rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2024-11-15 05:13:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

nuc: switch to caddy

Browse source
This commit is contained in:
Rouven Seifert 2024-05-21 18:44:04 +02:00
parent 6e82ae5be8
commit 657ae1385e
10 changed files with 69 additions and 98 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
hosts/falkenstein/modules/dns/default.nix
View file

@ -35,8 +35,10 @@ let
subdomains =
let
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.nginx.virtualHosts);
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
getVirtualHostsNginx = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.nginx.virtualHosts);
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (label: { CNAME = [ "${hostname}.${domain}." ]; });
genCNAMEsNginx = hostname: lib.attrsets.genAttrs (getVirtualHostsNginx hostname) (label: { CNAME = [ "${hostname}.${domain}." ]; });
in
lib.attrsets.mergeAttrsList [
rec {
@ -54,7 +56,9 @@ let
}
(genCNAMEs "nuc")
(genCNAMEsNginx "nuc")
(builtins.removeAttrs (genCNAMEs "falkenstein") [ "mail" ])
(builtins.removeAttrs (genCNAMEsNginx "falkenstein") [ "mail" ])
];
});
in

4
hosts/nuc/default.nix
View file

@ -8,7 +8,6 @@
./modules/networks
./modules/adguard
./modules/backup
# ./modules/keycloak
./modules/jellyfin
./modules/cache
./modules/matrix
@ -16,7 +15,8 @@
./modules/seafile
./modules/torrent
./modules/vaultwarden
./modules/nginx
# ./modules/nginx
./modules/caddy
./modules/indexing
];

13
hosts/nuc/modules/authentik/default.nix
View file

@ -9,10 +9,13 @@ in
services.authentik = {
enable = true;
environmentFile = config.age.secrets.authentik.path;
nginx = {
enable = true;
enableACME = true;
host = domain;
};
# nginx = {
# enable = true;
# enableACME = true;
# host = domain;
# };
};
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy localhost:9000
'';
}

8
hosts/nuc/modules/cache/default.nix vendored
View file

@ -10,9 +10,7 @@ in
enable = true;
secretKeyFile = config.age.secrets.cache.path;
};
services.nginx.virtualHosts."${domain}" = {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.nix-serve.port}";
};
};
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.nix-serve.port}
'';
}

10
hosts/nuc/modules/caddy/default.nix Normal file
View file

@ -0,0 +1,10 @@
{ config, ... }:
{
services.caddy = {
enable = true;
email = "ca@${config.networking.domain}";
logFormat = "format console";
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 443 ];
}

43
hosts/nuc/modules/keycloak/default.nix
View file

@ -1,43 +0,0 @@
{ config, ... }:
let
domain = "auth.${config.networking.domain}";
in
{
age.secrets.keycloak = {
file = ../../../../secrets/nuc/keycloak/db.age;
};
services.keycloak = {
enable = true;
settings = {
http-port = 8084;
https-port = 19000;
hostname = domain;
# proxy-headers = "forwarded";
proxy = "edge";
};
database = {
# host = "/var/run/postgresql/.s.PGSQL.5432";
# useSSL = false;
# createLocally = false;
passwordFile = config.age.secrets.keycloak.path;
};
initialAdminPassword = "plschangeme";
};
# services.postgresql = {
# enable = true;
# ensureUsers = [
# {
# name = "keycloak";
# ensureDBOwnership = true;
# }
# ];
# ensureDatabases = [ "keycloak" ];
# };
services.nginx.virtualHosts."${domain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.keycloak.settings.http-port}";
};
};
}

45
hosts/nuc/modules/matrix/default.nix
View file

@ -32,6 +32,7 @@ in
matrix-synapse = {
enable = true;
configureRedisLocally = true;
enableRegistrationScript = false;
extraConfigFiles = [ config.age.secrets."matrix/shared".path ];
log = {
root.level = "WARNING";
@ -41,10 +42,9 @@ in
server_name = config.networking.domain;
listeners = [{
port = 8008;
bind_addresses = [ "::1" ];
path = "/run/matrix-synapse/server.sock";
mode = "666";
type = "http";
tls = false;
x_forwarded = true;
resources = [{
names = [ "client" "federation" ];
@ -57,29 +57,24 @@ in
enable = true;
settings = {
SYNCV3_SERVER = "https://${domain}";
SYNCV3_BINDADDR = "/run/matrix-sliding-sync/server.sock";
};
environmentFile = config.age.secrets."matrix/sync".path;
};
nginx = {
recommendedProxySettings = true;
caddy = {
virtualHosts = {
# synapse
"${domain}" = {
# locations."/".extraConfig = "return 404;";
# # proxy to synapse
# locations."/_matrix".proxyPass = "http://[::1]:8008";
locations."/".proxyPass = "http://[::1]:8008";
locations."~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)".proxyPass = "http://localhost:8009";
# locations."/_synapse/client".proxyPass = "http://[::1]:8008";
};
"${domain}".extraConfig = ''
reverse_proxy /client/* unix//run/matrix-sliding-sync/server.sock
reverse_proxy /_matrix/client/unstable/org.matrix.msc3575/sync* unix//run/matrix-sliding-sync/server.sock
reverse_proxy unix//run/matrix-synapse/server.sock
'';
# element
"${domainClient}" = {
root = pkgs.element-web.override {
"${domainClient}".extraConfig = ''
root '${pkgs.element-web.override {
conf = {
default_server_config = {
inherit (clientConfig) "m.homeserver";
@ -87,13 +82,23 @@ in
};
disable_3pid_login = true;
};
};
};
}}'
'';
};
};
};
systemd.services.matrix-synapse.after = [ "matrix-synapse-pgsetup.service" ];
systemd.services.matrix-synapse = {
after = [ "matrix-synapse-pgsetup.service" ];
serviceConfig = {
RuntimeDirectory = "matrix-synapse";
};
};
systemd.services.matrix-sliding-sync = {
serviceConfig = {
RuntimeDirectory = "matrix-sliding-sync";
};
};
systemd.services.matrix-synapse-pgsetup = {
description = "Prepare Synapse postgres database";

29
hosts/nuc/modules/seafile/default.nix
View file

@ -31,21 +31,16 @@ in
}
'';
};
services.nginx.virtualHosts."${domain}" = {
locations."/" = {
proxyPass = "http://unix:/run/seahub/gunicorn.sock";
};
locations."/seafhttp" = {
proxyPass = "http://127.0.0.1:${toString config.services.seafile.seafileSettings.fileserver.port}";
extraConfig = ''
rewrite ^/seafhttp(.*)$ $1 break;
'';
};
locations."/media" = {
root = pkgs.seahub;
};
locations."/accounts/login" = {
return = "301 /oauth/login";
};
};
services.caddy.virtualHosts."${domain}".extraConfig = ''
redir /accounts/login /oauth/login
reverse_proxy unix//run/seahub/gunicorn.sock
route /media/* {
root '${pkgs.seahub}'
}
route /seafhttp/* {
uri strip_prefix /seafhttp
reverse_proxy 127.0.0.1:${toString config.services.seafile.seafileSettings.fileserver.port}
}
'';
}

8
hosts/nuc/modules/vaultwarden/default.nix
View file

@ -29,9 +29,7 @@ in
];
ensureDatabases = [ "vaultwarden" ];
};
services.nginx.virtualHosts."${domain}" = {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.rocketPort}";
};
};
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.vaultwarden.config.rocketPort}
'';
}

1
shared/zsh.nix
View file

@ -9,6 +9,7 @@
trash-cli
nix-output-monitor
iperf
jq
];
users.defaultUserShell = pkgs.zsh;
programs.fzf = {