Initial commit for empyrean configs

amanuensis.nix

@@ -0,0 +1,47 @@
+# Configuration for the Amanuensis service
+
+{ config, pkgs, ... }:
+
+# Set up python
+with pkgs;
+let amanuensis-requires = python-packages: with python-packages; [
+  flask flask_login flask_wtf gunicorn
+];
+python3-with-amanuensis-requires = python3.withPackages amanuensis-requires;
+in
+{
+  # Create a user for the server process to run under
+  users.users.amanuensis = {
+    isNormalUser = true;
+    description = "Amanuensis server user";
+    packages = [ python3-with-amanuensis-requires ];
+  };
+
+  # Create the server process systemd unit
+  systemd.services.amanuensis = {
+    enable = false;
+    description = "Amanuensis Lexicon server";
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "/home/amanuensis/Amanuensis/run.sh";
+      Restart = "on-failure";
+      User = "amanuensis";
+      WorkingDirectory = "/home/amanuensis";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  # Configure nginx to forward to the server at the lexicon subdomain
+  services.nginx.virtualHosts."lexicon.alogoulogoi.com" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      access_log /var/log/nginx/access.lexicon.log;
+    '';
+    locations."/".extraConfig = ''
+      proxy_buffering off;
+      proxy_pass http://localhost:8000/;
+    '';
+  };
+}
+

catacomb.nix

@@ -0,0 +1,19 @@
+# Configuration for the catacomb forwarder
+
+{ config, pkgs, ... }:
+
+{
+  # Configure nginx to forward to the server on catacomb
+  services.nginx.virtualHosts."catacomb.alogoulogoi.com" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      access_log /var/log/nginx/access.catacomb.log;
+    '';
+    locations."/".extraConfig = ''
+      proxy_buffering off;
+      proxy_pass http://10.7.3.16:7473/;
+    '';
+  };
+}
+

configuration.nix

@@ -0,0 +1,133 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./amanuensis.nix
+      ./docstore.nix
+      ./catacomb.nix
+      ./gitea.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub = {
+    enable = true;
+    version = 2;
+    device = "/dev/xvda";
+    extraConfig = "serial --unit=0 --speed=115200 ; terminal_input serial console ; terminal_output serial console";
+  };
+  boot.kernelParams = ["console=ttyS0"];
+  console.extraTTYs = ["ttyS0"];
+
+  networking.hostName = "empyrean";
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+
+  # Set your time zone.
+  time.timeZone = "UTC";
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim htop git tinc_pre python3
+    gitea
+  ];
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      # Static pages
+      "www.alogoulogoi.com" = {
+        enableACME = true;
+        forceSSL = true;
+        root = "/srv/www/";
+        extraConfig = ''
+          access_log /var/log/nginx/access.www.log;
+          index index.html;
+        '';
+      };
+      # Deny all other subdomains
+      "alogoulogoi.com" = {
+        default = true;
+        locations."/".return = "444";
+      };
+    };
+  };
+  security.acme = {
+    email = "tim.vanbaak+alogoulogoi@gmail.com";
+    acceptTerms = true;
+  };
+
+  services.gitolite = {
+    enable = true;
+    adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDkSvOcY0eFuYqewc73MNHGP/Owzfnt+BZDSOCwr4h+gJenOBmXol695sRKdIw8phgshb6LsNyWeEAr3YISwzjdOvWNKpSsdyH/79VFIffC+/RBhPFhIPHn1zpHIwgthXji8FMmnO6B1bhJvbJxD5bUqhdBLnUeMhNgUkDj4Qi42S8yK1VZkgWRuPOTGqlzkODEdzG6OST7ndL58jEQaK8R2KRC2cZfrjingmPL+ORyf1/lGwyF6MEAmbQuE6UdspMs8FWt2e8jQJS+ZQ8dl+NDFrC1QfPRFpBJWnQceBcfAVZTtDaJpRhc4ClZstBy/bVRjiKeQiNv5NasjKRvvIvot4+LXmBKrXJs81enExtMSHMPuqPRlyVZLMMCVmdLDP/HUYOASDzlUhV/v5Wp0jjY4Wy0IWC7nm7P8EKsp1ZofwU6rJ9XPLpQJt7UUURX71h1FMaqi+lylW6xkD3LqD8oT5Bdp+Vs0bUbPQVRw1Fenjc6G1URU94GOAggyNgsWms= root@empyrean";
+  };
+
+  services.ntp = {
+    enable = true;
+    servers = ["time.nist.gov"];
+  };
+
+  services.openssh = {
+    enable = true;
+    passwordAuthentication = false;
+    permitRootLogin = "prohibit-password";
+  };
+
+  services.tinc.networks.beatific = {
+    listenAddress = "0.0.0.0";
+    chroot = false;
+  };
+
+  networking.firewall = {
+    enable = true;
+    allowPing = true;
+    allowedTCPPorts = [
+      22  # ssh
+      80  # http
+      443 # https
+      655 # tinc
+    ];
+    allowedUDPPorts = [
+      655 # tinc
+    ];
+  };
+
+  security.hideProcessInformation = true;
+
+  users.users.tvb = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "20.03"; # Did you read the comment?
+
+}
+

docstore.nix

@@ -0,0 +1,49 @@
+# Configuration for the DocStore service
+
+{ config, pkgs, ... }:
+
+# Set up python
+with pkgs;
+let docstore-requires = python-packages: with python-packages; [
+  flask flask_login flask_wtf gunicorn
+];
+python3-with-docstore-requires = python3.withPackages docstore-requires;
+in
+{
+  # Create a user for the server process to run under
+  users.users.docstore = {
+    description = "DocStore system user";
+    isSystemUser = true;
+    home = "/home/docstore";
+    createHome = true;
+    packages = [ python3-with-docstore-requires ];
+  };
+
+  # Create the server process systemd unit
+  systemd.services.docstore = {
+    enable = true;
+    description = "DocStore server";
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${python3-with-docstore-requires}/bin/python -m docstore.server /srv/docstore --port 8001";
+      Restart = "on-failure";
+      User = "docstore";
+      WorkingDirectory = "/home/docstore/DocStore";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  # Configure nginx to forward to the server at the docs subdomain
+  services.nginx.virtualHosts."docs.alogoulogoi.com" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      access_log /var/log/nginx/access.docs.log;
+    '';
+    locations."/".extraConfig = ''
+      proxy_buffering off;
+      proxy_pass http://localhost:8001/;
+    '';
+  };
+}
+

gitea.nix

@@ -0,0 +1,62 @@
+# Configuration for Gitea instance
+
+{ config, pkgs, ... }:
+
+{
+  # Gitea configuration
+  services.gitea = {
+    # Enable Gitea and configure for reverse proxy
+    enable = true;
+    httpAddress = "127.0.0.1";
+    httpPort = 3300;
+
+    # Private server
+    disableRegistration = true;
+    #useWizard = true;  # Needed for first-time building
+
+    # Settings
+    appName = "Horse Codes";
+    lfs.enable = true;
+    dump = {
+      enable = true;
+      interval = "weekly";
+    };
+    log.level = "Info";
+    settings = {
+      "repository" = {
+        DEFAULT_PRIVATE = true;
+      };
+      "ui" = {
+        DEFAULT_THEME = "arc-green";
+        SHOW_USER_EMAIL = false;
+      };
+      "ui.meta" = {
+        AUTHOR = "Horse Codes";
+        DESCRIPTION = "Alogoulogoi Gitea instance";
+        KEYWORDS = "";
+      };
+      "security" = {
+        INSTALL_LOCK = true;
+      };
+      "picture" = {
+        DISABLE_GRAVATAR = true;
+      };
+      "cron.archive_cleanup".ENABLED = false;
+      "cron.sync_external_users".ENABLED = false;
+    };
+  };
+
+  # Configure nginx to forward to the server at the git subdomain
+  services.nginx.virtualHosts."git.alogoulogoi.com" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      access_log /var/log/nginx/access.git.log;
+    '';
+    locations."/".extraConfig = ''
+      proxy_buffering off;
+      proxy_pass http://localhost:3300/;
+    '';
+  };
+}
+

hardware-configuration.nix

@@ -0,0 +1,22 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "sr_mod" "xen_blkfront" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/60aa6f09-f77f-472e-beb1-3441423a5d6d";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 1;
+}