bogale/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nginx, phpfpm, tls, vaultwarden configured

Browse source
This commit is contained in:
bogale 2026-09-19 00:39:59 +09:00
commit e5477915a7
4 changed files with 61 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

2
home/common.nix
View file

@ -39,9 +39,11 @@
extraConfig = '' extraConfig = ''
unbind C-b unbind C-b
set -g mouse on set -g mouse on
set -g prefix M-f
set-option -g focus-events on set-option -g focus-events on
set -s set-clipboard external set -s set-clipboard external
set-option -a terminal-features "xterm-256color:RGB" set-option -a terminal-features "xterm-256color:RGB"
bind f send-prefix
bind h select-pane -L bind h select-pane -L
bind j select-pane -D bind j select-pane -D
bind k select-pane -U bind k select-pane -U

4
home/desktop/common.nix
View file

@ -1,7 +1,3 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
programs.tmux.extraConfig = ''
set -g prefix M-f
bind f send-prefix
'';
} }

4
home/server/common.nix
View file

@ -1,7 +1,3 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
programs.tmux.extraConfig = ''
set -g prefix M-d
bind d send-prefix
'';
} }

89
server/configuration.nix
View file

@ -2,6 +2,7 @@
{ {
imports = [ ../common.nix ./hardware-configuration.nix ]; imports = [ ../common.nix ./hardware-configuration.nix ];
boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ]; boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
users.users.nginx.extraGroups = [ "acme" ];
users.users.bogale.openssh.authorizedKeys.keys = [ users.users.bogale.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
]; ];
@ -12,17 +13,25 @@
wifi-security.psk = "$BOGALE_2_4_PSK"; wifi-security.psk = "$BOGALE_2_4_PSK";
}; };
firewall = { firewall = {
allowedTCPPorts = [ 80 ]; allowedTCPPorts = [ 80 443 ];
extraInputRules = '' allowedUDPPorts = [ 443 ];
ip saddr 192.168.1.0/24 tcp dport 22 accept };
''; };
security.acme = {
acceptTerms = true;
certs."bogaledev.ru" = {
validMinDays = 3;
dnsProvider = "cloudflare";
email = "acme-tls@bogaledev.ru";
reloadServices = [ "nginx.service" ];
extraDomainNames = [ "*.bogaledev.ru" ];
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/root/secrets/cf-token"; };
}; };
}; };
services = { services = {
postgresql.enable = true; postgresql.enable = true;
openssh = { openssh = {
enable = true; enable = true;
openFirewall = false;
settings = { settings = {
PermitRootLogin = "no"; PermitRootLogin = "no";
PasswordAuthentication = false; PasswordAuthentication = false;
@ -38,6 +47,26 @@
"listen.group" = "nginx"; "listen.group" = "nginx";
}; };
}; };
vaultwarden = {
enable = true;
configureNginx = true;
dbBackend = "postgresql";
configurePostgres = true;
domain = "vw.bogaledev.ru";
package = pkgs.vaultwarden-postgresql;
environmentFile = "/root/secrets/vaultwarden.env";
config = {
#EMAIL_TOKEN_SIZE = 8;
#SMTP_SECURITY = "off";
#SMTP_HOST = "localhost";
SIGNUPS_ALLOWED = false;
#REQUIRE_DEVICE_EMAIL = true;
TRASH_AUTO_DELETE_DAYS = 90;
PASSWORD_HINTS_ALLOWED = false;
EMERGENCY_ACCESS_ALLOWED = false;
#SMTP_FROM = "vaultwarden@bogaledev.ru";
};
};
nginx = { nginx = {
enable = true; enable = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
@ -45,34 +74,34 @@
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedBrotliSettings = true; recommendedBrotliSettings = true;
virtualHosts."_" = { virtualHosts."bogaledev.ru" = {
quic = true;
default = true; default = true;
root = "/srv/http/_"; forceSSL = true;
locations."~ \\.php$".extraConfig = '' root = "/srv/http";
fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; useACMEHost = "bogaledev.ru";
extraConfig = ''
add_header Alt-Svc 'h3=":443"; ma=86400' always;
'';
locations = {
"/".index = "index.php index.html";
"~ \\.php$".extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
'';
};
};
virtualHosts."vw.bogaledev.ru" = {
quic = true;
forceSSL = true;
useACMEHost = "bogaledev.ru";
extraConfig = ''
allow fc00::/64;
allow 10.0.0.0/24;
allow 192.168.1.0/24;
deny all;
add_header Alt-Svc 'h3=":443"; ma=86400' always;
''; '';
}; };
}; };
#vaultwarden = {
#enable = true;
#configureNginx = true;
#dbBackend = "postgresql";
#configurePostgres = true;
#package = pkgs.vaultwarden-postgresql;
#domain = "https://wg.bogaledev.ru/vault";
#environmentFile = "/root/secrets/vaultwarden.env";
#config = {
#EMAIL_TOKEN_SIZE = 8;
#SMTP_SECURITY = "off";
#SMTP_HOST = "localhost";
#SIGNUPS_ALLOWED = false;
#REQUIRE_DEVICE_EMAIL = true;
#TRASH_AUTO_DELETE_DAYS = 90;
#ROCKET_ADDRESS = "127.0.0.1";
#PASSWORD_HINTS_ALLOWED = false;
#EMERGENCY_ACCESS_ALLOWED = false;
#SMTP_FROM = "vaultwarden@bogaledev.ru";
#};
#};
}; };
} }