Clean up new Haven config a bit
This commit is contained in:
parent
bbfdf83630
commit
11db7e1d22
|
@ -61,14 +61,12 @@ in
|
||||||
# TLS certificate renewal via Let's Encrypt
|
# TLS certificate renewal via Let's Encrypt
|
||||||
security.acme = {
|
security.acme = {
|
||||||
acceptTerms = true;
|
acceptTerms = true;
|
||||||
defaults = {
|
defaults.email = "${config.secrets.users.aires.email}";
|
||||||
email = "${config.secrets.users.aires.email}";
|
|
||||||
};
|
|
||||||
|
|
||||||
certs."${config.secrets.networking.primaryDomain}" = {
|
certs."${config.secrets.networking.primaryDomain}" = {
|
||||||
dnsProvider = "namecheap";
|
dnsProvider = "namecheap";
|
||||||
extraDomainNames = subdomains;
|
extraDomainNames = subdomains;
|
||||||
webroot = null; # Prevents an assertion error
|
webroot = null; # Required in order to prevent a failed assertion
|
||||||
credentialFiles = {
|
credentialFiles = {
|
||||||
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
|
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
|
||||||
${config.secrets.networking.namecheap.api.user}
|
${config.secrets.networking.namecheap.api.user}
|
||||||
|
@ -92,18 +90,16 @@ in
|
||||||
# Use recommended settings per https://nixos.wiki/wiki/Nginx#Hardened_setup_with_TLS_and_HSTS_preloading
|
# Use recommended settings per https://nixos.wiki/wiki/Nginx#Hardened_setup_with_TLS_and_HSTS_preloading
|
||||||
recommendedGzipSettings = true;
|
recommendedGzipSettings = true;
|
||||||
recommendedOptimisation = true;
|
recommendedOptimisation = true;
|
||||||
#recommendedProxySettings = true; # Recommended settings break Airsonic
|
|
||||||
recommendedTlsSettings = true;
|
recommendedTlsSettings = true;
|
||||||
|
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
# Base URL: make sure we've got Let's Encrypt running challenges here, and all other requests going to HTTPS
|
# Base URL: make sure we've got Let's Encrypt running challenges here, and all other requests going to HTTPS
|
||||||
"${config.secrets.networking.primaryDomain}" = {
|
"${config.secrets.networking.primaryDomain}" = {
|
||||||
# Catchall vhost, will redirect users to HTTPS for all vhosts
|
|
||||||
default = true;
|
default = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
#serverAliases = subdomains;
|
# Catchall vhost, will Redirect users to Forgejo
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
return = "301 https://$host$request_uri";
|
return = "301 https://code.${config.secrets.networking.primaryDomain}";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -111,19 +107,10 @@ in
|
||||||
"code.${config.secrets.networking.primaryDomain}" = {
|
"code.${config.secrets.networking.primaryDomain}" = {
|
||||||
useACMEHost = "${config.secrets.networking.primaryDomain}";
|
useACMEHost = "${config.secrets.networking.primaryDomain}";
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
port = 443;
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
ssl = true;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://127.0.0.1:3000";
|
proxyPass = "http://127.0.0.1:3000";
|
||||||
proxyWebsockets = true; # needed if you need to use WebSocket
|
proxyWebsockets = true;
|
||||||
extraConfig =
|
extraConfig = "proxy_ssl_server_name on;"; # required when the target is also TLS server with multiple hosts
|
||||||
# required when the target is also TLS server with multiple hosts
|
|
||||||
"proxy_ssl_server_name on;";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -131,16 +118,10 @@ in
|
||||||
"music.${config.secrets.networking.primaryDomain}" = {
|
"music.${config.secrets.networking.primaryDomain}" = {
|
||||||
useACMEHost = "${config.secrets.networking.primaryDomain}";
|
useACMEHost = "${config.secrets.networking.primaryDomain}";
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
port = 443;
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
ssl = true;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://127.0.0.1:4040";
|
proxyPass = "http://127.0.0.1:4040";
|
||||||
proxyWebsockets = true; # needed if you need to use WebSocket
|
proxyWebsockets = true;
|
||||||
|
extraConfig = "proxy_ssl_server_name on;";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -151,12 +132,12 @@ in
|
||||||
enable = true;
|
enable = true;
|
||||||
war = "${
|
war = "${
|
||||||
(pkgs.callPackage ../../packages/airsonic-advanced.nix { inherit lib; })
|
(pkgs.callPackage ../../packages/airsonic-advanced.nix { inherit lib; })
|
