🚀 big update:
added logging to all nginx routes
added loki, promtail to scrape nginx logs
turned i2pd back on,
updated my websites version
upgraded all hosts to 24.05
forgejo added bigger limit to upload limit due to docker images
privacy frontends:
added priviblur
libreddit -> redlib
added biblioreads
ddns-updater, changed credentials but there is a bug with porkbun
added penpot
brought back anonymousoverflow
added readme privacy respecting frontends
This commit is contained in:
parent
b6107679d1
commit
9216cbbf62
258
flake.lock
258
flake.lock
|
|
@ -21,6 +21,22 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"backend": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1714162491,
|
||||||
|
"narHash": "sha256-ncbQIX1XB2XL8lRrIyVzvloev/yuMAeT7O2S1sky1No=",
|
||||||
|
"owner": "TeamPiped",
|
||||||
|
"repo": "Piped-Backend",
|
||||||
|
"rev": "d67e50b5b8aa1b44930574cf67a420f75a08d1e2",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "TeamPiped",
|
||||||
|
"repo": "Piped-Backend",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"darwin": {
|
"darwin": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
|
|
@ -61,6 +77,93 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"flake-utils_2": {
|
||||||
|
"inputs": {
|
||||||
|
"systems": "systems_3"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1710146030,
|
||||||
|
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_3": {
|
||||||
|
"inputs": {
|
||||||
|
"systems": "systems_4"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1701680307,
|
||||||
|
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_4": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1631561581,
|
||||||
|
"narHash": "sha256-3VQMV5zvxaVLvqqUrNz3iJelLw30mIVSfZmAaauM3dA=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "7e5bf3925f6fbdfaf50a2a7ca0be2879c4261d19",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"frontend": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1717236695,
|
||||||
|
"narHash": "sha256-F/tWsF+StCKi+HQg1CtxVZNCOXG2o7ufhC2IezbSF2s=",
|
||||||
|
"owner": "TeamPiped",
|
||||||
|
"repo": "Piped",
|
||||||
|
"rev": "f94d56c16540282266b94d33c5a865268e255a70",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "TeamPiped",
|
||||||
|
"repo": "Piped",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"gradle2nix": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_2",
|
||||||
|
"nixpkgs": "nixpkgs_3"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1717114617,
|
||||||
|
"narHash": "sha256-zYYnEIpJAST9tm7A58FG+XOuKEDnH8WUGKcXfsTCsoM=",
|
||||||
|
"owner": "tadfisher",
|
||||||
|
"repo": "gradle2nix",
|
||||||
|
"rev": "a9353317959b7627a5754c6863e58231988f548a",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "tadfisher",
|
||||||
|
"ref": "v2",
|
||||||
|
"repo": "gradle2nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"home-manager": {
|
"home-manager": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
|
|
@ -163,27 +266,142 @@
|
||||||
},
|
},
|
||||||
"nixpkgs_2": {
|
"nixpkgs_2": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716633019,
|
"lastModified": 1717144377,
|
||||||
"narHash": "sha256-xim1b5/HZYbWaZKyI7cn9TJCM6ewNVZnesRr00mXeS4=",
|
"narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "9d29cd266cebf80234c98dd0b87256b6be0af44e",
|
"rev": "805a384895c696f802a9bf5bf4720f37385df547",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"ref": "nixos-23.11",
|
"ref": "nixos-24.05",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"nixpkgs_3": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1716769173,
|
||||||
|
"narHash": "sha256-7EXDb5WBw+d004Agt+JHC/Oyh/KTUglOaQ4MNjBbo5w=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "9ca3f649614213b2aaf5f1e16ec06952fe4c2632",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs_4": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1702151865,
|
||||||
|
"narHash": "sha256-9VAt19t6yQa7pHZLDbil/QctAgVsA66DLnzdRGqDisg=",
|
||||||
|
"owner": "nixos",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "666fc80e7b2afb570462423cb0e1cf1a3a34fedd",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nixos",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"piped": {
|
||||||
|
"inputs": {
|
||||||
|
"backend": "backend",
|
||||||
|
"frontend": "frontend",
|
||||||
|
"gradle2nix": "gradle2nix",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
],
|
||||||
|
"pnpm2nix": "pnpm2nix",
|
||||||
|
"proxy": "proxy"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1717288685,
|
||||||
|
"narHash": "sha256-yVKs0wx84eNn01TymHUxp+D2ayoHSNe2HfYwlqo2b2g=",
|
||||||
|
"owner": "Defelo",
|
||||||
|
"repo": "piped-nix",
|
||||||
|
"rev": "12259e1f04e8f981fc0953b1500879de86ca3099",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "Defelo",
|
||||||
|
"repo": "piped-nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"pnpm2nix": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_3",
|
||||||
|
"nixpkgs": "nixpkgs_4"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1706694632,
|
||||||
|
"narHash": "sha256-ytyTwNPiUR8aq74QlxFI+Wv3MyvXz5POO1xZxQIoi0c=",
|
||||||
|
"owner": "nzbr",
|
||||||
|
"repo": "pnpm2nix-nzbr",
|
||||||
|
"rev": "0366b7344171accc2522525710e52a8abbf03579",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nzbr",
|
||||||
|
"repo": "pnpm2nix-nzbr",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"proxy": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1717106863,
|
||||||
|
"narHash": "sha256-N6F6PLg3e78NW/b/c+jI7skUyc9hyClc1MSDaNO8aCo=",
|
||||||
|
"owner": "TeamPiped",
|
||||||
|
"repo": "piped-proxy",
|
||||||
|
"rev": "aad4375921bca890b927f6d4c50dcebd0b65cc2d",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "TeamPiped",
|
||||||
|
"repo": "piped-proxy",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"agenix": "agenix",
|
"agenix": "agenix",
|
||||||
"home-manager": "home-manager_2",
|
"home-manager": "home-manager_2",
|
||||||
"i2pd-exporter": "i2pd-exporter",
|
"i2pd-exporter": "i2pd-exporter",
|
||||||
"microvm": "microvm",
|
"microvm": "microvm",
|
||||||
"nixpkgs": "nixpkgs_2"
|
"nixpkgs": "nixpkgs_2",
|
||||||
|
"piped": "piped",
|
||||||
|
"scribe": "scribe"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"scribe": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_4",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1708785571,
|
||||||
|
"narHash": "sha256-s44+L6GSNHI4rBXiICyN64V1gT5WBIELNbR5R/2GH4A=",
|
||||||
|
"ref": "refs/heads/main",
|
||||||
|
"rev": "8dda4233ac3a817ccf29c3da3a8b25ddcdffa8ce",
|
||||||
|
"revCount": 137,
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.sr.ht/~edwardloveall/scribe"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.sr.ht/~edwardloveall/scribe"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"spectrum": {
|
"spectrum": {
|
||||||
|
|
@ -231,6 +449,36 @@
|
||||||
"repo": "default",
|
"repo": "default",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
|
},
|
||||||
|
"systems_3": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1681028828,
|
||||||
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"systems_4": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1681028828,
|
||||||
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
|
|
||||||
17
flake.nix
17
flake.nix
|
|
@ -2,7 +2,7 @@
|
||||||
description = "4o1x5 infrastructure/homelab";
|
description = "4o1x5 infrastructure/homelab";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
|
||||||
home-manager = {
|
home-manager = {
|
||||||
url = "github:nix-community/home-manager/release-23.11";
|
url = "github:nix-community/home-manager/release-23.11";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
@ -12,6 +12,16 @@
|
||||||
url = "git+https://git.4o1x5.dev/4o1x5/i2pd-exporter";
|
url = "git+https://git.4o1x5.dev/4o1x5/i2pd-exporter";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
piped = {
|
||||||
|
url = "github:Defelo/piped-nix";
|
||||||
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
|
|
||||||
|
scribe = {
|
||||||
|
url = "git+https://git.sr.ht/~edwardloveall/scribe";
|
||||||
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
microvm = {
|
microvm = {
|
||||||
url = "github:astro/microvm.nix";
|
url = "github:astro/microvm.nix";
|
||||||
|
|
@ -27,13 +37,14 @@
|
||||||
, i2pd-exporter
|
, i2pd-exporter
|
||||||
, microvm
|
, microvm
|
||||||
, agenix
|
, agenix
|
||||||
|
, scribe
|
||||||
|
, piped
|
||||||
}:
|
}:
|
||||||
let
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
nixosConfigurations = {
|
nixosConfigurations = {
|
||||||
|
|
||||||
pink = nixpkgs.lib.nixosSystem {
|
pink = nixpkgs.lib.nixosSystem {
|
||||||
inherit system;
|
inherit system;
|
||||||
modules = [
|
modules = [
|
||||||
|
|
@ -56,6 +67,8 @@
|
||||||
./root.nix
|
./root.nix
|
||||||
./secrets/carbon.nix
|
./secrets/carbon.nix
|
||||||
agenix.nixosModules.default
|
agenix.nixosModules.default
|
||||||
|
scribe.nixosModules.default
|
||||||
|
piped.nixosModules.default
|
||||||
home-manager.nixosModules.home-manager
|
home-manager.nixosModules.home-manager
|
||||||
{
|
{
|
||||||
home-manager.useGlobalPkgs = true;
|
home-manager.useGlobalPkgs = true;
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{ pkgs, ... }: {
|
||||||
#
|
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
|
|
@ -13,7 +12,10 @@
|
||||||
./services/routes/openproject.nix
|
./services/routes/openproject.nix
|
||||||
./services/routes/hydra.nix
|
./services/routes/hydra.nix
|
||||||
./services/routes/csengo.nix
|
./services/routes/csengo.nix
|
||||||
|
./services/routes/penpot.nix
|
||||||
./services/routes/matrix.nix
|
./services/routes/matrix.nix
|
||||||
|
./services/routes/learningpulsedev.nix
|
||||||
|
|
||||||
|
|
||||||
#./services/ai.nix
|
#./services/ai.nix
|
||||||
|
|
||||||
|
|
@ -25,7 +27,7 @@
|
||||||
# privacy services
|
# privacy services
|
||||||
|
|
||||||
./services/privacy/libreddit.nix
|
./services/privacy/libreddit.nix
|
||||||
#./services/privacy/safetwitch.nix
|
./services/privacy/safetwitch.nix
|
||||||
#./services/privacy/piped.nix
|
#./services/privacy/piped.nix
|
||||||
./services/privacy/breezewiki.nix
|
./services/privacy/breezewiki.nix
|
||||||
./services/privacy/gothub.nix
|
./services/privacy/gothub.nix
|
||||||
|
|
@ -38,12 +40,18 @@
|
||||||
./services/privacy/libremdb.nix
|
./services/privacy/libremdb.nix
|
||||||
./services/privacy/librey.nix
|
./services/privacy/librey.nix
|
||||||
./services/privacy/dumb.nix
|
./services/privacy/dumb.nix
|
||||||
|
./services/privacy/priviblur.nix
|
||||||
|
#./services/privacy/biblioreads.nix
|
||||||
|
#./services/privacy/proxitok.nix
|
||||||
|
#./services/privacy/scribe.nix
|
||||||
#./services/privacy/searxng.nix
|
#./services/privacy/searxng.nix
|
||||||
|
#./services/privacy/wikiless.nix
|
||||||
|
|
||||||
|
|
||||||
# monitoring
|
# monitoring
|
||||||
./services/monitoring/exporters/node.nix
|
./services/monitoring/exporters/node.nix
|
||||||
./services/monitoring/exporters/smartctl.nix
|
./services/monitoring/exporters/smartctl.nix
|
||||||
|
./services/monitoring/promtail.nix
|
||||||
];
|
];
|
||||||
networking.hostName = "carbon";
|
networking.hostName = "carbon";
|
||||||
networking.domain = "4o1x5.dev";
|
networking.domain = "4o1x5.dev";
|
||||||
|
|
|
||||||
|
|
@ -26,6 +26,10 @@
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:3000";
|
proxyPass = " http://127.0.0.1:3000";
|
||||||
};
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
client_max_body_size 8192M;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -38,13 +42,12 @@
|
||||||
settings = {
|
settings = {
|
||||||
container = {
|
container = {
|
||||||
# TODO fix: networking
|
# TODO fix: networking
|
||||||
# instead of using host, create a subnet that cannot contat other server on my network to avoid being haxxed
|
# instead of using host, create a subnet that cannot contact other server on my network to avoid being haxxed
|
||||||
network = "host";
|
network = "host";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
labels = [
|
labels = [
|
||||||
"ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
|
"ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
|
||||||
|
|
||||||
];
|
];
|
||||||
name = config.networking.domain;
|
name = config.networking.domain;
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,33 +1,46 @@
|
||||||
{ pkgs, ... }: {
|
{ pkgs, config, lib, ... }: {
|
||||||
|
|
||||||
|
|
||||||
|
networking.firewall = {
|
||||||
|
allowedTCPPorts = [ config.services.promtail.configuration.server.http_listen_port ];
|
||||||
|
allowedUDPPorts = [ config.services.promtail.configuration.server.http_listen_port ];
|
||||||
|
};
|
||||||
|
|
||||||
|
#$ var/ sudo setfacl -R -m u:promtail:rX log
|
||||||
|
#$ sudo chown promtail:promtail /tmp/positions.yaml
|
||||||
|
#$ sudo usermod -a -G systemd-journal promtail
|
||||||
|
# makeshift permission since promtail by default has no permission to read /var
|
||||||
|
|
||||||
services.promtail = {
|
services.promtail = {
|
||||||
enable = true;
|
enable = true;
|
||||||
configuration =
|
configuration =
|
||||||
{
|
{
|
||||||
server = {
|
server = {
|
||||||
http_listen_port = 0;
|
http_listen_port = 6177;
|
||||||
grpc_listen_port = 0;
|
grpc_listen_port = 0;
|
||||||
|
log_level = "debug";
|
||||||
|
};
|
||||||
|
positions = {
|
||||||
|
filename = "/tmp/positions.yaml";
|
||||||
};
|
};
|
||||||
|
|
||||||
clients = [
|
clients = [
|
||||||
{ url = "https//32.54.31.99:3100/api/prom/push"; }
|
{
|
||||||
|
url = "http://32.54.31.99:3100/loki/api/v1/push";
|
||||||
|
tenant_id = 1;
|
||||||
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
scrape_configs = [
|
scrape_configs = [
|
||||||
{
|
{
|
||||||
job_name = "system";
|
job_name = "nginx";
|
||||||
pipeline_stages = [
|
|
||||||
{ replace = { expression = "(?:[0-9]{1,3}\\.){3}([0-9]{1,3})"; replace = "***"; }; }
|
|
||||||
];
|
|
||||||
static_configs = [
|
static_configs = [
|
||||||
{
|
{
|
||||||
targets = [ "localhost" ];
|
targets = [ "localhost" ];
|
||||||
labels = {
|
labels = {
|
||||||
job = "nginx_access_log";
|
job = "nginx";
|
||||||
host = "carbon";
|
host = "carbon";
|
||||||
agent = "promtail";
|
agent = "promtail";
|
||||||
__path__ = "/var/log/nginx/json_access.log";
|
__path__ = ''/var/log/nginx/*-access.log'';
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
@ -36,4 +49,3 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,79 @@
|
||||||
{ pkgs, inputs, config, ... }:
|
{ pkgs, inputs, config, ... }:
|
||||||
|
let
|
||||||
|
# define logging format in json
|
||||||
|
# https://grafana.com/grafana/dashboards/12559-loki-nginx-service-mesh-json-version/
|
||||||
|
log_format = ''
|
||||||
|
log_format json_analytics escape=json '{'
|
||||||
|
'"msec": "$msec", ' # request unixtime in seconds with a milliseconds resolution
|
||||||
|
'"connection": "$connection", ' # connection serial number
|
||||||
|
'"connection_requests": "$connection_requests", ' # number of requests made in connection
|
||||||
|
'"pid": "$pid", ' # process pid
|
||||||
|
'"request_id": "$request_id", ' # the unique request id
|
||||||
|
'"request_length": "$request_length", ' # request length (including headers and body)
|
||||||
|
'"remote_addr": "$remote_addr", ' # client IP
|
||||||
|
'"remote_user": "$remote_user", ' # client HTTP username
|
||||||
|
'"remote_port": "$remote_port", ' # client port
|
||||||
|
'"time_local": "$time_local", '
|
||||||
|
'"time_iso8601": "$time_iso8601", ' # local time in the ISO 8601 standard format
|
||||||
|
'"request": "$request", ' # full path no arguments if the request
|
||||||
|
'"request_uri": "$request_uri", ' # full path and arguments if the request
|
||||||
|
'"args": "$args", ' # args
|
||||||
|
'"status": "$status", ' # response status code
|
||||||
|
'"body_bytes_sent": "$body_bytes_sent", ' # the number of body bytes exclude headers sent to a client
|
||||||
|
'"bytes_sent": "$bytes_sent", ' # the number of bytes sent to a client
|
||||||
|
'"http_referer": "$http_referer", ' # HTTP referer
|
||||||
|
'"http_user_agent": "$http_user_agent", ' # user agent
|
||||||
|
'"http_x_forwarded_for": "$http_x_forwarded_for", ' # http_x_forwarded_for
|
||||||
|
'"http_host": "$http_host", ' # the request Host: header
|
||||||
|
'"server_name": "$server_name", ' # the name of the vhost serving the request
|
||||||
|
'"request_time": "$request_time", ' # request processing time in seconds with msec resolution
|
||||||
|
'"upstream": "$upstream_addr", ' # upstream backend server for proxied requests
|
||||||
|
'"upstream_connect_time": "$upstream_connect_time", ' # upstream handshake time incl. TLS
|
||||||
|
'"upstream_header_time": "$upstream_header_time", ' # time spent receiving upstream headers
|
||||||
|
'"upstream_response_time": "$upstream_response_time", ' # time spend receiving upstream body
|
||||||
|
'"upstream_response_length": "$upstream_response_length", ' # upstream response length
|
||||||
|
'"upstream_cache_status": "$upstream_cache_status", ' # cache HIT/MISS where applicable
|
||||||
|
'"ssl_protocol": "$ssl_protocol", ' # TLS protocol
|
||||||
|
'"ssl_cipher": "$ssl_cipher", ' # TLS cipher
|
||||||
|
'"scheme": "$scheme", ' # http or https
|
||||||
|
'"request_method": "$request_method", ' # request method
|
||||||
|
'"server_protocol": "$server_protocol", ' # request protocol, like HTTP/1.1 or HTTP/2.0
|
||||||
|
'"pipe": "$pipe", ' # "p" if request was pipelined, "." otherwise
|
||||||
|
'"gzip_ratio": "$gzip_ratio", '
|
||||||
|
'"http_cf_ray": "$http_cf_ray",'
|
||||||
|
'"geoip_country_code": "$geoip2_data_country_code"'
|
||||||
|
'}';
|
||||||
|
|
||||||
|
'';
|
||||||
|
# geoip2 module to get countries from addresses
|
||||||
|
geoip2 = ''
|
||||||
|
geoip2 /etc/GeoLite2-Country.mmdb {
|
||||||
|
auto_reload 5m;
|
||||||
|
$geoip2_metadata_country_build metadata build_epoch;
|
||||||
|
$geoip2_data_country_code default=US source=$remote_addr country iso_code;
|
||||||
|
$geoip2_data_country_name country names en;
|
||||||
|
}
|
||||||
|
|
||||||
|
geoip2 /etc/GeoLite2-City.mmdb {
|
||||||
|
$geoip2_data_city_name default=London city names en;
|
||||||
|
}
|
||||||
|
|
||||||
|
'';
|
||||||
|
in
|
||||||
{
|
{
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
additionalModules = [ pkgs.nginxModules.geoip2 ];
|
||||||
|
|
||||||
|
# add logging to config
|
||||||
|
commonHttpConfig = ''
|
||||||
|
${geoip2}
|
||||||
|
${log_format}
|
||||||
|
'';
|
||||||
|
|
||||||
|
#access_log /var/log/nginx/json_access.log json_analytics;
|
||||||
|
# ^^ adds logging to every host
|
||||||
|
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
|
|
||||||
"www.${config.networking.domain}" = {
|
"www.${config.networking.domain}" = {
|
||||||
|
|
@ -11,6 +83,10 @@
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
root = pkgs.callPackage ../services/website/default.nix { };
|
root = pkgs.callPackage ../services/website/default.nix { };
|
||||||
};
|
};
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
"${config.networking.domain}" = {
|
"${config.networking.domain}" = {
|
||||||
|
|
@ -20,12 +96,14 @@
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
root = pkgs.callPackage ../services/website/default.nix { };
|
root = pkgs.callPackage ../services/website/default.nix { };
|
||||||
};
|
};
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
error_page 404 /404.html;
|
error_page 404 /404.html;
|
||||||
deny 3.1.202.244;
|
deny 3.1.202.244;
|
||||||
deny 170.64.219.93;
|
deny 170.64.219.93;
|
||||||
deny 91.215.85.43;
|
deny 91.215.85.43;
|
||||||
client_max_body_size 900M;
|
client_max_body_size 900M;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -8,8 +8,8 @@
|
||||||
"7344:8080"
|
"7344:8080"
|
||||||
];
|
];
|
||||||
environment = {
|
environment = {
|
||||||
APP_URL = "https://.anonymousoverflow.4o1x5.dev";
|
APP_URL = "https://anonymousoverflow.4o1x5.dev";
|
||||||
# TODO add JTW_SIGNING_KEY to work
|
JWT_SIGNING_SECRET = "${config.age.secrets.anonymousoverflow.path}";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -21,6 +21,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:7344";
|
proxyPass = " http://127.0.0.1:7344";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -10,9 +10,9 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
|
|
||||||
"biblioreads.${config.networking.domain}" = {
|
"biblioreads.${config.networking.domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
|
||||||
|
|
@ -16,6 +16,13 @@
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:7382";
|
proxyPass = " http://127.0.0.1:7382";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
rewrite ^/www.pinterest.com$ http://binternet.${config.networking.domain}/ permanent;
|
||||||
|
rewrite ^/pinterest.com$ http://binternet.${config.networking.domain}/ permanent;
|
||||||
|
'';
|
||||||
|
# ^^^ libreddirect for some reason forgets to delete the pinterest domain
|
||||||
