php-fpm, vaultwarden

common.nix

@@ -15,7 +15,9 @@
   swapDevices = [ { device = "/var/swapfile"; } ];
   boot.loader.limine = {
     enable = true;
+    maxGenerations = 20;
     secureBoot.enable = true;
+    panicOnChecksumMismatch = true;
   };
   users.users = {
     root = {

marks

@@ -12,4 +12,6 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
 systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
 
 todo:
-- lanzaboote
+- php-fpm, postgresql, certbot
+- postfix, dovecot, rspamd
+- vaultwarden, gitea, mediawiki

server/configuration.nix

@@ -18,22 +18,64 @@
       '';
     };
   };
+  #environment.systemPackages = with pkgs; [
+    #php
+  #];
   services = {
+    postgresql.enable = true;
     openssh = {
       enable = true;
       openFirewall = false;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+      };
+    };
+    phpfpm.pools.main = {
+      user = "nginx";
+      group = "nginx";
+      settings = {
+        "pm" = "ondemand";
+        "pm.max_children" = 8;
+        "listen.owner" = "nginx";
+        "listen.group" = "nginx";
+      };
     };
     nginx = {
       enable = true;
-      virtualHosts."_".default = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedBrotliSettings = true;
       virtualHosts."_" = {
-        locations."/" = {
+        default = true;
-          return = "200 '<html><body>It works</body></html>'";
+        root = "/srv/http/_";
-          extraConfig = ''
+        locations."~ \\.php$".extraConfig = ''
-            default_type text/html;
+          fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
         '';
       };
     };
+    vaultwarden = {
+      enable = true;
+      configureNginx = true;
+      dbBackend = "postgresql";
+      configurePostgres = true;
+      package = pkgs.vaultwarden-postgresql;
+      domain = "https://wg.bogaledev.ru/vault";
+      environmentFile = "/root/secrets/vaultwarden.env";
+      config = {
+        EMAIL_TOKEN_SIZE = 8;
+        SMTP_SECURITY = "off";
+        SMTP_HOST = "localhost";
+        SIGNUPS_ALLOWED = false;
+        REQUIRE_DEVICE_EMAIL = true;
+        TRASH_AUTO_DELETE_DAYS = 90;
+        ROCKET_ADDRESS = "127.0.0.1";
+        PASSWORD_HINTS_ALLOWED = false;
+        EMERGENCY_ACCESS_ALLOWED = false;
+        SMTP_FROM = "vaultwarden@bogaledev.ru";
+      };
     };
   };
 }