82 lines
3.5 KiB
Nix
82 lines
3.5 KiB
Nix
{
|
|
nixpkgs,
|
|
self,
|
|
system,
|
|
}:
|
|
let
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
evaluatedSystem = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
self.nixosModules.default
|
|
{
|
|
system.stateVersion = "25.11";
|
|
services.yisroelbaum-web = {
|
|
enable = true;
|
|
secretFiles = {
|
|
borgPassphrase = "/run/secrets/borg-passphrase";
|
|
borgPrivateKey = "/run/secrets/borg-private-key";
|
|
forgejoMailerUser = "/run/secrets/forgejo-mailer-user";
|
|
forgejoMailerPassword = "/run/secrets/forgejo-mailer-password";
|
|
rabbiGerziEnvironment = "/run/secrets/rabbi-gerzi.env";
|
|
};
|
|
};
|
|
}
|
|
];
|
|
};
|
|
evaluatedConfig = evaluatedSystem.config;
|
|
virtualHosts = evaluatedConfig.services.nginx.virtualHosts;
|
|
certificates = evaluatedConfig.security.acme.certs;
|
|
forgejoBackup = evaluatedConfig.services.borgbackup.jobs.forgejo;
|
|
forgejoBackupService = evaluatedConfig.systemd.services.borgbackup-job-forgejo;
|
|
publicHostNames = [
|
|
"yisroelbaum.com"
|
|
"jellyfin.yisroelbaum.com"
|
|
"git.yisroelbaum.com"
|
|
"rabbigerzi.yisroelbaum.com"
|
|
"rabbigerziapi.yisroelbaum.com"
|
|
];
|
|
in
|
|
assert evaluatedConfig.services.nginx.enable;
|
|
assert evaluatedConfig.services.jellyfin.enable;
|
|
assert evaluatedConfig.services.forgejo.enable;
|
|
assert evaluatedConfig.services.rabbi-gerzi.enable;
|
|
assert
|
|
virtualHosts."yisroelbaum.com".locations."/".root
|
|
== "${self.inputs.resume.packages.${system}.default}";
|
|
assert virtualHosts."jellyfin.yisroelbaum.com".locations."/".proxyPass == "http://localhost:8096";
|
|
assert virtualHosts."git.yisroelbaum.com".locations."/".proxyPass == "http://127.0.0.1:3000";
|
|
assert !virtualHosts."git.yisroelbaum.com".locations."/".recommendedProxySettings;
|
|
assert nixpkgs.lib.hasInfix "proxy_set_header X-Forwarded-Proto $scheme;"
|
|
virtualHosts."git.yisroelbaum.com".locations."/".extraConfig;
|
|
assert builtins.all (
|
|
hostName:
|
|
virtualHosts.${hostName}.forceSSL
|
|
&& virtualHosts.${hostName}.enableACME
|
|
&& certificates.${hostName}.domain == hostName
|
|
) publicHostNames;
|
|
assert builtins.all (certificate: !(nixpkgs.lib.hasPrefix "*." certificate.domain)) (
|
|
builtins.attrValues certificates
|
|
);
|
|
assert evaluatedConfig.services.forgejo.settings.server.ROOT_URL == "https://git.yisroelbaum.com/";
|
|
assert evaluatedConfig.services.forgejo.settings.server.DOMAIN == "git.yisroelbaum.com";
|
|
assert evaluatedConfig.services.forgejo.settings.server.SSH_PORT == 2222;
|
|
assert evaluatedConfig.services.forgejo.settings.mailer.FROM == "me@yisroelbaum.com";
|
|
assert evaluatedConfig.services.forgejo.secrets.mailer.USER == "/run/secrets/forgejo-mailer-user";
|
|
assert
|
|
evaluatedConfig.services.forgejo.secrets.mailer.PASSWD == "/run/secrets/forgejo-mailer-password";
|
|
assert evaluatedConfig.services.rabbi-gerzi.frontend.hostName == "rabbigerzi.yisroelbaum.com";
|
|
assert evaluatedConfig.services.rabbi-gerzi.backend.hostName == "rabbigerziapi.yisroelbaum.com";
|
|
assert
|
|
evaluatedConfig.services.rabbi-gerzi.backend.environmentFile == "/run/secrets/rabbi-gerzi.env";
|
|
assert forgejoBackup.repo == "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
|
|
assert forgejoBackup.startAt == "*-*-* 03:15:00";
|
|
assert forgejoBackup.persistentTimer;
|
|
assert forgejoBackup.prune.keep.daily == 7;
|
|
assert forgejoBackup.prune.keep.weekly == 4;
|
|
assert forgejoBackup.prune.keep.monthly == 6;
|
|
assert builtins.elem evaluatedConfig.services.forgejo.stateDir forgejoBackup.paths;
|
|
assert builtins.elem "sops-install-secrets.service" forgejoBackupService.after;
|
|
pkgs.runCommand "yisroelbaum-web-module-eval" { } ''
|
|
touch "$out"
|
|
''
|