tower: init

7 files changed, 239 insertions, 0 deletions

diff --git a/hosts/tower/web/blog.nix b/hosts/tower/web/blog.nix
new file mode 100644
index 0000000..7cefd6e
--- /dev/null
+++ b/hosts/tower/web/blog.nix
@@ -0,0 +1,24 @@
+{
+  inputs,
+  pkgs,
+  # config,
+  ...
+}:
+{
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."sorre.xyz" = {
+      # enableACME = true;
+      # forceSSL = true;
+      root = inputs.sorre-website.packages.${pkgs.system}.default;
+    };
+
+    virtualHosts."priv.sorre.xyz" = {
+      # enableACME = true;
+      # forceSSL = true;
+      root = "/var/www/priv";
+      # basicAuthFile = config.sops.secrets."priv-blog-auth-file".path;
+    };
+  };
+}
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
new file mode 100644
index 0000000..2424eaf
--- /dev/null
+++ b/hosts/tower/web/default.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  imports = [
+    ./blog.nix
+    ./mediadb.nix
+    ./git.nix
+    ./static.nix
+    ./navidrome.nix
+    ./vaultwarden.nix
+  ];
+}
diff --git a/hosts/tower/web/git.nix b/hosts/tower/web/git.nix
new file mode 100644
index 0000000..4dcae8e
--- /dev/null
+++ b/hosts/tower/web/git.nix
@@ -0,0 +1,55 @@
+{ config, ... }:
+let
+  # secrets = config.sops.secrets;
+  domainInternal = "git.sorre.internal";
+  domainPublic = "git.sorre.xyz";
+
+  commonSettings = {
+    readme = "main:README.md";
+  };
+in
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts."${domainInternal}" = {
+      # forceSSL = true;
+      # sslCertificateKey = secrets."wg-ca-key".path;
+      # sslCertificate = secrets."wg-ca-crt".path;
+      listen = [
+        {
+          addr = "100.64.0.3";
+          port = 443;
+          # ssl = true;
+        }
+      ];
+    };
+
+    virtualHosts."${domainPublic}" = {
+      # enableACME = true;
+      # forceSSL = true;
+    };
+  };
+
+  services.cgit.internal = {
+    enable = true;
+    user = "cgit-internal";
+    group = "cgit";
+    nginx.virtualHost = domainInternal;
+    gitHttpBackend.checkExportOkFiles = false;
+    scanPath = "/var/lib/git/repos/isabella";
+    settings = commonSettings;
+  };
+
+  services.cgit.public = {
+    enable = true;
+    user = "cgit-public";
+    group = "cgit";
+    nginx.virtualHost = domainPublic;
+    gitHttpBackend.checkExportOkFiles = false;
+    repos = {
+      futils.path = "/var/lib/git/repos/isabella/futils";
+      nixos-config.path = "/var/lib/git/repos/isabella/nixos-config";
+    };
+    settings = commonSettings;
+  };
+}
diff --git a/hosts/tower/web/mediadb.nix b/hosts/tower/web/mediadb.nix
new file mode 100644
index 0000000..67c9fdd
--- /dev/null
+++ b/hosts/tower/web/mediadb.nix
@@ -0,0 +1,50 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  newPostgres = pkgs.postgresql_18_jit;
+  cfg = config.services.postgresql;
+  upgrade-pg-cluster = pkgs.writeScriptBin "upgrade-pg-cluster" ''
+    set -eux
+    systemctl stop postgresql
+
+    export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+    export NEWBIN="${newPostgres}/bin"
+
+    export OLDDATA="${cfg.dataDir}"
+    export OLDBIN="${cfg.finalPackage}/bin"
+
+    install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+    cd "$NEWDATA"
+    sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs}
+
+    sudo -u postgres "$NEWBIN/pg_upgrade" \
+      --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+      --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
+      "$@"
+  '';
+in
+{
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_18_jit;
+    enableTCPIP = true;
+    enableJIT = true;
+
+    settings = {
+      password_encryption = "scram-sha-256";
+    };
+
+    authentication = ''
+      # TYPE  DATABASE  USER        ADDRESS  METHOD
+      local   all       all                  peer
+      host    all       postgres    all      reject
+      host    all       all         all      scram-sha-256
+    '';
+  }; # end of services.postgreslq
+
+  environment.systemPackages = [ upgrade-pg-cluster ];
+}
diff --git a/hosts/tower/web/navidrome.nix b/hosts/tower/web/navidrome.nix
new file mode 100644
index 0000000..70d2779
--- /dev/null
+++ b/hosts/tower/web/navidrome.nix
@@ -0,0 +1,46 @@
+{ config, ... }:
+let
+  cfg = config.services.navidrome;
+  # secrets = config.sops.secrets;
+  domain = "music.sorre.internal";
+in
+{
+  services.navidrome = {
+    enable = false;
+    settings = {
+      MusicFolder = "/var/navidrome/music";
+      DataFolder = "/var/navidrome/data";
+      BaseUrl = "https://${domain}";
+      Port = 4533;
+      Address = "127.0.0.1";
+      openFirewall = false;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."navidrome" = {
+      serverName = domain;
+      # forceSSL = true;
+      listen = [
+        {
+          addr = "100.64.0.3";
+          port = 443;
+          # ssl = true;
+        }
+      ];
+
+      # sslCertificateKey = secrets."wg-ca-key".path;
+      # sslCertificate = secrets."wg-ca-crt".path;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString cfg.settings.Port}";
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_buffering off;
+        '';
+      };
+    };
+  };
+}
diff --git a/hosts/tower/web/static.nix b/hosts/tower/web/static.nix
new file mode 100644
index 0000000..d73d566
--- /dev/null
+++ b/hosts/tower/web/static.nix
@@ -0,0 +1,12 @@
+{ ... }:
+{
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."static.sorre.xyz" = {
+      # enableACME = true;
+      # forceSSL = true;
+      root = "/var/www/static";
+    };
+  };
+}
diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
new file mode 100644
index 0000000..68bb1cd
--- /dev/null
+++ b/hosts/tower/web/vaultwarden.nix
@@ -0,0 +1,41 @@
+{ config, ... }:
+let
+  cfg = config.services.vaultwarden.config;
+  # secrets = config.sops.secrets;
+  domain = "vaultwarden.sorre.internal";
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    configureNginx = false;
+    dbBackend = "sqlite";
+    inherit domain;
+    config = {
+      SIGNUPS_ALLOWED = false;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  services.nginx.virtualHosts."vaultwarden" = {
+    serverName = domain;
+    # forceSSL = true;
+    listen = [
+      {
+        addr = "100.64.0.3";
+        port = 443;
+        # ssl = true;
+      }
+    ];
+
+    # sslCertificateKey = secrets."wg-ca-key".path;
+    # sslCertificate = secrets."wg-ca-crt".path;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
+      recommendedProxySettings = true;
+    };
+  };
+}