emelie/nix-deploy
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Wiki Activity

Restructure folders, add mail host

Browse source 
The entire file structure has been reorganised into stable and unstable
to separate deployments running on either channel. A `mail` host running
Simple Nix Mailserver has also been added for testing to see if it's a
good alternative to soverin as well as SMTP for other services.
This commit is contained in:
Emelie Graven 2021-11-20 07:18:18 +01:00
parent 51ba0ae296
commit 90eb0c3708
Signed by: emelie
GPG key ID: C11123726DBB55A1
78 changed files with 535 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
unstable/config/hosts/wind/services/acme.nix Normal file
View file

@ -0,0 +1,14 @@
{ config, ... }:
{
security.acme = {
acceptTerms = true;
email = "admin+certs@graven.dev";
certs."graven.dev" = {
extraDomainNames = [ "*.graven.dev" ];
dnsProvider = "hurricane";
credentialsFile = config.secrets.files.acme_graven_dev.file;
};
};
}

26
unstable/config/hosts/wind/services/coturn.nix Normal file
View file

@ -0,0 +1,26 @@
{ config, ... }:
{
services.coturn = {
enable = true;
lt-cred-mech = true;
use-auth-secret = true;
static-auth-secret = builtins.toString config.secrets.files.turn_shared_secret.file;
realm = "turn.graven.dev";
relay-ips = [
"65.21.58.38"
"2a01:4f9:c010:34cb::1"
];
no-tcp-relay = true;
extraConfig = "
cipher-list=\"HIGH\"
no-loopback-peers
no-multicast-peers
";
secure-stun = true;
cert = "/var/lib/acme/graven.dev/fullchain.pem";
pkey = "/var/lib/acme/graven.dev/key.pem";
min-port = 49152;
max-port = 49999;
};
}

16
unstable/config/hosts/wind/services/gitea.nix Normal file
View file

@ -0,0 +1,16 @@
{ ... }:
{
services.gitea = {
enable = true;
domain = "git.graven.dev";
rootUrl = "https://git.graven.dev";
enableUnixSocket = true;
cookieSecure = true;
appName = "Graven Gitea";
settings = { "ui" = { "DEFAULT_THEME" = "arc-green"; }; };
database = {
type = "postgres";
};
};
}

79
unstable/config/hosts/wind/services/nginx.nix Normal file
View file

@ -0,0 +1,79 @@
{
imports = [ ../../../common/services/nginx.nix ];
services.nginx.virtualHosts = {
"graven.dev" = {
useACMEHost = "graven.dev";
forceSSL = true;
locations."/".root = "/var/www/graven.dev/public";
locations."/_matrix".proxyPass = "http://127.0.0.1:8008";
locations."/_synapse".proxyPass = "http://127.0.0.1:8008";
locations."/.well-known/matrix/" = {
root = "/var/www/matrix/public";
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin "*";
add_header Strict-Transport-Security $hsts_header;
add_header Referrer-Policy "origin-when-cross-origin";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
'';
};
};
"rss.graven.dev" = {
useACMEHost = "graven.dev";
forceSSL = true;
};
"git.graven.dev" = {
useACMEHost = "graven.dev";
forceSSL = true;
locations."/".proxyPass = "http://unix:/run/gitea/gitea.sock:";
};
"vault.graven.dev" = {
forceSSL = true;
useACMEHost = "graven.dev";
locations."/" = {
proxyPass = "http://localhost:8812";
proxyWebsockets = true;
};
locations."/notifications/hub" = {
proxyPass = "http://localhost:3012";
proxyWebsockets = true;
};
locations."/notifications/hub/negotiate" = {
proxyPass = "http://localhost:8812";
proxyWebsockets = true;
};
};
"mta-sts.graven.dev" = {
forceSSL = true;
enableACME = true;
root = "/var/www/mta-sts/public";
};
"mta-sts.graven.se" = {
forceSSL = true;
enableACME = true;
root = "/var/www/mta-sts/public";
};
"mta-sts.nao.sh" = {
forceSSL = true;
enableACME = true;
root = "/var/www/mta-sts/public";
};
"mta-sts.amandag.net" = {
forceSSL = true;
enableACME = true;
root = "/var/www/mta-sts/public";
};
"mta-sts.queersin.space" = {
forceSSL = true;
enableACME = true;
root = "/var/www/mta-sts/public";
};
"mta-sts.anarkafem.dev" = {
forceSSL = true;
enableACME = true;
root = "/var/www/mta-sts/public";
};
};
}

27
unstable/config/hosts/wind/services/postgres.nix Normal file
View file

@ -0,0 +1,27 @@
{ pkgs, ... }:
{
services.postgresql = {
enable = true;
package = pkgs.postgresql_13;
initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE synapse;
CREATE DATABASE synapse WITH OWNER synapse
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C"
ENCODING = "UTF8";
'';
authentication = pkgs.lib.mkOverride 10 ''
local all all trust
host all all ::1/128 trust
'';
};
services.postgresqlBackup = {
enable = true;
location = "/var/lib/postgresql/backup";
databases = [ "synapse" ];
startAt = "02:30";
compression = "none";
};
}

47
unstable/config/hosts/wind/services/restic.nix Normal file
View file

@ -0,0 +1,47 @@
{ config, ... }:
{
services.restic.backups = {
"gitea" = {
paths = [ "/var/lib/gitea" ];
repository = "sftp:restic@despondos.nao.sh:/etheria/backup/wind/gitea";
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "02:15"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
user = "gitea";
};
"postgres" = {
paths = [ "/var/lib/postgresql/backup" ];
repository = "sftp:restic@despondos.nao.sh:/etheria/backup/wind/postgres";
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "03:00"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
user = "postgres";
};
"synapse" = {
paths = [ "/var/lib/matrix-synapse" ];
repository = "sftp:restic@despondos.nao.sh:/etheria/backup/wind/synapse";
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "03:30"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
user = "matrix-synapse";
};
"vaultwarden" = {
paths = [ "/var/lib/bitwarden_rs" ];
repository = "sftp:restic@despondos.nao.sh:/etheria/backup/wind/vaultwarden";
initialize = true;
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
timerConfig = { "OnCalendar" = "23:45"; };
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
user = "vaultwarden";
};
};
}

67
unstable/config/hosts/wind/services/synapse.nix Normal file
View file

@ -0,0 +1,67 @@
{ config, ... }:
{
services.matrix-synapse = {
enable = true;
server_name = "graven.dev";
enable_registration = false;
registration_shared_secret = builtins.toString config.secrets.files.synapse_registration_shared_secret.file;
turn_shared_secret = builtins.toString config.secrets.files.turn_shared_secret.file;
max_upload_size = "100M";
database_type = "psycopg2";
database_user = "synapse";
database_name = "synapse";
turn_uris = [
"turn:turn.graven.dev:3478?transport=udp"
"turn:turn.graven.dev:3478?transport=tcp"
"turn:turn.graven.dev:3479?transport=udp"
"turn:turn.graven.dev:3479?transport=tcp"
"turns:turn.graven.dev:5349?transport=udp"
"turns:turn.graven.dev:5349?transport=tcp"
"turns:turn.graven.dev:5350?transport=udp"
"turns:turn.graven.dev:5350?transport=tcp"
];
report_stats = true;
withJemalloc = true;
logConfig = ''
version: 1
formatters:
precise:
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
handlers:
console:
class: logging.StreamHandler
formatter: precise
loggers:
synapse.storage.SQL:
# beware: increasing this to DEBUG will make synapse log sensitive
# information such as access tokens.
level: WARN
root:
level: WARN
handlers: [console]
disable_existing_loggers: false
'';
listeners = [
{
port = 8008;
bind_address = "127.0.0.1";
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [ "client" "federation" ];
compress = false;
}
];
}
];
};
}

10
unstable/config/hosts/wind/services/ttrss.nix Normal file
View file

@ -0,0 +1,10 @@
{ config, ... }:
{
services.tt-rss = {
enable = true;
registration.enable = true;
virtualHost = "rss.graven.dev";
selfUrlPath = "https://rss.graven.dev";
};
}

25
unstable/config/hosts/wind/services/vaultwarden.nix Normal file
View file

@ -0,0 +1,25 @@
{ config, ... }:
{
services.vaultwarden = {
enable = true;
environmentFile = config.secrets.files.vaultwarden_env.file;
backupDir = "/var/lib/bitwarden_rs/backup";
config = {
domain = "https://vault.graven.dev";
signupsAllowed = false;
rocketPort = 8812;
ipHeader = "X-Real-IP";
websocketEnabled = true;
websocketAddress = "127.0.0.1";
websocketPort = "3012";
#dataDir = "/var/lib/vaultwarden";
smtpHost = "smtp.soverin.net";
smtpFrom = "vaultwarden@graven.dev";
smtpFromName = "Vaultwarden";
smtpPort = 465;
smtpSsl = true;
smtpExplicitTls = true;
smtpAuthMechanism = "Login";
};
};
}