aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

bowl

Browse source
This commit is contained in:
Anish Lakhwara 2021-01-29 00:13:47 +10:00
parent 8af4b6faf9
commit e3e7c1d99c
29 changed files with 1339 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
backup.nix Normal file
View file

@ -0,0 +1,34 @@
{
# Assumes the remote borg backup server has already been initialized
# borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive>
services.borgbackup.jobs = {
backupTaskwarriorRsync = {
paths = [ "/var/lib/taskserver" ];
doInit = true;
repo = "20779@hk-s020.rsync.net:taskwarrior" ;
encryption = {
mode = "repokey-blake2";
passCommand = "cat /run/keys/rsync";
};
environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
compression = "auto,lzma";
startAt = "weekly";
extraArgs = "--remote-path=borg1";
};
};
services.borgbackup.jobs = {
backupShaarliRsync = {
paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ];
doInit = true;
repo = "20779@hk-s020.rsync.net:shaarli" ;
encryption = {
mode = "repokey-blake2";
passCommand = "cat /run/keys/rsync";
};
environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
compression = "auto,lzma";
startAt = "weekly";
extraArgs = "--remote-path=borg1";
};
};
}

74
configuration.nix Normal file
View file

@ -0,0 +1,74 @@
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
./taskd.nix
./nextcloud.nix
./networking.nix
# ./wireguard.nix
# ./shiori.nix
./shaarli.nix
# ./shaarli-tokudan.nix
./mod-wallabag.nix
# ./pkg-wallabag.nix
./navidrome.nix
./pkg-navidrome.nix
./wallabag.nix
./headphones.nix
#./dns.nix
./backup.nix
./monitoring.nix
];
boot.loader.grub.devices = [ "/dev/sda" ];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.enableCryptodisk = true;
boot.loader.supportsInitrdSecrets = true;
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.initrd.availableKernelModules = ["virtio-pci"];
boot.initrd.network = {
enable = true;
ssh = {
enable = true;
port = 2222;
authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box
"];
hostKeys = [ "/host_ecdsa_key" ];
};
};
boot.initrd.luks.devices = {
"enc-pv" = {
name = "enc-pv";
preLVM = true;
device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c";
allowDiscards = true;
};
};
boot.initrd.secrets = {
"/host_ecdsa_key" = "/host_ecdsa_key";
};
boot.cleanTmpDir = true;
boot.kernelModules = [ "dm-snapshot" ];
users.users.anish = {
isNormalUser = true;
extraGroups = [ "wheel" ];
hashedPassword = "MO0Pbd2O4eIlA";
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ];
};
users.users.root.initialHashedPassword = "";
services.openssh.permitRootLogin = "prohibit-password";
networking.hostName = "bowl";
services.openssh.enable = true;
services.logind.lidSwitch = "ignore";
system.stateVersion = "20.09";
time.timeZone = "Australia/Brisbane";
}

11
dns.nix Normal file
View file

@ -0,0 +1,11 @@
{ config, pkgs, lib, ... }:
{
services.dnsmasq.enable = false;
services.dnsmasq.extraConfig = ''
address=/.mossnet.lan/192.168.1.6
dhcp-range=192.168.1.1,proxy
'';
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
}

29
hardware-configuration.nix Normal file
View file

@ -0,0 +1,29 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/d64cc666-2569-403d-8629-32c65732f683";
fsType = "ext4";
};
fileSystems."/data" =
{ device = "/dev/disk/by-uuid/d85b6c90-501c-4f8d-adfd-84f8d66b203a";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/e2479d1b-af81-44ed-ae47-0f7aee2817b8"; }
];
}

12
headphones.nix Normal file
View file

@ -0,0 +1,12 @@
{config, lib, pkgs, ... }:
{
services.headphones = {
enable = true;
host = "192.168.1.6";
port = 8181;
user = "headphones";
group = "headphones";
dataDir = "/data/downloaded";
};
networking.firewall.allowedTCPPorts = [ 8181 ];
}

80
mod-shaarli.nix Normal file
View file

@ -0,0 +1,80 @@
{ config, lib, pkgs, ... }:
let
phppoolName = "shaarli";
dataDir = "/var/lib/shaarli";
vhost = "192.168.1.6:1233";
shaarli = pkgs.callPackage ./pkg-shaarli.nix {
inherit dataDir;
};
in
{
services.nginx.virtualHosts."${vhost}" = {
forceSSL = false;
enableACME = false;
root = "${shaarli}";
listen = [ { addr = "192.168.1.6"; port = 1233; } ];
# extraConfig = ''
# index index.php;
# '';
locations."/" = {
index = "index.php";
extraConfig = ''
try_files $uri $uri/ index.php;
'';
};
locations."~ (index)\.php$" = {
extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.*)$;
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
include ${pkgs.nginx}/conf/fastcgi.conf;
fastcgi_pass unix:${config.services.phpfpm.pools."${phppoolName}".socket};
fastcgi_index index.php;
'';
};
locations."~ \.php$" = {
extraConfig = ''
deny all;
'';
};
};
services.phpfpm.pools."${phppoolName}" = {
user = "nginx";
group = "nginx";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"user" = "nginx";
"pm" = "dynamic";
"pm.max_children" = "75";
"pm.min_spare_servers" = "5";
"pm.max_spare_servers" = "20";
"pm.max_requests" = "10";
"catch_workers_output" = "1";
};
};
users.extraUsers.shaarli = { group = "shaarli"; };
users.extraGroups.shaarli = { };
systemd.services.shaarli-install = {
serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ];
script = ''
if [ ! -d "${dataDir}" ]; then
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/
fi
chown -Rc nginx:nginx ${dataDir}
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
'';
};
networking.firewall.allowedTCPPorts = [ 1233 ];
}

218
mod-wallabag.nix Normal file
View file

@ -0,0 +1,218 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.wallabag;
poolName = "wallabag";
configFile = pkgs.writeTextFile {
name = "wallabag-config";
text = cfg.conf;
destination = "/config/parameters.yml";
};
appDir = pkgs.buildEnv {
name = "wallabag-app-dir";
ignoreCollisions = true;
checkCollisionContents = false;
paths = [ configFile "${cfg.package}/app" ];
};
in {
options = {
services.wallabag = {
enable = mkEnableOption "wallabag";
user = mkOption {
type = types.str;
default = "nginx";
description = ''
User account under which both the update daemon and the web-application run.
'';
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/wallabag";
description = ''
Data directory.
'';
};
package = mkOption {
type = types.package;
default = pkgs.wallabag;
description = ''
Wallabag package to use.
'';
};
hostName = mkOption {
type = types.str;
description = ''
Name of the nginx virtualhost to use and setup.
'';
};
poolConfig = mkOption {
type = types.lines;
default = ''
pm = dynamic
pm.max_children = 75
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 20
pm.max_requests = 500
catch_workers_output = 1
'';
description = ''
Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
'';
};
conf = mkOption {
type = types.str;
description = ''
Contents of the wallabag configuration file (parameters.yml)
'';
};
};
};
config = mkIf cfg.enable {
services.phpfpm.pools."${poolName}" = {
user = "${cfg.user}";
group = "nginx";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"listen.mode" = "0600";
"user" = "${cfg.user}";
"group" = "nginx";
"env[WALLABAG_DATA]" = "${cfg.dataDir}";
"pm" = "dynamic";
"pm.max_children" = "75";
"pm.min_spare_servers" = "5";
"pm.max_spare_servers" = "20";
"pm.max_requests" = "10";
"catch_workers_output" = "1";
"php_admin_value[error_log]" = "/var/log/nginx/${poolName}-phpfpm-error.log";
};
};
services.phpfpm.phpOptions = ''
max_execution_time = 120
'';
services.nginx.enable = mkDefault true;
services.nginx.virtualHosts."${cfg.hostName}" = {
enableACME = false;
forceSSL = false;
root = "${cfg.package}/web";
extraConfig = ''
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
'';
locations."/" = {
extraConfig = ''
try_files $uri /app.php$is_args$args;
'';
};
locations."/assets".root = "${cfg.dataDir}/web";
locations."~ ^/app\\.php(/|$)" = {
extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
fastcgi_split_path_info ^(.+\.php)(/.*)$;
fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
fastcgi_read_timeout 120;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
internal;
'';
};
locations."~ /(?!app)\\.php$" = {
extraConfig = ''
return 404;
'';
};
};
systemd.services.wallabag-install = {
description = "Wallabag install service";
wantedBy = [ "multi-user.target" ];
before = [ "phpfpm-wallabag.service" ];
after = [ "mysql.service" "postgresql.service" ];
path = with pkgs; [ coreutils php phpPackages.composer ];
serviceConfig = {
User = cfg.user;
Type = "oneshot";
RemainAfterExit = "yes";
PermissionsStartOnly = true;
};
preStart = ''
mkdir -p "${cfg.dataDir}"
chown ${cfg.user}:nginx "${cfg.dataDir}"
'';
script = ''
echo "Setting up wallabag files in ${cfg.dataDir} ..."
cd "${cfg.dataDir}"
rm -rf var/cache/*
rm -f app
ln -sf ${appDir} app
ln -sf ${cfg.package}/composer.{json,lock} .
export WALLABAG_DATA="${cfg.dataDir}"
if [ ! -f installed ]; then
php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
# Until https://github.com/wallabag/wallabag/issues/3662 is fixed
# yes no | php ${cfg.package}/bin/console --env=prod wallabag:install
touch installed
else
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
fi
php ${cfg.package}/bin/console --env=prod cache:clear
'';
};
};
meta = with stdenv.lib; {
maintainers = with maintainers; [ nadrieril ];
};
}

53
monitoring.nix Normal file
View file

@ -0,0 +1,53 @@
{ config, pkgs, ... }: {
# grafana configuration
services.grafana = {
enable = true;
domain = "grafana.mossnet.lan";
port = 2342;
addr = "127.0.0.1";
};
# nginx reverse proxy
services.nginx.virtualHosts.${config.services.grafana.domain} = {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
proxyWebsockets = true;
};
};
services.prometheus = {
enable = true;
port = 9001;
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
port = 9002;
};
};
scrapeConfigs = [
{
job_name = "bowl";
static_configs = [{
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
}];
}
];
};
services.loki = {
enable = true;
configFile = /var/loki-config.yaml;
};
systemd.services.promtail = {
description = "Promtail service for Loki";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''
${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
'';
};
};
}

101
navidrome.nix Normal file
View file

@ -0,0 +1,101 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.navidrome;
configFile = "/etc/navidrome/settings.json";
dataFolder = "/var/lib/navidrome";
in {
options = {
services.navidrome = {
enable = mkEnableOption "Navidrome music server and streamer";
settings = lib.mkOption {
type = with types; attrsOf (oneOf [ int str ]);
default = {};
example = literalExample ''
{
LogLevel = "INFO";
BaseURL = "/music";
ScanInterval = "10s";
TranscodingCacheSize = "15MB";
MusicFolder = "/data/music";
};
'';
description = ''
Configuration for Navidrome, see <link xlink:href="https://www.navidrome.org/docs/usage/configuration-options/"/> for supported values.
'';
};
user = mkOption {
type = types.str;
default = "navidrome";
description = "User account under which Navidrome runs.";
};
group = mkOption {
type = types.str;
default = "navidrome";
description = "Group account under which Navidrome runs.";
};
};
};
config = mkIf cfg.enable {
environment.etc."navidrome/settings.json".text = builtins.toJSON cfg.settings;
services.navidrome.settings = {
DataFolder = dataFolder;
ConfigFile = configFile;
};
systemd.services.navidrome = {
description = "Navidrome Music Server and Streamer compatible with Subsonic/Airsonic";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
environment = {
ND_CONFIGFILE = configFile;
};
serviceConfig = {
ExecStart = "${pkgs.navidrome}/bin/navidrome";
WorkingDirectory = dataFolder;
TimeoutStopSec = "20";
KillMode = "process";
Restart = "on-failure";
User = cfg.user;
Group = cfg.group;
DevicePolicy = "closed";
NoNewPrivileges= " yes";
PrivateTmp = "yes";
PrivateUsers = "yes";
ProtectControlGroups = "yes";
ProtectKernelModules = "yes";
ProtectKernelTunables = "yes";
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "navidrome") ({
navidrome = {
description = "Navidrome service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "navidrome") ({
navidrome = {};
});
};
}

12
networking.nix Normal file
View file

@ -0,0 +1,12 @@
{ config, pkgs, ... }:
{
#networking.interfaces.enp3s0.ipv4.addresses = [ {
#address = "192.168.1.6";
#prefixLength = 24;
#} ];
networking.nameservers = [ "1.1.1.1" ];
#networking.defaultGateway = "192.168.1.1";
environment.systemPackages = [ pkgs.mosh ];
programs.mosh.enable = true;
#config.nssDatabase.hosts = [ "mdns_minimal" "[NOTFOUND=return]" ];
}

52
nextcloud.nix Normal file
View file

@ -0,0 +1,52 @@
{ pkgs, config, ... }:
{
services.nextcloud = {
enable = true;
hostName = "mossnet.lan";
#home = "/data/nextcloud";
# Use HTTPS for links
https = false;
# Auto-update Nextcloud Apps
autoUpdateApps.enable = true;
# Set what time makes sense for you
autoUpdateApps.startAt = "05:00:00";
config = {
# Further forces Nextcloud to use HTTPS
# overwriteProtocol = "https";
# Nextcloud PostegreSQL database configuration, recommended over using SQLite
dbtype = "pgsql";
dbuser = "nextcloud";
dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
dbname = "nextcloud";
dbpassFile = "/var/nextcloud-db-pass";
adminpassFile = "/var/nextcloud-admin-pass";
adminuser = "admin";
};
};
# Enable PostgreSQL
services.postgresql = {
enable = true;
# Ensure the database, user, and permissions always exist
ensureDatabases = [ "nextcloud" ];
ensureUsers = [
{ name = "nextcloud";
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
}
];
};
# Ensure that postgres is running before running the setup
systemd.services."nextcloud-setup" = {
requires = ["postgresql.service"];
after = ["postgresql.service"];
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
}

8
nextcloud.nix.save.1 Normal file
View file

@ -0,0 +1,8 @@
{ pkgs, config, ... }:
{
security.acme = {
acceptTerms = true;
# Replace the email here!
email = "anish@lakhwara.com";
};
}

9
pkg-navidrome.nix Normal file
View file

@ -0,0 +1,9 @@
{ config, lib, pkgs, ... }:
{
services.navidrome.enable = true;
services.navidrome.settings = {
MusicFolder = "/data/music";
Port = 4433;
};
networking.firewall.allowedTCPPorts = [ 4433 ];
}

30
pkg-rssBridge.nix Normal file
View file

@ -0,0 +1,30 @@
{ lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }:
stdenv.mkDerivation rec {
name = "rssBridge-${version}";
version = "2020-10-11";
preferLocalBuild = true;
src = fetchurl {
url = "https://github.com/RSS-Bridge/rss-bridge/archive/${version}.tar.gz";
sha256 = "";
};
phases = [ "installPhase" ];
installPhase = ''
mkdir $out
tar xzf $src
cp -ra * $out/
find $out -type d -exec chmod 0755 {} \;
find $out -type f -exec chmod 0644 {} \;
ln -s $dataDir $out
'';
meta = with stdenv.lib; {
description = "RSS-Bridge is a project to create RSS Feeds for websites that don't have one.";
#license = licenses.agpl3;
homepage = "https://github.com/RSS-Bridge/rss-bridge/";
platforms = platforms.all;
maintainers = with stdenv.lib.maintainers; [ chickensoupwithrice ];
};
}

34
pkg-shaarli.nix Normal file
View file

@ -0,0 +1,34 @@
{ lib, stdenv, fetchurl, config ? null, dataDir ? "/var/lib/shaarli" }:
stdenv.mkDerivation rec {
name = "shaarli-${version}";
version = "0.11.1";
preferLocalBuild = true;
src = fetchurl {
url = "https://github.com/shaarli/Shaarli/releases/download/v0.11.1/shaarli-v${version}-full.tar.gz";
sha256 = "1psijcmi24hk0gxh1zdsm299xj11i7find2045nnx3r96cgnwjpn";
};
phases = [ "installPhase" ];
installPhase = ''
mkdir $out
tar xzf $src
cp -ra Shaarli/. $out/
find $out -type d -exec chmod 0755 {} \;
find $out -type f -exec chmod 0644 {} \;
for a in cache data pagecache tmp; do
mv $out/$a $out/$a.orig
ln -s "${dataDir}/$a" $out/$a
done
'';
meta = with stdenv.lib; {
description = "";
# License is complicated...
#license = licenses.agpl3;
homepage = "https://github.com/shaarli/Shaarli";
platforms = platforms.all;
maintainers = with stdenv.lib.maintainers; [ tokudan ];
};
}

39
pkg-wallabag.nix Normal file
View file

@ -0,0 +1,39 @@
{ stdenv, fetchurl }:
stdenv.mkDerivation rec {
pname = "wallabag";
version = "2.4.0";
# remember to rm -r var/cache/* after a rebuild or unexpected errors will occur
src = fetchurl {
url = "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz";
sha256 = "11vda7aqq82kpr88v4hr7zg19zfq970n3z4qp25my8b1fvlgdjhi";
};
outputs = [ "out" ];
patches = [
./wallabag-data.patch # exposes $WALLABAG_DATA
];
dontBuild = true;
installPhase = ''
mkdir $out/
cp -R * $out/
'';
meta = with stdenv.lib; {
description = "Web page archiver";
longDescription = ''
wallabag is a self hostable application for saving web pages.
Point the environment variable $WALLABAG_DATA to a data directory that contains the folder `app/config` which must be a clone of wallabag's configuration files with your customized `parameters.yml`. These need to be updated every package upgrade.
After a package upgrade, empty the `var/cache` folder.
'';
license = licenses.mit;
homepage = "http://wallabag.org";
maintainers = with maintainers; [ schneefux ];
platforms = platforms.all;
};
}

78
shaarli-broken.nix Normal file
View file

@ -0,0 +1,78 @@
{ config, pkgs, ... }:
let
app = "shaarli";
dataDir = "/var/www/${app}";
in {
services.nginx = {
enable = true;
virtualHosts = {
"192.168.1.6:1232" = {
forceSSL = false;
enableACME = false;
#root = pkgs.shaarli;
root = dataDir;
listen = [ { addr = "192.168.1.6"; port = 1232; } ];
extraConfig = ''
index index.php;
'';
locations = {
"/".index = "index.php";
"~ /\\.".extraConfig = ''
log_not_found off;
deny all;
'';
"~ (index)\\.php$".extraConfig = ''
try_files $uri =404
include ${pkgs.nginx}/conf/fastcgi.conf;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SHAARLI_CONFIG /var/www/shaarli/config;
fastcgi_pass unix:${config.services.phpfpm.pools.${app}.socket};
fastcgi_index index.php;
'';
"^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";
"~ \\.php$".extraConfig = ''
deny all;
'';
"^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";
"~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
expires max;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
'';
};
};
};
};
services.phpfpm.pools.${app} = {
user = app;
#listen = "/run/phpfpm/shaarli.sock";
settings = {
"listen.owner" = config.services.nginx.user;
"pm" = "dynamic";
"pm.max_children" = 4;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 1;
"pm.max_spare_servers" = 4;
"pm.max_requests" = 32;
"php_admin_value[error_log]" = "stderr";
"php_admin_flag[log_errors]" = true;
};
};
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
users.users.${app} = {
isSystemUser = true;
createHome = true;
home = dataDir;
group = app;
};
users.groups.${app} = {};
networking.firewall.allowedTCPPorts = [ 1232 ];
}

9
shaarli-docker.nix Normal file
View file

@ -0,0 +1,9 @@
{ pkg, config, lib, ... }:
{
docker-containers."shaarli" = {
image = "shaarli/shaarli";
volumes = [ "shaarli:/var/lib/shaarli/data/" ];
ports = [ "1233:80" ];
};
networking.firewall.allowedTCPPorts = [ 1233 ];
}

97
shaarli-tokudan.nix Normal file
View file

@ -0,0 +1,97 @@
{ config, lib, pkgs, ... }:
let
phppoolName = "shaarli";
dataDir = "/var/lib/shaarli";
vhost = "192.168.1.6:1232";
shaarli = pkgs.callPackage ./pkg-shaarli.nix {
inherit dataDir;
};
in
{
services.nginx.virtualHosts."${vhost}" = {
forceSSL = false;
enableACME = false;
root = "${dataDir}";
listen = [ { addr = "192.168.1.6"; port = 1232; } ];
extraConfig = ''
index index.php;
'';
locations."/" = {
extraConfig = ''
try_files _ /index.php$is_args$args;";
'';
};
locations."~ (index)\\.php$" = {
extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.*)$;
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
fastcgi_pass unix:${config.services.phpfpm.pools.shaarli.socket};
fastcgi_index index.php;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
fastcgi_param HTTPS $https;
'';
};
};
services.phpfpm.pools.shaarli = {
user = "shaarli";
group = "shaarli";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"user" = "shaarli";
"pm" = "dynamic";
"pm.max_children" = "75";
"pm.min_spare_servers" = "5";
"pm.max_spare_servers" = "20";
"pm.max_requests" = "10";
"catch_workers_output" = "1";
};
};
users.extraUsers.shaarli = { group = "shaarli"; home = dataDir; };
users.extraGroups.shaarli = { };
systemd.services.shaarli-install = {
serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ];
script = ''
if [ ! -d "${dataDir}" ]; then
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/cache/
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/data/
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
cp -R ${shaarli}/data.orig/.htaccess ${dataDir}/tmp/
fi
chown -Rc shaarli:shaarli ${dataDir}
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
'';
};
networking.firewall.allowedTCPPorts = [ 1232 ];
}

116
shaarli.nix Normal file
View file

@ -0,0 +1,116 @@
{ pkgs, config, ... }:
let
dataDir = "/var/www/shaarli-config";
name = "shaarli";
in
{
services.nginx = {
enable = true;
virtualHosts = {
"links.mossnet.lan" = {
forceSSL = false;
enableACME = false;
root = "${dataDir}";
#listen = [ { addr = "192.168.1.6"; port = 1234; } ];
extraConfig = ''
index index.php;
'';
locations = {
"/".extraConfig = ''
try_files $uri $uri/ index.php;
'';
"~ (index)\.php$".extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.*)$;
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket};
fastcgi_index index.php;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
'';
"~ \.php$".extraConfig = ''
deny all;
'';
"^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";
"^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";
"~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
expires max;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
'';
};
};
};
};
services.phpfpm = {
pools = {
"${name}" = {
user = "nginx";
group = "nginx";
#listen = "/run/phpfpm/php.sock";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"user" = "nginx";
"pm" = "dynamic";
"pm.max_children" = "4";
"pm.min_spare_servers" = "1";
"pm.max_spare_servers" = "4";
"pm.max_requests" = "32";
"catch_workers_output" = "1";
"php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log";
};
};
};
};
users.extraUsers."${name}" = { group = "${name}"; };
users.extraGroups."${name}" = { };
systemd.services.shaarli-install = {
serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ];
script = ''
if [ ! -d "${dataDir}" ]; then
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/
ln -S ${pkgs.shaarli}/* ${dataDir}
fi
chown -Rc nginx:nginx ${dataDir}
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
'';
};
# TODO: Write the configuration file here?
#networking.firewall.allowedTCPPorts = [ 1234 ];
}

7
shiori.nix Normal file
View file

@ -0,0 +1,7 @@
{ pkgs, config, lib, ... }:
{
services.shiori.enable = true;
services.shiori.address = "192.168.1.6";
services.shiori.port = 1234;
networking.firewall.allowedTCPPorts = [ 1234 ];
}

12
taskd.nix Normal file
View file

@ -0,0 +1,12 @@
{ config, pkgs, ... }:
{
services.taskserver.enable = true;
#services.taskserver.fqdn = "192.168.1.6";
#services.taskserver.listenHost = "192.168.1.6";
services.taskserver.fqdn = "172.16.11.242";
services.taskserver.listenHost = "172.16.11.242";
services.taskserver.listenPort = 53589;
services.taskserver.organisations.mossnet.users = [ "anish" ];
}

0
taskd.nix.save Normal file
View file

9
taskd.nix.save.1 Normal file
View file

@ -0,0 +1,9 @@
{ config, pkgs, ... }:
{
services.taskserver.enable = true;
services.taskserver.fqdn = "bowl";
services.taskserver.listenHost = "::";
services.taskserver.organisations.mossnet.users = [ "anish" ];
}

24
test-nginx.nix Normal file
View file

@ -0,0 +1,24 @@
{ pkgs, config, lib, ... }:
let
vhost = "192.168.1.6:1232";
in
{
services.nginx.virtualHosts."${vhost}" = {
forceSSL = false;
enableACME = false;
root = "/var/lib/test";
listen = [ { addr = "192.168.1.6"; port = 1232; } ];
extraConfig = ''
index index.html;
'';
locations."/" = {
extraConfig = ''
try_files $uri $uri/ index.html;
'';
};
};
networking.firewall.allowedTCPPorts = [ 1232 ];
}

31
wallabag-data.patch Normal file
View file

@ -0,0 +1,31 @@
diff --git a/app/AppKernel.php b/app/AppKernel.php
index 347197e..902b558 100644
--- a/app/AppKernel.php
+++ b/app/AppKernel.php
@@ -69,19 +69,24 @@ class AppKernel extends Kernel
return __DIR__;
}
+ public function getProjectDir()
+ {
+ return getenv('WALLABAG_DATA') ?: dirname(__DIR__);
+ }
+
public function getCacheDir()
{
- return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment();
+ return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment();
}
public function getLogDir()
{
- return dirname(__DIR__) . '/var/logs';
+ return $this->getProjectDir() . '/var/logs';
}
public function registerContainerConfiguration(LoaderInterface $loader)
{
- $loader->load($this->getRootDir() . '/config/config_' . $this->getEnvironment() . '.yml');
+ $loader->load($this->getProjectDir() . '/app/config/config_' . $this->getEnvironment() . '.yml');
$loader->load(function ($container) {

52
wallabag-docker.nix Normal file
View file

@ -0,0 +1,52 @@
{ pkg, config, lib, ... }:
{
docker-containers."wallabag-db" = {
image = "postgres";
environment = {
"POSTGRES_PASSWORD" = "wallaroot";
"POSTGRES_USER" = "postgres";
};
extraDockerOptions = [ "--network=wallabag-br" ];
volumes = [ "/opt/wallabag/data:/var/www/wallabag" ];
};
docker-containers."wallabag" = {
image = "wallabag/wallabag";
ports = [ "800:80" ];
#volumes = [ "/opt/wallabag/data:/var/www/wallabag/data" "/opt/wallabag/images:/var/www/wallabag/web/assets/images" ];
environment = {
"SYMFONY__ENV__DOMAIN_NAME" = "http://192.168.1.6:800";
"POSTGRES_PASSWORD" = "wallaroot";
"POSTGRES_USER" = "postgres";
"SYMFONY__ENV__DATABASE_DRIVER" = "pdo_pgsql";
"SYMFONY__ENV__DATABASE_DRIVER_CLASS" = "Wallabag\\CoreBundle\\Doctrine\\DBAL\\Driver\\CustomPostgreSQLDriver";
"SYMFONY__ENV__DATABASE_HOST" = "wallabag-db";
"SYMFONY__ENV__DATABASE_PORT" = "5432";
"SYMFONY__ENV__DATABASE_NAME" = "wallabag";
"SYMFONY__ENV__DATABASE_USER" = "wallabag";
"SYMFONY__ENV__DATABASE_PASSWORD" = "wallapass";
#"SYMFONY__ENV__DATABASE_CHARSET" = "utf8mb4";
};
extraDockerOptions = [ "--network=wallabag-br" ];
};
systemd.services.init-wallabag-docker-br = {
description = "Create the network bridge wallabag.";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = let dockercli = "${config.virtualisation.docker.package}/bin/docker";
in ''
# Put a true at the end to prevent getting non-zero return code, which will
# crash the whole service.
check=$(${dockercli} network ls | grep "wallabag-br" || true)
if [ -z "$check" ]; then
${dockercli} network create wallabag-br
else
echo "wallabag-br already exists in docker"
fi
'';
};
networking.firewall.allowedTCPPorts = [ 800 ];
}

87
wallabag.nix Normal file
View file

@ -0,0 +1,87 @@
{ pkgs, config, lib, ... }:
{
services.wallabag = {
enable = true;
hostName = "read.mossnet.lan";
package = pkgs.callPackage ./pkg-wallabag.nix {};
conf = ''
# This file is a "template" of what your parameters.yml file should look like
parameters:
# Uncomment these settings or manually update your parameters.yml
# to use docker-compose
#
# database_driver: %env.database_driver%
# database_host: %env.database_host%
# database_port: %env.database_port%
# database_name: %env.database_name%
# database_user: %env.database_user%
# database_password: %env.database_password%
database_driver: pdo_pgsql
database_host: localhost
database_port: ~
database_name: wallabag
database_user: wallabag
database_password: wallabag
# For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
database_path: ~
database_table_prefix: wallabag_
database_socket: null
# with PostgreSQL and SQLite, you must set "utf8"
database_charset: utf8
domain_name: http://read.mossnet.lan
server_name: "mossnet wallabag instance"
mailer_transport: smtp
mailer_user: ~
mailer_password: ~
mailer_host: 127.0.0.1
mailer_port: false
mailer_encryption: ~
mailer_auth_mode: ~
locale: en
# A secret key that's used to generate certain security-related tokens
secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
# two factor stuff
twofactor_auth: true
twofactor_sender: no-reply@wallabag.org
# fosuser stuff
fosuser_registration: true
fosuser_confirmation: true
# how long the access token should live in seconds for the API
fos_oauth_server_access_token_lifetime: 3600
# how long the refresh token should life in seconds for the API
fos_oauth_server_refresh_token_lifetime: 1209600
from_email: no-reply@wallabag.org
rss_limit: 50
# RabbitMQ processing
rabbitmq_host: localhost
rabbitmq_port: 5672
rabbitmq_user: guest
rabbitmq_password: guest
rabbitmq_prefetch_count: 10
# Redis processing
redis_scheme: tcp
redis_host: localhost
redis_port: 6379
redis_path: null
redis_password: null
# sentry logging
sentry_dsn: ~
'';
};
# networking.firewall.allowedTCPPorts = [ 8080 ];
}

21
wireguard.nix Normal file
View file

@ -0,0 +1,21 @@
{ config, pkgs, ... }:
{
boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ];
environment.systemPackages = [ pkgs.wireguard ];
networking.wireguard.enable = true;
networking.wireguard.interfaces = {
wg0 = {
ips = [ "10.0.69.2/32" ];
privateKeyFile = "/var/lib/wireguard/priv";
peers = [
{ # helix - server
publicKey = "{c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=}";
allowedIPs = [ "10.0.69.1/24" ];
endpoint = "sealight.xyz:60990";
persistentKeepalive = 25;
} ];
};
};
}