hosts/ao: rewrite & use agenix
This commit is contained in:
		
							parent
							
								
									d1e987c4ba
								
							
						
					
					
						commit
						d0309c51a0
					
				|  | @ -7,17 +7,25 @@ with lib.my; | |||
|   imports = [ | ||||
|     ../personal.nix | ||||
|     ./hardware-configuration.nix | ||||
| 
 | ||||
|     # ./modules/postgresql.nix | ||||
|     ./modules/gitea.nix | ||||
|     ./modules/bitwarden.nix | ||||
|     # ./modules/tinytinyrss.nix | ||||
|   ]; | ||||
| 
 | ||||
| 
 | ||||
|   ## Modules | ||||
|   modules = { | ||||
|     shell.git.enable = true; | ||||
|     shell.zsh.enable = true; | ||||
|     services.ssh.enable = true; | ||||
|     services.nginx.enable = true; | ||||
|     services.gitea.enable = true; | ||||
|     services.bitwarden.enable = true; | ||||
|     # services.syncthing.enable = true; | ||||
|     shell = { | ||||
|       git.enable = true; | ||||
|       zsh.enable = true; | ||||
|     }; | ||||
|     services = { | ||||
|       fail2ban.enable = true; | ||||
|       ssh.enable = true; | ||||
|       nginx.enable = true; | ||||
|     }; | ||||
| 
 | ||||
|     theme.active = "alucard"; | ||||
|   }; | ||||
|  | @ -27,87 +35,16 @@ with lib.my; | |||
|   networking.networkmanager.enable = true; | ||||
| 
 | ||||
|   # nginx hosts | ||||
|   services.nginx = { | ||||
|     user = config.user.name; | ||||
|     virtualHosts = { | ||||
|       "v0.io" = { | ||||
|         default = true; | ||||
|         forceSSL = true; | ||||
|         enableACME = true; | ||||
|         extraConfig = '' | ||||
|           client_max_body_size 128M; | ||||
|         ''; | ||||
|         locations."/" = { | ||||
|           proxyPass = "https://192.168.1.3:8001"; | ||||
|           extraConfig = '' | ||||
|             proxy_ssl_server_name on; | ||||
|             proxy_pass_header Authorization; | ||||
|           ''; | ||||
|         }; | ||||
|       }; | ||||
|       "git.v0.io" = { | ||||
|         forceSSL = true; | ||||
|         enableACME = true; | ||||
|         locations."/".proxyPass = "http://127.0.0.1:3000"; | ||||
|       }; | ||||
|       "p.v0.io" = { | ||||
|         forceSSL = true; | ||||
|         enableACME = true; | ||||
|         locations."/" = { | ||||
|           proxyPass = "http://127.0.0.1:8000"; | ||||
|           extraConfig = '' | ||||
|             proxy_set_header Host $host; | ||||
|             proxy_set_header X-Real-IP $remote_addr; | ||||
|             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||
|             proxy_set_header X-Forwarded-Proto $scheme; | ||||
|           ''; | ||||
|         }; | ||||
|         locations."/notifications/hub" = { | ||||
|           proxyPass = "http://127.0.0.1:3012"; | ||||
|           extraConfig = '' | ||||
|             proxy_set_header Upgrade $http_upgrade; | ||||
|             proxy_set_header Connection "upgrade"; | ||||
|           ''; | ||||
|         }; | ||||
|         locations."/notifications/hub/negotiate" = { | ||||
|           proxyPass = "http://127.0.0.1:8001"; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   security.acme = { | ||||
|     acceptTerms = true; | ||||
|     certs = let email = "henrik@lissner.net"; in { | ||||
|       "v0.io".email = email; | ||||
|       "git.v0.io".email = email; | ||||
|       "p.v0.io".email = email; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.gitea = { | ||||
|     appName = "V-NOUGHT"; | ||||
|     domain = "v0.io"; | ||||
|     rootUrl = "https://git.v0.io/"; | ||||
|     settings.server.SSH_DOMAIN = "v0.io"; | ||||
|   }; | ||||
| 
 | ||||
|   services.bitwarden_rs.config = { | ||||
|     signupsAllowed = false; | ||||
|     domain = "https://p.v0.io"; | ||||
|     httpPort = 8002; | ||||
|   }; | ||||
| 
 | ||||
|   services.fail2ban = { | ||||
|     enable = true; | ||||
|     ignoreIP = [ "127.0.0.1/8" "192.168.1.0/24" ]; | ||||
|     jails.DEFAULT = '' | ||||
|       bantime = 3600 | ||||
|     ''; | ||||
|     jails.sshd = '' | ||||
|       filter = sshd | ||||
|       action = iptables[name=ssh, port=22, protocl=tcp] | ||||
|       enabled = true | ||||
|   services.nginx.virtualHosts."v0.io" = { | ||||
|     default = true; | ||||
|     forceSSL = true; | ||||
|     enableACME = true; | ||||
|     locations."/".extraConfig = '' | ||||
|       proxy_pass https://kiiro:8001; | ||||
|       proxy_ssl_server_name on; | ||||
|       proxy_pass_header Authorization; | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   security.acme.email = "henrik@lissner.net"; | ||||
| } | ||||
|  |  | |||
							
								
								
									
										32
									
								
								hosts/ao/modules/bitwarden.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										32
									
								
								hosts/ao/modules/bitwarden.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,32 @@ | |||
| { config, lib, ... }: | ||||
| 
 | ||||
| { | ||||
|   modules.services.bitwarden.enable = true; | ||||
| 
 | ||||
|   services.bitwarden_rs.config = { | ||||
|     signupsAllowed = false; | ||||
|     invitationsAllowed = true; | ||||
|     domain = "https://p.v0.io"; | ||||
|     httpPort = 8002; | ||||
|   }; | ||||
| 
 | ||||
|   # Inject secrets at runtime | ||||
|   systemd.services.bitwarden_rs.serviceConfig = { | ||||
|     EnvironmentFile = [ config.age.secrets.bitwarden-smtp-env.path ]; | ||||
|     Restart = "on-failure"; | ||||
|     RestartSec = "2s"; | ||||
|   }; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."p.v0.io" = { | ||||
|     forceSSL = true; | ||||
|     enableACME = true; | ||||
|     extraConfig = '' | ||||
|       client_max_body_size 128M; | ||||
|     ''; | ||||
|     locations = { | ||||
|       "/".proxyPass = "http://127.0.0.1:8000"; | ||||
|       "/notifications/hub".proxyWebsockets = true; | ||||
|       "/notifications/hub/negotiate".proxyPass = "http://127.0.0.1:8001"; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										31
									
								
								hosts/ao/modules/gitea.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										31
									
								
								hosts/ao/modules/gitea.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,31 @@ | |||
| { config, lib, ... }: | ||||
| 
 | ||||
| { | ||||
|   modules.services.gitea.enable = true; | ||||
| 
 | ||||
|   services.gitea = { | ||||
|     appName = "V-NOUGHT"; | ||||
|     domain = "v0.io"; | ||||
|     rootUrl = "https://git.v0.io/"; | ||||
|     disableRegistration = false; | ||||
|     settings = { | ||||
|       server.SSH_DOMAIN = "v0.io"; | ||||
|       mailer = { | ||||
|         ENABLED = true; | ||||
|         FROM = "mail@v0.io"; | ||||
|         HOST = "mail.gmail.com:465"; | ||||
|         USER = "hlissner@gmail.com"; | ||||
|         MAILER_TYPE = "smtp"; | ||||
|         IS_TLS_ENABLED = "true"; | ||||
|       }; | ||||
|     }; | ||||
|     mailerPasswordFile = config.age.secrets.gitea-smtp.path; | ||||
|     database.type = "sqlite3"; | ||||
|   }; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."git.v0.io" = { | ||||
|     forceSSL = true; | ||||
|     enableACME = true; | ||||
|     locations."/".proxyPass = "http://127.0.0.1:3000"; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										
											BIN
										
									
								
								hosts/ao/secrets/bitwarden-smtp-env.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										
											BIN
										
									
								
								hosts/ao/secrets/bitwarden-smtp-env.age
									
									
									
									
									
										Normal file
									
								
							
										
											Binary file not shown.
										
									
								
							
							
								
								
									
										7
									
								
								hosts/ao/secrets/gitea-smtp.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										7
									
								
								hosts/ao/secrets/gitea-smtp.age
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,7 @@ | |||
| age-encryption.org/v1 | ||||
| -> ssh-ed25519 4+kR2g aFztrZ7QN3Odj4EbFwuaRn+1VSuTFSUZ1Gwtgf5ELmw | ||||
| H2s3EFMm4cRnFw5AbeOmX+OdADnEuMW5KqR4erH8Rv0 | ||||
| -> (-grease 10P|_2X | ||||
| JP9WDuBVhwq8P4B/QTPM/UFVgEM | ||||
| --- IV78E3ztrIne6HidhqvOUfg//H77bnXQlXvEtqmpkBA | ||||
| ‹,æûS"™2(·*b×<>zš‚=C•IÂPm¹¯gÜ…íäÂg¹éø4tΑog!ÕDJm | ||||
							
								
								
									
										5
									
								
								hosts/ao/secrets/secrets.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										5
									
								
								hosts/ao/secrets/secrets.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,5 @@ | |||
| let key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd+4ijlEHI98NLpgP/El73BmpBUfzka9ovdt8FoaVAG hlissner@home"; | ||||
| in { | ||||
|   "bitwarden-smtp-env.age".publicKeys = [key]; | ||||
|   "gitea-smtp.age".publicKeys = [key]; | ||||
| } | ||||
		Loading…
	
		Reference in a new issue