continuing things

flake.lock

@@ -2,57 +2,23 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1682362401,
+        "lastModified": 1682303062,
-        "narHash": "sha256-/UMUHtF2CyYNl4b60Z2y4wwTTdIWGKhj9H301EDcT9M=",
+        "narHash": "sha256-x+KAADp27lbxeoPXLUMxKcRsUUHDlg+qVjt5PjgBw9A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "884ac294018409e0d1adc0cae185439a44bd6b0b",
+        "rev": "f5364316e314436f6b9c8fd50592b18920ab18f9",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-22.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs"
-        "utils": "utils"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
       }
     }
   },

flake.nix

@@ -1,10 +1,9 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
-    utils.url = "github:numtide/flake-utils";
   };
 
-  outputs = { self, nixpkgs, utils, ... }: 
+  outputs = { self, nixpkgs, ... }@inputs: 
     let
       pkgs = import nixpkgs { system = "x86_64-linux"; };
     in {
@@ -25,9 +24,11 @@
             buildOnTarget = true;
           };
           imports = [
+            ./modules/base-stuff.nix
             ./modules/proxy.nix
             ./modules/jitsi.nix
-            ./modules/base-stuff.nix
+            ./modules/containers
+            ./modules/keycloak.nix
           ];
 
           system.stateVersion = "22.11";

modules/base-stuff.nix

@@ -2,9 +2,30 @@
 {
   networking.hostName = "katzen-cafe";
 
+  networking.firewall = {
+    allowedTCPPorts = [ 22 80 443 ];
+  };
+
   boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.canTouchEfiVariables = true;
   boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelParams = [ "console=tty" ];
+  boot.initrd.kernelModules = [ "virtio_gpu" ];
+
+  users.users.april = {
+    isNormalUser = true;
+    packages = with pkgs; [ podman ];
+    createHome = true;
+  };
+
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "prohibit-password";
+  };
+
+  environment.systemPackages = with pkgs; [
+    neovim wget neofetch
+  ];
 
   fileSystems."/" = { 
     device = "/dev/sda1";
@@ -17,6 +38,6 @@
   };
 
   swapDevices = [ { 
-    device = "/dev/disk/by-uuid/9cb23bf3-128c-4847-8f72-f14f4aaa5026"; 
+    device = "/dev/sda2"; 
   } ];
 }

modules/conduit.nix

@@ -0,0 +1,4 @@
+{ pkgs, inputs, ... }:
+{
+  # TODO: matrix-conduit
+}

modules/containers/default.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./postgres.nix
+    ./phtanumb-wiki.nix
+  ];
+}

modules/containers/phtanumb-wiki.nix

@@ -0,0 +1,40 @@
+{ pkgs, ... }:
+{
+  containers."phtanumb-wiki" = {
+    autoStart = true;
+    localAddress = "127.0.0.1";
+    bindMounts = {
+      "/var/mediawiki" = {
+        hostPath = "/phtanum-b/wiki";
+        isReadOnly = false;
+      };
+    };
+    config = { config, pkgs, ... }: {
+
+      services.mediawiki = {
+        enable = true;
+        name = "phtanum-b";
+        virtualHost.listen = [
+          {
+            ip = "127.0.0.1";
+            port = 8080;
+            ssl = false;
+          }
+        ];
+        virtualHost.hostName = "wiki.phtanum-b.katzen.cafe";
+        virtualHost.adminAddr = "admin@katzen.cafe";
+        passwordFile = "/var/mediawiki/passwordFile"; 
+        extraConfig = ''
+          # Disable anonymous editing
+          $wgGroupPermissions['*']['edit'] = false;
+        '';
+      };
+
+      system.stateVersion = "22.11";
+    };
+  };
+  deployment.keys."passwordFile" = {
+    keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ];
+    destDir = "/var/mediawiki";
+  };
+}

modules/containers/postgres.nix

@@ -0,0 +1,32 @@
+{ pkgs, ... }: 
+{
+  containers.postgres = {
+    autoStart = true;
+    localAddress = "127.0.0.1";
+    bindMounts = {
+      "/var/lib/postgresql" = {
+        hostPath = "/postgres";
+        isReadOnly = false;
+      };
+    };
+    config = { config, pkgs, ... }: {
+
+      services.postgresql = {
+        enable = true;
+        ensureUsers = [
+          {
+            name = "keycloak";
+            ensurePermissions = {
+              "DATABASE \"nextcloud\"" = "ALL PRIVILEGES";
+            };
+          }
+        ];
+        ensureDatabases = [
+          "keycloak"
+        ];
+      };
+
+      system.stateVersion = "22.11";
+    };
+  };
+}

modules/keycloak.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  services.keycloak = {
+    enable = true;
+
+    settings = {
+      http-port = 8097;
+      proxy = "edge";
+      hostname = "auth.katzen.cafe";
+    };
+
+    database = {
+      createLocally = false;
+    };
+  };
+}

modules/proxy.nix

@@ -12,6 +12,30 @@
         group = "nginx";
         keyType = "rsa4096";
       };
+      "wiki.phtanum-b.katzen.cafe" = {
+        group = "nginx";
+        keyType = "rsa4096";
+      };
     };
   };
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "wiki.phtanum-b.katzen.cafe" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8080";
+        };
+      };
+      "auth.katzen.cafe" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8097";
+        };
+      };
+    };
+
+  };
 }