merging in box
This commit is contained in:
		
							parent
							
								
									cdd7baebb0
								
							
						
					
					
						commit
						e950234ee1
					
				|  | @ -118,7 +118,8 @@ | ||||||
|             suites = with profiles; rec { |             suites = with profiles; rec { | ||||||
|               base = [ core users.root users.anish ]; |               base = [ core users.root users.anish ]; | ||||||
|               sealight = [ base server ]; # matrix rsshub backup wireguard |               sealight = [ base server ]; # matrix rsshub backup wireguard | ||||||
|               mossnet = [ base server ]; # shaarli wallabag nextcloud taskwarrior headphones  |               mossnet = [ base server ]; # taskd nextcloud networking wireguard shaarli mod-wallabag wallabag headphones dns backup monitoring dev gonic module-gonic cron nfs | ||||||
|  | 
 | ||||||
|               cube = [ base site server ]; |               cube = [ base site server ]; | ||||||
|               graphical = [ base bluetooth music sync wireguard wifi desktop ]; |               graphical = [ base bluetooth music sync wireguard wifi desktop ]; | ||||||
|               curve = [ graphical secrets ]; |               curve = [ graphical secrets ]; | ||||||
|  |  | ||||||
							
								
								
									
										96
									
								
								hosts/box/configuration.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										96
									
								
								hosts/box/configuration.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,96 @@ | ||||||
|  | # Edit this configuration file to define what should be installed on | ||||||
|  | # your system.  Help is available in the configuration.nix(5) man page | ||||||
|  | # and in the NixOS manual (accessible by running ‘nixos-help’). | ||||||
|  | 
 | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   imports = | ||||||
|  |     [ # Include the results of the hardware scan. | ||||||
|  |       ./hardware-configuration.nix | ||||||
|  |     ]; | ||||||
|  |    | ||||||
|  |   # Use the GRUB 2 boot loader. | ||||||
|  |   boot.loader.efi.canTouchEfiVariables = false; | ||||||
|  |   boot.loader.efi.efiSysMountPoint = "/boot/efi"; | ||||||
|  |   boot.loader.grub = { | ||||||
|  |     enable = true; | ||||||
|  |     device = "nodev"; | ||||||
|  |     version = 2; | ||||||
|  |     efiSupport = true; | ||||||
|  |     enableCryptodisk = true; | ||||||
|  |     efiInstallAsRemovable = true; | ||||||
|  |   }; | ||||||
|  |    | ||||||
|  |   boot.initrd.secrets = { | ||||||
|  |     "/keyfile0.bin" = /etc/secrets/initrd/keyfile0.bin; | ||||||
|  |     "/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   boot.initrd.luks.devices = { | ||||||
|  |     "root" = {  | ||||||
|  |       #name = "root"; | ||||||
|  |       device = "/dev/disk/by-uuid/f37f3222-47d7-42d8-b400-363320a31853"; # UUID for /dev/nvme01np2  | ||||||
|  |       preLVM = true; | ||||||
|  |       allowDiscards = true; | ||||||
|  |       keyFile = "/keyfile0.bin"; | ||||||
|  |     }; | ||||||
|  | 	}; | ||||||
|  | 
 | ||||||
|  |   # Data mount | ||||||
|  |   fileSystems."/data" = { | ||||||
|  |     device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; # UUID for /dev/mapper/crypted-data | ||||||
|  |     encrypted = { | ||||||
|  |       enable = true; | ||||||
|  |       label = "crypted-data"; | ||||||
|  |       blkDev = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; # UUID for /dev/sda1 | ||||||
|  |       keyFile = "/keyfile1.bin"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.interfaces.enp2s0 =  { | ||||||
|  |     ipv4.addresses = [{ | ||||||
|  |       address = "192.168.1.240"; | ||||||
|  |       prefixLength = 24; | ||||||
|  |     } ]; | ||||||
|  |     ipv4.routes = [ { address = "192.168.1.0"; prefixLength = 24; via = "192.168.1.1"; }]; | ||||||
|  |     useDHCP = false; | ||||||
|  |    }; | ||||||
|  |    #networking.nameservers = [ "172.16.11.240" ]; | ||||||
|  |    networking.nameservers = [ "192.168.1.1" ]; | ||||||
|  |    networking.defaultGateway = { | ||||||
|  |      address = "192.168.1.1"; | ||||||
|  |      interface = "enp2s0"; | ||||||
|  |    }; | ||||||
|  | 
 | ||||||
|  |   networking.hostName = "box"; # Define your hostname. | ||||||
|  |   networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant. | ||||||
|  | 
 | ||||||
|  |   # The global useDHCP flag is deprecated, therefore explicitly set to false here. | ||||||
|  |   # Per-interface useDHCP will be mandatory in the future, so this generated config | ||||||
|  |   # replicates the default behaviour. | ||||||
|  |   networking.useDHCP = false; | ||||||
|  |   networking.interfaces.wlp3s0.useDHCP = true; | ||||||
|  |   networking.interfaces.enp2s0.useDHCP = false; | ||||||
|  | 
 | ||||||
|  |   # Set your time zone. | ||||||
|  |   time.timeZone = "Australia/Brisbane"; | ||||||
|  | 
 | ||||||
|  |   # Enable the OpenSSH daemon. | ||||||
|  |   services.openssh.enable = true; | ||||||
|  |   services.openssh.permitRootLogin = "yes"; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 22 ]; | ||||||
|  |   sound.enable = false; | ||||||
|  | 
 | ||||||
|  |   programs.gnupg.agent.enable = true; | ||||||
|  |   programs.gnupg.agent.pinentryFlavor = "curses"; | ||||||
|  |   programs.gnupg.agent.enableSSHSupport = true; | ||||||
|  | 
 | ||||||
|  |   # This value determines the NixOS release with which your system is to be | ||||||
|  |   # compatible, in order to avoid breaking some software such as database | ||||||
|  |   # servers. You should change this only after NixOS release notes say you | ||||||
|  |   # should. | ||||||
|  |   system.stateVersion = "19.09"; # Did you read the comment? | ||||||
|  | 
 | ||||||
|  | } | ||||||
|  | 
 | ||||||
							
								
								
									
										38
									
								
								hosts/box/hardware-configuration.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										38
									
								
								hosts/box/hardware-configuration.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,38 @@ | ||||||
|  | # Do not modify this file!  It was generated by ‘nixos-generate-config’ | ||||||
|  | # and may be overwritten by future invocations.  Please make changes | ||||||
|  | # to /etc/nixos/configuration.nix instead. | ||||||
|  | { config, lib, pkgs, modulesPath, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   imports = | ||||||
|  |     [ (modulesPath + "/installer/scan/not-detected.nix") | ||||||
|  |     ]; | ||||||
|  | 
 | ||||||
|  |   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; | ||||||
|  |   boot.initrd.kernelModules = [ "dm-snapshot" ]; | ||||||
|  |   boot.kernelModules = [ "kvm-intel" ]; | ||||||
|  |   boot.extraModulePackages = [ ]; | ||||||
|  | 
 | ||||||
|  |   fileSystems."/" = | ||||||
|  |     { device = "/dev/disk/by-uuid/ade0752d-84d3-4e39-865b-9027ba2d5c67"; | ||||||
|  |       fsType = "ext4"; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |   fileSystems."/boot/efi" = | ||||||
|  |     { device = "/dev/disk/by-uuid/1715-278E"; | ||||||
|  |       fsType = "vfat"; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |   fileSystems."/data" = | ||||||
|  |     { device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; | ||||||
|  |       fsType = "ext4"; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |   boot.initrd.luks.devices."crypted-data".device = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; | ||||||
|  | 
 | ||||||
|  |   swapDevices = | ||||||
|  |     [ { device = "/dev/disk/by-uuid/b790abb4-ba5f-4476-8f09-b0fc575414aa"; } | ||||||
|  |     ]; | ||||||
|  | 
 | ||||||
|  |   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; | ||||||
|  | } | ||||||
							
