bogale/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

code organization

Browse source
This commit is contained in:
bogale 2026-10-06 14:53:26 +09:00
commit bf5f9f799e
8 changed files with 227 additions and 209 deletions
Download patch file Download diff file Expand all files Collapse all files

31
server/configuration.nix
View file

@ -8,6 +8,26 @@
"memmap=0x4000%0xbfb76000-4"
"memmap=0x4000%0xbfb7a000-4"
];
security.acme = {
acceptTerms = true;
defaults.email = "letsencrypt@bogaledev.ru";
certs."bogaledev.ru" = {
validMinDays = 3;
dnsProvider = "cloudflare";
extraDomainNames = [ "*.bogaledev.ru" ];
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
};
};
systemd.tmpfiles.rules = [
"d /root/backup/server 0700 root root -"
"L /root/backup/server/http - - - - /srv/http"
"L /root/backup/server/acme - - - - /var/lib/acme"
"L /root/backup/server/mail - - - - /var/spool/mail"
"L /root/backup/server/forgejo - - - - /var/lib/forgejo/dump"
"L /root/backup/server/vaultwarden - - - - /var/lib/vaultwarden"
"L /root/backup/server/postgresql - - - - /var/backup/postgresql"
];
users = {
groups = {
php.gid = 1568;
@ -47,15 +67,4 @@
wifi-security.psk = "$BOGALE_2_4_PSK";
};
};
security.acme = {
acceptTerms = true;
defaults.email = "letsencrypt@bogaledev.ru";
certs."bogaledev.ru" = {
validMinDays = 3;
dnsProvider = "cloudflare";
extraDomainNames = [ "*.bogaledev.ru" ];
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
};
};
}

92
server/mods/web.nix
View file

@ -68,50 +68,58 @@
};
};
};
nginx.virtualHosts."bogaledev.ru" = let
phpPool = ''
index index.php index.html;
location ~ \.php$ {
fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
}
'';
localNetworks = ''
allow fc00::/64;
allow fc01::/96;
allow fc02::/64;
allow 10.0.0.0/16;
allow 10.1.0.0/24;
allow 10.2.0.0/16;
deny all;
'';
in {
quic = true;
addSSL = true;
default = true;
root = "/srv/http";
useACMEHost = "bogaledev.ru";
extraConfig = ''
add_header Alt-Svc 'h3=":443"; ma=2592000' always;
add_header X-Content-Type-Options "nosniff" always;
'';
locations = {
"/".extraConfig = phpPool;
"/local/".extraConfig = "${phpPool} ${localNetworks}";
"/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
"/grafana/" = {
proxyWebsockets = true;
extraConfig = localNetworks;
proxyPass = "http://unix:/run/grafana/grafana.sock:/";
};
"/local/net/".extraConfig = ''
allow fc01::/64;
allow 10.1.0.0/16;
nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedBrotliSettings = true;
virtualHosts.main = let
phpPool = ''
index index.php index.html;
location ~ \.php$ {
fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
}
'';
localNetworks = ''
allow fc00::/64;
allow fc01::/96;
allow fc02::/64;
allow 10.0.0.0/16;
allow 10.1.0.0/24;
allow 10.2.0.0/16;
deny all;
'';
"/vw/" = {
proxyWebsockets = true;
extraConfig = localNetworks;
proxyPass = "http://localhost:46151";
in {
quic = true;
default = true;
forceSSL = true;
root = "/srv/http";
useACMEHost = "bogaledev.ru";
extraConfig = ''
add_header Alt-Svc 'h3=":443"; ma=2592000' always;
add_header X-Content-Type-Options 'nosniff' always;
'';
locations = {
"/".extraConfig = phpPool;
"/local/".extraConfig = "${phpPool} ${localNetworks}";
"/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
"/grafana/" = {
proxyWebsockets = true;
extraConfig = localNetworks;
proxyPass = "http://unix:/run/grafana/grafana.sock:/";
};
"/local/net/".extraConfig = ''
allow fc01::/64;
allow 10.1.0.0/16;
deny all;
'';
"/vw/" = {
proxyWebsockets = true;
extraConfig = localNetworks;
proxyPass = "http://localhost:46151";
};
};
};
};