continuing things

This commit is contained in:
Jade 2023-04-26 23:25:04 +02:00
parent 6c2fea3b2f
commit bce60dc872
9 changed files with 156 additions and 45 deletions

View file

@ -2,57 +2,23 @@
"nodes": { "nodes": {
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1682362401, "lastModified": 1682303062,
"narHash": "sha256-/UMUHtF2CyYNl4b60Z2y4wwTTdIWGKhj9H301EDcT9M=", "narHash": "sha256-x+KAADp27lbxeoPXLUMxKcRsUUHDlg+qVjt5PjgBw9A=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "884ac294018409e0d1adc0cae185439a44bd6b0b", "rev": "f5364316e314436f6b9c8fd50592b18920ab18f9",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "NixOS", "owner": "NixOS",
"ref": "nixos-unstable", "ref": "nixos-22.11",
"repo": "nixpkgs", "repo": "nixpkgs",
"type": "github" "type": "github"
} }
}, },
"root": { "root": {
"inputs": { "inputs": {
"nixpkgs": "nixpkgs", "nixpkgs": "nixpkgs"
"utils": "utils"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1681202837,
"narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "cfacdce06f30d2b68473a46042957675eebb3401",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
} }
} }
}, },

View file

@ -1,10 +1,9 @@
{ {
inputs = { inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
utils.url = "github:numtide/flake-utils";
}; };
outputs = { self, nixpkgs, utils, ... }: outputs = { self, nixpkgs, ... }@inputs:
let let
pkgs = import nixpkgs { system = "x86_64-linux"; }; pkgs = import nixpkgs { system = "x86_64-linux"; };
in { in {
@ -25,9 +24,11 @@
buildOnTarget = true; buildOnTarget = true;
}; };
imports = [ imports = [
./modules/base-stuff.nix
./modules/proxy.nix ./modules/proxy.nix
./modules/jitsi.nix ./modules/jitsi.nix
./modules/base-stuff.nix ./modules/containers
./modules/keycloak.nix
]; ];
system.stateVersion = "22.11"; system.stateVersion = "22.11";

View file

@ -2,9 +2,30 @@
{ {
networking.hostName = "katzen-cafe"; networking.hostName = "katzen-cafe";
networking.firewall = {
allowedTCPPorts = [ 22 80 443 ];
};
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = false; boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_latest; boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelParams = [ "console=tty" ];
boot.initrd.kernelModules = [ "virtio_gpu" ];
users.users.april = {
isNormalUser = true;
packages = with pkgs; [ podman ];
createHome = true;
};
services.openssh = {
enable = true;
permitRootLogin = "prohibit-password";
};
environment.systemPackages = with pkgs; [
neovim wget neofetch
];
fileSystems."/" = { fileSystems."/" = {
device = "/dev/sda1"; device = "/dev/sda1";
@ -17,6 +38,6 @@
}; };
swapDevices = [ { swapDevices = [ {
device = "/dev/disk/by-uuid/9cb23bf3-128c-4847-8f72-f14f4aaa5026"; device = "/dev/sda2";
} ]; } ];
} }

4
modules/conduit.nix Normal file
View file

@ -0,0 +1,4 @@
{ pkgs, inputs, ... }:
{
# TODO: matrix-conduit
}

View file

@ -0,0 +1,7 @@
{ pkgs, ... }:
{
imports = [
./postgres.nix
./phtanumb-wiki.nix
];
}

View file

@ -0,0 +1,40 @@
{ pkgs, ... }:
{
containers."phtanumb-wiki" = {
autoStart = true;
localAddress = "127.0.0.1";
bindMounts = {
"/var/mediawiki" = {
hostPath = "/phtanum-b/wiki";
isReadOnly = false;
};
};
config = { config, pkgs, ... }: {
services.mediawiki = {
enable = true;
name = "phtanum-b";
virtualHost.listen = [
{
ip = "127.0.0.1";
port = 8080;
ssl = false;
}
];
virtualHost.hostName = "wiki.phtanum-b.katzen.cafe";
virtualHost.adminAddr = "admin@katzen.cafe";
passwordFile = "/var/mediawiki/passwordFile";
extraConfig = ''
# Disable anonymous editing
$wgGroupPermissions['*']['edit'] = false;
'';
};
system.stateVersion = "22.11";
};
};
deployment.keys."passwordFile" = {
keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ];
destDir = "/var/mediawiki";
};
}

View file

@ -0,0 +1,32 @@
{ pkgs, ... }:
{
containers.postgres = {
autoStart = true;
localAddress = "127.0.0.1";
bindMounts = {
"/var/lib/postgresql" = {
hostPath = "/postgres";
isReadOnly = false;
};
};
config = { config, pkgs, ... }: {
services.postgresql = {
enable = true;
ensureUsers = [
{
name = "keycloak";
ensurePermissions = {
"DATABASE \"nextcloud\"" = "ALL PRIVILEGES";
};
}
];
ensureDatabases = [
"keycloak"
];
};
system.stateVersion = "22.11";
};
};
}

16
modules/keycloak.nix Normal file
View file

@ -0,0 +1,16 @@
{ pkgs, ... }:
{
services.keycloak = {
enable = true;
settings = {
http-port = 8097;
proxy = "edge";
hostname = "auth.katzen.cafe";
};
database = {
createLocally = false;
};
};
}

View file

@ -12,6 +12,30 @@
group = "nginx"; group = "nginx";
keyType = "rsa4096"; keyType = "rsa4096";
}; };
"wiki.phtanum-b.katzen.cafe" = {
group = "nginx";
keyType = "rsa4096";
};
}; };
}; };
services.nginx = {
enable = true;
virtualHosts = {
"wiki.phtanum-b.katzen.cafe" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8080";
};
};
"auth.katzen.cafe" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8097";
};
};
};
};
} }