								
								
									
										109
									
								
								modules/gonic.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										109
									
								
								modules/gonic.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,109 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   cfg = config.services.gonic; | ||||||
|  |   configFile = "/etc/gonic/config"; | ||||||
|  |   dataFolder = "/var/lib/gonic"; | ||||||
|  | in { | ||||||
|  |   options = { | ||||||
|  | 
 | ||||||
|  |     services.gonic = { | ||||||
|  |       enable = mkEnableOption "Gonic music server and streamer"; | ||||||
|  | 
 | ||||||
|  |       settings = lib.mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = {}; | ||||||
|  |         example = literalExample '' | ||||||
|  |             music-path        <path to your music dir> | ||||||
|  |             podcast-path      <path to your podcasts dir> | ||||||
|  |             cache-path        <path to cache dir> | ||||||
|  |         ''; | ||||||
|  |         description = '' | ||||||
|  |           Configuration for Gonic, see <link xlink:href="https://github.com/sentriz/gonic"/> for supported values. | ||||||
|  |       ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       user = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "gonic"; | ||||||
|  |         description = "User account under which gonic runs."; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       group = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "gonic"; | ||||||
|  |         description = "Group account under which gonic runs."; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  | 
 | ||||||
|  |     environment.etc."gonic/config".text = cfg.settings; | ||||||
|  | 
 | ||||||
|  |     systemd.services.gonic = { | ||||||
|  |       description = "gonic Music Server and Streamer compatible with Subsonic/Airsonic"; | ||||||
|  |       after = [ "remote-fs.target" "network.target" ]; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       environment = { | ||||||
|  |         #GONIC_MUSIC_PATH | ||||||
|  |         #GONIC_PODCAST_PATH | ||||||
|  |         #GONIC_CACHE_PATH | ||||||
|  |         #GONIC_DB_PATH | ||||||
|  |         GONIC_SCAN_INTERVAL="800"; | ||||||
|  |         #... | ||||||
|  |       }; | ||||||
|  |       serviceConfig = { | ||||||
|  |         ExecStart = "${pkgs.gonic}/bin/gonic -config-path /etc/gonic/config"; | ||||||
|  |         WorkingDirectory = dataFolder; | ||||||
|  |         TimeoutStopSec = "20"; | ||||||
|  |         KillMode = "process"; | ||||||
|  |         Restart = "on-failure"; | ||||||
|  |         RestartSec = "10"; | ||||||
|  |         User = cfg.user; | ||||||
|  |         Group = cfg.group; | ||||||
|  |         DevicePolicy = "closed"; | ||||||
|  |         NoNewPrivileges= " yes"; | ||||||
|  |         PrivateTmp = "yes"; | ||||||
|  |         PrivateUsers = "yes"; | ||||||
|  |         ProtectControlGroups = "yes"; | ||||||
|  |         ProtectKernelModules = "yes"; | ||||||
|  |         ProtectKernelTunables = "yes"; | ||||||
|  |         RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6"; | ||||||
|  |         RestrictNamespaces = "yes"; | ||||||
|  |         RestrictRealtime = "yes"; | ||||||
|  |         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; | ||||||
|  |         ReadWritePaths = dataFolder; | ||||||
|  |         StateDirectory = baseNameOf dataFolder; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     users.users = optionalAttrs (cfg.user == "gonic") ({ | ||||||
|  |       gonic = { | ||||||
|  |         description = "gonic service user"; | ||||||
|  |         name = cfg.user; | ||||||
|  |         group = cfg.group; | ||||||
|  |         isSystemUser = true; | ||||||
|  |       }; | ||||||
|  |     }); | ||||||
|  | 
 | ||||||
|  |     users.groups = optionalAttrs (cfg.group == "gonic") ({ | ||||||
|  |       gonic = {}; | ||||||
|  |     }); | ||||||
|  |      | ||||||
|  |     services.nginx.virtualHosts."music.mossnet.lan" = { | ||||||
|  |       enableACME = false; | ||||||
|  |       forceSSL = false; | ||||||
|  | 
 | ||||||
|  |       locations."/" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           proxy_pass http://localhost:4747/; | ||||||
|  |           proxy_set_header X-Forwarded-Host $host; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										12
									
								
								modules/grasp.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										12
									
								
								modules/grasp.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,12 @@ | ||||||
|  | { config, lib, pkgs, ...}: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   systemd.services.grasp = { | ||||||
|  |     description = "grasp server"; | ||||||
|  |     wantedBy = [ "default.target" ]; | ||||||
|  | 
 | ||||||
|  |     serviceConfig = { | ||||||
|  |       ExecStart = "{$pkgs.grasp}/server/grasp_server.py --path /data/grasp/capture.org"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										220
									
								
								modules/wallabag.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										220
									
								
								modules/wallabag.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,220 @@ | ||||||
|  | { config, options, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | let | ||||||
|  |   cfg = config.services.wallabag; | ||||||
|  | 
 | ||||||
|  |   poolName = "wallabag"; | ||||||
|  | 
 | ||||||
|  |   configFile = pkgs.writeTextFile { | ||||||
|  |     name = "wallabag-config"; | ||||||
|  |     text = cfg.conf; | ||||||
|  |     destination = "/config/parameters.yml"; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   appDir = pkgs.buildEnv { | ||||||
|  |     name = "wallabag-app-dir"; | ||||||
|  |     ignoreCollisions = true; | ||||||
|  |     checkCollisionContents = false; | ||||||
|  |     paths = [ configFile "${cfg.package}/app" ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  | in { | ||||||
|  | 
 | ||||||
|  |   options = { | ||||||
|  | 
 | ||||||
|  |     services.wallabag = { | ||||||
|  |       enable = mkEnableOption "wallabag"; | ||||||
|  | 
 | ||||||
|  |       user = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "nginx"; | ||||||
|  |         description = '' | ||||||
|  |           User account under which both the update daemon and the web-application run. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       dataDir = mkOption { | ||||||
|  |         type = types.path; | ||||||
|  |         default = "/var/lib/wallabag"; | ||||||
|  |         description = '' | ||||||
|  |           Data directory. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       package = mkOption { | ||||||
|  |         type = types.package; | ||||||
|  |         default = pkgs.wallabag; | ||||||
|  |         description = '' | ||||||
|  |           Wallabag package to use. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       hostName = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         description = '' | ||||||
|  |           Name of the nginx virtualhost to use and setup. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       poolConfig = mkOption { | ||||||
|  |         type = types.lines; | ||||||
|  |         default = '' | ||||||
|  |           pm = dynamic | ||||||
|  |           pm.max_children = 75 | ||||||
|  |           pm.start_servers = 1 | ||||||
|  |           pm.min_spare_servers = 1 | ||||||
|  |           pm.max_spare_servers = 20 | ||||||
|  |           pm.max_requests = 500 | ||||||
|  |           catch_workers_output = 1 | ||||||
|  |         ''; | ||||||
|  |         description = '' | ||||||
|  |           Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       conf = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         description = '' | ||||||
|  |           Contents of the wallabag configuration file (parameters.yml) | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  | 
 | ||||||
|  |     services.phpfpm.pools."${poolName}" = { | ||||||
|  | 	user = "${cfg.user}"; | ||||||
|  | 	group = "nginx"; | ||||||
|  | 	settings = { | ||||||
|  | 		"listen.owner" = "nginx"; | ||||||
|  | 		"listen.group" = "nginx"; | ||||||
|  | 		"listen.mode" = "0600"; | ||||||
|  | 		"user" = "${cfg.user}"; | ||||||
|  | 		"group" = "nginx"; | ||||||
|  | 		"env[WALLABAG_DATA]" = "${cfg.dataDir}"; | ||||||
|  | 		"pm" = "dynamic"; | ||||||
|  | 		"pm.max_children" = "75"; | ||||||
|  | 		"pm.min_spare_servers" = "5"; | ||||||
|  | 		"pm.max_spare_servers" = "20"; | ||||||
|  | 		"pm.max_requests" = "10"; | ||||||
|  | 		"catch_workers_output" = "1"; | ||||||
|  | 	      	"php_admin_value[error_log]" = "/var/log/nginx/${poolName}-phpfpm-error.log"; | ||||||
|  | 	}; | ||||||
|  |     }; | ||||||
|  |     services.phpfpm.phpOptions = '' | ||||||
|  |       max_execution_time = 120 | ||||||
|  |     ''; | ||||||
|  | 
 | ||||||
|  |     services.nginx.enable = mkDefault true; | ||||||
|  | 
 | ||||||
|  |     services.nginx.virtualHosts."${cfg.hostName}" = { | ||||||
|  |       enableACME = false; | ||||||
|  |       forceSSL = false; | ||||||
|  |       root = "${cfg.package}/web"; | ||||||
|  | 
 | ||||||
|  |       extraConfig = '' | ||||||
|  |         add_header X-Frame-Options SAMEORIGIN; | ||||||
|  |         add_header X-Content-Type-Options nosniff; | ||||||
|  |         add_header X-XSS-Protection "1; mode=block"; | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       locations."/" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           try_files $uri /app.php$is_args$args; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       locations."/assets".root = "${cfg.dataDir}/web"; | ||||||
|  | 
 | ||||||
|  |       locations."~ ^/app\\.php(/|$)" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket}; | ||||||
|  |           fastcgi_split_path_info ^(.+\.php)(/.*)$; | ||||||
|  | 
 | ||||||
|  |           fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name; | ||||||
|  |           fastcgi_param DOCUMENT_ROOT ${cfg.package}/web; | ||||||
|  |           fastcgi_read_timeout 120; | ||||||
|  | 
 | ||||||
|  |             fastcgi_param   QUERY_STRING            $query_string; | ||||||
|  |             fastcgi_param   REQUEST_METHOD          $request_method; | ||||||
|  |             fastcgi_param   CONTENT_TYPE            $content_type; | ||||||
|  |             fastcgi_param   CONTENT_LENGTH          $content_length; | ||||||
|  |      | ||||||
|  |             fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name; | ||||||
|  |             fastcgi_param   SCRIPT_NAME             $fastcgi_script_name; | ||||||
|  |             fastcgi_param   PATH_INFO               $fastcgi_path_info; | ||||||
|  |             fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info; | ||||||
|  |             fastcgi_param   REQUEST_URI             $request_uri; | ||||||
|  |             fastcgi_param   DOCUMENT_URI            $document_uri; | ||||||
|  |             fastcgi_param   SERVER_PROTOCOL         $server_protocol; | ||||||
|  |      | ||||||
|  |             fastcgi_param   GATEWAY_INTERFACE       CGI/1.1; | ||||||
|  |             fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version; | ||||||
|  |      | ||||||
|  |             fastcgi_param   REMOTE_ADDR             $remote_addr; | ||||||
|  |             fastcgi_param   REMOTE_PORT             $remote_port; | ||||||
|  |             fastcgi_param   SERVER_ADDR             $server_addr; | ||||||
|  |             fastcgi_param   SERVER_PORT             $server_port; | ||||||
|  |             fastcgi_param   SERVER_NAME             $server_name; | ||||||
|  | 
 | ||||||
|  |           internal; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       locations."~ /(?!app)\\.php$" = { | ||||||
|  |         extraConfig = '' | ||||||
|  |           return 404; | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     systemd.services.wallabag-install = { | ||||||
|  |       description = "Wallabag install service"; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       before = [ "phpfpm-wallabag.service" ]; | ||||||
|  |       after = [ "mysql.service" "postgresql.service" ]; | ||||||
|  |       path = with pkgs; [ coreutils php phpPackages.composer ]; | ||||||
|  | 
 | ||||||
|  |       serviceConfig = { | ||||||
|  |         User = cfg.user; | ||||||
|  |         Type = "oneshot"; | ||||||
|  |         RemainAfterExit = "yes"; | ||||||
|  |         PermissionsStartOnly = true; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       preStart = '' | ||||||
|  |         mkdir -p "${cfg.dataDir}" | ||||||
|  |         chown ${cfg.user}:nginx "${cfg.dataDir}" | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       script = '' | ||||||
|  |         echo "Setting up wallabag files in ${cfg.dataDir} ..." | ||||||
|  |         cd "${cfg.dataDir}" | ||||||
|  | 
 | ||||||
|  |         rm -rf var/cache/* | ||||||
|  |         rm -f app | ||||||
|  |         ln -sf ${appDir} app | ||||||
|  |         ln -sf ${cfg.package}/composer.{json,lock} . | ||||||
|  | 
 | ||||||
|  |         export WALLABAG_DATA="${cfg.dataDir}" | ||||||
|  |         if [ ! -f installed ]; then | ||||||
|  |           php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction | ||||||
|  |           php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction | ||||||
|  |           # Until https://github.com/wallabag/wallabag/issues/3662 is fixed | ||||||
|  |           # yes no | php ${cfg.package}/bin/console --env=prod wallabag:install | ||||||
|  |           touch installed | ||||||
|  |         else | ||||||
|  |           php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction | ||||||
|  |         fi | ||||||
|  |         php ${cfg.package}/bin/console --env=prod cache:clear | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   meta = with stdenv.lib; { | ||||||
|  |     maintainers = with maintainers; [ nadrieril ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										22
									
								
								pkgs/grasp.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										22
									
								
								pkgs/grasp.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,22 @@ | ||||||
|  | { python3, fetchFromGitHub, lib }: | ||||||
|  | 
 | ||||||
|  | python3.pkgs.buildPythonApplication rec { | ||||||
|  |   pname = "grasp"; | ||||||
|  |   version = "0.6.6"; | ||||||
|  | 
 | ||||||
|  |   src = fetchFromGitHub { | ||||||
|  |     owner = "karlicoss"; | ||||||
|  |     repo = pname; | ||||||
|  |     rev = "grasp-${version}"; | ||||||
|  |     sha256 = "0000000000000000000000000000000000000000000000000000"; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   meta = with lib; { | ||||||
|  |     description = "grasp server"; | ||||||
|  |     # License is complicated... | ||||||
|  |     #license = licenses.agpl3; | ||||||
|  |     homepage = "https://github.com/karlicoss/grasp"; | ||||||
|  |     platforms = platforms.all; | ||||||
|  |     maintainers = with stdenv.lib.maintainers; [ chickensoupwithrice ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										9
									
								
								pkgs/navidrome.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								pkgs/navidrome.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | { | ||||||
|  |   services.navidrome.enable = true; | ||||||
|  |   services.navidrome.settings = { | ||||||
|  |     MusicFolder = "/data/music"; | ||||||
|  |     Port = 4433; | ||||||
|  |   }; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 4433 ]; | ||||||
|  | } | ||||||
							
								
								
									
										31
									
								
								pkgs/wallabag.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										31
									
								
								pkgs/wallabag.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,31 @@ | ||||||
|  | diff --git a/app/AppKernel.php b/app/AppKernel.php | ||||||
|  | index 347197e..902b558 100644 | ||||||
|  | --- a/app/AppKernel.php | ||||||
|  | +++ b/app/AppKernel.php | ||||||
|  | @@ -69,19 +69,24 @@ class AppKernel extends Kernel | ||||||
|  |          return __DIR__; | ||||||
|  |      } | ||||||
|  |   | ||||||
|  | +    public function getProjectDir() | ||||||
|  | +    { | ||||||
|  | +        return getenv('WALLABAG_DATA') ?: dirname(__DIR__); | ||||||
|  | +    } | ||||||
|  | + | ||||||
|  |      public function getCacheDir() | ||||||
|  |      { | ||||||
|  | -        return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment(); | ||||||
|  | +        return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment(); | ||||||
|  |      } | ||||||
|  |   | ||||||
|  |      public function getLogDir() | ||||||
|  |      { | ||||||
|  | -        return dirname(__DIR__) . '/var/logs'; | ||||||
|  | +        return $this->getProjectDir() . '/var/logs'; | ||||||
|  |      } | ||||||
|  |   | ||||||
|  |      public function registerContainerConfiguration(LoaderInterface $loader) | ||||||
|  |      { | ||||||
|  | -        $loader->load($this->getRootDir() . '/config/config_' . $this->getEnvironment() . '.yml'); | ||||||
|  | +        $loader->load($this->getProjectDir() . '/app/config/config_' . $this->getEnvironment() . '.yml'); | ||||||
|  |   | ||||||
|  |          $loader->load(function ($container) { | ||||||
							
