diff options
Diffstat (limited to 'makefu/2configs')
| -rw-r--r-- | makefu/2configs/bepasty-dual.nix | 39 | ||||
| -rw-r--r-- | makefu/2configs/default.nix | 2 | ||||
| -rw-r--r-- | makefu/2configs/deployment/mycube.connector.one.nix | 15 | ||||
| -rw-r--r-- | makefu/2configs/disable_v6.nix | 1 | ||||
| -rw-r--r-- | makefu/2configs/elchos/irc-token.nix | 62 | ||||
| -rw-r--r-- | makefu/2configs/elchos/log.nix | 56 | ||||
| -rw-r--r-- | makefu/2configs/elchos/search.nix | 143 | ||||
| -rw-r--r-- | makefu/2configs/elchos/stats.nix | 86 | ||||
| -rw-r--r-- | makefu/2configs/elchos/test/ftpservers.nix | 7 | ||||
| -rw-r--r-- | makefu/2configs/main-laptop.nix | 12 | ||||
| -rw-r--r-- | makefu/2configs/nginx/euer.blog.nix | 29 | ||||
| -rw-r--r-- | makefu/2configs/nginx/euer.test.nix | 14 | ||||
| -rw-r--r-- | makefu/2configs/nginx/euer.wiki.nix | 84 | ||||
| -rw-r--r-- | makefu/2configs/nginx/icecult.nix | 20 | ||||
| -rw-r--r-- | makefu/2configs/nginx/public_html.nix | 17 | ||||
| -rw-r--r-- | makefu/2configs/nginx/update.connector.one.nix | 30 | ||||
| -rw-r--r-- | makefu/2configs/omo-share.nix | 38 | ||||
| -rw-r--r-- | makefu/2configs/torrent.nix | 7 |
18 files changed, 288 insertions, 374 deletions
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix index a6be04876..936aaf004 100644 --- a/makefu/2configs/bepasty-dual.nix +++ b/makefu/2configs/bepasty-dual.nix @@ -20,54 +20,29 @@ let ext-dom = "paste.krebsco.de" ; in { - krebs.nginx.enable = mkDefault true; + services.nginx.enable = mkDefault true; krebs.bepasty = { enable = true; serveNginx= true; servers = { - internal = { + "paste.r" = { nginx = { - server-names = [ "paste.retiolum" "paste.r" "paste.${config.krebs.build.host.name}" ]; + serverAliases = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ]; }; defaultPermissions = "admin,list,create,read,delete"; secretKey = secKey; }; - external = { + "${ext-dom}" = { nginx = { - server-names = [ ext-dom ]; - ssl = { - enable = true; - certificate = "${acmepath}/${ext-dom}/fullchain.pem"; - certificate_key = "${acmepath}/${ext-dom}/key.pem"; - # these certs will be needed if acme has not yet created certificates: - #certificate = "${sec}/wildcard.krebsco.de.crt"; - #certificate_key = "${sec}/wildcard.krebsco.de.key"; - ciphers = "RC4:HIGH:!aNULL:!MD5" ; - force_encryption = true; - }; - locations = singleton ( nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${ext-dom}/; - ''); - extraConfig = '' - ssl_session_cache shared:SSL:1m; - ssl_session_timeout 10m; - ssl_verify_client off; - proxy_ssl_session_reuse off; - ''; + enableSSL = true; + forceSSL = true; + enableACME = true; }; defaultPermissions = "read"; secretKey = secKey; }; }; }; - security.acme.certs."${ext-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${ext-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - postRun = "systemctl reload nginx.service"; - extraDomains."${ext-dom}" = null ; - }; } diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index 9a2adbc3e..9e3f3eb61 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -22,7 +22,7 @@ with import <stockholm/lib>; user = config.krebs.users.makefu; source = let inherit (config.krebs.build) host user; - ref = "f52eaf4"; # stable @ 2016-12-12 + ref = "ee13b9af"; # stable @ 2016-12-12 in { nixpkgs = if config.makefu.full-populate || (getEnv "dummy_secrets" == "true") then { diff --git a/makefu/2configs/deployment/mycube.connector.one.nix b/makefu/2configs/deployment/mycube.connector.one.nix index 091b7f21b..379176f78 100644 --- a/makefu/2configs/deployment/mycube.connector.one.nix +++ b/makefu/2configs/deployment/mycube.connector.one.nix @@ -27,23 +27,18 @@ in { }; }; - krebs.nginx = { + services.nginx = { enable = mkDefault true; - servers = { - mybox-connector-one = { - listen = [ "${external-ip}:80" ]; - server-names = [ - "mycube.connector.one" - "mybox.connector.one" - ]; - locations = singleton (nameValuePair "/" '' + virtualHosts."mybox.connector.one" = { + locations = { + "/".extraConfig = '' uwsgi_pass unix://${wsgi-sock}; uwsgi_param UWSGI_CHDIR ${pkgs.mycube-flask}/${pkgs.python.sitePackages}; uwsgi_param UWSGI_MODULE mycube.websrv; uwsgi_param UWSGI_CALLABLE app; include ${pkgs.nginx}/conf/uwsgi_params; - ''); + ''; }; }; }; diff --git a/makefu/2configs/disable_v6.nix b/makefu/2configs/disable_v6.nix index 37db172ef..0a8c8d53d 100644 --- a/makefu/2configs/disable_v6.nix +++ b/makefu/2configs/disable_v6.nix @@ -1,4 +1,3 @@ { networking.enableIPv6 = false; - boot.kernelParams = [ "ipv6.disable=1" ]; } diff --git a/makefu/2configs/elchos/irc-token.nix b/makefu/2configs/elchos/irc-token.nix new file mode 100644 index 000000000..3f3c4ffc3 --- /dev/null +++ b/makefu/2configs/elchos/irc-token.nix @@ -0,0 +1,62 @@ +{pkgs, ...}: +with import <stockholm/lib>; +let + secret = (import <secrets/elchos-token.nix>); +in { + systemd.services.elchos-irctoken = { + startAt = "*:0/30"; + serviceConfig = { + RuntimeMaxSec = "20"; + }; + script = '' + set -euf + now=$(date -u +%Y-%m-%dT%H:%M) + sec=$(echo -n "${secret}$now" | md5sum | cut -d\ -f1) + message="The secret valid for 30 minutes is $sec" + echo "token for $now (UTC) is $sec" + LOGNAME=sec-announcer + HOSTNAME=$(${pkgs.systemd}/bin/hostnamectl --static) + IRC_SERVER=irc.freenode.net + IRC_PORT=6667 + IRC_NICK=$HOSTNAME-$$ + IRC_CHANNEL='#eloop' + + export IRC_CHANNEL # for privmsg_cat + + echo2() { echo "$*"; echo "$*" >&2; } + + privmsg_cat() { ${pkgs.gawk}/bin/awk '{ print "PRIVMSG "ENVIRON["IRC_CHANNEL"]" :"$0 }'; } + + tmpdir="$(mktemp -d irc-announce_XXXXXXXX)" + cd "$tmpdir" + mkfifo ircin + trap " + rm ircin + cd '$OLDPWD' + rmdir '$tmpdir' + trap - EXIT INT QUIT + " EXIT INT QUIT + + { + echo2 "USER $LOGNAME 0 * :$LOGNAME@$HOSTNAME" + echo2 "NICK $IRC_NICK" + + # wait for MODE message + ${pkgs.gnused}/bin/sed -un '/^:[^ ]* MODE /q' + + echo2 "JOIN $IRC_CHANNEL" + + printf '%s' "$message" \ + | privmsg_cat + + echo2 "PART $IRC_CHANNEL" + + # wait for PART confirmation + sed -un '/:'"$IRC_NICK"'![^ ]* PART /q' + + echo2 'QUIT :Gone to have lunch' + } < ircin \ + | ${pkgs.netcat}/bin/netcat "$IRC_SERVER" "$IRC_PORT" |tee -a ircin + ''; + }; +} diff --git a/makefu/2configs/elchos/log.nix b/makefu/2configs/elchos/log.nix new file mode 100644 index 000000000..3facd1ceb --- /dev/null +++ b/makefu/2configs/elchos/log.nix @@ -0,0 +1,56 @@ +{ config, lib, pkgs, ... }: + +with import <stockholm/lib>; +let +in { + networking.firewall.allowedTCPPorts = [ 80 443 514 ]; + networking.firewall.allowedUDPPorts = [ 80 443 514 ]; + services.logstash = { + enable = true; + enableWeb = true; + inputConfig = '' + syslog { + timezone => "Etc/UTC" + } + ''; + filterConfig = '' + if ( [program] == "proftpd") { + kv { + field_split => " " + } + } + ''; + outputConfig = '' + stdout { + codec => rubydebug + } + elasticsearch { } + ''; + }; + services.elasticsearch = { + enable = true; + }; + services.kibana = { + enable = true; + port = 9332; + }; + services.nginx = { + virtualHosts = { + "log.nsupdate.info" = { + enableACME = true; + forceSSL = true; + basicAuth = import <secrets/kibana-auth.nix>; + locations = { + "/" = { + proxyPass = "http://localhost:9332"; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; + }; + }; + }; + }; + }; +} diff --git a/makefu/2configs/elchos/search.nix b/makefu/2configs/elchos/search.nix index 5adaa0c6f..5777be373 100644 --- a/makefu/2configs/elchos/search.nix +++ b/makefu/2configs/elchos/search.nix @@ -1,11 +1,12 @@ { config, lib, pkgs, ... }: -# graphite-web on port 8080 -# carbon cache on port 2003 (tcp/udp) +# search also generates ddclient entries for all other logs + with import <stockholm/lib>; let #primary-itf = "eth0"; - primary-itf = "wlp2s0"; + #primary-itf = "wlp2s0"; + primary-itf = config.makefu.server.primary-itf; elch-sock = "${config.services.uwsgi.runDir}/uwsgi-elch.sock"; ddclientUser = "ddclient"; sec = toString <secrets>; @@ -14,15 +15,7 @@ let cfg = "${stateDir}/cfg"; ddclientPIDFile = "${stateDir}/ddclient.pid"; - acmepath = "/var/lib/acme/"; - acmechall = acmepath + "/challenges/"; # TODO: correct cert generation requires a `real` internet ip address - stats-dom = "stats.nsupdate.info"; - search-dom = "search.nsupdate.info"; - search_ssl_cert = "${acmepath}/${search-dom}/fullchain.pem"; - search_ssl_key = "${acmepath}/${search-dom}/key.pem"; - stats_ssl_cert = "${acmepath}/${stats-dom}/fullchain.pem"; - stats_ssl_key = "${acmepath}/${stats-dom}/key.pem"; gen-cfg = dict: '' ssl=yes @@ -64,75 +57,22 @@ in { }; }; - security.acme.certs = { - "${stats-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${stats-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - postRun = "systemctl reload nginx.service"; - extraDomains = { - "${stats-dom}" = null ; - }; - }; - "${search-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${search-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - postRun = "systemctl reload nginx.service"; - extraDomains = { - "${stats-dom}" = null ; - }; - }; - }; - - krebs.nginx = { + services.nginx = { enable = mkDefault true; - servers = { - elch-stats = { - server-names = [ stats-dom ]; - # listen = [ "80" "443 ssl" ]; - ssl = { - enable = true; - certificate = stats_ssl_cert; - certificate_key = stats_ssl_key; - force_encryption = true; + virtualHosts = { + "search.nsupdate.info" = { + enableACME = true; + forceSSL = true; + locations = { + "/".extraConfig = '' + uwsgi_pass unix://${elch-sock}; + uwsgi_param UWSGI_CHDIR ${pkgs.elchhub}/${pkgs.python3.sitePackages}; + uwsgi_param UWSGI_MODULE elchhub.wsgi; + uwsgi_param UWSGI_CALLABLE app; + + include ${pkgs.nginx}/conf/uwsgi_params; + ''; }; - - locations = [ - (nameValuePair "/" '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://localhost:3000/; - '') - (nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${search-dom}/; - '') - ]; - }; - elchhub = { - server-names = [ "search.nsupdate.info" ]; - # listen = [ "80" "443 ssl" ]; - ssl = { - enable = true; - certificate = search_ssl_cert; - certificate_key = search_ssl_key; - force_encryption = true; - }; - locations = [ (nameValuePair "/" '' - uwsgi_pass unix://${elch-sock}; - uwsgi_param UWSGI_CHDIR ${pkgs.elchhub}/${pkgs.python3.sitePackages}; - uwsgi_param UWSGI_MODULE elchhub.wsgi; - uwsgi_param UWSGI_CALLABLE app; - - include ${pkgs.nginx}/conf/uwsgi_params; - '') - (nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${search-dom}/; - '') - ]; }; }; }; @@ -147,7 +87,7 @@ in { ExecStart = "${pkgs.elchhub}/bin/elch-manager"; }; }; - register-elchos-nsupdate = { + ddclient-nsupdate-elchos = { wantedBy = [ "multi-user.target" ]; after = [ "ip-up.target" ]; serviceConfig = { @@ -163,49 +103,8 @@ in { }; }; - services.grafana = { - enable = true; - addr = "127.0.0.1"; - users.allowSignUp = false; - users.allowOrgCreate = false; - users.autoAssignOrg = false; - auth.anonymous.enable = true; - security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""} - }; - - services.graphite = { - api = { - enable = true; - listenAddress = "127.0.0.1"; - port = 8080; - }; - carbon = { - enableCache = true; - # save disk usage by restricting to 1 bulk update per second - config = '' - [cache] - MAX_CACHE_SIZE = inf - MAX_UPDATES_PER_SECOND = 1 - MAX_CREATES_PER_MINUTE = 500 - ''; - storageSchemas = '' - [carbon] - pattern = ^carbon\. - retentions = 60:90d - - [elchos] - patterhn = ^elchos\. - retentions = 10s:30d,60s:3y - - [default] - pattern = .