bogale/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nginx, phpfpm, tls, vaultwarden configured

Browse source
This commit is contained in:
bogale 2026-09-19 00:39:59 +09:00
commit e5477915a7
4 changed files with 61 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

2
home/common.nix
View file

@ -39,9 +39,11 @@
extraConfig = ''
unbind C-b
set -g mouse on
set -g prefix M-f
set-option -g focus-events on
set -s set-clipboard external
set-option -a terminal-features "xterm-256color:RGB"
bind f send-prefix
bind h select-pane -L
bind j select-pane -D
bind k select-pane -U

4
home/desktop/common.nix
View file

@ -1,7 +1,3 @@
{ config, pkgs, ... }:
{
programs.tmux.extraConfig = ''
set -g prefix M-f
bind f send-prefix
'';
}

4
home/server/common.nix
View file

@ -1,7 +1,3 @@
{ config, pkgs, ... }:
{
programs.tmux.extraConfig = ''
set -g prefix M-d
bind d send-prefix
'';
}

87
server/configuration.nix
View file

@ -2,6 +2,7 @@
{
imports = [ ../common.nix ./hardware-configuration.nix ];
boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
users.users.nginx.extraGroups = [ "acme" ];
users.users.bogale.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
];
@ -12,17 +13,25 @@
wifi-security.psk = "$BOGALE_2_4_PSK";
};
firewall = {
allowedTCPPorts = [ 80 ];
extraInputRules = ''
ip saddr 192.168.1.0/24 tcp dport 22 accept
'';
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 443 ];
};
};
security.acme = {
acceptTerms = true;
certs."bogaledev.ru" = {
validMinDays = 3;
dnsProvider = "cloudflare";
email = "acme-tls@bogaledev.ru";
reloadServices = [ "nginx.service" ];
extraDomainNames = [ "*.bogaledev.ru" ];
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/root/secrets/cf-token"; };
};
};
services = {
postgresql.enable = true;
openssh = {
enable = true;
openFirewall = false;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
@ -38,6 +47,26 @@
"listen.group" = "nginx";
};
};
vaultwarden = {
enable = true;
configureNginx = true;
dbBackend = "postgresql";
configurePostgres = true;
domain = "vw.bogaledev.ru";
package = pkgs.vaultwarden-postgresql;
environmentFile = "/root/secrets/vaultwarden.env";
config = {
#EMAIL_TOKEN_SIZE = 8;
#SMTP_SECURITY = "off";
#SMTP_HOST = "localhost";
SIGNUPS_ALLOWED = false;
#REQUIRE_DEVICE_EMAIL = true;
TRASH_AUTO_DELETE_DAYS = 90;
PASSWORD_HINTS_ALLOWED = false;
EMERGENCY_ACCESS_ALLOWED = false;
#SMTP_FROM = "vaultwarden@bogaledev.ru";
};
};
nginx = {
enable = true;
recommendedTlsSettings = true;
@ -45,34 +74,34 @@
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedBrotliSettings = true;
virtualHosts."_" = {
virtualHosts."bogaledev.ru" = {
quic = true;
default = true;
root = "/srv/http/_";
locations."~ \\.php$".extraConfig = ''
forceSSL = true;
root = "/srv/http";
useACMEHost = "bogaledev.ru";
extraConfig = ''
add_header Alt-Svc 'h3=":443"; ma=86400' always;
'';
locations = {
"/".index = "index.php index.html";
"~ \\.php$".extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
'';
};
};
#vaultwarden = {
#enable = true;
#configureNginx = true;
#dbBackend = "postgresql";
#configurePostgres = true;
#package = pkgs.vaultwarden-postgresql;
#domain = "https://wg.bogaledev.ru/vault";
#environmentFile = "/root/secrets/vaultwarden.env";
#config = {
#EMAIL_TOKEN_SIZE = 8;
#SMTP_SECURITY = "off";
#SMTP_HOST = "localhost";
#SIGNUPS_ALLOWED = false;
#REQUIRE_DEVICE_EMAIL = true;
#TRASH_AUTO_DELETE_DAYS = 90;
#ROCKET_ADDRESS = "127.0.0.1";
#PASSWORD_HINTS_ALLOWED = false;
#EMERGENCY_ACCESS_ALLOWED = false;
#SMTP_FROM = "vaultwarden@bogaledev.ru";
#};
#};
virtualHosts."vw.bogaledev.ru" = {
quic = true;
forceSSL = true;
useACMEHost = "bogaledev.ru";
extraConfig = ''
allow fc00::/64;
allow 10.0.0.0/24;
allow 192.168.1.0/24;
deny all;
add_header Alt-Svc 'h3=":443"; ma=86400' always;
'';
};
};
};
}