jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed servers/nginx quirks on 24.05

Browse Source
This commit is contained in:
Danilo Reyes
2024-06-09 14:15:32 -06:00
parent 5faf09f546
commit 2998c6fe40
8 changed files with 285 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
hosts/miniserver/configuration.nix
View File

@@ -22,9 +22,9 @@ in {
ffmpreg.enable = true;
ffmpeg4discord.enable = true;
manage-library.enable = true;
sync-subs.enable = true;
pika-list.enable = true;
find-dup-episodes.enable = true;
update-dns.enable = true;
};
};
fonts.fontconfig.enable = true;
@@ -112,14 +112,7 @@ in {
# };
};
systemd = {
packages = let
pkgs = import (builtins.fetchTarball {
url =
"https://github.com/NixOS/nixpkgs/archive/9957cd48326fe8dbd52fdc50dd2502307f188b0d.tar.gz";
}) { };
myPkg = pkgs.qbittorrent-nox;
in [ myPkg ];
packages = [ pkgs.qbittorrent-nox ];
services = {
"qbittorrent-nox@jawz" = {
enable = true;

66
hosts/miniserver/nginx.nix
View File

@@ -2,30 +2,30 @@
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{ config, ... }:
let
localhost = "127.0.0.1";
workstation = "192.168.1.64";
# workstation = "192.168.1.64";
domain = "servidos.lat";
jellyfinPort = 8096;
nextcloudPort = 80;
shioriPort = 4368;
# nextcloudPort = 80;
collaboraPort = 9980;
flamePort = 5005;
secretFlamePort = 5007;
lidarrPort = 8686;
# lidarrPort = 8686;
qbitPort = 9091;
prowlarrPort = 9696;
radarrPort = 7878;
sonarrPort = 8989;
# prowlarrPort = 9696;
# radarrPort = 7878;
# sonarrPort = 8989;
mealiePort = 9925;
ryotPort = 8765;
scrobblePort = 9078;
malojaPort = 42010;
darkwirePort = 3001;
jiraPort = 8091;
metatubePort = 8881;
bazarrPort = config.services.bazarr.listenPort;
kavitaPort = config.services.kavita.port;
# bazarrPort = config.services.bazarr.listenPort;
# kavitaPort = config.services.kavita.port;
vaultPort = config.services.vaultwarden.config.ROCKET_PORT;
audiobookPort = config.services.audiobookshelf.port;
microbinPort = config.services.microbin.settings.MICROBIN_PORT;
@@ -52,21 +52,21 @@ in {
http2 = true;
};
proxy = port:
base { "/".proxyPass = "http://${localhost}:${toString (port)}/"; };
proxyArr = port:
proxy port // {
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
base { "/".proxyPass = "http://${localhost}:${toString port}/"; };
# proxyArr = port:
# proxy port // {
# extraConfig = ''
# proxy_set_header Host $host;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header X-Forwarded-Host $host;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection $http_connection;
proxy_redirect off;
proxy_http_version 1.1;
'';
};
# proxy_redirect off;
# proxy_http_version 1.1;
# '';
# };
in {
# "movies.${domain}" = proxyArr radarrPort // { };
# "indexer.${domain}" = proxyArr prowlarrPort // { };
@@ -81,13 +81,13 @@ in {
"tracker.${domain}" = proxy ryotPort // { };
"scrobble.${domain}" = proxy scrobblePort // { };
"maloja.${domain}" = proxy malojaPort // { };
"jira.${domain}" = proxy jiraPort // { };
"bookmarks.${domain}" = proxy shioriPort // { };
"bajameesta.${domain}" = proxy metatubePort // { };
"qampqwn4wprhqny8h8zj.${domain}" = proxy secretFlamePort // { };
"xfwmrle6h6skqujbeizw.${domain}" = proxy qbitPort // { };
"audiobooks.${domain}" = base {
"/" = {
proxyPass = "http://${localhost}:${toString (audiobookPort)}";
proxyPass = "http://${localhost}:${toString audiobookPort}";
extraConfig = ''
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
@@ -103,7 +103,7 @@ in {
};
"dontcancelmeplz.${domain}" = base {
"/" = {
proxyPass = "http://${localhost}:${toString (darkwirePort)}";
proxyPass = "http://${localhost}:${toString darkwirePort}";
proxyWebsockets = true;
extraConfig = ''
# Ensuring it can use websockets
@@ -143,7 +143,7 @@ in {
location = /web/ {
# Proxy main Jellyfin traffic
proxy_pass http://${localhost}:${
toString (jellyfinPort)
toString jellyfinPort
}/web/index.html;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
@@ -155,11 +155,11 @@ in {
'';
locations = {
"/" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}";
proxyPass = "http://${localhost}:${toString jellyfinPort}";
proxyWebsockets = true;
};
"/socket" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}";
proxyPass = "http://${localhost}:${toString jellyfinPort}";
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
@@ -167,7 +167,7 @@ in {
'';
};
"~ /Items/(.*)/Images" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}";
proxyPass = "http://${localhost}:${toString jellyfinPort}";
extraConfig = ''
proxy_cache jellyfin;
proxy_cache_revalidate on;
@@ -175,7 +175,7 @@ in {
'';
};
"~* ^/Videos/(.*)/(?!live)" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}";
proxyPass = "http://${localhost}:${toString jellyfinPort}";
extraConfig = ''
# Set size of a slice (this amount will be always requested from the backend by nginx)
# Higher value means more latency, lower more overhead
@@ -219,7 +219,7 @@ in {
};
"collabora.${domain}" = let
collaboraString = "http://${localhost}:${toString (collaboraPort)}";
collaboraString = "http://${localhost}:${toString collaboraPort}";
collaboraProxy = {
proxyPass = collaboraString;
extraConfig = ''

195
hosts/miniserver/servers.nix
View File

@@ -1,49 +1,44 @@
{ config, lib, pkgs, modulesPath, ... }:
{ config, pkgs, ... }:
let
localhost = "127.0.0.1";
postgresSocket = "/run/postgresql";
unstable = import
(builtins.fetchTarball "https://github.com/nixos/nixpkgs/tarball/master") {
config = config.nixpkgs.config;
};
in {
imports = [ ./nginx.nix ];
disabledModules = [ "services/web-apps/shiori.nix" ];
imports = [ ./nginx.nix ../../pkgs/shiori/shiori-service.nix ];
nixpkgs.config = {
permittedInsecurePackages = [ "nodejs-14.21.3" "openssl-1.1.1v" ];
};
environment.systemPackages = with pkgs;
[
# Upgrades postgres
(let
# XXX specify the postgresql package you'd like to upgrade to.
# Do not forget to list the extensions you need.
newPostgres = pkgs.postgresql_16.withPackages (pp:
[
# pp.plv8
]);
in pkgs.writeScriptBin "upgrade-pg-cluster" ''
set -eux
# XXX it's perhaps advisable to stop all services that depend on postgresql
systemctl stop postgresql
environment.systemPackages = [
# Upgrades postgres
(let
# XXX specify the postgresql package you'd like to upgrade to.
# Do not forget to list the extensions you need.
newPostgres = pkgs.postgresql_16.withPackages (pp:
[
# pp.plv8
]);
in pkgs.writeScriptBin "upgrade-pg-cluster" ''
set -eux
# XXX it's perhaps advisable to stop all services that depend on postgresql
systemctl stop postgresql
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
export NEWBIN="${newPostgres}/bin"
export NEWBIN="${newPostgres}/bin"
export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin"
export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin"
install -d -m 0700 -o postgres -g postgres "$NEWDATA"
cd "$NEWDATA"
sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
install -d -m 0700 -o postgres -g postgres "$NEWDATA"
cd "$NEWDATA"
sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
sudo -u postgres $NEWBIN/pg_upgrade \
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
--old-bindir $OLDBIN --new-bindir $NEWBIN \
"$@"
'')
];
sudo -u postgres $NEWBIN/pg_upgrade \
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
--old-bindir $OLDBIN --new-bindir $NEWBIN \
"$@"
'')
];
users.groups = { piracy.gid = 985; };
users.users = let base = { isSystemUser = true; };
in {
@@ -94,7 +89,7 @@ in {
# bazarr = base // { };
jellyfin = base // { };
# prowlarr.enable = true;
jira.enable = true;
# jira.enable = true;
microbin = {
enable = true;
settings = {
@@ -107,39 +102,45 @@ in {
MICROBIN_ENCRYPTION_SERVER_SIDE = true;
};
};
shiori = {
enable = true;
port = 4368;
package = pkgs.callPackage ../../pkgs/shiori/shiori.nix { };
httpSecretKey = "password";
databaseUrl = "postgres:///shiori?host=${postgresSocket}";
};
# audiobookshelf = {
# enable = true;
# group = "piracy";
# port = 5687;
# };
# paperless = {
# enable = true;
# address = "0.0.0.0";
# consumptionDirIsPublic = true;
# consumptionDir = "/home/jawz/Backups/Scans";
# extraConfig = {
# PAPERLESS_DBENGINE = "postgress";
# PAPERLESS_DBNAME = "paperless";
# PAPERLESS_DBHOST = postgresSocket;
# PAPERLESS_CONSUMER_IGNORE_PATTERN =
# builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
# PAPERLESS_TIME_ZONE = "America/Mexico_City";
# PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
# optimize = 1;
# pdfa_image_compression = "lossless";
# };
# };
# };
paperless = {
enable = true;
address = "0.0.0.0";
consumptionDirIsPublic = true;
consumptionDir = "/mnt/pool/scans/";
settings = {
PAPERLESS_DBENGINE = "postgress";
PAPERLESS_DBNAME = "paperless";
PAPERLESS_DBHOST = postgresSocket;
PAPERLESS_CONSUMER_IGNORE_PATTERN =
builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
PAPERLESS_TIME_ZONE = "America/Mexico_City";
PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
optimize = 1;
pdfa_image_compression = "lossless";
};
};
};
vaultwarden = {
enable = true;
dbBackend = "postgresql";
package = pkgs.vaultwarden;
environmentFile = "/var/lib/vaultwarden.env";
config = {
ROCKET_ADDRESS = "${localhost}";
ROCKET_PORT = 8222;
WEBSOCKET_PORT = 8333;
ADMIN_TOKEN =
"x9BLqz2QmnU5RmrMLt2kPpoPBTNPZxNFw/b8XrPgpQML2/01+MYENl87dmhDX+Jm";
DATABASE_URL = "postgresql:///vaultwarden?host=${postgresSocket}";
ENABLE_DB_WAL = false;
WEBSOCKET_ENABLED = true;
@@ -157,13 +158,16 @@ in {
nextcloud = {
enable = true;
https = true;
package = pkgs.nextcloud28;
package = pkgs.nextcloud29;
appstoreEnable = true;
configureRedis = true;
extraAppsEnable = true;
enableImagemagick = true;
maxUploadSize = "16G";
hostName = "cloud.servidos.lat";
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) calendar;
};
config = {
adminpassFile = "${pkgs.writeText "adminpass"
"Overlying-Hatchback-Charting-Encounter-Deface-Gallantly7"}";
@@ -193,6 +197,8 @@ in {
short_open_tag = "Off";
};
settings = {
log_type = "file";
log_level = 3;
trusted_proxies = [ "nginx" ];
trusted_domains = [ "cloud.rotehaare.art" "danilo-reyes.com" ];
overwrite_protocol = "https";
@@ -214,32 +220,17 @@ in {
};
phpExtraExtensions = all: [ all.pdlib all.bz2 ];
};
postgresql = {
postgresql = let
dbNames =
[ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" "shiori" ];
in {
enable = true;
ensureDatabases = [ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" ];
ensureDatabases = dbNames;
package = pkgs.postgresql_16;
ensureUsers = [
{
name = "jawz";
ensureDBOwnership = true;
}
{
name = "nextcloud";
ensureDBOwnership = true;
}
{
name = "paperless";
ensureDBOwnership = true;
}
{
name = "ryot";
ensureDBOwnership = true;
}
{
name = "vaultwarden";
ensureDBOwnership = true;
}
];
ensureUsers = map (name: {
name = name;
ensureDBOwnership = true;
}) dbNames;
authentication = pkgs.lib.mkOverride 10 ''
local all all trust
host all all ${localhost}/32 trust
@@ -249,15 +240,12 @@ in {
};
systemd = {
services = {
nextcloud-cron = { path = [ pkgs.perl ]; };
# sub-sync = {
# restartIfChanged = true;
# description = "syncronizes subtitles downloaded & modified today";
# wantedBy = [ "default.target" ];
# path = [
# pkgs.bash
# pkgs.nix
# jawzSubs
# ];
# path = [ pkgs.bash pkgs.nix jawzSubs ];
# serviceConfig = {
# Restart = "on-failure";
# RestartSec = 30;
@@ -267,16 +255,16 @@ in {
# };
# };
nextcloud-cronjob = let
jawzNextcloudCronjob = pkgs.writeScriptBin "nextcloud-cronjob"
nextcloud-cronjob = pkgs.writeScriptBin "nextcloud-cronjob"
(builtins.readFile ../../scripts/nextcloud-cronjob.sh);
in {
description = "Runs various nextcloud-related cronjobs";
wantedBy = [ "multi-user.target" ];
path = [ pkgs.bash jawzNextcloudCronjob ];
path = [ pkgs.bash nextcloud-cronjob ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 30;
ExecStart = "${jawzNextcloudCronjob}/bin/nextcloud-cronjob";
ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
};
};
};
@@ -291,38 +279,9 @@ in {
# enable = true;
# description = "syncronizes subtitles downloaded & modified today";
# wantedBy = [ "timers.target" ];
# timerConfig = {
# OnCalendar = "22:00";
# };
# timerConfig = { OnCalendar = "22:00"; };
# };
};
user.services = {
update-dns = let
jawzUpdateDns = pkgs.writeScriptBin "update-dns"
(builtins.readFile ../../scripts/update-dns.sh);
in {
restartIfChanged = true;
description = "update DNS of my websites";
wantedBy = [ "default.target" ];
path = [ pkgs.bash pkgs.nix jawzUpdateDns ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 30;
ExecStart = "${jawzUpdateDns}/bin/update-dns";
};
};
};
user.timers = {
update-dns = {
enable = true;
description = "update DNS of my websites";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "1min";
OnUnitActiveSec = "30m";
};
};
};
};
networking = {