Initial commit for empyrean configs
This commit is contained in:
parent
93b0b86108
commit
2fb16b51b3
|
@ -0,0 +1,47 @@
|
|||
# Configuration for the Amanuensis service
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
# Set up python
|
||||
with pkgs;
|
||||
let amanuensis-requires = python-packages: with python-packages; [
|
||||
flask flask_login flask_wtf gunicorn
|
||||
];
|
||||
python3-with-amanuensis-requires = python3.withPackages amanuensis-requires;
|
||||
in
|
||||
{
|
||||
# Create a user for the server process to run under
|
||||
users.users.amanuensis = {
|
||||
isNormalUser = true;
|
||||
description = "Amanuensis server user";
|
||||
packages = [ python3-with-amanuensis-requires ];
|
||||
};
|
||||
|
||||
# Create the server process systemd unit
|
||||
systemd.services.amanuensis = {
|
||||
enable = false;
|
||||
description = "Amanuensis Lexicon server";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "/home/amanuensis/Amanuensis/run.sh";
|
||||
Restart = "on-failure";
|
||||
User = "amanuensis";
|
||||
WorkingDirectory = "/home/amanuensis";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
# Configure nginx to forward to the server at the lexicon subdomain
|
||||
services.nginx.virtualHosts."lexicon.alogoulogoi.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
access_log /var/log/nginx/access.lexicon.log;
|
||||
'';
|
||||
locations."/".extraConfig = ''
|
||||
proxy_buffering off;
|
||||
proxy_pass http://localhost:8000/;
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# Configuration for the catacomb forwarder
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Configure nginx to forward to the server on catacomb
|
||||
services.nginx.virtualHosts."catacomb.alogoulogoi.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
access_log /var/log/nginx/access.catacomb.log;
|
||||
'';
|
||||
locations."/".extraConfig = ''
|
||||
proxy_buffering off;
|
||||
proxy_pass http://10.7.3.16:7473/;
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./amanuensis.nix
|
||||
./docstore.nix
|
||||
./catacomb.nix
|
||||
./gitea.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
version = 2;
|
||||
device = "/dev/xvda";
|
||||
extraConfig = "serial --unit=0 --speed=115200 ; terminal_input serial console ; terminal_output serial console";
|
||||
};
|
||||
boot.kernelParams = ["console=ttyS0"];
|
||||
console.extraTTYs = ["ttyS0"];
|
||||
|
||||
networking.hostName = "empyrean";
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "UTC";
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim htop git tinc_pre python3
|
||||
gitea
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts = {
|
||||
# Static pages
|
||||
"www.alogoulogoi.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
root = "/srv/www/";
|
||||
extraConfig = ''
|
||||
access_log /var/log/nginx/access.www.log;
|
||||
index index.html;
|
||||
'';
|
||||
};
|
||||
# Deny all other subdomains
|
||||
"alogoulogoi.com" = {
|
||||
default = true;
|
||||
locations."/".return = "444";
|
||||
};
|
||||
};
|
||||
};
|
||||
security.acme = {
|
||||
email = "tim.vanbaak+alogoulogoi@gmail.com";
|
||||
acceptTerms = true;
|
||||
};
|
||||
|
||||
services.gitolite = {
|
||||
enable = true;
|
||||
adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDkSvOcY0eFuYqewc73MNHGP/Owzfnt+BZDSOCwr4h+gJenOBmXol695sRKdIw8phgshb6LsNyWeEAr3YISwzjdOvWNKpSsdyH/79VFIffC+/RBhPFhIPHn1zpHIwgthXji8FMmnO6B1bhJvbJxD5bUqhdBLnUeMhNgUkDj4Qi42S8yK1VZkgWRuPOTGqlzkODEdzG6OST7ndL58jEQaK8R2KRC2cZfrjingmPL+ORyf1/lGwyF6MEAmbQuE6UdspMs8FWt2e8jQJS+ZQ8dl+NDFrC1QfPRFpBJWnQceBcfAVZTtDaJpRhc4ClZstBy/bVRjiKeQiNv5NasjKRvvIvot4+LXmBKrXJs81enExtMSHMPuqPRlyVZLMMCVmdLDP/HUYOASDzlUhV/v5Wp0jjY4Wy0IWC7nm7P8EKsp1ZofwU6rJ9XPLpQJt7UUURX71h1FMaqi+lylW6xkD3LqD8oT5Bdp+Vs0bUbPQVRw1Fenjc6G1URU94GOAggyNgsWms= root@empyrean";
|
||||
};
|
||||
|
||||
services.ntp = {
|
||||
enable = true;
|
||||
servers = ["time.nist.gov"];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
passwordAuthentication = false;
|
||||
permitRootLogin = "prohibit-password";
|
||||
};
|
||||
|
||||
services.tinc.networks.beatific = {
|
||||
listenAddress = "0.0.0.0";
|
||||
chroot = false;
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
allowedTCPPorts = [
|
||||
22 # ssh
|
||||
80 # http
|
||||
443 # https
|
||||
655 # tinc
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
655 # tinc
|
||||
];
|
||||
};
|
||||
|
||||
security.hideProcessInformation = true;
|
||||
|
||||
users.users.tvb = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
};
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "20.03"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
# Configuration for the DocStore service
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
# Set up python
|
||||
with pkgs;
|
||||
let docstore-requires = python-packages: with python-packages; [
|
||||
flask flask_login flask_wtf gunicorn
|
||||
];
|
||||
python3-with-docstore-requires = python3.withPackages docstore-requires;
|
||||
in
|
||||
{
|
||||
# Create a user for the server process to run under
|
||||
users.users.docstore = {
|
||||
description = "DocStore system user";
|
||||
isSystemUser = true;
|
||||
home = "/home/docstore";
|
||||
createHome = true;
|
||||
packages = [ python3-with-docstore-requires ];
|
||||
};
|
||||
|
||||
# Create the server process systemd unit
|
||||
systemd.services.docstore = {
|
||||
enable = true;
|
||||
description = "DocStore server";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${python3-with-docstore-requires}/bin/python -m docstore.server /srv/docstore --port 8001";
|
||||
Restart = "on-failure";
|
||||
User = "docstore";
|
||||
WorkingDirectory = "/home/docstore/DocStore";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
# Configure nginx to forward to the server at the docs subdomain
|
||||
services.nginx.virtualHosts."docs.alogoulogoi.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
access_log /var/log/nginx/access.docs.log;
|
||||
'';
|
||||
locations."/".extraConfig = ''
|
||||
proxy_buffering off;
|
||||
proxy_pass http://localhost:8001/;
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
# Configuration for Gitea instance
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Gitea configuration
|
||||
services.gitea = {
|
||||
# Enable Gitea and configure for reverse proxy
|
||||
enable = true;
|
||||
httpAddress = "127.0.0.1";
|
||||
httpPort = 3300;
|
||||
|
||||
# Private server
|
||||
disableRegistration = true;
|
||||
#useWizard = true; # Needed for first-time building
|
||||
|
||||
# Settings
|
||||
appName = "Horse Codes";
|
||||
lfs.enable = true;
|
||||
dump = {
|
||||
enable = true;
|
||||
interval = "weekly";
|
||||
};
|
||||
log.level = "Info";
|
||||
settings = {
|
||||
"repository" = {
|
||||
DEFAULT_PRIVATE = true;
|
||||
};
|
||||
"ui" = {
|
||||
DEFAULT_THEME = "arc-green";
|
||||
SHOW_USER_EMAIL = false;
|
||||
};
|
||||
"ui.meta" = {
|
||||
AUTHOR = "Horse Codes";
|
||||
DESCRIPTION = "Alogoulogoi Gitea instance";
|
||||
KEYWORDS = "";
|
||||
};
|
||||
"security" = {
|
||||
INSTALL_LOCK = true;
|
||||
};
|
||||
"picture" = {
|
||||
DISABLE_GRAVATAR = true;
|
||||
};
|
||||
"cron.archive_cleanup".ENABLED = false;
|
||||
"cron.sync_external_users".ENABLED = false;
|
||||
};
|
||||
};
|
||||
|
||||
# Configure nginx to forward to the server at the git subdomain
|
||||
services.nginx.virtualHosts."git.alogoulogoi.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
access_log /var/log/nginx/access.git.log;
|
||||
'';
|
||||
locations."/".extraConfig = ''
|
||||
proxy_buffering off;
|
||||
proxy_pass http://localhost:3300/;
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "sr_mod" "xen_blkfront" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/60aa6f09-f77f-472e-beb1-3441423a5d6d";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nix.maxJobs = lib.mkDefault 1;
|
||||
}
|
Loading…
Reference in New Issue