Inital commit ;P

6 files changed, 174 insertions, 0 deletions

diff --git a/hosts/sagittarius/web/acme.nix b/hosts/sagittarius/web/acme.nix
new file mode 100644
index 0000000..4cde574
--- /dev/null
+++ b/hosts/sagittarius/web/acme.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "miran.bastaja04@gmail.com";
+      dnsProvider = "porkbun";
+      credentialsFile = "/var/secrets/porkbun.env";
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
new file mode 100644
index 0000000..1226bd7
--- /dev/null
+++ b/hosts/sagittarius/web/blog.nix
@@ -0,0 +1,14 @@
+{ ... }: {
+  imports = [ ./acme.nix ];
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."sorre.xyz" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/blog";
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
new file mode 100644
index 0000000..3fc702e
--- /dev/null
+++ b/hosts/sagittarius/web/default.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [
+    ./blog.nix
+    ./matrix.nix
+    ./mediadb.nix
+    # ./git.nix
+  ];
+}
diff --git a/hosts/sagittarius/web/git.nix b/hosts/sagittarius/web/git.nix
new file mode 100644
index 0000000..732f7d0
--- /dev/null
+++ b/hosts/sagittarius/web/git.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+  services.gitDaemon = {
+    enable = true;
+    repositories = [ "/srv/git/" ];
+    exportAll = true;
+    basePath = "/srv/git/";
+  };
+}
diff --git a/hosts/sagittarius/web/matrix.nix b/hosts/sagittarius/web/matrix.nix
new file mode 100644
index 0000000..fc32044
--- /dev/null
+++ b/hosts/sagittarius/web/matrix.nix
@@ -0,0 +1,115 @@
+{ pkgs, config, ... }:
+let
+  server_name = "sorre.xyz";
+  matrix_hostname = "matrix.${server_name}";
+  #admin_email = "gloss_unranked088@simplelogin.com";
+
+  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
+  well_known_server = pkgs.writeText "well-known-matrix-server" ''
+    {
+      "m.server": "${matrix_hostname}"
+    }
+  '';
+
+  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
+  well_known_client = pkgs.writeText "well-known-matrix-client" ''
+    {
+      "m.homeserver": {
+        "base_url": "https://${matrix_hostname}"
+      }
+    }
+  '';
+in
+{
+  imports = [ ./acme.nix ];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+
+  services.matrix-conduit = {
+    enable = true;
+    # Currently conduit seems to have no substituter for the flake, which means
+    # that the compilation would be done on the server, therefore we're using
+    # the (prebuilt) nixpkgs version of it for now.
+    #package = inputs.conduit.packages.${pkgs.system}.default;
+    package = pkgs.matrix-conduit;
+    settings.global.server_name = server_name;
+    settings.global.allow_registration = false;
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+
+    virtualHosts."${matrix_hostname}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+        {
+          addr = "[::]";
+          port = 443;
+          ssl = true;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 8448;
+          ssl = true;
+        }
+        {
+          addr = "[::]";
+          port = 8448;
+          ssl = true;
+        }
+      ];
+      locations."/_matrix/" = {
+        proxyPass = "http://backend_conduit$request_uri";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_buffering off;
+        '';
+      };
+      extraConfig = ''
+        merge_slashes off;
+      '';
+    };
+
+    virtualHosts."${server_name}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations = {
+        "=/.well-known/matrix/server" = {
+          alias = "${well_known_server}";
+          extraConfig = ''
+            # Set the header since by default NGINX thinks it's just bytes
+            default_type application/json;
+          '';
+        };
+        "=/.well-known/matrix/client" = {
+          # Use the contents of the derivation built previously
+          alias = "${well_known_client}";
+
+          extraConfig = ''
+            # Set the header since by default NGINX thinks it's just bytes
+            default_type application/json;
+
+            # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
+            add_header Access-Control-Allow-Origin "*";
+          '';
+        };
+      };
+    };
+
+    upstreams."backend_conduit".servers = {
+      "[::1]:${toString config.services.matrix-conduit.settings.global.port}" =
+        { };
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/mediadb.nix b/hosts/sagittarius/web/mediadb.nix
new file mode 100644
index 0000000..78d76cd
--- /dev/null
+++ b/hosts/sagittarius/web/mediadb.nix
@@ -0,0 +1,19 @@
+{ pkgs, ... }: {
+  networking.firewall.allowedTCPPorts = [ 5432 ];
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15_jit;
+    enableTCPIP = true;
+    enableJIT = true;
+
+    settings = { password_encryption = "scram-sha-256"; };
+
+    authentication = ''
+      # TYPE  DATABASE  USER        ADDRESS  METHOD
+      local   all       postgres             peer
+      host    all       postgres    all      reject
+      host    all       all         all      scram-sha-256
+    '';
+  }; # end of services.postgreslq
+}