nix-cfg/hosts/vps1/akkotest.nix
2024-02-23 01:52:10 +03:00

156 lines
No EOL
3.7 KiB
Nix

{ config, pkgs, lib, ... }:
let
rootDomain = "lgmrszd.xyz";
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
localPort = 4000;
domain = "akko429164.testdrive.${rootDomain}";
in
{
imports = [
./akkoma/akkontainer.nix
];
services.nginx.virtualHosts."${domain}" = {
serverName = "${domain}";
forceSSL = true;
useACMEHost = "${rootDomain}";
locations."/" = {
proxyPass = "http://${localAddress}:${toString localPort}";
proxyWebsockets = true;
recommendedProxySettings = true;
};
};
sops.secrets =
let
sopsFile = ../../secrets/akkotest-vps.yaml;
format = "yaml";
sopsPrefix = "akkotest-vps";
mkSopsSecret = secretList: builtins.listToAttrs(map
(name: {
name = "${sopsPrefix}/${name}";
value = {
inherit sopsFile;
inherit format;
};
})
secretList);
in mkSopsSecret [
"vapid-private"
"vapid-public"
"liveview-salt"
"signing-salt"
"jwt-signer"
"key-base"
];
myAkkomaContainerOptions = {
enable = true;
# hostAddress = "192.168.100.10";
# localAddress = "192.168.100.11";
# localPort = 4000;
# domain = "akkotest.local";
inherit hostAddress;
inherit localAddress;
inherit localPort;
inherit domain;
containerName = "akkotest";
};
users = {
users."akkoma" = {
description = "Fake Akkoma user to set up files permissions";
group = "akkoma";
isSystemUser = true;
uid = 1234;
};
groups."akkoma" = { gid = 1234; };
};
containers.akkotest =
let
outerConfig = config;
hostDataPrefix = "/data/akkotest";
containerDataPrefix = "/data/akkotest";
in
{
ephemeral = true;
privateNetwork = true;
inherit hostAddress;
inherit localAddress;
allowedDevices = [
{
modifier = "rwm";
node = "/dev/fuse";
}
];
bindMounts."/dev/fuse" = {};
bindMounts.static = {
hostPath = "/data/akkotest/static_i";
mountPoint = "/data/akkoma/static_i";
isReadOnly = false;
};
bindMounts.db = {
hostPath = "/data/akkotest/postgresql";
mountPoint = "/data/postgresql";
isReadOnly = false;
};
bindMounts.uploads = {
hostPath = "/data/akkotest/uploads";
mountPoint = "/data/akkoma/uploads";
isReadOnly = false;
};
# bindMounts.secrets = {
# hostPath = "/data/secrets_akkotest";
# mountPoint = "/var/akkosecrets";
# isReadOnly = true;
# };
bindMounts."/run/secrets/akkotest-vps" = {
isReadOnly = true;
};
config =
{ config, pkgs, ... }:
{
imports = [
./akkoma/akkontainer.nix
./akkoma/akkoma.nix
./akkoma/akkoma-static.nix
../../modules/akkoma-patches.nix
];
users = {
users."akkoma" = {
description = "Akkoma user";
group = "akkoma";
isSystemUser = true;
uid = 1234;
};
groups."akkoma" = { gid = 1234; };
};
# myAkkomaContainerOptions = outerConfig.myAkkomaContainerOptions.mkInnerConfig;
# myAkkomaContainerOptions = {
# inherit hostAddress;
# inherit localAddress;
# inherit localPort;
# inherit domain;
# isContainer = true;
# };
environment.systemPackages = with pkgs; [ zip unzip ];
systemd.tmpfiles.rules = [
"d /data/postgresql 700 postgres postgres -"
# "d /data/uploads 700 akkoma akkoma -"
# "d /var/akkosecrets 500 akkoma akkoma -"
];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
dataDir = "/data/postgresql";
};
networking.firewall.allowedTCPPorts = [
localPort
];
};
};
}