tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 9 Pull requests Releases Activity

Use nixpkgs-fmt for formatting #114

Manually merged
tlater merged 2 commits from tlater/nixpkgs-formatting into master 2024-06-28 19:24:32 +01:00
Conversation 0 Commits 2 Files changed 30 +812 -767
29 changed files with 812 additions and 767 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit fd138d45e6 - Show all commits

13
configuration/default.nix
View file

@ -1,10 +1,9 @@
{
config,
pkgs,
lib,
modulesPath,
flake-inputs,
...
{ config
, pkgs
, lib
, modulesPath
, flake-inputs
, ...
}: {
imports = [
flake-inputs.disko.nixosModules.disko

6
configuration/hardware-specific/hetzner/disko.nix
View file

@ -1,5 +1,6 @@
{
disko.devices.disk = let
disko.devices.disk =
let
bootPartition = {
size = "1M";
type = "EF02";
@ -19,7 +20,8 @@
};
mountOptions = [ "compress=zstd" "noatime" ];
in {
in
{
sda = {
type = "disk";
device = "/dev/sda";

13
configuration/nginx.nix
View file

@ -1,7 +1,6 @@
{
config,
lib,
...
{ config
, lib
, ...
}: {
services.nginx = {
enable = true;
@ -27,7 +26,8 @@
# Override the default, just keep fewer logs
nginx.rotate = 6;
}
// lib.mapAttrs' (virtualHost: _:
// lib.mapAttrs'
(virtualHost: _:
lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
frequency = "daily";
rotate = 2;
@ -39,7 +39,8 @@
config.services.nginx.virtualHosts;
systemd.tmpfiles.rules =
lib.mapAttrsToList (
lib.mapAttrsToList
(
virtualHost: _:
#
"d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"

7
configuration/services/afvalcalendar.nix
View file

@ -1,7 +1,6 @@
{
pkgs,
config,
...
{ pkgs
, config
, ...
}: {
systemd.services.afvalcalendar = {
description = "Enschede afvalcalendar -> ical converter";

28
configuration/services/backups.nix
View file

@ -1,9 +1,9 @@
{
config,
pkgs,
lib,
...
}: let
{ config
, pkgs
, lib
, ...
}:
let
inherit (lib) types optional singleton;
mkShutdownScript = service:
pkgs.writeShellScript "backup-${service}-shutdown" ''
@ -42,16 +42,16 @@
RESTIC_REPOSITORY = "rclone:storagebox:backups";
RCLONE_CONFIG = rcloneConfig;
};
in {
in
{
options = {
services.backups = lib.mkOption {
description = lib.mdDoc ''
Configure restic backups with a specific tag.
'';
type = types.attrsOf (types.submodule ({
config,
name,
...
type = types.attrsOf (types.submodule ({ config
, name
, ...
}: {
options = {
user = lib.mkOption {
@ -164,7 +164,8 @@ in {
};
};
}
// lib.mapAttrs' (name: backup:
// lib.mapAttrs'
(name: backup:
lib.nameValuePair "backup-${name}" {
# Don't want to restart mid-backup
restartIfChanged = false;
@ -226,7 +227,8 @@ in {
# of the backup jobs.
};
}
// lib.mapAttrs' (name: backup:
// lib.mapAttrs'
(name: backup:
lib.nameValuePair "backup-${name}" {
wantedBy = [ "timers.target" ];
timerConfig = {

7
configuration/services/battery-manager.nix
View file

@ -1,7 +1,6 @@
{
config,
flake-inputs,
...
{ config
, flake-inputs
, ...
}: {
imports = [
flake-inputs.sonnenshift.nixosModules.default

