153 lines
3.6 KiB
Nix
153 lines
3.6 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with lib;
|
|
let
|
|
inherit (import <stockholm/lib>)
|
|
genid
|
|
;
|
|
|
|
in {
|
|
imports = [
|
|
./default.nix
|
|
../git.nix
|
|
];
|
|
|
|
security.acme = {
|
|
certs."lassul.us" = {
|
|
email = "lass@lassul.us";
|
|
webroot = "/var/lib/acme/acme-challenges";
|
|
plugins = [
|
|
"account_key.json"
|
|
"key.pem"
|
|
"fullchain.pem"
|
|
"full.pem"
|
|
];
|
|
allowKeysForGroup = true;
|
|
group = "lasscert";
|
|
};
|
|
certs."cgit.lassul.us" = {
|
|
email = "lassulus@gmail.com";
|
|
webroot = "/var/lib/acme/acme-challenges";
|
|
plugins = [
|
|
"account_key.json"
|
|
"key.pem"
|
|
"fullchain.pem"
|
|
];
|
|
group = "nginx";
|
|
allowKeysForGroup = true;
|
|
};
|
|
};
|
|
|
|
krebs.tinc_graphs.enable = true;
|
|
|
|
users.users.lass-stuff = {
|
|
uid = genid "lass-stuff";
|
|
description = "lassul.us blog cgi stuff";
|
|
home = "/var/empty";
|
|
};
|
|
|
|
services.phpfpm.poolConfigs."lass-stuff" = ''
|
|
listen = /var/run/lass-stuff.socket
|
|
user = lass-stuff
|
|
group = nginx
|
|
pm = dynamic
|
|
pm.max_children = 5
|
|
pm.start_servers = 1
|
|
pm.min_spare_servers = 1
|
|
pm.max_spare_servers = 1
|
|
listen.owner = lass-stuff
|
|
listen.group = nginx
|
|
php_admin_value[error_log] = 'stderr'
|
|
php_admin_flag[log_errors] = on
|
|
catch_workers_output = yes
|
|
security.limit_extensions =
|
|
'';
|
|
|
|
users.groups.lasscert.members = [
|
|
"dovecot2"
|
|
"ejabberd"
|
|
"exim"
|
|
"nginx"
|
|
];
|
|
|
|
services.nginx.virtualHosts."lassul.us" = {
|
|
serverAliases = [ "lassul.us" ];
|
|
locations."/".extraConfig = ''
|
|
root /srv/http/lassul.us;
|
|
'';
|
|
locations."/.well-known/acme-challenge".extraConfig = ''
|
|
root /var/lib/acme/challenges/lassul.us/;
|
|
'';
|
|
locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
|
|
alias ${config.krebs.tinc.retiolum.hostsArchive};
|
|
'';
|
|
locations."= /retiolum.hosts".extraConfig = ''
|
|
alias ${pkgs.retiolum-hosts};
|
|
'';
|
|
locations."/tinc".extraConfig = ''
|
|
alias ${config.krebs.tinc_graphs.workingDir}/external;
|
|
'';
|
|
# TODO make this work!
|
|
locations."= /ddate".extraConfig = let
|
|
script = pkgs.writeBash "test" ''
|
|
echo "hello world"
|
|
'';
|
|
#script = pkgs.execve "ddate-wrapper" {
|
|
# filename = "${pkgs.ddate}/bin/ddate";
|
|
# argv = [];
|
|
#};
|
|
in ''
|
|
gzip off;
|
|
fastcgi_pass unix:/var/run/lass-stuff.socket;
|
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
|
fastcgi_param DOCUMENT_ROOT /var/empty;
|
|
fastcgi_param SCRIPT_FILENAME ${script};
|
|
fastcgi_param SCRIPT_NAME ${script};
|
|
'';
|
|
|
|
locations."/init".extraConfig = let
|
|
initscript = pkgs.init.override {
|
|
pubkey = config.krebs.users.lass.pubkey;
|
|
};
|
|
in ''
|
|
alias ${initscript};
|
|
'';
|
|
|
|
enableSSL = true;
|
|
extraConfig = ''
|
|
listen 80;
|
|
listen [::]:80;
|
|
'';
|
|
sslCertificate = "/var/lib/acme/lassul.us/fullchain.pem";
|
|
sslCertificateKey = "/var/lib/acme/lassul.us/key.pem";
|
|
};
|
|
|
|
services.nginx.virtualHosts.cgit = {
|
|
serverAliases = [
|
|
"cgit.lassul.us"
|
|
];
|
|
locations."/.well-known/acme-challenge".extraConfig = ''
|
|
root /var/lib/acme/acme-challenges;
|
|
'';
|
|
enableSSL = true;
|
|
extraConfig = ''
|
|
listen 80;
|
|
listen [::]:80;
|
|
'';
|
|
sslCertificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
|
|
sslCertificateKey = "/var/lib/acme/cgit.lassul.us/key.pem";
|
|
};
|
|
|
|
users.users.blog = {
|
|
uid = genid "blog";
|
|
description = "lassul.us blog deployment";
|
|
home = "/srv/http/lassul.us";
|
|
useDefaultShell = true;
|
|
createHome = true;
|
|
openssh.authorizedKeys.keys = [
|
|
config.krebs.users.lass.pubkey
|
|
];
|
|
};
|
|
}
|
|
|