palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactorings

Browse source
This commit is contained in:
Ingolf Wagner 2024-04-12 20:56:42 +02:00
parent fe9efe5852
commit 6645f02a72
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
7 changed files with 257 additions and 266 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

472
nixos/components/network/nginx.nix
View file

@ -6,248 +6,260 @@ with lib;
default = config.components.network.enable; default = config.components.network.enable;
}; };
config = mkIf (config.components.network.nginx.enable) { options.components.network.nginx.landingpage.enable = mkOption {
type = lib.types.bool;
default = config.components.network.nginx.enable;
};
environment.systemPackages = [ config = mkMerge [
pkgs.nginx-config-formatter (mkIf (config.components.network.nginx.enable) {
(pkgs.writers.writePython3Bin "nginx-show-config" { flakeIgnore = [ "E265" "E225" "W292" ]; }
(lib.fileContents "${assets}/nginx-show-config.py"))
];
security.acme.defaults.email = "contact@ingolf-wagner.de"; environment.systemPackages = [
security.acme.acceptTerms = true; pkgs.nginx-config-formatter
(pkgs.writers.writePython3Bin "nginx-show-config" { flakeIgnore = [ "E265" "E225" "W292" ]; }
(lib.fileContents "${assets}/nginx-show-config.py"))
];
services.nginx = { security.acme.defaults.email = "contact@ingolf-wagner.de";
security.acme.acceptTerms = true;
# Use recommended settings services.nginx = {
recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true;
recommendedProxySettings = lib.mkDefault true;
recommendedTlsSettings = lib.mkDefault true;
# for loki logging # Use recommended settings
commonHttpConfig = '' recommendedGzipSettings = lib.mkDefault true;
log_format logfmt escape=json 'timestamp=$time_iso8601 ' recommendedOptimisation = lib.mkDefault true;
'facility=nginx ' recommendedProxySettings = lib.mkDefault true;
'src_addr=$remote_addr ' recommendedTlsSettings = lib.mkDefault true;
'body_bytes_sent=$body_bytes_sent '
'request_time=$request_time '
'response_status=$status '
'request="$request" '
'request_method="$request_method" '
'host="$host" '
'upstream_cache_status="$upstream_cache_status" '
'upstream_addr="$upstream_addr" '
'http_x_forwarded_for="$http_x_forwarded_for" '
'http_referrer="$http_referer" '
'http_user_agent="$http_user_agent"';
# log to local journald # for loki logging
access_log syslog:server=unix:/dev/log logfmt; commonHttpConfig = ''
''; log_format logfmt escape=json 'timestamp=$time_iso8601 '
'facility=nginx '
'src_addr=$remote_addr '
'body_bytes_sent=$body_bytes_sent '
'request_time=$request_time '
'response_status=$status '
'request="$request" '
'request_method="$request_method" '
'host="$host" '
'upstream_cache_status="$upstream_cache_status" '
'upstream_addr="$upstream_addr" '
'http_x_forwarded_for="$http_x_forwarded_for" '
'http_referrer="$http_referer" '
'http_user_agent="$http_user_agent"';
}; # log to local journald
access_log syslog:server=unix:/dev/log logfmt;
'';
services.nginx.package = pkgs.nginxMainline; };
services.nginx.virtualHosts."${config.networking.hostName}.private" = {
default = lib.mkDefault true; services.nginx.package = pkgs.nginxMainline;
locations."/" = {
root = pkgs.landingpage.override { })
(mkIf (config.components.network.nginx.landingpage.enable) {
services.nginx.virtualHosts."${config.networking.hostName}.private" = {
default = lib.mkDefault true;
locations."/" = {
root = pkgs.landingpage.override {
jsonConfig = [ jsonConfig = [
{ title = "System Links"; } { title = "System Links"; }
{ {
text = "Syncthings"; text = "Syncthings";
items = map items = map
({ name, host ? "${name}.private", ... }: { ({ name, host ? "${name}.private", ... }: {
label = name; label = name;
href = "http://${host}:8384/"; href = "http://${host}:8384/";
image = "https://media.giphy.com/media/JoyU4vuzwj6ZA7Ging/giphy.gif"; image = "https://media.giphy.com/media/JoyU4vuzwj6ZA7Ging/giphy.gif";
}) })
(lib.flatten (lib.mapAttrsToList (name: { ... }: { inherit name; }) (lib.flatten (lib.mapAttrsToList (name: { ... }: { inherit name; })
