tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 9 Pull requests Releases Activity

treewide: Start using nixpkgs-fmt formatting

Browse source
This commit is contained in:
Tristan Daniël Maat 2024-06-28 20:12:55 +02:00
parent 501c3466bc
commit fd138d45e6
Signed by: tlater
GPG key ID: 49670FD774E43268
29 changed files with 812 additions and 767 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
configuration/default.nix
View file

@ -1,10 +1,9 @@
{
config,
pkgs,
lib,
modulesPath,
flake-inputs,
...
{ config
, pkgs
, lib
, modulesPath
, flake-inputs
, ...
}: {
imports = [
flake-inputs.disko.nixosModules.disko
@ -47,15 +46,15 @@
'';
# Enable remote builds from tlater
settings.trusted-users = ["@wheel"];
settings.trusted-users = [ "@wheel" ];
};
nixpkgs.config.allowUnfreePredicate = pkg:
builtins.elem (lib.getName pkg) ["steam-original" "steam-runtime" "steam-run" "steamcmd"];
builtins.elem (lib.getName pkg) [ "steam-original" "steam-runtime" "steam-run" "steamcmd" ];
# Optimization for minecraft servers, see:
# https://bugs.mojang.com/browse/MC-183518
boot.kernelParams = ["highres=off" "nohz=off"];
boot.kernelParams = [ "highres=off" "nohz=off" ];
networking = {
usePredictableInterfaceNames = false;
@ -106,15 +105,15 @@
users.users.tlater = {
isNormalUser = true;
extraGroups = ["wheel"];
openssh.authorizedKeys.keyFiles = [../keys/tlater.pub];
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keyFiles = [ ../keys/tlater.pub ];
};
services = {
openssh = {
enable = true;
allowSFTP = false;
ports = [2222];
ports = [ 2222 ];
startWhenNeeded = true;
settings = {
@ -133,14 +132,14 @@
pam = {
sshAgentAuth = {
enable = true;
authorizedKeysFiles = ["/etc/ssh/authorized_keys.d/%u"];
authorizedKeysFiles = [ "/etc/ssh/authorized_keys.d/%u" ];
};
services.sudo.sshAgentAuth = true;
};
};
# Remove some unneeded packages
environment.defaultPackages = [];
environment.defaultPackages = [ ];
system.stateVersion = "20.09";
}

2
configuration/hardware-specific/hetzner/default.nix
View file

@ -8,7 +8,7 @@
# disables it by default.
#
# TODO(tlater): See if would be useful for anything?
boot.kernelParams = ["nosgx"];
boot.kernelParams = [ "nosgx" ];
networking.hostName = "hetzner-1";
services.nginx.domain = "tlater.net";

14
configuration/hardware-specific/hetzner/disko.nix
View file

@ -1,5 +1,6 @@
{
disko.devices.disk = let
disko.devices.disk =
let
bootPartition = {
size = "1M";
type = "EF02";
@ -18,8 +19,9 @@
};
};
mountOptions = ["compress=zstd" "noatime"];
in {
mountOptions = [ "compress=zstd" "noatime" ];
in
{
sda = {
type = "disk";
device = "/dev/sda";
@ -52,9 +54,9 @@
type = "btrfs";
# Hack to get multi-device btrfs going
# See https://github.com/nix-community/disko/issues/99
extraArgs = ["-d" "raid1" "-m" "raid1" "--runtime-features" "quota" "/dev/sda3"];
extraArgs = [ "-d" "raid1" "-m" "raid1" "--runtime-features" "quota" "/dev/sda3" ];
subvolumes = {
"/volume" = {};
"/volume" = { };
"/volume/root" = {
inherit mountOptions;
mountpoint = "/";
@ -71,7 +73,7 @@
inherit mountOptions;
mountpoint = "/nix";
};
"/snapshots" = {};
"/snapshots" = { };
};
};
};

4
configuration/hardware-specific/vm.nix
View file

@ -1,8 +1,8 @@
{lib, ...}: {
{ lib, ... }: {
users.users.tlater.password = "insecure";
# Disable graphical tty so -curses works
boot.kernelParams = ["nomodeset"];
boot.kernelParams = [ "nomodeset" ];
networking.hostName = "testvm";
# Sets the base domain for nginx to a local domain so that we can

15
configuration/nginx.nix
View file

@ -1,7 +1,6 @@
{
config,
lib,
...
{ config
, lib
, ...
}: {
services.nginx = {
enable = true;
@ -27,7 +26,8 @@
# Override the default, just keep fewer logs
nginx.rotate = 6;
}
// lib.mapAttrs' (virtualHost: _:
// lib.mapAttrs'
(virtualHost: _:
lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
frequency = "daily";
rotate = 2;
@ -39,7 +39,8 @@
config.services.nginx.virtualHosts;
systemd.tmpfiles.rules =
lib.mapAttrsToList (
lib.mapAttrsToList
(
virtualHost: _:
#
"d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"
@ -51,7 +52,7 @@
acceptTerms = true;
certs."tlater.net" = {
extraDomainNames = ["*.tlater.net"];
extraDomainNames = [ "*.tlater.net" ];
dnsProvider = "hetzner";
group = "nginx";
credentialFiles."HETZNER_API_KEY_FILE" = config.sops.secrets."hetzner-api".path;

17
configuration/services/afvalcalendar.nix
View file

@ -1,12 +1,11 @@
{
pkgs,
config,
...
{ pkgs
, config
, ...
}: {
systemd.services.afvalcalendar = {
description = "Enschede afvalcalendar -> ical converter";
wantedBy = ["multi-user.target"];
after = ["network.target"];
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
script = ''
${pkgs.local.afvalcalendar}/bin/afvalcalendar > /srv/afvalcalendar/afvalcalendar.ical
@ -26,14 +25,14 @@
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
Umask = 0002;
SupplementaryGroups = "afvalcalendar-hosting";
@ -50,7 +49,7 @@
root = "/srv/afvalcalendar";
};
users.groups.afvalcalendar-hosting = {};
users.groups.afvalcalendar-hosting = { };
systemd.tmpfiles.settings."10-afvalcalendar" = {
"/srv/afvalcalendar".d = {
user = "nginx";

46
configuration/services/backups.nix
View file

@ -1,9 +1,9 @@
{
config,
pkgs,
lib,
...
}: let
{ config
, pkgs
, lib
, ...
}:
let
inherit (lib) types optional singleton;
mkShutdownScript = service:
pkgs.writeShellScript "backup-${service}-shutdown" ''
@ -42,16 +42,16 @@
RESTIC_REPOSITORY = "rclone:storagebox:backups";
RCLONE_CONFIG = rcloneConfig;
};
in {
in
{
options = {
services.backups = lib.mkOption {
description = lib.mdDoc ''
Configure restic backups with a specific tag.
'';
type = types.attrsOf (types.submodule ({
config,
name,
...
type = types.attrsOf (types.submodule ({ config
, name
, ...
}: {
options = {
user = lib.mkOption {
@ -76,7 +76,7 @@ in {
preparation = {
packages = lib.mkOption {
type = types.listOf types.package;
default = [];
default = [ ];
description = ''
The list of packages to make available in the
preparation script.
@ -97,7 +97,7 @@ in {
cleanup = {
packages = lib.mkOption {
type = types.listOf types.package;
default = [];
default = [ ];
description = ''
The list of packages to make available in the
cleanup script.
@ -116,7 +116,7 @@ in {
};
pauseServices = lib.mkOption {
type = types.listOf types.str;
default = [];
default = [ ];
description = ''
The systemd services that need to be shut down before
the backup can run. Services will be restarted after the
@ -131,7 +131,7 @@ in {
};
};
config = lib.mkIf (config.services.backups != {}) {
config = lib.mkIf (config.services.backups != { }) {
systemd.services =
{
restic-prune = {
@ -164,7 +164,8 @@ in {
};
};
}
// lib.mapAttrs' (name: backup:
// lib.mapAttrs'
(name: backup:
lib.nameValuePair "backup-${name}" {
# Don't want to restart mid-backup
restartIfChanged = false;
@ -196,12 +197,12 @@ in {
PrivateTmp = true;
ExecStart = [
(lib.concatStringsSep " " (["${pkgs.restic}/bin/restic" "backup" "--tag" name] ++ backup.paths))
(lib.concatStringsSep " " ([ "${pkgs.restic}/bin/restic" "backup" "--tag" name ] ++ backup.paths))
];
ExecStartPre =
map (service: "+${mkShutdownScript service}") backup.pauseServices
++ singleton (writeScript "backup-${name}-repo-init" [] ''
++ singleton (writeScript "backup-${name}-repo-init" [ ] ''
restic snapshots || restic init
'')
++ optional (backup.preparation.text != null)
@ -219,16 +220,17 @@ in {
systemd.timers =
{
restic-prune = {
wantedBy = ["timers.target"];
wantedBy = [ "timers.target" ];
timerConfig.OnCalendar = "Thursday 03:00:00 UTC";
# Don't make this persistent, in case the server was offline
# for a while. This job cannot run at the same time as any
# of the backup jobs.
};
}
// lib.mapAttrs' (name: backup:
// lib.mapAttrs'
(name: backup:
lib.nameValuePair "backup-${name}" {
wantedBy = ["timers.target"];
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "Wednesday 02:30:00 UTC";
RandomizedDelaySec = "1h";
@ -245,7 +247,7 @@ in {
group = "backup";
isSystemUser = true;
};
groups.backup = {};
groups.backup = { };
};
};
}

7
configuration/services/battery-manager.nix
View file

@ -1,7 +1,6 @@
{
config,
flake-inputs,
...
{ config
, flake-inputs
, ...
}: {
imports = [
flake-inputs.sonnenshift.nixosModules.default

39
configuration/services/conduit.nix
View file

@ -1,15 +1,16 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs
, config
, lib
, ...
}:
let
inherit (lib.strings) concatMapStringsSep;
cfg = config.services.matrix-conduit;
domain = "matrix.${config.services.nginx.domain}";
turn-realm = "turn.${config.services.nginx.domain}";
in {
in
{
services.matrix-conduit = {
enable = true;
settings.global = {
@ -17,10 +18,12 @@ in {
server_name = domain;
database_backend = "rocksdb";
turn_uris = let
turn_uris =
let
address = "${config.services.coturn.realm}:${toString config.services.coturn.listening-port}";
tls-address = "${config.services.coturn.realm}:${toString config.services.coturn.tls-listening-port}";
in [
in
[
"turn:${address}?transport=udp"
"turn:${address}?transport=tcp"
"turns:${tls-address}?transport=udp"
@ -29,7 +32,8 @@ in {
};
};
systemd.services.heisenbridge = let
systemd.services.heisenbridge =
let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
registrationFile = builtins.toFile "heisenbridge-registration.yaml" (builtins.toJSON {
id = "heisenbridge";
@ -49,8 +53,8 @@ in {
exclusive = true;
}
];
aliases = [];
rooms = [];
aliases = [ ];
rooms = [ ];
};
});
@ -73,10 +77,11 @@ in {
--owner @tlater:matrix.tlater.net \
'http://localhost:${toString cfg.settings.global.port}'
'';
in {
in
{
description = "Matrix<->IRC bridge";
wantedBy = ["multi-user.target"];
after = ["conduit.service"];
wantedBy = [ "multi-user.target" ];
after = [ "conduit.service" ];
serviceConfig = {
Type = "simple";
@ -97,7 +102,7 @@ in {
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = ["AF_INET AF_INET6"];
RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
LockPersonality = true;
RestrictRealtime = true;
ProtectProc = "invisible";
@ -249,6 +254,6 @@ in {
];
# Other services store their data in conduit, so no other services
# need to be shut down currently.
pauseServices = ["conduit.service"];
pauseServices = [ "conduit.service" ];
};
}

6
configuration/services/fail2ban.nix
View file

@ -1,7 +1,7 @@
{pkgs, ...}: {
{ pkgs, ... }: {
services.fail2ban = {
enable = true;
extraPackages = [pkgs.ipset];
extraPackages = [ pkgs.ipset ];
banaction = "iptables-ipset-proto6-allports";
bantime-increment.enable = true;
@ -21,7 +21,7 @@
};
# Allow metrics services to connect to the socket as well
users.groups.fail2ban = {};
users.groups.fail2ban = { };
systemd.services.fail2ban.serviceConfig = {
ExecStartPost =
"+"

27
configuration/services/foundryvtt.nix
View file

@ -1,12 +1,13 @@
{
lib,
config,
flake-inputs,
...
}: let
{ lib
, config
, flake-inputs
, ...
}:
let
domain = "foundryvtt.${config.services.nginx.domain}";
in {
imports = [flake-inputs.foundryvtt.nixosModules.foundryvtt];
in
{
imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ];
services.foundryvtt = {
enable = true;
@ -18,11 +19,13 @@ in {
# Want to start it manually when I need it, not have it constantly
# running
systemd.services.foundryvtt.wantedBy = lib.mkForce [];
systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
services.nginx.virtualHosts."${domain}" = let
services.nginx.virtualHosts."${domain}" =
let
inherit (config.services.foundryvtt) port;
in {
in
{
forceSSL = true;
useACMEHost = "tlater.net";
enableHSTS = true;
@ -38,6 +41,6 @@ in {
paths = [
config.services.foundryvtt.dataDir
];
pauseServices = ["foundryvtt.service"];
pauseServices = [ "foundryvtt.service" ];
};
}

33
configuration/services/gitea.nix
View file

@ -1,11 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs
, config
, lib
, ...
}:
let
domain = "gitea.${config.services.nginx.domain}";
in {
in
{
services.forgejo = {
enable = true;
database.type = "postgres";
@ -27,19 +28,23 @@ in {
};
};
systemd.services.forgejo.serviceConfig.ExecStartPre = let
systemd.services.forgejo.serviceConfig.ExecStartPre =
let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."forgejo/metrics-token".path;
runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
in [
in
[
"+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
];
# Set up SSL
services.nginx.virtualHosts."${domain}" = let
services.nginx.virtualHosts."${domain}" =
let
httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
httpPort = config.services.forgejo.settings.server.HTTP_PORT;
in {
in
{
forceSSL = true;
useACMEHost = "tlater.net";
enableHSTS = true;
@ -83,13 +88,13 @@ in {
# Conf is backed up via nix
];
preparation = {
packages = [config.services.postgresql.package];
packages = [ config.services.postgresql.package ];
text = "pg_dump ${config.services.forgejo.database.name} --file=/var/lib/forgejo/forgejo-db.sql";
};
cleanup = {
packages = [pkgs.coreutils];
packages = [ pkgs.coreutils ];
text = "rm /var/lib/forgejo/forgejo-db.sql";
};
pauseServices = ["forgejo.service"];
pauseServices = [ "forgejo.service" ];
};
}

36
configuration/services/metrics/exporters.nix
View file

@ -1,23 +1,26 @@
{ config
, pkgs
, lib
, ...
}:
let
yaml = pkgs.formats.yaml { };
in
{
config,
pkgs,
lib,
...
}: let
yaml = pkgs.formats.yaml {};
in {
services.prometheus = {
exporters = {
# Periodically check domain registration status
domain = {
enable = true;
listenAddress = "127.0.0.1";
extraFlags = let
extraFlags =
let
conf.domains = [
"tlater.net"
"tlater.com"
];
in [
in
[
"--config=${yaml.generate "domains.yml" conf}"
];
};
@ -49,7 +52,8 @@ in {
group = "nginx";
settings.namespaces =
lib.mapAttrsToList (name: virtualHost: {
lib.mapAttrsToList
(name: virtualHost: {
inherit name;
metrics_override.prefix = "nginxlog";
namespace_label = "vhost";
@ -71,16 +75,18 @@ in {
};
extraExporters = {
fail2ban = let
fail2ban =
let
cfg = config.services.prometheus.extraExporters.fail2ban;
in {
in
{
port = 9191;
serviceOpts = {
after = ["fail2ban.service"];
requires = ["fail2ban.service"];
after = [ "fail2ban.service" ];
requires = [ "fail2ban.service" ];
serviceConfig = {
Group = "fail2ban";
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
ExecStart = lib.concatStringsSep " " [
"${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
"--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"

6
configuration/services/metrics/grafana.nix
View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
domain = "metrics.${config.services.nginx.domain}";
in {
in
{
services.grafana = {
enable = true;
settings = {

87
configuration/services/metrics/options.nix
View file

@ -1,12 +1,13 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs
, config
, lib
, ...
}:
let
inherit (lib) types mkOption mkDefault;
yaml = pkgs.formats.yaml {};
in {
yaml = pkgs.formats.yaml { };
in
{
options = {
services.prometheus = {
extraExporters = mkOption {
@ -31,10 +32,9 @@ in {
};
services.victoriametrics.scrapeConfigs = mkOption {
type = types.attrsOf (types.submodule ({
name,
self,
...
type = types.attrsOf (types.submodule ({ name
, self
, ...
}: {
options = {
job_name = mkOption {
@ -47,7 +47,7 @@ in {
description = ''
Other settings to set for this scrape config.
'';
default = {};
default = { };
};
targets = mkOption {
@ -57,11 +57,11 @@ in {
Shortcut for `static_configs = lib.singleton {targets = [<targets>];}`
'';
default = [];
default = [ ];
};
static_configs = mkOption {
default = [];
default = [ ];
type = types.listOf (types.submodule {
options = {
targets = mkOption {
@ -77,7 +77,7 @@ in {
description = lib.mdDoc ''
Labels to apply to all targets defined for this static config.
'';
default = {};
default = { };
};
};
});
@ -89,20 +89,21 @@ in {
config = {
systemd.services = lib.mkMerge [
(lib.mapAttrs' (name: exporter:
(lib.mapAttrs'
(name: exporter:
lib.nameValuePair "prometheus-${name}-exporter" (lib.mkMerge [
{
# Shamelessly copied from upstream because the upstream
# module is an intractable mess
wantedBy = ["multi-user.target"];
after = ["network.target"];
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig.Restart = mkDefault "always";
serviceConfig.PrivateTmp = mkDefault true;
serviceConfig.WorkingDirectory = mkDefault /tmp;
serviceConfig.DynamicUser = mkDefault true;
# Hardening
serviceConfig.CapabilityBoundingSet = mkDefault [""];
serviceConfig.DeviceAllow = [""];
serviceConfig.CapabilityBoundingSet = mkDefault [ "" ];
serviceConfig.DeviceAllow = [ "" ];
serviceConfig.LockPersonality = true;
serviceConfig.MemoryDenyWriteExecute = true;
serviceConfig.NoNewPrivileges = true;
@ -116,7 +117,7 @@ in {
serviceConfig.ProtectKernelTunables = true;
serviceConfig.ProtectSystem = mkDefault "strict";
serviceConfig.RemoveIPC = true;
serviceConfig.RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
serviceConfig.RestrictNamespaces = true;
serviceConfig.RestrictRealtime = true;
serviceConfig.RestrictSUIDSGID = true;
@ -128,25 +129,29 @@ in {
config.services.prometheus.extraExporters)
{
vmagent-scrape-exporters = let
vmagent-scrape-exporters =
let
listenAddress = config.services.victoriametrics.listenAddress;
vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
promscrape = yaml.generate "prometheus.yml" {
scrape_configs = lib.mapAttrsToList (_: scrape:
lib.recursiveUpdate {
scrape_configs = lib.mapAttrsToList
(_: scrape:
lib.recursiveUpdate
{
inherit (scrape) job_name;
static_configs =
scrape.static_configs
++ lib.optional (scrape.targets != []) {targets = scrape.targets;};
++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; };
}
scrape.extraSettings)
config.services.victoriametrics.scrapeConfigs;
};
in {
in
{
enable = true;
path = [pkgs.victoriametrics];
wantedBy = ["multi-user.target"];
after = ["network.target" "victoriametrics.service"];
path = [ pkgs.victoriametrics ];
wantedBy = [ "multi-user.target" ];
after = [ "network.target" "victoriametrics.service" ];
serviceConfig = {
ExecStart = [
(lib.concatStringsSep " " [
@ -160,8 +165,8 @@ in {
DynamicUser = true;
RuntimeDirectory = "vmagent";
CapabilityBoundingSet = [""];
DeviceAllow = [""];
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
@ -175,7 +180,7 @@ in {
ProtectKernelTunables = true;
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
@ -186,18 +191,22 @@ in {
}
];
users.groups.metrics = {};
users.groups.metrics = { };
services.victoriametrics.scrapeConfigs = let
services.victoriametrics.scrapeConfigs =
let
allExporters =
lib.mapAttrs (name: exporter: {
lib.mapAttrs
(name: exporter: {
inherit (exporter) listenAddress port;
}) ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
})
((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
config.services.prometheus.exporters)
// config.services.prometheus.extraExporters);
in
lib.mapAttrs (_: exporter: {
targets = ["${exporter.listenAddress}:${toString exporter.port}"];
lib.mapAttrs
(_: exporter: {
targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
})
allExporters;
};

6
configuration/services/metrics/victoriametrics.nix
View file

@ -1,4 +1,4 @@
{config, ...}: {
{ config, ... }: {
config.services.victoriametrics = {
enable = true;
extraOptions = [
@ -7,10 +7,10 @@
scrapeConfigs = {
forgejo = {
targets = ["127.0.0.1:${toString config.services.forgejo.settings.server.HTTP_PORT}"];
targets = [ "127.0.0.1:${toString config.services.forgejo.settings.server.HTTP_PORT}" ];
extraSettings.authorization.credentials_file = config.sops.secrets."forgejo/metrics-token".path;
};
coturn.targets = ["127.0.0.1:9641"];
coturn.targets = [ "127.0.0.1:9641" ];
};
};
}

15
configuration/services/nextcloud.nix
View file

@ -1,14 +1,15 @@
{
pkgs,
config,
...
}: let
{ pkgs
, config
, ...
}:
let
# Update pending on rewrite of nextcloud news, though there is an
# alpha to switch to if it becomes necessary:
# https://github.com/nextcloud/news/issues/2610
nextcloud = pkgs.nextcloud27;
hostName = "nextcloud.${config.services.nginx.domain}";
in {
in
{
services.nextcloud = {
inherit hostName;
@ -42,7 +43,7 @@ in {
};
# Ensure that this service doesn't start before postgres is ready
systemd.services.nextcloud-setup.after = ["postgresql.service"];
systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
# Set up SSL
services.nginx.virtualHosts."${hostName}" = {

2
configuration/services/postgres.nix
View file

@ -1,4 +1,4 @@
{pkgs, ...}: {
{ pkgs, ... }: {
services.postgresql = {
package = pkgs.postgresql_14;
enable = true;

19
configuration/services/starbound.nix
View file

@ -1,16 +1,17 @@
{
pkgs,
lib,
...
}: let
{ pkgs
, lib
, ...
}:
let
inherit (lib) concatStringsSep;
in {
in
{
# Sadly, steam-run requires some X libs
environment.noXlibs = false;
systemd.services.starbound = {
description = "Starbound";
after = ["network.target"];
after = [ "network.target" ];
serviceConfig = {
ExecStart = "${pkgs.local.starbound}/bin/launch-starbound ${./configs/starbound.json}";
@ -67,7 +68,7 @@ in {
# Game servers shouldn't use cgroups themselves either
ProtectControlGroups = true;
# Most game servers will never need other socket types
RestrictAddressFamilies = ["AF_UNIX AF_INET AF_INET6"];
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
# Also a no-brainer, no game server should ever need this
LockPersonality = true;
# Some game servers will probably try to set this, but they
@ -116,6 +117,6 @@ in {
paths = [
"/var/lib/private/starbound/storage/universe/"
];
pauseServices = ["starbound.service"];
pauseServices = [ "starbound.service" ];
};
}

14
configuration/services/webserver.nix
View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
domain = config.services.nginx.domain;
in {
in
{
services.tlaternet-webserver = {
enable = true;
listen = {
@ -10,10 +12,12 @@ in {
};
# Set up SSL
services.nginx.virtualHosts."${domain}" = let
services.nginx.virtualHosts."${domain}" =
let
inherit (config.services.tlaternet-webserver.listen) addr port;
in {
serverAliases = ["www.${domain}"];
in
{
serverAliases = [ "www.${domain}" ];
forceSSL = true;
useACMEHost = "tlater.net";

6
configuration/services/wireguard.nix
View file

@ -1,4 +1,4 @@
{config, ...}: {
{ config, ... }: {
# iptables needs to permit forwarding from wg0 to wg0
networking.firewall.extraCommands = ''
iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
@ -26,7 +26,7 @@
{
# yui
wireguardPeerConfig = {
AllowedIPs = ["10.45.249.2/32"];
AllowedIPs = [ "10.45.249.2/32" ];
PublicKey = "5mlnqEVJWks5OqgeFA2bLIrvST9TlCE81Btl+j4myz0=";
};
}
@ -34,7 +34,7 @@
{
# yuanyuan
wireguardPeerConfig = {
AllowedIPs = ["10.45.249.10/32"];
AllowedIPs = [ "10.45.249.10/32" ];
PublicKey = "0UsFE2atz/O5P3OKQ8UHyyyGQNJbp1MeIWUJLuoerwE=";
};
}

8
configuration/sops.nix
View file

@ -31,8 +31,8 @@
};
# Heisenbridge
"heisenbridge/as-token" = {};
"heisenbridge/hs-token" = {};
"heisenbridge/as-token" = { };
"heisenbridge/hs-token" = { };
"hetzner-api" = {
owner = "acme";
@ -62,10 +62,10 @@
};
# Steam
"steam/tlater" = {};
"steam/tlater" = { };
# Turn
"turn/env" = {};
"turn/env" = { };
"turn/secret" = {
owner = "turnserver";
};

44
flake.nix
View file

@ -32,17 +32,19 @@
};
};
outputs = {
self,
nixpkgs,
sops-nix,
nvfetcher,
deploy-rs,
...
} @ inputs: let
outputs =
{ self
, nixpkgs
, sops-nix
, nvfetcher
, deploy-rs
, ...
} @ inputs:
let
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
in {
in
{
##################
# Configurations #
##################
@ -72,7 +74,7 @@
};
sshUser = "tlater";
sshOpts = ["-p" "2222" "-o" "ForwardAgent=yes"];
sshOpts = [ "-p" "2222" "-o" "ForwardAgent=yes" ];
};
};
@ -89,7 +91,8 @@
run-vm = {
type = "app";
program = let
program =
let
vm = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs.flake-inputs = inputs;
@ -102,32 +105,31 @@
in
(pkgs.writeShellScript "" ''
${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
'')
.outPath;
'').outPath;
};
update-pkgs = {
type = "app";
program = let
program =
let
nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
in
(pkgs.writeShellScript "update-pkgs" ''
cd "$(git rev-parse --show-toplevel)/pkgs"
${nvfetcher-bin} -o _sources_pkgs -c nvfetcher.toml
'')
.outPath;
'').outPath;
};
update-nextcloud-apps = {
type = "app";
program = let
program =
let
nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
in
(pkgs.writeShellScript "update-nextcloud-apps" ''
cd "$(git rev-parse --show-toplevel)/pkgs"
${nvfetcher-bin} -o _sources_nextcloud -c nextcloud-apps.toml
'')
.outPath;
'').outPath;
};
};
@ -135,7 +137,7 @@
# Development environment #
###########################
devShells.${system}.default = nixpkgs.legacyPackages.${system}.mkShell {
sopsPGPKeyDirs = ["./keys/hosts/" "./keys/users/"];
sopsPGPKeyDirs = [ "./keys/hosts/" "./keys/users/" ];
nativeBuildInputs = [
sops-nix.packages.${system}.sops-import-keys-hook
];
@ -144,6 +146,8 @@
sops-nix.packages.${system}.sops-init-gpg-key
deploy-rs.packages.${system}.default
nixpkgs-fmt
cargo
clippy
rustc

26
modules/nginxExtensions.nix
View file

@ -1,8 +1,7 @@
{
config,
pkgs,
lib,
...
{ config
, pkgs
, lib
, ...
}: {
options = {
services.nginx.domain = lib.mkOption {
@ -10,11 +9,12 @@
description = "The base domain name to append to virtual domain names";
};
services.nginx.virtualHosts = let
extraVirtualHostOptions = {
name,
config,
...
services.nginx.virtualHosts =
let
extraVirtualHostOptions =
{ name
, config
, ...
}: {
options = {
enableHSTS = lib.mkEnableOption "Enable HSTS";
@ -47,10 +47,12 @@
config = {
# Don't attempt to run acme if the domain name is not tlater.net
systemd.services = let
systemd.services =
let
confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
in
lib.mapAttrs' (cert: _:
lib.mapAttrs'
(cert: _:
lib.nameValuePair "acme-${cert}" {
serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
})

7
pkgs/afvalcalendar/default.nix
View file

@ -1,7 +1,6 @@
{
pkgs,
rustPlatform,
...
{ pkgs
, rustPlatform
, ...
}:
rustPlatform.buildRustPackage {
pname = "afvalcalendar";

23
pkgs/default.nix
View file

@ -1,22 +1,23 @@
{
pkgs,
lib,
}: let
{ pkgs
, lib
,
}:
let
inherit (builtins) fromJSON mapAttrs readFile;
inherit (pkgs) callPackage;
in
{
starbound = callPackage ./starbound {};
{
starbound = callPackage ./starbound { };
prometheus-fail2ban-exporter = callPackage ./prometheus/fail2ban-exporter.nix {
sources = pkgs.callPackage ./_sources_pkgs/generated.nix {};
sources = pkgs.callPackage ./_sources_pkgs/generated.nix { };
};
afvalcalendar = callPackage ./afvalcalendar {};
}
afvalcalendar = callPackage ./afvalcalendar { };
}
// (
# Add nextcloud apps
let
mkNextcloudApp = pkgs.callPackage ./mkNextcloudApp.nix {};
mkNextcloudApp = pkgs.callPackage ./mkNextcloudApp.nix { };
sources = fromJSON (readFile ./_sources_nextcloud/generated.json);
in
mapAttrs (_: source: mkNextcloudApp source) sources
)
)

6
pkgs/mkNextcloudApp.nix
View file

@ -1,6 +1,6 @@
{
fetchNextcloudApp,
lib,
{ fetchNextcloudApp
, lib
,
}: source:
fetchNextcloudApp {
url = source.src.url;

6
pkgs/prometheus/fail2ban-exporter.nix
View file

@ -1,6 +1,6 @@
{
buildGoModule,
sources,
{ buildGoModule
, sources
,
}:
buildGoModule {
inherit (sources.prometheus-fail2ban-exporter) pname src version;

25
pkgs/starbound/default.nix
View file

@ -1,22 +1,23 @@
{
stdenv,
lib,
makeWrapper,
patchelf,
steamPackages,
replace-secret,
}: let
{ stdenv
, lib
, makeWrapper
, patchelf
, steamPackages
, replace-secret
,
}:
let
# Use the directory in which starbound is installed so steamcmd
# doesn't have to be reinstalled constantly (we're using DynamicUser
# with StateDirectory to persist this).
steamcmd = steamPackages.steamcmd.override {
steamRoot = "/var/lib/starbound/.steamcmd";
};
wrapperPath = lib.makeBinPath [patchelf steamcmd replace-secret];
wrapperPath = lib.makeBinPath [ patchelf steamcmd replace-secret ];
in
stdenv.mkDerivation {
stdenv.mkDerivation {
name = "starbound-update-script";
nativeBuildInputs = [makeWrapper];
nativeBuildInputs = [ makeWrapper ];
dontUnpack = true;
patchPhase = ''
interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
@ -31,4 +32,4 @@ in
wrapProgram $out/bin/launch-starbound \
--prefix PATH : "${wrapperPath}"
'';
}
}