massicot,fix: switch to fix drive
This commit is contained in:
parent
37f59db944
commit
5104c5943e
SSH key fingerprint:
SHA256:UU5pRTl7NiLFJbWJZa+snLylZSXIz5rgHmwjzv8v4oE
16 changed files with 512 additions and 248 deletions
|
|
@ -12,6 +12,7 @@
|
|||
./hardware-configuration.nix
|
||||
./networking.nix
|
||||
./services.nix
|
||||
./services
|
||||
];
|
||||
|
||||
sops = {
|
||||
|
|
@ -50,13 +51,13 @@
|
|||
efiSupport = true;
|
||||
configurationLimit = 5;
|
||||
};
|
||||
|
||||
fileSystems."/mnt/storage" = {
|
||||
device = "//u380335-sub1.your-storagebox.de/u380335-sub1";
|
||||
fsType = "cifs";
|
||||
options = [ "credentials=${config.sops.secrets.storage_box_mount.path}" ];
|
||||
};
|
||||
|
||||
#
|
||||
# fileSystems."/mnt/storage" = {
|
||||
# device = "//u380335-sub1.your-storagebox.de/u380335-sub1";
|
||||
# fsType = "cifs";
|
||||
# options = [ "credentials=${config.sops.secrets.storage_box_mount.path}" ];
|
||||
# };
|
||||
#
|
||||
environment.systemPackages = with pkgs; [
|
||||
cifs-utils
|
||||
git
|
||||
|
|
|
|||
|
|
@ -16,8 +16,17 @@
|
|||
];
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/sda1";
|
||||
device = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_35068215-part1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/mnt/storage" = {
|
||||
device = "/dev/disk/by-id/scsi-0HC_Volume_101302395";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=storage"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,175 +1,214 @@
|
|||
{ config, lib, ... }:
|
||||
{
|
||||
enable = true;
|
||||
autoRemove = true;
|
||||
groups = {
|
||||
forgejo-access = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
forgejo-admin = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
gts-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
ocis-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
linux_users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
hedgedoc-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
immich-users = {
|
||||
members = [
|
||||
"xin"
|
||||
"zhuo"
|
||||
"ycm"
|
||||
];
|
||||
};
|
||||
grafana-superadmins = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
grafana-admins = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
grafana-editors = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
grafana-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
miniflux-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
idm_people_self_mail_write = {
|
||||
members = [ ];
|
||||
sops.secrets = {
|
||||
"kanidm/ocis_android_secret" = {
|
||||
owner = "kanidm";
|
||||
};
|
||||
};
|
||||
persons = {
|
||||
xin = {
|
||||
displayName = "Xinyang Li";
|
||||
mailAddresses = [ "lixinyang411@gmail.com" ];
|
||||
};
|
||||
|
||||
zhuo = {
|
||||
displayName = "Zhuo";
|
||||
mailAddresses = [ "13681104320@163.com" ];
|
||||
};
|
||||
|
||||
ycm = {
|
||||
displayName = "Chunming";
|
||||
mailAddresses = [ "chunmingyou@gmail.com" ];
|
||||
};
|
||||
systemd.services.kanidm.serviceConfig = {
|
||||
BindReadOnlyPaths = [
|
||||
config.sops.secrets."kanidm/ocis_android_secret".path
|
||||
];
|
||||
};
|
||||
systems.oauth2 = {
|
||||
forgejo = {
|
||||
displayName = "ForgeJo";
|
||||
originUrl = "https://git.xinyang.life/";
|
||||
originLanding = "https://git.xinyang.life/user/oauth2/kandim";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
forgejo-access = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
services.kanidm.provision = {
|
||||
enable = true;
|
||||
autoRemove = true;
|
||||
groups = {
|
||||
forgejo-access = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
forgejo-admin = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
gts-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
ocis-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
linux_users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
hedgedoc-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
immich-users = {
|
||||
members = [
|
||||
"xin"
|
||||
"zhuo"
|
||||
"ycm"
|
||||
];
|
||||
};
|
||||
claimMaps = {
|
||||
forgejo_role = {
|
||||
joinType = "array";
|
||||
valuesByGroup = {
|
||||
forgejo-access = [ "Access" ];
|
||||
forgejo-admin = [ "Admin" ];
|
||||
grafana-superadmins = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
grafana-admins = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
grafana-editors = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
grafana-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
miniflux-users = {
|
||||
members = [ "xin" ];
|
||||
};
|
||||
idm_people_self_mail_write = {
|
||||
members = [ ];
|
||||
};
|
||||
};
|
||||
persons = {
|
||||
xin = {
|
||||
displayName = "Xinyang Li";
|
||||
mailAddresses = [ "lixinyang411@gmail.com" ];
|
||||
};
|
||||
|
||||
zhuo = {
|
||||
displayName = "Zhuo";
|
||||
mailAddresses = [ "13681104320@163.com" ];
|
||||
};
|
||||
|
||||
ycm = {
|
||||
displayName = "Chunming";
|
||||
mailAddresses = [ "chunmingyou@gmail.com" ];
|
||||
};
|
||||
};
|
||||
systems.oauth2 = {
|
||||
forgejo = {
|
||||
displayName = "ForgeJo";
|
||||
originUrl = "https://git.xinyang.life/";
|
||||
originLanding = "https://git.xinyang.life/user/oauth2/kandim";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
forgejo-access = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
claimMaps = {
|
||||
forgejo_role = {
|
||||
joinType = "array";
|
||||
valuesByGroup = {
|
||||
forgejo-access = [ "Access" ];
|
||||
forgejo-admin = [ "Admin" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
gts = {
|
||||
displayName = "GoToSocial";
|
||||
originUrl = "https://xinyang.life/";
|
||||
originLanding = "https://xinyang.life/";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
gts-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
gts = {
|
||||
displayName = "GoToSocial";
|
||||
originUrl = "https://xinyang.life/";
|
||||
originLanding = "https://xinyang.life/";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
gts-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
owncloud = {
|
||||
displayName = "ownCloud";
|
||||
originUrl = "https://home.xinyang.life:9201/";
|
||||
originLanding = "https://home.xinyang.life:9201/";
|
||||
public = true;
|
||||
scopeMaps = {
|
||||
ocis-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
owncloud = {
|
||||
displayName = "ownCloud";
|
||||
originUrl = "https://drive.xinyang.life:8443/";
|
||||
originLanding = "https://drive.xinyang.life:8443/";
|
||||
public = true;
|
||||
preferShortUsername = true;
|
||||
scopeMaps = {
|
||||
ocis-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
hedgedoc = {
|
||||
displayName = "HedgeDoc";
|
||||
originUrl = "https://docs.xinyang.life/";
|
||||
originLanding = "https://docs.xinyang.life/auth/oauth2";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
hedgedoc-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
|
||||
owncloud-android = {
|
||||
displayName = "ownCloud Apps";
|
||||
originLanding = "https://drive.xinyang.life:8443/";
|
||||
originUrl = [
|
||||
"http://localhost/"
|
||||
"http://127.0.0.1/"
|
||||
"oc://android.owncloud.com"
|
||||
];
|
||||
basicSecretFile = config.sops.secrets."kanidm/ocis_android_secret".path;
|
||||
preferShortUsername = true;
|
||||
scopeMaps = {
|
||||
ocis-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"offline_access"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
immich-mobile = {
|
||||
displayName = "Immich";
|
||||
originUrl = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
|
||||
originLanding = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
immich-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
|
||||
hedgedoc = {
|
||||
displayName = "HedgeDoc";
|
||||
originUrl = "https://docs.xinyang.life/";
|
||||
originLanding = "https://docs.xinyang.life/auth/oauth2";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
hedgedoc-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
immich = {
|
||||
displayName = "Immich";
|
||||
originUrl = [
|
||||
"https://immich.xinyang.life:8000/api/oauth/mobile-redirect/"
|
||||
"https://immich.xinyang.life:8000/auth/login/"
|
||||
"https://immich.xinyang.life:8000/user-settings/"
|
||||
];
|
||||
originLanding = "https://immich.xinyang.life:8000/auth/login?autoLaunch=0";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
immich-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
miniflux = {
|
||||
displayName = "Miniflux";
|
||||
originUrl = "https://rss.xinyang.life/";
|
||||
originLanding = "https://rss.xinyang.life/";
|
||||
scopeMaps = {
|
||||
miniflux-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
miniflux = {
|
||||
displayName = "Miniflux";
|
||||
originUrl = "https://rss.xinyang.life/";
|
||||
originLanding = "https://rss.xinyang.life/";
|
||||
scopeMaps = {
|
||||
miniflux-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
grafana = {
|
||||
displayName = "Grafana";
|
||||
originUrl = "https://grafana.xinyang.life/";
|
||||
originLanding = "https://grafana.xinyang.life/";
|
||||
scopeMaps = {
|
||||
grafana-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
claimMaps = {
|
||||
grafana_role = {
|
||||
joinType = "array";
|
||||
valuesByGroup = {
|
||||
grafana-superadmins = [ "GrafanaAdmin" ];
|
||||
grafana-admins = [ "Admin" ];
|
||||
grafana-editors = [ "Editor" ];
|
||||
grafana = {
|
||||
displayName = "Grafana";
|
||||
originUrl = "https://grafana.xinyang.life/";
|
||||
originLanding = "https://grafana.xinyang.life/";
|
||||
scopeMaps = {
|
||||
grafana-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
claimMaps = {
|
||||
grafana_role = {
|
||||
joinType = "array";
|
||||
valuesByGroup = {
|
||||
grafana-superadmins = [ "GrafanaAdmin" ];
|
||||
grafana-admins = [ "Admin" ];
|
||||
grafana-editors = [ "Editor" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,19 +1,12 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
networking = {
|
||||
interfaces = {
|
||||
eth0.useDHCP = true;
|
||||
eth0.ipv6.addresses = [
|
||||
{
|
||||
address = "2a01:4f8:c17:345f::1";
|
||||
prefixLength = 64;
|
||||
}
|
||||
];
|
||||
};
|
||||
defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
interface = "eth0";
|
||||
};
|
||||
nameservers = [ ];
|
||||
networking.useNetworkd = true;
|
||||
systemd.network.networks."10-wan" = {
|
||||
matchConfig.MACAddress = "96:00:02:68:7d:2d";
|
||||
networkConfig.DHCP = "ipv4";
|
||||
