Local akkoma for testing

hosts/laptop/akkoma/akkoma-static.nix

@@ -0,0 +1,30 @@
+{ pkgs, config, lib, ... }:
+let
+  imperativeStaticPath = "/data/akkoma/static_i";
+  declarativeStaticPath = "/data/akkoma/static_d";
+  mergedStaticPath = "/data/akkoma/static";
+  declarativeStaticFiles = let cfg = config.services.akkoma; in with lib; pkgs.runCommandLocal "declarative-akkoma-static" { } ''
+    ${concatStringsSep "\n" (mapAttrsToList (key: val: ''
+      mkdir -p $out/frontends/${escapeShellArg val.name}/
+      ln -s ${escapeShellArg val.package} $out/frontends/${escapeShellArg val.name}/${escapeShellArg val.ref}
+    '') cfg.frontends)}
+
+    ${optionalString (cfg.extraStatic != null)
+      (concatStringsSep "\n" (mapAttrsToList (key: val: ''
+        mkdir -p "$out/$(dirname ${escapeShellArg key})"
+        ln -s ${escapeShellArg val} $out/${escapeShellArg key}
+      '') cfg.extraStatic))}
+  '';
+in
+{
+  environment.systemPackages = with pkgs; [ mergerfs ];
+  systemd.tmpfiles.rules = [
+    "d ${imperativeStaticPath} 700 akkoma akkoma -"
+    "L+ ${declarativeStaticPath} - - - - ${toString declarativeStaticFiles}"
+  ];
+  fileSystems."${mergedStaticPath}" = {
+    fsType = "fuse.mergerfs";
+    device = "${imperativeStaticPath}:${declarativeStaticPath}";
+    options = [ "cache.files=off" "dropcacheonclose=true" "category.create=epff" ];
+  };
+}

hosts/laptop/akkoma/akkoma.nix

@@ -0,0 +1,53 @@
+{ pkgs, lib, config, ... }:
+let
+  inherit ((pkgs.formats.elixirConf {}).lib) mkMap mkAtom mkRaw mkTuple;
+in
+{
+  services.akkoma = {
+    enable = true;
+    initSecrets = false;
+    patches.configurableFromDatabase = true;
+    # frontends.mastodon = {
+    #   package = ;
+    #   name = "mastodon-fe";
+    #   ref = "stable";
+    # };
+    extraPackages = with pkgs; [ zip unzip exiftool ffmpeg_5-headless graphicsmagick-imagemagick-compat ];
+    config = {
+      ":pleroma".":instance" = {
+        name = "My Akkoma instance";
+        description = "Akkoma instance description";
+        email = "user@localhost";
+        registration_open = false;
+        federating = false;
+        upload_dir = "/data/uploads";
+        static_dir = "/data/akkoma/static";
+      };
+      ":pleroma"."Pleroma.Web.Endpoint" = {
+        url.host = config.myAkkomaContainerOptions.domain;
+        http.ip = config.myAkkomaContainerOptions.localAddress;
+        http.port = config.myAkkomaContainerOptions.localPort;
+      };
+
+      ":pleroma"."Pleroma.Uploaders.Local".uploads = "/data/uploads";
+
+      ":pleroma".":mrf".policies =  map mkRaw [
+        "Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy"
+        "Pleroma.Web.ActivityPub.MRF.TagPolicy"
+        "Pleroma.Web.ActivityPub.MRF.SimplePolicy"
+      ];
+      ":pleroma".":mrf_simple".accept = [
+        (mkTuple ["good.instance" "good!"])
+      ];
+
+
+      ":pleroma"."Pleroma.Web.Endpoint".secret_key_base = { _secret = "/run/secrets/akkotest/key-base"; };
+      ":pleroma"."Pleroma.Web.Endpoint".signing_salt = { _secret = "/run/secrets/akkotest/signing-salt"; };
+      ":pleroma"."Pleroma.Web.Endpoint".live_view.signing_salt = { _secret = "/run/secrets/akkotest/liveview-salt"; };
+      ":web_push_encryption".":vapid_details".private_key = { _secret = "/run/secrets/akkotest/vapid-private"; };
+      ":web_push_encryption".":vapid_details".public_key = { _secret = "/run/secrets/akkotest/vapid-public"; };
+      ":joken".":default_signer" = { _secret = "/run/secrets/akkotest/jwt-signer"; };
+
+    };
+  };
+}

hosts/laptop/akkoma/akkontainer.nix

@@ -0,0 +1,45 @@
+{ lib, config, ... }:
+let
+  cfg = config.myAkkomaContainerOptions;
+in
+with lib;
+{
+  options.myAkkomaContainerOptions = {
+    enable = mkEnableOption "akkoma container tweaks";
+    hostAddress = mkOption {
+      type = types.str;
+    };
+    localAddress = mkOption {
+      type = types.str;
+    };
+    localPort = mkOption {
+      type = types.int;
+    };
+    domain = mkOption {
+      type = types.str;
+    };
+    isContainer = mkOption {
+      type = types.uniq types.bool;
+      default = false;
+    };
+    containerName = mkOption {
+      type = types.uniq types.str;
+    };
+  };
+
+  
+  config = mkIf (cfg.enable && (!cfg.isContainer)) {
+    containers.${cfg.containerName}.config =
+    { config, pkgs, ... }:
+    {
+      myAkkomaContainerOptions = with cfg; {
+        isContainer = true;
+        inherit hostAddress;
+        inherit localAddress;
+        inherit localPort;
+        inherit domain;
+        # inherit containerName;
+      };
+    };
+  };
+}

hosts/laptop/akkotest.nix

@@ -0,0 +1,141 @@
+{ config, pkgs, lib, ... }:
+let
+  hostAddress = "192.168.100.10";
+  localAddress = "192.168.100.11";
+  localPort = 4000;
+  domain = "akkotest.local";
+in 
+{
+  imports = [
+    ./akkoma/akkontainer.nix
+  ];
+
+  networking.extraHosts = ''
+  127.0.0.1 ${domain}
+  '';
+  services.nginx = {
+    enable = true;
+    virtualHosts."${domain}" = {
+      serverName = "${domain}";
+      forceSSL = true;
+      sslCertificate = "/data/selfcerts/nginx-selfsigned.crt";
+      sslCertificateKey = "/data/selfcerts/nginx-selfsigned.key";
+      locations."/" = {
+        proxyPass = "http://${localAddress}:${toString localPort}";
+        proxyWebsockets = true;
+        recommendedProxySettings = true;
+      };
+    };
+  };
+  sops.secrets = 
+  let
+    sopsFile = ../../secrets/akkotest.yaml;
+    format = "yaml";
+    sopsPrefix = "akkotest";
+    mkSopsSecret = secretList: builtins.listToAttrs(map 
+    (name: {
+      name = "${sopsPrefix}/${name}";
+      value = {
+        inherit sopsFile;
+        inherit format;
+      };
+    })
+    secretList);
+  in mkSopsSecret [
+    "vapid-private"
+    "vapid-public"
+    "liveview-salt"
+    "signing-salt"
+    "jwt-signer"
+    "key-base"
+  ];
+  # sops.secrets."akkotest/vapid-private" = {
+  #   sopsFile = ../../secrets/akkotest.yaml;
+  #   format = "yaml";
+  # };
+
+  myAkkomaContainerOptions = {
+    enable = true;
+    hostAddress = "192.168.100.10";
+    localAddress = "192.168.100.11";
+    localPort = 4000;
+    domain = "akkotest.local";
+    containerName = "akkotest";
+  };
+
+  containers.akkotest =
+  let
+    outerConfig = config;
+    hostDataPrefix = "/data/akkotest";
+    containerDataPrefix = "/data/akkotest";
+  in 
+  {
+    ephemeral = true;
+    privateNetwork = true;
+    inherit hostAddress;
+    inherit localAddress;
+    allowedDevices = [
+      {
+        modifier = "rwm";
+        node = "/dev/fuse";
+      }
+    ];
+    bindMounts."/dev/fuse" = {};
+    bindMounts.static = {
+      hostPath = "/data/static_i_akkotest";
+      mountPoint = "/data/akkoma/static_i";
+      isReadOnly = false;
+    };
+    bindMounts.db = {
+      hostPath = "/data/postgresql_akkotest";
+      mountPoint = "/data/postgresql";
+      isReadOnly = false;
+    };
+    bindMounts.uploads = {
+      hostPath = "/data/uploads_akkotest";
+      mountPoint = "/data/uploads";
+      isReadOnly = false;
+    };
+    bindMounts.secrets = {
+      hostPath = "/data/secrets_akkotest";
+      mountPoint = "/var/akkosecrets";
+      isReadOnly = true;
+    };
+    bindMounts."/run/secrets/akkotest" = {
+      isReadOnly = true;
+    };
+
+    config = 
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./akkoma/akkontainer.nix
+        ./akkoma/akkoma.nix
+        ./akkoma/akkoma-static.nix
+        ../../modules/akkoma-patches.nix
+      ];
+      # myAkkomaContainerOptions = outerConfig.myAkkomaContainerOptions.mkInnerConfig;
+      # myAkkomaContainerOptions = {
+      #   inherit hostAddress;
+      #   inherit localAddress;
+      #   inherit localPort;
+      #   inherit domain;
+      #   isContainer = true;
+      # };
+      environment.systemPackages = with pkgs; [ zip unzip ];
+      systemd.tmpfiles.rules = [
+        "d /data/postgresql 700 postgres postgres -"
+        # "d /data/uploads 700 akkoma akkoma -"
+        "d /var/akkosecrets 500 akkoma akkoma -"
+       ];
+      services.postgresql = {
+        enable = true;
+        package = pkgs.postgresql_15;
+        dataDir = "/data/postgresql";
+      };
+      networking.firewall.allowedTCPPorts = [
+        localPort
+      ];
+    };
+  };
+}

hosts/laptop/configuration.nix

@@ -9,6 +9,9 @@ let
 in
 
 {  
+  imports = [
+    ./akkotest.nix
+  ];
   # boot.kernelPackages = pkgs.linuxPackages_zen;
 
   # Use the systemd-boot EFI boot loader.
@@ -291,7 +294,6 @@ in
     defaultSopsFile = ../../secrets/secrets.yaml;
     defaultSopsFormat = "yaml";
     secrets.example_key = {};
-    gnupg.home = "/home/lgm/.gnupg";
   };
 
   # OnlyKey
@@ -360,13 +362,25 @@ in
   # Enable the OpenSSH daemon.
   # services.openssh.enable = true;
 
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+  };
+
   # Open ports in the firewall.
   networking.firewall.trustedInterfaces = [ "p2p-wl+" ];
   networking.firewall.allowedTCPPorts = [ 5900 5905 7236 7250 ];
   networking.firewall.allowedUDPPorts = [ 5900 5905 7236 5353 ];
+
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
 
+  # enable NAT for the containers
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "wlp3s0";
+  networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
+
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
   # accidentally delete configuration.nix.