|
||||||
|
compression = "auto,lzma";
|
||||||
|
startAt = "weekly";
|
||||||
|
extraArgs = "--remote-path=borg1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
11
modules/dns.nix
Normal file
11
modules/dns.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
{
|
||||||
|
services.dnsmasq.enable = true;
|
||||||
|
services.dnsmasq.extraConfig = ''
|
||||||
|
address=/.mossnet.lan/192.168.1.6
|
||||||
|
dhcp-range=192.168.1.1,proxy
|
||||||
|
'';
|
||||||
|
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
|
||||||
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
||||||
|
}
|
||||||
12
modules/headphones.nix
Normal file
12
modules/headphones.nix
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
{config, lib, pkgs, ... }:
|
||||||
|
{
|
||||||
|
services.headphones = {
|
||||||
|
enable = true;
|
||||||
|
host = "192.168.1.6";
|
||||||
|
port = 8181;
|
||||||
|
user = "headphones";
|
||||||
|
group = "headphones";
|
||||||
|
dataDir = "/data/downloaded";
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 8181 ];
|
||||||
|
}
|
||||||
80
modules/mod-shaarli.nix
Normal file
80
modules/mod-shaarli.nix
Normal file
|
|
@ -0,0 +1,80 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
phppoolName = "shaarli";
|
||||||
|
dataDir = "/var/lib/shaarli";
|
||||||
|
vhost = "192.168.1.6:1233";
|
||||||
|
|
||||||
|
shaarli = pkgs.callPackage ./pkg-shaarli.nix {
|
||||||
|
inherit dataDir;
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts."${vhost}" = {
|
||||||
|
forceSSL = false;
|
||||||
|
enableACME = false;
|
||||||
|
root = "${shaarli}";
|
||||||
|
listen = [ { addr = "192.168.1.6"; port = 1233; } ];
|
||||||
|
# extraConfig = ''
|
||||||
|
# index index.php;
|
||||||
|
# '';
|
||||||
|
locations."/" = {
|
||||||
|
index = "index.php";
|
||||||
|
extraConfig = ''
|
||||||
|
try_files $uri $uri/ index.php;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
locations."~ (index)\.php$" = {
|
||||||
|
extraConfig = ''
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||||
|
if (!-f $document_root$fastcgi_script_name) {
|
||||||
|
return 404;
|
||||||
|
}
|
||||||
|
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket};
|
||||||
|
fastcgi_index index.php;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
locations."~ \.php$" = {
|
||||||
|
extraConfig = ''
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.phpfpm.pools."${phppoolName}" = {
|
||||||
|
user = "nginx";
|
||||||
|
group = "nginx";
|
||||||
|
settings = {
|
||||||
|
"listen.owner" = "nginx";
|
||||||
|
"listen.group" = "nginx";
|
||||||
|
"user" = "nginx";
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"pm.max_children" = "75";
|
||||||
|
"pm.min_spare_servers" = "5";
|
||||||
|
"pm.max_spare_servers" = "20";
|
||||||
|
"pm.max_requests" = "10";
|
||||||
|
"catch_workers_output" = "1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
users.extraUsers.shaarli = { group = "shaarli"; };
|
||||||
|
users.extraGroups.shaarli = { };
|
||||||
|
systemd.services.shaarli-install = {
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
script = ''
|
||||||
|
if [ ! -d "${dataDir}" ]; then
|
||||||
|
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/
|
||||||
|
fi
|
||||||
|
chown -Rc nginx:nginx ${dataDir}
|
||||||
|
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
|
||||||
|
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1233 ];
|
||||||
|
}
|
||||||
263
modules/mod-wallabag.nix
Normal file
263
modules/mod-wallabag.nix
Normal file
|
|
@ -0,0 +1,263 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
let
|
||||||
|
cfg = config.services.wallabag;
|
||||||
|
|
||||||
|
poolName = "wallabag";
|
||||||
|
|
||||||
|
phpfpmSocketName = "/var/run/phpfpm/${poolName}.sock";
|
||||||
|
|
||||||
|
configFile = pkgs.writeTextFile {
|
||||||
|
name = "wallabag-config";
|
||||||
|
text = cfg.conf;
|
||||||
|
destination = "/config/parameters.yml";
|
||||||
|
};
|
||||||
|
|
||||||
|
appDir = pkgs.buildEnv {
|
||||||
|
name = "wallabag-app-dir";
|
||||||
|
ignoreCollisions = true;
|
||||||
|
checkCollisionContents = false;
|
||||||
|
paths = [ configFile "${cfg.package}/app" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
in {
|
||||||
|
options = {
|
||||||
|
services.wallabag = {
|
||||||
|
enable = mkEnableOption "wallabag";
|
||||||
|
|
||||||
|
user = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "nginx";
|
||||||
|
description = ''
|
||||||
|
User account under which both the update daemon and the web-application run.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
dataDir = mkOption {
|
||||||
|
type = types.path;
|
||||||
|
default = "/var/www/wallabag";
|
||||||
|
description = ''
|
||||||
|
Data directory.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
package = mkOption {
|
||||||
|
type = types.package;
|
||||||
|
default = pkgs.wallabag;
|
||||||
|
description = ''
|
||||||
|
Wallabag package to use.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
hostName = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
description = ''
|
||||||
|
Name of the nginx virtualhost to use and setup.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
poolConfig = mkOption {
|
||||||
|
type = types.lines;
|
||||||
|
default = ''
|
||||||
|
pm = dynamic
|
||||||
|
pm.max_children = 75
|
||||||
|
pm.start_servers = 1
|
||||||
|
pm.min_spare_servers = 1
|
||||||
|
pm.max_spare_servers = 20
|
||||||
|
pm.max_requests = 500
|
||||||
|
catch_workers_output = 1
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
conf = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = ''
|
||||||
|
parameters:
|
||||||
|
database_driver: pdo_pgsql
|
||||||
|
database_driver_class: Wallabag\CoreBundle\Doctrine\DBAL\Driver\CustomPostgreSQLDriver
|
||||||
|
database_host: 127.0.0.1
|
||||||
|
database_port: ~
|
||||||
|
database_name: wallabag
|
||||||
|
database_user: wallabag
|
||||||
|
database_password: ~
|
||||||
|
# For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
|
||||||
|
database_path: null
|
||||||
|
database_table_prefix: wallabag_
|
||||||
|
database_socket: null
|
||||||
|
# with PostgreSQL and SQLite, you must set "utf8"
|
||||||
|
database_charset: utf8
|
||||||
|
|
||||||
|
domain_name: http://192.168.1.6:8080
|
||||||
|
|
||||||
|
mailer_transport: smtp
|
||||||
|
mailer_user: ~
|
||||||
|
mailer_password: ~
|
||||||
|
mailer_host: 127.0.0.1
|
||||||
|
mailer_port: false
|
||||||
|
mailer_encryption: ~
|
||||||
|
mailer_auth_mode: ~
|
||||||
|
locale: en
|
||||||
|
# A secret key that's used to generate certain security-related tokens
|
||||||
|
secret: sateofg893964crfSTNFG"*(&@$091
|
||||||
|
twofactor_auth: true
|
||||||
|
twofactor_sender: no-reply@wallabag.org
|
||||||
|
fosuser_registration: true
|
||||||
|
fosuser_confirmation: true
|
||||||
|
fos_oauth_server_access_token_lifetime: 3600
|
||||||
|
fos_oauth_server_refresh_token_lifetime: 1209600
|
||||||
|
from_email: no-reply@wallabag.org
|
||||||
|
rss_limit: 50
|
||||||
|
rabbitmq_host: localhost
|
||||||
|
rabbitmq_port: 5672
|
||||||
|
rabbitmq_user: ~
|
||||||
|
rabbitmq_password: ~
|
||||||
|
rabbitmq_prefetch_count: 0
|
||||||
|
redis_scheme: tcp
|
||||||
|
redis_host: localhost
|
||||||
|
redis_port: 6379
|
||||||
|
redis_path: ~
|
||||||
|
redis_password: ~
|
||||||
|
sentry_dsn: ~
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
Contents of the wallabag configuration file (parameters.yml)
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
|
services.phpfpm.pools."${poolName}" = {
|
||||||
|
user = "${cfg.user}";
|
||||||
|
group = "nginx";
|
||||||
|
settings = {
|
||||||
|
"listen" = "${phpfpmSocketName}";
|
||||||
|
"listen.owner" = "nginx";
|
||||||
|
"listen.group" = "nginx";
|
||||||
|
"listen.mode" = "0600";
|
||||||
|
"env[WALLABAG_DATA]" = "${cfg.dataDir}";
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"pm.max_children" = "75";
|
||||||
|
"pm.min_spare_servers" = "5";
|
||||||
|
"pm.max_spare_servers" = "20";
|
||||||
|
"pm.max_requests" = "10";
|
||||||
|
"catch_workers_output" = "1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.phpfpm.phpOptions = ''
|
||||||
|
max_execution_time = 120
|
||||||
|
'';
|
||||||
|
|
||||||
|
services.nginx.enable = mkDefault true;
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."${cfg.hostName}" = {
|
||||||
|
root = "${cfg.package}/web";
|
||||||
|
listen = [ { addr = "192.168.1.6"; port = 8080; } ];
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
add_header X-Frame-Options SAMEORIGIN;
|
||||||
|
add_header X-Content-Type-Options nosniff;
|
||||||
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
|
'';
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
try_files $uri /app.php$is_args$args;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
locations."/assets".root = "${cfg.dataDir}/web";
|
||||||
|
|
||||||
|
locations."~ ^/app\\.php(/|$)" = {
|
||||||
|
extraConfig = ''
|
||||||
|
fastcgi_pass unix:${phpfpmSocketName};
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
|
|
||||||
|
fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
|
||||||
|
fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
|
||||||
|
fastcgi_read_timeout 120;
|
||||||
|
|
||||||
|
internal;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
locations."~ /(?!app)\\.php$" = {
|
||||||
|
extraConfig = ''
|
||||||
|
return 404;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
# Ensure the database, user, and permissions always exist
|
||||||
|
ensureDatabases = [ "wallabag" "wallabag_user" ];
|
||||||
|
authentication = lib.mkForce ''
|
||||||
|
# Generated file; do not edit!
|
||||||
|
# TYPE DATABASE USER ADDRESS METHOD
|
||||||
|
local all all trust
|
||||||
|
host all wallabag 127.0.0.1/32 trust
|
||||||
|
'';
|
||||||
|
ensureUsers = [
|
||||||
|
{ name = "wallabag";
|
||||||
|
ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
|
||||||
|
ensurePermissions."DATABASE wallabag_user" = "ALL PRIVILEGES";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.wallabag-install = {
|
||||||
|
description = "Wallabag install service";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
before = [ "phpfpm-wallabag.service" ];
|
||||||
|
after = [ "mysql.service" "postgresql.service" ];
|
||||||
|
path = with pkgs; [ coreutils php72 php72Packages.composer ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
User = cfg.user;
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = "yes";
|
||||||
|
PermissionsStartOnly = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
preStart = ''
|
||||||
|
mkdir -p "${cfg.dataDir}"
|
||||||
|
chown ${cfg.user}:nginx "${cfg.dataDir}"
|
||||||
|
'';
|
||||||
|
|
||||||
|
script = ''
|
||||||
|
echo "Setting up wallabag files in ${cfg.dataDir} ..."
|
||||||
|
cd "${cfg.dataDir}"
|
||||||
|
|
||||||
|
rm -rf var/cache/*
|
||||||
|
rm -f app
|
||||||
|
ln -sf ${appDir} app
|
||||||
|
ln -sf ${cfg.package}/composer.{json,lock} .
|
||||||
|
|
||||||
|
export WALLABAG_DATA="${cfg.dataDir}"
|
||||||
|
if [ ! -f installed ]; then
|
||||||
|
php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction
|
||||||
|
#php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
|
||||||
|
# Until https://github.com/wallabag/wallabag/issues/3662 is fixed
|
||||||
|
yes no | php ${cfg.package}/bin/console --env=prod wallabag:install
|
||||||
|
touch installed
|
||||||
|
else
|
||||||
|
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
|
||||||
|
fi
|
||||||
|
php ${cfg.package}/bin/console --env=prod cache:clear
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
meta = with stdenv.lib; {
|
||||||
|
maintainers = with maintainers; [ chickensoupwithrice ];
|
||||||
|
};
|
||||||
|
}
|
||||||
53
modules/monitoring.nix
Normal file
53
modules/monitoring.nix
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
{ config, pkgs, ... }: {
|
||||||
|
# grafana configuration
|
||||||
|
services.grafana = {
|
||||||
|
enable = true;
|
||||||
|
domain = "grafana.mossnet.lan";
|
||||||
|
port = 2342;
|
||||||
|
addr = "127.0.0.1";
|
||||||
|
};
|
||||||
|
|
||||||
|
# nginx reverse proxy
|
||||||
|
services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.prometheus = {
|
||||||
|
enable = true;
|
||||||
|
port = 9001;
|
||||||
|
exporters = {
|
||||||
|
node = {
|
||||||
|
enable = true;
|
||||||
|
enabledCollectors = [ "systemd" ];
|
||||||
|
port = 9002;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
scrapeConfigs = [
|
||||||
|
{
|
||||||
|
job_name = "bowl";
|
||||||
|
static_configs = [{
|
||||||
|
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
||||||
|
}];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.loki = {
|
||||||
|
enable = true;
|
||||||
|
configFile = /var/loki-config.yaml;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.promtail = {
|
||||||
|
description = "Promtail service for Loki";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = ''
|
||||||
|
${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
101
modules/navidrome.nix
Normal file
101
modules/navidrome.nix
Normal file
|
|
@ -0,0 +1,101 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.navidrome;
|
||||||
|
configFile = "/etc/navidrome/settings.json";
|
||||||
|
dataFolder = "/var/lib/navidrome";
|
||||||
|
in {
|
||||||
|
options = {
|
||||||
|
|
||||||
|
services.navidrome = {
|
||||||
|
enable = mkEnableOption "Navidrome music server and streamer";
|
||||||
|
|
||||||
|
settings = lib.mkOption {
|
||||||
|
type = with types; attrsOf (oneOf [ int str ]);
|
||||||
|
default = {};
|
||||||
|
example = literalExample ''
|
||||||
|
{
|
||||||
|
LogLevel = "INFO";
|
||||||
|
BaseURL = "/music";
|
||||||
|
ScanInterval = "10s";
|
||||||
|
TranscodingCacheSize = "15MB";
|
||||||
|
MusicFolder = "/data/music";
|
||||||
|
};
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
Configuration for Navidrome, see <link xlink:href="https://www.navidrome.org/docs/usage/configuration-options/"/> for supported values.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
user = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "navidrome";
|
||||||
|
description = "User account under which Navidrome runs.";
|
||||||
|
};
|
||||||
|
|
||||||
|
group = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "navidrome";
|
||||||
|
description = "Group account under which Navidrome runs.";
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
|
environment.etc."navidrome/settings.json".text = builtins.toJSON cfg.settings;
|
||||||
|
|
||||||
|
services.navidrome.settings = {
|
||||||
|
DataFolder = dataFolder;
|
||||||
|
ConfigFile = configFile;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.navidrome = {
|
||||||
|
description = "Navidrome Music Server and Streamer compatible with Subsonic/Airsonic";
|
||||||
|
after = [ "remote-fs.target" "network.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
environment = {
|
||||||
|
ND_CONFIGFILE = configFile;
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${pkgs.navidrome}/bin/navidrome";
|
||||||
|
WorkingDirectory = dataFolder;
|
||||||
|
TimeoutStopSec = "20";
|
||||||
|
KillMode = "process";
|
||||||
|
Restart = "on-failure";
|
||||||
|
User = cfg.user;
|
||||||
|
Group = cfg.group;
|
||||||
|
DevicePolicy = "closed";
|
||||||
|
NoNewPrivileges= " yes";
|
||||||
|
PrivateTmp = "yes";
|
||||||
|
PrivateUsers = "yes";
|
||||||
|
ProtectControlGroups = "yes";
|
||||||
|
ProtectKernelModules = "yes";
|
||||||
|
ProtectKernelTunables = "yes";
|
||||||
|
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
|
||||||
|
RestrictNamespaces = "yes";
|
||||||
|
RestrictRealtime = "yes";
|
||||||
|
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
|
||||||
|
ReadWritePaths = dataFolder;
|
||||||
|
StateDirectory = baseNameOf dataFolder;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users = optionalAttrs (cfg.user == "navidrome") ({
|
||||||
|
navidrome = {
|
||||||
|
description = "Navidrome service user";
|
||||||
|
name = cfg.user;
|
||||||
|
group = cfg.group;
|
||||||
|
isSystemUser = true;
|
||||||
|
};
|
||||||
|
});
|
||||||
|
|
||||||
|
users.groups = optionalAttrs (cfg.group == "navidrome") ({
|
||||||
|
navidrome = {};
|
||||||
|
});
|
||||||
|
|
||||||
|
};
|
||||||
|
}
|
||||||
52
modules/nextcloud.nix
Normal file
52
modules/nextcloud.nix
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
{
|
||||||
|
services.nextcloud = {
|
||||||
|
enable = true;
|
||||||
|
hostName = "mossnet.lan";
|
||||||
|
#home = "/data/nextcloud";
|
||||||
|
|
||||||
|
# Use HTTPS for links
|
||||||
|
https = false;
|
||||||
|
|
||||||
|
# Auto-update Nextcloud Apps
|
||||||
|
autoUpdateApps.enable = true;
|
||||||
|
# Set what time makes sense for you
|
||||||
|
autoUpdateApps.startAt = "05:00:00";
|
||||||
|
|
||||||
|
config = {
|
||||||
|
# Further forces Nextcloud to use HTTPS
|
||||||
|
# overwriteProtocol = "https";
|
||||||
|
|
||||||
|
# Nextcloud PostegreSQL database configuration, recommended over using SQLite
|
||||||
|
dbtype = "pgsql";
|
||||||
|
dbuser = "nextcloud";
|
||||||
|
dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
|
||||||
|
dbname = "nextcloud";
|
||||||
|
dbpassFile = "/var/nextcloud-db-pass";
|
||||||
|
|
||||||
|
adminpassFile = "/var/nextcloud-admin-pass";
|
||||||
|
adminuser = "admin";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable PostgreSQL
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
# Ensure the database, user, and permissions always exist
|
||||||
|
ensureDatabases = [ "nextcloud" ];
|
||||||
|
ensureUsers = [
|
||||||
|
{ name = "nextcloud";
|
||||||
|
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Ensure that postgres is running before running the setup
|
||||||
|
systemd.services."nextcloud-setup" = {
|
||||||
|
requires = ["postgresql.service"];
|
||||||
|
after = ["postgresql.service"];
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
}
|
||||||
116
modules/shaarli.nix
Normal file
116
modules/shaarli.nix
Normal file
|
|
@ -0,0 +1,116 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
let
|
||||||
|
dataDir = "/var/www/shaarli-config";
|
||||||
|
name = "shaarli";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts = {
|
||||||
|
"links.mossnet.lan" = {
|
||||||
|
forceSSL = false;
|
||||||
|
enableACME = false;
|
||||||
|
root = "${dataDir}";
|
||||||
|
#listen = [ { addr = "192.168.1.6"; port = 1234; } ];
|
||||||
|
extraConfig = ''
|
||||||
|
index index.php;
|
||||||
|
'';
|
||||||
|
locations = {
|
||||||
|
"/".extraConfig = ''
|
||||||
|
try_files $uri $uri/ index.php;
|
||||||
|
'';
|
||||||
|
|
||||||
|
"~ (index)\.php$".extraConfig = ''
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||||
|
if (!-f $document_root$fastcgi_script_name) {
|
||||||
|
return 404;
|
||||||
|
}
|
||||||
|
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket};
|
||||||
|
fastcgi_index index.php;
|
||||||
|
|
||||||
|
fastcgi_param QUERY_STRING $query_string;
|
||||||
|
fastcgi_param REQUEST_METHOD $request_method;
|
||||||
|
fastcgi_param CONTENT_TYPE $content_type;
|
||||||
|
fastcgi_param CONTENT_LENGTH $content_length;
|
||||||
|
|
||||||
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||||
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||||
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||||
|
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
|
||||||
|
fastcgi_param REQUEST_URI $request_uri;
|
||||||
|
fastcgi_param DOCUMENT_URI $document_uri;
|
||||||
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
||||||
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
||||||
|
|
||||||
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
||||||
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
||||||
|
|
||||||
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
||||||
|
fastcgi_param REMOTE_PORT $remote_port;
|
||||||
|
fastcgi_param SERVER_ADDR $server_addr;
|
||||||
|
fastcgi_param SERVER_PORT $server_port;
|
||||||
|
fastcgi_param SERVER_NAME $server_name;
|
||||||
|
'';
|
||||||
|
|
||||||
|
"~ \.php$".extraConfig = ''
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
|
||||||
|
"^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";
|
||||||
|
|
||||||
|
"^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";
|
||||||
|
|
||||||
|
"~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
|
||||||
|
expires max;
|
||||||
|
add_header Pragma public;
|
||||||
|
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.phpfpm = {
|
||||||
|
pools = {
|
||||||
|
"${name}" = {
|
||||||
|
user = "nginx";
|
||||||
|
group = "nginx";
|
||||||
|
#listen = "/run/phpfpm/php.sock";
|
||||||
|
settings = {
|
||||||
|
"listen.owner" = "nginx";
|
||||||
|
"listen.group" = "nginx";
|
||||||
|
"user" = "nginx";
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"pm.max_children" = "4";
|
||||||
|
"pm.min_spare_servers" = "1";
|
||||||
|
"pm.max_spare_servers" = "4";
|
||||||
|
"pm.max_requests" = "32";
|
||||||
|
"catch_workers_output" = "1";
|
||||||
|
"php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
users.extraUsers."${name}" = { group = "${name}"; };
|
||||||
|
users.extraGroups."${name}" = { };
|
||||||
|
systemd.services.shaarli-install = {
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
script = ''
|
||||||
|
if [ ! -d "${dataDir}" ]; then
|
||||||
|
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
|
||||||
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/
|
||||||
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/
|
||||||
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
|
||||||
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/
|
||||||
|
ln -S ${pkgs.shaarli}/* ${dataDir}
|
||||||
|
fi
|
||||||
|
chown -Rc nginx:nginx ${dataDir}
|
||||||
|
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
|
||||||
|
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
# TODO: Write the configuration file here?
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1234 ];
|
||||||
|
}
|
||||||
10
modules/taskd.nix
Normal file
10
modules/taskd.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.taskserver.enable = true;
|
||||||
|
services.taskserver.fqdn = "192.168.1.6";
|
||||||
|
services.taskserver.listenHost = "192.168.1.6";
|
||||||
|
services.taskserver.listenPort = 53589;
|
||||||
|
services.taskserver.organisations.mossnet.users = [ "anish" ];
|
||||||
|
}
|
||||||
|
|
||||||
21
modules/wireguard.nix
Normal file
21
modules/wireguard.nix
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ];
|
||||||
|
environment.systemPackages = [ pkgs.wireguard ];
|
||||||
|
networking.wireguard.enable = true;
|
||||||
|
networking.wireguard.interfaces = {
|
||||||
|
wg0 = {
|
||||||
|
ips = [ "10.0.69.2/32" ];
|
||||||
|
privateKeyFile = "/var/lib/wireguard/priv";
|
||||||
|
|
||||||
|
peers = [
|
||||||
|
{ # helix - server
|
||||||
|
publicKey = "{c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=}";
|
||||||
|
allowedIPs = [ "10.0.69.1/24" ];
|
||||||
|
endpoint = "sealight.xyz:60990";
|
||||||
|
persistentKeepalive = 25;
|
||||||
|
} ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
9
pkgs/pkg-navidrome.nix
Normal file
9
pkgs/pkg-navidrome.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
{
|
||||||
|
services.navidrome.enable = true;
|
||||||
|
services.navidrome.settings = {
|
||||||
|
MusicFolder = "/data/music";
|
||||||
|
Port = 4433;
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 4433 ];
|
||||||
|
}
|
||||||
30
pkgs/pkg-rssBridge.nix
Normal file
30
pkgs/pkg-rssBridge.nix
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
{ lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }:
|
||||||
|
|
||||||
|
stdenv.mkDerivation rec {
|
||||||
|
name = "rssBridge-${version}";
|
||||||
|
version = "2020-10-11";
|
||||||
|
preferLocalBuild = true;
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
url = "https://github.com/RSS-Bridge/rss-bridge/archive/${version}.tar.gz";
|
||||||
|
sha256 = "";
|
||||||
|
};
|
||||||
|
|
||||||
|
phases = [ "installPhase" ];
|
||||||
|
installPhase = ''
|
||||||
|
mkdir $out
|
||||||
|
tar xzf $src
|
||||||
|
cp -ra * $out/
|
||||||
|
find $out -type d -exec chmod 0755 {} \;
|
||||||
|
find $out -type f -exec chmod 0644 {} \;
|
||||||
|
ln -s $dataDir $out
|
||||||
|
'';
|
||||||
|
|
||||||
|
meta = with stdenv.lib; {
|
||||||
|
description = "RSS-Bridge is a project to create RSS Feeds for websites that don't have one.";
|
||||||
|
#license = licenses.agpl3;
|
||||||
|
homepage = "https://github.com/RSS-Bridge/rss-bridge/";
|
||||||
|
platforms = platforms.all;
|
||||||
|
maintainers = with stdenv.lib.maintainers; [ chickensoupwithrice ];
|
||||||
|
};
|
||||||
|
}
|
||||||
34
pkgs/pkg-shaarli.nix
Normal file
34
pkgs/pkg-shaarli.nix
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
{ lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }:
|
||||||
|
|
||||||
|
stdenv.mkDerivation rec {
|
||||||
|
name = "shaarli-${version}";
|
||||||
|
version = "0.11.1";
|
||||||
|
preferLocalBuild = true;
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
url = "https://github.com/shaarli/Shaarli/releases/download/v0.11.1/shaarli-v${version}-full.tar.gz";
|
||||||
|
sha256 = "1psijcmi24hk0gxh1zdsm299xj11i7find2045nnx3r96cgnwjpn";
|
||||||
|
};
|
||||||
|
|
||||||
|
phases = [ "installPhase" ];
|
||||||
|
installPhase = ''
|
||||||
|
mkdir $out
|
||||||
|
tar xzf $src
|
||||||
|
cp -ra Shaarli/. $out/
|
||||||
|
find $out -type d -exec chmod 0755 {} \;
|
||||||
|
find $out -type f -exec chmod 0644 {} \;
|
||||||
|
for a in cache data pagecache tmp; do
|
||||||
|
mv $out/$a $out/$a.orig
|
||||||
|
ln -s "${dataDir}/$a" $out/$a
|
||||||
|
done
|
||||||
|
'';
|
||||||
|
|
||||||
|
meta = with stdenv.lib; {
|
||||||
|
description = "";
|
||||||
|
# License is complicated...
|
||||||
|
#license = licenses.agpl3;
|
||||||
|
homepage = "https://github.com/shaarli/Shaarli";
|
||||||
|
platforms = platforms.all;
|
||||||
|
maintainers = with stdenv.lib.maintainers; [ tokudan ];
|
||||||
|
};
|
||||||
|
}
|
||||||
9
pkgs/pkg-wallabag.nix
Normal file
9
pkgs/pkg-wallabag.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
{ pkgs, config, lib, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.wallabag = {
|
||||||
|
enable = true;
|
||||||
|
hostName = "192.168.1.6:8080";
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 8080 ];
|
||||||
|
}
|
||||||
12
reference/networking.nix
Normal file
12
reference/networking.nix
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
networking.interfaces.enp3s0.ipv4.addresses = [ {
|
||||||
|
address = "192.168.1.6";
|
||||||
|
prefixLength = 24;
|
||||||
|
} ];
|
||||||
|
networking.nameservers = [ "1.1.1.1" ];
|
||||||
|
networking.defaultGateway = "192.168.1.1";
|
||||||
|
environment.systemPackages = [ pkgs.mosh ];
|
||||||
|
programs.mosh.enable = true;
|
||||||
|
#config.nssDatabase.hosts = [ "mdns_minimal" "[NOTFOUND=return]" ];
|
||||||
|
}
|
||||||
78
reference/shaarli-broken.nix
Normal file
78
reference/shaarli-broken.nix
Normal file
|
|
@ -0,0 +1,78 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
let
|
||||||
|
app = "shaarli";
|
||||||
|
dataDir = "/var/www/${app}";
|
||||||
|
in {
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts = {
|
||||||
|
"192.168.1.6:1232" = {
|
||||||
|
forceSSL = false;
|
||||||
|
enableACME = false;
|
||||||
|
#root = pkgs.shaarli;
|
||||||
|
root = dataDir;
|
||||||
|
listen = [ { addr = "192.168.1.6"; port = 1232; } ];
|
||||||
|
extraConfig = ''
|
||||||
|
index index.php;
|
||||||
|
'';
|
||||||
|
locations = {
|
||||||
|
"/".index = "index.php";
|
||||||
|
|
||||||
|
"~ /\\.".extraConfig = ''
|
||||||
|
log_not_found off;
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
|
||||||
|
"~ (index)\\.php$".extraConfig = ''
|
||||||
|
try_files $uri =404
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||||
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||||
|
fastcgi_param SHAARLI_CONFIG /var/www/shaarli/config;
|
||||||
|
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.${app}.socket};
|
||||||
|
fastcgi_index index.php;
|
||||||
|
'';
|
||||||
|
|
||||||
|
"^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";
|
||||||
|
|
||||||
|
"~ \\.php$".extraConfig = ''
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
|
||||||
|
"^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";
|
||||||
|
|
||||||
|
"~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
|
||||||
|
expires max;
|
||||||
|
add_header Pragma public;
|
||||||
|
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.phpfpm.pools.${app} = {
|
||||||
|
user = app;
|
||||||
|
#listen = "/run/phpfpm/shaarli.sock";
|
||||||
|
settings = {
|
||||||
|
"listen.owner" = config.services.nginx.user;
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"pm.max_children" = 4;
|
||||||
|
"pm.start_servers" = 2;
|
||||||
|
"pm.min_spare_servers" = 1;
|
||||||
|
"pm.max_spare_servers" = 4;
|
||||||
|
"pm.max_requests" = 32;
|
||||||
|
"php_admin_value[error_log]" = "stderr";
|
||||||
|
"php_admin_flag[log_errors]" = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
|
||||||
|
users.users.${app} = {
|
||||||
|
isSystemUser = true;
|
||||||
|
createHome = true;
|
||||||
|
home = dataDir;
|
||||||
|
group = app;
|
||||||
|
};
|
||||||
|
users.groups.${app} = {};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1232 ];
|
||||||
|
}
|
||||||
9
reference/shaarli-docker.nix
Normal file
9
reference/shaarli-docker.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
{ pkg, config, lib, ... }:
|
||||||
|
{
|
||||||
|
docker-containers."shaarli" = {
|
||||||
|
image = "shaarli/shaarli";
|
||||||
|
volumes = [ "shaarli:/var/lib/shaarli/data/" ];
|
||||||
|
ports = [ "1233:80" ];
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1233 ];
|
||||||
|
}
|
||||||
97
reference/shaarli-tokudan.nix
Normal file
97
reference/shaarli-tokudan.nix
Normal file
|
|
@ -0,0 +1,97 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
phppoolName = "shaarli";
|
||||||
|
dataDir = "/var/lib/shaarli";
|
||||||
|
vhost = "192.168.1.6:1232";
|
||||||
|
|
||||||
|
shaarli = pkgs.callPackage ./pkg-shaarli.nix {
|
||||||
|
inherit dataDir;
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts."${vhost}" = {
|
||||||
|
forceSSL = false;
|
||||||
|
enableACME = false;
|
||||||
|
root = "${dataDir}";
|
||||||
|
listen = [ { addr = "192.168.1.6"; port = 1232; } ];
|
||||||
|
extraConfig = ''
|
||||||
|
index index.php;
|
||||||
|
'';
|
||||||
|
locations."/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
try_files _ /index.php$is_args$args;";
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
locations."~ (index)\\.php$" = {
|
||||||
|
extraConfig = ''
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||||
|
if (!-f $document_root$fastcgi_script_name) {
|
||||||
|
return 404;
|
||||||
|
}
|
||||||
|
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.shaarli.socket};
|
||||||
|
fastcgi_index index.php;
|
||||||
|
|
||||||
|
fastcgi_param QUERY_STRING $query_string;
|
||||||
|
fastcgi_param REQUEST_METHOD $request_method;
|
||||||
|
fastcgi_param CONTENT_TYPE $content_type;
|
||||||
|
fastcgi_param CONTENT_LENGTH $content_length;
|
||||||
|
|
||||||
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||||
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||||
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||||
|
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
|
||||||
|
fastcgi_param REQUEST_URI $request_uri;
|
||||||
|
fastcgi_param DOCUMENT_URI $document_uri;
|
||||||
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
||||||
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
||||||
|
|
||||||
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
||||||
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
||||||
|
|
||||||
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
||||||
|
fastcgi_param REMOTE_PORT $remote_port;
|
||||||
|
fastcgi_param SERVER_ADDR $server_addr;
|
||||||
|
fastcgi_param SERVER_PORT $server_port;
|
||||||
|
fastcgi_param SERVER_NAME $server_name;
|
||||||
|
|
||||||
|
fastcgi_param HTTPS $https;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.phpfpm.pools.shaarli = {
|
||||||
|
user = "shaarli";
|
||||||
|
group = "shaarli";
|
||||||
|
settings = {
|
||||||
|
"listen.owner" = "nginx";
|
||||||
|
"listen.group" = "nginx";
|
||||||
|
"user" = "shaarli";
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"pm.max_children" = "75";
|
||||||
|
"pm.min_spare_servers" = "5";
|
||||||
|
"pm.max_spare_servers" = "20";
|
||||||
|
"pm.max_requests" = "10";
|
||||||
|
"catch_workers_output" = "1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
users.extraUsers.shaarli = { group = "shaarli"; home = dataDir; };
|
||||||
|
users.extraGroups.shaarli = { };
|
||||||
|
systemd.services.shaarli-install = {
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
script = ''
|
||||||
|
if [ ! -d "${dataDir}" ]; then
|
||||||
|
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
|
||||||
|
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/
|
||||||
|
fi
|
||||||
|
chown -Rc shaarli:shaarli ${dataDir}
|
||||||
|
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
|
||||||
|
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1232 ];
|
||||||
|
}
|
||||||
7
reference/shiori.nix
Normal file
7
reference/shiori.nix
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
{ pkgs, config, lib, ... }:
|
||||||
|
{
|
||||||
|
services.shiori.enable = true;
|
||||||
|
services.shiori.address = "192.168.1.6";
|
||||||
|
services.shiori.port = 1234;
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1234 ];
|
||||||
|
}
|
||||||
24
reference/test-nginx.nix
Normal file
24
reference/test-nginx.nix
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
{ pkgs, config, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
vhost = "192.168.1.6:1232";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts."${vhost}" = {
|
||||||
|
forceSSL = false;
|
||||||
|
enableACME = false;
|
||||||
|
root = "/var/lib/test";
|
||||||
|
listen = [ { addr = "192.168.1.6"; port = 1232; } ];
|
||||||
|
extraConfig = ''
|
||||||
|
index index.html;
|
||||||
|
'';
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
try_files $uri $uri/ index.html;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 1232 ];
|
||||||
|
}
|
||||||
52
reference/wallabag-docker.nix
Normal file
52
reference/wallabag-docker.nix
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
{ pkg, config, lib, ... }:
|
||||||
|
{
|
||||||
|
docker-containers."wallabag-db" = {
|
||||||
|
image = "postgres";
|
||||||
|
environment = {
|
||||||
|
"POSTGRES_PASSWORD" = "wallaroot";
|
||||||
|
"POSTGRES_USER" = "postgres";
|
||||||
|
};
|
||||||
|
extraDockerOptions = [ "--network=wallabag-br" ];
|
||||||
|
volumes = [ "/opt/wallabag/data:/var/www/wallabag" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
docker-containers."wallabag" = {
|
||||||
|
image = "wallabag/wallabag";
|
||||||
|
ports = [ "800:80" ];
|
||||||
|
#volumes = [ "/opt/wallabag/data:/var/www/wallabag/data" "/opt/wallabag/images:/var/www/wallabag/web/assets/images" ];
|
||||||
|
environment = {
|
||||||
|
"SYMFONY__ENV__DOMAIN_NAME" = "http://192.168.1.6:800";
|
||||||
|
"POSTGRES_PASSWORD" = "wallaroot";
|
||||||
|
"POSTGRES_USER" = "postgres";
|
||||||
|
"SYMFONY__ENV__DATABASE_DRIVER" = "pdo_pgsql";
|
||||||
|
"SYMFONY__ENV__DATABASE_DRIVER_CLASS" = "Wallabag\\CoreBundle\\Doctrine\\DBAL\\Driver\\CustomPostgreSQLDriver";
|
||||||
|
"SYMFONY__ENV__DATABASE_HOST" = "wallabag-db";
|
||||||
|
"SYMFONY__ENV__DATABASE_PORT" = "5432";
|
||||||
|
"SYMFONY__ENV__DATABASE_NAME" = "wallabag";
|
||||||
|
"SYMFONY__ENV__DATABASE_USER" = "wallabag";
|
||||||
|
"SYMFONY__ENV__DATABASE_PASSWORD" = "wallapass";
|
||||||
|
#"SYMFONY__ENV__DATABASE_CHARSET" = "utf8mb4";
|
||||||
|
};
|
||||||
|
extraDockerOptions = [ "--network=wallabag-br" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.init-wallabag-docker-br = {
|
||||||
|
description = "Create the network bridge wallabag.";
|
||||||
|
after = [ "network.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
script = let dockercli = "${config.virtualisation.docker.package}/bin/docker";
|
||||||
|
in ''
