yisroelbaum/home-server-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

move discourse behind tide module

Browse source
This commit is contained in:
Yisroel Baum 2026-07-19 10:40:25 +03:00
parent 03f84d7b6a
commit 344d496a9b
Signed by: yisroelbaum
GPG key ID: 0FA60884F75520A9
11 changed files with 59 additions and 419 deletions
Download patch file Download diff file Expand all files Collapse all files

56
tide.nix
View file

@ -1,37 +1,41 @@
{
domainName,
...
}:
{ config, ... }:
{
services.tide = {
enable = true;
domain = "tide.${domainName}";
apiDomain = "apitide.${domainName}";
secretsFile = "/run/secrets/tide-env";
# Reuse the wildcard cert already issued for *.${domainName}
# in configuration.nix instead of requesting a new one per
# subdomain.
nginx.useACMEHost = null;
secretFiles = {
adminPassword = config.sops.secrets."tide-admin-password".path;
mailPassword = config.sops.secrets."tide-mail-password".path;
secretKeyBase = config.sops.secrets."tide-secret-key-base".path;
borgPassphrase = config.sops.secrets."borg-passphrase".path;
borgPrivateKey = config.sops.secrets."borg-private-key".path;
};
};
# Don't fail evaluation when secrets/tide.yaml is missing (e.g.
# before the operator has encrypted it on a fresh checkout).
# sops-install-secrets will still error at activation time if
# the file is absent, which is the right place for that failure.
sops.validateSopsFiles = false;
# Use the host's age key generated with age-keygen, not the
# SSH-host-key-derived identity sops-nix falls back to by default.
# The encrypted file's recipient is the public key paired with
# this private key.
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.sshKeyPaths = [ ];
sops.gnupg.sshKeyPaths = [ ];
sops.secrets."tide-env" = {
sopsFile = ./secrets/tide.yaml;
# phpfpm reads this via EnvironmentFile, which runs as root
# before dropping to the tide user, so root readable is enough.
mode = "0400";
sops.secrets = {
"tide-admin-password" = {
sopsFile = ./secrets/tide.yaml;
key = "admin-password";
mode = "0400";
owner = "discourse";
group = "discourse";
};
"tide-mail-password" = {
sopsFile = ./secrets/tide.yaml;
key = "mail-key";
mode = "0400";
owner = "discourse";
group = "discourse";
};
"tide-secret-key-base" = {
sopsFile = ./secrets/tide.yaml;
key = "secret-key";
mode = "0400";
owner = "discourse";
group = "discourse";
};
};
}