m 2 *: krebs.nginx -> services.nginx
This commit is contained in:
makefu
parent
78c50fe495
commit
1745abde62
@ -20,42 +20,27 @@ let
|
||||
ext-dom = "paste.krebsco.de" ;
|
||||
in {
|
||||
|
||||
krebs.nginx.enable = mkDefault true;
|
||||
services.nginx.enable = mkDefault true;
|
||||
krebs.bepasty = {
|
||||
enable = true;
|
||||
serveNginx= true;
|
||||
|
||||
servers = {
|
||||
internal = {
|
||||
domain = "paste.r";
|
||||
nginx = {
|
||||
server-names = [ "paste.retiolum" "paste.r" "paste.${config.krebs.build.host.name}" ];
|
||||
serverAliases = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
|
||||
};
|
||||
defaultPermissions = "admin,list,create,read,delete";
|
||||
secretKey = secKey;
|
||||
};
|
||||
|
||||
external = {
|
||||
domain = ext-dom;
|
||||
nginx = {
|
||||
server-names = [ ext-dom ];
|
||||
ssl = {
|
||||
enable = true;
|
||||
certificate = "${acmepath}/${ext-dom}/fullchain.pem";
|
||||
certificate_key = "${acmepath}/${ext-dom}/key.pem";
|
||||
# these certs will be needed if acme has not yet created certificates:
|
||||
#certificate = "${sec}/wildcard.krebsco.de.crt";
|
||||
#certificate_key = "${sec}/wildcard.krebsco.de.key";
|
||||
ciphers = "RC4:HIGH:!aNULL:!MD5" ;
|
||||
force_encryption = true;
|
||||
};
|
||||
locations = singleton ( nameValuePair "/.well-known/acme-challenge" ''
|
||||
root ${acmechall}/${ext-dom}/;
|
||||
'');
|
||||
extraConfig = ''
|
||||
ssl_session_cache shared:SSL:1m;
|
||||
ssl_session_timeout 10m;
|
||||
ssl_verify_client off;
|
||||
proxy_ssl_session_reuse off;
|
||||
'';
|
||||
enableSSL = true;
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
defaultPermissions = "read";
|
||||
secretKey = secKey;
|
||||
|
||||
@ -27,23 +27,18 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
servers = {
|
||||
mybox-connector-one = {
|
||||
listen = [ "${external-ip}:80" ];
|
||||
server-names = [
|
||||
"mycube.connector.one"
|
||||
"mybox.connector.one"
|
||||
];
|
||||
locations = singleton (nameValuePair "/" ''
|
||||
virtualHosts."mybox.connector.one" = {
|
||||
locations = {
|
||||
"/".extraConfig = ''
|
||||
uwsgi_pass unix://${wsgi-sock};
|
||||
uwsgi_param UWSGI_CHDIR ${pkgs.mycube-flask}/${pkgs.python.sitePackages};
|
||||
uwsgi_param UWSGI_MODULE mycube.websrv;
|
||||
uwsgi_param UWSGI_CALLABLE app;
|
||||
|
||||
include ${pkgs.nginx}/conf/uwsgi_params;
|
||||
'');
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -1,11 +1,12 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
# graphite-web on port 8080
|
||||
# carbon cache on port 2003 (tcp/udp)
|
||||
# search also generates ddclient entries for all other logs
|
||||
|
||||
with import <stockholm/lib>;
|
||||
let
|
||||
#primary-itf = "eth0";
|
||||
primary-itf = "wlp2s0";
|
||||
#primary-itf = "wlp2s0";
|
||||
primary-itf = config.makefu.server.primary-itf;
|
||||
elch-sock = "${config.services.uwsgi.runDir}/uwsgi-elch.sock";
|
||||
ddclientUser = "ddclient";
|
||||
sec = toString <secrets>;
|
||||
@ -14,15 +15,7 @@ let
|
||||
cfg = "${stateDir}/cfg";
|
||||
ddclientPIDFile = "${stateDir}/ddclient.pid";
|
||||
|
||||
acmepath = "/var/lib/acme/";
|
||||
acmechall = acmepath + "/challenges/";
|
||||
# TODO: correct cert generation requires a `real` internet ip address
|
||||
stats-dom = "stats.nsupdate.info";
|
||||
search-dom = "search.nsupdate.info";
|
||||
search_ssl_cert = "${acmepath}/${search-dom}/fullchain.pem";
|
||||
search_ssl_key = "${acmepath}/${search-dom}/key.pem";
|
||||
stats_ssl_cert = "${acmepath}/${stats-dom}/fullchain.pem";
|
||||
stats_ssl_key = "${acmepath}/${stats-dom}/key.pem";
|
||||
|
||||
gen-cfg = dict: ''
|
||||
ssl=yes
|
||||
@ -64,75 +57,22 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.certs = {
|
||||
"${stats-dom}" = {
|
||||
email = "acme@syntax-fehler.de";
|
||||
webroot = "${acmechall}/${stats-dom}/";
|
||||
group = "nginx";
|
||||
allowKeysForGroup = true;
|
||||
postRun = "systemctl reload nginx.service";
|
||||
extraDomains = {
|
||||
"${stats-dom}" = null ;
|
||||
};
|
||||
};
|
||||
"${search-dom}" = {
|
||||
email = "acme@syntax-fehler.de";
|
||||
webroot = "${acmechall}/${search-dom}/";
|
||||
group = "nginx";
|
||||
allowKeysForGroup = true;
|
||||
postRun = "systemctl reload nginx.service";
|
||||
extraDomains = {
|
||||
"${stats-dom}" = null ;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
servers = {
|
||||
elch-stats = {
|
||||
server-names = [ stats-dom ];
|
||||
# listen = [ "80" "443 ssl" ];
|
||||
ssl = {
|
||||
enable = true;
|
||||
certificate = stats_ssl_cert;
|
||||
certificate_key = stats_ssl_key;
|
||||
force_encryption = true;
|
||||
};
|
||||
virtualHosts = {
|
||||
"search.nsupdate.info" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations = {
|
||||
"/".extraConfig = ''
|
||||
uwsgi_pass unix://${elch-sock};
|
||||
uwsgi_param UWSGI_CHDIR ${pkgs.elchhub}/${pkgs.python3.sitePackages};
|
||||
uwsgi_param UWSGI_MODULE elchhub.wsgi;
|
||||
uwsgi_param UWSGI_CALLABLE app;
|
||||
|
||||
locations = [
|
||||
(nameValuePair "/" ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_pass http://localhost:3000/;
|
||||
'')
|
||||
(nameValuePair "/.well-known/acme-challenge" ''
|
||||
root ${acmechall}/${search-dom}/;
|
||||
'')
|
||||
];
|
||||
};
|
||||
elchhub = {
|
||||
server-names = [ "search.nsupdate.info" ];
|
||||
# listen = [ "80" "443 ssl" ];
|
||||
ssl = {
|
||||
enable = true;
|
||||
certificate = search_ssl_cert;
|
||||
certificate_key = search_ssl_key;
|
||||
force_encryption = true;
|
||||
include ${pkgs.nginx}/conf/uwsgi_params;
|
||||
'';
|
||||
};
|
||||
locations = [ (nameValuePair "/" ''
|
||||
uwsgi_pass unix://${elch-sock};
|
||||
uwsgi_param UWSGI_CHDIR ${pkgs.elchhub}/${pkgs.python3.sitePackages};
|
||||
uwsgi_param UWSGI_MODULE elchhub.wsgi;
|
||||
uwsgi_param UWSGI_CALLABLE app;
|
||||
|
||||
include ${pkgs.nginx}/conf/uwsgi_params;
|
||||
'')
|
||||
(nameValuePair "/.well-known/acme-challenge" ''
|
||||
root ${acmechall}/${search-dom}/;
|
||||
'')
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
@ -147,7 +87,7 @@ in {
|
||||
ExecStart = "${pkgs.elchhub}/bin/elch-manager";
|
||||
};
|
||||
};
|
||||
register-elchos-nsupdate = {
|
||||
ddclient-nsupdate-elchos = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "ip-up.target" ];
|
||||
serviceConfig = {
|
||||
@ -163,49 +103,8 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
addr = "127.0.0.1";
|
||||
users.allowSignUp = false;
|
||||
users.allowOrgCreate = false;
|
||||
users.autoAssignOrg = false;
|
||||
auth.anonymous.enable = true;
|
||||
security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
|
||||
};
|
||||
|
||||
services.graphite = {
|
||||
api = {
|
||||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
port = 8080;
|
||||
};
|
||||
carbon = {
|
||||
enableCache = true;
|
||||
# save disk usage by restricting to 1 bulk update per second
|
||||
config = ''
|
||||
[cache]
|
||||
MAX_CACHE_SIZE = inf
|
||||
MAX_UPDATES_PER_SECOND = 1
|
||||
MAX_CREATES_PER_MINUTE = 500
|
||||
'';
|
||||
storageSchemas = ''
|
||||
[carbon]
|
||||
pattern = ^carbon\.
|
||||
retentions = 60:90d
|
||||
|
||||
[elchos]
|
||||
patterhn = ^elchos\.
|
||||
retentions = 10s:30d,60s:3y
|
||||
|
||||
[default]
|
||||
pattern = .*
|
||||
retentions = 30s:30d,300s:1y
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 2003 80 443 ];
|
||||
allowedUDPPorts = [ 2003 ];
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
allowedUDPPorts = [ ];
|
||||
};
|
||||
}
|
||||
|
||||
@ -3,13 +3,9 @@
|
||||
with import <stockholm/lib>;
|
||||
let
|
||||
sec = toString <secrets>;
|
||||
ssl_cert = "${sec}/wildcard.krebsco.de.crt";
|
||||
ssl_key = "${sec}/wildcard.krebsco.de.key";
|
||||
hostname = config.krebs.build.host.name;
|
||||
user = config.services.nginx.user;
|
||||
group = config.services.nginx.group;
|
||||
external-ip = config.krebs.build.host.nets.internet.ip4.addr;
|
||||
internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
|
||||
base-dir = "/var/www/blog.euer";
|
||||
in {
|
||||
# Prepare Blog directory
|
||||
@ -32,24 +28,15 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
servers = {
|
||||
euer-blog = {
|
||||
listen = [ "${external-ip}:80" "${external-ip}:443 ssl"
|
||||
"${internal-ip}:80" "${internal-ip}:443 ssl" ];
|
||||
server-names = [ "euer.krebsco.de" "blog.euer.krebsco.de" "blog.${hostname}" ];
|
||||
extraConfig = ''
|
||||
gzip on;
|
||||
gzip_buffers 4 32k;
|
||||
gzip_types text/plain application/x-javascript text/css;
|
||||
ssl_certificate ${ssl_cert};
|
||||
ssl_certificate_key ${ssl_key};
|
||||
default_type text/plain;
|
||||
'';
|
||||
locations = singleton (nameValuePair "/" ''
|
||||
root ${base-dir};
|
||||
'');
|
||||
virtualHosts = {
|
||||
"euer.krebsco.de" = {
|
||||
#serverAliases = [ "blog.euer.krebsco.de" "blog.${hostname}" ];
|
||||
enableSSL = true;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
root = base-dir;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -8,18 +8,16 @@ let
|
||||
external-ip = config.krebs.build.host.nets.internet.ip4.addr;
|
||||
internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
|
||||
in {
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
servers = {
|
||||
euer-share = {
|
||||
listen = [ ];
|
||||
server-names = [ "share.euer.krebsco.de" ];
|
||||
locations = singleton (nameValuePair "/" ''
|
||||
virtualHosts."share.euer.krebsco.de" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8000/";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_pass http://localhost:8000/;
|
||||
'');
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -4,13 +4,6 @@ with import <stockholm/lib>;
|
||||
let
|
||||
sec = toString <secrets>;
|
||||
ext-dom = "wiki.euer.krebsco.de";
|
||||
acmepath = "/var/lib/acme/";
|
||||
acmechall = acmepath + "/challenges/";
|
||||
|
||||
#ssl_cert = "${sec}/wildcard.krebsco.de.crt";
|
||||
#ssl_key = "${sec}/wildcard.krebsco.de.key";
|
||||
ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem";
|
||||
ssl_key = "${acmepath}/${ext-dom}/key.pem";
|
||||
|
||||
user = config.services.nginx.user;
|
||||
group = config.services.nginx.group;
|
||||
@ -25,8 +18,7 @@ let
|
||||
# user1 = pass1
|
||||
# userN = passN
|
||||
tw-pass-file = "${sec}/tw-pass.ini";
|
||||
external-ip = config.krebs.build.host.nets.internet.ip4.addr;
|
||||
internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
|
||||
|
||||
in {
|
||||
services.phpfpm = {
|
||||
# phpfpm does not have an enable option
|
||||
@ -79,24 +71,18 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
servers = {
|
||||
euer-wiki = {
|
||||
listen = [ "${external-ip}:80" "${external-ip}:443 ssl"
|
||||
"${internal-ip}:80" "${internal-ip}:443 ssl" ];
|
||||
server-names = [
|
||||
ext-dom
|
||||
"wiki.makefu.retiolum"
|
||||
"wiki.makefu"
|
||||
];
|
||||
ssl = {
|
||||
enable = true;
|
||||
# these certs will be needed if acme has not yet created certificates:
|
||||
certificate = ssl_cert;
|
||||
certificate_key = ssl_key;
|
||||
force_encryption = true;
|
||||
};
|
||||
virtualHosts = {
|
||||
"${ext-dom}" = {
|
||||
#serverAliases = [
|
||||
# "wiki.makefu.retiolum"
|
||||
# "wiki.makefu"
|
||||
#];
|
||||
enableSSL = true;
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
# recommendedGzipSettings = true;
|
||||
extraConfig = ''
|
||||
gzip on;
|
||||
gzip_buffers 4 32k;
|
||||
@ -104,34 +90,26 @@ in {
|
||||
default_type text/plain;
|
||||
|
||||
'';
|
||||
locations = [
|
||||
(nameValuePair "/" ''
|
||||
root ${wiki-dir};
|
||||
expires -1;
|
||||
autoindex on;
|
||||
'')
|
||||
(nameValuePair "/store.php" ''
|
||||
root ${tw-upload};
|
||||
client_max_body_size 200M;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:${fpm-socket};
|
||||
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||
'')
|
||||
(nameValuePair "/.well-known/acme-challenge" ''
|
||||
root ${acmechall}/${ext-dom}/;
|
||||
'')
|
||||
|
||||
];
|
||||
locations = {
|
||||
"/" = {
|
||||
root = wiki-dir;
|
||||
extraConfig = ''
|
||||
expires -1;
|
||||
autoindex on;
|
||||
'';
|
||||
};
|
||||
"/store.php" = {
|
||||
root = tw-upload;
|
||||
extraConfig = ''
|
||||
client_max_body_size 200M;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:${fpm-socket};
|
||||
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
security.acme.certs."${ext-dom}" = {
|
||||
email = "acme@syntax-fehler.de";
|
||||
webroot = "${acmechall}/${ext-dom}/";
|
||||
group = "nginx";
|
||||
allowKeysForGroup = true;
|
||||
postRun = "systemctl reload nginx.service";
|
||||
extraDomains."${ext-dom}" = null ;
|
||||
};
|
||||
}
|
||||
|
||||
@ -10,19 +10,17 @@ let
|
||||
sha256 = "0l8q7kw3w1kpvmy8hza9vr5liiycivbljkmwpacaifbay5y98z58";
|
||||
};
|
||||
in{
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
servers.default = {
|
||||
extraConfig = ''
|
||||
root ${icecult}/app;
|
||||
virtualHosts.default = {
|
||||
root = "${icecult}/app";
|
||||
locations = {
|
||||
"/rpc".proxyPass = "http://10.42.22.163:3121";
|
||||
"/rpc".extraConfig = ''
|
||||
rewrite /rpc/(.*) /$1 break;
|
||||
proxy_http_version 1.1;
|
||||
'';
|
||||
locations = [
|
||||
(nameValuePair "/rpc" ''
|
||||
rewrite /rpc/(.*) /$1 break;
|
||||
proxy_http_version 1.1;
|
||||
proxy_pass http://10.42.22.163:3121;
|
||||
'')
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -3,13 +3,16 @@
|
||||
with import <stockholm/lib>;
|
||||
|
||||
{
|
||||
krebs.nginx = {
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
servers.default.locations = [
|
||||
(nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
|
||||
alias /home/$1/public_html$2;
|
||||
autoindex on;
|
||||
'')
|
||||
];
|
||||
virtualHosts.default = {
|
||||
default = true;
|
||||
locations = {
|
||||
"~ ^/~(.+?)(/.*)?\$".extraConfig = ''
|
||||
alias /home/$1/public_html$2;
|
||||
autoindex on;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,25 +1,19 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with import <stockholm/lib>;
|
||||
let
|
||||
hostname = config.krebs.build.host.name;
|
||||
external-ip = config.krebs.build.host.nets.internet.ip4.addr;
|
||||
in {
|
||||
krebs.nginx = {
|
||||
{
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
servers = {
|
||||
update-connector-one = {
|
||||
listen = [ "${external-ip}:80" ];
|
||||
server-names = [
|
||||
"update.connector.one"
|
||||
"firmware.connector.one"
|
||||
];
|
||||
locations = singleton (nameValuePair "/" ''
|
||||
autoindex on;
|
||||
root /var/www/update.connector.one;
|
||||
sendfile on;
|
||||
gzip on;
|
||||
'');
|
||||
virtualHosts."update.connector.one" = {
|
||||
locations = {
|
||||
"/" = {
|
||||
root = "/var/www/update.connector.one";
|
||||
extraConfig = ''
|
||||
autoindex on;
|
||||
sendfile on;
|
||||
gzip on;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
Loading…
Reference in New Issue
Block a user