3 files changed, 73 insertions, 3 deletions
diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index 38d770316..fffe128e6 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -27,9 +27,6 @@ with import <stockholm/lib>;
   ];
 
   console.keyMap = "us";
-  i18n = {
-    defaultLocale = lib.mkForce "C";
-  };
 
   programs.ssh.startAgent = false;
 
@@ -60,4 +57,7 @@ with import <stockholm/lib>;
 
   # The NixOS release to be compatible with for stateful data such as databases.
   system.stateVersion = "17.03";
+
+  # maybe fix Error: unsupported locales detected:
+  i18n.defaultLocale = mkDefault "C.UTF-8";
 }
diff --git a/krebs/2configs/mastodon-proxy.nix b/krebs/2configs/mastodon-proxy.nix
new file mode 100644
index 000000000..4d359c3fe
--- /dev/null
+++ b/krebs/2configs/mastodon-proxy.nix
@@ -0,0 +1,24 @@
+{ config, lib, pkgs, ... }:
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts."social.krebsco.de" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        # TODO use this in 22.11
+        # recommendedProxySettings = true;
+        proxyPass = "http://hotdog.r";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_set_header        Host $host;
+          proxy_set_header        X-Real-IP $remote_addr;
+          proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header        X-Forwarded-Proto $scheme;
+          proxy_set_header        X-Forwarded-Host $host;
+          proxy_set_header        X-Forwarded-Server $host;
+        '';
+      };
+    };
+  };
+}
diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix
new file mode 100644
index 000000000..145b383ed
--- /dev/null
+++ b/krebs/2configs/mastodon.nix
@@ -0,0 +1,46 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postgresql = {
+    enable = true;
+    dataDir = "/var/state/postgresql/${config.services.postgresql.package.psqlSchema}";
+    package = pkgs.postgresql_11;
+  };
+  systemd.tmpfiles.rules = [
+    "d /var/state/postgresql 0700 postgres postgres -"
+  ];
+
+  services.mastodon = {
+    enable = true;
+    localDomain = "social.krebsco.de";
+    configureNginx = true;
+    trustedProxy = config.krebs.hosts.prism.nets.retiolum.ip6.addr;
+    smtp.createLocally = false;
+    smtp.fromAddress = "derp";
+  };
+
+  services.nginx.virtualHosts.${config.services.mastodon.localDomain} = {
+    forceSSL = lib.mkForce false;
+    enableACME = lib.mkForce false;
+    locations."@proxy".extraConfig = ''
+      proxy_redirect off;
+      proxy_pass_header Server;
+      proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+  ];
+
+  environment.systemPackages = [
+    (pkgs.writers.writeDashBin "tootctl" ''
+      sudo -u mastodon /etc/profiles/per-user/mastodon/bin/mastodon-env /etc/profiles/per-user/mastodon/bin/tootctl "$@"
+    '')
+    (pkgs.writers.writeDashBin "create-mastodon-user" ''
+      set -efu
+      nick=$1
+      /run/current-system/sw/bin/tootctl accounts create "$nick" --email "$nick"@krebsco.de --confirmed
+      /run/current-system/sw/bin/tootctl accounts approve "$nick"
+    '')
+  ];
+}