helm/hosts/helix/default.nix
2025-02-23 20:09:55 -08:00

69 lines
1.6 KiB
Nix

{ self, profiles, suites, pkgs, ... }:
{
imports = [
./configuration.nix
../profiles/core
../profiles/server
# ../profiles/metrics
../profiles/gitea
# ../profiles/woodpecker-server
../profiles/rss-bridge
# ../profiles/mount-mossnet
../profiles/freshrss
../profiles/microbin
../profiles/site
# ../profiles/postgres_upgrade_script
];
# Capsul specific
users.users.cyberian = {
isNormalUser = true;
extraGroups = [ "wheel" ];
};
age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
age.secrets.helix-wg.owner = "anish";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.5/24" ];
privateKeyFile = "/run/agenix/helix-wg";
};
# Reverse proxy for immich
services.nginx.virtualHosts."photos.sealight.xyz" = {
enableACME = true;
forceSSL = true;
locations."/" = {
extraConfig = ''
proxy_pass http://10.0.69.4:8567;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
'';
};
};
services.postgresql.package = pkgs.postgresql_15;
services.postgresqlBackup = {
# TODO needs working wireguard to box
enable = false;
databases = [ "gitea" "freshrss" ]; # "woodpecker"
location = "/mnt/two/postgres";
};
mossnet.backup = {
enable = true;
name = "helix";
paths = [
"/var/lib/gitea"
"/var/lib/freshrss"
# "/var/lib/woodpecker"
"/var/lib/microbin"
];
};
}