bchmnn/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: change from namecheap to cloudflare, setup tls with acme, setup vaultwarden

Browse source
This commit is contained in:
Jacob Bachmann 2024-09-10 00:32:58 +02:00
parent 6b55345b66
commit fd794698d3
No known key found for this signature in database
GPG key ID: 7753026D577922A6
12 changed files with 118 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

19
hosts/APPA/services/acme.nix Normal file
View file

@ -0,0 +1,19 @@
{ config, ... }:
{
age.secrets.environments-acme = {
file = ../../../secrets/environments/acme.age;
};
security.acme.acceptTerms = true;
security.acme.defaults.email = "gendulf@posteo.de";
security.acme.certs."dryb.org" = {
domain = "dryb.org";
extraDomainNames = [ "*.dryb.org" ];
dnsProvider = "cloudflare";
dnsPropagationCheck = true;
credentialsFile = config.age.secrets.environments-acme.path;
};
users.users.nginx.extraGroups = [ "acme" ];
}

4
hosts/APPA/services/adguard-home.nix
View file

@ -46,6 +46,10 @@
domain = "anki.dryb.org";
answer = "192.168.2.40";
}
{
domain = "vaultwarden.dryb.org";
answer = "192.168.2.40";
}
];
};
dhcp = {

13
hosts/APPA/services/ddclient.nix
View file

@ -1,7 +1,7 @@
{ config, ... }:
{
age.secrets.passwords-ddclient-namecheap = {
file = ../../../secrets/passwords/ddclient/namecheap.age;
age.secrets.passwords-ddclient-cloudflare = {
file = ../../../secrets/passwords/ddclient/cloudflare.age;
};
services.ddclient = {
@ -11,11 +11,10 @@
usev4=webv4, webv4=ifconfig.me
usev6=disabled
'';
protocol = "namecheap";
server = "dynamicdns.park-your-domain.com";
username = "dryb.org";
passwordFile = config.age.secrets.passwords-ddclient-namecheap.path;
domains = [ "vpn" ];
protocol = "cloudflare";
zone = "dryb.org";
passwordFile = config.age.secrets.passwords-ddclient-cloudflare.path;
domains = [ "vpn.dryb.org" ];
interval = "10min";
};
}

2
hosts/APPA/services/default.nix
View file

@ -1,5 +1,6 @@
{
imports = [
./acme.nix
./adguard-home.nix
./anki.nix
./ddclient.nix
@ -7,5 +8,6 @@
./homepage-dashboard.nix
./nginx.nix
./postgresql.nix
./vaultwarden.nix
];
}

20
hosts/APPA/services/nginx.nix
View file

@ -3,28 +3,46 @@
services.nginx = {
enable = true;
virtualHosts."dryb.org" = {
useACMEHost = "dryb.org";
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8002";
};
};
virtualHosts."adguard.dryb.org" = {
useACMEHost = "dryb.org";
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8001";
};
};
virtualHosts."${config.services.gitea.domain}" = {
useACMEHost = "dryb.org";
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8003";
};
};
virtualHosts."anki.dryb.org" = {
useACMEHost = "dryb.org";
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8004";
};
};
virtualHosts."vaultwarden.dryb.org" = {
useACMEHost = "dryb.org";
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8005";
};
};
};
networking.firewall = {
allowedTCPPorts = [ 80 ];
allowedTCPPorts = [
80
443
];
};
}

22
hosts/APPA/services/postgresql.nix
View file

@ -3,16 +3,28 @@
services.postgresql = {
enable = true;
ensureDatabases = [ config.services.gitea.user ];
ensureDatabases = [
config.services.gitea.user
"vaultwarden"
];
# type database DBuser auth-method mapping
ensureUsers = [
{
name = "vaultwarden";
ensureDBOwnership = true;
}
];
# type database DBuser auth-method mapping
authentication = ''
local gitea all ident map=gitea-users
local gitea all ident map=gitea-users
local vaultwarden all ident map=vaultwarden-users
'';
# name sysuser dbuser
# name sysuser dbuser
identMap = ''
gitea-users gitea gitea
gitea-users gitea gitea
vaultwarden-users vaultwarden vaultwarden
'';
};

30
hosts/APPA/services/vaultwarden.nix Normal file
View file

@ -0,0 +1,30 @@
{ config, ... }:
{
age.secrets.environments-vaultwarden = {
file = ../../../secrets/environments/vaultwarden.age;
# mode = "640";
# owner = "vaultwarden";
# group = "vaultwarden";
};
users.users.vaultwarden = {
description = "Vaultwarden Service";
home = "/var/lib/bitwarden_rs";
useDefaultShell = true;
isSystemUser = true;
};
services.vaultwarden = {
enable = true;
dbBackend = "postgresql";
environmentFile = config.age.secrets.environments-vaultwarden.path;
config = {
DOMAIN = "http://vaultwarden.dryb.org";
SIGNUPS_ALLOWED = false;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8005;
DATABASE_URL = "postgresql:///vaultwarden";
WEB_VAULT_ENABLED = true;
};
};
}