131 lines
3.9 KiB
Nix
131 lines
3.9 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./linode.nix
|
|
];
|
|
|
|
networking = {
|
|
hostName = "tlater.net";
|
|
|
|
# useDHCP is deprecated
|
|
useDHCP = false;
|
|
interfaces.eth0.useDHCP = true;
|
|
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
80
|
|
443
|
|
2222
|
|
3022
|
|
];
|
|
};
|
|
};
|
|
|
|
time.timeZone = "Europe/London";
|
|
|
|
users.users = {
|
|
tlater = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "docker" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1QMrJrjjWOjQf9wF5JC52EHtDh03grRHdS0PHlnc9kLDXYw8n41KEN2vE2skVTKBVufQhuckCAlXd6BpisW1YoyhaLs9Bcp6Un63VH3YvRvXzKtwXJHEv/5SnDrGqxo5UF6xTVTxC9ux0dnSSizAeQiremr9Zuzz4B25NJCiZ2lVZUOi8iG1m4082owuwZWIW6qrFWi3gUGtjz32EM3eUX75BE1ZcDap7BJj2GdYsMHO2iiHBZwQVOXd7Fvk/23f9IeQ95D2RMgeQun8OIF+7X5zaWzyzq1Tky4pijaSsUebnFk9Cxm6KRg+yXgmIjpskskCY6kj82+wqFjPRIgxf cardno:000606358963"
|
|
|
|
];
|
|
};
|
|
|
|
lauren = {
|
|
isNormalUser = true;
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCsQbwAdxtl4psbt0lkBaG9UZeJgDcI8xHWbot3cCM4avbfFjfpYhhv5SPlYvRKG4BqHXcK12oATKqKCapJhonR34K3khPiHGex+BUVs19bGTSj7NdXKFSvIDltdTeTA8gmpcOwT3ctlN7mdRNJdMIM3gzmFAu6DFOq/QnSNQViQDSvULyo4ElT48MS0fFuGCFT/bUGZaLQjnfHcnPegtBVfoZRNpLu+qgJZGm36mnzmovvza9cwm7ZE53FFjy4iGk/SzVw8li2b3Om3GgmdJd63ZPUI8wyLowPWQhQzf+N488WUe8mBw8dqUR4vhYSWTWhbQOuEqI2ttyWNrc0ApkknQgwLNzHVTFbaDL5Y0ATQaK7pzZ/c9GOS1dRMSEGFYwSY+pdMzXhIyG9wNCuDSFCXOluocbh4kJ42gdEI12IZ4GgYp5EgJ3obXXNDRizghrqljone415kga1fp+LVA3gLeScoh/DtB3EZ6oa1Dt9LjL8CH6KwX8wFUipCwcUkOCLairiMYyR2P6A9KBPtW/+JI7WaMO6SrBn/IS6wvqHr9If6dClyjpKHD5fqjDF8VrOyBfdGLU1WnYdHHPjmBRsJloLX85bZQtrJChBOS30wfeWwIIsBJOuqdj0/PlYmfq9l6NfGVoowC7BWJMw3Nl91CFfGD44cRUQM0oGQweEnQ== me@laurenweston.com"
|
|
];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
];
|
|
|
|
services = {
|
|
openssh = {
|
|
enable = true;
|
|
allowSFTP = false;
|
|
passwordAuthentication = false;
|
|
permitRootLogin = "no";
|
|
ports = [ 2222 ];
|
|
startWhenNeeded = true;
|
|
};
|
|
};
|
|
|
|
virtualisation.docker = {
|
|
enable = true;
|
|
autoPrune.enable = true;
|
|
};
|
|
|
|
docker-containers = {
|
|
## nginx proxy
|
|
nginx-proxy = {
|
|
image = "jwilder/nginx-proxy:alpine";
|
|
ports = [
|
|
"80:80"
|
|
"443:443"
|
|
];
|
|
volumes = [
|
|
# So that we can watch new containers come up
|
|
"/var/run/docker.sock:/tmp/docker.sock:ro"
|
|
# So that we can access generated certs
|
|
"nginx-certs:/etc/nginx/certs:ro"
|
|
# So that we can write challenge files for letsencrypt auth
|
|
"nginx-challenges:/usr/share/nginx/html"
|
|
# So that we can modify config on-the-fly to set up challenge
|
|
# files
|
|
"nginx-conf:/etc/nginx/vhost.d"
|
|
];
|
|
environment = {
|
|
DHPARAM_GENERATION = "false"; # Provided by nginx-proxy-letsencrypt
|
|
};
|
|
extraDockerOptions = [
|
|
"--network=webproxy"
|
|
];
|
|
};
|
|
|
|
nginx-proxy-letsencrypt = {
|
|
image = "jrcs/letsencrypt-nginx-proxy-companion";
|
|
volumes = [
|
|
"/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
"nginx-certs:/etc/nginx/certs"
|
|
];
|
|
environment = {
|
|
DEFAULT_EMAIL = "tm@tlater.net";
|
|
};
|
|
extraDockerOptions = [
|
|
"--volumes-from" "docker-nginx-proxy.service"
|
|
];
|
|
};
|
|
|
|
## GitLab
|
|
gitlab = {
|
|
image = "gitlab/gitlab-ce:latest";
|
|
ports = [
|
|
"3022:22"
|
|
];
|
|
volumes = [
|
|
"gitlab-data:/var/opt/gitlab:Z"
|
|
"gitlab-logs:/var/log/gitlab:Z"
|
|
"gitlab-config:/etc/gitlab:Z"
|
|
];
|
|
environment = {
|
|
VIRTUAL_HOST = "gitlab.tlater.net";
|
|
LETSENCRYPT_HOST = "gitlab.tlater.net";
|
|
GITLAB_OMNIBUS_CONFIG = builtins.replaceStrings ["\n"] [""] (builtins.readFile ./configs/gitlab.rb);
|
|
};
|
|
extraDockerOptions = [
|
|
"--network=webproxy"
|
|
];
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "19.09";
|
|
}
|