networkConfig.Gateway = "fe80::1";
|
||||
address = [
|
||||
"2a01:4f8:c17:345f::3/64"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,17 @@
|
|||
storage_box_mount: ENC[AES256_GCM,data:9lOAL3tkfB0pN4/cuM4SX0xoMrW0UUEzTN8spw3MQ3BWrfsRc3Stsce3puXz1sRf,iv:7Q9wzpBgQ3tqcfy0n/c6Ya84Kg60nhR/e2H0pVntWsY=,tag:9a0xvNBGQpCvhxgmV3hrww==,type:str]
|
||||
gts_env: ENC[AES256_GCM,data:StggMdJPevrDbrVDrBDETdQYnSOaTESkgSqpGKrSHXhS21nyCE5ya7/X4l0GVTXoGCyfWG7vK+PDW22mJxpYcj2CBaVUYDu/,iv:2fqWDaWAWxTXdG7w5HU6jBcappFEByNtYs0Jd6PaYnA=,tag:KGhrMemao6g4FkEAZmmacg==,type:str]
|
||||
hedgedoc_env: ENC[AES256_GCM,data:zwAA+zKSJT0tZyYArCaa1lfL0y8DNHDp/thS11DrVxNvjmk38o0ydsKArfZKzFYye+qNBzz1B4sPCdW4cFgQUNgbM+n9AvoMB8CssdmQ+sALKmozA5aEV23q+khZSGlHocP6WA==,iv:SgZruOS1nanK64Ex1dvgoD1HzbGbNa4DFSBuVoaNgEc=,tag:R+I8m1AloDCXs5PdpEpS0w==,type:str]
|
||||
hedgedoc_env: ENC[AES256_GCM,data:+rjEctM6IJUpn7WcAnBS9TkQi2lCq4wKPxbaOApffH0tFyu56SpECrLpmM749I7th3N+UGb0pLM7+Ywr7fbuuMfUuIWom6Y+CKYw4yMlgjzTaaNqBmstvMxLaPnmA01G9ie1rQ==,iv:YBIyQQ6xiUyxSnR5epE5hV9OqETLKC5CFTEaRJdErGU=,tag:77kHYQ2i2APVyadhMhmvWA==,type:str]
|
||||
grafana_oauth_secret: ENC[AES256_GCM,data:43+EBnN912eK/08MdJokWPxi2Lxn/D4hSHPhNmHOk9awWQ7ut/el0vaAa+Epqnui3le2p4VuotQT6XlIuDLrixIomrc6Qw5HERAEdZmbrGvDlrrNhw==,iv:Pfn8rL0LtG3hym9EdSZRjaPLMlWlut/nt2FEtRWnULo=,tag:moDWqF3aBbnO4aG0Cysfcw==,type:str]
|
||||
miniflux:
|
||||
oauth2_secret: ENC[AES256_GCM,data:jcZR9E9jXNKfkAoGgBI19qQeaz26R6qiAWjP4XrftHSCQV974tjJl+fiU8Xgi0bViA==,iv:/aY0bL/oAAHBhohy3FHB/UEDYryw7A7JOKvEbLtDHJg=,tag:Fn/6NurNkRphXySR+y9S9Q==,type:str]
|
||||
forgejo:
|
||||
env: ENC[AES256_GCM,data:TMeguXfanISeyvsay9SBqm3SSGKpp5nCkqhHblf0QHNzHWGQKwpORmWfOtVfgOh9qdDqq8wYBpXznmbvixjV,iv:IR/rMoAIvZCw9FURmau4+g8c3pvI9BRs7v1NJ5ia4jI=,tag:kjwf6RN5HN8I2sUhDcr4UQ==,type:str]
|
||||
restic:
|
||||
repo: ENC[AES256_GCM,data:/vybkTU7LMWSlco9W2pJouU9wm4okXClSHXQMCA6SGIHWp4Ppl6C+jS4sNJALc6ntKzcEHyWO/R3JPjQKjZNH4YtrnNQp/ZY9g==,iv:gAvp6blg5JuBKzLw6YSgM1Uc24Aesov3ttCRXZXBvJw=,tag:pvH1y6BFOl7jIn/qQejUbQ==,type:str]
|
||||
password: ENC[AES256_GCM,data:5eIIBtGtBFwcAQ+ZwTYOtg==,iv:3GEM8Imu0i1aTwwSspvz2EzwJOXUC/b15hzkFFuZ+YY=,tag:wscba+nMtshldgUtcEKnOw==,type:str]
|
||||
kanidm:
|
||||
ocis_android_secret: ENC[AES256_GCM,data:vuEIvBEhIME+C/s3xoskddtf5nogC9nPq+HUyyAl3u9nvH3bTzUkfE/1wolaCLeeupnD3pDokdRyKzjEmoZACQ==,iv:cmx/0i23p1uEI0oAiWdcvGRq4+075+VuAMkFSfXzfso=,tag:yVnqz16L5kyW9vAVng53pA==,type:str]
|
||||
ocis_desktop_secret: ENC[AES256_GCM,data:WTfUQzTB9An9p9xof2nuIkD5mYzMaisS62Cv86zX05rkB/wXmTnZiY7ztUoN9OmhGoPgeZg0+d+Jo6bV1hoqlw==,iv:V4iqtYIOcyDXIijcD0IXqpaSs2rxyWiOSZGer/BFSe4=,tag:1nCU1KmWQcY5ZXjlzhxaQQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -30,8 +36,8 @@ sops:
|
|||
dnFBa0lDWWZtS1BHdzBoVzNTaGNkSEEKi/W1n7RT8NpTp00SBMwxsUJAPDhumJ/i
|
||||
V2VnaSNwouD3SswTcoBzqQpBP9XrqzjIYGke90ZODFQbMY9WDQ+O0g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-08-21T05:54:31Z"
|
||||
mac: ENC[AES256_GCM,data:oNBabsDRuHjMBXynr8ytCLmv5NPyA0mRUcPJfFZjjAb9ZbGP+pquwJT3S0l2yo4Nsd0YQP8X1pGS3PEv9v+N538bxmMJJCERR7iZ5U5G4h0AvKi+UkjkveDdhPWBXhC1O+Up7reT/LLzOiZ1WUHCYRQfcb9R1RL3G2NpeYuOShk=,iv:FLmtKyZjZuGDnMjOgJdoIU9EXLQSZavs8f4q2C+Sxbk=,tag:sGoJNppCTYxZ2u2l0eMHgg==,type:str]
|
||||
lastmodified: "2024-09-14T05:48:04Z"
|
||||
mac: ENC[AES256_GCM,data:zdGdvk2pMaZYUsTI9XsSUpgtWrNmZNPg7KoV0zAt19h7Qccu3OGTSfXD+rhhhxhhWgBohGIhDVAVQcORnAw1Y/ykgqxERCANuzoBvvR1eKfPcRNiCEr2dmUAybDF7B2MWKlJ5Fsnpk/caK717Fe8XdAJDuplFwmMWi2c1c61/NQ=,iv:KPQTGzFQH+CQmLeXBzMSbU4lVH0/Wc6CeTp6w/pMMOY=,tag:UVA+sQwQa2bpy2/woBgAkQ==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.9.0
|
||||
|
|
|
|||
|
|
@ -8,6 +8,9 @@ let
|
|||
kanidm_listen_port = 5324;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./kanidm-provision.nix
|
||||
];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
|
|
@ -46,33 +49,6 @@ in
|
|||
exporters.miniflux.enable = true;
|
||||
};
|
||||
|
||||
systemd.mounts =
|
||||
map
|
||||
(share: {
|
||||
what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
|
||||
where = "/mnt/storage/${share}";
|
||||
type = "cifs";
|
||||
options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
|
||||
before = [ "${share}.service" ];
|
||||
after = [ "cachefilesd.service" ];
|
||||
wantedBy = [ "${share}.service" ];
|
||||
})
|
||||
[
|
||||
"forgejo"
|
||||
"gotosocial"
|
||||
"conduit"
|
||||
"hedgedoc"
|
||||
];
|
||||
|
||||
services.cachefilesd.enable = true;
|
||||
|
||||
system.activationScripts = {
|
||||
conduit-media-link.text = ''
|
||||
mkdir -m 700 -p /var/lib/private/matrix-conduit/media
|
||||
chown conduit:conduit /var/lib/private/matrix-conduit/media
|
||||
mount --bind --verbose /mnt/storage/conduit/media /var/lib/private/matrix-conduit/media
|
||||
'';
|
||||
};
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
certs."auth.xinyang.life" = {
|
||||
|
|
@ -106,7 +82,6 @@ in
|
|||
online_backup.versions = 7;
|
||||
# db_path = "/var/lib/kanidm/kanidm.db";
|
||||
};
|
||||
provision = import ./kanidm-provision.nix;
|
||||
};
|
||||
|
||||
custom.miniflux = {
|
||||
|
|
@ -144,6 +119,12 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
users.users.conduit = {
|
||||
isSystemUser = true;
|
||||
group = "conduit";
|
||||
};
|
||||
users.groups.conduit = { };
|
||||
|
||||
services.gotosocial = {
|
||||
enable = true;
|
||||
settings = {
|
||||
|
|
|
|||
5
machines/massicot/services/default.nix
Normal file
5
machines/massicot/services/default.nix
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
imports = [
|
||||
./restic.nix
|
||||
];
|
||||
}
|
||||
51
machines/massicot/services/restic.nix
Normal file
51
machines/massicot/services/restic.nix
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
sqliteBackup = path: ''
|
||||
mkdir -p /backup${path}
|
||||
${lib.getExe pkgs.sqlite} ${path} "vacuum into '/var/backup${path}'"
|
||||
'';
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"restic/repo" = {
|
||||
sopsFile = ../secrets.yaml;
|
||||
};
|
||||
"restic/password" = {
|
||||
sopsFile = ../secrets.yaml;
|
||||
};
|
||||
};
|
||||
|
||||
custom.restic = {
|
||||
enable = true;
|
||||
repositoryFile = config.sops.secrets."restic/repo".path;
|
||||
passwordFile = config.sops.secrets."restic/password".path;
|
||||
paths = [
|
||||
"/var/backup"
|
||||
"/mnt/storage"
|
||||
];
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
compression = "zstd";
|
||||
compressionLevel = 9;
|
||||
location = "/var/backup/postgresql";
|
||||
};
|
||||
|
||||
services.restic.backups.${config.networking.hostName} = {
|
||||
backupPrepareCommand = builtins.concatStringsSep "\n" [
|
||||
(sqliteBackup "/var/lib/hedgedoc/db.sqlite")
|
||||
(sqliteBackup "/var/lib/bitwarden_rs/db.sqlite3")
|
||||
(sqliteBackup "/var/lib/gotosocial/database.sqlite")
|
||||
(sqliteBackup "/var/lib/kanidm/kanidm.db")
|
||||
];
|
||||
extraBackupArgs = [
|
||||
"--limit-upload=1024"
|
||||
];
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue