server modules

2026-09-24 23:53:45 +09:00 · 2026-09-24 23:53:45 +09:00 · 48024d95ad
commit 48024d95ad
parent f88232875e
4 changed files with 229 additions and 215 deletions
--- a/server/mods/web.nix
+++ b/server/mods/web.nix
@ -0,0 +1,88 @@
+{ config, lib, pkgs, ... }:
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "letsencrypt@bogaledev.ru";
+    certs."bogaledev.ru" = {
+      validMinDays = 3;
+      dnsProvider = "cloudflare";
+      extraDomainNames = [ "*.bogaledev.ru" ];
+      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
+      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
+    };
+  };
+  services = let
+    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
+  in {
+    postgresql.enable = true;
+    phpfpm.pools.default = {
+      user = "php";
+      group = "php";
+      settings = {
+        "pm" = "ondemand";
+        "pm.max_children" = 8;
+        "listen.owner" = "nginx";
+        "listen.group" = "nginx";
+      };
+    };
+    forgejo = {
+      enable = true;
+      database.type = "postgres";
+      settings = {
+        service.DISABLE_REGISTRATION = true; 
+        server = {
+          HTTP_PORT = 8039;
+          ROOT_URL = "https://bogaledev.ru/git/";
+        };
+      };
+    };
+    vaultwarden = {
+      enable = true;
+      dbBackend = "postgresql";
+      configurePostgres = true;
+      package = pkgs.vaultwarden-postgresql;
+      environmentFile = "/secrets/vw-token.env";
+      config = {
+        ROCKET_PORT = 8032;
+        SIGNUPS_ALLOWED = false;
+        TRASH_AUTO_DELETE_DAYS = 90;
+        PASSWORD_HINTS_ALLOWED = false;
+        EMERGENCY_ACCESS_ALLOWED = false;
+        DOMAIN = "https://bogaledev.ru/vw/";
+      };
+    };
+    nginx.virtualHosts."bogaledev.ru" = let
+      phpPool = pool: ''
+        location ~ \.php$ {
+          fastcgi_pass unix:${config.services.phpfpm.pools.${pool}.socket};
+        }
+      '';
+      localNetworks = ''
+        allow fc00::/64;
+        allow fc01::/64;
+        allow fc02::/64;
+        allow 10.0.0.0/16;
+        allow 10.1.0.0/16;
+        allow 10.2.0.0/16;
+        deny all;
+      '';
+    in {
+      quic = true;
+      default = true;
+      forceSSL = true;
+      root = "/srv/http";
+      useACMEHost = "bogaledev.ru";
+      extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
+      locations = {
+        "/app/".extraConfig = phpPool "default";
+        "/git/".proxyPass = "http://127.0.0.1:8039/";
+        "/priv/".extraConfig = ''${localNetworks} ${phpPool "default"}'';
+        "/vw/" = {
+          proxyWebsockets = true;
+          extraConfig = localNetworks;
+          proxyPass = "http://127.0.0.1:8032";
+        };
+      };
+    };
+  };
+}