110 lines
2.9 KiB
Nix
110 lines
2.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
{
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "letsencrypt@bogaledev.ru";
|
|
certs."bogaledev.ru" = {
|
|
validMinDays = 3;
|
|
dnsProvider = "cloudflare";
|
|
extraDomainNames = [ "*.bogaledev.ru" ];
|
|
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
|
|
reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
|
|
};
|
|
};
|
|
services = let
|
|
sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
|
|
in {
|
|
postgresqlBackup = {
|
|
enable = true;
|
|
compression = "none";
|
|
databases = [ "php" "forgejo" "vaultwarden" ];
|
|
};
|
|
postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "php" ];
|
|
ensureUsers = [ {
|
|
name = "php";
|
|
ensureDBOwnership = true;
|
|
} ];
|
|
};
|
|
forgejo = {
|
|
enable = true;
|
|
database.type = "postgres";
|
|
settings.server = {
|
|
HTTP_PORT = 8039;
|
|
ROOT_URL = "https://bogaledev.ru/git/";
|
|
};
|
|
};
|
|
phpfpm.pools.php = {
|
|
user = "php";
|
|
group = "php";
|
|
phpEnv = { PATH = "/run/current-system/sw/bin"; };
|
|
settings = {
|
|
"pm" = "ondemand";
|
|
"pm.max_children" = 4;
|
|
"listen.owner" = "nginx";
|
|
"listen.group" = "nginx";
|
|
};
|
|
};
|
|
vaultwarden = {
|
|
enable = true;
|
|
dbBackend = "postgresql";
|
|
configurePostgres = true;
|
|
package = pkgs.vaultwarden-postgresql;
|
|
environmentFile = "/secrets/vw-token.env";
|
|
config = {
|
|
ROCKET_PORT = 8032;
|
|
SIGNUPS_ALLOWED = false;
|
|
TRASH_AUTO_DELETE_DAYS = 90;
|
|
PASSWORD_HINTS_ALLOWED = false;
|
|
EMERGENCY_ACCESS_ALLOWED = false;
|
|
DOMAIN = "https://bogaledev.ru/vw/";
|
|
};
|
|
};
|
|
nginx.virtualHosts."bogaledev.ru" = let
|
|
phpPool = ''
|
|
location ~ \.php$ {
|
|
fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
|
|
}
|
|
'';
|
|
localNetworks = ''
|
|
allow fc00::/64;
|
|
allow fc01::/120;
|
|
allow 10.0.0.0/16;
|
|
allow 10.1.0.0/24;
|
|
deny all;
|
|
'';
|
|
in {
|
|
quic = true;
|
|
default = true;
|
|
forceSSL = true;
|
|
root = "/srv/http";
|
|
useACMEHost = "bogaledev.ru";
|
|
extraConfig = ''
|
|
add_header Alt-Svc 'h3=":443"; ma=2592000' always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
'';
|
|
locations = {
|
|
"/git/".proxyPass = "http://127.0.0.1:8039/";
|
|
"/" = {
|
|
extraConfig = phpPool;
|
|
index = "index.php index.html";
|
|
};
|
|
"/local/" = {
|
|
extraConfig = "${phpPool} ${localNetworks}";
|
|
index = "index.php index.html";
|
|
};
|
|
"/local/net/".extraConfig = ''
|
|
allow fc01::/64;
|
|
allow 10.1.0.0/16;
|
|
deny all;
|
|
'';
|
|
"/vw/" = {
|
|
proxyWebsockets = true;
|
|
extraConfig = localNetworks;
|
|
proxyPass = "http://127.0.0.1:8032";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|