||||||
}/webapps/airsonic-advanced.war";
|
}/webapps/airsonic.war";
|
||||||
port = 4040;
|
port = 4040;
|
||||||
jre = pkgs.jdk17_headless;
|
jre = pkgs.jdk17_headless;
|
||||||
jvmOptions = [
|
jvmOptions = [
|
||||||
"-Dserver.use-forward-headers=true"
|
"-Dserver.use-forward-headers=true"
|
||||||
"-Xmx4G"
|
"-Xmx4G" # Increase Java heap size to 4GB
|
||||||
];
|
];
|
||||||
home = "/storage/services/airsonic-advanced";
|
home = "/storage/services/airsonic-advanced";
|
||||||
};
|
};
|
||||||
|
@ -173,20 +154,11 @@ in
|
||||||
forgejo = {
|
forgejo = {
|
||||||
enable = true;
|
enable = true;
|
||||||
stateDir = "/storage/services/forgejo";
|
stateDir = "/storage/services/forgejo";
|
||||||
# Enable support for Git Large File Storage
|
|
||||||
lfs.enable = true;
|
lfs.enable = true;
|
||||||
settings = {
|
settings.server = {
|
||||||
server = {
|
|
||||||
DOMAIN = "${config.secrets.networking.primaryDomain}";
|
DOMAIN = "${config.secrets.networking.primaryDomain}";
|
||||||
ROOT_URL = "https://code.${config.secrets.networking.primaryDomain}/";
|
ROOT_URL = "https://code.${config.secrets.networking.primaryDomain}/";
|
||||||
HTTP_PORT = 3000;
|
HTTP_PORT = 3000;
|
||||||
/*
|
|
||||||
DISABLE_SSH = false;
|
|
||||||
SSH_PORT = config.secrets.services.forgejo.sshPort;
|
|
||||||
START_SSH_SERVER = true;
|
|
||||||
BUILTIN_SSH_SERVER_USER = "forgejo";
|
|
||||||
*/
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
useWizard = true;
|
useWizard = true;
|
||||||
};
|
};
|
||||||
|
@ -197,12 +169,11 @@ in
|
||||||
ports = [ config.secrets.hosts.haven.ssh.port ];
|
ports = [ config.secrets.hosts.haven.ssh.port ];
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
# require public key authentication for better security
|
# require public key authentication and disable root logins
|
||||||
PasswordAuthentication = false;
|
PasswordAuthentication = false;
|
||||||
KbdInteractiveAuthentication = false;
|
KbdInteractiveAuthentication = false;
|
||||||
PubkeyAuthentication = true;
|
PubkeyAuthentication = true;
|
||||||
|
PermitRootLogin = "no";
|
||||||
PermitRootLogin = "without-password";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -211,22 +182,16 @@ in
|
||||||
|
|
||||||
# Configure services
|
# Configure services
|
||||||
systemd.services = {
|
systemd.services = {
|
||||||
# Airsonic: Disable autostart and set environment variables. Started via start-haven script
|
# Disable autostart for services. They get started via start-haven script
|
||||||
airsonic = {
|
airsonic.wantedBy = lib.mkForce [ ];
|
||||||
wantedBy = lib.mkForce [ ];
|
forgejo.wantedBy = lib.mkForce [ ];
|
||||||
};
|
|
||||||
|
|
||||||
# Foregejo: Disable autostart. Started via start-haven script
|
# Nginx: Disable autostart, and start sub-services first.
|
||||||
forgejo = {
|
|
||||||
wantedBy = lib.mkForce [ ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Nginx: Disable autostart. Started via start-haven script
|
|
||||||
nginx = {
|
nginx = {
|
||||||
wantedBy = lib.mkForce [ ];
|
wantedBy = lib.mkForce [ ];
|
||||||
wants = [
|
wants = [
|
||||||
"airsonic.service"
|
config.systemd.services.airsonic.name
|
||||||
"forgejo.service"
|
config.systemd.services.forgejo.name
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -237,7 +202,6 @@ in
|
||||||
allowedTCPPorts = [
|
allowedTCPPorts = [
|
||||||
80
|
80
|
||||||
443
|
443
|
||||||
22222
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
|
||||||
|
|
||||||
buildCommand = ''
|
buildCommand = ''
|
||||||
mkdir -p "$out/webapps"
|
mkdir -p "$out/webapps"
|
||||||
cp "$src" "$out/webapps/airsonic-advanced.war"
|
cp "$src" "$out/webapps/airsonic.war"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
passthru.tests = {
|
passthru.tests = {
|
||||||
|
@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
|
||||||
};
|
};
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
description = "Personal media streamer";
|
description = "Free, web-based media streamer providing ubiquitous access to your music.";
|
||||||
homepage = "https://airsonic.github.io";
|
homepage = "https://github.com/kagemomiji/airsonic-advanced/";
|
||||||
sourceProvenance = with sourceTypes; [ binaryBytecode ];
|
sourceProvenance = with sourceTypes; [ binaryBytecode ];
|
||||||
license = lib.licenses.gpl3;
|
license = lib.licenses.gpl3;
|
||||||
platforms = platforms.all;
|
platforms = platforms.all;
|
||||||
|
|
Loading…
Reference in a new issue