biotite: move services to new machines and new domain
- related services: forgejo, miniflux, vaultwarden - moved from xinyang.life to xiny.li - clean up modules
This commit is contained in:
parent
947e97ce4e
commit
ad9c205fc5
SSH key fingerprint:
SHA256:UU5pRTl7NiLFJbWJZa+snLylZSXIz5rgHmwjzv8v4oE
18 changed files with 263 additions and 670 deletions
|
|
@ -23,26 +23,6 @@ in
|
|||
8448
|
||||
];
|
||||
|
||||
custom.vaultwarden = {
|
||||
enable = true;
|
||||
domain = "vaultwarden.xinyang.life";
|
||||
};
|
||||
|
||||
custom.hedgedoc = {
|
||||
enable = true;
|
||||
caddy = true;
|
||||
domain = "docs.xinyang.life";
|
||||
mediaPath = "/mnt/storage/hedgedoc";
|
||||
oidc = {
|
||||
enable = true;
|
||||
baseURL = "https://auth.xinyang.life/oauth2/openid/hedgedoc";
|
||||
authorizationURL = "https://auth.xinyang.life/ui/oauth2";
|
||||
tokenURL = "https://auth.xinyang.life/oauth2/token";
|
||||
userProfileURL = "https://auth.xinyang.life/oauth2/openid/hedgedoc/userinfo";
|
||||
};
|
||||
environmentFile = config.sops.secrets.hedgedoc_env.path;
|
||||
};
|
||||
|
||||
custom.monitoring = {
|
||||
promtail.enable = true;
|
||||
};
|
||||
|
|
@ -92,40 +72,6 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
custom.miniflux = {
|
||||
enable = true;
|
||||
environment = {
|
||||
LOG_LEVEL = "debug";
|
||||
LISTEN_ADDR = "127.0.0.1:58173";
|
||||
BASE_URL = "https://rss.xinyang.life/";
|
||||
OAUTH2_PROVIDER = "oidc";
|
||||
OAUTH2_CLIENT_ID = "miniflux";
|
||||
OAUTH2_REDIRECT_URL = "https://rss.xinyang.life/oauth2/oidc/callback";
|
||||
OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.xinyang.life/oauth2/openid/miniflux";
|
||||
OAUTH2_USER_CREATION = 1;
|
||||
};
|
||||
oauth2SecretFile = config.sops.secrets."miniflux/oauth2_secret".path;
|
||||
};
|
||||
|
||||
services.matrix-conduit = {
|
||||
enable = true;
|
||||
package = pkgs.matrix-conduit;
|
||||
settings.global = {
|
||||
server_name = "xinyang.life";
|
||||
port = 6167;
|
||||
# database_path = "/var/lib/matrix-conduit/";
|
||||
max_concurrent_requests = 100;
|
||||
log = "info";
|
||||
database_backend = "rocksdb";
|
||||
allow_registration = false;
|
||||
|
||||
well_known = {
|
||||
client = "https://msg.xinyang.life";
|
||||
server = "msg.xinyang.life:443";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.conduit = {
|
||||
isSystemUser = true;
|
||||
group = "conduit";
|
||||
|
|
@ -150,111 +96,6 @@ in
|
|||
environmentFile = config.sops.secrets.gts_env.path;
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
# Use cutting edge instead of lts
|
||||
package = pkgs.forgejo;
|
||||
repositoryRoot = "/mnt/storage/forgejo/repositories";
|
||||
lfs = {
|
||||
enable = true;
|
||||
contentDir = "/mnt/storage/forgejo/lfs";
|
||||
};
|
||||
settings = {
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
server = {
|
||||
ROOT_URL = "https://git.xinyang.life/";
|
||||
START_SSH_SERVER = false;
|
||||
SSH_USER = config.services.forgejo.user;
|
||||
SSH_DOMAIN = "ssh.xinyang.life";
|
||||
SSH_PORT = 22;
|
||||
LFS_MAX_FILE_SIZE = 10737418240;
|
||||
LANDING_PAGE = "/explore/repos";
|
||||
};
|
||||
repository = {
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
};
|
||||
service = {
|
||||
ENABLE_BASIC_AUTHENTICATION = false;
|
||||
};
|
||||
oauth2 = {
|
||||
ENABLED = false; # Disable forgejo as oauth2 provider
|
||||
};
|
||||
oauth2_client = {
|
||||
ACCOUNT_LINKING = "auto";
|
||||
USERNAME = "email";
|
||||
ENABLE_AUTO_REGISTRATION = true;
|
||||
UPDATE_AVATAR = false;
|
||||
OPENID_CONNECT_SCOPES = "openid profile email groups";
