diff options
Diffstat (limited to 'vps-configuration.env.nix')
| -rw-r--r-- | vps-configuration.env.nix | 414 |
1 files changed, 0 insertions, 414 deletions
diff --git a/vps-configuration.env.nix b/vps-configuration.env.nix deleted file mode 100644 index d5a7f54..0000000 --- a/vps-configuration.env.nix +++ /dev/null @@ -1,414 +0,0 @@ -{ config, pkgs, ... }: - -let - envsubstConfiguration = { - TLD = "$TLD"; - nextcloudTLD = "$NEXTCLOUD_TLD"; - gitTLD = "$GIT_TLD"; - prosodyTLD = "$PROSODY_TLD"; - bonecoTLD = "$BONECO_TLD"; - pdfsTLD = "$PDFS_TLD"; - ciLogsTLD = "$CI_LOGS_TLD"; - songbooksDocumentationTLD = "$SONGBOOKS_DOCUMENTATION_TLD"; - piresDocumentationTLD = "$PIRES_DOCUMENTATION_TLD"; - mediatorDocumentationTLD = "$MEDIATOR_DOCUMENTATION_TLD"; - cementDocumentationTLD = "$CEMENT_DOCUMENTATION_TLD"; - piresProdTLD = "$PIRES_PROD_TLD"; - piresProdPort = "$PIRES_PROD_PORT"; - piresProdDir = "$PIRES_PROD_DIR"; - letsencryptEmail = "$LETSENCRYPT_EMAIL"; - authorizedKey = "$AUTHORIZED_KEY"; - userPassword = "$USER_PASSWORD"; - userName = "$USER_NAME"; - dataRoot = "$DATA_ROOT"; - staticRoot = "$STATIC_ROOT"; - ciLogsRoot = "$CI_LOGS_ROOT"; - faviconsRoot = "$FAVICONS_ROOT"; - nextcloudDatabaseUser = "$NEXTCLOUD_DATABASE_USER"; - nextcloudDatabasePassword = "$NEXTCLOUD_DATABASE_PASSWORD"; - nextcloudAdminUser = "$NEXTCLOUD_ADMIN_USER"; - nextcloudAdminPassword = "$NEXTCLOUD_ADMIN_PASSWORD"; - nextcloudTablePrefix = "$NEXTCLOUD_TABLE_PREFIX"; - gitPort = "$GIT_PORT"; - gitRoot = "$GIT_ROOT"; - systemStateVersion = "$SYSTEM_STATE_VERSION"; - prosodyConverseTLD = "$PROSODY_CONVERSE_TLD"; - prosodyAdminUser = "$PROSODY_ADMIN_USER"; - prosodyMUCTLD = "$PROSODY_MUC_TLD"; - prosodyPort = "$PROSODY_PORT"; - prosodyHTTPPort = "$PROSODY_HTTP_PORT"; - prosodyEnable = $PROSODY_ENABLE; - }; - staticSiteFromRepo = repoName: - pkgs.stdenv.mkDerivation { - name = repoName; - src = fetchTarball - "https://git.sr.ht/~euandreh/${DOLLAR}{repoName}/archive/master.tar.gz"; - phases = "unpackPhase buildPhase"; - buildPhase = '' - mkdir ${DOLLAR}out - cp index.html ${DOLLAR}out - cp favicon.ico ${DOLLAR}out - ''; - }; - pkgsUnstable = import (builtins.fetchTarball { - url = "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz"; - }) { }; - piresProd = pkgs.writeShellScriptBin "run-pires.sh" '' - export FLASK_CONFIG=production - - export PIRES_PROD_DIR="$" - if [[ ! -d ${envsubstConfiguration.piresProdDir} ]]; then - ${pkgs.git}/bin/git clone https://gitlab.com/EuAndreh/pires.git ${envsubstConfiguration.piresProdDir} - fi - pushd ${envsubstConfiguration.piresProdDir} - ${pkgs.git}/bin/git pull - ${pkgsUnstable.poetry}/bin/poetry install --no-dev --extras "waitress" - ${pkgsUnstable.poetry}/bin/poetry run flask inicializar-banco - ${pkgsUnstable.poetry}/bin/poetry run waitress-serve --host localhost --port ${envsubstConfiguration.piresProdPort} --call pires:create_app - ''; -in { - nix = { - binaryCaches = [ "https://euandreh.cachix.org" ]; - binaryCachePublicKeys = - [ "euandreh.cachix.org-1:ms8eOKJJtb20GJDPCf8Nvob8YI0oF8dREAMdx3XF/90=" ]; - }; - - imports = [ ./hardware-configuration.nix ]; - - boot.loader.grub = { - enable = true; - version = 2; - device = "/dev/vda"; - }; - - networking = { - useDHCP = false; - interfaces.ens3.useDHCP = true; - }; - - environment.systemPackages = with pkgs; [ - vim - git - gitAndTools.git-annex - gotop - ]; - - networking.firewall.allowedTCPPorts = [ - # SSH: OpenSSH - 22 - - # HTTP and HTPPS: NGINX - 80 - 443 - ] ++ (if prosodyEnable then - [ - # XMPP: Prosody - # https://prosody.im/doc/ports - 5000 - 5222 - 5269 - 5280 - 5281 - 5347 - 5582 - ] else []); - - security.acme = { - acceptTerms = true; - email = envsubstConfiguration.letsencryptEmail; - }; - - services = { - openssh = { - enable = true; - permitRootLogin = "no"; - passwordAuthentication = false; - }; - - nginx = { - enable = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - virtualHosts = { - "${envsubstConfiguration.nextcloudTLD}" = { - forceSSL = true; - enableACME = true; - }; - "${envsubstConfiguration.gitTLD}" = { - forceSSL = true; - enableACME = true; - extraConfig = '' - location = /favicon.ico { - alias ${envsubstConfiguration.dataRoot}/favicons/git.ico; - } - location / { - proxy_pass http://localhost:${envsubstConfiguration.gitPort}; - } - ''; - }; - "${envsubstConfiguration.bonecoTLD}" = { - forceSSL = true; - enableACME = true; - root = staticSiteFromRepo "boneco"; - }; - "${envsubstConfiguration.pdfsTLD}" = { - forceSSL = true; - enableACME = true; - root = staticSiteFromRepo "pdfs-da-d-maria"; - }; - "${envsubstConfiguration.ciLogsTLD}" = { - forceSSL = true; - enableACME = true; - root = "${envsubstConfiguration.ciLogsRoot}"; - }; - "${envsubstConfiguration.mediatorDocumentationTLD}" = { - forceSSL = true; - enableACME = true; - extraConfig = '' - location = / { - return 301 master/; - } - root ${envsubstConfiguration.staticRoot}/mediator/; - ''; - }; - "${envsubstConfiguration.cementDocumentationTLD}" = { - forceSSL = true; - enableACME = true; - extraConfig = '' - location = / { - return 301 master/; - } - root ${envsubstConfiguration.staticRoot}/cement/; - ''; - }; - "${envsubstConfiguration.songbooksDocumentationTLD}" = { - forceSSL = true; - enableACME = true; - extraConfig = '' - location = / { - return 301 en/master/; - } - root ${envsubstConfiguration.staticRoot}/songbooks/; - ''; - }; - "${envsubstConfiguration.piresDocumentationTLD}" = { - forceSSL = true; - enableACME = true; - root = "${envsubstConfiguration.staticRoot}/pires/"; - }; - "${envsubstConfiguration.piresProdTLD}" = { - forceSSL = true; - enableACME = true; - locations = { - "/" = { - proxyPass = - "http://localhost:${envsubstConfiguration.piresProdPort}/"; - }; - }; - }; - # Generate and maintain TLS certificate with NGINX - # to be used by Prosody - "${envsubstConfiguration.prosodyTLD}" = { - forceSSL = true; - enableACME = true; - }; - "${envsubstConfiguration.prosodyConverseTLD}" = { - forceSSL = true; - enableACME = true; - extraConfig = '' - location = /favicon.ico { - alias ${envsubstConfiguration.dataRoot}/favicons/conversejs.ico; - } - location = / { - return 301 conversejs; - } - location / { - proxy_pass http://localhost:${envsubstConfiguration.prosodyHTTPPort}/; - } - ''; - }; - }; - }; - - postgresql = { - enable = true; - ensureDatabases = [ "nextcloud" ]; - package = pkgs.postgresql_11; - ensureUsers = [{ - name = "nextcloud"; - ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES"; - }]; - }; - - nextcloud = { - enable = true; - package = pkgs.nextcloud19; - nginx.enable = true; - hostName = envsubstConfiguration.nextcloudTLD; - https = true; - maxUploadSize = "4G"; - autoUpdateApps.enable = true; - config = { - overwriteProtocol = "https"; - dbtype = "pgsql"; - dbhost = "/run/postgresql"; - dbuser = envsubstConfiguration.nextcloudDatabaseUser; - dbpass = envsubstConfiguration.nextcloudDatabasePassword; - dbtableprefix = envsubstConfiguration.nextcloudTablePrefix; - adminuser = envsubstConfiguration.nextcloudAdminUser; - adminpass = envsubstConfiguration.nextcloudAdminPassword; - }; - }; - - prosody = let - XMPP = { - fullchainPEM = - "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/fullchain.pem"; - keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/key.pem"; - }; - ConverseJS = { - fullchainPEM = - "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/fullchain.pem"; - keyPEM = - "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/key.pem"; - }; - in { - enable = prosodyEnable; - admins = [ envsubstConfiguration.prosodyAdminUser ]; - allowRegistration = false; - modules = { websocket = true; }; - package = pkgs.prosody.override { - withCommunityModules = [ "http_upload" "conversejs" "bookmarks" ]; - }; - extraModules = [ "http_upload" "conversejs" "bookmarks" ]; - virtualHosts = { - "${envsubstConfiguration.prosodyTLD}" = { - enabled = true; - domain = "${envsubstConfiguration.prosodyTLD}"; - ssl = { - cert = XMPP.fullchainPEM; - key = XMPP.keyPEM; - }; - }; - "${envsubstConfiguration.prosodyConverseTLD}" = { - enabled = true; - domain = "${envsubstConfiguration.prosodyConverseTLD}"; - ssl = { - cert = ConverseJS.fullchainPEM; - key = ConverseJS.keyPEM; - }; - }; - }; - }; - - lighttpd = { - enable = true; - port = pkgs.lib.toInt envsubstConfiguration.gitPort; - cgit = { - enable = true; - subdir = ""; - configText = '' - enable-blame=1 - enable-commit-graph=1 - enable-follow-links=1 - enable-index-owner=0 - enable-log-filecount=1 - enable-log-linecount=1 - root-desc=public repositories - root-readme=${envsubstConfiguration.gitRoot}/about.html - readme=:README.md - readme=:README - readme=:README.rst - readme=:README.org - max-repodesc-length=120 - remove-suffix=1 - root-title=EuAndreh's git repositories - snapshots=tar.gz zip - source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py - about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh - scan-path=${envsubstConfiguration.gitRoot} - ''; - }; - }; - - logrotate = { - enable = - false; # disabled due to extraConfig not being yet out of unstable - # extraConfig = '' - # compress - - # ${envsubstConfiguration.ciLogsRoot}/*/*.log { - # rotate 5 - # daily - # olddir ${envsubstConfiguration.staticRoot}/logrorate/ - # createolddir 744 andreh users - # su andreh users - # } - # ''; - }; - }; - - systemd.services = { - "nextcloud-setup" = { - requires = [ "postgresql.service" ]; - after = [ "postgresql.service" ]; - }; - "data-folder-init" = { - enable = true; - description = "Setup data folders and permissions"; - wantedBy = [ "multi-user.target" ]; - script = pkgs.lib.fold (p: acc: - acc + '' - mkdir -p ${DOLLAR}{p} - chown -R andreh:users ${DOLLAR}{p} - chmod -R 755 ${DOLLAR}{p} - '') "" (with envsubstConfiguration; [ - staticRoot - gitRoot - faviconsRoot - ciLogsRoot - dataRoot - ]); - serviceConfig = { Type = "oneshot"; }; - }; - "poor-mans-logrotate" = { - enable = true; - description = "Delete old CI log files"; - wantedBy = [ "multi-user.target" ]; - script = '' - pushd ${envsubstConfiguration.ciLogsRoot} - find . -type f -name '*.log' -mtime 1 -delete - find . -type d -empty -delete - ${pkgs.bash}/bin/bash ci-gen-index.sh - ''; - serviceConfig = { Type = "oneshot"; }; - }; - "pires-prod" = { - enable = true; - # Unit - description = "Service for pires server deployment"; - after = [ "network.target" ]; - # Service - serviceConfig = { - User = "${envsubstConfiguration.userName}"; - ExecStart = "${DOLLAR}{piresProd}/bin/run-pires.sh"; - Restart = "always"; - }; - # Install - wantedBy = [ "multi-user.target" ]; - }; - }; - - users.extraUsers."${envsubstConfiguration.userName}" = { - uid = 1000; - isNormalUser = true; - extraGroups = [ "wheel" ]; - password = envsubstConfiguration.userPassword; - openssh.authorizedKeys.keys = [ envsubstConfiguration.authorizedKey ]; - }; - - system.stateVersion = envsubstConfiguration.systemStateVersion; -} |