fixed organization, added nix files from bowl
This commit is contained in:
		
							parent
							
								
									6446ab7ce4
								
							
						
					
					
						commit
						8af4b6faf9
					
				|  | @ -1,147 +0,0 @@ | ||||||
| # Edit this configuration file to define what should be installed on |  | ||||||
| # your system.  Help is available in the configuration.nix(5) man page |  | ||||||
| # and in the NixOS manual (accessible by running ‘nixos-help’). |  | ||||||
| 
 |  | ||||||
| { config, pkgs, ... }: |  | ||||||
| 
 |  | ||||||
| { |  | ||||||
|   imports = |  | ||||||
|     [ # Include the results of the hardware scan. |  | ||||||
|       ./hardware-configuration.nix |  | ||||||
|       ./common.nix |  | ||||||
|       ./box.nix |  | ||||||
|     ]; |  | ||||||
|      |  | ||||||
|   # Use the GRUB 2 boot loader. |  | ||||||
|   boot.loader.efi.canTouchEfiVariables = true; |  | ||||||
|   boot.loader.efi.efiSysMountPoint = "/boot/efi"; |  | ||||||
|   boot.loader.grub = { |  | ||||||
|     enable = true; |  | ||||||
|     device = "nodev"; |  | ||||||
|     version = 2; |  | ||||||
|     efiSupport = true; |  | ||||||
|     enableCryptodisk = true; |  | ||||||
|   }; |  | ||||||
|    |  | ||||||
|   boot.initrd.secrets = { |  | ||||||
|     "/keyfile0.bin" = /etc/secrets/initrd/keyfile0.bin; |  | ||||||
|     "/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   boot.initrd.luks.devices = { |  | ||||||
|     "root" = {  |  | ||||||
|       #name = "root"; |  | ||||||
|       device = "/dev/disk/by-uuid/f37f3222-47d7-42d8-b400-363320a31853"; # UUID for /dev/nvme01np2  |  | ||||||
|       preLVM = true; |  | ||||||
|       allowDiscards = true; |  | ||||||
|       keyFile = "/keyfile0.bin"; |  | ||||||
|     }; |  | ||||||
| 	}; |  | ||||||
| 
 |  | ||||||
|   # Data mount |  | ||||||
|   fileSystems."/data" = { |  | ||||||
|     device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; # UUID for /dev/mapper/crypted-data |  | ||||||
|     encrypted = { |  | ||||||
|       enable = true; |  | ||||||
|       label = "crypted-data"; |  | ||||||
|       blkDev = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; # UUID for /dev/sda1 |  | ||||||
|       keyFile = "/keyfile1.bin"; |  | ||||||
|     }; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   # boot.loader.grub.efiInstallAsRemovable = true; |  | ||||||
|   # boot.loader.efi.efiSysMountPoint = "/boot/efi"; |  | ||||||
|   # Define on which hard drive you want to install Grub. |  | ||||||
|   # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only |  | ||||||
| 
 |  | ||||||
|   networking.hostName = "box"; # Define your hostname. |  | ||||||
|   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant. |  | ||||||
| 
 |  | ||||||
|   # The global useDHCP flag is deprecated, therefore explicitly set to false here. |  | ||||||
|   # Per-interface useDHCP will be mandatory in the future, so this generated config |  | ||||||
|   # replicates the default behaviour. |  | ||||||
|   networking.useDHCP = false; |  | ||||||
|   networking.interfaces.enp0s31f6.useDHCP = true; |  | ||||||
|   networking.interfaces.enp3s0.useDHCP = true; |  | ||||||
|   networking.interfaces.wlp4s0.useDHCP = true; |  | ||||||
| 
 |  | ||||||
|   # OpenVPN |  | ||||||
|   services.openvpn.servers = { |  | ||||||
|     officeVPN =  |  | ||||||
|     { config = ''  |  | ||||||
|         config /home/anish/usr/work/ThreatDefence/vpn/anishcarbon19.ovpn '';  |  | ||||||
|         autoStart = false; |  | ||||||
|         updateResolvConf = true; |  | ||||||
|     }; |  | ||||||
|   }; |  | ||||||
|   # Configure network proxy if necessary |  | ||||||
|   # networking.proxy.default = "http://user:password@proxy:port/"; |  | ||||||
|   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; |  | ||||||
| 
 |  | ||||||
|   # Select internationalisation properties. |  | ||||||
|   # i18n = { |  | ||||||
|   #   consoleFont = "Lat2-Terminus16"; |  | ||||||
|   #   consoleKeyMap = "us"; |  | ||||||
|   #   defaultLocale = "en_US.UTF-8"; |  | ||||||
|   # }; |  | ||||||
| 
 |  | ||||||
|   # Set your time zone. |  | ||||||
|   # time.timeZone = "Europe/Amsterdam"; |  | ||||||
| 
 |  | ||||||
|   # List packages installed in system profile. To search, run: |  | ||||||
|   # $ nix search wget |  | ||||||
|   # environment.systemPackages = with pkgs; [ |  | ||||||
|   #   wget vim |  | ||||||
|   # ]; |  | ||||||
| 
 |  | ||||||
|   # Some programs need SUID wrappers, can be configured further or are |  | ||||||
|   # started in user sessions. |  | ||||||
|   # programs.mtr.enable = true; |  | ||||||
|   # programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; |  | ||||||
| 
 |  | ||||||
|   # List services that you want to enable: |  | ||||||
| 
 |  | ||||||
|   # Enable the OpenSSH daemon. |  | ||||||
|   services.openssh.enable = true; |  | ||||||
|   services.openssh.permitRootLogin = "yes"; |  | ||||||
| 
 |  | ||||||
|   # Open ports in the firewall. |  | ||||||
|   # networking.firewall.allowedTCPPorts = [ ... ]; |  | ||||||
|   # networking.firewall.allowedUDPPorts = [ ... ]; |  | ||||||
|   # Or disable the firewall altogether. |  | ||||||
|   # networking.firewall.enable = false; |  | ||||||
| 
 |  | ||||||
|   # Enable CUPS to print documents. |  | ||||||
|   # services.printing.enable = true; |  | ||||||
| 
 |  | ||||||
|   # Enable sound. |  | ||||||
|   sound.enable = true; |  | ||||||
|   # hardware.pulseaudio.enable = true; |  | ||||||
| 
 |  | ||||||
|   # Enable the X11 windowing system. |  | ||||||
|   # services.xserver.enable = true; |  | ||||||
|   # services.xserver.layout = "us"; |  | ||||||
|   # services.xserver.xkbOptions = "eurosign:e"; |  | ||||||
| 
 |  | ||||||
|   # Enable touchpad support. |  | ||||||
|   # services.xserver.libinput.enable = true; |  | ||||||
| 
 |  | ||||||
|   # Enable the KDE Desktop Environment. |  | ||||||
|   # services.xserver.displayManager.sddm.enable = true; |  | ||||||
|   # services.xserver.desktopManager.plasma5.enable = true; |  | ||||||
| 
 |  | ||||||
|   # Define a user account. Don't forget to set a password with ‘passwd’. |  | ||||||
|   users.users.anish = { |  | ||||||
|     isNormalUser = true; |  | ||||||
|     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. |  | ||||||
|     hashedPassword = "MO0Pbd2O4eIlA"; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   # This value determines the NixOS release with which your system is to be |  | ||||||
|   # compatible, in order to avoid breaking some software such as database |  | ||||||
|   # servers. You should change this only after NixOS release notes say you |  | ||||||
|   # should. |  | ||||||
|   system.stateVersion = "19.09"; # Did you read the comment? |  | ||||||
| 
 |  | ||||||
| } |  | ||||||
| 
 |  | ||||||
|  | @ -1,32 +0,0 @@ | ||||||
| # Do not modify this file!  It was generated by ‘nixos-generate-config’ |  | ||||||
| # and may be overwritten by future invocations.  Please make changes |  | ||||||
| # to /etc/nixos/configuration.nix instead. |  | ||||||
| { config, lib, pkgs, ... }: |  | ||||||
| 
 |  | ||||||
| { |  | ||||||
|   imports = |  | ||||||
|     [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> |  | ||||||
|     ]; |  | ||||||
| 
 |  | ||||||
|   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ]; |  | ||||||
|   boot.initrd.kernelModules = [ "dm-snapshot" ]; |  | ||||||
|   boot.kernelModules = [ "kvm-intel" ]; |  | ||||||
|   boot.extraModulePackages = [ ]; |  | ||||||
| 
 |  | ||||||
|   fileSystems."/" = |  | ||||||
|     { device = "/dev/disk/by-uuid/ade0752d-84d3-4e39-865b-9027ba2d5c67"; |  | ||||||
|       fsType = "ext4"; |  | ||||||
|     }; |  | ||||||
| 
 |  | ||||||
|   fileSystems."/boot/efi" = |  | ||||||
|     { device = "/dev/disk/by-uuid/1715-278E"; |  | ||||||
|       fsType = "vfat"; |  | ||||||
|     }; |  | ||||||
| 
 |  | ||||||
|   swapDevices = |  | ||||||
|     [ { device = "/dev/disk/by-uuid/b790abb4-ba5f-4476-8f09-b0fc575414aa"; } |  | ||||||
|     ]; |  | ||||||
| 
 |  | ||||||
|   nix.maxJobs = lib.mkDefault 4; |  | ||||||
|   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; |  | ||||||
| } |  | ||||||
							