|
||||
};
|
||||
other = {
|
||||
SHOW_FOOTER_VERSION = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.forgejo = {
|
||||
serviceConfig = {
|
||||
EnvironmentFile = config.sops.secrets."forgejo/env".path;
|
||||
ExecStartPost = ''
|
||||
${lib.getExe config.services.forgejo.package} admin auth update-oauth \
|
||||
--id 1 \
|
||||
--name kanidm \
|
||||
--provider openidConnect \
|
||||
--key forgejo \
|
||||
--secret $CLIENT_SECRET \
|
||||
--icon-url https://auth.xinyang.life/pkg/img/favicon.png \
|
||||
--group-claim-name forgejo_role --admin-group Admin
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
http_addr = "127.0.0.1";
|
||||
http_port = 3003;
|
||||
root_url = "https://grafana.xinyang.life";
|
||||
domain = "grafana.xinyang.life";
|
||||
};
|
||||
"auth.generic_oauth" = {
|
||||
enabled = true;
|
||||
name = "Kanidm";
|
||||
client_id = "grafana";
|
||||
scopes = "openid,profile,email,groups";
|
||||
auth_url = "https://auth.xinyang.life/ui/oauth2";
|
||||
token_url = "https://auth.xinyang.life/oauth2/token";
|
||||
api_url = "https://auth.xinyang.life/oauth2/openid/grafana/userinfo";
|
||||
use_pkce = true;
|
||||
use_refresh_token = true;
|
||||
allow_sign_up = true;
|
||||
login_attribute_path = "preferred_username";
|
||||
groups_attribute_path = "groups";
|
||||
role_attribute_path = "contains(grafana_role[*], 'GrafanaAdmin') && 'GrafanaAdmin' || contains(grafana_role[*], 'Admin') && 'Admin' || contains(grafana_role[*], 'Editor') && 'Editor' || 'Viewer'";
|
||||
allow_assign_grafana_admin = true;
|
||||
auto_login = true;
|
||||
};
|
||||
"auth" = {
|
||||
disable_login_form = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.grafana.serviceConfig.EnvironmentFile =
|
||||
config.sops.secrets.grafana_oauth_secret.path;
|
||||
|
||||
users.users.git = {
|
||||
isSystemUser = true;
|
||||
useDefaultShell = true;
|
||||
group = "git";
|
||||
extraGroups = [ "forgejo" ];
|
||||
};
|
||||
users.groups.git = { };
|
||||
|
||||
users.users = {
|
||||
${config.services.caddy.user}.extraGroups = [ config.services.ntfy-sh.group ];
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."xinyang.life:443".extraConfig = ''
|
||||
|
|
@ -265,12 +106,6 @@ in
|
|||
flush_interval -1
|
||||
}
|
||||
'';
|
||||
virtualHosts."https://msg.xinyang.life:443".extraConfig = ''
|
||||
reverse_proxy /_matrix/* localhost:6167
|
||||
'';
|
||||
virtualHosts."https://git.xinyang.life:443".extraConfig = ''
|
||||
reverse_proxy http://${config.services.gitea.settings.server.DOMAIN}:${toString config.services.gitea.settings.server.HTTP_PORT}
|
||||
'';
|
||||
|
||||
virtualHosts."http://auth.xinyang.life:80".extraConfig = ''
|
||||
reverse_proxy ${config.security.acme.certs."auth.xinyang.life".listenHTTP}
|
||||
|
|
@ -285,10 +120,6 @@ in
|
|||
}
|
||||
'';
|
||||
|
||||
virtualHosts."https://rss.xinyang.life".extraConfig = ''
|
||||
reverse_proxy ${config.custom.miniflux.environment.LISTEN_ADDR}
|
||||
'';
|
||||
|
||||
virtualHosts."https://ntfy.xinyang.life".extraConfig = ''
|
||||
reverse_proxy unix/${config.services.ntfy-sh.settings.listen-unix}
|
||||
@httpget {
|
||||
|
|
@ -298,13 +129,5 @@ in
|
|||
}
|
||||
redir @httpget https://{host}{uri}
|
||||
'';
|
||||
|
||||
virtualHosts."https://grafana.xinyang.life".extraConfig =
|
||||
let
|
||||
grafanaSettings = config.services.grafana.settings.server;
|
||||
in
|
||||
''
|
||||
reverse_proxy http://${grafanaSettings.http_addr}:${toString grafanaSettings.http_port}
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue