forked from c3d2/nix-config
Add gemini container
This commit is contained in:
parent
00e84344e4
commit
2d3e83c43c
66
flake.lock
66
flake.lock
|
@ -23,7 +23,7 @@
|
|||
},
|
||||
"fenix_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"rust-analyzer-src": "rust-analyzer-src_2"
|
||||
},
|
||||
"locked": {
|
||||
|
@ -40,6 +40,23 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gemini": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1639155521,
|
||||
"narHash": "sha256-Lh74QEjPIPZSZNvz1zPKEqEjSA6eIci0eDRoZJKIYeE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "flake-gemini",
|
||||
"rev": "2900f752c983974a03e66077f1e6522764486aed",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"id": "gemini",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"heliwatch": {
|
||||
"inputs": {
|
||||
"fenix": "fenix_2",
|
||||
|
@ -65,7 +82,7 @@
|
|||
},
|
||||
"naersk": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1639947939,
|
||||
|
@ -118,16 +135,16 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1644278373,
|
||||
"narHash": "sha256-9riYZyVing7OQUUWELSojlbt9u0xDh0Xm5Eg8FQn0fc=",
|
||||
"owner": "nixos",
|
||||
"lastModified": 1639153468,
|
||||
"narHash": "sha256-AXlstb8jjYs8HKGTLOuSjIdFLyPQSI5aYPN34qUy+Rc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "60c52a73f1d5858020ac4f161cd5bf1c9650f8b8",
|
||||
"rev": "cf8f41fe116c8e733c833acd4759d9261ecd6d1f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"owner": "NixOS",
|
||||
"ref": "release-21.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
|
@ -179,6 +196,22 @@
|
|||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1644278373,
|
||||
"narHash": "sha256-9riYZyVing7OQUUWELSojlbt9u0xDh0Xm5Eg8FQn0fc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "60c52a73f1d5858020ac4f161cd5bf1c9650f8b8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1644151317,
|
||||
"narHash": "sha256-TpXGBYCFKvEN7Q+To45rn4kqTbLPY4f56rF6ymUGGRE=",
|
||||
|
@ -192,7 +225,7 @@
|
|||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1644328695,
|
||||
"narHash": "sha256-rK1HXS35XOO3PksBnJzbv93G9wqZsk61gi22j8dtOt0=",
|
||||
|
@ -208,7 +241,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"nixpkgs_5": {
|
||||
"locked": {
|
||||
"lastModified": 1637209424,
|
||||
"narHash": "sha256-oXw75hkCOVtoB+CEElWiTmkC1gNdL3jf0tG2GInytHA=",
|
||||
|
@ -224,7 +257,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_5": {
|
||||
"nixpkgs_6": {
|
||||
"locked": {
|
||||
"lastModified": 1638097282,
|
||||
"narHash": "sha256-EXCzj9b8X/lqDPJapxZThIOKL5ASbpsJZ+8L1LnY1ig=",
|
||||
|
@ -240,7 +273,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_6": {
|
||||
"nixpkgs_7": {
|
||||
"locked": {
|
||||
"lastModified": 1641924320,
|
||||
"narHash": "sha256-DuOpJqoMmQ3Yk4C64QQHFaByhbSIi872He6z5BXY1YM=",
|
||||
|
@ -276,10 +309,11 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"fenix": "fenix",
|
||||
"gemini": "gemini",
|
||||
"heliwatch": "heliwatch",
|
||||
"naersk": "naersk_2",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs": "nixpkgs_4",
|
||||
"nixpkgs-mobilizon": "nixpkgs-mobilizon",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"scrapers": "scrapers",
|
||||
|
@ -344,7 +378,7 @@
|
|||
},
|
||||
"secrets": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_4",
|
||||
"nixpkgs": "nixpkgs_5",
|
||||
"sops-nix": [
|
||||
"sops-nix"
|
||||
]
|
||||
|
@ -365,7 +399,7 @@
|
|||
},
|
||||
"sops-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_5"
|
||||
"nixpkgs": "nixpkgs_6"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1644240878,
|
||||
|
@ -467,7 +501,7 @@
|
|||
},
|
||||
"zentralwerk": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_6",
|
||||
"nixpkgs": "nixpkgs_7",
|
||||
"nixpkgs-master": "nixpkgs-master",
|
||||
"openwrt": "openwrt"
|
||||
},
|
||||
|
|
12
flake.nix
12
flake.nix
|
@ -28,7 +28,7 @@
|
|||
fenix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = inputs@{ self, nixpkgs, secrets, nixos-hardware, zentralwerk, yammat, scrapers, spacemsg, tigger, ticker, heliwatch, sops-nix, naersk, fenix, ... }:
|
||||
outputs = inputs@{ self, nixpkgs, secrets, nixos-hardware, zentralwerk, yammat, scrapers, spacemsg, tigger, ticker, heliwatch, sops-nix, naersk, fenix, gemini, ... }:
|
||||
let
|
||||
inherit (nixpkgs) lib;
|
||||
forAllSystems = lib.genAttrs [ "aarch64-linux" "x86_64-linux" ];
|
||||
|
@ -243,6 +243,16 @@
|
|||
];
|
||||
};
|
||||
|
||||
gemini = nixosSystem' {
|
||||
nixpkgs = inputs.nixpkgs-unstable;
|
||||
modules = [
|
||||
./config/lxc-container.nix
|
||||
./hosts/containers/gemini
|
||||
gemini.nixosModules.duckling-proxy
|
||||
gemini.nixosModules.kineto
|
||||
];
|
||||
};
|
||||
|
||||
gitea = nixosSystem' {
|
||||
nixpkgs = inputs.nixpkgs-unstable;
|
||||
modules = [
|
||||
|
|
|
@ -12,6 +12,13 @@
|
|||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMFbxHGfBMBjjior1FNRub56O62K++HVnqUH67BeKD7d";
|
||||
};
|
||||
|
||||
gemini = {
|
||||
ip6 = "2a00:8180:2c00:223:58f4:2eff:fe48:5216";
|
||||
# ygg = "30c:c3d2:b946:76d0:58f4:2eff:fe48:5216";
|
||||
publicKey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvB3MTO5+MJk8/sojF+bX0MBz9BLwo3FRH5SjIbrfeH";
|
||||
};
|
||||
|
||||
gitea.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8MmjiiRmiyUqRYs5a07m7qKDwxh2NwvS2h7pm2b+zx";
|
||||
|
||||
glotzbert = {
|
||||
|
|
62
hosts/containers/gemini/default.nix
Normal file
62
hosts/containers/gemini/default.nix
Normal file
|
@ -0,0 +1,62 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let fqdn = "gemini.c3d2.de";
|
||||
in {
|
||||
imports = [ ./users.nix ];
|
||||
|
||||
c3d2.hq.statistics.enable = true;
|
||||
c3d2.autoUpdate = true;
|
||||
|
||||
networking.hostName = "gemini";
|
||||
networking.hosts."::1" = [ fqdn ];
|
||||
|
||||
networking.firewall.enable = false;
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
config.services.molly-brown.settings.Port
|
||||
config.services.duckling-proxy.port
|
||||
];
|
||||
|
||||
services.duckling-proxy = {
|
||||
enable = true;
|
||||
address = "0.0.0.0";
|
||||
port = 1966;
|
||||
serverCert = "/var/lib/acme/${fqdn}/cert.pem";
|
||||
serverKey = "/var/lib/acme/${fqdn}/key.pem";
|
||||
};
|
||||
|
||||
services.kineto = {
|
||||
enable = true;
|
||||
port = 1967;
|
||||
geminiDomain = "gemini://${fqdn}";
|
||||
};
|
||||
|
||||
services.molly-brown = {
|
||||
enable = true;
|
||||
hostName = fqdn;
|
||||
certPath = "/var/lib/acme/${fqdn}/cert.pem";
|
||||
keyPath = "/var/lib/acme/${fqdn}/key.pem";
|
||||
docBase = "/var/gemini";
|
||||
settings = {
|
||||
DefaultLang = "de";
|
||||
ReadMollyFiles = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${fqdn} = {
|
||||
default = true;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:1967";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.duckling-proxy.serviceConfig.SupplementaryGroups =
|
||||
[ config.security.acme.certs.${fqdn}.group ];
|
||||
|
||||
systemd.services.molly-brown.serviceConfig.SupplementaryGroups =
|
||||
[ config.security.acme.certs.${fqdn}.group ];
|
||||
}
|
18
hosts/containers/gemini/users.nix
Normal file
18
hosts/containers/gemini/users.nix
Normal file
|
@ -0,0 +1,18 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
{
|
||||
system.activationScripts.gemini = ''
|
||||
mkdir -p ${config.services.molly-brown.docBase}/users/
|
||||
'' + lib.strings.concatStrings (lib.attrsets.mapAttrsToList (name:
|
||||
{ isNormalUser, home, ... }:
|
||||
lib.strings.optionalString (isNormalUser && home != null) ''
|
||||
ln -sf ${home}/public_gemini ${config.services.molly-brown.docBase}/users/${name}
|
||||
'') config.users.users);
|
||||
|
||||
users.users = lib.attrsets.mapAttrs (name:
|
||||
{ sshKeys, ... }: {
|
||||
createHome = true;
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keys = sshKeys;
|
||||
}) config.c3d2.users;
|
||||
}
|
Loading…
Reference in New Issue
Block a user