config.services.tinc.networks."private".hostSettings)); config.services.tinc.networks."private".hostSettings));
} }
{ {
text = "robi"; text = "robi";
items = [ items = [
{ {
label = "Jellyfin"; label = "Jellyfin";
href = "http://flix.ingolf-wagner.de/"; href = "http://flix.ingolf-wagner.de/";
image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif"; image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif";
} }
{ {
label = "netdata"; label = "netdata";
href = "http://robi.private:19999/"; href = "http://robi.private:19999/";
image = "https://media.giphy.com/media/BkjdN6MQCDPaw/giphy.gif"; image = "https://media.giphy.com/media/BkjdN6MQCDPaw/giphy.gif";
} }
{ {
label = "logs"; label = "logs";
href = "http://grafana.robi.private/explore"; href = "http://grafana.robi.private/explore";
image = "https://raw.githubusercontent.com/cncf/landscape/master/hosted_logos/grafana-loki.svg"; image = "https://raw.githubusercontent.com/cncf/landscape/master/hosted_logos/grafana-loki.svg";
} }
{ {
label = "grafana"; label = "grafana";
href = "http://grafana.robi.private/"; href = "http://grafana.robi.private/";
image = "https://www.vectorlogo.zone/logos/grafana/grafana-icon.svg"; image = "https://www.vectorlogo.zone/logos/grafana/grafana-icon.svg";
} }
{ {
label = "prometheus"; label = "prometheus";
href = "http://prometheus.robi.private/"; href = "http://prometheus.robi.private/";
image = "https://www.vectorlogo.zone/logos/prometheusio/prometheusio-icon.svg"; image = "https://www.vectorlogo.zone/logos/prometheusio/prometheusio-icon.svg";
} }
]; ];
} }
{ {
text = "chungus"; text = "chungus";
items = [ items = [
{ {
label = "HomeAssistant"; label = "HomeAssistant";
href = "http://chungus.private:8123/"; href = "http://chungus.private:8123/";
image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif"; image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif";
} }
{ {
label = "Zigbee2Mqtt"; label = "Zigbee2Mqtt";
href = "http://chungus.private:9666/"; href = "http://chungus.private:9666/";
image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif"; image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif";
} }
{ {
label = "Flix"; label = "Flix";
href = "http://chungus:8096/"; href = "http://chungus:8096/";
image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif"; image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif";
} }
{ {
label = "netdata"; label = "netdata";
href = "http://chungus.private:19999/"; href = "http://chungus.private:19999/";
image = "https://media.giphy.com/media/BkjdN6MQCDPaw/giphy.gif"; image = "https://media.giphy.com/media/BkjdN6MQCDPaw/giphy.gif";
} }
{ {
label = "logs"; label = "logs";
href = "http://grafana.chungus.private/explore"; href = "http://grafana.chungus.private/explore";
image = "https://raw.githubusercontent.com/cncf/landscape/master/hosted_logos/grafana-loki.svg"; image = "https://raw.githubusercontent.com/cncf/landscape/master/hosted_logos/grafana-loki.svg";
} }
{ {
label = "grafana"; label = "grafana";
href = "http://grafana.chungus.private/"; href = "http://grafana.chungus.private/";
image = "https://www.vectorlogo.zone/logos/grafana/grafana-icon.svg"; image = "https://www.vectorlogo.zone/logos/grafana/grafana-icon.svg";
} }
{ {
label = "prometheus"; label = "prometheus";
href = "http://prometheus.chungus.private/"; href = "http://prometheus.chungus.private/";
image = "https://www.vectorlogo.zone/logos/prometheusio/prometheusio-icon.svg"; image = "https://www.vectorlogo.zone/logos/prometheusio/prometheusio-icon.svg";
} }
{ {
label = "Kitchen"; label = "Kitchen";
href = "http://192.168.178.101/"; href = "http://192.168.178.101/";
image = "https://i.giphy.com/3o7TKsrMIW65QT7VWo.webp"; image = "https://i.giphy.com/3o7TKsrMIW65QT7VWo.webp";
} }
{ {
label = "Living Room"; label = "Living Room";
href = "http://192.168.178.102/"; href = "http://192.168.178.102/";
image = "https://i.giphy.com/3o7TKsrMIW65QT7VWo.webp"; image = "https://i.giphy.com/3o7TKsrMIW65QT7VWo.webp";
} }
]; ];
} }
{ {
title = "Various Links"; title = "Various Links";
items = [ items = [
{ {
label = "Terrapen"; label = "Terrapen";
href = "http://192.168.178.31/"; href = "http://192.168.178.31/";
image = "https://i.giphy.com/W08brEWFt7EpA5y2jI.webp"; image = "https://i.giphy.com/W08brEWFt7EpA5y2jI.webp";
} }
{ {
label = "NeverSSL"; label = "NeverSSL";
href = "https://oldslowfreshlight.neverssl.com/"; href = "https://oldslowfreshlight.neverssl.com/";
image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif"; image = "https://media.giphy.com/media/fyLi0OuWysotq/giphy.gif";
} }
{ {
label = "Hetzner Cloud"; label = "Hetzner Cloud";
href = "https://console.hetzner.cloud/projects"; href = "https://console.hetzner.cloud/projects";
image = image =
"https://media.giphy.com/media/NECZ8crkbXR0k/giphy.gif"; "https://media.giphy.com/media/NECZ8crkbXR0k/giphy.gif";
} }
{ {
label = "Pass the Popcorn"; label = "Pass the Popcorn";
href = "https://passthepopcorn.me/"; href = "https://passthepopcorn.me/";
image = image =
"https://media.giphy.com/media/NipFetnQOuKhW/giphy.gif"; "https://media.giphy.com/media/NipFetnQOuKhW/giphy.gif";
} }
{ {
label = "redacted"; label = "redacted";
href = "https://redacted.ch/"; href = "https://redacted.ch/";
image = image =
"https://media.giphy.com/media/ku5EcFe4PNGWA/giphy.gif"; "https://media.giphy.com/media/ku5EcFe4PNGWA/giphy.gif";
} }
{ {
label = "Cups"; label = "Cups";
href = "http://localhost:631/"; href = "http://localhost:631/";
image = image =
"https://media.giphy.com/media/7hU7x4GPurk2c/giphy.gif"; "https://media.giphy.com/media/7hU7x4GPurk2c/giphy.gif";
} }
]; ];
} }
{ {
text = "NixOS Links"; text = "NixOS Links";
items = [ items = [
{ {
label = "NixOS Manual"; label = "NixOS Manual";
href = "https://nixos.org/nixos/manual/"; href = "https://nixos.org/nixos/manual/";
image = image =
"https://media.giphy.com/media/dsdVyKkSqccEzoPufX/giphy.gif"; "https://media.giphy.com/media/dsdVyKkSqccEzoPufX/giphy.gif";
} }
{ {
label = "Nixpkgs Manual"; label = "Nixpkgs Manual";
href = "https://nixos.org/nixpkgs/manual/"; href = "https://nixos.org/nixpkgs/manual/";
image = image =
"https://media.giphy.com/media/dsdVyKkSqccEzoPufX/giphy.gif"; "https://media.giphy.com/media/dsdVyKkSqccEzoPufX/giphy.gif";
} }
{ {
label = "NixOS Reference"; label = "NixOS Reference";
href = href =
"https://storage.googleapis.com/files.tazj.in/nixdoc/manual.html#sec-functions-library"; "https://storage.googleapis.com/files.tazj.in/nixdoc/manual.html#sec-functions-library";
image = image =
"https://media.giphy.com/media/LkjlH3rVETgsg/giphy.gif"; "https://media.giphy.com/media/LkjlH3rVETgsg/giphy.gif";
} }
{ {
label = "Nix Packages"; label = "Nix Packages";
href = "https://nixos.org/nixos/packages.html"; href = "https://nixos.org/nixos/packages.html";
image = image =
"https://media.giphy.com/media/l2YWlohvjPnsvkdEc/giphy.gif"; "https://media.giphy.com/media/l2YWlohvjPnsvkdEc/giphy.gif";
} }
{ {
label = "NixOS Language specific helpers"; label = "NixOS Language specific helpers";
href = href =
"https://nixos.wiki/wiki/Language-specific_package_helpers"; "https://nixos.wiki/wiki/Language-specific_package_helpers";
image = image =
"https://media.giphy.com/media/LkjlH3rVETgsg/giphy.gif"; "https://media.giphy.com/media/LkjlH3rVETgsg/giphy.gif";
} }
{ {
label = "NixOS Weekly"; label = "NixOS Weekly";
href = "https://weekly.nixos.org/"; href = "https://weekly.nixos.org/";
image = image =
"https://media.giphy.com/media/lXiRLb0xFzmreM8k8/giphy.gif"; "https://media.giphy.com/media/lXiRLb0xFzmreM8k8/giphy.gif";
} }
{ {
label = "NixOS Security"; label = "NixOS Security";
href = "https://broken.sh/"; href = "https://broken.sh/";
image = image =
"https://media.giphy.com/media/BqILAHjH1Ttm0/giphy.gif"; "https://media.giphy.com/media/BqILAHjH1Ttm0/giphy.gif";
} }
{ {
label = "NixOS RFCs"; label = "NixOS RFCs";
href = "https://github.com/NixOS/rfcs/"; href = "https://github.com/NixOS/rfcs/";
image = image =
"https://media.giphy.com/media/Uq9bGjGKg08M0/giphy.gif"; "https://media.giphy.com/media/Uq9bGjGKg08M0/giphy.gif";
} }
]; ];
} }
{ urlEncode = true; } { urlEncode = true; }
]; ];
};
}; };
}; };
}; })
}; ];
} }

