emelie/nix-deploy
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Wiki Activity

add anarkafem.dev, minor tweaks

Browse source
This commit is contained in:
Emelie 2021-09-23 16:45:06 +02:00
parent 3ed18d33fc
commit 0969b36564
Signed by: emelie
GPG key ID: 49D33365A7E22D12
18 changed files with 374 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

7
config/hosts/wind/configuration.nix
View file

@ -3,6 +3,7 @@
{
imports = [
./hardware-configuration.nix
../../common/services/openssh.nix
./services/acme.nix
./services/coturn.nix
./services/nginx.nix
@ -56,12 +57,6 @@
];
};
services.openssh = {
enable = true;
passwordAuthentication = false;
permitRootLogin = "no";
challengeResponseAuthentication = false;
};
# Use hetzner firewall instead
networking.firewall.enable = false;

2
config/hosts/wind/services/acme.nix
View file

@ -5,7 +5,7 @@
acceptTerms = true;
email = "admin+certs@graven.dev";
certs."graven.dev" = {
extraDomainNames = "*.graven.dev";
extraDomainNames = [ "*.graven.dev" ];
dnsProvider = "hurricane";
credentialsFile = config.secrets.files.acme_graven_dev.file;
};

2
config/hosts/wind/services/coturn.nix
View file

@ -4,7 +4,7 @@
enable = true;
lt-cred-mech = true;
use-auth-secret = true;
static-auth-secret = builtins.toString config.secrets.files.synapse_turn_shared_secret.file;
static-auth-secret = builtins.toString config.secrets.files.turn_shared_secret.file;
realm = "turn.graven.dev";
relay-ips = [
"65.21.58.38"

2
config/hosts/wind/services/postgres.nix
View file

@ -20,7 +20,7 @@
services.postgresqlBackup = {
enable = true;
location = "/var/lib/postgresql/backup";
databases = [ "gitea" "mogger" "synapse" "tt_rss" ];
databases = [ "synapse" ];
startAt = "02:30";
compression = "none";
};

8
config/hosts/wind/services/restic.nix
View file

@ -9,7 +9,7 @@
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "02:15"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_private_key.file} -s sftp'" ];
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
};
"postgres" = {
@ -18,7 +18,7 @@
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "03:00"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_private_key.file} -s sftp'" ];
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
};
"synapse" = {
@ -27,7 +27,7 @@
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "03:30"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_private_key.file} -s sftp'" ];
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
};
"vaultwarden" = {
@ -36,7 +36,7 @@
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "23:45"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_private_key.file} -s sftp'" ];
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
};
};

2
config/hosts/wind/services/synapse.nix
View file

@ -6,7 +6,7 @@
server_name = "graven.dev";
enable_registration = false;
registration_shared_secret = builtins.toString config.secrets.files.synapse_registration_shared_secret.file;
turn_shared_secret = builtins.toString config.secrets.files.synapse_turn_shared_secret.file;
turn_shared_secret = builtins.toString config.secrets.files.turn_shared_secret.file;
max_upload_size = "100M";
database_type = "psycopg2";
database_user = "synapse";

2
config/hosts/wind/services/vaultwarden.nix
View file

@ -6,7 +6,7 @@
backupDir = "/var/lib/bitwarden_rs/backup";
config = {
domain = "https://vault.graven.dev";
signupsAllowed = true;
signupsAllowed = false;
rocketPort = 8812;
ipHeader = "X-Real-IP";
websocketEnabled = true;