27
configuration/services/conduit.nix
View file

@ -1,15 +1,16 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs
, config
, lib
, ...
}:
let
inherit (lib.strings) concatMapStringsSep;
cfg = config.services.matrix-conduit;
domain = "matrix.${config.services.nginx.domain}";
turn-realm = "turn.${config.services.nginx.domain}";
in {
in
{
services.matrix-conduit = {
enable = true;
settings.global = {
@ -17,10 +18,12 @@ in {
server_name = domain;
database_backend = "rocksdb";
turn_uris = let
turn_uris =
let
address = "${config.services.coturn.realm}:${toString config.services.coturn.listening-port}";
tls-address = "${config.services.coturn.realm}:${toString config.services.coturn.tls-listening-port}";
in [
in
[
"turn:${address}?transport=udp"
"turn:${address}?transport=tcp"
"turns:${tls-address}?transport=udp"
@ -29,7 +32,8 @@ in {
};
};
systemd.services.heisenbridge = let
systemd.services.heisenbridge =
let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
registrationFile = builtins.toFile "heisenbridge-registration.yaml" (builtins.toJSON {
id = "heisenbridge";
@ -73,7 +77,8 @@ in {
--owner @tlater:matrix.tlater.net \
'http://localhost:${toString cfg.settings.global.port}'
'';
in {
in
{
description = "Matrix<->IRC bridge";
wantedBy = [ "multi-user.target" ];
after = [ "conduit.service" ];

21
configuration/services/foundryvtt.nix
View file

@ -1,11 +1,12 @@
{
lib,
config,
flake-inputs,
...
}: let
{ lib
, config
, flake-inputs
, ...
}:
let
domain = "foundryvtt.${config.services.nginx.domain}";
in {
in
{
imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ];
services.foundryvtt = {
@ -20,9 +21,11 @@ in {
# running
systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
services.nginx.virtualHosts."${domain}" = let
services.nginx.virtualHosts."${domain}" =
let
inherit (config.services.foundryvtt) port;
in {
in
{
forceSSL = true;
useACMEHost = "tlater.net";
enableHSTS = true;

27
configuration/services/gitea.nix
View file

@ -1,11 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs
, config
, lib
, ...
}:
let
domain = "gitea.${config.services.nginx.domain}";
in {
in
{
services.forgejo = {
enable = true;
database.type = "postgres";
@ -27,19 +28,23 @@ in {
};
};
systemd.services.forgejo.serviceConfig.ExecStartPre = let
systemd.services.forgejo.serviceConfig.ExecStartPre =
let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."forgejo/metrics-token".path;
runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
in [
in
[
"+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
];
# Set up SSL
services.nginx.virtualHosts."${domain}" = let
services.nginx.virtualHosts."${domain}" =
let
httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
httpPort = config.services.forgejo.settings.server.HTTP_PORT;
in {
in
{
forceSSL = true;
useACMEHost = "tlater.net";
enableHSTS = true;

30
configuration/services/metrics/exporters.nix
View file

@ -1,23 +1,26 @@
{
config,
pkgs,
lib,
...
}: let
{ config
, pkgs
, lib
, ...
}:
let
yaml = pkgs.formats.yaml { };
in {
in
{
services.prometheus = {
exporters = {
# Periodically check domain registration status
domain = {
enable = true;
listenAddress = "127.0.0.1";
extraFlags = let
extraFlags =
let
conf.domains = [
"tlater.net"
"tlater.com"
];
in [
in
[
"--config=${yaml.generate "domains.yml" conf}"
];
};
@ -49,7 +52,8 @@ in {
group = "nginx";
settings.namespaces =
lib.mapAttrsToList (name: virtualHost: {
lib.mapAttrsToList
(name: virtualHost: {
inherit name;
metrics_override.prefix = "nginxlog";
namespace_label = "vhost";
@ -71,9 +75,11 @@ in {
};
extraExporters = {
fail2ban = let
fail2ban =
let
cfg = config.services.prometheus.extraExporters.fail2ban;
in {
in
{
port = 9191;
serviceOpts = {
after = [ "fail2ban.service" ];

