hosts/ao: rewrite & use agenix

hosts/ao/default.nix

@@ -7,17 +7,25 @@ with lib.my;
   imports = [
     ../personal.nix
     ./hardware-configuration.nix
+
+    # ./modules/postgresql.nix
+    ./modules/gitea.nix
+    ./modules/bitwarden.nix
+    # ./modules/tinytinyrss.nix
   ];
 
+
   ## Modules
   modules = {
-    shell.git.enable = true;
-    shell.zsh.enable = true;
-    services.ssh.enable = true;
-    services.nginx.enable = true;
-    services.gitea.enable = true;
-    services.bitwarden.enable = true;
-    # services.syncthing.enable = true;
+    shell = {
+      git.enable = true;
+      zsh.enable = true;
+    };
+    services = {
+      fail2ban.enable = true;
+      ssh.enable = true;
+      nginx.enable = true;
+    };
 
     theme.active = "alucard";
   };
@@ -27,87 +35,16 @@ with lib.my;
   networking.networkmanager.enable = true;
 
   # nginx hosts
-  services.nginx = {
-    user = config.user.name;
-    virtualHosts = {
-      "v0.io" = {
-        default = true;
-        forceSSL = true;
-        enableACME = true;
-        extraConfig = ''
-          client_max_body_size 128M;
-        '';
-        locations."/" = {
-          proxyPass = "https://192.168.1.3:8001";
-          extraConfig = ''
-            proxy_ssl_server_name on;
-            proxy_pass_header Authorization;
-          '';
-        };
-      };
-      "git.v0.io" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/".proxyPass = "http://127.0.0.1:3000";
-      };
-      "p.v0.io" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:8000";
-          extraConfig = ''
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-          '';
-        };
-        locations."/notifications/hub" = {
-          proxyPass = "http://127.0.0.1:3012";
-          extraConfig = ''
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-          '';
-        };
-        locations."/notifications/hub/negotiate" = {
-          proxyPass = "http://127.0.0.1:8001";
-        };
-      };
-    };
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    certs = let email = "henrik@lissner.net"; in {
-      "v0.io".email = email;
-      "git.v0.io".email = email;
-      "p.v0.io".email = email;
-    };
-  };
-
-  services.gitea = {
-    appName = "V-NOUGHT";
-    domain = "v0.io";
-    rootUrl = "https://git.v0.io/";
-    settings.server.SSH_DOMAIN = "v0.io";
-  };
-
-  services.bitwarden_rs.config = {
-    signupsAllowed = false;
-    domain = "https://p.v0.io";
-    httpPort = 8002;
-  };
-
-  services.fail2ban = {
-    enable = true;
-    ignoreIP = [ "127.0.0.1/8" "192.168.1.0/24" ];
-    jails.DEFAULT = ''
-      bantime = 3600
-    '';
-    jails.sshd = ''
-      filter = sshd
-      action = iptables[name=ssh, port=22, protocl=tcp]
-      enabled = true
+  services.nginx.virtualHosts."v0.io" = {
+    default = true;
+    forceSSL = true;
+    enableACME = true;
+    locations."/".extraConfig = ''
+      proxy_pass https://kiiro:8001;
+      proxy_ssl_server_name on;
+      proxy_pass_header Authorization;
     '';
   };
+
+  security.acme.email = "henrik@lissner.net";
 }

hosts/ao/modules/bitwarden.nix

@@ -0,0 +1,32 @@
+{ config, lib, ... }:
+
+{
+  modules.services.bitwarden.enable = true;
+
+  services.bitwarden_rs.config = {
+    signupsAllowed = false;
+    invitationsAllowed = true;
+    domain = "https://p.v0.io";
+    httpPort = 8002;
+  };
+
+  # Inject secrets at runtime
+  systemd.services.bitwarden_rs.serviceConfig = {
+    EnvironmentFile = [ config.age.secrets.bitwarden-smtp-env.path ];
+    Restart = "on-failure";
+    RestartSec = "2s";
+  };
+
+  services.nginx.virtualHosts."p.v0.io" = {
+    forceSSL = true;
+    enableACME = true;
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+    locations = {
+      "/".proxyPass = "http://127.0.0.1:8000";
+      "/notifications/hub".proxyWebsockets = true;
+      "/notifications/hub/negotiate".proxyPass = "http://127.0.0.1:8001";
+    };
+  };
+}

hosts/ao/modules/gitea.nix

@@ -0,0 +1,31 @@
+{ config, lib, ... }:
+
+{
+  modules.services.gitea.enable = true;
+
+  services.gitea = {
+    appName = "V-NOUGHT";
+    domain = "v0.io";
+    rootUrl = "https://git.v0.io/";
+    disableRegistration = false;
+    settings = {
+      server.SSH_DOMAIN = "v0.io";
+      mailer = {
+        ENABLED = true;
+        FROM = "mail@v0.io";
+        HOST = "mail.gmail.com:465";
+        USER = "hlissner@gmail.com";
+        MAILER_TYPE = "smtp";
+        IS_TLS_ENABLED = "true";
+      };
+    };
+    mailerPasswordFile = config.age.secrets.gitea-smtp.path;
+    database.type = "sqlite3";
+  };
+
+  services.nginx.virtualHosts."git.v0.io" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".proxyPass = "http://127.0.0.1:3000";
+  };
+}

hosts/ao/secrets/gitea-smtp.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 4+kR2g aFztrZ7QN3Odj4EbFwuaRn+1VSuTFSUZ1Gwtgf5ELmw
+H2s3EFMm4cRnFw5AbeOmX+OdADnEuMW5KqR4erH8Rv0
+-> (-grease 10P|_2X
+JP9WDuBVhwq8P4B/QTPM/UFVgEM
+--- IV78E3ztrIne6HidhqvOUfg//H77bnXQlXvEtqmpkBA
+‹,æûS"™2(·*b×<>­zš‚=C•IÂPm¹¯gÜ…íäÂg¹éø4tΑog!ÕDJm

hosts/ao/secrets/secrets.nix

@@ -0,0 +1,5 @@
+let key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd+4ijlEHI98NLpgP/El73BmpBUfzka9ovdt8FoaVAG hlissner@home";
+in {
+  "bitwarden-smtp-env.age".publicKeys = [key];
+  "gitea-smtp.age".publicKeys = [key];
+}