118 lines
3.2 KiB
Nix
118 lines
3.2 KiB
Nix
{
|
|
pkgs,
|
|
home-manager,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
start-haven = pkgs.writeShellScriptBin "start-haven" (builtins.readFile ./start-haven.sh);
|
|
|
|
subdomains = [
|
|
config.secrets.services.airsonic.url
|
|
config.secrets.services.cache.url
|
|
config.secrets.services.forgejo.url
|
|
config.secrets.services.gremlin-lab.url
|
|
];
|
|
in
|
|
{
|
|
imports = [ ./hardware-configuration.nix ];
|
|
|
|
system.stateVersion = "24.05";
|
|
system.autoUpgrade.enable = lib.mkForce false;
|
|
|
|
host = {
|
|
role = "server";
|
|
services = {
|
|
acme = {
|
|
enable = true;
|
|
defaultEmail = config.secrets.users.aires.email;
|
|
certs = {
|
|
"${config.secrets.networking.primaryDomain}" = {
|
|
dnsProvider = "namecheap";
|
|
extraDomainNames = subdomains;
|
|
webroot = null; # Required in order to prevent a failed assertion
|
|
credentialFiles = {
|
|
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
|
|
${config.secrets.networking.namecheap.api.user}
|
|
''}";
|
|
"NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
|
|
${config.secrets.networking.namecheap.api.key}
|
|
''}";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
apcupsd = {
|
|
enable = true;
|
|
configText = builtins.readFile ./etc/apcupsd.conf;
|
|
};
|
|
airsonic = {
|
|
enable = true;
|
|
home = "/storage/services/airsonic-advanced";
|
|
};
|
|
boinc.enable = true;
|
|
cache = {
|
|
enable = false; # Disable for now
|
|
secretKeyFile = "/storage/services/nix-cache/cache-priv-key.pem";
|
|
};
|
|
duplicacy-web = {
|
|
enable = true;
|
|
autostart = false;
|
|
environment = "/storage/backups/settings/Haven";
|
|
};
|
|
forgejo = {
|
|
enable = true;
|
|
home = "/storage/services/forgejo";
|
|
};
|
|
msmtp.enable = true;
|
|
nginx = {
|
|
enable = true;
|
|
autostart = false;
|
|
virtualHosts = {
|
|
"${config.secrets.networking.primaryDomain}" = {
|
|
default = true;
|
|
enableACME = true; # Enable Let's Encrypt
|
|
locations."/" = {
|
|
# Catchall vhost, will redirect users to Forgejo
|
|
return = "301 https://${config.secrets.services.forgejo.url}";
|
|
};
|
|
};
|
|
"${config.secrets.services.gremlin-lab.url}" = {
|
|
useACMEHost = config.secrets.networking.primaryDomain;
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
|
|
proxyWebsockets = true;
|
|
extraConfig = "proxy_ssl_server_name on;";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
ssh = {
|
|
enable = true;
|
|
ports = [ config.secrets.hosts.haven.ssh.port ];
|
|
};
|
|
virtualization = {
|
|
enable = true;
|
|
user = "aires";
|
|
};
|
|
};
|
|
users.aires = {
|
|
enable = true;
|
|
services.syncthing = {
|
|
enable = true;
|
|
autostart = false;
|
|
};
|
|
};
|
|
};
|
|
|
|
# TODO: VPN (Check out Wireguard)
|
|
|
|
# Add Haven's startup script
|
|
environment.systemPackages = [ start-haven ];
|
|
|
|
# Allow Haven to be a build target for other architectures (mainly ARM64)
|
|
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
|
}
|