grimm-nixos-laptop/modules/default.nix

222 lines
5.9 KiB
Nix
Raw Normal View History

2024-05-11 22:55:59 +02:00
{ lib, config, ... }:
let
inherit (config.networking) domain;
root_email = "contact@${domain}";
in
{
imports = [
2024-05-09 12:16:28 +02:00
./matrix.nix
./puffer.nix
./gitea.nix
./grafana.nix
./nextcloud.nix
./prometheus.nix
# ./mjolnir.nix
./fail2ban.nix
./email.nix
./discord-matrix-bridge.nix
./mastodon.nix
2024-05-09 22:32:39 +02:00
./nix_cache.nix
2024-05-12 09:46:41 +02:00
./auth.nix
];
2024-05-11 22:55:59 +02:00
options.serverConfig =
let
inherit (lib) mkOption types mkEnableOption;
in
{
ports = mkOption {
type = types.attrsOf (
types.submodule (
{ ... }:
{
options = {
port = mkOption {
type = types.int;
description = "port to define";
};
open = mkEnableOption "whether to open the port" // {
default = true;
};
};
2024-05-11 22:55:59 +02:00
}
)
);
default = { };
description = "ports associated with services";
};
2024-05-09 12:16:28 +02:00
2024-05-11 22:55:59 +02:00
vhosts = mkOption {
type = types.attrsOf (
types.submodule (
{ config, ... }:
let
type_lookup = {
proxy = {
locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.port}";
};
redirect = {
locations."/".return = "307 https://${domain}";
};
custom = { };
none = { };
};
2024-05-11 22:55:59 +02:00
in
{
options = {
port = mkOption {
type = types.int;
default = 80;
description = "port to redirect to this vhost";
};
host = mkOption {
type = types.nonEmptyStr;
description = "name if the vhost";
};
accessType = mkOption {
type = types.enum (lib.attrNames type_lookup);
default = "none";
description = "nginx template to use";
};
extraNginx = mkOption {
type = types.attrs;
default = type_lookup.${config.accessType};
description = "location definition for nginx";
};
};
2024-05-11 22:55:59 +02:00
}
)
);
default = { };
description = "vhosts associated with services";
};
};
2024-05-09 12:16:28 +02:00
config = {
networking.firewall.allowedTCPPorts = [
80
443
] ++ (lib.mapAttrsToList (n: v: v.port) (lib.filterAttrs (n: v: v.open) config.serverConfig.ports));
# ++ (lib.mapAttrsToList (n: v: v.port) (lib.filterAttrs (n: v: !v.disableWebAccess) config.serverConfig.vhosts));
2024-05-09 12:16:28 +02:00
services.nginx.virtualHosts =
{
"${domain}" = {
forceSSL = true;
enableACME = lib.mkForce false; # use the correct cert, not some weird one that matrix-synapse module supplies
useACMEHost = domain;
locations."/" = {
root = "/var/www/${domain}";
};
};
}
// (lib.concatMapAttrs (_: host: {
"${host.host}" = {
serverName = host.host;
forceSSL = true;
useACMEHost = domain;
enableACME = lib.mkForce false;
} // host.extraNginx;
}) (lib.filterAttrs (n: v: v.accessType != "none") config.serverConfig.vhosts));
2024-05-09 12:16:28 +02:00
serverConfig = {
ports = {
puffer_sftp_port.port = 5657;
gitea_ssh_port.port = 2222;
node_exporter = {
port = 9002;
open = false;
};
discord_matrix_bridge_port = {
port = 9005;
open = false;
};
redis_nextcloud_port = {
port = 6379;
open = false;
};
2024-05-12 10:39:52 +02:00
open_ldap_port = {
port = 389;
open = false;
};
2024-05-09 12:16:28 +02:00
};
2024-05-09 12:16:28 +02:00
vhosts = {
puffer_host = {
port = 8080;
host = "puffer.${domain}";
2024-05-10 16:59:38 +02:00
accessType = "proxy";
2024-05-09 12:16:28 +02:00
};
tlemap_host = {
port = 8100;
host = "tlemap.${domain}";
2024-05-10 16:59:38 +02:00
accessType = "proxy";
2024-05-09 12:16:28 +02:00
};
mail_host = {
host = "mail.${domain}";
accessType = "redirect";
};
gitea_host = {
host = "git.${domain}";
port = 8081;
2024-05-10 16:59:38 +02:00
accessType = "proxy";
};
matrix_host = {
accessType = "redirect";
host = "matrix.${domain}";
};
prometheus_host = {
host = "prometheus.${domain}";
port = 9090;
accessType = "redirect";
};
grafana_host = {
host = "grafana.${domain}";
2024-05-10 16:59:38 +02:00
accessType = "proxy";
port = 8082;
};
nextcloud_host = rec {
host = "cloud.${domain}";
port = 8083;
accessType = "custom";
extraNginx.serverName = host;
};
mastodon_host = {
host = "mastodon.${domain}";
};
2024-05-10 16:59:38 +02:00
nix_cache_host = {
2024-05-09 22:32:39 +02:00
host = "nixcache.${domain}";
port = 5000;
2024-05-25 21:50:51 +02:00
accessType = "proxy";
2024-05-10 16:59:38 +02:00
};
auth_host = {
host = "auth.${domain}";
2024-05-25 21:50:51 +02:00
port = 38080;
2024-05-10 16:59:38 +02:00
accessType = "proxy";
2024-05-09 22:32:39 +02:00
};
};
};
2024-05-09 12:16:28 +02:00
security.acme = {
acceptTerms = true;
defaults.email = root_email;
certs."${domain}" = {
webroot = "/var/lib/acme/acme-challenge/";
extraDomainNames = lib.mapAttrsToList (n: v: v.host) config.serverConfig.vhosts;
};
};
services.nginx = {
# package = pkgs.nginxStable.override { openssl = pkgs.libressl; };
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
};
users.users.nginx.extraGroups = [ "acme" ];
};
}