138 lines
2.8 KiB
Nix
138 lines
2.8 KiB
Nix
{
|
|
modulesPath,
|
|
lib,
|
|
pkgs,
|
|
config,
|
|
inputs',
|
|
...
|
|
}:
|
|
let
|
|
inherit (lib.my) mkVHost;
|
|
in
|
|
{
|
|
imports = [
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
./disk-config.nix
|
|
./forgejo
|
|
./headscale
|
|
./fail2ban.nix
|
|
];
|
|
|
|
age.secrets = {
|
|
couchdb.file = ../../secrets/couchdb.age;
|
|
rustypaste = {
|
|
file = ../../secrets/rustypaste.age;
|
|
owner = "rustypaste";
|
|
group = "rustypaste";
|
|
};
|
|
forgejo-runner-token.file = ../../secrets/forgejo-runner-token.age;
|
|
};
|
|
|
|
boot.loader.grub = {
|
|
efiSupport = true;
|
|
efiInstallAsRemovable = true;
|
|
};
|
|
|
|
virtualisation.docker.enable = true;
|
|
|
|
modules = {
|
|
server.rustypaste = {
|
|
enable = true;
|
|
package = inputs'.nur.packages.rustypaste;
|
|
authTokenFile = config.age.secrets.rustypaste.path;
|
|
settings = {
|
|
server = {
|
|
url = "https://rusty.ccnlc.eu";
|
|
max_content_length = "1000MB";
|
|
timeout = "30s";
|
|
expose_version = false;
|
|
expose_list = false;
|
|
handle_spaces = "replace";
|
|
};
|
|
paste = {
|
|
random_url = {
|
|
type = "petname";
|
|
words = 3;
|
|
separator = "-";
|
|
};
|
|
default_extension = "txt";
|
|
mime_blacklist = [
|
|
"application/x-dosexec"
|
|
"application/java-archive"
|
|
"application/java-vm"
|
|
];
|
|
duplicate_files = false;
|
|
default_expiry = "1h";
|
|
delete_expired_files = {
|
|
enabled = true;
|
|
interval = "1h";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.tailscale = {
|
|
enable = true;
|
|
tags = [ "server" ];
|
|
extraFlags = [ "--accept-dns=false" ]; # Want to disable that since *server* can't access the private dns... for now
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
nftables.enable = true;
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
80 # for acme challenges
|
|
443
|
|
];
|
|
};
|
|
};
|
|
|
|
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
security = {
|
|
polkit.enable = true;
|
|
|
|
acme = {
|
|
defaults.email = "admin@ccnlc.eu";
|
|
acceptTerms = true;
|
|
};
|
|
};
|
|
|
|
services = {
|
|
fail2ban.enable = true;
|
|
headscale.enable = true;
|
|
|
|
nginx = {
|
|
package = pkgs.nginxQuic;
|
|
enable = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
clientMaxBodySize = "100M";
|
|
virtualHosts = builtins.listToAttrs [
|
|
(mkVHost "rusty.ccnlc.eu" 8000 true)
|
|
(mkVHost "hedgedoc.ccnlc.eu" 4739 true)
|
|
];
|
|
};
|
|
|
|
endlessh = {
|
|
enable = true;
|
|
port = 22;
|
|
openFirewall = true;
|
|
};
|
|
};
|
|
|
|
services.hedgedoc = {
|
|
enable = true;
|
|
settings = {
|
|
domain = "hedgedoc.ccnlc.eu";
|
|
host = "0.0.0.0";
|
|
port = 4739;
|
|
protocolUseSSL = true;
|
|
allowEmailRegister = false;
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "24.11";
|
|
}
|