From dcd2c4c4d71161301a956b7e4777b499f5010e74 Mon Sep 17 00:00:00 2001 From: Isabella Bastaja Date: Tue, 18 Aug 2026 20:07:35 +0200 Subject: tower: init --- hosts/tower/web/blog.nix | 24 ++++++++++++++++++ hosts/tower/web/default.nix | 11 +++++++++ hosts/tower/web/git.nix | 55 +++++++++++++++++++++++++++++++++++++++++ hosts/tower/web/mediadb.nix | 50 +++++++++++++++++++++++++++++++++++++ hosts/tower/web/navidrome.nix | 46 ++++++++++++++++++++++++++++++++++ hosts/tower/web/static.nix | 12 +++++++++ hosts/tower/web/vaultwarden.nix | 41 ++++++++++++++++++++++++++++++ 7 files changed, 239 insertions(+) create mode 100644 hosts/tower/web/blog.nix create mode 100644 hosts/tower/web/default.nix create mode 100644 hosts/tower/web/git.nix create mode 100644 hosts/tower/web/mediadb.nix create mode 100644 hosts/tower/web/navidrome.nix create mode 100644 hosts/tower/web/static.nix create mode 100644 hosts/tower/web/vaultwarden.nix (limited to 'hosts/tower/web') diff --git a/hosts/tower/web/blog.nix b/hosts/tower/web/blog.nix new file mode 100644 index 0000000..7cefd6e --- /dev/null +++ b/hosts/tower/web/blog.nix @@ -0,0 +1,24 @@ +{ + inputs, + pkgs, + # config, + ... +}: +{ + services.nginx = { + enable = true; + + virtualHosts."sorre.xyz" = { + # enableACME = true; + # forceSSL = true; + root = inputs.sorre-website.packages.${pkgs.system}.default; + }; + + virtualHosts."priv.sorre.xyz" = { + # enableACME = true; + # forceSSL = true; + root = "/var/www/priv"; + # basicAuthFile = config.sops.secrets."priv-blog-auth-file".path; + }; + }; +} diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix new file mode 100644 index 0000000..2424eaf --- /dev/null +++ b/hosts/tower/web/default.nix @@ -0,0 +1,11 @@ +{ ... }: +{ + imports = [ + ./blog.nix + ./mediadb.nix + ./git.nix + ./static.nix + ./navidrome.nix + ./vaultwarden.nix + ]; +} diff --git a/hosts/tower/web/git.nix b/hosts/tower/web/git.nix new file mode 100644 index 0000000..4dcae8e --- /dev/null +++ b/hosts/tower/web/git.nix @@ -0,0 +1,55 @@ +{ config, ... }: +let + # secrets = config.sops.secrets; + domainInternal = "git.sorre.internal"; + domainPublic = "git.sorre.xyz"; + + commonSettings = { + readme = "main:README.md"; + }; +in +{ + services.nginx = { + enable = true; + virtualHosts."${domainInternal}" = { + # forceSSL = true; + # sslCertificateKey = secrets."wg-ca-key".path; + # sslCertificate = secrets."wg-ca-crt".path; + listen = [ + { + addr = "100.64.0.3"; + port = 443; + # ssl = true; + } + ]; + }; + + virtualHosts."${domainPublic}" = { + # enableACME = true; + # forceSSL = true; + }; + }; + + services.cgit.internal = { + enable = true; + user = "cgit-internal"; + group = "cgit"; + nginx.virtualHost = domainInternal; + gitHttpBackend.checkExportOkFiles = false; + scanPath = "/var/lib/git/repos/isabella"; + settings = commonSettings; + }; + + services.cgit.public = { + enable = true; + user = "cgit-public"; + group = "cgit"; + nginx.virtualHost = domainPublic; + gitHttpBackend.checkExportOkFiles = false; + repos = { + futils.path = "/var/lib/git/repos/isabella/futils"; + nixos-config.path = "/var/lib/git/repos/isabella/nixos-config"; + }; + settings = commonSettings; + }; +} diff --git a/hosts/tower/web/mediadb.nix b/hosts/tower/web/mediadb.nix new file mode 100644 index 0000000..67c9fdd --- /dev/null +++ b/hosts/tower/web/mediadb.nix @@ -0,0 +1,50 @@ +{ + pkgs, + lib, + config, + ... +}: +let + newPostgres = pkgs.postgresql_18_jit; + cfg = config.services.postgresql; + upgrade-pg-cluster = pkgs.writeScriptBin "upgrade-pg-cluster" '' + set -eux + systemctl stop postgresql + + export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" + export NEWBIN="${newPostgres}/bin" + + export OLDDATA="${cfg.dataDir}" + export OLDBIN="${cfg.finalPackage}/bin" + + install -d -m 0700 -o postgres -g postgres "$NEWDATA" + cd "$NEWDATA" + sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs} + + sudo -u postgres "$NEWBIN/pg_upgrade" \ + --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ + --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \ + "$@" + ''; +in +{ + services.postgresql = { + enable = true; + package = pkgs.postgresql_18_jit; + enableTCPIP = true; + enableJIT = true; + + settings = { + password_encryption = "scram-sha-256"; + }; + + authentication = '' + # TYPE DATABASE USER ADDRESS METHOD + local all all peer + host all postgres all reject + host all all all scram-sha-256 + ''; + }; # end of services.postgreslq + + environment.systemPackages = [ upgrade-pg-cluster ]; +} diff --git a/hosts/tower/web/navidrome.nix b/hosts/tower/web/navidrome.nix new file mode 100644 index 0000000..70d2779 --- /dev/null +++ b/hosts/tower/web/navidrome.nix @@ -0,0 +1,46 @@ +{ config, ... }: +let + cfg = config.services.navidrome; + # secrets = config.sops.secrets; + domain = "music.sorre.internal"; +in +{ + services.navidrome = { + enable = false; + settings = { + MusicFolder = "/var/navidrome/music"; + DataFolder = "/var/navidrome/data"; + BaseUrl = "https://${domain}"; + Port = 4533; + Address = "127.0.0.1"; + openFirewall = false; + }; + }; + + services.nginx = { + enable = true; + + virtualHosts."navidrome" = { + serverName = domain; + # forceSSL = true; + listen = [ + { + addr = "100.64.0.3"; + port = 443; + # ssl = true; + } + ]; + + # sslCertificateKey = secrets."wg-ca-key".path; + # sslCertificate = secrets."wg-ca-crt".path; + + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.settings.Port}"; + recommendedProxySettings = true; + extraConfig = '' + proxy_buffering off; + ''; + }; + }; + }; +} diff --git a/hosts/tower/web/static.nix b/hosts/tower/web/static.nix new file mode 100644 index 0000000..d73d566 --- /dev/null +++ b/hosts/tower/web/static.nix @@ -0,0 +1,12 @@ +{ ... }: +{ + services.nginx = { + enable = true; + + virtualHosts."static.sorre.xyz" = { + # enableACME = true; + # forceSSL = true; + root = "/var/www/static"; + }; + }; +} diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix new file mode 100644 index 0000000..68bb1cd --- /dev/null +++ b/hosts/tower/web/vaultwarden.nix @@ -0,0 +1,41 @@ +{ config, ... }: +let + cfg = config.services.vaultwarden.config; + # secrets = config.sops.secrets; + domain = "vaultwarden.sorre.internal"; +in +{ + services.vaultwarden = { + enable = true; + configureNginx = false; + dbBackend = "sqlite"; + inherit domain; + config = { + SIGNUPS_ALLOWED = false; + + ROCKET_ADDRESS = "127.0.0.1"; + ROCKET_PORT = 8222; + ROCKET_LOG = "critical"; + }; + }; + + services.nginx.virtualHosts."vaultwarden" = { + serverName = domain; + # forceSSL = true; + listen = [ + { + addr = "100.64.0.3"; + port = 443; + # ssl = true; + } + ]; + + # sslCertificateKey = secrets."wg-ca-key".path; + # sslCertificate = secrets."wg-ca-crt".path; + + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}"; + recommendedProxySettings = true; + }; + }; +} -- cgit v1.3.1