X-Git-Url: https://gitweb.ps.run/flake_server/blobdiff_plain/f783db55688028afe9b8ebbb270708dc00c2ffb8..HEAD:/configuration.nix
diff --git a/configuration.nix b/configuration.nix
index d5931f8..3c0e603 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -2,7 +2,7 @@
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
-{ config, lib, pkgs, ... } @ args:
+{ config, lib, pkgs, inputs, ... } @ args:
{
imports =
@@ -19,7 +19,7 @@
# boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
nix.settings.experimental-features = [ "nix-command" "flakes" ];
- nix.package = pkgs.nixVersions.nix_2_28;
+ nix.settings.download-buffer-size = 500000000;
nix.gc = {
automatic = true;
@@ -29,13 +29,22 @@
system.autoUpgrade = {
enable = true;
allowReboot = true;
+ flake = inputs.self.outPath;
+ flags = [ "-L" ];
+ dates = "02:00";
+ randomizedDelaySec = "45min";
};
- networking.hostName = "pschdev"; # Define your hostname.
+ networking.hostName = "netcup"; # Define your hostname.
networking.firewall = {
enable = true;
- allowedTCPPorts = [ 80 443 7777 9418 ];
+ allowedTCPPorts = [
+ 80 443 # http(s)
+ 7777 # terraria
+ 9418 # syncthing (?)
+ 25565 # minecraft
+ ];
};
# Set your time zone.
@@ -75,12 +84,19 @@
sudo.wheelNeedsPassword = false;
};
- # nixpkgs.config.allowUnfree = true;
+ nixpkgs.config.allowUnfree = true;
+
+ nixpkgs.overlays = [
+ (inputs.ps-flakes.overlays.cgit)
+ (inputs.ps-flakes.overlays.gitweb)
+ (inputs.nix-minecraft.overlay)
+ ];
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
vim wget file git fzf bat
+ openssh
helix
gitui
bintools
@@ -89,6 +105,7 @@
tmux
md4c
highlight
+ multimarkdown
python312Packages.pygments
pkg-config
@@ -101,6 +118,21 @@
senc = "sudo ${pkgs.helix}/bin/hx /etc/nixos/configuration.nix";
};
+ # git-hooks
+ system.activationScripts.githook =
+ let
+ githooksRepo = pkgs.fetchgit {
+ url = "git://psch.dev/git-hooks";
+ rev = "1a40e097c8854d5a0e65c070addaa7e3337635c0";
+ hash = "sha256-KNKnP/3hhQQlildzRF+skYHtV+7Xg1MQMPi2DDEHGAI=";
+ };
+ in
+ {
+ text = ''
+ PATH=$PATH:${lib.makeBinPath [ pkgs.git pkgs.sudo pkgs.python3 ]} sudo -u git ${githooksRepo}/git-hooks/post-receive
+ '';
+ };
+
# git
users.users.git = {
isSystemUser = true;
@@ -109,11 +141,8 @@
createHome = true;
homeMode = "750";
shell = "${pkgs.git}/bin/git-shell";
- openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQOPefMnq0qvFjYxlrdlSmUgyCbvV85gkfRykVlTnrn ps@nixos"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0mNZn4EWdIwXEGfqUwwJy5STaZLYWbeKqDd4MN8WIK root@nixos"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+1sLAf+I+o3aODJeDuNvbqKD1wokQyk6oX0ZGK8su5 root@pschdev"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN6sNqiMZpmRkiwjj5Dv0QljLObzhopwIsF0WDQbr/Hg ps@nixos"
+ packages = with pkgs; [
+ python3 # for blog git-hook
];
};
users.groups.git = {};
@@ -151,74 +180,130 @@
# virtualisation.qemu.guestAgent.enable = true;
programs.mosh.enable = true;
+ services.minecraft-servers = {
+ enable = true;
+ eula = true;
+ servers.fabric = {
+ enable = true;
+
+ serverProperties = {
+ difficulty = 2;
+ motd = "A Place on Earth";
+ white-list = true;
+ };
+
+ package = pkgs.fabricServers.fabric-1_20_1;
+ # .override {
+ # loaderVersion = "";
+ # }
+ symlinks = {
+ mods = pkgs.linkFarmFromDrvs "mods" (
+ builtins.attrValues {
+ Fabric-API = pkgs.fetchurl {
+ url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/UapVHwiP/fabric-api-0.92.6%2B1.20.1.jar";
+ sha256 = "sha256-Ds5QR22jaSERqwS3WUXFRY5w2YzQae78BEqz5Xl33us=";
+ };
+ GlitchCore = pkgs.fetchurl {
+ url = "https://cdn.modrinth.com/data/s3dmwKy5/versions/25HLOiOl/GlitchCore-fabric-1.20.1-0.0.1.1.jar";
+ sha256 = "sha256-+359QjXKv4OVR4vEKu9rv9u++JUd3x9w9zcZ4LJMmcw=";
+ };
+ TerraBlender = pkgs.fetchurl {
+ url = "https://cdn.modrinth.com/data/kkmrDlKT/versions/J1S3aA8i/TerraBlender-fabric-1.20.1-3.0.1.10.jar";
+ sha256 = "sha256-0C2aoszwkSZLD87wdkQSi4I7NCGgK/xAORoBqhzNCiQ=";
+ };
+ BiomesOPlenty = pkgs.fetchurl {
+ url = "https://cdn.modrinth.com/data/HXF82T3G/versions/eZaag2ca/BiomesOPlenty-fabric-1.20.1-19.0.0.96.jar";
+ sha256 = "sha256-A4Kp4TNMtzbE8Nhs8NACEG1qmEU6cJlQ678Ok5gx6nI=";
+ };
+ }
+ );
+ };
+ };
+ };
services.caddy = {
enable = true;
- virtualHosts."psch.dev".extraConfig = ''
- root * /srv/www
- file_server
- '';
- virtualHosts."julius.psch.dev".extraConfig = ''
- basic_auth { test $2a$14$iKv0GlwavCunG0zQbaf2fOl4r4/8k8gDKUVUouu9Q3o.MfSDkp6Te }
- root * /srv/julius_cam
- file_server
- '';
- virtualHosts."chirp.psch.dev".extraConfig = ''
- reverse_proxy http://localhost:8080 {
- request_buffers 8192
+
+ extraConfig = ''
+ psch.dev ps.run pasch.cc {
+ rewrite /src /src/
+ handle_path /src/* {
+ reverse_proxy http://localhost:3000
}
- '';
- };
- services.caddy.virtualHosts."git.psch.dev".extraConfig = ''
- encode gzip zstd
+ rewrite /git /git/
+ handle_path /git/* {
+ encode gzip zstd
- @assets path /cgit.css /cgit.png /favicon.ico /robots.txt
- handle /cgithub/* {
- file_server {
- root /srv/cgithub
+ @assets path /cgit.css /cgit.png /favicon.ico /robots.txt
+ handle /cgithub/* {
+ file_server {
+ root /srv/cgithub
+ }
+ }
+ handle @assets {
+ file_server {
+ root ${pkgs.cgit}/cgit
+ }
+ }
+ handle {
+ reverse_proxy unix//run/fcgiwrap-git.sock {
+ transport fastcgi {
+ env CGIT_CONFIG ${pkgs.writeText "cgitrc" ''
+ snapshots=tar tar.gz zip
+ enable-git-config=1
+ enable-index-owner=0
+ enable-log-filecount=1
+ enable-log-linecount=1
+ section-from-path=1
+ virtual-root=/git
+ css=/git/cgit.css
+ logo=/git/cgit.png
+ favicon=/git/favicon.ico
+ module-link=/%s/commit/?id=%s
+ clone-url=https://$HTTP_HOST/git/$CGIT_REPO_URL git://$HTTP_HOST/$CGIT_REPO_URL git@$HTTP_HOST:$CGIT_REPO_URL
+ noplainemail=1
+ repository-sort=age
+ about-filter=${pkgs.writeShellScript "markdown-filter" ''
+ echo ''
+ ${pkgs.md4c}/bin/md2html --github --ftables
+ echo '
'
+ ''}
+ # source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
+ head-include=/srv/cgithub/head-include.html
+ footer=/srv/cgithub/footer.html
+ readme=:readme.md
+ readme=:Readme.md
+ readme=:ReadMe.md
+ readme=:README.md
+ scan-path=/srv/git
+ ''}
+ env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
+ }
+ }
+ }
}
+
+ basic_auth /julius_cam/* { test $2a$14$iKv0GlwavCunG0zQbaf2fOl4r4/8k8gDKUVUouu9Q3o.MfSDkp6Te }
+ root * /srv/www
+ file_server
}
- handle @assets {
- file_server {
- root ${pkgs.cgit}/cgit
- }
+ tnx.sh {
+ respond "The Website is under Construction."
}
- handle {
- reverse_proxy unix//run/fcgiwrap-git.sock {
- transport fastcgi {
- env CGIT_CONFIG ${pkgs.writeText "cgitrc" ''
- snapshots=tar tar.gz zip
- enable-git-config=1
- enable-index-owner=0
- section-from-path=1
- virtual-root=/
- module-link=/%s/commit/?id=%s
- clone-url=https://git.psch.dev/$CGIT_REPO_URL git://psch.dev/$CGIT_REPO_URL ssh://git@psch.dev:$CGIT_REPO_URL
- noplainemail=1
- side-by-side-diffs=1
- about-filter=${pkgs.writeShellScript "markdown-filter" ''
- echo ''
- ${pkgs.md4c}/bin/md2html --github --ftables
- echo '
'
- ''}
- # source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
- head-include=/srv/cgithub/head-include.html
- footer=/srv/cgithub/footer.html
- readme=:readme.md
- readme=:Readme.md
- readme=:ReadMe.md
- readme=:README.md
- scan-path=/srv/git
- ''}
- env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
- }
+ chirp.ps.run {
+ reverse_proxy http://localhost:8080 {
+ request_buffers 8192
}
}
- '';
+ mail.psch.dev {
+ respond mail
+ }
+ '';
+ };
# virtualHosts."git.psch.dev".extraConfig = ''
# reverse_proxy unix//run/anubis/anubis-cgit.sock
# '';
- services.caddy.virtualHosts."gitweb.psch.dev".extraConfig = ''
+ services.caddy.virtualHosts."gitweb.ps.run".extraConfig = ''
handle /static/* {
file_server {
root ${pkgs.gitweb}
@@ -261,6 +346,25 @@
socket.group = "caddy";
};
+ services.forgejo = {
+ enable = true;
+ repositoryRoot = "/srv/git2";
+ settings = {
+ server = {
+ DOMAIN = "ps.run";
+ ROOT_URL = "https://ps.run/src";
+ };
+ repository = {
+ REQUIRE_SIGNIN_VIEW = false;
+ };
+ service = {
+ REQUIRE_SIGNIN_VIEW = false;
+ DISABLE_REGISTRATION = true;
+ };
+ };
+ };
+ users.users.forgejo.extraGroups = [ "git" ];
+
users.users.chirp = {
isSystemUser = true;
group = "chirp";
@@ -268,6 +372,79 @@
createHome = true;
};
users.groups.chirp = {};
+
+ systemd.services.poster-splitter =
+ let
+ poster-splitter-src = "/var/lib/postersplitter/repo";
+ in
+ {
+ description = "Poster Splitter";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+
+ serviceConfig = {
+ Type = "simple";
+ User = "poster";
+ Group = "poster";
+ WorkingDirectory = "${poster-splitter-src}";
+
+ ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=$PATH:${lib.makeBinPath [ pkgs.bash pkgs.python3 ]} LD_LIBRARY_PATH=${pkgs.stdenv.cc.cc.lib}/lib/ /var/lib/postersplitter/run.sh'";
+ Restart = "on-failure";
+ };
+ };
+ services.webhook = {
+ enable = true;
+ port = 8102;
+ user = "root";
+ group = "root";
+ hooks = {
+ "deploy-poster-splitter" = {
+ id = "deploy-poster-splitter";
+ response-message = "Deployed Poster Splitter";
+ execute-command = "/var/lib/postersplitter/deploy.sh";
+ command-working-directory = "/var/lib/postersplitter";
+ pass-environment-to-command = [
+ { source = "string"; envname = "PATH"; name = "${lib.makeBinPath [ pkgs.coreutils pkgs.sudo pkgs.systemd pkgs.openssh pkgs.git pkgs.bash pkgs.python3 pkgs.git ]}"; }
+ ];
+ trigger-rule = {
+ match = {
+ type = "payload-hmac-sha1";
+ secret = "mysecret";
+ parameter = {
+ source = "header";
+ name = "X-Hub-Signature";
+ };
+ };
+ };
+ };
+ };
+ };
+ services.caddy.virtualHosts."postersplitter.de".extraConfig = ''
+ # Route 1: Der Webhook
+ # Leitet Anfragen an /hooks/ an den Webhook-Dienst
+ @webhook path /hooks/*
+ handle @webhook {
+ reverse_proxy 127.0.0.1:8102
+ }
+
+ # Route 2: Die Flask App (alles andere)
+ # Muss NACH der Webhook-Route kommen
+ @all not path /hooks/*
+ handle @all {
+ reverse_proxy 127.0.0.1:8101
+ }
+ '';
+ users.users.poster = {
+ isSystemUser = true;
+ group = "poster";
+ home = "/var/lib/postersplitter";
+ createHome = true;
+ useDefaultShell = true;
+ packages = with pkgs; [
+ python314
+ ];
+ };
+ users.groups.poster = {};
systemd.services.chirp = {
description = "Chirp SystemD Service";
@@ -283,6 +460,29 @@
};
};
+ # Mail Server
+ mailserver = {
+ enable = true;
+ # stateVersion = 1;
+ fqdn = "mail.psch.dev";
+ domains = [ "psch.dev" ];
+
+ # A list of all login accounts. To create the password hashes, use
+ # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+ loginAccounts = {
+ "ps@psch.dev" = {
+ hashedPassword = "$2b$05$dd65mMjWxZNc.MK4YUwLgeRMInJHvwNTazptImrw4paRqyX/p4TQG";
+ aliases = ["p@psch.dev" "patrick@psch.dev"];
+ };
+ };
+
+ certificateScheme = "manual";
+ certificateFile = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.psch.dev/mail.psch.dev.crt";
+ keyFile = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.psch.dev/mail.psch.dev.key";
+ };
+ # security.acme.acceptTerms = true;
+ # security.acme.defaults.email = "patrick.schoenberger@posteo.de";
+
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.