6
configuration/services/metrics/grafana.nix
View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
domain = "metrics.${config.services.nginx.domain}";
in {
in
{
services.grafana = {
enable = true;
settings = {

49
configuration/services/metrics/options.nix
View file

@ -1,12 +1,13 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs
, config
, lib
, ...
}:
let
inherit (lib) types mkOption mkDefault;
yaml = pkgs.formats.yaml { };
in {
in
{
options = {
services.prometheus = {
extraExporters = mkOption {
@ -31,10 +32,9 @@ in {
};
services.victoriametrics.scrapeConfigs = mkOption {
type = types.attrsOf (types.submodule ({
name,
self,
...
type = types.attrsOf (types.submodule ({ name
, self
, ...
}: {
options = {
job_name = mkOption {
@ -89,7 +89,8 @@ in {
config = {
systemd.services = lib.mkMerge [
(lib.mapAttrs' (name: exporter:
(lib.mapAttrs'
(name: exporter:
lib.nameValuePair "prometheus-${name}-exporter" (lib.mkMerge [
{
# Shamelessly copied from upstream because the upstream
@ -128,12 +129,15 @@ in {
config.services.prometheus.extraExporters)
{
vmagent-scrape-exporters = let
vmagent-scrape-exporters =
let
listenAddress = config.services.victoriametrics.listenAddress;
vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
promscrape = yaml.generate "prometheus.yml" {
scrape_configs = lib.mapAttrsToList (_: scrape:
lib.recursiveUpdate {
scrape_configs = lib.mapAttrsToList
(_: scrape:
lib.recursiveUpdate
{
inherit (scrape) job_name;
static_configs =
scrape.static_configs
@ -142,7 +146,8 @@ in {
scrape.extraSettings)
config.services.victoriametrics.scrapeConfigs;
};
in {
in
{
enable = true;
path = [ pkgs.victoriametrics ];
wantedBy = [ "multi-user.target" ];
@ -188,15 +193,19 @@ in {
users.groups.metrics = { };
services.victoriametrics.scrapeConfigs = let
services.victoriametrics.scrapeConfigs =
let
allExporters =
lib.mapAttrs (name: exporter: {
lib.mapAttrs
(name: exporter: {
inherit (exporter) listenAddress port;
}) ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
})
((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
config.services.prometheus.exporters)
// config.services.prometheus.extraExporters);
in
lib.mapAttrs (_: exporter: {
lib.mapAttrs
(_: exporter: {
targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
})
allExporters;

13
configuration/services/nextcloud.nix
View file

@ -1,14 +1,15 @@
{
pkgs,
config,
...
}: let
{ pkgs
, config
, ...
}:
let
# Update pending on rewrite of nextcloud news, though there is an
# alpha to switch to if it becomes necessary:
# https://github.com/nextcloud/news/issues/2610
nextcloud = pkgs.nextcloud27;
hostName = "nextcloud.${config.services.nginx.domain}";
in {
in
{
services.nextcloud = {
inherit hostName;

13
configuration/services/starbound.nix
View file

@ -1,10 +1,11 @@
{
pkgs,
lib,
...
}: let
{ pkgs
, lib
, ...
}:
let
inherit (lib) concatStringsSep;
in {
in
{
# Sadly, steam-run requires some X libs
environment.noXlibs = false;

12
configuration/services/webserver.nix
View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
domain = config.services.nginx.domain;
in {
in
{
services.tlaternet-webserver = {
enable = true;
listen = {
@ -10,9 +12,11 @@ in {
};
# Set up SSL
services.nginx.virtualHosts."${domain}" = let
services.nginx.virtualHosts."${domain}" =
let
inherit (config.services.tlaternet-webserver.listen) addr port;
in {
in
{
serverAliases = [ "www.${domain}" ];
forceSSL = true;

40
flake.nix
View file

@ -32,17 +32,19 @@
};
};
outputs = {
self,
nixpkgs,
sops-nix,
nvfetcher,
deploy-rs,
...
} @ inputs: let
outputs =
{ self
, nixpkgs
, sops-nix
, nvfetcher
, deploy-rs
, ...
} @ inputs:
let
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
in {
in
{
##################
# Configurations #
##################
@ -89,7 +91,8 @@
run-vm = {
type = "app";
program = let
program =
let
vm = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs.flake-inputs = inputs;
@ -102,32 +105,31 @@
in
(pkgs.writeShellScript "" ''
${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
'')
.outPath;
'').outPath;
};
update-pkgs = {
type = "app";
program = let
program =
let
nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
in
(pkgs.writeShellScript "update-pkgs" ''
cd "$(git rev-parse --show-toplevel)/pkgs"
${nvfetcher-bin} -o _sources_pkgs -c nvfetcher.toml
'')
.outPath;
'').outPath;
};
update-nextcloud-apps = {
type = "app";
program = let
program =
let
nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
in
(pkgs.writeShellScript "update-nextcloud-apps" ''
cd "$(git rev-parse --show-toplevel)/pkgs"
${nvfetcher-bin} -o _sources_nextcloud -c nextcloud-apps.toml
'')
.outPath;
'').outPath;
};
};
@ -144,6 +146,8 @@
sops-nix.packages.${system}.sops-init-gpg-key
deploy-rs.packages.${system}.default
nixpkgs-fmt
cargo
clippy
rustc

26
modules/nginxExtensions.nix
View file

@ -1,8 +1,7 @@
{
config,
pkgs,
lib,
...
{ config
, pkgs
, lib
, ...
}: {
options = {
services.nginx.domain = lib.mkOption {
@ -10,11 +9,12 @@
description = "The base domain name to append to virtual domain names";
};
services.nginx.virtualHosts = let
extraVirtualHostOptions = {
name,
config,
...
services.nginx.virtualHosts =
let
extraVirtualHostOptions =
{ name
, config
, ...
}: {
options = {
enableHSTS = lib.mkEnableOption "Enable HSTS";
@ -47,10 +47,12 @@
config = {
# Don't attempt to run acme if the domain name is not tlater.net
systemd.services = let
systemd.services =
let
confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
in
lib.mapAttrs' (cert: _:
lib.mapAttrs'
(cert: _:
lib.nameValuePair "acme-${cert}" {
serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
})

7
pkgs/afvalcalendar/default.nix
View file

@ -1,7 +1,6 @@
{
pkgs,
rustPlatform,
...
{ pkgs
, rustPlatform
, ...
}:
rustPlatform.buildRustPackage {
pname = "afvalcalendar";

9
pkgs/default.nix
View file

@ -1,7 +1,8 @@
{
pkgs,
lib,
}: let
{ pkgs
, lib
,
}:
let
inherit (builtins) fromJSON mapAttrs readFile;
inherit (pkgs) callPackage;
in

6
pkgs/mkNextcloudApp.nix
View file

@ -1,6 +1,6 @@
{
fetchNextcloudApp,
lib,
{ fetchNextcloudApp
, lib
,
}: source:
fetchNextcloudApp {
url = source.src.url;

6
pkgs/prometheus/fail2ban-exporter.nix
View file

@ -1,6 +1,6 @@
{
buildGoModule,
sources,
{ buildGoModule
, sources
,
}:
buildGoModule {
inherit (sources.prometheus-fail2ban-exporter) pname src version;

17
pkgs/starbound/default.nix
View file

@ -1,11 +1,12 @@
{
stdenv,
lib,
makeWrapper,
patchelf,
steamPackages,
replace-secret,
}: let
{ stdenv
, lib
, makeWrapper
, patchelf
, steamPackages
, replace-secret
,
}:
let
# Use the directory in which starbound is installed so steamcmd
# doesn't have to be reinstalled constantly (we're using DynamicUser
# with StateDirectory to persist this).