5
nixos/homes/common/packages.nix
View file

@ -29,6 +29,11 @@ with lib;
tree tree
killall killall
nix-tree nix-tree
unstable.vulnix
(writers.writeBashBin "vulnix-system" ''
${unstable.vulnix}/bin/vulnix --profile /nix/var/nix/profiles/system
'')
]; ];
programs.btop.enable = true; programs.btop.enable = true;

7
nixos/machines/orbi/configuration.nix
View file

@ -13,11 +13,11 @@
#./borg.nix #./borg.nix
#./codimd.nix #./codimd.nix
#./gitea.nix #./gitea.nix
#./packages.nix
#./taskserver.nix #./taskserver.nix
#./vaultwarden.nix #./vaultwarden.nix
#./nginx.nix
#./nginx-wkd.nix ./nginx-ingolf-wagner-de.nix
./nginx-wkd.nix
./network-tinc.nix ./network-tinc.nix
./network-wireguard.nix ./network-wireguard.nix
@ -53,6 +53,7 @@
components.mainUser.enable = true; components.mainUser.enable = true;
components.gui.enable = false; components.gui.enable = false;
components.network.enable = true; components.network.enable = true;
components.network.nginx.landingpage.enable = false;
components.network.wifi.enable = false; components.network.wifi.enable = false;
security.acme.acceptTerms = true; security.acme.acceptTerms = true;

3
nixos/machines/orbi/hardware-configuration/default.nix
View file

@ -55,6 +55,9 @@ in
services.openssh.enable = true; services.openssh.enable = true;
services.sshguard.enable = true; services.sshguard.enable = true;
environment.systemPackages = [
pkgs.ipset # for sshguard
];
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!) boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)

16
nixos/machines/orbi/nginx.nix → nixos/machines/orbi/nginx-ingolf-wagner-de.nix
View file

@ -107,7 +107,6 @@ in
}; };
}; };
}; };
"travel.ingolf-wagner.de" = { "travel.ingolf-wagner.de" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
@ -138,21 +137,6 @@ in
}; };
} // error.locations; } // error.locations;
}; };
"terranix.org" = {
forceSSL = true;
enableACME = true;
extraConfig = error.extraConfig;
locations = {
"/" = {
root = "/srv/www/terranix";
extraConfig = ''
if (-d $request_filename) {
rewrite [^/]$ $scheme://$http_host$request_uri/ permanent;
}
'';
};
} // error.locations;
};
}; };
}; };
} }

14
nixos/machines/orbi/packages.nix
View file

@ -1,14 +0,0 @@
{ config, pkgs, ... }: {
environment.systemPackages = with pkgs; [
mosh
mediainfo
youtube-dl
ipset # for sshguard
unstable.vulnix
(pkgs.writers.writeBashBin "vulnix-system" ''
${pkgs.unstable.vulnix}/bin/vulnix --profile /nix/var/nix/profiles/system
'')
];
}

6
nixos/machines/robi/configuration.nix
View file

@ -1,7 +1,7 @@
{ lib, config, pkgs, ... }: { { lib, config, pkgs, ... }: {
imports = [ imports = [
# ../../system/all/nginx.nix # ../../system/all/nginx-ingolf-wagner-de.nix
../../system/all/defaults.nix ../../system/all/defaults.nix
../../components ../../components
@ -16,8 +16,8 @@
./packages.nix ./packages.nix
./taskserver.nix ./taskserver.nix
./vaultwarden.nix ./vaultwarden.nix
./nginx.nix #./nginx.nix
./nginx-wkd.nix #./nginx-wkd.nix
./network-tinc.nix ./network-tinc.nix
#./network-wireguard.nix #./network-wireguard.nix