Add Haven's services to Dimaga
This commit is contained in:
parent
cf04193e5c
commit
a74cc6a140
|
@ -8,6 +8,28 @@
|
|||
let
|
||||
# Do not change this value! This tracks when NixOS was installed on your system.
|
||||
stateVersion = "24.11";
|
||||
|
||||
start-services = pkgs.writeShellScriptBin "start-services" (
|
||||
builtins.readFile ../Haven/start-haven.sh
|
||||
);
|
||||
|
||||
services-root = "/storage/services";
|
||||
|
||||
subdomains = [
|
||||
config.secrets.services.airsonic.url
|
||||
config.secrets.services.cache.url
|
||||
config.secrets.services.forgejo.url
|
||||
config.secrets.services.gremlin-lab.url
|
||||
];
|
||||
|
||||
namecheapCredentials = {
|
||||
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
|
||||
${config.secrets.networking.namecheap.api.user}
|
||||
''}";
|
||||
"NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
|
||||
${config.secrets.networking.namecheap.api.key}
|
||||
''}";
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [ ./hardware-configuration.nix ];
|
||||
|
@ -28,6 +50,7 @@ in
|
|||
|
||||
apps = {
|
||||
development.enable = true;
|
||||
tmux.enable = true;
|
||||
#media.enable = true;
|
||||
#office.enable = true;
|
||||
#recording.enable = true;
|
||||
|
@ -38,7 +61,7 @@ in
|
|||
# Enable Secure Boot support.
|
||||
bootloader = {
|
||||
enable = true;
|
||||
#secureboot.enable = true;
|
||||
secureboot.enable = true;
|
||||
tpm2.enable = true;
|
||||
};
|
||||
|
||||
|
@ -58,17 +81,113 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
packages = [
|
||||
start-services
|
||||
pkgs.htop
|
||||
];
|
||||
|
||||
# Change how long old generations are kept for.
|
||||
retentionPeriod = "14d";
|
||||
retentionPeriod = "monthly";
|
||||
|
||||
services = {
|
||||
autoUpgrade = {
|
||||
acme = {
|
||||
enable = true;
|
||||
defaultEmail = config.secrets.users.aires.email;
|
||||
certs = {
|
||||
"${config.secrets.networking.primaryDomain}" = {
|
||||
dnsProvider = "namecheap";
|
||||
extraDomainNames = subdomains;
|
||||
webroot = null; # Required in order to prevent a failed assertion
|
||||
credentialFiles = namecheapCredentials;
|
||||
};
|
||||
"${config.secrets.networking.blogDomain}" = {
|
||||
dnsProvider = "namecheap";
|
||||
webroot = null; # Required in order to prevent a failed assertion
|
||||
credentialFiles = namecheapCredentials;
|
||||
};
|
||||
};
|
||||
};
|
||||
apcupsd = {
|
||||
enable = true;
|
||||
configText = builtins.readFile ../Haven/etc/apcupsd.conf;
|
||||
};
|
||||
airsonic = {
|
||||
enable = true;
|
||||
home = "${services-root}/airsonic-advanced";
|
||||
domain = config.secrets.networking.primaryDomain;
|
||||
url = config.secrets.services.airsonic.url;
|
||||
};
|
||||
autoUpgrade = {
|
||||
enable = false; # Don't update the system...
|
||||
pushUpdates = true; # ...but do push updates remotely.
|
||||
configDir = config.secrets.nixConfigFolder;
|
||||
onCalendar = "daily";
|
||||
user = config.users.users.aires.name;
|
||||
};
|
||||
virtualization.enable = true;
|
||||
boinc.enable = true;
|
||||
cache = {
|
||||
enable = false; # Disable for now
|
||||
secretKeyFile = "${services-root}/nix-cache/cache-priv-key.pem";
|
||||
};
|
||||
duplicacy-web = {
|
||||
enable = true;
|
||||
autostart = false;
|
||||
environment = "/storage/backups/settings/Haven";
|
||||
};
|
||||
forgejo = {
|
||||
enable = true;
|
||||
home = "${services-root}/forgejo";
|
||||
domain = config.secrets.networking.primaryDomain;
|
||||
url = config.secrets.services.forgejo.url;
|
||||
actions = {
|
||||
enable = true;
|
||||
token = config.secrets.services.forgejo.runner-token;
|
||||
};
|
||||
};
|
||||
msmtp.enable = true;
|
||||
nginx = {
|
||||
enable = true;
|
||||
autostart = false;
|
||||
virtualHosts = {
|
||||
"${config.secrets.networking.primaryDomain}" = {
|
||||
default = true;
|
||||
enableACME = true; # Enable Let's Encrypt
|
||||
locations."/" = {
|
||||
# Catchall vhost, will redirect users to Forgejo
|
||||
return = "301 https://${config.secrets.services.forgejo.url}";
|
||||
};
|
||||
};
|
||||
"${config.secrets.networking.blogDomain}" = {
|
||||
useACMEHost = config.secrets.networking.blogDomain;
|
||||
forceSSL = true;
|
||||
root = "${services-root}/nginx/sites/${config.secrets.networking.blogDomain}";
|
||||
};
|
||||
"${config.secrets.services.gremlin-lab.url}" = {
|
||||
useACMEHost = config.secrets.networking.primaryDomain;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = "proxy_ssl_server_name on;";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
ssh = {
|
||||
enable = true;
|
||||
ports = [ config.secrets.hosts.haven.ssh.port ];
|
||||
};
|
||||
virtualization = {
|
||||
host = {
|
||||
enable = true;
|
||||
user = "aires";
|
||||
vmBuilds = {
|
||||
enable = true;
|
||||
cores = 3;
|
||||
ram = 4096;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
ui = {
|
||||
|
@ -83,8 +202,6 @@ in
|
|||
# Define Flatpak packages to install.
|
||||
packages = [
|
||||
"com.github.tchx84.Flatseal"
|
||||
"com.github.wwmm.easyeffects"
|
||||
"md.obsidian.Obsidian"
|
||||
"org.keepassxc.KeePassXC"
|
||||
"org.mozilla.firefox"
|
||||
];
|
||||
|
@ -96,8 +213,7 @@ in
|
|||
services = {
|
||||
syncthing = {
|
||||
enable = true;
|
||||
autostart = true;
|
||||
enableTray = false;
|
||||
autostart = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue