Merge remote-tracking branch 'pnp/master'
This commit is contained in:
commit
692a59423a
@ -166,6 +166,7 @@ with lib;
|
|||||||
wry IN A ${head nets.internet.addrs4}
|
wry IN A ${head nets.internet.addrs4}
|
||||||
io IN NS wry.krebsco.de.
|
io IN NS wry.krebsco.de.
|
||||||
graphs IN A ${head nets.internet.addrs4}
|
graphs IN A ${head nets.internet.addrs4}
|
||||||
|
paste 60 IN A ${head nets.internet.addrs4}
|
||||||
tinc IN A ${head nets.internet.addrs4}
|
tinc IN A ${head nets.internet.addrs4}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
@ -174,6 +175,7 @@ with lib;
|
|||||||
addrs4 = ["104.233.87.86"];
|
addrs4 = ["104.233.87.86"];
|
||||||
aliases = [
|
aliases = [
|
||||||
"wry.internet"
|
"wry.internet"
|
||||||
|
"paste.internet"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
retiolum = {
|
retiolum = {
|
||||||
@ -182,6 +184,8 @@ with lib;
|
|||||||
addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"];
|
addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"];
|
||||||
aliases = [
|
aliases = [
|
||||||
"graphs.wry.retiolum"
|
"graphs.wry.retiolum"
|
||||||
|
"paste.wry.retiolum"
|
||||||
|
"paste.retiolum"
|
||||||
"wry.retiolum"
|
"wry.retiolum"
|
||||||
];
|
];
|
||||||
tinc.pubkey = ''
|
tinc.pubkey = ''
|
||||||
@ -210,8 +214,7 @@ with lib;
|
|||||||
"krebsco.de" = ''
|
"krebsco.de" = ''
|
||||||
omo IN A ${head nets.internet.addrs4}
|
omo IN A ${head nets.internet.addrs4}
|
||||||
euer IN A ${head nets.internet.addrs4}
|
euer IN A ${head nets.internet.addrs4}
|
||||||
gum IN A ${head nets.internet.addrs4}
|
gum IN A ${head nets.internet.addrs4} '';
|
||||||
paste IN A ${head nets.internet.addrs4}'';
|
|
||||||
};
|
};
|
||||||
nets = {
|
nets = {
|
||||||
internet = {
|
internet = {
|
||||||
|
@ -36,7 +36,7 @@ let
|
|||||||
type = with types; listOf (attrsOf str);
|
type = with types; listOf (attrsOf str);
|
||||||
};
|
};
|
||||||
extraConfig = mkOption {
|
extraConfig = mkOption {
|
||||||
type = with types; str;
|
type = with types; string;
|
||||||
default = "";
|
default = "";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -16,6 +16,14 @@ let
|
|||||||
description = "hostname which serves tinc boot";
|
description = "hostname which serves tinc boot";
|
||||||
default = "tinc.krebsco.de" ;
|
default = "tinc.krebsco.de" ;
|
||||||
};
|
};
|
||||||
|
listen = mkOption {
|
||||||
|
type = with types; listOf str;
|
||||||
|
description = ''Addresses to listen on (nginx-syntax).
|
||||||
|
ssl will be configured, http will be redirected to ssl.
|
||||||
|
Make sure to have at least 1 ssl port configured.