								
								
									
										74
									
								
								machines/bowl.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										74
									
								
								machines/bowl.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,74 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | { | ||||||
|  | imports = | ||||||
|  |         [ # Include the results of the hardware scan. | ||||||
|  |           ./hardware-configuration.nix | ||||||
|  |           ./taskd.nix | ||||||
|  | 	  ./nextcloud.nix | ||||||
|  | 	  ./networking.nix | ||||||
|  | #	  ./wireguard.nix | ||||||
|  | #	  ./shiori.nix | ||||||
|  | 	  ./shaarli.nix | ||||||
|  | #	  ./shaarli-tokudan.nix | ||||||
|  | #	  ./mod-wallabag.nix | ||||||
|  | #	  ./pkg-wallabag.nix | ||||||
|  | 	  ./navidrome.nix | ||||||
|  | 	  ./pkg-navidrome.nix | ||||||
|  | #	  ./wallabag.nix | ||||||
|  | 	  ./headphones.nix | ||||||
|  | 	  ./dns.nix | ||||||
|  | 	  ./backup.nix | ||||||
|  | 	  ./monitoring.nix | ||||||
|  |         ]; | ||||||
|  | 
 | ||||||
|  |                 boot.loader.grub.devices = [ "/dev/sda" ]; | ||||||
|  |                 boot.loader.grub.enable = true; | ||||||
|  |                 boot.loader.grub.version = 2; | ||||||
|  |                 boot.loader.grub.enableCryptodisk = true; | ||||||
|  |                 boot.loader.supportsInitrdSecrets = true; | ||||||
|  |          | ||||||
|  |                 boot.initrd.kernelModules = [ "dm-snapshot" ]; | ||||||
|  |                 boot.initrd.availableKernelModules = ["virtio-pci"]; | ||||||
|  |                 boot.initrd.network = { | ||||||
|  |                   enable = true; | ||||||
|  |                   ssh = { | ||||||
|  |                     enable = true; | ||||||
|  |                     port = 2222; | ||||||
|  |                     authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box | ||||||
|  | "]; | ||||||
|  |                     hostKeys = [ "/host_ecdsa_key" ]; | ||||||
|  |                     }; | ||||||
|  |                 }; | ||||||
|  |          | ||||||
|  |                 boot.initrd.luks.devices = { | ||||||
|  |                   "enc-pv" = { | ||||||
|  |                     name = "enc-pv"; | ||||||
|  |                     preLVM = true; | ||||||
|  |                     device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c"; | ||||||
|  |                     allowDiscards = true; | ||||||
|  |                   }; | ||||||
|  |                 }; | ||||||
|  |          | ||||||
|  |                 boot.initrd.secrets = { | ||||||
|  |                   "/host_ecdsa_key" = "/host_ecdsa_key"; | ||||||
|  |                   }; | ||||||
|  |          | ||||||
|  | 
 | ||||||
|  |         boot.cleanTmpDir = true; | ||||||
|  |         boot.kernelModules = [ "dm-snapshot" ]; | ||||||
|  | 
 | ||||||
|  | 	users.users.anish = { | ||||||
|  | 		isNormalUser = true; | ||||||
|  | 		extraGroups = [ "wheel" ]; | ||||||
|  | 		hashedPassword = "MO0Pbd2O4eIlA"; | ||||||
|  | 		openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ]; | ||||||
|  | 	}; | ||||||
|  | 
 | ||||||
|  |         users.users.root.initialHashedPassword = ""; | ||||||
|  |         services.openssh.permitRootLogin = "prohibit-password"; | ||||||
|  |         networking.hostName = "bowl"; | ||||||
|  |         services.openssh.enable = true; | ||||||
|  |         services.logind.lidSwitch = "ignore"; | ||||||
|  | 	system.stateVersion = "20.09"; | ||||||
|  | 	time.timeZone = "Australia/Brisbane"; | ||||||
|  | } | ||||||
							
								
								
									
										34
									
								
								modules/backup.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										34
									
								
								modules/backup.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,34 @@ | ||||||
|  | { | ||||||
|  |   # Assumes the remote borg backup server has already been initialized | ||||||
|  |   # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive> | ||||||
|  |   services.borgbackup.jobs = { | ||||||
|  |     backupTaskwarriorRsync = { | ||||||
|  |       paths = [ "/var/lib/taskserver" ]; | ||||||
|  |       doInit = true; | ||||||
|  |       repo =  "20779@hk-s020.rsync.net:taskwarrior" ; | ||||||
|  |       encryption = { | ||||||
|  |         mode = "repokey-blake2"; | ||||||
|  |         passCommand = "cat /run/keys/rsync"; | ||||||
|  |       }; | ||||||
|  |       environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; | ||||||
|  |       compression = "auto,lzma"; | ||||||
|  |       startAt = "weekly"; | ||||||
|  |       extraArgs = "--remote-path=borg1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   services.borgbackup.jobs = { | ||||||
|  |     backupShaarliRsync = { | ||||||
|  |       paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ]; | ||||||
|  |       doInit = true; | ||||||
|  |       repo =  "20779@hk-s020.rsync.net:shaarli" ; | ||||||
|  |       encryption = { | ||||||
|  |         mode = "repokey-blake2"; | ||||||
|  |         passCommand = "cat /run/keys/rsync"; | ||||||
|  |       }; | ||||||
|  |       environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; | ||||||
|  |       compression = "auto,lzma"; | ||||||
|  |       startAt = "weekly"; | ||||||
|  |       extraArgs = "--remote-path=borg1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										11
									
								
								modules/dns.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										11
									
								
								modules/dns.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,11 @@ | ||||||
|  | { config, pkgs, lib, ... }: | ||||||
|  | { | ||||||
|  |   services.dnsmasq.enable = true; | ||||||
|  |   services.dnsmasq.extraConfig = '' | ||||||
|  |       address=/.mossnet.lan/192.168.1.6 | ||||||
|  |       dhcp-range=192.168.1.1,proxy | ||||||
|  |     ''; | ||||||
|  |   services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 53 ]; | ||||||
|  |   networking.firewall.allowedUDPPorts = [ 53 ]; | ||||||
|  | } | ||||||
							
								
								
									
										12
									
								
								modules/headphones.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										12
									
								
								modules/headphones.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,12 @@ | ||||||
|  | {config, lib, pkgs, ... }: | ||||||
|  | { | ||||||
|  |   services.headphones = { | ||||||
|  |     enable = true; | ||||||
|  |     host = "192.168.1.6"; | ||||||
|  |     port = 8181; | ||||||
|  |     user = "headphones"; | ||||||
|  |     group = "headphones"; | ||||||
|  |     dataDir = "/data/downloaded"; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 8181 ]; | ||||||
|  | } | ||||||
							
								
								
									
										80
									
								
								modules/mod-shaarli.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										80
									
								
								modules/mod-shaarli.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,80 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   phppoolName = "shaarli"; | ||||||
|  |   dataDir = "/var/lib/shaarli"; | ||||||
|  |   vhost = "192.168.1.6:1233"; | ||||||
|  | 
 | ||||||
|  |   shaarli = pkgs.callPackage ./pkg-shaarli.nix { | ||||||
|  |     inherit dataDir; | ||||||
|  |   }; | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   services.nginx.virtualHosts."${vhost}" = { | ||||||
|  |     forceSSL = false; | ||||||
|  |     enableACME = false; | ||||||
|  |     root = "${shaarli}"; | ||||||
|  |     listen = [ { addr = "192.168.1.6"; port = 1233; } ]; | ||||||
|  |    # extraConfig = '' | ||||||
|  |    #   index index.php; | ||||||
|  |    #   ''; | ||||||
|  |     locations."/" = { | ||||||
|  |       index = "index.php"; | ||||||
|  |       extraConfig = '' | ||||||
|  |         try_files $uri $uri/ index.php; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  |     locations."~ (index)\.php$" = { | ||||||
|  |       extraConfig = '' | ||||||
|  |         fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  |         if (!-f $document_root$fastcgi_script_name) { | ||||||
|  |         return 404; | ||||||
|  |         } | ||||||
|  | 
 | ||||||
|  |         include ${pkgs.nginx}/conf/fastcgi.conf; | ||||||
|  |         fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket}; | ||||||
|  |         fastcgi_index index.php; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  |     locations."~ \.php$" = { | ||||||
|  |       extraConfig = '' | ||||||
|  |         deny all; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   services.phpfpm.pools."${phppoolName}" = { | ||||||
|  |     user = "nginx"; | ||||||
|  |     group = "nginx"; | ||||||
|  |     settings = { | ||||||
|  |       "listen.owner" = "nginx"; | ||||||
|  |       "listen.group" = "nginx"; | ||||||
|  |       "user" = "nginx"; | ||||||
|  |       "pm" = "dynamic"; | ||||||
|  |       "pm.max_children" = "75"; | ||||||
|  |       "pm.min_spare_servers" = "5"; | ||||||
|  |       "pm.max_spare_servers" = "20"; | ||||||
|  |       "pm.max_requests" = "10"; | ||||||
|  |       "catch_workers_output" = "1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   users.extraUsers.shaarli = { group = "shaarli"; }; | ||||||
|  |   users.extraGroups.shaarli = { }; | ||||||
|  |   systemd.services.shaarli-install = { | ||||||
|  |     serviceConfig.Type = "oneshot"; | ||||||
|  |     wantedBy = [ "multi-user.target" ]; | ||||||
|  |     script = '' | ||||||
|  |       if [ ! -d "${dataDir}" ]; then | ||||||
|  |         mkdir -p ${dataDir}/{cache,data,pagecache,tmp} | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/ | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/ | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/ | ||||||
|  |       fi | ||||||
|  |       chown -Rc nginx:nginx ${dataDir} | ||||||
|  |       find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; | ||||||
|  |       find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; | ||||||
|  |     ''; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 1233 ]; | ||||||
|  | } | ||||||
							
								
								
									
										263
									
								
								modules/mod-wallabag.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										263
									
								
								modules/mod-wallabag.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,263 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | let | ||||||
|  |   cfg = config.services.wallabag; | ||||||
|  | 
 | ||||||
|  |   poolName = "wallabag"; | ||||||
|  | 
 | ||||||
|  |   phpfpmSocketName = "/var/run/phpfpm/${poolName}.sock"; | ||||||
|  | 
 | ||||||
|  |   configFile = pkgs.writeTextFile { | ||||||
|  |     name = "wallabag-config"; | ||||||
|  |     text = cfg.conf; | ||||||
|  |     destination = "/config/parameters.yml"; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   appDir = pkgs.buildEnv { | ||||||
|  |     name = "wallabag-app-dir"; | ||||||
|  |     ignoreCollisions = true; | ||||||
|  |     checkCollisionContents = false; | ||||||
|  |     paths = [ configFile "${cfg.package}/app" ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  | in { | ||||||
|  |   options = { | ||||||
|  |     services.wallabag = { | ||||||
|  |       enable = mkEnableOption "wallabag"; | ||||||
|  | 
 | ||||||
|  |       user = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "nginx"; | ||||||
|  |         description = '' | ||||||
|  |           User account under which both the update daemon and the web-application run. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       dataDir = mkOption { | ||||||
|  |         type = types.path; | ||||||
|  |         default = "/var/www/wallabag"; | ||||||
|  |         description = '' | ||||||
|  |           Data directory. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       package = mkOption { | ||||||
|  |         type = types.package; | ||||||
|  |         default = pkgs.wallabag; | ||||||
|  |         description = '' | ||||||
|  |           Wallabag package to use. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       hostName = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         description = '' | ||||||
|  |           Name of the nginx virtualhost to use and setup. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       poolConfig = mkOption { | ||||||
|  |         type = types.lines; | ||||||
|  |         default = '' | ||||||
|  |           pm = dynamic | ||||||
|  |           pm.max_children = 75 | ||||||
|  |           pm.start_servers = 1 | ||||||
|  |           pm.min_spare_servers = 1 | ||||||
|  |           pm.max_spare_servers = 20 | ||||||
|  |           pm.max_requests = 500 | ||||||
|  |           catch_workers_output = 1 | ||||||
|  |         ''; | ||||||
|  |         description = '' | ||||||
|  |           Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       conf = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  | 	default = '' | ||||||
|  | parameters: | ||||||
|  |     database_driver: pdo_pgsql | ||||||
|  |     database_driver_class: Wallabag\CoreBundle\Doctrine\DBAL\Driver\CustomPostgreSQLDriver | ||||||
|  |     database_host: 127.0.0.1 | ||||||
|  |     database_port: ~ | ||||||
|  |     database_name: wallabag | ||||||
|  |     database_user: wallabag | ||||||
|  |     database_password: ~ | ||||||
|  |     # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite" | ||||||
|  |     database_path: null | ||||||
|  |     database_table_prefix: wallabag_ | ||||||
|  |     database_socket: null | ||||||
|  |     # with PostgreSQL and SQLite, you must set "utf8" | ||||||
|  |     database_charset: utf8 | ||||||
|  | 
 | ||||||
|  |     domain_name: http://192.168.1.6:8080 | ||||||
|  | 
 | ||||||
|  |     mailer_transport:  smtp | ||||||
|  |     mailer_user:       ~ | ||||||
|  |     mailer_password:   ~ | ||||||
|  |     mailer_host:       127.0.0.1 | ||||||
|  |     mailer_port:       false | ||||||
|  |     mailer_encryption: ~ | ||||||
|  |     mailer_auth_mode:  ~ | ||||||
|  |     locale: en | ||||||
|  |     # A secret key that's used to generate certain security-related tokens | ||||||
|  |     secret: sateofg893964crfSTNFG"*(&@$091 | ||||||
|  |     twofactor_auth: true | ||||||
|  |     twofactor_sender: no-reply@wallabag.org | ||||||
|  |     fosuser_registration: true | ||||||
|  |     fosuser_confirmation: true | ||||||
|  |     fos_oauth_server_access_token_lifetime: 3600 | ||||||
|  |     fos_oauth_server_refresh_token_lifetime: 1209600 | ||||||
|  |     from_email: no-reply@wallabag.org | ||||||
|  |     rss_limit: 50 | ||||||
|  |     rabbitmq_host: localhost | ||||||
|  |     rabbitmq_port: 5672 | ||||||
|  |     rabbitmq_user: ~ | ||||||
|  |     rabbitmq_password: ~ | ||||||
|  |     rabbitmq_prefetch_count: 0 | ||||||
|  |     redis_scheme: tcp | ||||||
|  |     redis_host: localhost | ||||||
|  |     redis_port: 6379 | ||||||
|  |     redis_path: ~ | ||||||
|  |     redis_password: ~ | ||||||
|  |     sentry_dsn: ~ | ||||||
|  | ''; | ||||||
|  |         description = '' | ||||||
|  |           Contents of the wallabag configuration file (parameters.yml) | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  | 
 | ||||||
|  |     services.phpfpm.pools."${poolName}" = { | ||||||
|  |         user = "${cfg.user}"; | ||||||
|  |         group = "nginx"; | ||||||
|  | 	settings = {  | ||||||
|  | 		"listen" = "${phpfpmSocketName}"; | ||||||
|  | 		"listen.owner" = "nginx"; | ||||||
|  | 		"listen.group" = "nginx"; | ||||||
|  | 		"listen.mode" = "0600"; | ||||||
|  |         	"env[WALLABAG_DATA]" = "${cfg.dataDir}"; | ||||||
|  | 	        "pm" = "dynamic"; | ||||||
|  | 	        "pm.max_children" = "75"; | ||||||
|  | 	        "pm.min_spare_servers" = "5"; | ||||||
|  | 	        "pm.max_spare_servers" = "20"; | ||||||
|  | 	        "pm.max_requests" = "10"; | ||||||
|  | 	        "catch_workers_output" = "1"; | ||||||
|  | 	}; | ||||||
|  |     }; | ||||||
|  |     services.phpfpm.phpOptions = '' | ||||||
|  |       max_execution_time = 120 | ||||||
|  |     ''; | ||||||
|  | 
 | ||||||
|  |     services.nginx.enable = mkDefault true; | ||||||
|  | 
 | ||||||
|  |     services.nginx.virtualHosts."${cfg.hostName}" = { | ||||||
|  |       root = "${cfg.package}/web"; | ||||||
|  |     listen = [ { addr = "192.168.1.6"; port = 8080; } ]; | ||||||
|  | 
 | ||||||
|  |       extraConfig = '' | ||||||
|  |         add_header X-Frame-Options SAMEORIGIN; | ||||||
|  |         add_header X-Content-Type-Options nosniff; | ||||||
|  |         add_header X-XSS-Protection "1; mode=block"; | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       locations."/" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           try_files $uri /app.php$is_args$args; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       locations."/assets".root = "${cfg.dataDir}/web"; | ||||||
|  | 
 | ||||||
|  |       locations."~ ^/app\\.php(/|$)" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           fastcgi_pass unix:${phpfpmSocketName}; | ||||||
|  |           fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  |           include ${pkgs.nginx}/conf/fastcgi_params; | ||||||
|  | 
 | ||||||
|  |           fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name; | ||||||
|  |           fastcgi_param DOCUMENT_ROOT ${cfg.package}/web; | ||||||
|  |           fastcgi_read_timeout 120; | ||||||
|  | 
 | ||||||
|  |           internal; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       locations."~ /(?!app)\\.php$" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           return 404; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |   services.postgresql = { | ||||||
|  |     enable = true; | ||||||
|  | 
 | ||||||
|  |     # Ensure the database, user, and permissions always exist | ||||||
|  |     ensureDatabases = [ "wallabag" "wallabag_user" ]; | ||||||
|  |     authentication = lib.mkForce '' | ||||||
|  |     # Generated file; do not edit! | ||||||
|  |     # TYPE  DATABASE        USER            ADDRESS                 METHOD | ||||||
|  |     local   all             all                                     trust | ||||||
|  |     host    all             wallabag        127.0.0.1/32            trust | ||||||
|  |     ''; | ||||||
|  |     ensureUsers = [ | ||||||
|  |      { name = "wallabag"; | ||||||
|  |        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES"; | ||||||
|  |        ensurePermissions."DATABASE wallabag_user" = "ALL PRIVILEGES"; | ||||||
|  |      } | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |     systemd.services.wallabag-install = { | ||||||
|  |       description = "Wallabag install service"; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       before = [ "phpfpm-wallabag.service" ]; | ||||||
|  |       after = [ "mysql.service" "postgresql.service" ]; | ||||||
|  |       path = with pkgs; [ coreutils php72 php72Packages.composer ]; | ||||||
|  | 
 | ||||||
|  |       serviceConfig = { | ||||||
|  |         User = cfg.user; | ||||||
|  |         Type = "oneshot"; | ||||||
|  |         RemainAfterExit = "yes"; | ||||||
|  |         PermissionsStartOnly = true; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       preStart = '' | ||||||
|  |         mkdir -p "${cfg.dataDir}" | ||||||
|  |         chown ${cfg.user}:nginx "${cfg.dataDir}" | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       script = '' | ||||||
|  |         echo "Setting up wallabag files in ${cfg.dataDir} ..." | ||||||
|  |         cd "${cfg.dataDir}" | ||||||
|  | 
 | ||||||
|  |         rm -rf var/cache/* | ||||||
|  |         rm -f app | ||||||
|  |         ln -sf ${appDir} app | ||||||
|  |         ln -sf ${cfg.package}/composer.{json,lock} . | ||||||
|  | 
 | ||||||
|  |         export WALLABAG_DATA="${cfg.dataDir}" | ||||||
|  |         if [ ! -f installed ]; then | ||||||
|  |           php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction | ||||||
|  |           #php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction | ||||||
|  |           # Until https://github.com/wallabag/wallabag/issues/3662 is fixed | ||||||
|  |           yes no | php ${cfg.package}/bin/console --env=prod wallabag:install | ||||||
|  |           touch installed | ||||||
|  |         else | ||||||
|  |           php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction | ||||||
|  |         fi | ||||||
|  |         php ${cfg.package}/bin/console --env=prod cache:clear | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   meta = with stdenv.lib; { | ||||||
|  |     maintainers = with maintainers; [ chickensoupwithrice ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										53
									
								
								modules/monitoring.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										53
									
								
								modules/monitoring.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,53 @@ | ||||||
|  | { config, pkgs, ... }: { | ||||||
|  |   # grafana configuration | ||||||
|  |   services.grafana = { | ||||||
|  |     enable = true; | ||||||
|  |     domain = "grafana.mossnet.lan"; | ||||||
|  |     port = 2342; | ||||||
|  |     addr = "127.0.0.1"; | ||||||
|  |   }; | ||||||
|  |    | ||||||
|  |   # nginx reverse proxy | ||||||
|  |   services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||||
|  |     locations."/" = { | ||||||
|  |         proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||||
|  |         proxyWebsockets = true; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.prometheus = { | ||||||
|  |     enable = true; | ||||||
|  |     port = 9001; | ||||||
|  |     exporters = { | ||||||
|  |       node = { | ||||||
|  | 	enable = true; | ||||||
|  | 	enabledCollectors = [ "systemd" ]; | ||||||
|  | 	port = 9002; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |     scrapeConfigs = [ | ||||||
|  |       { | ||||||
|  | 	job_name = "bowl"; | ||||||
|  | 	static_configs = [{ | ||||||
|  | 	  targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; | ||||||
|  | 	}]; | ||||||
|  |       } | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.loki = { | ||||||
|  |     enable = true; | ||||||
|  |     configFile = /var/loki-config.yaml; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   systemd.services.promtail = { | ||||||
|  |     description = "Promtail service for Loki"; | ||||||
|  |     wantedBy = [ "multi-user.target" ]; | ||||||
|  | 
 | ||||||
|  |     serviceConfig = { | ||||||
|  |       ExecStart = '' | ||||||
|  |         ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										101
									
								
								modules/navidrome.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										101
									
								
								modules/navidrome.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,101 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   cfg = config.services.navidrome; | ||||||
|  |   configFile = "/etc/navidrome/settings.json"; | ||||||
|  |   dataFolder = "/var/lib/navidrome"; | ||||||
|  | in { | ||||||
|  |   options = { | ||||||
|  | 
 | ||||||
|  |     services.navidrome = { | ||||||
|  |       enable = mkEnableOption "Navidrome music server and streamer"; | ||||||
|  | 
 | ||||||
|  |       settings = lib.mkOption { | ||||||
|  |         type = with types; attrsOf (oneOf [ int str ]); | ||||||
|  |         default = {}; | ||||||
|  |         example = literalExample '' | ||||||
|  |           { | ||||||
|  |             LogLevel = "INFO"; | ||||||
|  |             BaseURL = "/music"; | ||||||
|  |             ScanInterval = "10s"; | ||||||
|  |             TranscodingCacheSize = "15MB"; | ||||||
|  |             MusicFolder = "/data/music"; | ||||||
|  |           }; | ||||||
|  |         ''; | ||||||
|  |         description = '' | ||||||
|  |           Configuration for Navidrome, see <link xlink:href="https://www.navidrome.org/docs/usage/configuration-options/"/> for supported values. | ||||||
|  |       ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       user = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "navidrome"; | ||||||
|  |         description = "User account under which Navidrome runs."; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       group = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "navidrome"; | ||||||
|  |         description = "Group account under which Navidrome runs."; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  | 
 | ||||||
|  |     environment.etc."navidrome/settings.json".text = builtins.toJSON cfg.settings; | ||||||
|  | 
 | ||||||
|  |     services.navidrome.settings = { | ||||||
|  |       DataFolder = dataFolder; | ||||||
|  |       ConfigFile = configFile; | ||||||
|  |     }; | ||||||
|  |      | ||||||
|  |     systemd.services.navidrome = { | ||||||
|  |       description = "Navidrome Music Server and Streamer compatible with Subsonic/Airsonic"; | ||||||
|  |       after = [ "remote-fs.target" "network.target" ]; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       environment = { | ||||||
|  |         ND_CONFIGFILE = configFile; | ||||||
|  |       }; | ||||||
|  |       serviceConfig = { | ||||||
|  |         ExecStart = "${pkgs.navidrome}/bin/navidrome"; | ||||||
|  |         WorkingDirectory = dataFolder; | ||||||
|  |         TimeoutStopSec = "20"; | ||||||
|  |         KillMode = "process"; | ||||||
|  |         Restart = "on-failure"; | ||||||
|  |         User = cfg.user; | ||||||
|  |         Group = cfg.group; | ||||||
|  |         DevicePolicy = "closed"; | ||||||
|  |         NoNewPrivileges= " yes"; | ||||||
|  |         PrivateTmp = "yes"; | ||||||
|  |         PrivateUsers = "yes"; | ||||||
|  |         ProtectControlGroups = "yes"; | ||||||
|  |         ProtectKernelModules = "yes"; | ||||||
|  |         ProtectKernelTunables = "yes"; | ||||||
|  |         RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6"; | ||||||
|  |         RestrictNamespaces = "yes"; | ||||||
|  |         RestrictRealtime = "yes"; | ||||||
|  |         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; | ||||||
|  |         ReadWritePaths = dataFolder; | ||||||
|  |         StateDirectory = baseNameOf dataFolder; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     users.users = optionalAttrs (cfg.user == "navidrome") ({ | ||||||
|  |       navidrome = { | ||||||
|  |         description = "Navidrome service user"; | ||||||
|  |         name = cfg.user; | ||||||
|  |         group = cfg.group; | ||||||
|  |         isSystemUser = true; | ||||||
|  |       }; | ||||||
|  |     }); | ||||||
|  | 
 | ||||||
|  |     users.groups = optionalAttrs (cfg.group == "navidrome") ({ | ||||||
|  |       navidrome = {}; | ||||||
|  |     }); | ||||||
|  |      | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										52
									
								
								modules/nextcloud.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										52
									
								
								modules/nextcloud.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,52 @@ | ||||||
|  | { pkgs, config, ... }: | ||||||
|  | { | ||||||
|  |   services.nextcloud = { | ||||||
|  |     enable = true; | ||||||
|  |     hostName = "mossnet.lan"; | ||||||
|  |     #home = "/data/nextcloud"; | ||||||
|  | 
 | ||||||
|  |     # Use HTTPS for links | ||||||
|  |     https = false; | ||||||
|  |      | ||||||
|  |     # Auto-update Nextcloud Apps | ||||||
|  |     autoUpdateApps.enable = true; | ||||||
|  |     # Set what time makes sense for you | ||||||
|  |     autoUpdateApps.startAt = "05:00:00"; | ||||||
|  | 
 | ||||||
|  |     config = { | ||||||
|  |       # Further forces Nextcloud to use HTTPS | ||||||
|  |       # overwriteProtocol = "https"; | ||||||
|  | 
 | ||||||
|  |       # Nextcloud PostegreSQL database configuration, recommended over using SQLite | ||||||
|  |       dbtype = "pgsql"; | ||||||
|  |       dbuser = "nextcloud"; | ||||||
|  |       dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself | ||||||
|  |       dbname = "nextcloud"; | ||||||
|  |       dbpassFile = "/var/nextcloud-db-pass"; | ||||||
|  | 
 | ||||||
|  |       adminpassFile = "/var/nextcloud-admin-pass"; | ||||||
|  |       adminuser = "admin"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   # Enable PostgreSQL  | ||||||
|  |   services.postgresql = { | ||||||
|  |     enable = true; | ||||||
|  | 
 | ||||||
|  |     # Ensure the database, user, and permissions always exist | ||||||
|  |     ensureDatabases = [ "nextcloud" ]; | ||||||
|  |     ensureUsers = [ | ||||||
|  |      { name = "nextcloud"; | ||||||
|  |        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES"; | ||||||
|  |      } | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   # Ensure that postgres is running before running the setup | ||||||
|  |   systemd.services."nextcloud-setup" = { | ||||||
|  |     requires = ["postgresql.service"]; | ||||||
|  |     after = ["postgresql.service"]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 80 443 ]; | ||||||
|  | } | ||||||
							
								
								
									
										116
									
								
								modules/shaarli.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										116
									
								
								modules/shaarli.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,116 @@ | ||||||
|  | { pkgs, config, ... }: | ||||||
|  | let  | ||||||
|  |   dataDir = "/var/www/shaarli-config"; | ||||||
|  |   name = "shaarli"; | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   services.nginx = { | ||||||
|  |     enable = true; | ||||||
|  |     virtualHosts = { | ||||||
|  |       "links.mossnet.lan" = { | ||||||
|  |         forceSSL = false; | ||||||
|  |         enableACME = false; | ||||||
|  |         root = "${dataDir}"; | ||||||
|  | 	#listen = [ { addr = "192.168.1.6"; port = 1234; } ]; | ||||||
|  | 	extraConfig = '' | ||||||
|  | 	      index index.php; | ||||||
|  | 	''; | ||||||
|  |         locations = { | ||||||
|  | 	  "/".extraConfig = '' | ||||||
|  | 	    try_files $uri $uri/ index.php; | ||||||
|  |           ''; | ||||||
|  | 
 | ||||||
|  |           "~ (index)\.php$".extraConfig = '' | ||||||
|  | 	    fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  |             if (!-f $document_root$fastcgi_script_name) { | ||||||
|  |             return 404; | ||||||
|  |             } | ||||||
|  |      | ||||||
|  |             fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket}; | ||||||
|  |             fastcgi_index index.php; | ||||||
|  |      | ||||||
|  |             fastcgi_param   QUERY_STRING            $query_string; | ||||||
|  |             fastcgi_param   REQUEST_METHOD          $request_method; | ||||||
|  |             fastcgi_param   CONTENT_TYPE            $content_type; | ||||||
|  |             fastcgi_param   CONTENT_LENGTH          $content_length; | ||||||
|  |      | ||||||
|  |             fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name; | ||||||
|  |             fastcgi_param   SCRIPT_NAME             $fastcgi_script_name; | ||||||
|  |             fastcgi_param   PATH_INFO               $fastcgi_path_info; | ||||||
|  |             fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info; | ||||||
|  |             fastcgi_param   REQUEST_URI             $request_uri; | ||||||
|  |             fastcgi_param   DOCUMENT_URI            $document_uri; | ||||||
|  |             fastcgi_param   DOCUMENT_ROOT           $document_root; | ||||||
|  |             fastcgi_param   SERVER_PROTOCOL         $server_protocol; | ||||||
|  |      | ||||||
|  |             fastcgi_param   GATEWAY_INTERFACE       CGI/1.1; | ||||||
|  |             fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version; | ||||||
|  |      | ||||||
|  |             fastcgi_param   REMOTE_ADDR             $remote_addr; | ||||||
|  |             fastcgi_param   REMOTE_PORT             $remote_port; | ||||||
|  |             fastcgi_param   SERVER_ADDR             $server_addr; | ||||||
|  |             fastcgi_param   SERVER_PORT             $server_port; | ||||||
|  |             fastcgi_param   SERVER_NAME             $server_name; | ||||||
|  |           ''; | ||||||
|  | 
 | ||||||
|  |           "~ \.php$".extraConfig = '' | ||||||
|  |             deny all; | ||||||
|  |           ''; | ||||||
|  | 
 | ||||||
|  |           "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;"; | ||||||
|  | 
 | ||||||
|  |           "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;"; | ||||||
|  | 
 | ||||||
|  |           "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = '' | ||||||
|  |             expires max; | ||||||
|  |             add_header Pragma public; | ||||||
|  |             add_header Cache-Control "public, must-revalidate, proxy-revalidate"; | ||||||
|  |           ''; | ||||||
|  |         }; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.phpfpm = { | ||||||
|  |     pools = { | ||||||
|  |       "${name}" = { | ||||||
|  |         user = "nginx"; | ||||||
|  |         group = "nginx"; | ||||||
|  |         #listen = "/run/phpfpm/php.sock"; | ||||||
|  | 	settings = { | ||||||
|  | 	      "listen.owner" = "nginx"; | ||||||
|  | 	      "listen.group" = "nginx"; | ||||||
|  | 	      "user" = "nginx"; | ||||||
|  | 	      "pm" = "dynamic"; | ||||||
|  | 	      "pm.max_children" = "4"; | ||||||
|  | 	      "pm.min_spare_servers" = "1"; | ||||||
|  | 	      "pm.max_spare_servers" = "4"; | ||||||
|  | 	      "pm.max_requests" = "32"; | ||||||
|  | 	      "catch_workers_output" = "1"; | ||||||
|  | 	      "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log"; | ||||||
|  | 	}; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   users.extraUsers."${name}" = { group = "${name}"; }; | ||||||
|  |   users.extraGroups."${name}" = { }; | ||||||
|  |   systemd.services.shaarli-install = { | ||||||
|  |     serviceConfig.Type = "oneshot"; | ||||||
|  |     wantedBy = [ "multi-user.target" ]; | ||||||
|  |     script = '' | ||||||
|  |       if [ ! -d "${dataDir}" ]; then | ||||||
|  |         mkdir -p ${dataDir}/{cache,data,pagecache,tmp} | ||||||
|  |         cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/ | ||||||
|  |         cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/ | ||||||
|  |         cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ | ||||||
|  |         cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/ | ||||||
|  | 	ln -S ${pkgs.shaarli}/* ${dataDir} | ||||||
|  |       fi | ||||||
|  |       chown -Rc nginx:nginx ${dataDir} | ||||||
|  |       find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; | ||||||
|  |       find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; | ||||||
|  |     ''; | ||||||
|  |   }; | ||||||
|  |   # TODO: Write the configuration file here? | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 1234 ]; | ||||||
|  | } | ||||||
							
								
								
									
										10
									
								
								modules/taskd.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										10
									
								
								modules/taskd.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,10 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   services.taskserver.enable = true; | ||||||
|  |   services.taskserver.fqdn = "192.168.1.6"; | ||||||
|  |   services.taskserver.listenHost = "192.168.1.6"; | ||||||
|  |   services.taskserver.listenPort = 53589; | ||||||
|  |   services.taskserver.organisations.mossnet.users = [ "anish" ]; | ||||||
|  | } | ||||||
|  | 
 | ||||||
							
								
								
									
										21
									
								
								modules/wireguard.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										21
									
								
								modules/wireguard.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,21 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ]; | ||||||
|  |   environment.systemPackages = [ pkgs.wireguard ]; | ||||||
|  |   networking.wireguard.enable = true; | ||||||
|  |   networking.wireguard.interfaces = { | ||||||
|  |     wg0 = { | ||||||
|  |       ips = [ "10.0.69.2/32" ]; | ||||||
|  |       privateKeyFile = "/var/lib/wireguard/priv"; | ||||||
|  | 
 | ||||||
|  |       peers = [ | ||||||
|  |         { # helix - server | ||||||
|  |           publicKey = "{c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=}"; | ||||||
|  |           allowedIPs = [ "10.0.69.1/24" ]; | ||||||
|  |           endpoint = "sealight.xyz:60990"; | ||||||
|  |           persistentKeepalive = 25; | ||||||
|  |         } ]; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										9
									
								
								pkgs/pkg-navidrome.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								pkgs/pkg-navidrome.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | { | ||||||
|  |   services.navidrome.enable = true; | ||||||
|  |   services.navidrome.settings = { | ||||||
|  |     MusicFolder = "/data/music"; | ||||||
|  |     Port = 4433; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 4433 ]; | ||||||
|  | } | ||||||
							
								
								
									
										30
									
								
								pkgs/pkg-rssBridge.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										30
									
								
								pkgs/pkg-rssBridge.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,30 @@ | ||||||
|  | { lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }: | ||||||
|  | 
 | ||||||
|  | stdenv.mkDerivation rec { | ||||||
|  |   name = "rssBridge-${version}"; | ||||||
|  |   version = "2020-10-11"; | ||||||
|  |   preferLocalBuild = true; | ||||||
|  | 
 | ||||||
|  |   src = fetchurl { | ||||||
|  |     url = "https://github.com/RSS-Bridge/rss-bridge/archive/${version}.tar.gz"; | ||||||
|  |     sha256 = ""; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   phases = [ "installPhase" ]; | ||||||
|  |   installPhase = '' | ||||||
|  |     mkdir $out | ||||||
|  |     tar xzf $src | ||||||
|  |     cp -ra * $out/ | ||||||
|  |     find $out -type d -exec chmod 0755 {} \; | ||||||
|  |     find $out -type f -exec chmod 0644 {} \; | ||||||
|  |     ln -s $dataDir $out | ||||||
|  |   ''; | ||||||
|  | 
 | ||||||
|  |   meta = with stdenv.lib; { | ||||||
|  |     description = "RSS-Bridge is a project to create RSS Feeds for websites that don't have one."; | ||||||
|  |     #license = licenses.agpl3; | ||||||
|  |     homepage = "https://github.com/RSS-Bridge/rss-bridge/"; | ||||||
|  |     platforms = platforms.all; | ||||||
|  |     maintainers = with stdenv.lib.maintainers; [ chickensoupwithrice ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										34
									
								
								pkgs/pkg-shaarli.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										34
									
								
								pkgs/pkg-shaarli.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,34 @@ | ||||||
|  | { lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }: | ||||||
|  | 
 | ||||||
|  | stdenv.mkDerivation rec { | ||||||
|  |   name = "shaarli-${version}"; | ||||||
|  |   version = "0.11.1"; | ||||||
|  |   preferLocalBuild = true; | ||||||
|  | 
 | ||||||
|  |   src = fetchurl { | ||||||
|  |     url = "https://github.com/shaarli/Shaarli/releases/download/v0.11.1/shaarli-v${version}-full.tar.gz"; | ||||||
|  |     sha256 = "1psijcmi24hk0gxh1zdsm299xj11i7find2045nnx3r96cgnwjpn"; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   phases = [ "installPhase" ]; | ||||||
|  |   installPhase = '' | ||||||
|  |     mkdir $out | ||||||
|  |     tar xzf $src | ||||||
|  |     cp -ra Shaarli/. $out/ | ||||||
|  |     find $out -type d -exec chmod 0755 {} \; | ||||||
|  |     find $out -type f -exec chmod 0644 {} \; | ||||||
|  |     for a in cache data pagecache tmp; do | ||||||
|  |       mv $out/$a $out/$a.orig | ||||||
|  |       ln -s "${dataDir}/$a" $out/$a | ||||||
|  |     done | ||||||
|  |   ''; | ||||||
|  | 
 | ||||||
|  |   meta = with stdenv.lib; { | ||||||
|  |     description = ""; | ||||||
|  |     # License is complicated... | ||||||
|  |     #license = licenses.agpl3; | ||||||
|  |     homepage = "https://github.com/shaarli/Shaarli"; | ||||||
|  |     platforms = platforms.all; | ||||||
|  |     maintainers = with stdenv.lib.maintainers; [ tokudan ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										9
									
								
								pkgs/pkg-wallabag.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								pkgs/pkg-wallabag.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | ||||||
|  | { pkgs, config, lib, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   services.wallabag = { | ||||||
|  |     enable = true; | ||||||
|  |     hostName = "192.168.1.6:8080"; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 8080 ]; | ||||||
|  | }  | ||||||
							
								
								
									
										12
									
								
								reference/networking.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										12
									
								
								reference/networking.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,12 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | { | ||||||
|  |    networking.interfaces.enp3s0.ipv4.addresses = [ { | ||||||
|  |     address = "192.168.1.6"; | ||||||
|  |     prefixLength = 24; | ||||||
|  |   } ]; | ||||||
|  |    networking.nameservers = [ "1.1.1.1" ]; | ||||||
|  |    networking.defaultGateway = "192.168.1.1"; | ||||||
|  |    environment.systemPackages = [ pkgs.mosh ]; | ||||||
|  |    programs.mosh.enable = true; | ||||||
|  |    #config.nssDatabase.hosts = [ "mdns_minimal" "[NOTFOUND=return]" ]; | ||||||
|  | } | ||||||
							
								
								
									
										78
									
								
								reference/shaarli-broken.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										78
									
								
								reference/shaarli-broken.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,78 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | let  | ||||||
|  |   app = "shaarli"; | ||||||
|  |   dataDir = "/var/www/${app}"; | ||||||
|  | in { | ||||||
|  |   services.nginx = { | ||||||
|  |     enable = true; | ||||||
|  |     virtualHosts = { | ||||||
|  |       "192.168.1.6:1232" = { | ||||||
|  |         forceSSL = false; | ||||||
|  |         enableACME = false; | ||||||
|  |         #root = pkgs.shaarli; | ||||||
|  | 	root = dataDir; | ||||||
|  |         listen = [ { addr = "192.168.1.6"; port = 1232; } ]; | ||||||
|  | 	 extraConfig = '' | ||||||
|  |            index index.php; | ||||||
|  | 	''; | ||||||
|  |         locations = { | ||||||
|  |           "/".index = "index.php"; | ||||||
|  | 
 | ||||||
|  |           "~ /\\.".extraConfig = '' | ||||||
|  |             log_not_found off; | ||||||
|  |             deny all; | ||||||
|  |           ''; | ||||||
|  | 
 | ||||||
|  |           "~ (index)\\.php$".extraConfig = '' | ||||||
|  | 	    try_files $uri =404 | ||||||
|  |             include ${pkgs.nginx}/conf/fastcgi.conf; | ||||||
|  |             fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  |             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; | ||||||
|  | 	    fastcgi_param SHAARLI_CONFIG /var/www/shaarli/config; | ||||||
|  | 
 | ||||||
|  |             fastcgi_pass unix:${config.services.phpfpm.pools.${app}.socket}; | ||||||
|  |             fastcgi_index index.php; | ||||||
|  |           ''; | ||||||
|  | 
 | ||||||
|  |           "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;"; | ||||||
|  | 
 | ||||||
|  |           "~ \\.php$".extraConfig = '' | ||||||
|  |             deny all; | ||||||
|  |           ''; | ||||||
|  | 
 | ||||||
|  |           "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;"; | ||||||
|  | 
 | ||||||
|  |           "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = '' | ||||||
|  |             expires max; | ||||||
|  |             add_header Pragma public; | ||||||
|  |             add_header Cache-Control "public, must-revalidate, proxy-revalidate"; | ||||||
|  |           ''; | ||||||
|  |         }; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   services.phpfpm.pools.${app} = { | ||||||
|  |     user = app; | ||||||
|  |     #listen = "/run/phpfpm/shaarli.sock"; | ||||||
|  |     settings = {  | ||||||
|  |       "listen.owner" = config.services.nginx.user; | ||||||
|  |       "pm" = "dynamic"; | ||||||
|  |       "pm.max_children" = 4; | ||||||
|  |       "pm.start_servers" = 2; | ||||||
|  |       "pm.min_spare_servers" = 1; | ||||||
|  |       "pm.max_spare_servers" = 4; | ||||||
|  |       "pm.max_requests" = 32; | ||||||
|  |       "php_admin_value[error_log]" = "stderr"; | ||||||
|  |       "php_admin_flag[log_errors]" = true; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; | ||||||
|  |     users.users.${app} = { | ||||||
|  |     isSystemUser = true; | ||||||
|  |     createHome = true; | ||||||
|  |     home = dataDir; | ||||||
|  |     group  = app; | ||||||
|  |   }; | ||||||
|  |   users.groups.${app} = {}; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 1232 ]; | ||||||
|  | } | ||||||
							
								
								
									
										9
									
								
								reference/shaarli-docker.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								reference/shaarli-docker.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | ||||||
|  | { pkg, config, lib, ... }: | ||||||
|  | { | ||||||
|  |   docker-containers."shaarli" = { | ||||||
|  |     image = "shaarli/shaarli"; | ||||||
|  |     volumes = [ "shaarli:/var/lib/shaarli/data/" ]; | ||||||
|  |     ports = [ "1233:80" ]; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 1233 ]; | ||||||
|  | } | ||||||
							
								
								
									
										97
									
								
								reference/shaarli-tokudan.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										97
									
								
								reference/shaarli-tokudan.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,97 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   phppoolName = "shaarli"; | ||||||
|  |   dataDir = "/var/lib/shaarli"; | ||||||
|  |   vhost = "192.168.1.6:1232"; | ||||||
|  | 
 | ||||||
|  |   shaarli = pkgs.callPackage ./pkg-shaarli.nix { | ||||||
|  |     inherit dataDir; | ||||||
|  |   }; | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   services.nginx.virtualHosts."${vhost}" = { | ||||||
|  |     forceSSL = false; | ||||||
|  |     enableACME = false; | ||||||
|  |     root = "${dataDir}"; | ||||||
|  |     listen = [ { addr = "192.168.1.6"; port = 1232; } ]; | ||||||
|  |     extraConfig = '' | ||||||
|  |       index index.php; | ||||||
|  |       ''; | ||||||
|  |     locations."/" = { | ||||||
|  |       extraConfig = '' | ||||||
|  |         try_files _ /index.php$is_args$args;"; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  |     locations."~ (index)\\.php$" = { | ||||||
|  |       extraConfig = '' | ||||||
|  |         fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  |         if (!-f $document_root$fastcgi_script_name) { | ||||||
|  |         return 404; | ||||||
|  |         } | ||||||
|  | 
 | ||||||
|  |         fastcgi_pass unix:${config.services.phpfpm.pools.shaarli.socket}; | ||||||
|  |         fastcgi_index index.php; | ||||||
|  | 
 | ||||||
|  |         fastcgi_param   QUERY_STRING            $query_string; | ||||||
|  |         fastcgi_param   REQUEST_METHOD          $request_method; | ||||||
|  |         fastcgi_param   CONTENT_TYPE            $content_type; | ||||||
|  |         fastcgi_param   CONTENT_LENGTH          $content_length; | ||||||
|  | 
 | ||||||
|  |         fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name; | ||||||
|  |         fastcgi_param   SCRIPT_NAME             $fastcgi_script_name; | ||||||
|  |         fastcgi_param   PATH_INFO               $fastcgi_path_info; | ||||||
|  |         fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info; | ||||||
|  |         fastcgi_param   REQUEST_URI             $request_uri; | ||||||
|  |         fastcgi_param   DOCUMENT_URI            $document_uri; | ||||||
|  |         fastcgi_param   DOCUMENT_ROOT           $document_root; | ||||||
|  |         fastcgi_param   SERVER_PROTOCOL         $server_protocol; | ||||||
|  | 
 | ||||||
|  |         fastcgi_param   GATEWAY_INTERFACE       CGI/1.1; | ||||||
|  |         fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version; | ||||||
|  | 
 | ||||||
|  |         fastcgi_param   REMOTE_ADDR             $remote_addr; | ||||||
|  |         fastcgi_param   REMOTE_PORT             $remote_port; | ||||||
|  |         fastcgi_param   SERVER_ADDR             $server_addr; | ||||||
|  |         fastcgi_param   SERVER_PORT             $server_port; | ||||||
|  |         fastcgi_param   SERVER_NAME             $server_name; | ||||||
|  | 
 | ||||||
|  |         fastcgi_param   HTTPS                   $https; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   services.phpfpm.pools.shaarli = { | ||||||
|  |     user = "shaarli"; | ||||||
|  |     group = "shaarli"; | ||||||
|  |     settings = { | ||||||
|  |       "listen.owner" = "nginx"; | ||||||
|  |       "listen.group" = "nginx"; | ||||||
|  |       "user" = "shaarli"; | ||||||
|  |       "pm" = "dynamic"; | ||||||
|  |       "pm.max_children" = "75"; | ||||||
|  |       "pm.min_spare_servers" = "5"; | ||||||
|  |       "pm.max_spare_servers" = "20"; | ||||||
|  |       "pm.max_requests" = "10"; | ||||||
|  |       "catch_workers_output" = "1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   users.extraUsers.shaarli = { group = "shaarli"; home = dataDir; }; | ||||||
|  |   users.extraGroups.shaarli = { }; | ||||||
|  |   systemd.services.shaarli-install = { | ||||||
|  |     serviceConfig.Type = "oneshot"; | ||||||
|  |     wantedBy = [ "multi-user.target" ]; | ||||||
|  |     script = '' | ||||||
|  |       if [ ! -d "${dataDir}" ]; then | ||||||
|  |         mkdir -p ${dataDir}/{cache,data,pagecache,tmp} | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/ | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/ | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ | ||||||
|  |         cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/ | ||||||
|  |       fi | ||||||
|  |       chown -Rc shaarli:shaarli ${dataDir} | ||||||
|  |       find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; | ||||||
|  |       find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; | ||||||
|  |     ''; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 1232 ]; | ||||||
|  | } | ||||||
							
								
								
									
										7
									
								
								reference/shiori.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										7
									
								
								reference/shiori.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,7 @@ | ||||||
|  | { pkgs, config, lib, ... }: | ||||||
|  | { | ||||||
|  |     services.shiori.enable = true; | ||||||
|  |     services.shiori.address = "192.168.1.6"; | ||||||
|  |     services.shiori.port = 1234; | ||||||
|  |     networking.firewall.allowedTCPPorts = [ 1234 ]; | ||||||
|  | } | ||||||
							
								
								
									
										24
									
								
								reference/test-nginx.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										24
									
								
								reference/test-nginx.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,24 @@ | ||||||
|  | { pkgs, config, lib, ... }: | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   vhost = "192.168.1.6:1232"; | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   services.nginx.virtualHosts."${vhost}" = { | ||||||
|  |     forceSSL = false; | ||||||
|  |     enableACME = false; | ||||||
|  |     root = "/var/lib/test"; | ||||||
|  |     listen = [ { addr = "192.168.1.6"; port = 1232; } ]; | ||||||
|  |     extraConfig = '' | ||||||
|  |       index index.html; | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |     locations."/" = { | ||||||
|  |       extraConfig = '' | ||||||
|  |         try_files $uri $uri/ index.html; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |    | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 1232 ]; | ||||||
|  | } | ||||||
							
								
								
									
										52
									
								
								reference/wallabag-docker.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										52
									
								
								reference/wallabag-docker.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,52 @@ | ||||||
|  | { pkg, config, lib, ... }: | ||||||
|  | { | ||||||
|  |   docker-containers."wallabag-db" = { | ||||||
|  |     image = "postgres"; | ||||||
|  |     environment = { | ||||||
|  |       "POSTGRES_PASSWORD" = "wallaroot"; | ||||||
|  |       "POSTGRES_USER" = "postgres"; | ||||||
|  |     }; | ||||||
|  |     extraDockerOptions = [ "--network=wallabag-br" ]; | ||||||
|  |     volumes = [ "/opt/wallabag/data:/var/www/wallabag" ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   docker-containers."wallabag" = { | ||||||
|  |     image = "wallabag/wallabag"; | ||||||
|  |     ports = [ "800:80" ]; | ||||||
|  |     #volumes = [ "/opt/wallabag/data:/var/www/wallabag/data" "/opt/wallabag/images:/var/www/wallabag/web/assets/images" ]; | ||||||
|  |     environment = { | ||||||
|  |       "SYMFONY__ENV__DOMAIN_NAME" = "http://192.168.1.6:800"; | ||||||
|  |       "POSTGRES_PASSWORD" = "wallaroot"; | ||||||
|  |       "POSTGRES_USER" = "postgres"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_DRIVER" = "pdo_pgsql"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_DRIVER_CLASS" = "Wallabag\\CoreBundle\\Doctrine\\DBAL\\Driver\\CustomPostgreSQLDriver"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_HOST" = "wallabag-db"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_PORT" = "5432"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_NAME" = "wallabag"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_USER" = "wallabag"; | ||||||
|  |       "SYMFONY__ENV__DATABASE_PASSWORD" = "wallapass";  | ||||||
|  |       #"SYMFONY__ENV__DATABASE_CHARSET" = "utf8mb4"; | ||||||
|  |     }; | ||||||
|  |     extraDockerOptions = [ "--network=wallabag-br" ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   systemd.services.init-wallabag-docker-br = { | ||||||
|  |     description = "Create the network bridge wallabag."; | ||||||
|  |     after = [ "network.target" ]; | ||||||
|  |     wantedBy = [ "multi-user.target" ]; | ||||||
|  |      | ||||||
|  |     serviceConfig.Type = "oneshot"; | ||||||
|  |      script = let dockercli = "${config.virtualisation.docker.package}/bin/docker"; | ||||||
|  |              in '' | ||||||
|  |                # Put a true at the end to prevent getting non-zero return code, which will | ||||||
|  |                # crash the whole service. | ||||||
|  |                check=$(${dockercli} network ls | grep "wallabag-br" || true) | ||||||
|  |                if [ -z "$check" ]; then | ||||||
|  |                  ${dockercli} network create wallabag-br | ||||||
|  |                else | ||||||
|  |                  echo "wallabag-br already exists in docker" | ||||||
|  |                fi | ||||||
|  |              ''; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 800 ]; | ||||||
|  | } | ||||||
							
								
								
									
										120
									
								
								reference/wallabag.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										120
									
								
								reference/wallabag.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,120 @@ | ||||||
|  | { pkgs, config, lib, ... }: | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   phppoolName = "wallabag"; | ||||||
|  |   dataDir = "/var/lib/wallabag"; | ||||||
|  |   vhost = "read.mossnet.local"; | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   services.nginx.virtualHosts."${vhost}" = { | ||||||
|  |     forceSSL = false; | ||||||
|  |     enableACME = false; | ||||||
|  |     root = "/var/lib/wallabag/web"; | ||||||
|  |     listen = [ { addr = "192.168.1.6"; port = 800; } ]; | ||||||
|  | 
 | ||||||
|  |     locations."/" = { | ||||||
|  |       extraConfig = '' | ||||||
|  |         try_files $uri /app.php$is_args$args; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     locations."/assets".root = "${dataDir}/web"; | ||||||
|  | 
 | ||||||
|  |     locations."~ ^/app\.php(/|$)" = { | ||||||
|  |       extraConfig = '' | ||||||
|  | 	include ${pkgs.nginx}/conf/fastcgi_params; | ||||||
|  |         fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  |         if (!-f $document_root$fastcgi_script_name) { | ||||||
|  |         return 404; | ||||||
|  |         } | ||||||
|  | 
 | ||||||
|  |         fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket}; | ||||||
|  | 	fastcgi_param  SCRIPT_FILENAME  {pkgs.wallabag}/web/$fastcgi_script_name; | ||||||
|  |         fastcgi_param DOCUMENT_ROOT {pkgs.wallabag}/web; | ||||||
|  |         ''; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     locations."~ \.php$" = { | ||||||
|  | 	extraConfig = '' | ||||||
|  | 	return 404; | ||||||
|  | 	''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   services.postgresql = { | ||||||
|  |     enable = true; | ||||||
|  | 
 | ||||||
|  |     # Ensure the database, user, and permissions always exist | ||||||
|  |     ensureDatabases = [ "wallabag" ]; | ||||||
|  |     ensureUsers = [ | ||||||
|  |      { name = "wallabag"; | ||||||
|  |        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES"; | ||||||
|  |      } | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  |   services.phpfpm.pools."${phppoolName}" = { | ||||||
|  |     user = "wallabag"; | ||||||
|  |     group = "wallabag"; | ||||||
|  |     phpEnv."WALLABAG_DATA" = "/var/lib/wallabag"; | ||||||
|  |     phpEnv."PATH" = lib.makeBinPath [ pkgs.php ]; | ||||||
|  |     settings = { | ||||||
|  |       "listen.owner" = "nginx"; | ||||||
|  |       "listen.group" = "nginx"; | ||||||
|  |       "user" = "wallabag"; | ||||||
|  |       "pm" = "dynamic"; | ||||||
|  |       "pm.max_children" = "75"; | ||||||
|  |       "pm.min_spare_servers" = "5"; | ||||||
|  |       "pm.max_spare_servers" = "20"; | ||||||
|  |       "pm.max_requests" = "10"; | ||||||
|  |       "catch_workers_output" = "1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |     | ||||||
|  |   systemd.services.wallabag-install = { | ||||||
|  |       description = "Wallabag install service"; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       before = [ "phpfpm-wallabag.service" ]; | ||||||
|  |       after = [ "mysql.service" "postgresql.service" ]; | ||||||
|  |       path = [ pkgs.coreutils pkgs.php73 pkgs.php73Packages.composer ]; | ||||||
|  | 
 | ||||||
|  |       serviceConfig = { | ||||||
|  |         User = "wallabag"; | ||||||
|  |         Type = "oneshot"; | ||||||
|  |         RemainAfterExit = "yes"; | ||||||
|  |         PermissionsStartOnly = true; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       preStart = '' | ||||||
|  |         mkdir -p "${dataDir}" | ||||||
|  |         chown wallabag:nginx "${dataDir}" | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       script = '' | ||||||
|  |         echo "Setting up wallabag files in ${dataDir} ..." | ||||||
|  |         cd "${dataDir}" | ||||||
|  | 
 | ||||||
|  |         rm -rf var/cache/* | ||||||
|  |         rm -f ${dataDir}/app | ||||||
|  | 	rm -f ${dataDir}/bin | ||||||
|  |         ln -sf ${pkgs.wallabag}/app app | ||||||
|  |         ln -sf ${pkgs.wallabag}/composer.{json,lock} . | ||||||
|  | 	ln -sf ${pkgs.wallabag}/bin/ bin | ||||||
|  | 
 | ||||||
|  |         export WALLABAG_DATA="${dataDir}" | ||||||
|  |         if [ ! -f installed ]; then | ||||||
|  |           php /var/lib/wallabag/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction | ||||||
|  |           php /var/lib/wallabag/bin/console --env=prod doctrine:migrations:migrate --no-interaction | ||||||
|  |           # Until https://github.com/wallabag/wallabag/issues/3662 is fixed | ||||||
|  |           yes no | php /var/lib/wallabag/bin/console --env=prod wallabag:install | ||||||
|  |           touch installed | ||||||
|  |         else | ||||||
|  |           php ${pkgs.wallabag}/bin/console --env=prod doctrine:migrations:migrate --no-interaction | ||||||
|  |         fi | ||||||
|  |         php ${pkgs.wallabag}/bin/console --env=prod cache:clear | ||||||
|  |       ''; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   users.extraUsers.wallabag = { group = "wallabag"; }; | ||||||
|  |   users.extraGroups.wallabag = { }; | ||||||
|  |    | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 800 ]; | ||||||
|  | } | ||||||
		Loading…
	
		Reference in a new issue