Semi working setup: Terraform and LetsEncrypt working

2 files changed, 34 insertions, 63 deletions

diff --git a/vps-configuration.env.nix b/vps-configuration.env.nix
index 8afa57d..6ffd900 100644
--- a/vps-configuration.env.nix
+++ b/vps-configuration.env.nix
@@ -6,6 +6,10 @@ let
     gitTLD = "$GIT_TLD";
     letsencryptEmail = "$LETSENCRYPT_EMAIL";
     authorizedKey = "$AUTHORIZED_KEY";
+    userPassword = "$USER_PASSWORD";
+    nextcloudDatabasePassword = "$NEXTCLOUD_DATABASE_PASSWORD";
+    nextcloudAdminPassword = "$NEXTCLOUD_ADMIN_PASSWORD";
+    gitRoot = "$GIT_ROOT";
   };
 in {
   imports = [ ./hardware-configuration.nix ];
@@ -21,7 +25,10 @@ in {
     interfaces.ens3.useDHCP = true;
   };
 
-  environment.systemPackages = with pkgs; [ vim ];
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
 
   networking.firewall.allowedTCPPorts = [ 80 443 22 ];
 
@@ -43,24 +50,20 @@ in {
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-      virtualHosts = let
-        customConfigTLDs = { };
-        defaultConfigTLDs =
-          [ envsubstConfiguration.nextcloudTLD envsubstConfiguration.gitTLD ];
-        buildDefaultConfiguration = tld: {
-          "${tld}" = {
-            forceSSL = true;
-            enableACME = true;
-          };
+      virtualHosts = {
+        "${envsubstConfiguration.nextcloudTLD}" = {
+          forceSSL = true;
+          enableACME = true;
         };
-      in pkgs.lib.fold
-      (tldString: acc: acc // buildDefaultConfiguration tldString)
-      customConfigTLDs defaultConfigTLDs;
+        "${envsubstConfiguration.gitTLD}" = {
+          forceSSL = true;
+          enableACME = true;
+        };
+      };
 
       gitweb = {
         enable = true;
-        location = "/";
+        location = "";
         virtualHost = envsubstConfiguration.gitTLD;
       };
     };
@@ -68,37 +71,35 @@ in {
     nextcloud = {
       enable = true;
       hostName = envsubstConfiguration.nextcloudTLD;
-      nginx.enable = true;
       https = true;
       autoUpdateApps.enable = true;
       autoUpdateApps.startAt = "05:00:00";
       config = {
         overwriteProtocol = "https";
-
         dbtype = "pgsql";
         dbuser = "nextcloud";
-        dbhost =
-          "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
+        dbhost = "/run/postgresql";
         dbname = "nextcloud";
-        dbpassFile = "/var/nextcloud-db-pass";
-
-        adminpassFile = "/var/nextcloud-admin-pass";
+        dbpass = envsubstConfiguration.nextcloudDatabasePassword;
         adminuser = "admin";
+        adminpass = envsubstConfiguration.nextcloudAdminPassword;
       };
     };
 
     postgresql = {
       enable = true;
       ensureDatabases = [ "nextcloud" ];
-      ensureUsers = [{
-        name = "nextcloud";
-        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
-      }];
+      ensureUsers = [
+        {
+          name = "nextcloud";
+          ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+        }
+      ];
     };
 
     gitweb = {
       gitwebTheme = true;
-      projectroot = "/srv/git";
+      projectroot = envsubstConfiguration.gitRoot;
     };
   };
 
@@ -107,12 +108,13 @@ in {
     after = [ "postgresql.service" ];
   };
 
-  users.users.nixos = {
+  users.extraUsers.andreh = {
     uid = 1000;
+    isNormalUser = true;
     extraGroups = [ "wheel" ];
-    useDefaultShell = true;
+    password = envsubstConfiguration.userPassword;
     openssh.authorizedKeys.keys = [ envsubstConfiguration.authorizedKey ];
   };
 
-  system.stateVersion = "19.09";
+  system.stateVersion = "20.03";
 }
diff --git a/vps.tf b/vps.tf
index 5c03529..3fa9e12 100644
--- a/vps.tf
+++ b/vps.tf
@@ -10,21 +10,11 @@ variable "tld" {
   description = "Root Top-Level Domain. Subdomains will be derived from it."
 }
 
-variable "nextcloud_tld_prefix" {
-  type        = string
-  description = "DNS prefix used for the Nextcloud installation. Does not contain a dot at the end."
-}
-
 variable "hostname" {
   type        = string
   description = "Human name of the host. This is a pet name, not cattle name :)"
 }
 
-variable "storage_name" {
-  type        = string
-  description = "Name of the block storage volume, which will also be the name of it's mount point."
-}
-
 
 # Vultr
 
@@ -46,39 +36,18 @@ resource "vultr_server" "vps_server" {
   # $ curl https://api.vultr.com/v1/plans/list?type=vc2 | jq '.["201"]'
   plan_id = 201
   # $ curl -H "API-Key: $TF_VAR_vultr_api_key" https://api.vultr.com/v1/snapshot/list | jq
-  snapshot_id = "e1d5f317b0f7a"
+  snapshot_id = "c565f318e4aea"
 }
 
 output "public_ip" {
   value = vultr_server.vps_server.main_ip
 }
 
-resource "vultr_block_storage" "vps_storage" {
-  size_gb     = 10
-  region_id   = 9
-  attached_id = vultr_server.vps_server.id
-  label       = var.storage_name
-  live        = "yes"
-}
-
 
 # DNS and IP configuration
 
 resource "vultr_dns_domain" "vps_tld" {
+  # The CNAME record is already generated by Vultr
   domain    = var.tld
   server_ip = vultr_server.vps_server.main_ip
 }
-
-resource "vultr_dns_record" "at_sign" {
-  domain = var.tld
-  type   = "A"
-  name   = "@"
-  data   = vultr_server.vps_server.main_ip
-}
-
-resource "vultr_dns_record" "nextcloud" {
-  domain = var.tld
-  type   = "CNAME"
-  name   = var.nextcloud_tld_prefix
-  data   = vultr_server.vps_server.main_ip
-}