aboutsummaryrefslogtreecommitdiff
path: root/vps-configuration.nix
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--vps-configuration.nix (renamed from vps-configuration.env.nix)212
1 files changed, 104 insertions, 108 deletions
diff --git a/vps-configuration.env.nix b/vps-configuration.nix
index d5a7f54..06d0e29 100644
--- a/vps-configuration.env.nix
+++ b/vps-configuration.nix
@@ -1,54 +1,49 @@
{ config, pkgs, ... }:
let
- envsubstConfiguration = {
- TLD = "$TLD";
- nextcloudTLD = "$NEXTCLOUD_TLD";
- gitTLD = "$GIT_TLD";
- prosodyTLD = "$PROSODY_TLD";
- bonecoTLD = "$BONECO_TLD";
- pdfsTLD = "$PDFS_TLD";
- ciLogsTLD = "$CI_LOGS_TLD";
- songbooksDocumentationTLD = "$SONGBOOKS_DOCUMENTATION_TLD";
- piresDocumentationTLD = "$PIRES_DOCUMENTATION_TLD";
- mediatorDocumentationTLD = "$MEDIATOR_DOCUMENTATION_TLD";
- cementDocumentationTLD = "$CEMENT_DOCUMENTATION_TLD";
- piresProdTLD = "$PIRES_PROD_TLD";
- piresProdPort = "$PIRES_PROD_PORT";
- piresProdDir = "$PIRES_PROD_DIR";
- letsencryptEmail = "$LETSENCRYPT_EMAIL";
- authorizedKey = "$AUTHORIZED_KEY";
- userPassword = "$USER_PASSWORD";
- userName = "$USER_NAME";
- dataRoot = "$DATA_ROOT";
- staticRoot = "$STATIC_ROOT";
- ciLogsRoot = "$CI_LOGS_ROOT";
- faviconsRoot = "$FAVICONS_ROOT";
- nextcloudDatabaseUser = "$NEXTCLOUD_DATABASE_USER";
- nextcloudDatabasePassword = "$NEXTCLOUD_DATABASE_PASSWORD";
- nextcloudAdminUser = "$NEXTCLOUD_ADMIN_USER";
- nextcloudAdminPassword = "$NEXTCLOUD_ADMIN_PASSWORD";
- nextcloudTablePrefix = "$NEXTCLOUD_TABLE_PREFIX";
- gitPort = "$GIT_PORT";
- gitRoot = "$GIT_ROOT";
- systemStateVersion = "$SYSTEM_STATE_VERSION";
- prosodyConverseTLD = "$PROSODY_CONVERSE_TLD";
- prosodyAdminUser = "$PROSODY_ADMIN_USER";
- prosodyMUCTLD = "$PROSODY_MUC_TLD";
- prosodyPort = "$PROSODY_PORT";
- prosodyHTTPPort = "$PROSODY_HTTP_PORT";
- prosodyEnable = $PROSODY_ENABLE;
+ envsubstConfiguration =
+ pkgs.callPackage /etc/nixos/envsubst-configuration.nix { };
+ config = rec {
+ letsencryptEmail =
+ "eu@euandre.org"; # this should change when adding email to the box
+ authorizedKey =
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDF+uy407LKZAFnfFkJPRiOBzwV98qIEcKhITnLYhqfITfrJvcFVOY0/YDCrs6WHXyLdM29AoywVWsQ1qXiB7xQCwknPV8YZoCnJQcn0gvH8jbCk+C8Po0Rx846wbhL49qYolnmlhe+Uoy30j7XIJSDtPVO9d/hZqt2GPwGVJ98HLyY2ak+j4i1YkHr+mPFgnCaqCAzA374d1Bop18+YENYtMMU0k8hCsomwZny/7qNo4V8mjLxQAS8FvTuljxlthEpOM4Jsjl07yDLgE69kLvU7mmFi8EeC26e50N18Ouse82dZigtVhAMeLBhbJnQbDff4WfUBzSjpKjZPGcxoRaej3qSRbIkcMMqCOSlww6GcjRi+COvlpA4c1i4hKI15wHceoiKghDLA6jbaHfOqEMldflYl5gCVUIYzJ5XehZppH6L7PzO+L4suNs+aFjWPDZ0jqEtcyTmgTMea40p7wwz086ExnBDorbG79oDiJrWc+swJjXuVakS+fQjb3mPsCC/FgUhsxEtqiVfvLo2mphp47pOYvs64aUp3RV9muqQNuS4tEuP9V1urGTLtgPL26LEjF0oLu1ag0H+VZY5O/T9KRYvWre8IWbj/KkZYo1tJaGJyEVr0plmyzLBEy8b3Hu/6Wtq7yB0Eii60fxqFWC24nEkvs1V0cxDa+o6I2iA9w== eu@euandre.org";
+ TLD = envsubstConfiguration.TLD;
+ nextcloudDomain = "cloud.${TLD}";
+ gitDomain = "git.${TLD}";
+ prosodyDomain = "${TLD}";
+ bonecoDomain = "boneco.${TLD}";
+ pdfsDomain = "pdfs-da-d-maria.${TLD}";
+ ciLogsDomain = "ci.${TLD}";
+ songbooksDocumentationDomain = "songbooks.${TLD}";
+ piresDocumentationDomain = "pires.${TLD}";
+ mediatorDocumentationDomain = "mediator.${TLD}";
+ cementDocumentationDomain = "cement.${TLD}";
+ piresProdDomain = "pires-prod.${TLD}";
+ piresProdPort = "1234";
+ piresProdDir = "/home/andreh/pires-git/";
+ nextcloudDatabaseUser = "nextcloud";
+ nextcloudAdminUser = envsubstConfiguration.userName;
+ nextcloudTablePrefix = "euandreh_";
+ gitPort = "81";
+ prosodyConverseDomain = "chat.${TLD}";
+ prosodyAdminUser = "eu@${TLD}";
+ prosodyMUCDomain = "conference.${TLD}";
+ prosodyPort = "5222";
+ prosodyHTTPPort = "5280";
+ prosodyEnable = envsubstConfiguration.prosodyEnable == "true";
+ openSSHPort = 23841;
};
staticSiteFromRepo = repoName:
pkgs.stdenv.mkDerivation {
name = repoName;
src = fetchTarball
- "https://git.sr.ht/~euandreh/${DOLLAR}{repoName}/archive/master.tar.gz";
+ "https://git.sr.ht/~euandreh/${repoName}/archive/master.tar.gz";
phases = "unpackPhase buildPhase";
buildPhase = ''
- mkdir ${DOLLAR}out
- cp index.html ${DOLLAR}out
- cp favicon.ico ${DOLLAR}out
+ mkdir $out
+ cp index.html $out
+ cp favicon.ico $out
'';
};
pkgsUnstable = import (builtins.fetchTarball {
@@ -58,14 +53,14 @@ let
export FLASK_CONFIG=production
export PIRES_PROD_DIR="$"
- if [[ ! -d ${envsubstConfiguration.piresProdDir} ]]; then
- ${pkgs.git}/bin/git clone https://gitlab.com/EuAndreh/pires.git ${envsubstConfiguration.piresProdDir}
+ if [[ ! -d ${config.piresProdDir} ]]; then
+ ${pkgs.git}/bin/git clone https://gitlab.com/EuAndreh/pires.git ${config.piresProdDir}
fi
- pushd ${envsubstConfiguration.piresProdDir}
+ pushd ${config.piresProdDir}
${pkgs.git}/bin/git pull
${pkgsUnstable.poetry}/bin/poetry install --no-dev --extras "waitress"
${pkgsUnstable.poetry}/bin/poetry run flask inicializar-banco
- ${pkgsUnstable.poetry}/bin/poetry run waitress-serve --host localhost --port ${envsubstConfiguration.piresProdPort} --call pires:create_app
+ ${pkgsUnstable.poetry}/bin/poetry run waitress-serve --host localhost --port ${config.piresProdPort} --call pires:create_app
'';
in {
nix = {
@@ -95,28 +90,27 @@ in {
];
networking.firewall.allowedTCPPorts = [
- # SSH: OpenSSH
- 22
+ config.openSSHPort
# HTTP and HTPPS: NGINX
80
443
- ] ++ (if prosodyEnable then
- [
- # XMPP: Prosody
- # https://prosody.im/doc/ports
- 5000
- 5222
- 5269
- 5280
- 5281
- 5347
- 5582
- ] else []);
+ ] ++ (if config.prosodyEnable then [
+ # XMPP: Prosody
+ # https://prosody.im/doc/ports
+ 5000
+ 5222
+ 5269
+ 5280
+ 5281
+ 5347
+ 5582
+ ] else
+ [ ]);
security.acme = {
acceptTerms = true;
- email = envsubstConfiguration.letsencryptEmail;
+ email = config.letsencryptEmail;
};
services = {
@@ -124,6 +118,7 @@ in {
enable = true;
permitRootLogin = "no";
passwordAuthentication = false;
+ ports = [ config.openSSHPort ];
};
nginx = {
@@ -133,11 +128,11 @@ in {
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
- "${envsubstConfiguration.nextcloudTLD}" = {
+ "${config.nextcloudDomain}" = {
forceSSL = true;
enableACME = true;
};
- "${envsubstConfiguration.gitTLD}" = {
+ "${config.gitDomain}" = {
forceSSL = true;
enableACME = true;
extraConfig = ''
@@ -145,26 +140,26 @@ in {
alias ${envsubstConfiguration.dataRoot}/favicons/git.ico;
}
location / {
- proxy_pass http://localhost:${envsubstConfiguration.gitPort};
+ proxy_pass http://localhost:${config.gitPort};
}
'';
};
- "${envsubstConfiguration.bonecoTLD}" = {
+ "${config.bonecoDomain}" = {
forceSSL = true;
enableACME = true;
root = staticSiteFromRepo "boneco";
};
- "${envsubstConfiguration.pdfsTLD}" = {
+ "${config.pdfsDomain}" = {
forceSSL = true;
enableACME = true;
root = staticSiteFromRepo "pdfs-da-d-maria";
};
- "${envsubstConfiguration.ciLogsTLD}" = {
+ "${config.ciLogsDomain}" = {
forceSSL = true;
enableACME = true;
root = "${envsubstConfiguration.ciLogsRoot}";
};
- "${envsubstConfiguration.mediatorDocumentationTLD}" = {
+ "${config.mediatorDocumentationDomain}" = {
forceSSL = true;
enableACME = true;
extraConfig = ''
@@ -174,7 +169,7 @@ in {
root ${envsubstConfiguration.staticRoot}/mediator/;
'';
};
- "${envsubstConfiguration.cementDocumentationTLD}" = {
+ "${config.cementDocumentationDomain}" = {
forceSSL = true;
enableACME = true;
extraConfig = ''
@@ -184,7 +179,7 @@ in {
root ${envsubstConfiguration.staticRoot}/cement/;
'';
};
- "${envsubstConfiguration.songbooksDocumentationTLD}" = {
+ "${config.songbooksDocumentationDomain}" = {
forceSSL = true;
enableACME = true;
extraConfig = ''
@@ -194,28 +189,25 @@ in {
root ${envsubstConfiguration.staticRoot}/songbooks/;
'';
};
- "${envsubstConfiguration.piresDocumentationTLD}" = {
+ "${config.piresDocumentationDomain}" = {
forceSSL = true;
enableACME = true;
root = "${envsubstConfiguration.staticRoot}/pires/";
};
- "${envsubstConfiguration.piresProdTLD}" = {
+ "${config.piresProdDomain}" = {
forceSSL = true;
enableACME = true;
locations = {
- "/" = {
- proxyPass =
- "http://localhost:${envsubstConfiguration.piresProdPort}/";
- };
+ "/" = { proxyPass = "http://localhost:${config.piresProdPort}/"; };
};
};
# Generate and maintain TLS certificate with NGINX
# to be used by Prosody
- "${envsubstConfiguration.prosodyTLD}" = {
+ "${config.prosodyDomain}" = {
forceSSL = true;
enableACME = true;
};
- "${envsubstConfiguration.prosodyConverseTLD}" = {
+ "${config.prosodyConverseDomain}" = {
forceSSL = true;
enableACME = true;
extraConfig = ''
@@ -226,7 +218,7 @@ in {
return 301 conversejs;
}
location / {
- proxy_pass http://localhost:${envsubstConfiguration.prosodyHTTPPort}/;
+ proxy_pass http://localhost:${config.prosodyHTTPPort}/;
}
'';
};
@@ -247,7 +239,7 @@ in {
enable = true;
package = pkgs.nextcloud19;
nginx.enable = true;
- hostName = envsubstConfiguration.nextcloudTLD;
+ hostName = config.nextcloudDomain;
https = true;
maxUploadSize = "4G";
autoUpdateApps.enable = true;
@@ -256,28 +248,28 @@ in {
dbtype = "pgsql";
dbhost = "/run/postgresql";
dbuser = envsubstConfiguration.nextcloudDatabaseUser;
- dbpass = envsubstConfiguration.nextcloudDatabasePassword;
- dbtableprefix = envsubstConfiguration.nextcloudTablePrefix;
- adminuser = envsubstConfiguration.nextcloudAdminUser;
- adminpass = envsubstConfiguration.nextcloudAdminPassword;
+ dbpassFile =
+ "${envsubstConfiguration.secretsRoot}/nextcloud-database.txt";
+ dbtableprefix = config.nextcloudTablePrefix;
+ adminuser = config.nextcloudAdminUser;
+ adminpassFile =
+ "${envsubstConfiguration.secretsRoot}/nextcloud-admin.txt";
};
};
prosody = let
XMPP = {
- fullchainPEM =
- "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/fullchain.pem";
- keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/key.pem";
+ fullchainPEM = "/var/lib/acme/${config.prosodyDomain}/fullchain.pem";
+ keyPEM = "/var/lib/acme/${config.prosodyDomain}/key.pem";
};
ConverseJS = {
fullchainPEM =
- "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/fullchain.pem";
- keyPEM =
- "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/key.pem";
+ "/var/lib/acme/${config.prosodyConverseDomain}/fullchain.pem";
+ keyPEM = "/var/lib/acme/${config.prosodyConverseDomain}/key.pem";
};
in {
- enable = prosodyEnable;
- admins = [ envsubstConfiguration.prosodyAdminUser ];
+ enable = config.prosodyEnable;
+ admins = [ config.prosodyAdminUser ];
allowRegistration = false;
modules = { websocket = true; };
package = pkgs.prosody.override {
@@ -285,17 +277,17 @@ in {
};
extraModules = [ "http_upload" "conversejs" "bookmarks" ];
virtualHosts = {
- "${envsubstConfiguration.prosodyTLD}" = {
+ "${config.prosodyDomain}" = {
enabled = true;
- domain = "${envsubstConfiguration.prosodyTLD}";
+ domain = "${config.prosodyDomain}";
ssl = {
cert = XMPP.fullchainPEM;
key = XMPP.keyPEM;
};
};
- "${envsubstConfiguration.prosodyConverseTLD}" = {
+ "${config.prosodyConverseDomain}" = {
enabled = true;
- domain = "${envsubstConfiguration.prosodyConverseTLD}";
+ domain = "${config.prosodyConverseDomain}";
ssl = {
cert = ConverseJS.fullchainPEM;
key = ConverseJS.keyPEM;
@@ -306,7 +298,7 @@ in {
lighttpd = {
enable = true;
- port = pkgs.lib.toInt envsubstConfiguration.gitPort;
+ port = pkgs.lib.toInt config.gitPort;
cgit = {
enable = true;
subdir = "";
@@ -340,10 +332,10 @@ in {
# extraConfig = ''
# compress
- # ${envsubstConfiguration.ciLogsRoot}/*/*.log {
+ # ${config.ciLogsRoot}/*/*.log {
# rotate 5
# daily
- # olddir ${envsubstConfiguration.staticRoot}/logrorate/
+ # olddir ${config.staticRoot}/logrorate/
# createolddir 744 andreh users
# su andreh users
# }
@@ -362,9 +354,9 @@ in {
wantedBy = [ "multi-user.target" ];
script = pkgs.lib.fold (p: acc:
acc + ''
- mkdir -p ${DOLLAR}{p}
- chown -R andreh:users ${DOLLAR}{p}
- chmod -R 755 ${DOLLAR}{p}
+ mkdir -p ${p}
+ chown -R andreh:users ${p}
+ chmod -R 755 ${p}
'') "" (with envsubstConfiguration; [
staticRoot
gitRoot
@@ -394,7 +386,7 @@ in {
# Service
serviceConfig = {
User = "${envsubstConfiguration.userName}";
- ExecStart = "${DOLLAR}{piresProd}/bin/run-pires.sh";
+ ExecStart = "${piresProd}/bin/run-pires.sh";
Restart = "always";
};
# Install
@@ -402,12 +394,16 @@ in {
};
};
- users.extraUsers."${envsubstConfiguration.userName}" = {
- uid = 1000;
- isNormalUser = true;
- extraGroups = [ "wheel" ];
- password = envsubstConfiguration.userPassword;
- openssh.authorizedKeys.keys = [ envsubstConfiguration.authorizedKey ];
+ users = {
+ mutableUsers = false;
+ extraUsers."${envsubstConfiguration.userName}" = {
+ uid = 1000;
+ isNormalUser = true;
+ extraGroups = [ "wheel" ];
+ hashedPassword =
+ builtins.readFile "${envsubstConfiguration.secretsRoot}/user-hash.txt";
+ openssh.authorizedKeys.keys = [ config.authorizedKey ];
+ };
};
system.stateVersion = envsubstConfiguration.systemStateVersion;
generated by cgit v1.3 (git 2.53.0) at 2026-10-19 20:23:57 +0000