|
||||||
|
# Put a true at the end to prevent getting non-zero return code, which will
|
||||||
|
# crash the whole service.
|
||||||
|
check=$(${dockercli} network ls | grep "wallabag-br" || true)
|
||||||
|
if [ -z "$check" ]; then
|
||||||
|
${dockercli} network create wallabag-br
|
||||||
|
else
|
||||||
|
echo "wallabag-br already exists in docker"
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
networking.firewall.allowedTCPPorts = [ 800 ];
|
||||||
|
}
|
||||||
120
reference/wallabag.nix
Normal file
120
reference/wallabag.nix
Normal file
|
|
@ -0,0 +1,120 @@
|
||||||
|
{ pkgs, config, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
phppoolName = "wallabag";
|
||||||
|
dataDir = "/var/lib/wallabag";
|
||||||
|
vhost = "read.mossnet.local";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts."${vhost}" = {
|
||||||
|
forceSSL = false;
|
||||||
|
enableACME = false;
|
||||||
|
root = "/var/lib/wallabag/web";
|
||||||
|
listen = [ { addr = "192.168.1.6"; port = 800; } ];
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
try_files $uri /app.php$is_args$args;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
locations."/assets".root = "${dataDir}/web";
|
||||||
|
|
||||||
|
locations."~ ^/app\.php(/|$)" = {
|
||||||
|
extraConfig = ''
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||||
|
if (!-f $document_root$fastcgi_script_name) {
|
||||||
|
return 404;
|
||||||
|
}
|
||||||
|
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket};
|
||||||
|
fastcgi_param SCRIPT_FILENAME {pkgs.wallabag}/web/$fastcgi_script_name;
|
||||||
|
fastcgi_param DOCUMENT_ROOT {pkgs.wallabag}/web;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
locations."~ \.php$" = {
|
||||||
|
extraConfig = ''
|
||||||
|
return 404;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
# Ensure the database, user, and permissions always exist
|
||||||
|
ensureDatabases = [ "wallabag" ];
|
||||||
|
ensureUsers = [
|
||||||
|
{ name = "wallabag";
|
||||||
|
ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
services.phpfpm.pools."${phppoolName}" = {
|
||||||
|
user = "wallabag";
|
||||||
|
group = "wallabag";
|
||||||
|
phpEnv."WALLABAG_DATA" = "/var/lib/wallabag";
|
||||||
|
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
|
||||||
|
settings = {
|
||||||
|
"listen.owner" = "nginx";
|
||||||
|
"listen.group" = "nginx";
|
||||||
|
"user" = "wallabag";
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"pm.max_children" = "75";
|
||||||
|
"pm.min_spare_servers" = "5";
|
||||||
|
"pm.max_spare_servers" = "20";
|
||||||
|
"pm.max_requests" = "10";
|
||||||
|
"catch_workers_output" = "1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.wallabag-install = {
|
||||||
|
description = "Wallabag install service";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
before = [ "phpfpm-wallabag.service" ];
|
||||||
|
after = [ "mysql.service" "postgresql.service" ];
|
||||||
|
path = [ pkgs.coreutils pkgs.php73 pkgs.php73Packages.composer ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
User = "wallabag";
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = "yes";
|
||||||
|
PermissionsStartOnly = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
preStart = ''
|
||||||
|
mkdir -p "${dataDir}"
|
||||||
|
chown wallabag:nginx "${dataDir}"
|
||||||
|
'';
|
||||||
|
|
||||||
|
script = ''
|
||||||
|
echo "Setting up wallabag files in ${dataDir} ..."
|
||||||
|
cd "${dataDir}"
|
||||||
|
|
||||||
|
rm -rf var/cache/*
|
||||||
|
rm -f ${dataDir}/app
|
||||||
|
rm -f ${dataDir}/bin
|
||||||
|
ln -sf ${pkgs.wallabag}/app app
|
||||||
|
ln -sf ${pkgs.wallabag}/composer.{json,lock} .
|
||||||
|
ln -sf ${pkgs.wallabag}/bin/ bin
|
||||||
|
|
||||||
|
export WALLABAG_DATA="${dataDir}"
|
||||||
|
if [ ! -f installed ]; then
|
||||||
|
php /var/lib/wallabag/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction
|
||||||
|
php /var/lib/wallabag/bin/console --env=prod doctrine:migrations:migrate --no-interaction
|
||||||
|
# Until https://github.com/wallabag/wallabag/issues/3662 is fixed
|
||||||
|
yes no | php /var/lib/wallabag/bin/console --env=prod wallabag:install
|
||||||
|
touch installed
|
||||||
|
else
|
||||||
|
php ${pkgs.wallabag}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
|
||||||
|
fi
|
||||||
|
php ${pkgs.wallabag}/bin/console --env=prod cache:clear
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
users.extraUsers.wallabag = { group = "wallabag"; };
|
||||||
|
users.extraGroups.wallabag = { };
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 800 ];
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue