From 92d6e4bad79a120c8ad91f6facca297778aae4ac Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Fri, 31 Jul 2026 11:30:25 +0300 Subject: [PATCH] move yisroelbaum web stack into module --- README.md | 4 ++ configuration.nix | 48 -------------------- flake.lock | 29 ++++++++++-- flake.nix | 17 +++---- forgejo.nix | 107 -------------------------------------------- rabbi-gerzi.nix | 34 -------------- secrets/README.md | 14 ++++++ yisroelbaum-web.nix | 32 +++++++++++++ 8 files changed, 81 insertions(+), 204 deletions(-) delete mode 100644 forgejo.nix delete mode 100644 rabbi-gerzi.nix create mode 100644 yisroelbaum-web.nix diff --git a/README.md b/README.md index e3c1b4a..dfaa84c 100644 --- a/README.md +++ b/README.md @@ -6,3 +6,7 @@ nixos-rebuild switch --flake .#nixos \ --sudo --ask-sudo-password ``` +The public services under `yisroelbaum.com` are provided by the +`yisroelbaum-web` flake input. This repository owns the machine configuration +and provisions the runtime secrets passed to that module from +`yisroelbaum-web.nix`. diff --git a/configuration.nix b/configuration.nix index 29870b7..070cce9 100644 --- a/configuration.nix +++ b/configuration.nix @@ -1,8 +1,5 @@ { - config, pkgs, - domainName, - resume, ... }: { @@ -10,7 +7,6 @@ [ # Include the results of the hardware scan. ./hardware-configuration.nix ./borgbackup.nix - ./forgejo.nix ./boot.nix ]; @@ -99,46 +95,6 @@ # Install firefox. programs.firefox.enable = true; - users.users.nginx.extraGroups = [ "acme" ]; - services.nginx = { - enable = true; - virtualHosts = { - "${domainName}" = { - forceSSL = true; - enableACME = true; - locations = { - "/" = { - root = "${resume.packages.x86_64-linux.default}"; - }; - }; - }; - "jellyfin.${domainName}" = { - forceSSL = true; - enableACME = true; - locations = { - "/" = { - proxyPass = "http://localhost:8096"; - }; - }; - }; - }; - }; - security.acme = { - defaults.webroot = "/var/lib/acme/acme-challenge/"; - acceptTerms = true; - defaults.email = "yisroel.d.baum@gmail.com"; - certs = { - "${domainName}" = { - domain = "*.${domainName}"; - webroot = "/var/lib/acme/acme-challenge/"; - group = config.services.nginx.group; - reloadServices = [ - "nginx" - ]; - }; - }; - }; - # Allow unfree packages nixpkgs.config.allowUnfree = true; @@ -159,10 +115,6 @@ # enableSSHSupport = true; # }; - services.jellyfin = { - enable = true; - }; - # List services that you want to enable: services.dnsmasq = { enable = true; diff --git a/flake.lock b/flake.lock index bdd385d..3622016 100644 --- a/flake.lock +++ b/flake.lock @@ -39,6 +39,7 @@ "rabbi-gerzi": { "inputs": { "nixpkgs": [ + "yisroelbaum-web", "nixpkgs" ], "utils": "utils" @@ -60,6 +61,7 @@ "resume": { "inputs": { "nixpkgs": [ + "yisroelbaum-web", "nixpkgs" ] }, @@ -81,10 +83,9 @@ "inputs": { "home-manager": "home-manager", "nixpkgs": "nixpkgs", - "rabbi-gerzi": "rabbi-gerzi", - "resume": "resume", "sops-nix": "sops-nix", - "tide": "tide" + "tide": "tide", + "yisroelbaum-web": "yisroelbaum-web" } }, "sops-nix": { @@ -159,6 +160,28 @@ "repo": "flake-utils", "type": "github" } + }, + "yisroelbaum-web": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "rabbi-gerzi": "rabbi-gerzi", + "resume": "resume" + }, + "locked": { + "lastModified": 1785486508, + "narHash": "sha256-ERBDLfvLBz91IBMJeagoTfXzeldUjhekF8jqiuHCeGw=", + "ref": "refs/heads/master", + "rev": "b09be84f730937f9556263fc995753e873e31ac0", + "revCount": 2, + "type": "git", + "url": "https://git.yisroelbaum.com/yisroelbaum/yisroelbaum-web" + }, + "original": { + "type": "git", + "url": "https://git.yisroelbaum.com/yisroelbaum/yisroelbaum-web" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 08739f7..ffea2a1 100644 --- a/flake.nix +++ b/flake.nix @@ -16,12 +16,8 @@ url = "git+https://git.yisroelbaum.com/yisroelbaum/TIDE"; inputs.nixpkgs.follows = "nixpkgs"; }; - resume = { - url = "git+https://git.yisroelbaum.com/yisroelbaum/MyResume"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - rabbi-gerzi = { - url = "git+https://git.yisroelbaum.com/yisroelbaum/Rabbi_Gerzi"; + yisroelbaum-web = { + url = "git+https://git.yisroelbaum.com/yisroelbaum/yisroelbaum-web"; inputs.nixpkgs.follows = "nixpkgs"; }; }; @@ -33,31 +29,28 @@ home-manager, sops-nix, tide, - resume, - rabbi-gerzi, + yisroelbaum-web, ... }: let system = "x86_64-linux"; - domainName = "yisroelbaum.com"; in { nixosConfigurations.nixos = nixpkgs.lib.nixosSystem { modules = [ ./configuration.nix ./tide.nix - ./rabbi-gerzi.nix + ./yisroelbaum-web.nix home-manager.nixosModules.home-manager sops-nix.nixosModules.sops tide.nixosModules.tide - rabbi-gerzi.nixosModules.default + yisroelbaum-web.nixosModules.default { home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; home-manager.users.yisroel = ./home-manager/home.nix; } ]; - specialArgs = { inherit domainName resume; }; }; devShells."${system}".default = let diff --git a/forgejo.nix b/forgejo.nix deleted file mode 100644 index 942bb83..0000000 --- a/forgejo.nix +++ /dev/null @@ -1,107 +0,0 @@ -{ - domainName, - config, - pkgs, - ... -}: -{ - services = { - forgejo = { - enable = true; - settings = { - server = { - ROOT_URL = "https://git.${domainName}/"; - PROTOCOL = "http"; - HTTP_ADDR = "127.0.0.1"; - HTTP_PORT = 3000; - DOMAIN = "git.${domainName}"; - SSH_PORT = 2222; - START_SSH_SERVER = true; - }; - session.COOKIE_SECURE = true; - service.DISABLE_REGISTRATION = true; - mailer = { - ENABLED = true; - SMTP_ADDR = "in-v3.mailjet.com"; - SMTP_PORT = 587; - FROM = "me@${domainName}"; - # USER and PASSWD come from secrets below - }; - }; - secrets.mailer.USER = config.sops.secrets."forgejo-mailer-user".path; - secrets.mailer.PASSWD = config.sops.secrets."forgejo-mailer-passwd".path; - }; - nginx.virtualHosts."git.${domainName}" = { - forceSSL = true; - enableACME = true; - extraConfig = '' - client_max_body_size 512M; - ''; - locations = { - "/" = { - proxyPass = "http://127.0.0.1:3000"; - recommendedProxySettings = false; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - ''; - }; - }; - }; - borgbackup.jobs.forgejo = { - paths = [ config.services.forgejo.stateDir ]; - repo = "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo"; - user = "root"; - group = "root"; - encryption = { - mode = "repokey-blake2"; - passCommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg-passphrase".path}"; - }; - doInit = true; - compression = "auto,zstd"; - startAt = "*-*-* 03:15:00"; - persistentTimer = true; - prune.keep = { - daily = 7; - weekly = 4; - monthly = 6; - }; - environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg-private-key".path} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts"; - preHook = '' - forgejoWasActive=/root/.cache/borg/forgejo-was-active - if ${pkgs.systemd}/bin/systemctl is-active --quiet forgejo.service; then - touch "$forgejoWasActive" - ${pkgs.systemd}/bin/systemctl stop forgejo.service - else - rm -f "$forgejoWasActive" - fi - ''; - postHook = '' - forgejoWasActive=/root/.cache/borg/forgejo-was-active - if [ -e "$forgejoWasActive" ]; then - ${pkgs.systemd}/bin/systemctl start forgejo.service - rm -f "$forgejoWasActive" - fi - ''; - }; - }; - - systemd.services.borgbackup-job-forgejo = { - after = [ - "sops-install-secrets.service" - "network-online.target" - ]; - wants = [ "network-online.target" ]; - }; - - sops.secrets."forgejo-mailer-user" = { - sopsFile = ./secrets/forgejo.yaml; - mode = "0400"; - }; - sops.secrets."forgejo-mailer-passwd" = { - sopsFile = ./secrets/forgejo.yaml; - mode = "0400"; - }; -} diff --git a/rabbi-gerzi.nix b/rabbi-gerzi.nix deleted file mode 100644 index ad5f676..0000000 --- a/rabbi-gerzi.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ - config, - domainName, - ... -}: -{ - services.rabbi-gerzi = { - enable = true; - frontend = { - hostName = "rabbigerzi.${domainName}"; - nginx = { - forceSSL = true; - enableACME = true; - }; - }; - backend = { - hostName = "rabbigerziapi.${domainName}"; - environmentFile = config.sops.secrets."rabbi-gerzi-env".path; - nginx = { - forceSSL = true; - enableACME = true; - }; - }; - }; - - sops.secrets."rabbi-gerzi-env" = { - sopsFile = ./secrets/rabbi-gerzi.env; - format = "dotenv"; - key = ""; - mode = "0400"; - owner = config.services.rabbi-gerzi.user; - group = config.services.rabbi-gerzi.group; - }; -} diff --git a/secrets/README.md b/secrets/README.md index b4eb134..fd8dcb3 100644 --- a/secrets/README.md +++ b/secrets/README.md @@ -18,6 +18,17 @@ host's age key. 3. On a workstation, put that public key into `.sops.yaml` at the repository root and encrypt the required secret files. +## Shared Borg backup credentials + +`borgbackup.yaml` contains `private-key` and `passphrase`. The resulting +secrets are shared by the TIDE and yisroelbaum.com backup jobs. + +## Forgejo + +`forgejo.yaml` contains `forgejo-mailer-user` and +`forgejo-mailer-passwd`. The host passes these secret paths to the +`yisroelbaum-web` module. + ## TIDE Create `tide.yaml` from `tide.yaml.example` and encrypt it with sops. It must @@ -33,3 +44,6 @@ APP_KEY=base64:... RABBI_GERZI_INITIAL_ADMIN_EMAIL=... RABBI_GERZI_INITIAL_ADMIN_PASSWORD=... ``` + +The host passes this environment file to the Rabbi Gerzi service through the +`yisroelbaum-web` module. diff --git a/yisroelbaum-web.nix b/yisroelbaum-web.nix new file mode 100644 index 0000000..79d9a68 --- /dev/null +++ b/yisroelbaum-web.nix @@ -0,0 +1,32 @@ +{ config, ... }: +{ + services.yisroelbaum-web = { + enable = true; + secretFiles = { + borgPassphrase = config.sops.secrets."borg-passphrase".path; + borgPrivateKey = config.sops.secrets."borg-private-key".path; + forgejoMailerUser = config.sops.secrets."forgejo-mailer-user".path; + forgejoMailerPassword = config.sops.secrets."forgejo-mailer-passwd".path; + rabbiGerziEnvironment = config.sops.secrets."rabbi-gerzi-env".path; + }; + }; + + sops.secrets = { + "forgejo-mailer-user" = { + sopsFile = ./secrets/forgejo.yaml; + mode = "0400"; + }; + "forgejo-mailer-passwd" = { + sopsFile = ./secrets/forgejo.yaml; + mode = "0400"; + }; + "rabbi-gerzi-env" = { + sopsFile = ./secrets/rabbi-gerzi.env; + format = "dotenv"; + key = ""; + mode = "0400"; + owner = config.services.rabbi-gerzi.user; + group = config.services.rabbi-gerzi.group; + }; + }; +}