1 files changed, 33 insertions, 39 deletions

diff --git a/configuration.nix b/vps-configuration.nix
index fad5305..8afa57d 100644
--- a/configuration.nix
+++ b/vps-configuration.nix
@@ -1,10 +1,14 @@
 { config, pkgs, ... }:
 
 let
-  privateConfiguration = import ./private-configuration.nix;
-  derivedConfiguration = import ./derived-configuration.nix;
+  envsubstConfiguration = {
+    nextcloudTLD = "$NEXTCLOUD_TLD";
+    gitTLD = "$GIT_TLD";
+    letsencryptEmail = "$LETSENCRYPT_EMAIL";
+    authorizedKey = "$AUTHORIZED_KEY";
+  };
 in {
-  imports = [ ./hardware-configuration.nix];
+  imports = [ ./hardware-configuration.nix ];
 
   boot.loader.grub = {
     enable = true;
@@ -17,15 +21,13 @@ in {
     interfaces.ens3.useDHCP = true;
   };
 
-  environment.systemPackages = with pkgs; [
-    vim
-  ];
+  environment.systemPackages = with pkgs; [ vim ];
 
   networking.firewall.allowedTCPPorts = [ 80 443 22 ];
 
   security.acme = {
     acceptTerms = true;
-    email = privateConfiguration.letsencryptEmail;
+    email = envsubstConfiguration.letsencryptEmail;
   };
 
   services = {
@@ -41,36 +43,31 @@ in {
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; # FIXME: ?????
+      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
       virtualHosts = let
-        customConfigTLDs = {};
-        defaultConfigTLDs = [
-          derivedConfiguration.nextcloudTLD
-          derivedConfiguration.gitTLD
-        ];
-        buildDefaultConfiguration = tld:
-          {
-            "${tld}" = {
-              forceSSL = true;
-              enableACME = true;
-            };
+        customConfigTLDs = { };
+        defaultConfigTLDs =
+          [ envsubstConfiguration.nextcloudTLD envsubstConfiguration.gitTLD ];
+        buildDefaultConfiguration = tld: {
+          "${tld}" = {
+            forceSSL = true;
+            enableACME = true;
           };
-      in
-        pkgs.lib.fold
-          (tldString: acc: acc // buildDefaultConfiguration tldString)
-          customConfigTLDs
-          defaultConfigTLDs;
+        };
+      in pkgs.lib.fold
+      (tldString: acc: acc // buildDefaultConfiguration tldString)
+      customConfigTLDs defaultConfigTLDs;
 
       gitweb = {
         enable = true;
         location = "/";
-        virtualHost = derivedConfiguration.gitTLD;
+        virtualHost = envsubstConfiguration.gitTLD;
       };
     };
 
     nextcloud = {
       enable = true;
-      hostName = derivedConfiguration.nextcloudTLD;
+      hostName = envsubstConfiguration.nextcloudTLD;
       nginx.enable = true;
       https = true;
       autoUpdateApps.enable = true;
@@ -80,7 +77,8 @@ in {
 
         dbtype = "pgsql";
         dbuser = "nextcloud";
-        dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
+        dbhost =
+          "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
         dbname = "nextcloud";
         dbpassFile = "/var/nextcloud-db-pass";
 
@@ -92,12 +90,10 @@ in {
     postgresql = {
       enable = true;
       ensureDatabases = [ "nextcloud" ];
-      ensureUsers = [
-        {
-          name = "nextcloud";
-          ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
-        }
-      ];
+      ensureUsers = [{
+        name = "nextcloud";
+        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+      }];
     };
 
     gitweb = {
@@ -106,18 +102,16 @@ in {
     };
   };
 
-  # FIXME: is this required?
   systemd.services."nextcloud-setup" = {
-    requires = ["postgresql.service"];
-    after = ["postgresql.service"];
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
   };
 
   users.users.nixos = {
     uid = 1000;
-    extraGroups = ["wheel"];
+    extraGroups = [ "wheel" ];
     useDefaultShell = true;
-    # FIXME: password hash file?
-    openssh.authorizedKeys.keyFiles = [ "/etc/nixos/nixos-user-authorized-key"];
+    openssh.authorizedKeys.keys = [ envsubstConfiguration.authorizedKey ];
   };
 
   system.stateVersion = "19.09";