natto1784/dotfiles
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Remilia: updates

Browse Source 
services: add znc and some random changes
networking: random changes
mailserver: add masti@weirdnatto.in
and some other misc changes
This commit is contained in:
Amneesh Singh
2022-03-09 10:53:07 +05:30
parent c27c8c3c56
commit 53b18802dd
5 changed files with 141 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
hosts/remilia/services.nix
View File

@@ -1,12 +1,19 @@
{config, pkgs, ...}:
{ config, pkgs, lib, ... }:
{
services = {
openssh = { enable = true;
openssh = {
enable = true;
permitRootLogin = "yes";
ports = [ 22001 22002 ];
};
znc = {
enable = true;
mutable = true;
useLegacyConfig = false;
};
nginx = {
enable = true;
package = (pkgs.nginx.overrideAttrs(oa: {
package = (pkgs.nginx.overrideAttrs (oa: {
configureFlags = oa.configureFlags ++ [ "--with-mail" "--with-mail_ssl_module" ];
}));
virtualHosts = {
@@ -20,13 +27,75 @@
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://10.55.0.2:5001";
proxyPass = "http://10.55.0.2:5000";
extraConfig = ''
client_max_body_size 64M;
proxy_set_header Host $host;
'';
};
};
"vault.weirdnatto.in" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "https://10.55.0.2:8800";
extraConfig = ''
proxy_set_header Host $host;
'';
};
};
"consul.weirdnatto.in" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://10.55.0.2:8500";
extraConfig = ''
proxy_set_header Host $host;
'';
};
};
"nomad.weirdnatto.in" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://10.55.0.2:4646";
extraConfig = ''
proxy_set_header Host $host;
proxy_buffering off;
proxy_read_timeout 310s;
'';
};
};
"radio.weirdnatto.in" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://10.55.0.3:8000";
extraConfig = ''
proxy_set_header Host $host;
'';
};
};
"ci.weirdnatto.in" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://10.55.0.2:6666";
extraConfig = ''
proxy_set_header Host $host;
'';
};
};
};
/*streamConfig = ''
upstream gitea {
server 10.55.0.2:222;
}
server {
listen 22001;
proxy_pass gitea;
}
'';*/
};
vault-agent = {
enable = true;
@@ -54,10 +123,16 @@
}
{
source = pkgs.writeText "natto@weirdnatto.in.tpl" ''
{{ with secret "kv/systems/Remilia" }}{{ .Data.data.nattomail }}{{ end }}
{{ with secret "kv/systems/Remilia/mail" }}{{ .Data.data.nattomail }}{{ end }}
'';
destination = "/var/secrets/natto@weirdnatto.in.key";
}
{
source = pkgs.writeText "masti@weirdnatto.in.tpl" ''
{{ with secret "kv/systems/Remilia/mail" }}{{ .Data.data.mastimail }}{{ end }}
'';
destination = "/var/secrets/masti@weirdnatto.in.key";
}
];
};
};
@@ -67,13 +142,15 @@
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHingN2Aho+KGgEvBMjtoez+W1svl9uVoa4vG0d646j"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILCH975XCps+VCzo8Fpp5BkbtiFmj9y3//FBVYlQ7/yo"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0jyHWuWBKzucnARINqQ/A0AFPghxayh0DDthbpOhaz"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFyKi0HYfkgvEDvjzmDRGwAq2z2KOkfv7scTVSnonBh"
];
security.acme = {
acceptTerms = true;
certs = {
"weirdnatto.in".email = "natto+acme@weirdnatto.in";
"git.weirdnatto.in".email = "git+acme@weirdnatto.in";
};
"weirdnatto.in".extraDomainNames = lib.singleton "www.weirdnatto.in";
} //
lib.mapAttrs' (n: _: lib.nameValuePair n ({ email = "natto@weirdnatto.in"; })) config.services.nginx.virtualHosts;
};
security.pki.certificateFiles = [ ../../cert.pem ];
}