tlaternet-server/etc/nixos/configuration.nix

126 lines
2.8 KiB
Nix
Raw Normal View History

2019-11-26 23:05:21 +00:00
{ config, pkgs, ... }:
2019-11-23 23:55:26 +00:00
{
imports = [
./hardware-configuration.nix
./linode.nix
];
networking = {
hostName = "tlater.net";
# useDHCP is deprecated
useDHCP = false;
interfaces.eth0.useDHCP = true;
2019-11-26 23:06:50 +00:00
firewall = {
enable = true;
allowedTCPPorts = [
80
443
2222
3022
2019-11-26 23:06:50 +00:00
];
};
2019-11-23 23:55:26 +00:00
};
time.timeZone = "Europe/London";
users.users = {
tlater = {
isNormalUser = true;
extraGroups = [ "wheel" "docker" ];
openssh.authorizedKeys.keyFiles = [ ./keys/tlater.pub ];
2019-11-23 23:55:26 +00:00
};
lauren = {
isNormalUser = true;
openssh.authorizedKeys.keyFiles = [ ./keys/lauren.pub ];
2019-11-23 23:55:26 +00:00
};
};
environment.systemPackages = with pkgs; [
];
services = {
openssh = {
enable = true;
allowSFTP = false;
passwordAuthentication = false;
permitRootLogin = "no";
ports = [ 2222 ];
startWhenNeeded = true;
};
};
2019-11-26 23:06:50 +00:00
virtualisation.docker = {
enable = true;
autoPrune.enable = true;
};
docker-containers = {
## nginx proxy
2019-11-26 23:06:50 +00:00
nginx-proxy = {
image = "jwilder/nginx-proxy:alpine";
ports = [
"80:80"
"443:443"
];
volumes = [
# So that we can watch new containers come up
"/var/run/docker.sock:/tmp/docker.sock:ro"
# So that we can access generated certs
"nginx-certs:/etc/nginx/certs:ro"
# So that we can write challenge files for letsencrypt auth
"nginx-challenges:/usr/share/nginx/html"
# So that we can modify config on-the-fly to set up challenge
# files
"nginx-conf:/etc/nginx/vhost.d"
];
environment = {
DHPARAM_GENERATION = "false"; # Provided by nginx-proxy-letsencrypt
};
extraDockerOptions = [
"--network=webproxy"
];
2019-11-26 23:06:50 +00:00
};
nginx-proxy-letsencrypt = {
image = "jrcs/letsencrypt-nginx-proxy-companion";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock:ro"
2019-11-26 23:06:50 +00:00
"nginx-certs:/etc/nginx/certs"
];
environment = {
DEFAULT_EMAIL = "tm@tlater.net";
};
extraDockerOptions = [
"--volumes-from" "docker-nginx-proxy.service"
];
};
## GitLab
gitlab = {
image = "gitlab/gitlab-ce:latest";
ports = [
"3022:22"
];
volumes = [
"gitlab-data:/var/opt/gitlab:Z"
"gitlab-logs:/var/log/gitlab:Z"
"gitlab-config:/etc/gitlab:Z"
];
environment = {
VIRTUAL_HOST = "gitlab.tlater.net";
LETSENCRYPT_HOST = "gitlab.tlater.net";
GITLAB_OMNIBUS_CONFIG = builtins.replaceStrings ["\n"] [""] (builtins.readFile ./configs/gitlab.rb);
};
extraDockerOptions = [
"--network=webproxy"
];
2019-11-26 23:06:50 +00:00
};
};
2019-11-23 23:55:26 +00:00
system.stateVersion = "19.09";
}