|
# fixing this bug
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -17,6 +17,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:1584";
|
proxyPass = " http://127.0.0.1:1584";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -17,6 +17,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:8332";
|
proxyPass = " http://127.0.0.1:8332";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -29,6 +29,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:4032";
|
proxyPass = " http://127.0.0.1:4032";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,21 +1,24 @@
|
||||||
{ pkgs, config, ... }: {
|
{ pkgs, config, ... }: {
|
||||||
|
|
||||||
|
# todo redlib instead of libreddit
|
||||||
services.libreddit = {
|
services.libreddit = {
|
||||||
enable = true;
|
enable = true;
|
||||||
address = "127.0.0.1";
|
address = "127.0.0.1";
|
||||||
port = 3672;
|
port = 3672;
|
||||||
|
package = pkgs.redlib;
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
# Privacy services
|
|
||||||
"libreddit.${config.networking.domain}" = {
|
"libreddit.${config.networking.domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:3672";
|
proxyPass = " http://127.0.0.1:3672";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -26,6 +26,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:7345";
|
proxyPass = " http://127.0.0.1:7345";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -36,6 +36,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:3345";
|
proxyPass = " http://127.0.0.1:3345";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -8,26 +8,11 @@
|
||||||
backend = {
|
backend = {
|
||||||
port = 5632;
|
port = 5632;
|
||||||
database = {
|
database = {
|
||||||
# TODO fix
|
|
||||||
#TODO SECRET
|
|
||||||
host = "127.0.0.1";
|
host = "127.0.0.1";
|
||||||
username = "piped-backend";
|
passwordFile = config.age.secrets.piped.path;
|
||||||
passwordFile = ./piped;
|
|
||||||
database = "piped-backend";
|
|
||||||
|
|
||||||
createLocally = false;
|
createLocally = false;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
services.postgresql = {
|
|
||||||
enable = true;
|
|
||||||
enableTCPIP = true;
|
|
||||||
ensureDatabases = [ "piped-backend" ];
|
|
||||||
ensureUsers = [
|
|
||||||
{
|
|
||||||
name = "piped-backend";
|
|
||||||
ensureDBOwnership = true;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
{ pkgs, config, ... }: {
|
{ pkgs, config, ... }: {
|
||||||
|
|
||||||
virtualisation.oci-containers.containers = {
|
virtualisation.oci-containers.containers = {
|
||||||
|
# todo fix, requires a config file....
|
||||||
priviblur = {
|
priviblur = {
|
||||||
image = "quay.io/pussthecatorg/priviblur:latest";
|
image = "quay.io/pussthecatorg/priviblur:latest";
|
||||||
ports = [
|
ports = [
|
||||||
|
|
@ -11,7 +11,6 @@
|
||||||
};
|
};
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
|
|
||||||
"priviblur.${config.networking.domain}" = {
|
"priviblur.${config.networking.domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
@ -24,5 +23,4 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
# Auto-generated using compose2nix v0.2.0-pre.
|
# Auto-generated using compose2nix v0.2.0-pre.
|
||||||
{ pkgs, lib, ... }:
|
{ pkgs, lib, config, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
|
|
@ -61,7 +61,7 @@
|
||||||
};
|
};
|
||||||
systemd.services."podman-proxitok-signer" = {
|
systemd.services."podman-proxitok-signer" = {
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Restart = lib.mkOverride 500 "\"no\"";
|
Restart = lib.mkOverride 500 "no";
|
||||||
};
|
};
|
||||||
after = [
|
after = [
|
||||||
"podman-network-docker-compose_proxitok.service"
|
"podman-network-docker-compose_proxitok.service"
|
||||||
|
|
@ -86,6 +86,7 @@
|
||||||
LATTE_CACHE = "/cache";
|
LATTE_CACHE = "/cache";
|
||||||
REDIS_HOST = "proxitok-redis";
|
REDIS_HOST = "proxitok-redis";
|
||||||
REDIS_PORT = "6379";
|
REDIS_PORT = "6379";
|
||||||
|
APP_URL = "https://proxitok.${config.networking.domain}";
|
||||||
};
|
};
|
||||||
volumes = [
|
volumes = [
|
||||||
"proxitok-cache:/cache:rw"
|
"proxitok-cache:/cache:rw"
|
||||||
|
|
@ -108,9 +109,10 @@
|
||||||
"--security-opt=no-new-privileges:true"
|
"--security-opt=no-new-privileges:true"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services."podman-proxitok-web" = {
|
systemd.services."podman-proxitok-web" = {
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Restart = lib.mkOverride 500 "\"no\"";
|
Restart = lib.mkOverride 500 "no";
|
||||||
};
|
};
|
||||||
after = [
|
after = [
|
||||||
"podman-network-docker-compose_proxitok.service"
|
"podman-network-docker-compose_proxitok.service"
|
||||||
|
|
|
||||||
|
|
@ -34,6 +34,9 @@
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:2355";
|
proxyPass = " http://127.0.0.1:2355";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -29,7 +29,7 @@
|
||||||
# Request URL
|
# Request URL
|
||||||
PRIVACY_URL = "true";
|
PRIVACY_URL = "true";
|
||||||
# Device Type (User agent)
|
# Device Type (User agent)
|
||||||
PRIVACY_DEVICE = "false";
|
PRIVACY_DEVICE = "true";
|
||||||
|
|
||||||
PRIVACY_DIAGNOSTICS = "false";
|
PRIVACY_DIAGNOSTICS = "false";
|
||||||
};
|
};
|
||||||
|
|
@ -44,6 +44,9 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:4312";
|
proxyPass = " http://127.0.0.1:4312";
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,6 @@
|
||||||
{ pkgs, config, ... }:
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
virtualisation.oci-containers.containers = {
|
virtualisation.oci-containers.containers = {
|
||||||
# TODO fix routing
|
|
||||||
|
|
||||||
safe-twitch-frontend = {
|
safe-twitch-frontend = {
|
||||||
image = "codeberg.org/safetwitch/safetwitch:latest";
|
image = "codeberg.org/safetwitch/safetwitch:latest";
|
||||||
ports = [
|
ports = [
|
||||||
|
|
@ -22,7 +20,7 @@
|
||||||
"7100:7100"
|
"7100:7100"
|
||||||
];
|
];
|
||||||
environment = {
|
environment = {
|
||||||
URL = "sf.${config.networking.domain}";
|
URL = "https://sf.${config.networking.domain}";
|
||||||
PORT = "7100";
|
PORT = "7100";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -30,26 +28,27 @@
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
|
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
"safetwitch.${config.networking.domain}" =
|
"safetwitch.${config.networking.domain}" = {
|
||||||
{
|
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:8280";
|
proxyPass = " http://127.0.0.1:8280";
|
||||||
};
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
"sf.${config.networking.domain}" = {
|
"sf.${config.networking.domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = " http://127.0.0.1:7100";
|
proxyPass = " http://127.0.0.1:7100";
|
||||||
};
|
extraConfig = ''
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -5,10 +5,12 @@
|
||||||
enable = true;
|
enable = true;
|
||||||
appDomain = "scribe.${config.networking.domain}";
|
appDomain = "scribe.${config.networking.domain}";
|
||||||
port = 7283;
|
port = 7283;
|
||||||
# TODO fix since it's readable by nix store...
|
|
||||||
|
# TODO , systemd doesnt like this, neither does it actually include the secrets
|
||||||
environmentFile = ''
|
environmentFile = ''
|
||||||
GITHUB_PERSONAL_ACCESS_TOKEN= ${builtins.readFile config.age.secrets.github-token.path}
|
GITHUB_PERSONAL_ACCESS_TOKEN=${config.age.secrets.github-token.path}
|
||||||
GITHUB_USERNAME= ${builtins.readFile config.age.secrets.github-username.path}
|
GITHUB_USERNAME=${config.age.secrets.github-username.path}
|
||||||
|
SECRET_KEY_BASE=${config.age.secrets.scribe-secret.path}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ pkgs, config, ... }: {
|
{ pkgs, config, ... }: {
|
||||||
|
# TODO rework the whole thing
|
||||||
virtualisation.oci-containers.containers = {
|
virtualisation.oci-containers.containers = {
|
||||||
|
|
||||||
searxng = {
|
searxng = {
|
||||||
|
|
@ -7,11 +7,6 @@
|
||||||
ports = [
|
ports = [
|
||||||
"3345:3000"
|
"3345:3000"
|
||||||
];
|
];
|
||||||
# TODO implement limiter
|
|
||||||
#volumes = [
|
|
||||||
# "/home/carbon/searxng.yml:/etc/searxng:rw"
|
|
||||||
#];
|
|
||||||
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,118 +0,0 @@
|
||||||
# Auto-generated using compose2nix v0.2.0-pre.
|
|
||||||
{ pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
services.nginx = {
|
|
||||||
virtualHosts = {
|
|
||||||
"wikiless.${config.networking.domain}" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = " http://127.0.0.1:8180";
|
|
||||||
extraConfig = ''
|
|
||||||
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Containers
|
|
||||||
virtualisation.oci-containers.containers."wikiless" = {
|
|
||||||
image = "ghcr.io/metastem/wikiless:latest";
|
|
||||||
environment = {
|
|
||||||
REDIS_HOST = "redis://172.4.0.5:6379";
|
|
||||||
};
|
|
||||||
ports = [
|
|
||||||
"127.0.0.1:8180:8080/tcp"
|
|
||||||
];
|
|
||||||
dependsOn = [
|
|
||||||
"wikiless_redis"
|
|
||||||
];
|
|
||||||
log-driver = "journald";
|
|
||||||
extraOptions = [
|
|
||||||
"--cap-drop=ALL"
|
|
||||||
"--hostname=wikiless"
|
|
||||||
"--ip=172.4.0.6"
|
|
||||||
"--network-alias=wikiless"
|
|
||||||
"--network=docker-compose_wikiless_net"
|
|
||||||
"--security-opt=no-new-privileges:true"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
systemd.services."podman-wikiless" = {
|
|
||||||
serviceConfig = {
|
|
||||||
Restart = lib.mkOverride 500 "always";
|
|
||||||
};
|
|
||||||
after = [
|
|
||||||
"podman-network-docker-compose_wikiless_net.service"
|
|
||||||
];
|
|
||||||
requires = [
|
|
||||||
"podman-network-docker-compose_wikiless_net.service"
|
|
||||||
];
|
|
||||||
partOf = [
|
|
||||||
"podman-compose-docker-compose-root.target"
|
|
||||||
];
|
|
||||||
wantedBy = [
|
|
||||||
"podman-compose-docker-compose-root.target"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
virtualisation.oci-containers.containers."wikiless_redis" = {
|
|
||||||
image = "redis:latest";
|
|
||||||
user = "nobody";
|
|
||||||
log-driver = "journald";
|
|
||||||
extraOptions = [
|
|
||||||
"--cap-add=DAC_OVERRIDE"
|
|
||||||
"--cap-add=SETGID"
|
|
||||||
"--cap-add=SETUID"
|
|
||||||
"--cap-drop=ALL"
|
|
||||||
"--hostname=wikiless_redis"
|
|
||||||
"--ip=172.4.0.5"
|
|
||||||
"--network-alias=wikiless_redis"
|
|
||||||
"--network=docker-compose_wikiless_net"
|
|
||||||
"--security-opt=no-new-privileges:true"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
systemd.services."podman-wikiless_redis" = {
|
|
||||||
serviceConfig = {
|
|
||||||
Restart = lib.mkOverride 500 "always";
|
|
||||||
};
|
|
||||||
after = [
|
|
||||||
"podman-network-docker-compose_wikiless_net.service"
|
|
||||||
];
|
|
||||||
requires = [
|
|
||||||
"podman-network-docker-compose_wikiless_net.service"
|
|
||||||
];
|
|
||||||
partOf = [
|
|
||||||
"podman-compose-docker-compose-root.target"
|
|
||||||
];
|
|
||||||
wantedBy = [
|
|
||||||
"podman-compose-docker-compose-root.target"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Networks
|
|
||||||
systemd.services."podman-network-docker-compose_wikiless_net" = {
|
|
||||||
path = [ pkgs.podman ];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
RemainAfterExit = true;
|
|
||||||
ExecStop = "${pkgs.podman}/bin/podman network rm -f docker-compose_wikiless_net";
|
|
||||||
};
|
|
||||||
script = ''
|
|
||||||
podman network inspect docker-compose_wikiless_net || podman network create docker-compose_wikiless_net --subnet=172.4.0.0/16
|
|
||||||
'';
|
|
||||||
partOf = [ "podman-compose-docker-compose-root.target" ];
|
|
||||||
wantedBy = [ "podman-compose-docker-compose-root.target" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Root service
|
|
||||||
# When started, this will automatically create all resources and start
|
|
||||||
# the containers. When stopped, this will teardown all resources.
|
|
||||||
systemd.targets."podman-compose-docker-compose-root" = {
|
|
||||||
unitConfig = {
|
|
||||||
Description = "Root target generated by compose2nix.";
|
|
||||||
};
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -13,6 +13,7 @@
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -14,6 +14,7 @@
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -2,8 +2,7 @@
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
"lpdev.${config.networking.domain}" =
|
"lpdev.${config.networking.domain}" = {
|
||||||
{
|
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
|
|
@ -14,10 +13,25 @@
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"lpdev-eureka.${config.networking.domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = " http://32.54.31.99:8761";
|
||||||
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -24,6 +24,7 @@ in
|
||||||
};
|
};
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
client_max_body_size 9000M;
|
client_max_body_size 9000M;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
"${fqdn}" = {
|
"${fqdn}" = {
|
||||||
|
|
@ -33,6 +34,7 @@ in
|
||||||
locations."/_matrix".proxyPass = "http://32.54.31.241:8008";
|
locations."/_matrix".proxyPass = "http://32.54.31.241:8008";
|
||||||
locations."/_synapse".proxyPass = "http://32.54.31.241:8008";
|
locations."/_synapse".proxyPass = "http://32.54.31.241:8008";
|
||||||
locations."= /.well-known/matrix/client" .extraConfig = mkWellKnown clientConfig;
|
locations."= /.well-known/matrix/client" .extraConfig = mkWellKnown clientConfig;
|
||||||
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -16,6 +16,7 @@
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -19,6 +19,7 @@
|
||||||
proxy_http_version 1.1;
|
proxy_http_version 1.1;
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
proxy_set_header Connection $connection_upgrade;
|
proxy_set_header Connection $connection_upgrade;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -13,6 +13,7 @@
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
access_log /var/log/nginx/$server_name-access.log json_analytics;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@
|
||||||
|
|
||||||
pkgs.stdenv.mkDerivation rec {
|
pkgs.stdenv.mkDerivation rec {
|
||||||
name = "website";
|
name = "website";
|
||||||
version = "0.1.25";
|
version = "0.1.29";
|
||||||
src = /home/grape/code/4o1x5/website;
|
src = /home/grape/code/4o1x5/website;
|
||||||
|
|
||||||
buildInputs = [ pkgs.hugo ];
|
buildInputs = [ pkgs.hugo ];
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,8 @@
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
[
|
||||||
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "sdhci_pci" ];
|
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "sdhci_pci" ];
|
||||||
|
|
@ -14,13 +15,13 @@
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/disk/by-uuid/16777af0-cb7b-470c-a172-d1761e6a8a12";
|
{
|
||||||
|
device = "/dev/disk/by-uuid/16777af0-cb7b-470c-a172-d1761e6a8a12";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices =
|
swapDevices =
|
||||||
[ { device = "/dev/disk/by-uuid/57420b12-9218-4110-9fb2-22ca3171f6a0"; }
|
[{ device = "/dev/disk/by-uuid/57420b12-9218-4110-9fb2-22ca3171f6a0"; }];
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
|
|
||||||
|
|
@ -5,15 +5,15 @@
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
./services/firewall.nix
|
./services/firewall.nix
|
||||||
#./services/loki.nix
|
|
||||||
|
|
||||||
./services/mumble.nix
|
./services/mumble.nix
|
||||||
#./services/ddns-updater.nix
|
./services/ddns-updater.nix
|
||||||
#./services/ai.nix
|
|
||||||
|
|
||||||
./services/postgresql.nix
|
./services/postgresql.nix
|
||||||
./services/matrix.nix
|
./services/matrix.nix
|
||||||
./services/owncast.nix
|
./services/owncast.nix
|
||||||
|
./services/penpot/docker-compose.nix
|
||||||
|
|
||||||
|
|
||||||
# monitoring
|
# monitoring
|
||||||
./services/monitoring/exporters/node.nix
|
./services/monitoring/exporters/node.nix
|
||||||
|
|
@ -27,5 +27,9 @@
|
||||||
networking.hostName = "lime";
|
networking.hostName = "lime";
|
||||||
networking.domain = "4o1x5.dev";
|
networking.domain = "4o1x5.dev";
|
||||||
|
|
||||||
|
users.users.lime = {
|
||||||
|
isNormalUser = true;
|
||||||
|
description = "lime";
|
||||||
|
extraGroups = [ "networkmanager" "wheel" "docker" ];
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,19 @@
|
||||||
{ pkgs, config, ... }: {
|
{ pkgs, config, ... }: {
|
||||||
|
|
||||||
services.inadyn = {
|
services.inadyn = {
|
||||||
enable = true;
|
# TODO wait for fix
|
||||||
# TODO fix
|
# https://github.com/troglobit/inadyn/issues/483
|
||||||
|
enable = false;
|
||||||
settings.provider.porkbun = {
|
settings.provider.porkbun = {
|
||||||
username = config.age.secrets.porkbun-user.path;
|
checkip-server = "icanhazip.com";
|
||||||
password = config.age.secrets.porkbun.path;
|
username = config.age.secrets.porkbun-user.path; # public key
|
||||||
|
password = config.age.secrets.porkbun.path; # private key
|
||||||
|
#hostname = [
|
||||||
|
# "4o1x5.dev"
|
||||||
|
# "*.4o1x5.dev"
|
||||||
|
#];
|
||||||
ssl = true;
|
ssl = true;
|
||||||
|
ttl = 600;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -6,7 +6,6 @@
|
||||||
virtualisation.podman = {
|
virtualisation.podman = {
|
||||||
enable = true;
|
enable = true;
|
||||||
autoPrune.enable = true;
|
autoPrune.enable = true;
|
||||||
dockerCompat = true;
|
|
||||||
defaultNetwork.settings = {
|
defaultNetwork.settings = {
|
||||||
# Required for container networking to be able to use names.
|
# Required for container networking to be able to use names.
|
||||||
dns_enabled = true;
|
dns_enabled = true;
|
||||||
|
|
|
||||||
|
|
@ -1,114 +0,0 @@
|
||||||
version: "3.8"
|
|
||||||
|
|
||||||
networks:
|
|
||||||
penpot:
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
penpot_postgres_v15:
|
|
||||||
penpot_assets:
|
|
||||||
|
|
||||||
services:
|
|
||||||
penpot-frontend:
|
|
||||||
image: "penpotapp/frontend:latest"
|
|
||||||
restart: always
|
|
||||||
ports:
|
|
||||||
- 9032:80
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- penpot_assets:/opt/data/assets
|
|
||||||
|
|
||||||
depends_on:
|
|
||||||
- penpot-backend
|
|
||||||
- penpot-exporter
|
|
||||||
|
|
||||||
networks:
|
|
||||||
- penpot
|
|
||||||
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
|
|
||||||
environment:
|
|
||||||
- PENPOT_FLAGS=enable-registration enable-login-with-password
|
|
||||||
|
|
||||||
penpot-backend:
|
|
||||||
image: "penpotapp/backend:latest"
|
|
||||||
restart: always
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- penpot_assets:/opt/data/assets
|
|
||||||
|
|
||||||
depends_on:
|
|
||||||
- penpot-postgres
|
|
||||||
- penpot-redis
|
|
||||||
|
|
||||||
networks:
|
|
||||||
- penpot
|
|
||||||
|
|
||||||
## Configuration envronment variables for backend the
|
|
||||||
## container.
|
|
||||||
|
|
||||||
environment:
|
|
||||||
- PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification enable-smtp enable-prepl-server
|
|
||||||
- PENPOT_PUBLIC_URI=https://penpot.4o1x5.dev
|
|
||||||
|
|
||||||
- PENPOT_DATABASE_URI=postgresql://penpot-postgres/penpot
|
|
||||||
- PENPOT_DATABASE_USERNAME=penpot
|
|
||||||
- PENPOT_DATABASE_PASSWORD=penpot
|
|
||||||
|
|
||||||
- PENPOT_REDIS_URI=redis://penpot-redis/0
|
|
||||||
|
|
||||||
- PENPOT_ASSETS_STORAGE_BACKEND=assets-fs
|
|
||||||
- PENPOT_STORAGE_ASSETS_FS_DIRECTORY=/opt/data/assets
|
|
||||||
- PENPOT_TELEMETRY_ENABLED=false
|
|
||||||
|
|
||||||
- PENPOT_SMTP_DEFAULT_FROM=no-reply@example.com
|
|
||||||
- PENPOT_SMTP_DEFAULT_REPLY_TO=no-reply@example.com
|
|
||||||
- PENPOT_SMTP_HOST=penpot-mailcatch
|
|
||||||
- PENPOT_SMTP_PORT=1025
|
|
||||||
- PENPOT_SMTP_USERNAME=
|
|
||||||
- PENPOT_SMTP_PASSWORD=
|
|
||||||
- PENPOT_SMTP_TLS=false
|
|
||||||
- PENPOT_SMTP_SSL=false
|
|
||||||
|
|
||||||
penpot-exporter:
|
|
||||||
image: "penpotapp/exporter:latest"
|
|
||||||
restart: always
|
|
||||||
networks:
|
|
||||||
- penpot
|
|
||||||
|
|
||||||
environment:
|
|
||||||
- PENPOT_PUBLIC_URI=http://penpot-frontend
|
|
||||||
- PENPOT_REDIS_URI=redis://penpot-redis/0
|
|
||||||
|
|
||||||
penpot-postgres:
|
|
||||||
image: "postgres:15"
|
|
||||||
restart: always
|
|
||||||
stop_signal: SIGINT
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- penpot_postgres_v15:/var/lib/postgresql/data
|
|
||||||
|
|
||||||
networks:
|
|
||||||
- penpot
|
|
||||||
|
|
||||||
environment:
|
|
||||||
- POSTGRES_INITDB_ARGS=--data-checksums
|
|
||||||
- POSTGRES_DB=penpot
|
|
||||||
- POSTGRES_USER=penpot
|
|
||||||
- POSTGRES_PASSWORD=penpot
|
|
||||||
|
|
||||||
penpot-redis:
|
|
||||||
image: redis:7
|
|
||||||
restart: always
|
|
||||||
networks:
|
|
||||||
- penpot
|
|
||||||
|
|
||||||
penpot-mailcatch:
|
|
||||||
image: sj26/mailcatcher:latest
|
|
||||||
restart: always
|
|
||||||
expose:
|
|
||||||
- "1025"
|
|
||||||
ports:
|
|
||||||
- "1080:1080"
|
|
||||||
networks:
|
|
||||||
- penpot
|
|
||||||
|
|
@ -14,6 +14,7 @@
|
||||||
|
|
||||||
# monitoring
|
# monitoring
|
||||||
./services/monitoring/prometheus.nix
|
./services/monitoring/prometheus.nix
|
||||||
|
./services/monitoring/loki.nix
|
||||||
./services/monitoring/grafana.nix
|
./services/monitoring/grafana.nix
|
||||||
./services/monitoring/exporters/node.nix
|
./services/monitoring/exporters/node.nix
|
||||||
./services/monitoring/exporters/smartctl.nix
|
./services/monitoring/exporters/smartctl.nix
|
||||||
|
|
@ -30,7 +31,12 @@
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
description = "pink";
|
description = "pink";
|
||||||
extraGroups = [ "networkmanager" "wheel" "docker" ];
|
extraGroups = [ "networkmanager" "wheel" "docker" ];
|
||||||
packages = with pkgs; [ ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
users.users."pink".openssh.authorizedKeys.keys = [
|
||||||
|
# for learning pulse deploy action
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDLEgQ0G40vIpnUmO0CUj6tyj2khAwcejs15h+BuMmhz/+v7ljRsu2G6cnex2lXpEmFQgIsmA0JAj8d8yFG8lp+pdIsdiqYmRhr3Tlc1FE5NinlYkSbeZi28bDf8AVL45Jbvu5wNYt/gJvj1G73oI0L1qz2y73q+g0FEjANtBXg9eN8/Scf1ohZco017lzcLNUCIxavwuzSRsWLHCfn7h1nrhdmFCUm7dipnycYX3osHrohT/7/rwikyjgEpioimVHvilLwMboQ22B4ztKqNgs+8Ob/UZTLZ0tzOGJ4hIa/PqZC0Az6Id44Mi8B6fY0qi9qO+fL39uim6sYxbden5E3QYxdufR28Zs5IqAMBRCmu3F9CzHWEggqbqS9KUxOdJwez7zk6nCjo5Jimzpuf8W2M8ty1F3jt98q009l0yQoTs04SE5DNWkmAFVLDZFgqBrcGp5e8UzuVIZoFOYpdMrre5Jd6Dur2WUqMlFKQLjBN36xYR0YKfNz347TucLr7aJwJ9ZkN1UthgaLna07tkry9f7YjsBOvhOSf+LBofpWgaQ8NRdgDjskFc4AjmqkB0i7giwkQFBzLGYtl3njPYW6sfEg89pQtxzxIi09iEuK2h/H1EjhJyQ3KmN/sRG6eutpexOCKFc+YqW/u303tTHGPGIGaCbjjIpR90vz3brRWQ== server@pink"
|
||||||
|
];
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -18,6 +18,8 @@
|
||||||
8422 # csengoclient
|
8422 # csengoclient
|
||||||
5333 # csengoserver
|
5333 # csengoserver
|
||||||
5432
|
5432
|
||||||
|
# learningpulse
|
||||||
|
8181
|
||||||
|
|
||||||
];
|
];
|
||||||
allowedUDPPorts = [
|
allowedUDPPorts = [
|
||||||
|
|
@ -35,6 +37,9 @@
|
||||||
5333 # csengoserver
|
5333 # csengoserver
|
||||||
5432
|
5432
|
||||||
|
|
||||||
|
# learningpulse
|
||||||
|
8181
|
||||||
|
|
||||||
config.services.i2pd.port
|
config.services.i2pd.port
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
{ pkgs, lib, config, ... }: {
|
{ pkgs, lib, config, ... }: {
|
||||||
|
|
||||||
services.i2pd = {
|
services.i2pd = {
|
||||||
enable = false;
|
enable = true;
|
||||||
port = 9732;
|
port = 9732;
|
||||||
enableIPv6 = true;
|
enableIPv6 = true;
|
||||||
floodfill = true;
|
floodfill = true;
|
||||||
|
|
@ -26,7 +26,7 @@
|
||||||
# need to create a nginx proxy that proxies the reseed file
|
# need to create a nginx proxy that proxies the reseed file
|
||||||
|
|
||||||
services.prometheus.exporters.i2pd = {
|
services.prometheus.exporters.i2pd = {
|
||||||
enable = false;
|
enable = true;
|
||||||
port = 3321;
|
port = 3321;
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
routerAddress = "https://127.0.0.1:${toString config.services.i2pd.proto.i2pControl.port}";
|
routerAddress = "https://127.0.0.1:${toString config.services.i2pd.proto.i2pControl.port}";
|
||||||
|
|
|
||||||
|
|
@ -19,6 +19,11 @@ in
|
||||||
url = "http://127.0.0.1:${toString config.services.prometheus.port}";
|
url = "http://127.0.0.1:${toString config.services.prometheus.port}";
|
||||||
isDefault = true;
|
isDefault = true;
|
||||||
}
|
}
|
||||||
|
# {
|
||||||
|
# name = "loki";
|
||||||
|
# type = "loki";
|
||||||
|
# url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}";
|
||||||
|
# }
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,46 +1,42 @@
|
||||||
{ pkgs, ... }: {
|
{ pkgs, config, ... }: {
|
||||||
#
|
|
||||||
services.loki = {
|
services.loki = {
|
||||||
enable = false;
|
enable = true;
|
||||||
configuration = {
|
configuration = {
|
||||||
auth_enabled = false;
|
auth_enabled = false;
|
||||||
server = {
|
server = {
|
||||||
http_listen_port = 3100;
|
http_listen_port = 3100;
|
||||||
|
grpc_listen_port = 9096;
|
||||||
};
|
};
|
||||||
ingester = {
|
common = {
|
||||||
lifecycler = {
|
instance_addr = "127.0.0.1";
|
||||||
address = "0.0.0.0";
|
path_prefix = "/tmp/loki";
|
||||||
ring = {
|
storage = { filesystem = { chunks_directory = "/tmp/loki/chunks"; rules_directory = "/tmp/loki/rules"; }; };
|
||||||
kvstore.store = "inmemory";
|
|
||||||
replication_factor = 1;
|
replication_factor = 1;
|
||||||
|
ring = { kvstore = { store = "inmemory"; }; };
|
||||||
|
};
|
||||||
|
query_range = {
|
||||||
|
results_cache.cache.embedded_cache = {
|
||||||
|
enabled = true;
|
||||||
|
max_size_mb = 100;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
chunk_idle_period = "15m";
|
schema_config = {
|
||||||
};
|
configs = [
|
||||||
schema_config.configs = [
|
|
||||||
{
|
{
|
||||||
from = "2020-02-25";
|
from = "2020-10-24";
|
||||||
store = "boltdb";
|
store = "tsdb";
|
||||||
object_store = "filesystem";
|
object_store = "filesystem";
|
||||||
schema = "v11";
|
schema = "v13";
|
||||||
index = {
|
index = { prefix = "index_"; period = "24h"; };
|
||||||
prefix = "index_";
|
|
||||||
period = "24h";
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
storage_config = {
|
networking.firewall = {
|
||||||
boltdb.directory = "/tmp/loki/index";
|
allowedTCPPorts = [ config.services.loki.configuration.server.http_listen_port ];
|
||||||
};
|
allowedUDPPorts = [ config.services.loki.configuration.server.http_listen_port ];
|
||||||
limits_config = {
|
|
||||||
enforce_metric_name = false;
|
|
||||||
reject_old_samples = true;
|
|
||||||
reject_old_samples_max_age = "500h";
|
|
||||||
};
|
|
||||||
chunk_store_config.max_look_back_period = "0s";
|
|
||||||
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
44
readme.md
44
readme.md
|
|
@ -1,3 +1,47 @@
|
||||||
# Infrastructure of 4o1x5.dev
|
# Infrastructure of 4o1x5.dev
|
||||||
|
|
||||||
Nix configs for all servers in my homelab. Including all services available for public and private use.
|
Nix configs for all servers in my homelab. Including all services available for public and private use.
|
||||||
|
|
||||||
|
## Setting up projects that don't have options in nixkpgs
|
||||||
|
|
||||||
|
Using compose2nix projects can be converted into `oci-container` definitions which we can use to deploy.
|
||||||
|
|
||||||
|
## Privacy respecting services
|
||||||
|
|
||||||
|
I will most likely deploy most of the services available in Libredirect. Since no projects are made equally, its really hard to set them up one by one.
|
||||||
|
Most projects don't even have a docker container, let alone a guide to deploy them. Some have nix flakes, but are missing crucial features or they are configured all wrong...
|
||||||
|
Here is a list of services I plan on hosting and their statuses.
|
||||||
|
|
||||||
|
| name | deployed? | info | I2P | Tor | Lokinet | Announced to instance list |
|
||||||
|
| -------------------------------------------------------- | --------- | ------------------------------------------------------------------------ | --- | --- | ------- | ------------------------------------------------ |
|
||||||
|
| [anonymousoverflow](https://anonymousoverflow.4o1x5.dev) | ✅ | works, but secret needs work | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [binternet](https://binternet.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ✅ |
|
||||||
|
| [breezewiki](https://breezewiki.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [dumb](https://dumb.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [gothub](https://gothub.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ (requires me to sign up for github (fuck no)) |
|
||||||
|
| [libreddit](https://libreddit.4o1x5.dev) | ✅ | needs to be migrated to redlib | ❌ | ❌ | ❌ | ❌ (owner didn't respond) |
|
||||||
|
| [libremdb](https://libremdb.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [librey](https://librey.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [piped](https://piped.4o1x5.dev) | ❌ | piped-nix deploys the database wrong | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [priviblur](https://priviblur.4o1x5.dev) | ❌ | need config file defined (impure) | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [quetre](https://quetre.4o1x5.dev) | ❓ | return 503 | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [rimgo](https://rimgo.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [safetwitch](https://safetwitch.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ✅ |
|
||||||
|
| [searxng](https://searxng.4o1x5.dev) | ❌ | no config option in nixpkgs | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [hyperpipe](https://hyperpipe.4o1x5.dev) | ❌ | no docker compose prioject & needs piped server | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [proxitok](https://proxitok.4o1x5.dev) | ❌ | complicated to setup | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [proxigram](https://proxigram.4o1x5.dev) | ❌ | deprecated | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| pixivfe | ❌ | [csam platform](https://www.bbc.com/news/uk-65932372), will never deploy | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [scribe](https://scribe.4o1x5.dev) | ❌ | flake has no secret for variables | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [laboratory](https://laboratory.4o1x5.dev) | ❌ | todo | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [reuter](https://reuters.4o1x5.dev) | ❌ | todo | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [snopes](https://snopes.4o1x5.dev) | ❌ | todo | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [ifunny](https://ifunny.4o1x5.dev) | ❌ | no nixpkgs/docker | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [tenor](https://tenor.4o1x5.dev) | ❌ | no nixpkgs/docker | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [knowyourmeme](https://knowyourmeme.4o1x5.dev) | ❌ | no nixpkgs/docker | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [urbandictionary](https://urbandictionary.4o1x5.dev) | ❌ | no nixpkgs/docker | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [biblioreads](https://biblioreads.4o1x5.dev) | ✅ | works | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [wolframalpha](https://wolframalpha.4o1x5.dev) | ❌ | no nixpkgs/docker | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
| [wikiless](https://wikiless.4o1x5.dev) | ❌ | todo no nixpkgs/docker | ❌ | ❌ | ❌ | ❌ |
|
||||||
|
|
||||||
|
I want to share my instances for public use, but most of these services code are hosted on github, meaning I would have to sign up and make a pull request there, which I will never do.
|
||||||
|
|
|
||||||
7
root.nix
7
root.nix
|
|
@ -39,7 +39,7 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
services.xserver = {
|
services.xserver = {
|
||||||
layout = "us";
|
xkb.layout = "us";
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users."root".openssh.authorizedKeys.keys = [
|
users.users."root".openssh.authorizedKeys.keys = [
|
||||||
|
|
@ -60,9 +60,12 @@
|
||||||
nixpkgs.config.allowUnfree = true;
|
nixpkgs.config.allowUnfree = true;
|
||||||
system.stateVersion = "23.11";
|
system.stateVersion = "23.11";
|
||||||
|
|
||||||
# DOCKER
|
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
docker-compose
|
docker-compose
|
||||||
|
neovim
|
||||||
|
git
|
||||||
|
zip
|
||||||
|
w3m
|
||||||
];
|
];
|
||||||
|
|
||||||
virtualisation.docker = {
|
virtualisation.docker = {
|
||||||
|
|
|
||||||
Reference in a new issue