jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed servers/nginx quirks on 24.05

Browse Source
This commit is contained in:
Danilo Reyes
2024-06-09 14:15:32 -06:00
parent 5faf09f546
commit 2998c6fe40
8 changed files with 285 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

195
hosts/miniserver/servers.nix
View File

@@ -1,49 +1,44 @@
{ config, lib, pkgs, modulesPath, ... }:
{ config, pkgs, ... }:
let
localhost = "127.0.0.1";
postgresSocket = "/run/postgresql";
unstable = import
(builtins.fetchTarball "https://github.com/nixos/nixpkgs/tarball/master") {
config = config.nixpkgs.config;
};
in {
imports = [ ./nginx.nix ];
disabledModules = [ "services/web-apps/shiori.nix" ];
imports = [ ./nginx.nix ../../pkgs/shiori/shiori-service.nix ];
nixpkgs.config = {
permittedInsecurePackages = [ "nodejs-14.21.3" "openssl-1.1.1v" ];
};
environment.systemPackages = with pkgs;
[
# Upgrades postgres
(let
# XXX specify the postgresql package you'd like to upgrade to.
# Do not forget to list the extensions you need.
newPostgres = pkgs.postgresql_16.withPackages (pp:
[
# pp.plv8
]);
in pkgs.writeScriptBin "upgrade-pg-cluster" ''
set -eux
# XXX it's perhaps advisable to stop all services that depend on postgresql
systemctl stop postgresql
environment.systemPackages = [
# Upgrades postgres
(let
# XXX specify the postgresql package you'd like to upgrade to.
# Do not forget to list the extensions you need.
newPostgres = pkgs.postgresql_16.withPackages (pp:
[
# pp.plv8
]);
in pkgs.writeScriptBin "upgrade-pg-cluster" ''
set -eux
# XXX it's perhaps advisable to stop all services that depend on postgresql
systemctl stop postgresql
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
export NEWBIN="${newPostgres}/bin"
export NEWBIN="${newPostgres}/bin"
export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin"
export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin"
install -d -m 0700 -o postgres -g postgres "$NEWDATA"
cd "$NEWDATA"
sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
install -d -m 0700 -o postgres -g postgres "$NEWDATA"
cd "$NEWDATA"
sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
sudo -u postgres $NEWBIN/pg_upgrade \
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
--old-bindir $OLDBIN --new-bindir $NEWBIN \
"$@"
'')
];
sudo -u postgres $NEWBIN/pg_upgrade \
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
--old-bindir $OLDBIN --new-bindir $NEWBIN \
"$@"
'')
];
users.groups = { piracy.gid = 985; };
users.users = let base = { isSystemUser = true; };
in {
@@ -94,7 +89,7 @@ in {
# bazarr = base // { };
jellyfin = base // { };
# prowlarr.enable = true;
jira.enable = true;
# jira.enable = true;
microbin = {
enable = true;
settings = {
@@ -107,39 +102,45 @@ in {
MICROBIN_ENCRYPTION_SERVER_SIDE = true;
};
};
shiori = {
enable = true;
port = 4368;
package = pkgs.callPackage ../../pkgs/shiori/shiori.nix { };
httpSecretKey = "password";
databaseUrl = "postgres:///shiori?host=${postgresSocket}";
};
# audiobookshelf = {
# enable = true;
# group = "piracy";
# port = 5687;
# };
# paperless = {
# enable = true;
# address = "0.0.0.0";
# consumptionDirIsPublic = true;
# consumptionDir = "/home/jawz/Backups/Scans";
# extraConfig = {
# PAPERLESS_DBENGINE = "postgress";
# PAPERLESS_DBNAME = "paperless";
# PAPERLESS_DBHOST = postgresSocket;
# PAPERLESS_CONSUMER_IGNORE_PATTERN =
# builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
# PAPERLESS_TIME_ZONE = "America/Mexico_City";
# PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
# optimize = 1;
# pdfa_image_compression = "lossless";
# };
# };
# };
paperless = {
enable = true;
address = "0.0.0.0";
consumptionDirIsPublic = true;
consumptionDir = "/mnt/pool/scans/";
settings = {
PAPERLESS_DBENGINE = "postgress";
PAPERLESS_DBNAME = "paperless";
PAPERLESS_DBHOST = postgresSocket;
PAPERLESS_CONSUMER_IGNORE_PATTERN =
builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
PAPERLESS_TIME_ZONE = "America/Mexico_City";
PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
optimize = 1;
pdfa_image_compression = "lossless";
};
};
};
vaultwarden = {
enable = true;
dbBackend = "postgresql";
package = pkgs.vaultwarden;
environmentFile = "/var/lib/vaultwarden.env";
config = {
ROCKET_ADDRESS = "${localhost}";
ROCKET_PORT = 8222;
WEBSOCKET_PORT = 8333;
ADMIN_TOKEN =
"x9BLqz2QmnU5RmrMLt2kPpoPBTNPZxNFw/b8XrPgpQML2/01+MYENl87dmhDX+Jm";
DATABASE_URL = "postgresql:///vaultwarden?host=${postgresSocket}";
ENABLE_DB_WAL = false;
WEBSOCKET_ENABLED = true;
@@ -157,13 +158,16 @@ in {
nextcloud = {
enable = true;
https = true;
package = pkgs.nextcloud28;
package = pkgs.nextcloud29;
appstoreEnable = true;
configureRedis = true;
extraAppsEnable = true;
enableImagemagick = true;
maxUploadSize = "16G";
hostName = "cloud.servidos.lat";
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) calendar;
};
config = {
adminpassFile = "${pkgs.writeText "adminpass"
"Overlying-Hatchback-Charting-Encounter-Deface-Gallantly7"}";
@@ -193,6 +197,8 @@ in {
short_open_tag = "Off";
};
settings = {
log_type = "file";
log_level = 3;
trusted_proxies = [ "nginx" ];
trusted_domains = [ "cloud.rotehaare.art" "danilo-reyes.com" ];
overwrite_protocol = "https";
@@ -214,32 +220,17 @@ in {
};
phpExtraExtensions = all: [ all.pdlib all.bz2 ];
};
postgresql = {
postgresql = let
dbNames =
[ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" "shiori" ];
in {
enable = true;
ensureDatabases = [ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" ];
ensureDatabases = dbNames;
package = pkgs.postgresql_16;
ensureUsers = [
{
name = "jawz";
ensureDBOwnership = true;
}
{
name = "nextcloud";
ensureDBOwnership = true;
}
{
name = "paperless";
ensureDBOwnership = true;
}
{
name = "ryot";
ensureDBOwnership = true;
}
{
name = "vaultwarden";
ensureDBOwnership = true;
}
];
ensureUsers = map (name: {
name = name;
ensureDBOwnership = true;
}) dbNames;
authentication = pkgs.lib.mkOverride 10 ''
local all all trust
host all all ${localhost}/32 trust
@@ -249,15 +240,12 @@ in {
};
systemd = {
services = {
nextcloud-cron = { path = [ pkgs.perl ]; };
# sub-sync = {
# restartIfChanged = true;
# description = "syncronizes subtitles downloaded & modified today";
# wantedBy = [ "default.target" ];
# path = [
# pkgs.bash
# pkgs.nix
# jawzSubs
# ];
# path = [ pkgs.bash pkgs.nix jawzSubs ];
# serviceConfig = {
# Restart = "on-failure";
# RestartSec = 30;
@@ -267,16 +255,16 @@ in {
# };
# };
nextcloud-cronjob = let
jawzNextcloudCronjob = pkgs.writeScriptBin "nextcloud-cronjob"
nextcloud-cronjob = pkgs.writeScriptBin "nextcloud-cronjob"
(builtins.readFile ../../scripts/nextcloud-cronjob.sh);
in {
description = "Runs various nextcloud-related cronjobs";
wantedBy = [ "multi-user.target" ];
path = [ pkgs.bash jawzNextcloudCronjob ];
path = [ pkgs.bash nextcloud-cronjob ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 30;
ExecStart = "${jawzNextcloudCronjob}/bin/nextcloud-cronjob";
ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
};
};
};
@@ -291,38 +279,9 @@ in {
# enable = true;
# description = "syncronizes subtitles downloaded & modified today";
# wantedBy = [ "timers.target" ];
# timerConfig = {
# OnCalendar = "22:00";
# };
# timerConfig = { OnCalendar = "22:00"; };
# };
};
user.services = {
update-dns = let
jawzUpdateDns = pkgs.writeScriptBin "update-dns"
(builtins.readFile ../../scripts/update-dns.sh);
in {
restartIfChanged = true;
description = "update DNS of my websites";
wantedBy = [ "default.target" ];
path = [ pkgs.bash pkgs.nix jawzUpdateDns ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 30;
ExecStart = "${jawzUpdateDns}/bin/update-dns";
};
};
};
user.timers = {
update-dns = {
enable = true;
description = "update DNS of my websites";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "1min";
OnUnitActiveSec = "30m";
};
};
};
};
networking = {