add yisroelbaum web stack module

2026-07-31 11:17:25 +03:00 · 2026-07-31 11:17:25 +03:00 · 4a4de4eb0a
commit 4a4de4eb0a
6 changed files with 456 additions and 0 deletions
--- a/nix/module.nix
+++ b/nix/module.nix
@ -0,0 +1,173 @@
+{ resume }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.yisroelbaum-web;
+  domainName = "yisroelbaum.com";
+  resumePackage = resume.packages.${pkgs.stdenv.hostPlatform.system}.default;
+  secretFileOption =
+    description:
+    lib.mkOption {
+      type = lib.types.path;
+      inherit description;
+    };
+in
+{
+  options.services.yisroelbaum-web = {
+    enable = lib.mkEnableOption "the yisroelbaum.com web stack";
+
+    secretFiles = {
+      borgPassphrase = secretFileOption "Borg repository passphrase file.";
+      borgPrivateKey = secretFileOption "Borg repository SSH private key file.";
+      forgejoMailerUser = secretFileOption "Forgejo SMTP username file.";
+      forgejoMailerPassword = secretFileOption "Forgejo SMTP password file.";
+      rabbiGerziEnvironment = secretFileOption "Rabbi Gerzi runtime dotenv file.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${config.services.nginx.user}.extraGroups = [ "acme" ];
+
+    services = {
+      jellyfin.enable = true;
+
+      forgejo = {
+        enable = true;
+        settings = {
+          server = {
+            ROOT_URL = "https://git.${domainName}/";
+            PROTOCOL = "http";
+            HTTP_ADDR = "127.0.0.1";
+            HTTP_PORT = 3000;
+            DOMAIN = "git.${domainName}";
+            SSH_PORT = 2222;
+            START_SSH_SERVER = true;
+          };
+          session.COOKIE_SECURE = true;
+          service.DISABLE_REGISTRATION = true;
+          mailer = {
+            ENABLED = true;
+            SMTP_ADDR = "in-v3.mailjet.com";
+            SMTP_PORT = 587;
+            FROM = "me@${domainName}";
+          };
+        };
+        secrets.mailer = {
+          USER = cfg.secretFiles.forgejoMailerUser;
+          PASSWD = cfg.secretFiles.forgejoMailerPassword;
+        };
+      };
+
+      rabbi-gerzi = {
+        enable = true;
+        frontend = {
+          hostName = "rabbigerzi.${domainName}";
+          nginx = {
+            forceSSL = true;
+            enableACME = true;
+          };
+        };
+        backend = {
+          hostName = "rabbigerziapi.${domainName}";
+          environmentFile = cfg.secretFiles.rabbiGerziEnvironment;
+          nginx = {
+            forceSSL = true;
+            enableACME = true;
+          };
+        };
+      };
+
+      nginx = {
+        enable = true;
+        virtualHosts = {
+          "${domainName}" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".root = "${resumePackage}";
+          };
+
+          "jellyfin.${domainName}" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://localhost:8096";
+          };
+
+          "git.${domainName}" = {
+            forceSSL = true;
+            enableACME = true;
+            extraConfig = ''
+              client_max_body_size 512M;
+            '';
+            locations."/" = {
+              proxyPass = "http://127.0.0.1:3000";
+              recommendedProxySettings = false;
+              extraConfig = ''
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+              '';
+            };
+          };
+        };
+      };
+
+      borgbackup.jobs.forgejo = {
+        paths = [ config.services.forgejo.stateDir ];
+        repo = "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
+        user = "root";
+        group = "root";
+        encryption = {
+          mode = "repokey-blake2";
+          passCommand = "${pkgs.coreutils}/bin/cat ${cfg.secretFiles.borgPassphrase}";
+        };
+        doInit = true;
+        compression = "auto,zstd";
+        startAt = "*-*-* 03:15:00";
+        persistentTimer = true;
+        prune.keep = {
+          daily = 7;
+          weekly = 4;
+          monthly = 6;
+        };
+        environment.BORG_RSH = "ssh -i ${cfg.secretFiles.borgPrivateKey} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
+        preHook = ''
+          forgejoWasActive=/root/.cache/borg/forgejo-was-active
+          if ${pkgs.systemd}/bin/systemctl is-active --quiet forgejo.service; then
+            touch "$forgejoWasActive"
+            ${pkgs.systemd}/bin/systemctl stop forgejo.service
+          else
+            rm -f "$forgejoWasActive"
+          fi
+        '';
+        postHook = ''
+          forgejoWasActive=/root/.cache/borg/forgejo-was-active
+          if [ -e "$forgejoWasActive" ]; then
+            ${pkgs.systemd}/bin/systemctl start forgejo.service
+            rm -f "$forgejoWasActive"
+          fi
+        '';
+      };
+    };
+
+    security.acme = {
+      defaults = {
+        webroot = "/var/lib/acme/acme-challenge/";
+        email = "yisroel.d.baum@gmail.com";
+      };
+      acceptTerms = true;
+    };
+
+    systemd.services.borgbackup-job-forgejo = {
+      after = [
+        "sops-install-secrets.service"
+        "network-online.target"
+      ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}