								
								
									
										34
									
								
								profiles/backup/backup.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										34
									
								
								profiles/backup/backup.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,34 @@ | ||||||
|  | { | ||||||
|  |   # Assumes the remote borg backup server has already been initialized | ||||||
|  |   # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive> | ||||||
|  |   services.borgbackup.jobs = { | ||||||
|  |     backupTaskwarriorRsync = { | ||||||
|  |       paths = [ "/var/lib/taskserver" ]; | ||||||
|  |       doInit = true; | ||||||
|  |       repo =  "20779@hk-s020.rsync.net:taskwarrior" ; | ||||||
|  |       encryption = { | ||||||
|  |         mode = "repokey-blake2"; | ||||||
|  |         passCommand = "cat /run/keys/rsync"; | ||||||
|  |       }; | ||||||
|  |       environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; | ||||||
|  |       compression = "auto,lzma"; | ||||||
|  |       startAt = "weekly"; | ||||||
|  |       extraArgs = "--remote-path=borg1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  |   services.borgbackup.jobs = { | ||||||
|  |     backupShaarliRsync = { | ||||||
|  |       paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ]; | ||||||
|  |       doInit = true; | ||||||
|  |       repo =  "20779@hk-s020.rsync.net:shaarli" ; | ||||||
|  |       encryption = { | ||||||
|  |         mode = "repokey-blake2"; | ||||||
|  |         passCommand = "cat /run/keys/rsync"; | ||||||
|  |       }; | ||||||
|  |       environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; | ||||||
|  |       compression = "auto,lzma"; | ||||||
|  |       startAt = "weekly"; | ||||||
|  |       extraArgs = "--remote-path=borg1"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										28
									
								
								profiles/box-zone/box.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										28
									
								
								profiles/box-zone/box.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,28 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | {  | ||||||
|  | 	imports = [ | ||||||
|  | 		./common.nix | ||||||
|  |     ./mossnet.nix | ||||||
|  | 	]; | ||||||
|  | 
 | ||||||
|  |   users.extraUsers."anish".extraGroups = [ "jackaudio" ]; | ||||||
|  | 
 | ||||||
|  | #	services.xserver = { | ||||||
|  | #    enable = true; | ||||||
|  | #    displayManager.gdm.enable = true; | ||||||
|  | #		desktopManager.gnome3.enable = true; | ||||||
|  | #  }; | ||||||
|  | 
 | ||||||
|  | 	# task whisperer broken  | ||||||
|  |   #nixpkgs.config.allowBroken = true; | ||||||
|  | 
 | ||||||
|  |   # virtual box | ||||||
|  |   virtualisation.virtualbox.host.enable = true; | ||||||
|  | 
 | ||||||
|  | 	# ErgoDox Firmware (doesn't compile) | ||||||
|  | 	# environment.systemPackages = with pkgs; [ | ||||||
|  | 	#	qmk_firmware | ||||||
|  | 	# ]; | ||||||
|  | } | ||||||
|  | 
 | ||||||
							
								
								
									
										120
									
								
								profiles/box-zone/common.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										120
									
								
								profiles/box-zone/common.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,120 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  | 	imports = [ | ||||||
|  | 		./nvim.nix | ||||||
|  | #	  ./unstable.nix | ||||||
|  | 	]; | ||||||
|  | 
 | ||||||
|  | 
 | ||||||
|  | 	environment.systemPackages = with pkgs; [ | ||||||
|  |     tailscale | ||||||
|  | 		htop | ||||||
|  |     fzf | ||||||
|  | 		iftop | ||||||
|  | 		wget | ||||||
|  | 		curl | ||||||
|  |     exa | ||||||
|  |     bat | ||||||
|  |     fd | ||||||
|  |     ag | ||||||
|  |     wpa_supplicant | ||||||
|  | 		tcpdump | ||||||
|  | 		whois | ||||||
|  | 		mtr | ||||||
|  | 		file | ||||||
|  | 		lsof | ||||||
|  | 	  atool | ||||||
|  | 		inotify-tools | ||||||
|  | 	  strace | ||||||
|  | 		zip | ||||||
|  | 		unzip | ||||||
|  | 		rsync | ||||||
|  | 		tmux | ||||||
|  | 		pwgen | ||||||
|  | 	  glow | ||||||
|  |     jq | ||||||
|  | 		gitAndTools.gitFull | ||||||
|  | 	  #neovim defined in ./nvim.nix | ||||||
|  | 	 # wofi | ||||||
|  | 	#	firefox | ||||||
|  | 	#	fractal | ||||||
|  | 	 # pinentry_gnome | ||||||
|  |    pinentry_curses | ||||||
|  | 		pass | ||||||
|  | 		gcc | ||||||
|  | 		less | ||||||
|  | 	#	mpv | ||||||
|  | 	#	zathura | ||||||
|  | 	  #qmk_firmware | ||||||
|  | 		python3 | ||||||
|  | 	  gdb | ||||||
|  | 	 # vcv-rack | ||||||
|  | 	  #xdotool | ||||||
|  | 	  #neofetch | ||||||
|  | 	  #calibre | ||||||
|  | 		#openvpn | ||||||
|  | 	  #gimp | ||||||
|  | 	  xxd | ||||||
|  | 	#	tilix | ||||||
|  | 	 # kitty | ||||||
|  | 		taskwarrior | ||||||
|  | 		gnupg | ||||||
|  | 	  openjdk | ||||||
|  | 		glslviewer | ||||||
|  |     #filezilla | ||||||
|  | 	#	signal-desktop | ||||||
|  | 	 # wire-desktop | ||||||
|  | 	#	tdesktop | ||||||
|  | 	#	feedreader | ||||||
|  |     #newsflash | ||||||
|  | #		syncthing | ||||||
|  | 	  dijo | ||||||
|  | 	  #ssb-patchwork | ||||||
|  |     #gnomeExtensions.taskwhisperer | ||||||
|  | 	  #gnome3.networkmanager-openvpn | ||||||
|  | 		#python3Packages.youtube-dl | ||||||
|  |     #appimage-run | ||||||
|  | 	  home-manager | ||||||
|  | 		libreoffice | ||||||
|  | 		fontconfig | ||||||
|  |     #hugo | ||||||
|  | 	  #processing | ||||||
|  | 	  #nextcloud-client | ||||||
|  | 	  zsh-powerlevel10k | ||||||
|  | 	  powerline-fonts | ||||||
|  | 	  supercollider | ||||||
|  | 	  haskellPackages.tidal | ||||||
|  | 	  pandoc | ||||||
|  |    # calibre | ||||||
|  | 	]; | ||||||
|  | 
 | ||||||
|  | 	programs.bash.enableCompletion = true; | ||||||
|  | 
 | ||||||
|  |   programs.gnupg.agent.enable = true; | ||||||
|  |   programs.gnupg.agent.pinentryFlavor = "curses"; | ||||||
|  |   programs.gnupg.agent.enableSSHSupport = true; | ||||||
|  | 	# needed for vcv-rack | ||||||
|  | 	nixpkgs.config.allowUnfree = true;  | ||||||
|  | 
 | ||||||
|  | 	system.copySystemConfiguration = true; | ||||||
|  |   #services.syncthing = { | ||||||
|  | 	#  enable = true; | ||||||
|  | 	#  openDefaultPorts = true; | ||||||
|  | 	#  systemService = true; | ||||||
|  | 	#  user    = "anish"; | ||||||
|  | 	#  dataDir = "/home/anish/usr/syncthing"; | ||||||
|  | 	#}; | ||||||
|  | 
 | ||||||
|  | 	#zsh powerlevel10k | ||||||
|  |   #programs.zsh.enable = true; | ||||||
|  | 	#programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme"; | ||||||
|  | 	users.users.anish.shell = pkgs.bash; | ||||||
|  | 
 | ||||||
|  | 	#android  | ||||||
|  | 	programs.adb.enable = true; | ||||||
|  | 	users.users.anish.extraGroups = ["adbusers"]; | ||||||
|  | 
 | ||||||
|  |   #ssh | ||||||
|  |   services.sshd.enable = true; | ||||||
|  | } | ||||||
							
								
								
									
										28
									
								
								profiles/box-zone/mossnet.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										28
									
								
								profiles/box-zone/mossnet.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,28 @@ | ||||||
|  | {config, pkgs, ...}: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  | 	imports = [ | ||||||
|  |     ./taskd.nix | ||||||
|  | 	  ./nextcloud.nix | ||||||
|  | 	  ./networking.nix | ||||||
|  | 	  ./wireguard.nix | ||||||
|  | 	  ./shaarli.nix | ||||||
|  | ##	  ./navidrome.nix | ||||||
|  | ##	  ./pkg-navidrome.nix | ||||||
|  | 	  ./mod-wallabag.nix | ||||||
|  | 	  ./wallabag.nix | ||||||
|  | 	  ./headphones.nix | ||||||
|  | 	  ./dns.nix | ||||||
|  | 	  ./backup.nix | ||||||
|  | 	  ./monitoring.nix | ||||||
|  | 	  ./dev.nix | ||||||
|  | 	  ./gonic.nix | ||||||
|  | 	  ./module-gonic.nix | ||||||
|  | #    ./rss-bridge.nix | ||||||
|  | #    ./pkg-grasp.nix | ||||||
|  | #    ./mod-grasp.nix | ||||||
|  |     ./cron.nix | ||||||
|  |     ./ftp.nix | ||||||
|  |     ./nfs.nix | ||||||
|  | 		]; | ||||||
|  | } | ||||||
							
								
								
									
										16
									
								
								profiles/dns/dns.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										16
									
								
								profiles/dns/dns.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,16 @@ | ||||||
|  | { config, pkgs, lib, ... }: | ||||||
|  | { | ||||||
|  |   services.dnsmasq.enable = true; | ||||||
|  |   services.dnsmasq.extraConfig = '' | ||||||
|  |       domain-needed | ||||||
|  |       no-resolv | ||||||
|  |       local=/lan/ | ||||||
|  |       local=/moss/ | ||||||
|  |       cache-size=5000 | ||||||
|  |       addn-hosts=/ec/adblock.hosts | ||||||
|  |     ''; | ||||||
|  |   services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; | ||||||
|  |   networking.hosts = {"192.168.1.240" = ["mossnet.lan" "links.mossnet.lan" "read.mossnet.lan" "stats.mossnet.lan" "music.moss" "tasks.moss" "headphones.moss" "cloud.moss" "links.moss" "read.moss" "stats.moss" "rss.moss"];}; | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 53 ]; | ||||||
|  |   networking.firewall.allowedUDPPorts = [ 53 ]; | ||||||
|  | } | ||||||
							
								
								
									
										20
									
								
								profiles/ftp/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										20
									
								
								profiles/ftp/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,20 @@ | ||||||
|  | { pkgs, lib, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   networking.firewall.allowedTCPPorts = [ 20 21 ]; | ||||||
|  |   networking.firewall.allowedTCPPortRanges = [ { from = 51000; to = 51999; } ]; | ||||||
|  |   services.vsftpd = { | ||||||
|  |     enable = true; | ||||||
|  |     writeEnable = true; | ||||||
|  |     anonymousUser = true; | ||||||
|  |     anonymousUserNoPassword = true; | ||||||
|  |     anonymousUploadEnable = true; | ||||||
|  |     anonymousMkdirEnable = true; | ||||||
|  |     anonymousUserHome = "/home/ftp"; | ||||||
|  |     extraConfig = '' | ||||||
|  |       pasv_enable=Yes | ||||||
|  |       pasv_min_port=51000 | ||||||
|  |       pasv_max_port=51999 | ||||||
|  |     ''; | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -5,7 +5,7 @@ | ||||||
|     music-path /data/music |     music-path /data/music | ||||||
|     podcast-path /data/music |     podcast-path /data/music | ||||||
|     cache-path /data/cache |     cache-path /data/cache | ||||||
|   ''; |   '';   | ||||||
|   services.gonic.group = "audio"; |   services.gonic.group = "audio"; | ||||||
|   services.gonic.user = "headphones"; |   services.gonic.user = "headphones"; | ||||||
|   networking.firewall.allowedTCPPorts = [ 4747 ]; |   networking.firewall.allowedTCPPorts = [ 4747 ]; | ||||||
|  |  | ||||||
|  | @ -1,4 +1,4 @@ | ||||||
| { config, lib, pkgs, ... }: | {config, lib, pkgs, ... }: | ||||||
| { | { | ||||||
|   services.headphones = { |   services.headphones = { | ||||||
|     enable = true; |     enable = true; | ||||||
|  |  | ||||||
|  | @ -6,12 +6,12 @@ | ||||||
|     port = 2342; |     port = 2342; | ||||||
|     addr = "127.0.0.1"; |     addr = "127.0.0.1"; | ||||||
|   }; |   }; | ||||||
| 
 |    | ||||||
|   # nginx reverse proxy |   # nginx reverse proxy | ||||||
|   services.nginx.virtualHosts.${config.services.grafana.domain} = { |   services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||||
|     locations."/" = { |     locations."/" = { | ||||||
|       proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; |         proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||||
|       proxyWebsockets = true; |         proxyWebsockets = true; | ||||||
|     }; |     }; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|  | @ -42,18 +42,18 @@ | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   services.loki = { |   services.loki = { | ||||||
|     enable = true; |     #enable = true; | ||||||
|     configFile = /var/loki-config.yaml; |     #configFile = /var/loki-config.yaml; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   systemd.services.promtail = { |   #systemd.services.promtail = { | ||||||
|     description = "Promtail service for Loki"; |   #  description = "Promtail service for Loki"; | ||||||
|     wantedBy = [ "multi-user.target" ]; |   #  wantedBy = [ "multi-user.target" ]; | ||||||
| 
 | 
 | ||||||
|     serviceConfig = { |   #  serviceConfig = { | ||||||
|       ExecStart = '' |   #    ExecStart = '' | ||||||
|         ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} |   #      ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} | ||||||
|       ''; |   #    ''; | ||||||
|     }; |   #  }; | ||||||
|   }; |   #}; | ||||||
| } | } | ||||||
|  |  | ||||||
							
								
								
