mirror of
https://git.lgmrszd.xyz/Lgmrszd/nix-cfg.git
synced 2025-12-13 23:28:20 +01:00
Akkoma on vps
This commit is contained in:
parent
4d4bdbefec
commit
acd2192b23
6 changed files with 342 additions and 41 deletions
30
hosts/vps1/akkoma/akkoma-static.nix
Normal file
30
hosts/vps1/akkoma/akkoma-static.nix
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
{ pkgs, config, lib, ... }:
|
||||
let
|
||||
imperativeStaticPath = "/data/akkoma/static_i";
|
||||
declarativeStaticPath = "/data/akkoma/static_d";
|
||||
mergedStaticPath = "/data/akkoma/static";
|
||||
declarativeStaticFiles = let cfg = config.services.akkoma; in with lib; pkgs.runCommandLocal "declarative-akkoma-static" { } ''
|
||||
${concatStringsSep "\n" (mapAttrsToList (key: val: ''
|
||||
mkdir -p $out/frontends/${escapeShellArg val.name}/
|
||||
ln -s ${escapeShellArg val.package} $out/frontends/${escapeShellArg val.name}/${escapeShellArg val.ref}
|
||||
'') cfg.frontends)}
|
||||
|
||||
${optionalString (cfg.extraStatic != null)
|
||||
(concatStringsSep "\n" (mapAttrsToList (key: val: ''
|
||||
mkdir -p "$out/$(dirname ${escapeShellArg key})"
|
||||
ln -s ${escapeShellArg val} $out/${escapeShellArg key}
|
||||
'') cfg.extraStatic))}
|
||||
'';
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [ mergerfs ];
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${imperativeStaticPath} 700 akkoma akkoma -"
|
||||
"L+ ${declarativeStaticPath} - - - - ${toString declarativeStaticFiles}"
|
||||
];
|
||||
fileSystems."${mergedStaticPath}" = {
|
||||
fsType = "fuse.mergerfs";
|
||||
device = "${imperativeStaticPath}:${declarativeStaticPath}";
|
||||
options = [ "cache.files=off" "dropcacheonclose=true" "category.create=epff" ];
|
||||
};
|
||||
}
|
||||
53
hosts/vps1/akkoma/akkoma.nix
Normal file
53
hosts/vps1/akkoma/akkoma.nix
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
inherit ((pkgs.formats.elixirConf {}).lib) mkMap mkAtom mkRaw mkTuple;
|
||||
in
|
||||
{
|
||||
services.akkoma = {
|
||||
enable = true;
|
||||
initSecrets = false;
|
||||
patches.configurableFromDatabase = true;
|
||||
# frontends.mastodon = {
|
||||
# package = ;
|
||||
# name = "mastodon-fe";
|
||||
# ref = "stable";
|
||||
# };
|
||||
extraPackages = with pkgs; [ zip unzip exiftool ffmpeg_5-headless graphicsmagick-imagemagick-compat ];
|
||||
config = {
|
||||
":pleroma".":instance" = {
|
||||
name = "My Akkoma instance";
|
||||
description = "Akkoma instance description";
|
||||
email = "user@localhost";
|
||||
registrations_open = false;
|
||||
federating = false;
|
||||
upload_dir = "/data/akkoma/uploads";
|
||||
static_dir = "/data/akkoma/static";
|
||||
};
|
||||
":pleroma"."Pleroma.Web.Endpoint" = {
|
||||
url.host = config.myAkkomaContainerOptions.domain;
|
||||
http.ip = config.myAkkomaContainerOptions.localAddress;
|
||||
http.port = config.myAkkomaContainerOptions.localPort;
|
||||
};
|
||||
|
||||
":pleroma"."Pleroma.Uploaders.Local".uploads = "/data/akkoma/uploads";
|
||||
|
||||
":pleroma".":mrf".policies = map mkRaw [
|
||||
"Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy"
|
||||
"Pleroma.Web.ActivityPub.MRF.TagPolicy"
|
||||
"Pleroma.Web.ActivityPub.MRF.SimplePolicy"
|
||||
];
|
||||
":pleroma".":mrf_simple".accept = [
|
||||
(mkTuple ["good.instance" "good!"])
|
||||
];
|
||||
|
||||
|
||||
":pleroma"."Pleroma.Web.Endpoint".secret_key_base = { _secret = "/run/secrets/akkotest-vps/key-base"; };
|
||||
":pleroma"."Pleroma.Web.Endpoint".signing_salt = { _secret = "/run/secrets/akkotest-vps/signing-salt"; };
|
||||
":pleroma"."Pleroma.Web.Endpoint".live_view.signing_salt = { _secret = "/run/secrets/akkotest-vps/liveview-salt"; };
|
||||
":web_push_encryption".":vapid_details".private_key = { _secret = "/run/secrets/akkotest-vps/vapid-private"; };
|
||||
":web_push_encryption".":vapid_details".public_key = { _secret = "/run/secrets/akkotest-vps/vapid-public"; };
|
||||
":joken".":default_signer" = { _secret = "/run/secrets/akkotest-vps/jwt-signer"; };
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
45
hosts/vps1/akkoma/akkontainer.nix
Normal file
45
hosts/vps1/akkoma/akkontainer.nix
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
cfg = config.myAkkomaContainerOptions;
|
||||
in
|
||||
with lib;
|
||||
{
|
||||
options.myAkkomaContainerOptions = {
|
||||
enable = mkEnableOption "akkoma container tweaks";
|
||||
hostAddress = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
localAddress = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
localPort = mkOption {
|
||||
type = types.int;
|
||||
};
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
isContainer = mkOption {
|
||||
type = types.uniq types.bool;
|
||||
default = false;
|
||||
};
|
||||
containerName = mkOption {
|
||||
type = types.uniq types.str;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
config = mkIf (cfg.enable && (!cfg.isContainer)) {
|
||||
containers.${cfg.containerName}.config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
myAkkomaContainerOptions = with cfg; {
|
||||
isContainer = true;
|
||||
inherit hostAddress;
|
||||
inherit localAddress;
|
||||
inherit localPort;
|
||||
inherit domain;
|
||||
# inherit containerName;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
156
hosts/vps1/akkotest.nix
Normal file
156
hosts/vps1/akkotest.nix
Normal file
|
|
@ -0,0 +1,156 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
rootDomain = "lgmrszd.xyz";
|
||||
hostAddress = "192.168.100.10";
|
||||
localAddress = "192.168.100.11";
|
||||
localPort = 4000;
|
||||
domain = "akko429164.testdrive.${rootDomain}";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./akkoma/akkontainer.nix
|
||||
];
|
||||
|
||||
|
||||
services.nginx.virtualHosts."${domain}" = {
|
||||
serverName = "${domain}";
|
||||
forceSSL = true;
|
||||
useACMEHost = "${rootDomain}";
|
||||
locations."/" = {
|
||||
proxyPass = "http://${localAddress}:${toString localPort}";
|
||||
proxyWebsockets = true;
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets =
|
||||
let
|
||||
sopsFile = ../../secrets/akkotest-vps.yaml;
|
||||
format = "yaml";
|
||||
sopsPrefix = "akkotest-vps";
|
||||
mkSopsSecret = secretList: builtins.listToAttrs(map
|
||||
(name: {
|
||||
name = "${sopsPrefix}/${name}";
|
||||
value = {
|
||||
inherit sopsFile;
|
||||
inherit format;
|
||||
};
|
||||
})
|
||||
secretList);
|
||||
in mkSopsSecret [
|
||||
"vapid-private"
|
||||
"vapid-public"
|
||||
"liveview-salt"
|
||||
"signing-salt"
|
||||
"jwt-signer"
|
||||
"key-base"
|
||||
];
|
||||
|
||||
myAkkomaContainerOptions = {
|
||||
enable = true;
|
||||
# hostAddress = "192.168.100.10";
|
||||
# localAddress = "192.168.100.11";
|
||||
# localPort = 4000;
|
||||
# domain = "akkotest.local";
|
||||
inherit hostAddress;
|
||||
inherit localAddress;
|
||||
inherit localPort;
|
||||
inherit domain;
|
||||
containerName = "akkotest";
|
||||
};
|
||||
|
||||
users = {
|
||||
users."akkoma" = {
|
||||
description = "Fake Akkoma user to set up files permissions";
|
||||
group = "akkoma";
|
||||
isSystemUser = true;
|
||||
uid = 1234;
|
||||
};
|
||||
groups."akkoma" = { gid = 1234; };
|
||||
};
|
||||
|
||||
containers.akkotest =
|
||||
let
|
||||
outerConfig = config;
|
||||
hostDataPrefix = "/data/akkotest";
|
||||
containerDataPrefix = "/data/akkotest";
|
||||
in
|
||||
{
|
||||
ephemeral = true;
|
||||
privateNetwork = true;
|
||||
inherit hostAddress;
|
||||
inherit localAddress;
|
||||
allowedDevices = [
|
||||
{
|
||||
modifier = "rwm";
|
||||
node = "/dev/fuse";
|
||||
}
|
||||
];
|
||||
bindMounts."/dev/fuse" = {};
|
||||
bindMounts.static = {
|
||||
hostPath = "/data/akkotest/static_i";
|
||||
mountPoint = "/data/akkoma/static_i";
|
||||
isReadOnly = false;
|
||||
};
|
||||
bindMounts.db = {
|
||||
hostPath = "/data/akkotest/postgresql";
|
||||
mountPoint = "/data/postgresql";
|
||||
isReadOnly = false;
|
||||
};
|
||||
bindMounts.uploads = {
|
||||
hostPath = "/data/akkotest/uploads";
|
||||
mountPoint = "/data/akkoma/uploads";
|
||||
isReadOnly = false;
|
||||
};
|
||||
# bindMounts.secrets = {
|
||||
# hostPath = "/data/secrets_akkotest";
|
||||
# mountPoint = "/var/akkosecrets";
|
||||
# isReadOnly = true;
|
||||
# };
|
||||
bindMounts."/run/secrets/akkotest-vps" = {
|
||||
isReadOnly = true;
|
||||
};
|
||||
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./akkoma/akkontainer.nix
|
||||
./akkoma/akkoma.nix
|
||||
./akkoma/akkoma-static.nix
|
||||
../../modules/akkoma-patches.nix
|
||||
];
|
||||
users = {
|
||||
users."akkoma" = {
|
||||
description = "Akkoma user";
|
||||
group = "akkoma";
|
||||
isSystemUser = true;
|
||||
uid = 1234;
|
||||
};
|
||||
groups."akkoma" = { gid = 1234; };
|
||||
};
|
||||
# myAkkomaContainerOptions = outerConfig.myAkkomaContainerOptions.mkInnerConfig;
|
||||
# myAkkomaContainerOptions = {
|
||||
# inherit hostAddress;
|
||||
# inherit localAddress;
|
||||
# inherit localPort;
|
||||
# inherit domain;
|
||||
# isContainer = true;
|
||||
# };
|
||||
environment.systemPackages = with pkgs; [ zip unzip ];
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /data/postgresql 700 postgres postgres -"
|
||||
# "d /data/uploads 700 akkoma akkoma -"
|
||||
# "d /var/akkosecrets 500 akkoma akkoma -"
|
||||
];
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
dataDir = "/data/postgresql";
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
localPort
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -3,14 +3,15 @@ let
|
|||
rootDomain = "lgmrszd.xyz";
|
||||
gtnhDomain = "gtnh.${rootDomain}";
|
||||
discDomain = "discourse.testdrive.${rootDomain}";
|
||||
akkoDomain = "akko.testdrive.${rootDomain}";
|
||||
iceDomain = "ice.testdrive.${rootDomain}";
|
||||
akkoDomain = "akko429164.testdrive.${rootDomain}";
|
||||
iceDomain = "ice758549.testdrive.${rootDomain}";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./akkotest.nix
|
||||
|
||||
(fetchTarball { url = "https://github.com/cariandrum22/nixos-vscode-server/tarball/support-for-new-dir-structure-of-vscode-server"; sha256 = "1sp4h0nb7dh7mcm8vdflihv76yz8azf5zifkcbxhq7xz48c8k5pd"; })
|
||||
|
||||
];
|
||||
|
||||
|
||||
|
|
@ -55,39 +56,6 @@ in
|
|||
|
||||
};
|
||||
|
||||
containers.akkotest = let secretpath = "${config.sops.secrets.example_key.path}"; in {
|
||||
ephemeral = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.10";
|
||||
localAddress = "192.168.100.11";
|
||||
bindMounts."${secretpath}".isReadOnly = true;
|
||||
specialArgs = {inherit secretpath;};
|
||||
|
||||
config =
|
||||
{ config, pkgs, secretpath, ... }:
|
||||
{
|
||||
users = {
|
||||
users."akkoma" = {
|
||||
description = "Akkoma user";
|
||||
group = "akkoma";
|
||||
isSystemUser = true;
|
||||
uid = 1234;
|
||||
};
|
||||
groups."akkoma" = { gid = 1234; };
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users = {
|
||||
users."akkoma" = {
|
||||
description = "Fake Akkoma user to set up secrets permissions";
|
||||
group = "akkoma";
|
||||
isSystemUser = true;
|
||||
uid = 1234;
|
||||
};
|
||||
groups."akkoma" = { gid = 1234; };
|
||||
};
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ../../secrets/secrets.yaml;
|
||||
defaultSopsFormat = "yaml";
|
||||
|
|
@ -128,11 +96,11 @@ in
|
|||
useACMEHost = "${rootDomain}";
|
||||
root = "/var/www/todo";
|
||||
};
|
||||
virtualHosts.${akkoDomain} = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "${rootDomain}";
|
||||
root = "/var/www/todo";
|
||||
};
|
||||
# virtualHosts.${akkoDomain} = {
|
||||
# forceSSL = true;
|
||||
# useACMEHost = "${rootDomain}";
|
||||
# root = "/var/www/todo";
|
||||
# };
|
||||
virtualHosts.${iceDomain} = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "${rootDomain}";
|
||||
|
|
@ -149,6 +117,7 @@ in
|
|||
environmentFile = config.sops.secrets.porkbun.path;
|
||||
extraDomainNames = [
|
||||
"*.${rootDomain}"
|
||||
"*.testdrive.${rootDomain}"
|
||||
# gtnhDomain
|
||||
# akkoDomain
|
||||
# iceDomain
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue