nix-infra/hosts/bloodletting/configuration.nix

223 lines
5.9 KiB
Nix
Raw Normal View History

2023-12-17 20:05:44 +00:00
{ config, pkgs, lib, ... }: {
imports = [
./hardware-configuration.nix
2023-03-26 16:15:14 +00:00
../../common/users/julia.nix
../../common/fragments/bin.nix
../../common/fragments/fail2ban.nix
2023-04-13 11:11:32 +00:00
../../common/fragments/frq-friend.nix
../../common/fragments/grafana.nix
../../common/fragments/mastodon-ebooks.nix
2023-04-30 10:49:28 +00:00
../../common/fragments/mastodon.nix
2023-07-07 14:08:54 +00:00
../../common/fragments/matrix-ril100.nix
../../common/fragments/matterbridge.nix
2023-03-07 19:24:57 +00:00
../../common/fragments/minecraft.nix
../../common/fragments/nyandroid.nix
2023-04-30 10:49:28 +00:00
../../common/fragments/postgres.nix
../../common/fragments/prometheus_exporters.nix
2024-05-22 00:06:22 +00:00
../../common/fragments/prosody.nix
2023-03-06 19:43:10 +00:00
../../common/fragments/vsftpd.nix
../../common/home_manager/common.nix
];
nixpkgs.overlays = [
2023-04-30 10:49:28 +00:00
(final: prev: {
bin = final.callPackage ../../common/pkgs/bin.nix { };
agatha-mastodon =
final.callPackage ../../common/pkgs/mastodon/default.nix { };
})
];
# Bootloader.
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/sda";
boot.loader.grub.useOSProber = true;
networking.hostName = "bloodletting";
# Enable networking
networking.networkmanager.enable = true;
2023-08-14 12:05:13 +00:00
networking.interfaces.ens20 = {
ipv4.addresses = [{
address = "91.198.192.199";
prefixLength = 27;
}];
ipv6.addresses = [{
address = "2001:67c:b54:1::6";
prefixLength = 64;
}];
};
2023-03-18 18:29:55 +00:00
networking.defaultGateway = {
2023-08-14 12:05:13 +00:00
address = "91.198.192.193";
interface = "ens20";
};
networking.defaultGateway6 = {
address = "2001:67c:b54:1::1";
interface = "ens20";
2023-03-18 18:29:55 +00:00
};
# Open ports in the firewall.
networking.firewall = {
2023-03-18 22:15:53 +00:00
allowedTCPPorts = [ 20 21 22 80 443 990 ];
allowedTCPPortRanges = [{
from = 40000;
to = 40200;
}];
2023-06-01 17:07:54 +00:00
trustedInterfaces = [ "podman0" ];
};
virtualisation = {
podman = {
enable = true;
dockerCompat = true;
2023-06-01 17:07:54 +00:00
defaultNetwork.settings.dns_enabled = true;
};
oci-containers = { backend = "podman"; };
};
# SSL/TLS Certificates
security.acme.acceptTerms = true;
security.acme.defaults.email = "letsencrypt@technogothic.net";
security.acme.certs."technogothic.net" = {
domain = "*.technogothic.net";
2023-03-18 18:29:55 +00:00
extraDomainNames = [ "technogothic.net" ];
dnsProvider = "rfc2136";
credentialsFile = "/var/lib/secrets/rfc2136-technogothic-net";
2023-03-06 19:43:10 +00:00
group = "nginx";
};
2024-05-22 00:06:22 +00:00
security.acme.defaults.reloadServices = [ "nginx" "vsftpd" "prosody" ];
2023-03-18 18:29:55 +00:00
systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
2023-03-06 19:43:10 +00:00
# Nginx
services.nginx = {
enable = true;
statusPage = true;
# Use recommended settings
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
2023-12-17 20:05:44 +00:00
upstreams = {
"backend-mastodon-streaming" = {
servers = builtins.listToAttrs (map (i: {
name = "unix:/run/mastodon-streaming/streaming-${toString i}.socket";
value = { fail_timeout = "0"; };
}) (lib.range 1 config.services.mastodon.streamingProcesses));
extraConfig = ''
least_conn;
'';
};
};
2023-03-06 19:43:10 +00:00
virtualHosts."technogothic.net" = {
useACMEHost = "technogothic.net";
forceSSL = true;
root = pkgs.vampysite;
2023-03-18 18:29:55 +00:00
serverAliases = [ "agatha.technogothic.net" ];
2023-03-06 19:43:10 +00:00
locations."=/cv.pdf" = { alias = "/home/ftp/cv.pdf"; };
2023-04-30 10:49:28 +00:00
locations."=/.well-known/host-meta" = {
return = "301 https://fv.technogothic.net$request_uri";
};
locations."=/.well-known/webfinger" = {
return = "301 https://fv.technogothic.net$request_uri";
extraConfig = ''
add_header Access-Control-Allow-Origin '*';
'';
};
2023-03-06 19:43:10 +00:00
extraConfig = ''
error_page 404 /404.html;
'';
};
2023-03-18 18:29:55 +00:00
virtualHosts."www.technogothic.net" = {
useACMEHost = "technogothic.net";
forceSSL = true;
globalRedirect = "technogothic.net";
};
2023-03-06 19:43:10 +00:00
virtualHosts."grafana.technogothic.net" = {
useACMEHost = "technogothic.net";
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:2342";
proxyWebsockets = true;
};
};
virtualHosts."thermalpaste.technogothic.net" = {
useACMEHost = "technogothic.net";
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:6162";
proxyWebsockets = true;
2023-04-30 10:49:28 +00:00
extraConfig = "client_max_body_size ${
toString config.services.bin.textUploadLimit
}M;";
2023-03-06 19:43:10 +00:00
};
};
2023-03-18 18:29:55 +00:00
virtualHosts."ftp.technogothic.net" = {
useACMEHost = "technogothic.net";
forceSSL = true;
root = "/home/ftp";
locations."/" = { extraConfig = "autoindex on;"; };
};
2023-04-30 10:49:28 +00:00
virtualHosts."fv.technogothic.net" = {
useACMEHost = "technogothic.net";
forceSSL = true;
root = "${config.services.mastodon.package}/public/";
locations."/system/".alias = "/var/lib/mastodon/public-system/";
locations."/" = { tryFiles = "$uri @proxy"; };
locations."@proxy" = {
proxyPass = "http://unix:/run/mastodon-web/web.socket";
proxyWebsockets = true;
};
2023-12-17 20:05:44 +00:00
locations."^~ /api/v1/streaming/" = {
proxyPass = "http://backend-mastodon-streaming/";
2023-04-30 10:49:28 +00:00
proxyWebsockets = true;
2023-12-17 20:05:44 +00:00
priority = 2300;
extraConfig = ''
proxy_buffering off;
proxy_redirect off;
tcp_nodelay on;
'';
2023-04-30 10:49:28 +00:00
};
2023-06-11 20:28:27 +00:00
extraConfig = "client_max_body_size 64M;";
2023-04-30 10:49:28 +00:00
};
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.11"; # Did you read the comment?
}