From e3e7c1d99cc07cb8dc971cadc9edc868dd9e7721 Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Fri, 29 Jan 2021 00:13:47 +1000 Subject: [PATCH] bowl --- backup.nix | 34 ++++++ configuration.nix | 74 +++++++++++++ dns.nix | 11 ++ hardware-configuration.nix | 29 +++++ headphones.nix | 12 ++ mod-shaarli.nix | 80 ++++++++++++++ mod-wallabag.nix | 218 +++++++++++++++++++++++++++++++++++++ monitoring.nix | 53 +++++++++ navidrome.nix | 101 +++++++++++++++++ networking.nix | 12 ++ nextcloud.nix | 52 +++++++++ nextcloud.nix.save.1 | 8 ++ pkg-navidrome.nix | 9 ++ pkg-rssBridge.nix | 30 +++++ pkg-shaarli.nix | 34 ++++++ pkg-wallabag.nix | 39 +++++++ shaarli-broken.nix | 78 +++++++++++++ shaarli-docker.nix | 9 ++ shaarli-tokudan.nix | 97 +++++++++++++++++ shaarli.nix | 116 ++++++++++++++++++++ shiori.nix | 7 ++ taskd.nix | 12 ++ taskd.nix.save | 0 taskd.nix.save.1 | 9 ++ test-nginx.nix | 24 ++++ wallabag-data.patch | 31 ++++++ wallabag-docker.nix | 52 +++++++++ wallabag.nix | 87 +++++++++++++++ wireguard.nix | 21 ++++ 29 files changed, 1339 insertions(+) create mode 100644 backup.nix create mode 100644 configuration.nix create mode 100644 dns.nix create mode 100644 hardware-configuration.nix create mode 100644 headphones.nix create mode 100644 mod-shaarli.nix create mode 100644 mod-wallabag.nix create mode 100644 monitoring.nix create mode 100644 navidrome.nix create mode 100644 networking.nix create mode 100644 nextcloud.nix create mode 100644 nextcloud.nix.save.1 create mode 100644 pkg-navidrome.nix create mode 100644 pkg-rssBridge.nix create mode 100644 pkg-shaarli.nix create mode 100644 pkg-wallabag.nix create mode 100644 shaarli-broken.nix create mode 100644 shaarli-docker.nix create mode 100644 shaarli-tokudan.nix create mode 100644 shaarli.nix create mode 100644 shiori.nix create mode 100644 taskd.nix create mode 100644 taskd.nix.save create mode 100644 taskd.nix.save.1 create mode 100644 test-nginx.nix create mode 100644 wallabag-data.patch create mode 100644 wallabag-docker.nix create mode 100644 wallabag.nix create mode 100644 wireguard.nix diff --git a/backup.nix b/backup.nix new file mode 100644 index 00000000..8fa6f01c --- /dev/null +++ b/backup.nix @@ -0,0 +1,34 @@ +{ + # Assumes the remote borg backup server has already been initialized + # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net: + services.borgbackup.jobs = { + backupTaskwarriorRsync = { + paths = [ "/var/lib/taskserver" ]; + doInit = true; + repo = "20779@hk-s020.rsync.net:taskwarrior" ; + encryption = { + mode = "repokey-blake2"; + passCommand = "cat /run/keys/rsync"; + }; + environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; + compression = "auto,lzma"; + startAt = "weekly"; + extraArgs = "--remote-path=borg1"; + }; + }; + services.borgbackup.jobs = { + backupShaarliRsync = { + paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ]; + doInit = true; + repo = "20779@hk-s020.rsync.net:shaarli" ; + encryption = { + mode = "repokey-blake2"; + passCommand = "cat /run/keys/rsync"; + }; + environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; + compression = "auto,lzma"; + startAt = "weekly"; + extraArgs = "--remote-path=borg1"; + }; + }; +} diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 00000000..9af674c3 --- /dev/null +++ b/configuration.nix @@ -0,0 +1,74 @@ +{ config, pkgs, ... }: +{ +imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ./taskd.nix + ./nextcloud.nix + ./networking.nix +# ./wireguard.nix +# ./shiori.nix + ./shaarli.nix +# ./shaarli-tokudan.nix + ./mod-wallabag.nix +# ./pkg-wallabag.nix + ./navidrome.nix + ./pkg-navidrome.nix + ./wallabag.nix + ./headphones.nix + #./dns.nix + ./backup.nix + ./monitoring.nix + ]; + + boot.loader.grub.devices = [ "/dev/sda" ]; + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.enableCryptodisk = true; + boot.loader.supportsInitrdSecrets = true; + + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.initrd.availableKernelModules = ["virtio-pci"]; + boot.initrd.network = { + enable = true; + ssh = { + enable = true; + port = 2222; + authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box +"]; + hostKeys = [ "/host_ecdsa_key" ]; + }; + }; + + boot.initrd.luks.devices = { + "enc-pv" = { + name = "enc-pv"; + preLVM = true; + device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c"; + allowDiscards = true; + }; + }; + + boot.initrd.secrets = { + "/host_ecdsa_key" = "/host_ecdsa_key"; + }; + + + boot.cleanTmpDir = true; + boot.kernelModules = [ "dm-snapshot" ]; + + users.users.anish = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + hashedPassword = "MO0Pbd2O4eIlA"; + openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ]; + }; + + users.users.root.initialHashedPassword = ""; + services.openssh.permitRootLogin = "prohibit-password"; + networking.hostName = "bowl"; + services.openssh.enable = true; + services.logind.lidSwitch = "ignore"; + system.stateVersion = "20.09"; + time.timeZone = "Australia/Brisbane"; +} diff --git a/dns.nix b/dns.nix new file mode 100644 index 00000000..c9048718 --- /dev/null +++ b/dns.nix @@ -0,0 +1,11 @@ +{ config, pkgs, lib, ... }: +{ + services.dnsmasq.enable = false; + services.dnsmasq.extraConfig = '' + address=/.mossnet.lan/192.168.1.6 + dhcp-range=192.168.1.1,proxy + ''; + services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; + networking.firewall.allowedTCPPorts = [ 53 ]; + networking.firewall.allowedUDPPorts = [ 53 ]; +} diff --git a/hardware-configuration.nix b/hardware-configuration.nix new file mode 100644 index 00000000..44547c2a --- /dev/null +++ b/hardware-configuration.nix @@ -0,0 +1,29 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/d64cc666-2569-403d-8629-32c65732f683"; + fsType = "ext4"; + }; + + fileSystems."/data" = + { device = "/dev/disk/by-uuid/d85b6c90-501c-4f8d-adfd-84f8d66b203a"; + fsType = "ext4"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/e2479d1b-af81-44ed-ae47-0f7aee2817b8"; } + ]; +} diff --git a/headphones.nix b/headphones.nix new file mode 100644 index 00000000..a76c6d5d --- /dev/null +++ b/headphones.nix @@ -0,0 +1,12 @@ +{config, lib, pkgs, ... }: +{ + services.headphones = { + enable = true; + host = "192.168.1.6"; + port = 8181; + user = "headphones"; + group = "headphones"; + dataDir = "/data/downloaded"; + }; + networking.firewall.allowedTCPPorts = [ 8181 ]; +} diff --git a/mod-shaarli.nix b/mod-shaarli.nix new file mode 100644 index 00000000..b3e0b52c --- /dev/null +++ b/mod-shaarli.nix @@ -0,0 +1,80 @@ +{ config, lib, pkgs, ... }: + +let + phppoolName = "shaarli"; + dataDir = "/var/lib/shaarli"; + vhost = "192.168.1.6:1233"; + + shaarli = pkgs.callPackage ./pkg-shaarli.nix { + inherit dataDir; + }; +in +{ + services.nginx.virtualHosts."${vhost}" = { + forceSSL = false; + enableACME = false; + root = "${shaarli}"; + listen = [ { addr = "192.168.1.6"; port = 1233; } ]; + # extraConfig = '' + # index index.php; + # ''; + locations."/" = { + index = "index.php"; + extraConfig = '' + try_files $uri $uri/ index.php; + ''; + }; + locations."~ (index)\.php$" = { + extraConfig = '' + fastcgi_split_path_info ^(.+\.php)(/.*)$; + if (!-f $document_root$fastcgi_script_name) { + return 404; + } + + include ${pkgs.nginx}/conf/fastcgi.conf; + fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket}; + fastcgi_index index.php; + ''; + }; + locations."~ \.php$" = { + extraConfig = '' + deny all; + ''; + }; + }; + services.phpfpm.pools."${phppoolName}" = { + user = "nginx"; + group = "nginx"; + settings = { + "listen.owner" = "nginx"; + "listen.group" = "nginx"; + "user" = "nginx"; + "pm" = "dynamic"; + "pm.max_children" = "75"; + "pm.min_spare_servers" = "5"; + "pm.max_spare_servers" = "20"; + "pm.max_requests" = "10"; + "catch_workers_output" = "1"; + }; + }; + users.extraUsers.shaarli = { group = "shaarli"; }; + users.extraGroups.shaarli = { }; + systemd.services.shaarli-install = { + serviceConfig.Type = "oneshot"; + wantedBy = [ "multi-user.target" ]; + script = '' + if [ ! -d "${dataDir}" ]; then + mkdir -p ${dataDir}/{cache,data,pagecache,tmp} + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/ + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/ + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/ + fi + chown -Rc nginx:nginx ${dataDir} + find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; + find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; + ''; + }; + + networking.firewall.allowedTCPPorts = [ 1233 ]; +} diff --git a/mod-wallabag.nix b/mod-wallabag.nix new file mode 100644 index 00000000..cd7de9ce --- /dev/null +++ b/mod-wallabag.nix @@ -0,0 +1,218 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.services.wallabag; + + poolName = "wallabag"; + + configFile = pkgs.writeTextFile { + name = "wallabag-config"; + text = cfg.conf; + destination = "/config/parameters.yml"; + }; + + appDir = pkgs.buildEnv { + name = "wallabag-app-dir"; + ignoreCollisions = true; + checkCollisionContents = false; + paths = [ configFile "${cfg.package}/app" ]; + }; + +in { + options = { + services.wallabag = { + enable = mkEnableOption "wallabag"; + + user = mkOption { + type = types.str; + default = "nginx"; + description = '' + User account under which both the update daemon and the web-application run. + ''; + }; + + dataDir = mkOption { + type = types.path; + default = "/var/lib/wallabag"; + description = '' + Data directory. + ''; + }; + + package = mkOption { + type = types.package; + default = pkgs.wallabag; + description = '' + Wallabag package to use. + ''; + }; + + hostName = mkOption { + type = types.str; + description = '' + Name of the nginx virtualhost to use and setup. + ''; + }; + + poolConfig = mkOption { + type = types.lines; + default = '' + pm = dynamic + pm.max_children = 75 + pm.start_servers = 1 + pm.min_spare_servers = 1 + pm.max_spare_servers = 20 + pm.max_requests = 500 + catch_workers_output = 1 + ''; + description = '' + Options for wallabag's PHP pool. See the documentation on php-fpm.conf for details on configuration directives. + ''; + }; + + conf = mkOption { + type = types.str; + description = '' + Contents of the wallabag configuration file (parameters.yml) + ''; + }; + }; + }; + + + config = mkIf cfg.enable { + + services.phpfpm.pools."${poolName}" = { + user = "${cfg.user}"; + group = "nginx"; + settings = { + "listen.owner" = "nginx"; + "listen.group" = "nginx"; + "listen.mode" = "0600"; + "user" = "${cfg.user}"; + "group" = "nginx"; + "env[WALLABAG_DATA]" = "${cfg.dataDir}"; + "pm" = "dynamic"; + "pm.max_children" = "75"; + "pm.min_spare_servers" = "5"; + "pm.max_spare_servers" = "20"; + "pm.max_requests" = "10"; + "catch_workers_output" = "1"; + "php_admin_value[error_log]" = "/var/log/nginx/${poolName}-phpfpm-error.log"; + }; + }; + services.phpfpm.phpOptions = '' + max_execution_time = 120 + ''; + + services.nginx.enable = mkDefault true; + + services.nginx.virtualHosts."${cfg.hostName}" = { + enableACME = false; + forceSSL = false; + root = "${cfg.package}/web"; + + extraConfig = '' + add_header X-Frame-Options SAMEORIGIN; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + ''; + + locations."/" = { + extraConfig = '' + try_files $uri /app.php$is_args$args; + ''; + }; + + locations."/assets".root = "${cfg.dataDir}/web"; + + locations."~ ^/app\\.php(/|$)" = { + extraConfig = '' + fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket}; + fastcgi_split_path_info ^(.+\.php)(/.*)$; + + fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name; + fastcgi_param DOCUMENT_ROOT ${cfg.package}/web; + fastcgi_read_timeout 120; + + fastcgi_param QUERY_STRING $query_string; + fastcgi_param REQUEST_METHOD $request_method; + fastcgi_param CONTENT_TYPE $content_type; + fastcgi_param CONTENT_LENGTH $content_length; + + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param SCRIPT_NAME $fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; + fastcgi_param REQUEST_URI $request_uri; + fastcgi_param DOCUMENT_URI $document_uri; + fastcgi_param SERVER_PROTOCOL $server_protocol; + + fastcgi_param GATEWAY_INTERFACE CGI/1.1; + fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + + fastcgi_param REMOTE_ADDR $remote_addr; + fastcgi_param REMOTE_PORT $remote_port; + fastcgi_param SERVER_ADDR $server_addr; + fastcgi_param SERVER_PORT $server_port; + fastcgi_param SERVER_NAME $server_name; + + internal; + ''; + }; + + locations."~ /(?!app)\\.php$" = { + extraConfig = '' + return 404; + ''; + }; + }; + + systemd.services.wallabag-install = { + description = "Wallabag install service"; + wantedBy = [ "multi-user.target" ]; + before = [ "phpfpm-wallabag.service" ]; + after = [ "mysql.service" "postgresql.service" ]; + path = with pkgs; [ coreutils php phpPackages.composer ]; + + serviceConfig = { + User = cfg.user; + Type = "oneshot"; + RemainAfterExit = "yes"; + PermissionsStartOnly = true; + }; + + preStart = '' + mkdir -p "${cfg.dataDir}" + chown ${cfg.user}:nginx "${cfg.dataDir}" + ''; + + script = '' + echo "Setting up wallabag files in ${cfg.dataDir} ..." + cd "${cfg.dataDir}" + + rm -rf var/cache/* + rm -f app + ln -sf ${appDir} app + ln -sf ${cfg.package}/composer.{json,lock} . + + export WALLABAG_DATA="${cfg.dataDir}" + if [ ! -f installed ]; then + php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction + php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction + # Until https://github.com/wallabag/wallabag/issues/3662 is fixed + # yes no | php ${cfg.package}/bin/console --env=prod wallabag:install + touch installed + else + php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction + fi + php ${cfg.package}/bin/console --env=prod cache:clear + ''; + }; + }; + + meta = with stdenv.lib; { + maintainers = with maintainers; [ nadrieril ]; + }; +} diff --git a/monitoring.nix b/monitoring.nix new file mode 100644 index 00000000..c5683289 --- /dev/null +++ b/monitoring.nix @@ -0,0 +1,53 @@ +{ config, pkgs, ... }: { + # grafana configuration + services.grafana = { + enable = true; + domain = "grafana.mossnet.lan"; + port = 2342; + addr = "127.0.0.1"; + }; + + # nginx reverse proxy + services.nginx.virtualHosts.${config.services.grafana.domain} = { + locations."/" = { + proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; + proxyWebsockets = true; + }; + }; + + services.prometheus = { + enable = true; + port = 9001; + exporters = { + node = { + enable = true; + enabledCollectors = [ "systemd" ]; + port = 9002; + }; + }; + scrapeConfigs = [ + { + job_name = "bowl"; + static_configs = [{ + targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; + }]; + } + ]; + }; + + services.loki = { + enable = true; + configFile = /var/loki-config.yaml; + }; + + systemd.services.promtail = { + description = "Promtail service for Loki"; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + ExecStart = '' + ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} + ''; + }; + }; +} diff --git a/navidrome.nix b/navidrome.nix new file mode 100644 index 00000000..be4fe9c5 --- /dev/null +++ b/navidrome.nix @@ -0,0 +1,101 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.navidrome; + configFile = "/etc/navidrome/settings.json"; + dataFolder = "/var/lib/navidrome"; +in { + options = { + + services.navidrome = { + enable = mkEnableOption "Navidrome music server and streamer"; + + settings = lib.mkOption { + type = with types; attrsOf (oneOf [ int str ]); + default = {}; + example = literalExample '' + { + LogLevel = "INFO"; + BaseURL = "/music"; + ScanInterval = "10s"; + TranscodingCacheSize = "15MB"; + MusicFolder = "/data/music"; + }; + ''; + description = '' + Configuration for Navidrome, see for supported values. + ''; + }; + + user = mkOption { + type = types.str; + default = "navidrome"; + description = "User account under which Navidrome runs."; + }; + + group = mkOption { + type = types.str; + default = "navidrome"; + description = "Group account under which Navidrome runs."; + }; + + }; + }; + + config = mkIf cfg.enable { + + environment.etc."navidrome/settings.json".text = builtins.toJSON cfg.settings; + + services.navidrome.settings = { + DataFolder = dataFolder; + ConfigFile = configFile; + }; + + systemd.services.navidrome = { + description = "Navidrome Music Server and Streamer compatible with Subsonic/Airsonic"; + after = [ "remote-fs.target" "network.target" ]; + wantedBy = [ "multi-user.target" ]; + environment = { + ND_CONFIGFILE = configFile; + }; + serviceConfig = { + ExecStart = "${pkgs.navidrome}/bin/navidrome"; + WorkingDirectory = dataFolder; + TimeoutStopSec = "20"; + KillMode = "process"; + Restart = "on-failure"; + User = cfg.user; + Group = cfg.group; + DevicePolicy = "closed"; + NoNewPrivileges= " yes"; + PrivateTmp = "yes"; + PrivateUsers = "yes"; + ProtectControlGroups = "yes"; + ProtectKernelModules = "yes"; + ProtectKernelTunables = "yes"; + RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6"; + RestrictNamespaces = "yes"; + RestrictRealtime = "yes"; + SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; + ReadWritePaths = dataFolder; + StateDirectory = baseNameOf dataFolder; + }; + }; + + users.users = optionalAttrs (cfg.user == "navidrome") ({ + navidrome = { + description = "Navidrome service user"; + name = cfg.user; + group = cfg.group; + isSystemUser = true; + }; + }); + + users.groups = optionalAttrs (cfg.group == "navidrome") ({ + navidrome = {}; + }); + + }; +} diff --git a/networking.nix b/networking.nix new file mode 100644 index 00000000..c7c7c06a --- /dev/null +++ b/networking.nix @@ -0,0 +1,12 @@ +{ config, pkgs, ... }: +{ + #networking.interfaces.enp3s0.ipv4.addresses = [ { + #address = "192.168.1.6"; + #prefixLength = 24; + #} ]; + networking.nameservers = [ "1.1.1.1" ]; + #networking.defaultGateway = "192.168.1.1"; + environment.systemPackages = [ pkgs.mosh ]; + programs.mosh.enable = true; + #config.nssDatabase.hosts = [ "mdns_minimal" "[NOTFOUND=return]" ]; +} diff --git a/nextcloud.nix b/nextcloud.nix new file mode 100644 index 00000000..c1919b80 --- /dev/null +++ b/nextcloud.nix @@ -0,0 +1,52 @@ +{ pkgs, config, ... }: +{ + services.nextcloud = { + enable = true; + hostName = "mossnet.lan"; + #home = "/data/nextcloud"; + + # Use HTTPS for links + https = false; + + # Auto-update Nextcloud Apps + autoUpdateApps.enable = true; + # Set what time makes sense for you + autoUpdateApps.startAt = "05:00:00"; + + config = { + # Further forces Nextcloud to use HTTPS + # overwriteProtocol = "https"; + + # Nextcloud PostegreSQL database configuration, recommended over using SQLite + dbtype = "pgsql"; + dbuser = "nextcloud"; + dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself + dbname = "nextcloud"; + dbpassFile = "/var/nextcloud-db-pass"; + + adminpassFile = "/var/nextcloud-admin-pass"; + adminuser = "admin"; + }; + }; + + # Enable PostgreSQL + services.postgresql = { + enable = true; + + # Ensure the database, user, and permissions always exist + ensureDatabases = [ "nextcloud" ]; + ensureUsers = [ + { name = "nextcloud"; + ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES"; + } + ]; + }; + + # Ensure that postgres is running before running the setup + systemd.services."nextcloud-setup" = { + requires = ["postgresql.service"]; + after = ["postgresql.service"]; + }; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; +} diff --git a/nextcloud.nix.save.1 b/nextcloud.nix.save.1 new file mode 100644 index 00000000..cd28966c --- /dev/null +++ b/nextcloud.nix.save.1 @@ -0,0 +1,8 @@ +{ pkgs, config, ... }: +{ + security.acme = { + acceptTerms = true; + # Replace the email here! + email = "anish@lakhwara.com"; + }; +} diff --git a/pkg-navidrome.nix b/pkg-navidrome.nix new file mode 100644 index 00000000..5bcd3789 --- /dev/null +++ b/pkg-navidrome.nix @@ -0,0 +1,9 @@ +{ config, lib, pkgs, ... }: +{ + services.navidrome.enable = true; + services.navidrome.settings = { + MusicFolder = "/data/music"; + Port = 4433; + }; + networking.firewall.allowedTCPPorts = [ 4433 ]; +} diff --git a/pkg-rssBridge.nix b/pkg-rssBridge.nix new file mode 100644 index 00000000..e606c187 --- /dev/null +++ b/pkg-rssBridge.nix @@ -0,0 +1,30 @@ +{ lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }: + +stdenv.mkDerivation rec { + name = "rssBridge-${version}"; + version = "2020-10-11"; + preferLocalBuild = true; + + src = fetchurl { + url = "https://github.com/RSS-Bridge/rss-bridge/archive/${version}.tar.gz"; + sha256 = ""; + }; + + phases = [ "installPhase" ]; + installPhase = '' + mkdir $out + tar xzf $src + cp -ra * $out/ + find $out -type d -exec chmod 0755 {} \; + find $out -type f -exec chmod 0644 {} \; + ln -s $dataDir $out + ''; + + meta = with stdenv.lib; { + description = "RSS-Bridge is a project to create RSS Feeds for websites that don't have one."; + #license = licenses.agpl3; + homepage = "https://github.com/RSS-Bridge/rss-bridge/"; + platforms = platforms.all; + maintainers = with stdenv.lib.maintainers; [ chickensoupwithrice ]; + }; +} diff --git a/pkg-shaarli.nix b/pkg-shaarli.nix new file mode 100644 index 00000000..be780707 --- /dev/null +++ b/pkg-shaarli.nix @@ -0,0 +1,34 @@ +{ lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }: + +stdenv.mkDerivation rec { + name = "shaarli-${version}"; + version = "0.11.1"; + preferLocalBuild = true; + + src = fetchurl { + url = "https://github.com/shaarli/Shaarli/releases/download/v0.11.1/shaarli-v${version}-full.tar.gz"; + sha256 = "1psijcmi24hk0gxh1zdsm299xj11i7find2045nnx3r96cgnwjpn"; + }; + + phases = [ "installPhase" ]; + installPhase = '' + mkdir $out + tar xzf $src + cp -ra Shaarli/. $out/ + find $out -type d -exec chmod 0755 {} \; + find $out -type f -exec chmod 0644 {} \; + for a in cache data pagecache tmp; do + mv $out/$a $out/$a.orig + ln -s "${dataDir}/$a" $out/$a + done + ''; + + meta = with stdenv.lib; { + description = ""; + # License is complicated... + #license = licenses.agpl3; + homepage = "https://github.com/shaarli/Shaarli"; + platforms = platforms.all; + maintainers = with stdenv.lib.maintainers; [ tokudan ]; + }; +} diff --git a/pkg-wallabag.nix b/pkg-wallabag.nix new file mode 100644 index 00000000..e82c6c39 --- /dev/null +++ b/pkg-wallabag.nix @@ -0,0 +1,39 @@ +{ stdenv, fetchurl }: + +stdenv.mkDerivation rec { + pname = "wallabag"; + version = "2.4.0"; + + # remember to rm -r var/cache/* after a rebuild or unexpected errors will occur + + src = fetchurl { + url = "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz"; + sha256 = "11vda7aqq82kpr88v4hr7zg19zfq970n3z4qp25my8b1fvlgdjhi"; + }; + + outputs = [ "out" ]; + + patches = [ + ./wallabag-data.patch # exposes $WALLABAG_DATA + ]; + + dontBuild = true; + + installPhase = '' + mkdir $out/ + cp -R * $out/ + ''; + + meta = with stdenv.lib; { + description = "Web page archiver"; + longDescription = '' + wallabag is a self hostable application for saving web pages. + Point the environment variable $WALLABAG_DATA to a data directory that contains the folder `app/config` which must be a clone of wallabag's configuration files with your customized `parameters.yml`. These need to be updated every package upgrade. + After a package upgrade, empty the `var/cache` folder. + ''; + license = licenses.mit; + homepage = "http://wallabag.org"; + maintainers = with maintainers; [ schneefux ]; + platforms = platforms.all; + }; +} diff --git a/shaarli-broken.nix b/shaarli-broken.nix new file mode 100644 index 00000000..1541149c --- /dev/null +++ b/shaarli-broken.nix @@ -0,0 +1,78 @@ +{ config, pkgs, ... }: +let + app = "shaarli"; + dataDir = "/var/www/${app}"; +in { + services.nginx = { + enable = true; + virtualHosts = { + "192.168.1.6:1232" = { + forceSSL = false; + enableACME = false; + #root = pkgs.shaarli; + root = dataDir; + listen = [ { addr = "192.168.1.6"; port = 1232; } ]; + extraConfig = '' + index index.php; + ''; + locations = { + "/".index = "index.php"; + + "~ /\\.".extraConfig = '' + log_not_found off; + deny all; + ''; + + "~ (index)\\.php$".extraConfig = '' + try_files $uri =404 + include ${pkgs.nginx}/conf/fastcgi.conf; + fastcgi_split_path_info ^(.+\.php)(/.*)$; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param SHAARLI_CONFIG /var/www/shaarli/config; + + fastcgi_pass unix:${config.services.phpfpm.pools.${app}.socket}; + fastcgi_index index.php; + ''; + + "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;"; + + "~ \\.php$".extraConfig = '' + deny all; + ''; + + "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;"; + + "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = '' + expires max; + add_header Pragma public; + add_header Cache-Control "public, must-revalidate, proxy-revalidate"; + ''; + }; + }; + }; + }; + services.phpfpm.pools.${app} = { + user = app; + #listen = "/run/phpfpm/shaarli.sock"; + settings = { + "listen.owner" = config.services.nginx.user; + "pm" = "dynamic"; + "pm.max_children" = 4; + "pm.start_servers" = 2; + "pm.min_spare_servers" = 1; + "pm.max_spare_servers" = 4; + "pm.max_requests" = 32; + "php_admin_value[error_log]" = "stderr"; + "php_admin_flag[log_errors]" = true; + }; + }; + systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; + users.users.${app} = { + isSystemUser = true; + createHome = true; + home = dataDir; + group = app; + }; + users.groups.${app} = {}; + networking.firewall.allowedTCPPorts = [ 1232 ]; +} diff --git a/shaarli-docker.nix b/shaarli-docker.nix new file mode 100644 index 00000000..f2193fcf --- /dev/null +++ b/shaarli-docker.nix @@ -0,0 +1,9 @@ +{ pkg, config, lib, ... }: +{ + docker-containers."shaarli" = { + image = "shaarli/shaarli"; + volumes = [ "shaarli:/var/lib/shaarli/data/" ]; + ports = [ "1233:80" ]; + }; + networking.firewall.allowedTCPPorts = [ 1233 ]; +} diff --git a/shaarli-tokudan.nix b/shaarli-tokudan.nix new file mode 100644 index 00000000..8a3c3fca --- /dev/null +++ b/shaarli-tokudan.nix @@ -0,0 +1,97 @@ +{ config, lib, pkgs, ... }: + +let + phppoolName = "shaarli"; + dataDir = "/var/lib/shaarli"; + vhost = "192.168.1.6:1232"; + + shaarli = pkgs.callPackage ./pkg-shaarli.nix { + inherit dataDir; + }; +in +{ + services.nginx.virtualHosts."${vhost}" = { + forceSSL = false; + enableACME = false; + root = "${dataDir}"; + listen = [ { addr = "192.168.1.6"; port = 1232; } ]; + extraConfig = '' + index index.php; + ''; + locations."/" = { + extraConfig = '' + try_files _ /index.php$is_args$args;"; + ''; + }; + locations."~ (index)\\.php$" = { + extraConfig = '' + fastcgi_split_path_info ^(.+\.php)(/.*)$; + if (!-f $document_root$fastcgi_script_name) { + return 404; + } + + fastcgi_pass unix:${config.services.phpfpm.pools.shaarli.socket}; + fastcgi_index index.php; + + fastcgi_param QUERY_STRING $query_string; + fastcgi_param REQUEST_METHOD $request_method; + fastcgi_param CONTENT_TYPE $content_type; + fastcgi_param CONTENT_LENGTH $content_length; + + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param SCRIPT_NAME $fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; + fastcgi_param REQUEST_URI $request_uri; + fastcgi_param DOCUMENT_URI $document_uri; + fastcgi_param DOCUMENT_ROOT $document_root; + fastcgi_param SERVER_PROTOCOL $server_protocol; + + fastcgi_param GATEWAY_INTERFACE CGI/1.1; + fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + + fastcgi_param REMOTE_ADDR $remote_addr; + fastcgi_param REMOTE_PORT $remote_port; + fastcgi_param SERVER_ADDR $server_addr; + fastcgi_param SERVER_PORT $server_port; + fastcgi_param SERVER_NAME $server_name; + + fastcgi_param HTTPS $https; + ''; + }; + }; + services.phpfpm.pools.shaarli = { + user = "shaarli"; + group = "shaarli"; + settings = { + "listen.owner" = "nginx"; + "listen.group" = "nginx"; + "user" = "shaarli"; + "pm" = "dynamic"; + "pm.max_children" = "75"; + "pm.min_spare_servers" = "5"; + "pm.max_spare_servers" = "20"; + "pm.max_requests" = "10"; + "catch_workers_output" = "1"; + }; + }; + users.extraUsers.shaarli = { group = "shaarli"; home = dataDir; }; + users.extraGroups.shaarli = { }; + systemd.services.shaarli-install = { + serviceConfig.Type = "oneshot"; + wantedBy = [ "multi-user.target" ]; + script = '' + if [ ! -d "${dataDir}" ]; then + mkdir -p ${dataDir}/{cache,data,pagecache,tmp} + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/ + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/ + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ + cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/ + fi + chown -Rc shaarli:shaarli ${dataDir} + find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; + find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; + ''; + }; + networking.firewall.allowedTCPPorts = [ 1232 ]; +} diff --git a/shaarli.nix b/shaarli.nix new file mode 100644 index 00000000..b9afd461 --- /dev/null +++ b/shaarli.nix @@ -0,0 +1,116 @@ +{ pkgs, config, ... }: +let + dataDir = "/var/www/shaarli-config"; + name = "shaarli"; +in +{ + services.nginx = { + enable = true; + virtualHosts = { + "links.mossnet.lan" = { + forceSSL = false; + enableACME = false; + root = "${dataDir}"; + #listen = [ { addr = "192.168.1.6"; port = 1234; } ]; + extraConfig = '' + index index.php; + ''; + locations = { + "/".extraConfig = '' + try_files $uri $uri/ index.php; + ''; + + "~ (index)\.php$".extraConfig = '' + fastcgi_split_path_info ^(.+\.php)(/.*)$; + if (!-f $document_root$fastcgi_script_name) { + return 404; + } + + fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket}; + fastcgi_index index.php; + + fastcgi_param QUERY_STRING $query_string; + fastcgi_param REQUEST_METHOD $request_method; + fastcgi_param CONTENT_TYPE $content_type; + fastcgi_param CONTENT_LENGTH $content_length; + + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param SCRIPT_NAME $fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; + fastcgi_param REQUEST_URI $request_uri; + fastcgi_param DOCUMENT_URI $document_uri; + fastcgi_param DOCUMENT_ROOT $document_root; + fastcgi_param SERVER_PROTOCOL $server_protocol; + + fastcgi_param GATEWAY_INTERFACE CGI/1.1; + fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + + fastcgi_param REMOTE_ADDR $remote_addr; + fastcgi_param REMOTE_PORT $remote_port; + fastcgi_param SERVER_ADDR $server_addr; + fastcgi_param SERVER_PORT $server_port; + fastcgi_param SERVER_NAME $server_name; + ''; + + "~ \.php$".extraConfig = '' + deny all; + ''; + + "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;"; + + "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;"; + + "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = '' + expires max; + add_header Pragma public; + add_header Cache-Control "public, must-revalidate, proxy-revalidate"; + ''; + }; + }; + }; + }; + + services.phpfpm = { + pools = { + "${name}" = { + user = "nginx"; + group = "nginx"; + #listen = "/run/phpfpm/php.sock"; + settings = { + "listen.owner" = "nginx"; + "listen.group" = "nginx"; + "user" = "nginx"; + "pm" = "dynamic"; + "pm.max_children" = "4"; + "pm.min_spare_servers" = "1"; + "pm.max_spare_servers" = "4"; + "pm.max_requests" = "32"; + "catch_workers_output" = "1"; + "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log"; + }; + }; + }; + }; + users.extraUsers."${name}" = { group = "${name}"; }; + users.extraGroups."${name}" = { }; + systemd.services.shaarli-install = { + serviceConfig.Type = "oneshot"; + wantedBy = [ "multi-user.target" ]; + script = '' + if [ ! -d "${dataDir}" ]; then + mkdir -p ${dataDir}/{cache,data,pagecache,tmp} + cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/ + cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/ + cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ + cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/ + ln -S ${pkgs.shaarli}/* ${dataDir} + fi + chown -Rc nginx:nginx ${dataDir} + find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; + find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; + ''; + }; + # TODO: Write the configuration file here? + #networking.firewall.allowedTCPPorts = [ 1234 ]; +} diff --git a/shiori.nix b/shiori.nix new file mode 100644 index 00000000..a1dfde45 --- /dev/null +++ b/shiori.nix @@ -0,0 +1,7 @@ +{ pkgs, config, lib, ... }: +{ + services.shiori.enable = true; + services.shiori.address = "192.168.1.6"; + services.shiori.port = 1234; + networking.firewall.allowedTCPPorts = [ 1234 ]; +} diff --git a/taskd.nix b/taskd.nix new file mode 100644 index 00000000..94c4a3b6 --- /dev/null +++ b/taskd.nix @@ -0,0 +1,12 @@ +{ config, pkgs, ... }: + +{ + services.taskserver.enable = true; + #services.taskserver.fqdn = "192.168.1.6"; + #services.taskserver.listenHost = "192.168.1.6"; + services.taskserver.fqdn = "172.16.11.242"; + services.taskserver.listenHost = "172.16.11.242"; + services.taskserver.listenPort = 53589; + services.taskserver.organisations.mossnet.users = [ "anish" ]; +} + diff --git a/taskd.nix.save b/taskd.nix.save new file mode 100644 index 00000000..e69de29b diff --git a/taskd.nix.save.1 b/taskd.nix.save.1 new file mode 100644 index 00000000..22087794 --- /dev/null +++ b/taskd.nix.save.1 @@ -0,0 +1,9 @@ +{ config, pkgs, ... }: + +{ + services.taskserver.enable = true; + services.taskserver.fqdn = "bowl"; + services.taskserver.listenHost = "::"; + services.taskserver.organisations.mossnet.users = [ "anish" ]; +} + diff --git a/test-nginx.nix b/test-nginx.nix new file mode 100644 index 00000000..69c480f2 --- /dev/null +++ b/test-nginx.nix @@ -0,0 +1,24 @@ +{ pkgs, config, lib, ... }: + +let + vhost = "192.168.1.6:1232"; +in +{ + services.nginx.virtualHosts."${vhost}" = { + forceSSL = false; + enableACME = false; + root = "/var/lib/test"; + listen = [ { addr = "192.168.1.6"; port = 1232; } ]; + extraConfig = '' + index index.html; + ''; + + locations."/" = { + extraConfig = '' + try_files $uri $uri/ index.html; + ''; + }; + }; + + networking.firewall.allowedTCPPorts = [ 1232 ]; +} diff --git a/wallabag-data.patch b/wallabag-data.patch new file mode 100644 index 00000000..243569b4 --- /dev/null +++ b/wallabag-data.patch @@ -0,0 +1,31 @@ +diff --git a/app/AppKernel.php b/app/AppKernel.php +index 347197e..902b558 100644 +--- a/app/AppKernel.php ++++ b/app/AppKernel.php +@@ -69,19 +69,24 @@ class AppKernel extends Kernel + return __DIR__; + } + ++ public function getProjectDir() ++ { ++ return getenv('WALLABAG_DATA') ?: dirname(__DIR__); ++ } ++ + public function getCacheDir() + { +- return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment(); ++ return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment(); + } + + public function getLogDir() + { +- return dirname(__DIR__) . '/var/logs'; ++ return $this->getProjectDir() . '/var/logs'; + } + + public function registerContainerConfiguration(LoaderInterface $loader) + { +- $loader->load($this->getRootDir() . '/config/config_' . $this->getEnvironment() . '.yml'); ++ $loader->load($this->getProjectDir() . '/app/config/config_' . $this->getEnvironment() . '.yml'); + + $loader->load(function ($container) { diff --git a/wallabag-docker.nix b/wallabag-docker.nix new file mode 100644 index 00000000..4bd844a1 --- /dev/null +++ b/wallabag-docker.nix @@ -0,0 +1,52 @@ +{ pkg, config, lib, ... }: +{ + docker-containers."wallabag-db" = { + image = "postgres"; + environment = { + "POSTGRES_PASSWORD" = "wallaroot"; + "POSTGRES_USER" = "postgres"; + }; + extraDockerOptions = [ "--network=wallabag-br" ]; + volumes = [ "/opt/wallabag/data:/var/www/wallabag" ]; + }; + + docker-containers."wallabag" = { + image = "wallabag/wallabag"; + ports = [ "800:80" ]; + #volumes = [ "/opt/wallabag/data:/var/www/wallabag/data" "/opt/wallabag/images:/var/www/wallabag/web/assets/images" ]; + environment = { + "SYMFONY__ENV__DOMAIN_NAME" = "http://192.168.1.6:800"; + "POSTGRES_PASSWORD" = "wallaroot"; + "POSTGRES_USER" = "postgres"; + "SYMFONY__ENV__DATABASE_DRIVER" = "pdo_pgsql"; + "SYMFONY__ENV__DATABASE_DRIVER_CLASS" = "Wallabag\\CoreBundle\\Doctrine\\DBAL\\Driver\\CustomPostgreSQLDriver"; + "SYMFONY__ENV__DATABASE_HOST" = "wallabag-db"; + "SYMFONY__ENV__DATABASE_PORT" = "5432"; + "SYMFONY__ENV__DATABASE_NAME" = "wallabag"; + "SYMFONY__ENV__DATABASE_USER" = "wallabag"; + "SYMFONY__ENV__DATABASE_PASSWORD" = "wallapass"; + #"SYMFONY__ENV__DATABASE_CHARSET" = "utf8mb4"; + }; + extraDockerOptions = [ "--network=wallabag-br" ]; + }; + + systemd.services.init-wallabag-docker-br = { + description = "Create the network bridge wallabag."; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig.Type = "oneshot"; + script = let dockercli = "${config.virtualisation.docker.package}/bin/docker"; + in '' + # Put a true at the end to prevent getting non-zero return code, which will + # crash the whole service. + check=$(${dockercli} network ls | grep "wallabag-br" || true) + if [ -z "$check" ]; then + ${dockercli} network create wallabag-br + else + echo "wallabag-br already exists in docker" + fi + ''; + }; + networking.firewall.allowedTCPPorts = [ 800 ]; +} diff --git a/wallabag.nix b/wallabag.nix new file mode 100644 index 00000000..7039fd1a --- /dev/null +++ b/wallabag.nix @@ -0,0 +1,87 @@ +{ pkgs, config, lib, ... }: + +{ + + services.wallabag = { + enable = true; + hostName = "read.mossnet.lan"; + package = pkgs.callPackage ./pkg-wallabag.nix {}; + conf = '' +# This file is a "template" of what your parameters.yml file should look like +parameters: + # Uncomment these settings or manually update your parameters.yml + # to use docker-compose + # + # database_driver: %env.database_driver% + # database_host: %env.database_host% + # database_port: %env.database_port% + # database_name: %env.database_name% + # database_user: %env.database_user% + # database_password: %env.database_password% + + database_driver: pdo_pgsql + database_host: localhost + database_port: ~ + database_name: wallabag + database_user: wallabag + database_password: wallabag + # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite" + database_path: ~ + database_table_prefix: wallabag_ + database_socket: null + # with PostgreSQL and SQLite, you must set "utf8" + database_charset: utf8 + + domain_name: http://read.mossnet.lan + server_name: "mossnet wallabag instance" + + mailer_transport: smtp + mailer_user: ~ + mailer_password: ~ + mailer_host: 127.0.0.1 + mailer_port: false + mailer_encryption: ~ + mailer_auth_mode: ~ + + locale: en + + # A secret key that's used to generate certain security-related tokens + secret: SAFGOECRIlfal89oe6u0(*^dsaaih961 + + # two factor stuff + twofactor_auth: true + twofactor_sender: no-reply@wallabag.org + + # fosuser stuff + fosuser_registration: true + fosuser_confirmation: true + + # how long the access token should live in seconds for the API + fos_oauth_server_access_token_lifetime: 3600 + # how long the refresh token should life in seconds for the API + fos_oauth_server_refresh_token_lifetime: 1209600 + + from_email: no-reply@wallabag.org + + rss_limit: 50 + + # RabbitMQ processing + rabbitmq_host: localhost + rabbitmq_port: 5672 + rabbitmq_user: guest + rabbitmq_password: guest + rabbitmq_prefetch_count: 10 + + # Redis processing + redis_scheme: tcp + redis_host: localhost + redis_port: 6379 + redis_path: null + redis_password: null + + # sentry logging + sentry_dsn: ~ +''; + }; + # networking.firewall.allowedTCPPorts = [ 8080 ]; +} diff --git a/wireguard.nix b/wireguard.nix new file mode 100644 index 00000000..ebad01c3 --- /dev/null +++ b/wireguard.nix @@ -0,0 +1,21 @@ +{ config, pkgs, ... }: + +{ + boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ]; + environment.systemPackages = [ pkgs.wireguard ]; + networking.wireguard.enable = true; + networking.wireguard.interfaces = { + wg0 = { + ips = [ "10.0.69.2/32" ]; + privateKeyFile = "/var/lib/wireguard/priv"; + + peers = [ + { # helix - server + publicKey = "{c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=}"; + allowedIPs = [ "10.0.69.1/24" ]; + endpoint = "sealight.xyz:60990"; + persistentKeepalive = 25; + } ]; + }; + }; +}