|
||||||
|
'';
|
||||||
|
default = [ "80" "443 ssl" ] ;
|
||||||
|
};
|
||||||
ssl_certificate_key = mkOption {
|
ssl_certificate_key = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
description = "Certificate key to use for ssl";
|
description = "Certificate key to use for ssl";
|
||||||
@ -33,19 +41,17 @@ let
|
|||||||
|
|
||||||
imp = {
|
imp = {
|
||||||
krebs.nginx.servers = assert config.krebs.nginx.enable; {
|
krebs.nginx.servers = assert config.krebs.nginx.enable; {
|
||||||
retiolum-boot-redir = {
|
|
||||||
server-names = singleton cfg.hostname;
|
|
||||||
extraConfig = ''
|
|
||||||
return 301 https://$server_name$request_uri;
|
|
||||||
'';
|
|
||||||
locations = [];
|
|
||||||
};
|
|
||||||
retiolum-boot-ssl = {
|
retiolum-boot-ssl = {
|
||||||
server-names = singleton cfg.hostname;
|
server-names = singleton cfg.hostname;
|
||||||
listen = "443 ssl";
|
listen = cfg.listen;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
ssl_certificate ${cfg.ssl_certificate};
|
ssl_certificate ${cfg.ssl_certificate};
|
||||||
ssl_certificate_key ${cfg.ssl_certificate_key};
|
ssl_certificate_key ${cfg.ssl_certificate_key};
|
||||||
|
|
||||||
|
if ($scheme = http){
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
root ${pkgs.retiolum-bootstrap};
|
root ${pkgs.retiolum-bootstrap};
|
||||||
try_files $uri $uri/retiolum.sh;
|
try_files $uri $uri/retiolum.sh;
|
||||||
'';
|
'';
|
||||||
|
@ -1,59 +1,72 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
let
|
let
|
||||||
|
|
||||||
ip = (lib.head config.krebs.build.host.nets.internet.addrs4);
|
external-ip = head config.krebs.build.host.nets.internet.addrs4;
|
||||||
|
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
|
||||||
in {
|
in {
|
||||||
imports = [
|
imports = [
|
||||||
# TODO: copy this config or move to krebs
|
# TODO: copy this config or move to krebs
|
||||||
../../tv/2configs/CAC-CentOS-7-64bit.nix
|
../../tv/2configs/CAC-CentOS-7-64bit.nix
|
||||||
../2configs/base.nix
|
../2configs/base.nix
|
||||||
../2configs/base-sources.nix
|
../2configs/unstable-sources.nix
|
||||||
../2configs/tinc-basic-retiolum.nix
|
../2configs/tinc-basic-retiolum.nix
|
||||||
|
|
||||||
|
../2configs/bepasty-dual.nix
|
||||||
|
|
||||||
../2configs/iodined.nix
|
../2configs/iodined.nix
|
||||||
|
|
||||||
# Reaktor
|
# Reaktor
|
||||||
../2configs/Reaktor/simpleExtend.nix
|
../2configs/Reaktor/simpleExtend.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
krebs.Reaktor.enable = true;
|
|
||||||
|
|
||||||
networking.firewall.allowPing = true;
|
|
||||||
networking.interfaces.enp2s1.ip4 = [
|
|
||||||
{
|
|
||||||
address = ip;
|
|
||||||
prefixLength = 24;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
networking.defaultGateway = "104.233.87.1";
|
|
||||||
networking.nameservers = [
|
|
||||||
"8.8.8.8"
|
|
||||||
];
|
|
||||||
|
|
||||||
# based on ../../tv/2configs/CAC-Developer-2.nix
|
|
||||||
sound.enable = false;
|
|
||||||
|
|
||||||
# prepare graphs
|
|
||||||
nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
|
|
||||||
|
|
||||||
krebs.nginx.enable = true;
|
|
||||||
krebs.retiolum-bootstrap.enable = true;
|
|
||||||
makefu.tinc_graphs.enable = true;
|
|
||||||
|
|
||||||
makefu.tinc_graphs.krebsNginx = {
|
|
||||||
enable = true;
|
|
||||||
# TODO: remove hard-coded hostname
|
|
||||||
hostnames_complete = [ "graphs.wry" ];
|
|
||||||
hostnames_anonymous = [ "graphs.krebsco.de" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 53 80 443 ];
|
|
||||||
|
|
||||||
krebs.build = {
|
krebs.build = {
|
||||||
user = config.krebs.users.makefu;
|
user = config.krebs.users.makefu;
|
||||||
target = "root@${ip}";
|
target = "root@wry";
|
||||||
host = config.krebs.hosts.wry;
|
host = config.krebs.hosts.wry;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
krebs.Reaktor.enable = true;
|
||||||
|
|
||||||
|
# bepasty to listen only on the correct interfaces
|
||||||
|
krebs.bepasty.servers.internal.nginx.listen = [ "${internal-ip}:80" ];
|
||||||
|
krebs.bepasty.servers.external.nginx.listen = [ "${external-ip}:80" "${external-ip}:443 ssl" ];
|
||||||
|
|
||||||
|
# prepare graphs
|
||||||
|
krebs.nginx.enable = true;
|
||||||
|
krebs.retiolum-bootstrap.enable = true;
|
||||||
|
|
||||||
|
nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
|
||||||
|
makefu.tinc_graphs = {
|
||||||
|
enable = true;
|
||||||
|
nginx = {
|
||||||
|
enable = true;
|
||||||
|
# TODO: remove hard-coded hostname
|
||||||
|
complete = {
|
||||||
|
listen = [ "${internal-ip}:80" ];
|
||||||
|
server-names = [ "graphs.wry" ];
|
||||||
|
};
|
||||||
|
anonymous = {
|
||||||
|
listen = [ "${external-ip}:80" ] ;
|
||||||
|
server-names = [ "graphs.krebsco.de" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
networking = {
|
||||||
|
firewall.allowPing = true;
|
||||||
|
firewall.allowedTCPPorts = [ 53 80 443 ];
|
||||||
|
interfaces.enp2s1.ip4 = [{
|
||||||
|
address = external-ip;
|
||||||
|
prefixLength = 24;
|
||||||
|
}];
|
||||||
|
defaultGateway = "104.233.87.1";
|
||||||
|
nameservers = [ "8.8.8.8" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
# based on ../../tv/2configs/CAC-Developer-2.nix
|
||||||
|
sound.enable = false;
|
||||||
}
|
}
|
||||||
|
52
makefu/2configs/bepasty-dual.nix
Normal file
52
makefu/2configs/bepasty-dual.nix
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
# 1systems should configure itself:
|
||||||
|
# krebs.bepasty.servers.internal.nginx.listen = [ "80" ]
|
||||||
|
# krebs.bepasty.servers.external.nginx.listen = [ "80" "443 ssl" ]
|
||||||
|
# 80 is redirected to 443 ssl
|
||||||
|
|
||||||
|
# secrets used:
|
||||||
|
# wildcard.krebsco.de.crt
|
||||||
|
# wildcard.krebsco.de.key
|
||||||
|
# bepasty-secret.nix <- contains single string
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
{
|
||||||
|
|
||||||
|
krebs.nginx.enable = mkDefault true;
|
||||||
|
krebs.bepasty = {
|
||||||
|
enable = true;
|
||||||
|
serveNginx= true;
|
||||||
|
|
||||||
|
servers = {
|
||||||
|
internal = {
|
||||||
|
nginx = {
|
||||||
|
server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
|
||||||
|
};
|
||||||
|
defaultPermissions = "admin,list,create,read,delete";
|
||||||
|
secretKey = import <secrets/bepasty-secret.nix>;
|
||||||
|
};
|
||||||
|
|
||||||
|
external = {
|
||||||
|
nginx = {
|
||||||
|
server-names = [ "paste.krebsco.de" ];
|
||||||
|
extraConfig = ''
|
||||||
|
ssl_session_cache shared:SSL:1m;
|
||||||
|
ssl_session_timeout 10m;
|
||||||
|
ssl_certificate /root/secrets/wildcard.krebsco.de.crt;
|
||||||
|
ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
|
||||||
|
ssl_verify_client off;
|
||||||
|
proxy_ssl_session_reuse off;
|
||||||
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||||
|
ssl_ciphers RC4:HIGH:!aNULL:!MD5;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
if ($scheme = http){
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
}'';
|
||||||
|
};
|
||||||
|
defaultPermissions = "read";
|
||||||
|
secretKey = import <secrets/bepasty-secret.nix>;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
@ -5,10 +5,6 @@ with lib;
|
|||||||
krebs.exim-retiolum.enable = true;
|
krebs.exim-retiolum.enable = true;
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
msmtp
|
msmtp
|
||||||
mutt-kz
|
|
||||||
notmuch
|
|
||||||
# TODO: put this somewhere else
|
|
||||||
offlineimap
|
|
||||||
];
|
];
|
||||||
|
|
||||||
}
|
}
|
||||||
|
19
makefu/2configs/unstable-sources.nix
Normal file
19
makefu/2configs/unstable-sources.nix
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
krebs.build.source = {
|
||||||
|
git.nixpkgs = {
|
||||||
|
url = https://github.com/makefu/nixpkgs;
|
||||||
|
rev = "984d33884d63d404ff2da76920b8bc8b15471552";
|
||||||
|
};
|
||||||
|
|
||||||
|
dir.secrets = {
|
||||||
|
host = config.krebs.hosts.pornocauster;
|
||||||
|
path = "/home/makefu/secrets/${config.krebs.build.host.name}/";
|
||||||
|
};
|
||||||
|
dir.stockholm = {
|
||||||
|
host = config.krebs.hosts.pornocauster;
|
||||||
|
path = toString ../.. ;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
@ -6,10 +6,10 @@ let
|
|||||||
bepasty = pkgs.pythonPackages.bepasty-server;
|
bepasty = pkgs.pythonPackages.bepasty-server;
|
||||||
gevent = pkgs.pythonPackages.gevent;
|
gevent = pkgs.pythonPackages.gevent;
|
||||||
python = pkgs.pythonPackages.python;
|
python = pkgs.pythonPackages.python;
|
||||||
cfg = config.makefu.bepasty-server;
|
cfg = config.krebs.bepasty;
|
||||||
|
|
||||||
out = {
|
out = {
|
||||||
options.makefu.bepasty-server = api;
|
options.krebs.bepasty = api;
|
||||||
config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
|
config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -20,27 +20,20 @@ let
|
|||||||
servers = mkOption {
|
servers = mkOption {
|
||||||
type = with types; attrsOf optionSet;
|
type = with types; attrsOf optionSet;
|
||||||
options = singleton {
|
options = singleton {
|
||||||
nginxCfg = mkOption {
|
nginx = mkOption {
|
||||||
# TODO use the correct type
|
# TODO use the correct type
|
||||||
type = with types; attrsOf unspecified;
|
type = with types; attrsOf unspecified;
|
||||||
description = ''
|
description = ''
|
||||||
additional nginx configuration. see krebs.nginx for all options
|
additional nginx configuration. see krebs.nginx for all options
|
||||||
'' ;
|
'' ;
|
||||||
};
|
};
|
||||||
debug = mkOption {
|
|
||||||
type = types.bool;
|
|
||||||
description = ''
|
|
||||||
run server in debug mode
|
|
||||||
'';
|
|
||||||
default = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
# TODO: assert secretKey
|
|
||||||
secretKey = mkOption {
|
secretKey = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
description = ''
|
description = ''
|
||||||
server secret for safe session cookies, must be set.
|
server secret for safe session cookies, must be set.
|
||||||
'';
|
'';
|
||||||
|
default = "";
|
||||||
};
|
};
|
||||||
|
|
||||||
# we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
|
# we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
|
||||||
@ -66,6 +59,7 @@ let
|
|||||||
extraConfig = mkOption {
|
extraConfig = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "";
|
default = "";
|
||||||
|
# TODO configure permissions in separate
|
||||||
example = ''
|
example = ''
|
||||||
PERMISSIONS = {
|
PERMISSIONS = {
|
||||||
'myadminsecret': 'admin,list,create,read,delete',
|
'myadminsecret': 'admin,list,create,read,delete',
|
||||||
@ -75,8 +69,13 @@ let
|
|||||||
};
|
};
|
||||||
|
|
||||||
defaultPermissions = mkOption {
|
defaultPermissions = mkOption {
|
||||||
|
# TODO: listOf str
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "list";
|
description = ''
|
||||||
|
default permissions for all unauthenticated users.
|
||||||
|
'';
|
||||||
|
example = "read,create,delete";
|
||||||
|
default = "read";
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
@ -102,21 +101,22 @@ let
|
|||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "simple";
|
Type = "simple";
|
||||||
PrivateTmp = true;
|
PrivateTmp = true;
|
||||||
ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
|
|
||||||
|
ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
chmod 755 ${server.workDir}
|
mkdir -p "${server.dataDir}" "${server.workDir}"
|
||||||
mkdir -p ${server.dataDir}
|
chown bepasty:bepasty "${server.workDir}" "${server.dataDir}"
|
||||||
cat > ${server.workDir}/bepasty-${name}.conf <<EOF
|
cat > "${server.workDir}/bepasty-${name}.conf" <<EOF
|
||||||
SITENAME="${name}"
|
SITENAME="${name}"
|
||||||
STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
|
STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
|
||||||
SECRET_KEY="${escapeShellArg server.secretKey}"
|
SECRET_KEY="${server.secretKey}"
|
||||||
DEFAULT_PERMISSIONS="${server.defaultPermissions}"
|
DEFAULT_PERMISSIONS="${server.defaultPermissions}"
|
||||||
${server.extraConfig}
|
${server.extraConfig}
|
||||||
EOF
|
EOF
|
||||||
'';
|
'';
|
||||||
Directory = "${bepasty}/lib/${python.libPrefix}/site-packages";
|
|
||||||
# we use Gunicorn to start a wsgi server
|
|
||||||
ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
|
ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
|
||||||
|
-u bepasty \
|
||||||
|
-g bepasty \
|
||||||
--workers 3 --log-level=info \
|
--workers 3 --log-level=info \
|
||||||
--bind=unix:${server.workDir}/gunicorn-${name}.sock \
|
--bind=unix:${server.workDir}/gunicorn-${name}.sock \
|
||||||
--pid ${server.workDir}/gunicorn-${name}.pid \
|
--pid ${server.workDir}/gunicorn-${name}.pid \
|
||||||
@ -128,17 +128,21 @@ let
|
|||||||
|
|
||||||
users.extraUsers.bepasty = {
|
users.extraUsers.bepasty = {
|
||||||
uid = 2796546855; #genid bepasty
|
uid = 2796546855; #genid bepasty
|
||||||
|
group = "bepasty";
|
||||||
home = "/var/lib/bepasty-server";
|
home = "/var/lib/bepasty-server";
|
||||||
createHome = true;
|
};
|
||||||
|
users.extraGroups.bepasty = {
|
||||||
|
gid = 2796546855; #genid bepasty
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
nginx-imp = {
|
nginx-imp = {
|
||||||
assertions = [ { assertion = config.krebs.nginx.enable;
|
assertions = [ { assertion = config.krebs.nginx.enable;
|
||||||
message = "krebs.nginx.enable must be true"; }];
|
message = "krebs.nginx.enable must be true"; }];
|
||||||
|
|
||||||
krebs.nginx.servers = mapAttrs' (name: server:
|
krebs.nginx.servers = mapAttrs' (name: server:
|
||||||
nameValuePair("bepasty-server-${name}")
|
nameValuePair("bepasty-server-${name}")
|
||||||
(server.nginxCfg // {
|
(mkMerge [ server.nginx {
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
client_max_body_size 32M;
|
client_max_body_size 32M;
|
||||||
'';
|
'';
|
||||||
@ -153,7 +157,7 @@ let
|
|||||||
alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
|
alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
|
||||||
''))
|
''))
|
||||||
];
|
];
|
||||||
})
|
}])
|
||||||
) cfg.servers ;
|
) cfg.servers ;
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
|
@ -3,6 +3,7 @@ _:
|
|||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./tinc_graphs.nix
|
./tinc_graphs.nix
|
||||||
|
./bepasty-server.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -20,26 +20,38 @@ let
|
|||||||
default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
|
default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
|
||||||
};
|
};
|
||||||
|
|
||||||
krebsNginx = {
|
nginx = {
|
||||||
# configure krebs nginx to serve the new graphs
|
enable = mkEnableOption "enable tinc_graphs to be served with nginx";
|
||||||
enable = mkEnableOption "tinc_graphs nginx";
|
|
||||||
|
|
||||||
hostnames_complete = mkOption {
|
anonymous = {
|
||||||
#TODO: this is not a secure way to serve these graphs,better listen to
|
server-names = mkOption {
|
||||||
# the correct interface, krebs.nginx does not support this yet
|
type = with types; listOf str;
|
||||||
|
description = "hostnames which serve anonymous graphs";
|
||||||
|
default = [ "graphs.${config.krebs.build.host.name}" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
listen = mkOption {
|
||||||
|
# use the type of the nginx listen option
|
||||||
|
type = with types; listOf str;
|
||||||
|
description = "listen address for anonymous graphs";
|
||||||
|
default = [ "80" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
complete = {
|
||||||
|
server-names = mkOption {
|
||||||
type = with types; listOf str;
|
type = with types; listOf str;
|
||||||
description = "hostname which serves complete graphs";
|
description = "hostname which serves complete graphs";
|
||||||
default = [ "graphs.${config.krebs.build.host.name}" ];
|
default = [ "graphs.${config.krebs.build.host.name}" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
hostnames_anonymous = mkOption {
|
listen = mkOption {
|
||||||
type = with types; listOf str;
|
type = with types; listOf str;
|
||||||
description = ''
|
description = "listen address for complete graphs";
|
||||||
hostname which serves anonymous graphs
|
default = [ "127.0.0.1:80" ];
|
||||||
must be different from hostname_complete
|
};
|
||||||
'';
|
|
||||||
default = [ "anongraphs.${config.krebs.build.host.name}" ];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -109,25 +121,23 @@ let
|
|||||||
createHome = true;
|
createHome = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
|
krebs.nginx.servers = mkIf cfg.nginx.enable {
|
||||||
tinc_graphs_complete = {
|
tinc_graphs_complete = mkMerge [ cfg.nginx.complete {
|
||||||
server-names = cfg.krebsNginx.hostnames_complete;
|
|
||||||
locations = [
|
locations = [
|
||||||
(nameValuePair "/" ''
|
(nameValuePair "/" ''
|
||||||
autoindex on;
|
autoindex on;
|
||||||
root ${internal_dir};
|
root ${internal_dir};
|
||||||
'')
|
'')
|
||||||
];
|
];
|
||||||
};
|
}] ;
|
||||||
tinc_graphs_anonymous = {
|
tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous {
|
||||||
server-names = cfg.krebsNginx.hostnames_anonymous;
|
|
||||||
locations = [
|
locations = [
|
||||||
(nameValuePair "/" ''
|
(nameValuePair "/" ''
|
||||||
autoindex on;
|
autoindex on;
|
||||||
root ${external_dir};
|
root ${external_dir};
|
||||||
'')
|
'')
|
||||||
];
|
];
|
||||||
};
|
}];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user