153 lines
4.4 KiB
Nix
153 lines
4.4 KiB
Nix
{ resume }:
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.yisroelbaum-web;
|
|
domainName = "yisroelbaum.com";
|
|
resumePackage = resume.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
|
secretFileOption =
|
|
description:
|
|
lib.mkOption {
|
|
type = lib.types.path;
|
|
inherit description;
|
|
};
|
|
in
|
|
{
|
|
options.services.yisroelbaum-web = {
|
|
enable = lib.mkEnableOption "the yisroelbaum.com web stack";
|
|
|
|
secretFiles = {
|
|
borgPassphrase = secretFileOption "Borg repository passphrase file.";
|
|
borgPrivateKey = secretFileOption "Borg repository SSH private key file.";
|
|
forgejoMailerUser = secretFileOption "Forgejo SMTP username file.";
|
|
forgejoMailerPassword = secretFileOption "Forgejo SMTP password file.";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
users.users.${config.services.nginx.user}.extraGroups = [ "acme" ];
|
|
|
|
services = {
|
|
jellyfin.enable = true;
|
|
|
|
forgejo = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
ROOT_URL = "https://git.${domainName}/";
|
|
PROTOCOL = "http";
|
|
HTTP_ADDR = "127.0.0.1";
|
|
HTTP_PORT = 3000;
|
|
DOMAIN = "git.${domainName}";
|
|
SSH_PORT = 2222;
|
|
START_SSH_SERVER = true;
|
|
};
|
|
session.COOKIE_SECURE = true;
|
|
service.DISABLE_REGISTRATION = true;
|
|
mailer = {
|
|
ENABLED = true;
|
|
SMTP_ADDR = "in-v3.mailjet.com";
|
|
SMTP_PORT = 587;
|
|
FROM = "me@${domainName}";
|
|
};
|
|
};
|
|
secrets.mailer = {
|
|
USER = cfg.secretFiles.forgejoMailerUser;
|
|
PASSWD = cfg.secretFiles.forgejoMailerPassword;
|
|
};
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"${domainName}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/".root = "${resumePackage}";
|
|
};
|
|
|
|
"jellyfin.${domainName}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/".proxyPass = "http://localhost:8096";
|
|
};
|
|
|
|
"git.${domainName}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
extraConfig = ''
|
|
client_max_body_size 512M;
|
|
'';
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:3000";
|
|
recommendedProxySettings = false;
|
|
extraConfig = ''
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
borgbackup.jobs.forgejo = {
|
|
paths = [ config.services.forgejo.stateDir ];
|
|
repo = "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
|
|
user = "root";
|
|
group = "root";
|
|
encryption = {
|
|
mode = "repokey-blake2";
|
|
passCommand = "${pkgs.coreutils}/bin/cat ${cfg.secretFiles.borgPassphrase}";
|
|
};
|
|
doInit = true;
|
|
compression = "auto,zstd";
|
|
startAt = "*-*-* 03:15:00";
|
|
persistentTimer = true;
|
|
prune.keep = {
|
|
daily = 7;
|
|
weekly = 4;
|
|
monthly = 6;
|
|
};
|
|
environment.BORG_RSH = "ssh -i ${cfg.secretFiles.borgPrivateKey} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
|
|
preHook = ''
|
|
forgejoWasActive=/root/.cache/borg/forgejo-was-active
|
|
if ${pkgs.systemd}/bin/systemctl is-active --quiet forgejo.service; then
|
|
touch "$forgejoWasActive"
|
|
${pkgs.systemd}/bin/systemctl stop forgejo.service
|
|
else
|
|
rm -f "$forgejoWasActive"
|
|
fi
|
|
'';
|
|
postHook = ''
|
|
forgejoWasActive=/root/.cache/borg/forgejo-was-active
|
|
if [ -e "$forgejoWasActive" ]; then
|
|
${pkgs.systemd}/bin/systemctl start forgejo.service
|
|
rm -f "$forgejoWasActive"
|
|
fi
|
|
'';
|
|
};
|
|
};
|
|
|
|
security.acme = {
|
|
defaults = {
|
|
webroot = "/var/lib/acme/acme-challenge/";
|
|
email = "yisroel.d.baum@gmail.com";
|
|
};
|
|
acceptTerms = true;
|
|
};
|
|
|
|
systemd.services.borgbackup-job-forgejo = {
|
|
after = [
|
|
"sops-install-secrets.service"
|
|
"network-online.target"
|
|
];
|
|
wants = [ "network-online.target" ];
|
|
};
|
|
};
|
|
}
|