312 lines
9.5 KiB
Nix
312 lines
9.5 KiB
Nix
{ config, lib, pkgs, modulesPath, ... }:
|
|
let
|
|
localhost = "127.0.0.1";
|
|
postgresSocket = "/run/postgresql";
|
|
unstable = import
|
|
(builtins.fetchTarball "https://github.com/nixos/nixpkgs/tarball/master") {
|
|
config = config.nixpkgs.config;
|
|
};
|
|
in {
|
|
|
|
imports = [ ./nginx.nix ];
|
|
nixpkgs.config = {
|
|
permittedInsecurePackages = [ "nodejs-14.21.3" "openssl-1.1.1v" ];
|
|
};
|
|
environment.systemPackages = with pkgs;
|
|
[
|
|
# Upgrades postgres
|
|
(let
|
|
# XXX specify the postgresql package you'd like to upgrade to.
|
|
# Do not forget to list the extensions you need.
|
|
newPostgres = pkgs.postgresql_16.withPackages (pp:
|
|
[
|
|
# pp.plv8
|
|
]);
|
|
in pkgs.writeScriptBin "upgrade-pg-cluster" ''
|
|
set -eux
|
|
# XXX it's perhaps advisable to stop all services that depend on postgresql
|
|
systemctl stop postgresql
|
|
|
|
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
|
|
|
|
export NEWBIN="${newPostgres}/bin"
|
|
|
|
export OLDDATA="${config.services.postgresql.dataDir}"
|
|
export OLDBIN="${config.services.postgresql.package}/bin"
|
|
|
|
install -d -m 0700 -o postgres -g postgres "$NEWDATA"
|
|
cd "$NEWDATA"
|
|
sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
|
|
|
|
sudo -u postgres $NEWBIN/pg_upgrade \
|
|
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
|
|
--old-bindir $OLDBIN --new-bindir $NEWBIN \
|
|
"$@"
|
|
'')
|
|
];
|
|
users.groups = { piracy.gid = 985; };
|
|
# users.users = let base = { isSystemUser = true; };
|
|
# in {
|
|
# # prowlarr = base // { group = "piracy"; };
|
|
# # kavita = base // {
|
|
# # group = "kavita";
|
|
# # extraGroups = [ "piracy" ];
|
|
# # };
|
|
# # nextcloud = base // {
|
|
# # extraGroups = [ "render" ];
|
|
# # packages = (with pkgs; [
|
|
# # nodejs
|
|
# # (python3.withPackages (ps: with ps; [ tensorflow ]))
|
|
# # perl
|
|
# # (perlPackages.buildPerlPackage rec {
|
|
# # pname = "Image-ExifTool";
|
|
# # version = "12.70";
|
|
# # src = fetchurl {
|
|
# # url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
|
|
# # hash = "sha256-TLJSJEXMPj870TkExq6uraX8Wl4kmNerrSlX3LQsr/4=";
|
|
# # };
|
|
# # })
|
|
# # ]);
|
|
# # };
|
|
# };
|
|
programs = {
|
|
msmtp = {
|
|
enable = true;
|
|
accounts.default = {
|
|
auth = true;
|
|
host = "smtp.gmail.com";
|
|
port = 587;
|
|
tls = true;
|
|
from = "stunner6399@gmail.com";
|
|
user = "stunner6399@gmail.com";
|
|
password = "eqyctcgjdykqeuwt";
|
|
};
|
|
};
|
|
};
|
|
services = let
|
|
base = {
|
|
enable = true;
|
|
group = "piracy";
|
|
};
|
|
in {
|
|
# sonarr = base // { package = pkgs.sonarr; };
|
|
# radarr = base // { package = pkgs.radarr; };
|
|
# bazarr = base // { };
|
|
jellyfin = base // { };
|
|
# prowlarr.enable = true;
|
|
jira.enable = true;
|
|
microbin = {
|
|
enable = true;
|
|
settings = {
|
|
MICROBIN_HIDE_LOGO = false;
|
|
MICROBIN_PORT = 8080;
|
|
MICROBIN_HIGHLIGHTSYNTAX = true;
|
|
MICROBIN_PRIVATE = true;
|
|
MICROBIN_QR = true;
|
|
MICROBIN_ENCRYPTION_CLIENT_SIDE = true;
|
|
MICROBIN_ENCRYPTION_SERVER_SIDE = true;
|
|
};
|
|
};
|
|
audiobookshelf = {
|
|
enable = true;
|
|
group = "piracy";
|
|
port = 5687;
|
|
};
|
|
paperless = {
|
|
enable = true;
|
|
address = "0.0.0.0";
|
|
consumptionDirIsPublic = true;
|
|
consumptionDir = "/home/jawz/Backups/Scans";
|
|
extraConfig = {
|
|
PAPERLESS_DBENGINE = "postgress";
|
|
PAPERLESS_DBNAME = "paperless";
|
|
PAPERLESS_DBHOST = postgresSocket;
|
|
PAPERLESS_CONSUMER_IGNORE_PATTERN =
|
|
builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
|
|
PAPERLESS_TIME_ZONE = "America/Mexico_City";
|
|
PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
|
|
optimize = 1;
|
|
pdfa_image_compression = "lossless";
|
|
};
|
|
};
|
|
};
|
|
vaultwarden = {
|
|
enable = true;
|
|
dbBackend = "postgresql";
|
|
package = pkgs.vaultwarden;
|
|
config = {
|
|
ROCKET_ADDRESS = "${localhost}";
|
|
ROCKET_PORT = 8222;
|
|
WEBSOCKET_PORT = 8333;
|
|
ADMIN_TOKEN =
|
|
"x9BLqz2QmnU5RmrMLt2kPpoPBTNPZxNFw/b8XrPgpQML2/01+MYENl87dmhDX+Jm";
|
|
DATABASE_URL = "postgresql:///vaultwarden?host=${postgresSocket}";
|
|
ENABLE_DB_WAL = false;
|
|
WEBSOCKET_ENABLED = true;
|
|
SHOW_PASSWORD_HINT = false;
|
|
SIGNUPS_ALLOWED = false;
|
|
EXTENDED_LOGGING = true;
|
|
LOG_LEVEL = "warn";
|
|
};
|
|
};
|
|
# kavita = {
|
|
# enable = true;
|
|
# tokenKeyFile = "${pkgs.writeText "kavitaToken"
|
|
# "Au002BRkRxBjlQrmWSuXWTGUcpXZjzMo2nJ0Z4g4OZ1S4c2zp6oaesGUXzKp2mhvOwjju002BNoURG3CRIE2qnGybvOgAlDxAZCPBzSNRcx6RJ1lFRgvI8wQR6Nd5ivYX0RMo4S8yOH8XIDhzN6vNo31rCjyv2IycX0JqiJPIovfbvXn9Y="}";
|
|
# };
|
|
# nextcloud = {
|
|
# enable = true;
|
|
# https = true;
|
|
# package = pkgs.nextcloud27;
|
|
# appstoreEnable = true;
|
|
# configureRedis = true;
|
|
# extraAppsEnable = true;
|
|
# enableImagemagick = true;
|
|
# maxUploadSize = "16G";
|
|
# hostName = "cloud.servidos.lat";
|
|
# config = {
|
|
# adminpassFile = "${pkgs.writeText "adminpass"
|
|
# "Overlying-Hatchback-Charting-Encounter-Deface-Gallantly7"}";
|
|
# overwriteProtocol = "https";
|
|
# defaultPhoneRegion = "MX";
|
|
# dbtype = "pgsql";
|
|
# dbhost = postgresSocket;
|
|
# dbtableprefix = "oc_";
|
|
# dbname = "nextcloud";
|
|
# trustedProxies = [ "nginx" ];
|
|
# extraTrustedDomains = [ "cloud.rotehaare.art" "danilo-reyes.com" ];
|
|
# };
|
|
# phpOptions = {
|
|
# catch_workers_output = "yes";
|
|
# display_errors = "stderr";
|
|
# error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
|
|
# expose_php = "Off";
|
|
# "opcache.enable_cli" = "1";
|
|
# "opcache.fast_shutdown" = "1";
|
|
# "opcache.interned_strings_buffer" = "16";
|
|
# "opcache.jit" = "1255";
|
|
# "opcache.jit_buffer_size" = "256M";
|
|
# "opcache.max_accelerated_files" = "10000";
|
|
# "opcache.huge_code_pages" = "1";
|
|
# "opcache.enable_file_override" = "1";
|
|
# "opcache.memory_consumption" = "128";
|
|
# "opcache.revalidate_freq" = "60";
|
|
# "opcache.save_comments" = "1";
|
|
# "opcache.validate_timestamps" = "0";
|
|
# "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
|
|
# short_open_tag = "Off";
|
|
# };
|
|
# extraOptions = {
|
|
# "allow_local_remote_servers" = true;
|
|
# mail_smtpmode = "sendmail";
|
|
# mail_sendmailmode = "pipe";
|
|
# "installed" = true;
|
|
# "memories.exiftool" = "/etc/profiles/per-user/nextcloud/bin/exiftool";
|
|
# enabledPreviewProviders = [
|
|
# "OC\\Preview\\Image"
|
|
# "OC\\Preview\\HEIC"
|
|
# "OC\\Preview\\TIFF"
|
|
# "OC\\Preview\\MKV"
|
|
# "OC\\Preview\\MP4"
|
|
# "OC\\Preview\\AVI"
|
|
# "OC\\Preview\\Movie"
|
|
# ];
|
|
# };
|
|
# phpExtraExtensions = all: [ all.pdlib all.bz2 ];
|
|
# };
|
|
postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" ];
|
|
package = pkgs.postgresql_16;
|
|
ensureUsers = [
|
|
{
|
|
name = "jawz";
|
|
ensureDBOwnership = true;
|
|
}
|
|
{
|
|
name = "nextcloud";
|
|
ensureDBOwnership = true;
|
|
}
|
|
{
|
|
name = "paperless";
|
|
ensureDBOwnership = true;
|
|
}
|
|
{
|
|
name = "ryot";
|
|
ensureDBOwnership = true;
|
|
}
|
|
{
|
|
name = "vaultwarden";
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
authentication = pkgs.lib.mkOverride 10 ''
|
|
local all all trust
|
|
host all all ${localhost}/32 trust
|
|
host all all ::1/128 trust
|
|
'';
|
|
};
|
|
};
|
|
systemd = {
|
|
services = {
|
|
# nextcloud-cronjob = let
|
|
# jawzNextcloudCronjob = pkgs.writeScriptBin "nextcloud-cronjob"
|
|
# (builtins.readFile ../scripts/nextcloud-cronjob.sh);
|
|
# in {
|
|
# description = "Runs various nextcloud-related cronjobs";
|
|
# wantedBy = [ "multi-user.target" ];
|
|
# path = [ pkgs.bash jawzNextcloudCronjob ];
|
|
# serviceConfig = {
|
|
# Restart = "on-failure";
|
|
# RestartSec = 30;
|
|
# ExecStart = "${jawzNextcloudCronjob}/bin/nextcloud-cronjob";
|
|
# };
|
|
# };
|
|
};
|
|
timers = {
|
|
# nextcloud-cronjob = {
|
|
# enable = true;
|
|
# description = "Runs various nextcloud-related cronjobs";
|
|
# wantedBy = [ "timers.target" ];
|
|
# timerConfig = { OnCalendar = "*:0/10"; };
|
|
# };
|
|
};
|
|
user.services = {
|
|
update-dns = let
|
|
jawzUpdateDns = pkgs.writeScriptBin "update-dns"
|
|
(builtins.readFile ../scripts/update-dns.sh);
|
|
in {
|
|
restartIfChanged = true;
|
|
description = "update DNS of my websites";
|
|
wantedBy = [ "default.target" ];
|
|
path = [ pkgs.bash pkgs.nix jawzUpdateDns ];
|
|
serviceConfig = {
|
|
Restart = "on-failure";
|
|
RestartSec = 30;
|
|
ExecStart = "${jawzUpdateDns}/bin/update-dns";
|
|
};
|
|
};
|
|
};
|
|
user.timers = {
|
|
update-dns = {
|
|
enable = true;
|
|
description = "update DNS of my websites";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "1min";
|
|
OnUnitActiveSec = "30m";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
firewall = let open_firewall_ports = [ config.services.paperless.port ];
|
|
in {
|
|
enable = true;
|
|
allowedTCPPorts = open_firewall_ports;
|
|
allowedUDPPorts = open_firewall_ports;
|
|
};
|
|
};
|
|
}
|