									
										101
									
								
								profiles/navidrome/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										101
									
								
								profiles/navidrome/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,101 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   cfg = config.services.navidrome; | ||||||
|  |   configFile = "/etc/navidrome/settings.json"; | ||||||
|  |   dataFolder = "/var/lib/navidrome"; | ||||||
|  | in { | ||||||
|  |   options = { | ||||||
|  | 
 | ||||||
|  |     services.navidrome = { | ||||||
|  |       enable = mkEnableOption "Navidrome music server and streamer"; | ||||||
|  | 
 | ||||||
|  |       settings = lib.mkOption { | ||||||
|  |         type = with types; attrsOf (oneOf [ int str ]); | ||||||
|  |         default = {}; | ||||||
|  |         example = literalExample '' | ||||||
|  |           { | ||||||
|  |             LogLevel = "INFO"; | ||||||
|  |             BaseURL = "/music"; | ||||||
|  |             ScanInterval = "10s"; | ||||||
|  |             TranscodingCacheSize = "15MB"; | ||||||
|  |             MusicFolder = "/data/music"; | ||||||
|  |           }; | ||||||
|  |         ''; | ||||||
|  |         description = '' | ||||||
|  |           Configuration for Navidrome, see <link xlink:href="https://www.navidrome.org/docs/usage/configuration-options/"/> for supported values. | ||||||
|  |       ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       user = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "navidrome"; | ||||||
|  |         description = "User account under which Navidrome runs."; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       group = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "navidrome"; | ||||||
|  |         description = "Group account under which Navidrome runs."; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  | 
 | ||||||
|  |     environment.etc."navidrome/settings.json".text = builtins.toJSON cfg.settings; | ||||||
|  | 
 | ||||||
|  |     services.navidrome.settings = { | ||||||
|  |       DataFolder = dataFolder; | ||||||
|  |       ConfigFile = configFile; | ||||||
|  |     }; | ||||||
|  |      | ||||||
|  |     systemd.services.navidrome = { | ||||||
|  |       description = "Navidrome Music Server and Streamer compatible with Subsonic/Airsonic"; | ||||||
|  |       after = [ "remote-fs.target" "network.target" ]; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       environment = { | ||||||
|  |         ND_CONFIGFILE = configFile; | ||||||
|  |       }; | ||||||
|  |       serviceConfig = { | ||||||
|  |         ExecStart = "${pkgs.navidrome}/bin/navidrome"; | ||||||
|  |         WorkingDirectory = dataFolder; | ||||||
|  |         TimeoutStopSec = "20"; | ||||||
|  |         KillMode = "process"; | ||||||
|  |         Restart = "on-failure"; | ||||||
|  |         User = cfg.user; | ||||||
|  |         Group = cfg.group; | ||||||
|  |         DevicePolicy = "closed"; | ||||||
|  |         NoNewPrivileges= " yes"; | ||||||
|  |         PrivateTmp = "yes"; | ||||||
|  |         PrivateUsers = "yes"; | ||||||
|  |         ProtectControlGroups = "yes"; | ||||||
|  |         ProtectKernelModules = "yes"; | ||||||
|  |         ProtectKernelTunables = "yes"; | ||||||
|  |         RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6"; | ||||||
|  |         RestrictNamespaces = "yes"; | ||||||
|  |         RestrictRealtime = "yes"; | ||||||
|  |         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; | ||||||
|  |         ReadWritePaths = dataFolder; | ||||||
|  |         StateDirectory = baseNameOf dataFolder; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     users.users = optionalAttrs (cfg.user == "navidrome") ({ | ||||||
|  |       navidrome = { | ||||||
|  |         description = "Navidrome service user"; | ||||||
|  |         name = cfg.user; | ||||||
|  |         group = cfg.group; | ||||||
|  |         isSystemUser = true; | ||||||
|  |       }; | ||||||
|  |     }); | ||||||
|  | 
 | ||||||
|  |     users.groups = optionalAttrs (cfg.group == "navidrome") ({ | ||||||
|  |       navidrome = {}; | ||||||
|  |     }); | ||||||
|  |      | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -1,7 +1,5 @@ | ||||||
| { pkgs, config, ... }: | { pkgs, config, ... }: | ||||||
| { | { | ||||||
|   age.secrets.nextcloud-db.file = "/etc/nixos/secrets/nextcloud-db.age"; |  | ||||||
|   age.secrets.nextcloud-admin.file = "/etc/nixos/secrets/nextcloud-admin.age"; |  | ||||||
|   services.nextcloud = { |   services.nextcloud = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     hostName = "mossnet.lan"; |     hostName = "mossnet.lan"; | ||||||
|  | @ -10,7 +8,7 @@ | ||||||
| 
 | 
 | ||||||
|     # Use HTTPS for links |     # Use HTTPS for links | ||||||
|     https = false; |     https = false; | ||||||
| 
 |      | ||||||
|     # Auto-update Nextcloud Apps |     # Auto-update Nextcloud Apps | ||||||
|     autoUpdateApps.enable = true; |     autoUpdateApps.enable = true; | ||||||
|     # Set what time makes sense for you |     # Set what time makes sense for you | ||||||
|  | @ -25,8 +23,9 @@ | ||||||
|       dbuser = "nextcloud"; |       dbuser = "nextcloud"; | ||||||
|       dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself |       dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself | ||||||
|       dbname = "nextcloud"; |       dbname = "nextcloud"; | ||||||
|       dbpassFile = "/run/secrets/nextcloud-db"; |       dbpassFile = "/var/nextcloud-db-pass"; | ||||||
|       adminpassFile = "/run/secrets/nextcloud-admin"; | 
 | ||||||
|  |       adminpassFile = "/var/nextcloud-admin-pass"; | ||||||
|       adminuser = "admin"; |       adminuser = "admin"; | ||||||
|     }; |     }; | ||||||
|   }; |   }; | ||||||
|  | @ -38,17 +37,16 @@ | ||||||
|     # Ensure the database, user, and permissions always exist |     # Ensure the database, user, and permissions always exist | ||||||
|     ensureDatabases = [ "nextcloud" ]; |     ensureDatabases = [ "nextcloud" ]; | ||||||
|     ensureUsers = [ |     ensureUsers = [ | ||||||
|       { |      { name = "nextcloud"; | ||||||
|         name = "nextcloud"; |        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES"; | ||||||
|         ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES"; |      } | ||||||
|       } |  | ||||||
|     ]; |     ]; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   # Ensure that postgres is running before running the setup |   # Ensure that postgres is running before running the setup | ||||||
|   systemd.services."nextcloud-setup" = { |   systemd.services."nextcloud-setup" = { | ||||||
|     requires = [ "postgresql.service" ]; |     requires = ["postgresql.service"]; | ||||||
|     after = [ "postgresql.service" ]; |     after = ["postgresql.service"]; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   networking.firewall.allowedTCPPorts = [ 80 443 ]; |   networking.firewall.allowedTCPPorts = [ 80 443 ]; | ||||||
|  |  | ||||||
							
								
								
									
										32
									
								
								profiles/nfs/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										32
									
								
								profiles/nfs/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,32 @@ | ||||||
|  | { | ||||||
|  |   #fileSystems."/export/" = { | ||||||
|  |   #  device = "/mnt/mafuyu"; | ||||||
|  |   #  options = [ "bind" ]; | ||||||
|  |   #}; | ||||||
|  | 
 | ||||||
|  |   services.nfs.server = { | ||||||
|  |     enable = true; | ||||||
|  |     # fixed rpc.statd port; for firewall | ||||||
|  |     lockdPort = 4001; | ||||||
|  |     mountdPort = 4002; | ||||||
|  |     statdPort = 4000; | ||||||
|  |     extraNfsdConfig = ''''; | ||||||
|  |     exports = '' | ||||||
|  |       /home/ftp        192.168.1.0/24(rw) | ||||||
|  |       ''; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.firewall = { | ||||||
|  |     allowedTCPPorts = [ 111  2049 4000 4001 4002 20048 ]; | ||||||
|  |     allowedUDPPorts = [ 111 2049 4000 4001  4002 20048 ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   #systemd.services.create-mount-dir = { | ||||||
|  |   #  serviceConfig = { | ||||||
|  |   #    ExecStart = "mkdir /export"; | ||||||
|  |   #  }; | ||||||
|  |   #  wantedBy = [ "multi-user.target" ]; | ||||||
|  |   #  after = [ "remote-fs.target" ]; | ||||||
|  |   #  description = "Create a directory we can mount on fs"; | ||||||
|  |   #}; | ||||||
|  | } | ||||||
							
								
								
									
										8
									
								
								profiles/rss-bridge/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										8
									
								
								profiles/rss-bridge/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,8 @@ | ||||||
|  | {pkgs, lib, config, ...}: | ||||||
|  | { | ||||||
|  |   services.rss-bridge = { | ||||||
|  |     enable = true; | ||||||
|  |     virtualHost = "rss.moss"; | ||||||
|  |     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -1,5 +1,5 @@ | ||||||
| { pkgs, config, ... }: | { pkgs, config, ... }: | ||||||
| let | let  | ||||||
|   dataDir = "/var/www/shaarli-config"; |   dataDir = "/var/www/shaarli-config"; | ||||||
|   name = "shaarli"; |   name = "shaarli"; | ||||||
| in | in | ||||||
|  | @ -12,14 +12,14 @@ in | ||||||
|         enableACME = false; |         enableACME = false; | ||||||
|         root = "${dataDir}"; |         root = "${dataDir}"; | ||||||
|         extraConfig = '' |         extraConfig = '' | ||||||
|           index index.php; |               index index.php; | ||||||
|         ''; |       ''; | ||||||
|         locations = { |         locations = { | ||||||
|           "/".extraConfig = '' |         "/".extraConfig = '' | ||||||
|             try_files $uri $uri/ index.php$is_args$args; |           try_files $uri $uri/ index.php$is_args$args; | ||||||
|           ''; |         ''; | ||||||
| 
 | 
 | ||||||
|           "~ (index)\\.php$".extraConfig = '' |         "~ (index)\\.php$".extraConfig = '' | ||||||
|             try_files $uri =404; |             try_files $uri =404; | ||||||
|             fastcgi_split_path_info ^(.+\.php)(/.+)$; |             fastcgi_split_path_info ^(.+\.php)(/.+)$; | ||||||
|      |      | ||||||
|  | @ -74,24 +74,24 @@ in | ||||||
|         user = "nginx"; |         user = "nginx"; | ||||||
|         group = "nginx"; |         group = "nginx"; | ||||||
|         #listen = "/run/phpfpm/php.sock"; |         #listen = "/run/phpfpm/php.sock"; | ||||||
|         settings = { | 	settings = { | ||||||
|           "listen.owner" = "nginx"; | 	      "listen.owner" = "nginx"; | ||||||
|           "listen.group" = "nginx"; | 	      "listen.group" = "nginx"; | ||||||
|           "user" = "nginx"; | 	      "user" = "nginx"; | ||||||
|           "pm" = "dynamic"; | 	      "pm" = "dynamic"; | ||||||
|           "pm.max_children" = "4"; | 	      "pm.max_children" = "4"; | ||||||
|           "pm.min_spare_servers" = "1"; | 	      "pm.min_spare_servers" = "1"; | ||||||
|           "pm.max_spare_servers" = "4"; | 	      "pm.max_spare_servers" = "4"; | ||||||
|           "pm.max_requests" = "32"; | 	      "pm.max_requests" = "32"; | ||||||
|           "catch_workers_output" = "1"; | 	      "catch_workers_output" = "1"; | ||||||
|           "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log"; | 	      "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log"; | ||||||
|         }; |       	}; | ||||||
|       }; |       }; | ||||||
|     }; |     }; | ||||||
|   }; |   }; | ||||||
|   users.extraUsers."${name}" = { group = "${name}"; }; |   users.extraUsers."${name}" = { group = "${name}"; }; | ||||||
|   users.extraGroups."${name}" = { }; |   users.extraGroups."${name}" = { }; | ||||||
|   users.users.shaarli.isSystemUser = true; |   users.users.shaarli.isSystemUser = true;  | ||||||
|   systemd.services.shaarli-install = { |   systemd.services.shaarli-install = { | ||||||
|     serviceConfig.Type = "oneshot"; |     serviceConfig.Type = "oneshot"; | ||||||
|     wantedBy = [ "multi-user.target" ]; |     wantedBy = [ "multi-user.target" ]; | ||||||
|  | @ -102,7 +102,7 @@ in | ||||||
|         #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ |         #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ | ||||||
|         #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/ |         #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/ | ||||||
|         mkdir -p ${dataDir}/{cache,data,pagecache,tmp} |         mkdir -p ${dataDir}/{cache,data,pagecache,tmp} | ||||||
|         ln -s ${pkgs.shaarli}/* ${dataDir} | 	      ln -s ${pkgs.shaarli}/* ${dataDir} | ||||||
|       fi |       fi | ||||||
|       chown -Rc nginx:nginx ${dataDir} |       chown -Rc nginx:nginx ${dataDir} | ||||||
|       find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; |       find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; | ||||||
|  |  | ||||||
							
								
								
									
										10
									
								
								profiles/sync/get-music.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										10
									
								
								profiles/sync/get-music.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,10 @@ | ||||||
|  | { pkgs, lib, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   services.cron = { | ||||||
|  |     enable = true; | ||||||
|  |     systemCronJobs = [ | ||||||
|  |       "* */24 * * * *     anish     ~/get-music.sh" | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										9
									
								
								profiles/sync/get-music.sh
									
									
									
									
									
										Executable file
									
								
							
							
						
						
									
										9
									
								
								profiles/sync/get-music.sh
									
									
									
									
									
										Executable file
									
								
							|  | @ -0,0 +1,9 @@ | ||||||
|  | #!/usr/bin/env bash | ||||||
|  | rsync -r --ignore-existing --log-file=/data/incoming/download-log hypercube@talos.feralhosting.com:private/transmission/data/* /data/incoming | ||||||
|  | 
 | ||||||
|  | # you need to set defaults for beets | ||||||
|  | # if already imported -> Skip | ||||||
|  | # Auto accept changes  | ||||||
|  | # also install it lmao | ||||||
|  | #beet import /data/incoming | ||||||
|  | 
 | ||||||
|  | @ -1,9 +1,61 @@ | ||||||
| { config, pkgs, ... }: | { config, pkgs, lib, ... }: | ||||||
| 
 | 
 | ||||||
| { | { | ||||||
|   services.taskserver.enable = true; |   services.tailscale.enable = true; | ||||||
|   services.taskserver.fqdn = "task.moss"; |   networking.firewall.allowedUDPPorts = [ 60990 ]; | ||||||
|   services.taskserver.listenHost = "172.16.11.240"; | 
 | ||||||
|   services.taskserver.listenPort = 53589; |   # Enable WireGuard | ||||||
|   services.taskserver.organisations.mossnet.users = [ "anish" ]; |   networking.wireguard.interfaces = { | ||||||
|  |     # "wg0" is the network interface name. You can name the interface arbitrarily. | ||||||
|  |     wg0 = { | ||||||
|  |       # Determines the IP address and subnet of the client's end of the tunnel interface. | ||||||
|  |       ips = [ "10.0.69.4/24" ]; | ||||||
|  |       listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers) | ||||||
|  | 
 | ||||||
|  |       # Path to the private key file. | ||||||
|  |       # | ||||||
|  |       # Note: The private key can also be included inline via the privateKey option, | ||||||
|  |       # but this makes the private key world-readable; thus, using privateKeyFile is | ||||||
|  |       # recommended. | ||||||
|  |       privateKeyFile = "/home/anish/wg/privkey"; | ||||||
|  | 
 | ||||||
|  |       peers = [ | ||||||
|  |         # For a client configuration, one peer entry for the server will suffice. | ||||||
|  |         { | ||||||
|  |           # Public key of the server (not a file path). | ||||||
|  |           publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI="; | ||||||
|  | 
 | ||||||
|  |           # Forward all the traffic via VPN. | ||||||
|  |           allowedIPs = [ "10.0.69.0/24" ]; | ||||||
|  |           # Or forward only particular subnets | ||||||
|  |           #allowedIPs = [ "10.100.0.1" "91.108.12.0/22" ]; | ||||||
|  | 
 | ||||||
|  |           # Set this to the server IP and port. | ||||||
|  |           endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 | ||||||
|  | 
 | ||||||
|  |           # Send keepalives every 25 seconds. Important to keep NAT tables alive. | ||||||
|  |           persistentKeepalive = 25; | ||||||
|  |         } | ||||||
|  |       ]; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  | #  boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ]; | ||||||
|  | #  environment.systemPackages = [ pkgs.wireguard ]; | ||||||
|  | #  networking.wireguard.enable = true; | ||||||
|  | #  networking.wireguard.interfaces = { | ||||||
|  | #    wg0 = { | ||||||
|  | #      ips = [ "10.0.69.4/32" ]; | ||||||
|  | #      privateKeyFile = "/home/anish/wg/privkey"; | ||||||
|  | #      listenPort = 60990; | ||||||
|  | # | ||||||
|  | #      peers = [ | ||||||
|  | #        { # helix - server | ||||||
|  | #          publicKey = "{c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=}"; | ||||||
|  | #          allowedIPs = [ "10.0.69.1/24" ]; | ||||||
|  | #          endpoint = "sealight.xyz:60990"; | ||||||
|  | #          persistentKeepalive = 25; | ||||||
|  | #        } ]; | ||||||
|  | #    }; | ||||||
|  | #  }; | ||||||
| } | } | ||||||
|  |  | ||||||
|  | @ -7,93 +7,92 @@ | ||||||
|     # Ensure the database, user, and permissions always exist |     # Ensure the database, user, and permissions always exist | ||||||
|     ensureDatabases = [ "wallabag" ]; |     ensureDatabases = [ "wallabag" ]; | ||||||
|     ensureUsers = [ |     ensureUsers = [ | ||||||
|       { |      { name = "wallabag"; | ||||||
|         name = "wallabag"; |        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES"; | ||||||
|         ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES"; |      } | ||||||
|       } |  | ||||||
|     ]; |     ]; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   services.wallabag = { |   services.wallabag = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     hostName = "read.mossnet.lan"; |     hostName = "read.mossnet.lan"; | ||||||
|     package = pkgs.callPackage ./pkg-wallabag.nix { }; |     package = pkgs.callPackage ./pkg-wallabag.nix {}; | ||||||
|     conf = '' |     conf = '' | ||||||
|       # This file is a "template" of what your parameters.yml file should look like | # This file is a "template" of what your parameters.yml file should look like | ||||||
|       parameters: | parameters: | ||||||
|           # Uncomment these settings or manually update your parameters.yml |     # Uncomment these settings or manually update your parameters.yml | ||||||
|           # to use docker-compose |     # to use docker-compose | ||||||
|           # |     # | ||||||
|           # database_driver: %env.database_driver% |     # database_driver: %env.database_driver% | ||||||
|           # database_host: %env.database_host% |     # database_host: %env.database_host% | ||||||
|           # database_port: %env.database_port% |     # database_port: %env.database_port% | ||||||
|           # database_name: %env.database_name% |     # database_name: %env.database_name% | ||||||
|           # database_user: %env.database_user% |     # database_user: %env.database_user% | ||||||
|           # database_password: %env.database_password% |     # database_password: %env.database_password% | ||||||
| 
 | 
 | ||||||
|           database_driver: pdo_pgsql |     database_driver: pdo_pgsql | ||||||
|           database_host: localhost |     database_host: localhost | ||||||
|           database_port: ~ |     database_port: ~ | ||||||
|           database_name: wallabag |     database_name: wallabag | ||||||
|           database_user: wallabag |     database_user: wallabag | ||||||
|           database_password: wallabag  |     database_password: wallabag  | ||||||
|           # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite" |     # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite" | ||||||
|           database_path: ~ |     database_path: ~ | ||||||
|           database_table_prefix: wallabag_ |     database_table_prefix: wallabag_ | ||||||
|           database_socket: null |     database_socket: null | ||||||
|           # with PostgreSQL and SQLite, you must set "utf8" |     # with PostgreSQL and SQLite, you must set "utf8" | ||||||
|           database_charset: utf8 |     database_charset: utf8 | ||||||
| 
 | 
 | ||||||
|           domain_name: http://read.mossnet.lan |     domain_name: http://read.mossnet.lan | ||||||
|           server_name: "mossnet wallabag instance" |     server_name: "mossnet wallabag instance" | ||||||
| 
 | 
 | ||||||
|           mailer_transport:  smtp |     mailer_transport:  smtp | ||||||
|           mailer_user:       ~ |     mailer_user:       ~ | ||||||
|           mailer_password:   ~ |     mailer_password:   ~ | ||||||
|           mailer_host:       127.0.0.1 |     mailer_host:       127.0.0.1 | ||||||
|           mailer_port:       false |     mailer_port:       false | ||||||
|           mailer_encryption: ~ |     mailer_encryption: ~ | ||||||
|           mailer_auth_mode:  ~ |     mailer_auth_mode:  ~ | ||||||
| 
 | 
 | ||||||
|           locale: en |     locale: en | ||||||
| 
 | 
 | ||||||
|           # A secret key that's used to generate certain security-related tokens |     # A secret key that's used to generate certain security-related tokens | ||||||
|           secret: SAFGOECRIlfal89oe6u0(*^dsaaih961 |     secret: SAFGOECRIlfal89oe6u0(*^dsaaih961 | ||||||
| 
 | 
 | ||||||
|           # two factor stuff |     # two factor stuff | ||||||
|           twofactor_auth: true |     twofactor_auth: true | ||||||
|           twofactor_sender: no-reply@wallabag.org |     twofactor_sender: no-reply@wallabag.org | ||||||
| 
 | 
 | ||||||
|           # fosuser stuff |     # fosuser stuff | ||||||
|           fosuser_registration: true |     fosuser_registration: true | ||||||
|           fosuser_confirmation: true |     fosuser_confirmation: true | ||||||
| 
 | 
 | ||||||
|           # how long the access token should live in seconds for the API |     # how long the access token should live in seconds for the API | ||||||
|           fos_oauth_server_access_token_lifetime: 3600 |     fos_oauth_server_access_token_lifetime: 3600 | ||||||
|           # how long the refresh token should life in seconds for the API |     # how long the refresh token should life in seconds for the API | ||||||
|           fos_oauth_server_refresh_token_lifetime: 1209600 |     fos_oauth_server_refresh_token_lifetime: 1209600 | ||||||
| 
 | 
 | ||||||
|           from_email: no-reply@wallabag.org |     from_email: no-reply@wallabag.org | ||||||
| 
 | 
 | ||||||
|           rss_limit: 50 |     rss_limit: 50 | ||||||
| 
 | 
 | ||||||
|           # RabbitMQ processing |     # RabbitMQ processing | ||||||
|           rabbitmq_host: localhost |     rabbitmq_host: localhost | ||||||
|           rabbitmq_port: 5672 |     rabbitmq_port: 5672 | ||||||
|           rabbitmq_user: guest |     rabbitmq_user: guest | ||||||
|           rabbitmq_password: guest |     rabbitmq_password: guest | ||||||
|           rabbitmq_prefetch_count: 10 |     rabbitmq_prefetch_count: 10 | ||||||
| 
 | 
 | ||||||
|           # Redis processing |     # Redis processing | ||||||
|           redis_scheme: tcp |     redis_scheme: tcp | ||||||
|           redis_host: localhost |     redis_host: localhost | ||||||
|           redis_port: 6379 |     redis_port: 6379 | ||||||
|           redis_path: null |     redis_path: null | ||||||
|           redis_password: null |     redis_password: null | ||||||
| 
 | 
 | ||||||
|           # sentry logging |     # sentry logging | ||||||
|           sentry_dsn: ~ |     sentry_dsn: ~ | ||||||
|     ''; | ''; | ||||||
|   }; |   }; | ||||||
|   # networking.firewall.allowedTCPPorts = [ 8080 ]; |   # networking.firewall.allowedTCPPorts = [ 8080 ]; | ||||||
| }  | }  | ||||||
|  |  | ||||||
		Loading…
	
		Reference in a new issue