* - retentions = 30s:30d,300s:1y - ''; - }; - }; - networking.firewall = { - allowedTCPPorts = [ 2003 80 443 ]; - allowedUDPPorts = [ 2003 ]; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ ]; }; } diff --git a/makefu/2configs/elchos/stats.nix b/makefu/2configs/elchos/stats.nix index 9f27b6647..b6133205f 100644 --- a/makefu/2configs/elchos/stats.nix +++ b/makefu/2configs/elchos/stats.nix @@ -1,73 +1,48 @@ { config, lib, pkgs, ... }: +# requires nsupdate to get correct hostname (from ./search.nix) # graphite-web on port 8080 # carbon cache on port 2003 (tcp/udp) + with import <stockholm/lib>; -let - sec = toString <secrets>; - acmepath = "/var/lib/acme/"; - acmechall = acmepath + "/challenges/"; - ext-dom = "stats.nsupdate.info"; - #ssl_cert = "${sec}/wildcard.krebsco.de.crt"; - #ssl_key = "${sec}/wildcard.krebsco.de.key"; - ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem"; - ssl_key = "${acmepath}/${ext-dom}/key.pem"; -in { - networking.firewall = { - allowedTCPPorts = [ 2003 80 443 ]; - allowedUDPPorts = [ 2003 ]; +{ + + services.nginx = { + enable = mkDefault true; + virtualHosts = { + "stats.nsupdate.info" = { + enableACME = true; + forceSSL = true; + + locations = { + "/" = { + proxyPass = "http://localhost:3000/"; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; + }; + }; + }; + }; }; services.grafana = { enable = true; addr = "127.0.0.1"; - extraOptions = { "AUTH_ANONYMOUS_ENABLED" = "true"; }; users.allowSignUp = false; users.allowOrgCreate = false; users.autoAssignOrg = false; + auth.anonymous.enable = true; security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""} }; - krebs.nginx = { - enable = true; - servers.elch-stats = { - server-names = [ ext-dom ]; - listen = [ "80" "443 ssl" ]; - ssl = { - enable = true; - # these certs will be needed if acme has not yet created certificates: - certificate = ssl_cert; - certificate_key = ssl_key; - force_encryption = true; - }; - - locations = [ - (nameValuePair "/" '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://localhost:3000/; - '') - (nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${ext-dom}/; - '') - ]; - }; - }; - - security.acme.certs."${ext-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${ext-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - postRun = "systemctl reload nginx.service"; - extraDomains."${ext-dom}" = null ; - }; services.graphite = { - web = { + api = { enable = true; - host = "127.0.0.1"; - port = 8080; + listenAddress = "127.0.0.1"; + port = 18080; }; carbon = { enableCache = true; @@ -85,7 +60,7 @@ in { [elchos] patterhn = ^elchos\. - retention = 10s:30d,60s:1y + retentions = 10s:30d,60s:3y [default] pattern = .* @@ -93,4 +68,9 @@ in { ''; }; }; + + networking.firewall = { + allowedTCPPorts = [ 2003 80 443 ]; + allowedUDPPorts = [ 2003 ]; + }; } diff --git a/makefu/2configs/elchos/test/ftpservers.nix b/makefu/2configs/elchos/test/ftpservers.nix new file mode 100644 index 000000000..bc7517209 --- /dev/null +++ b/makefu/2configs/elchos/test/ftpservers.nix @@ -0,0 +1,7 @@ +{...}: +{ + services.vsftpd.anonymousUser = true; + services.vsftpd.enable = true; + services.vsftpd.chrootlocalUser = true; + networking.firewall.allowedTCPPorts = [ 21 ]; +} diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix index ef8a3b88f..e1c3d20ff 100644 --- a/makefu/2configs/main-laptop.nix +++ b/makefu/2configs/main-laptop.nix @@ -71,5 +71,15 @@ in { latitude = "48.7"; longitude = "9.1"; }; - + systemd.services.look-up = { + startAt = "*:30"; + serviceConfig = { + ExecStart= pkgs.writeDash "look-up" '' + set -x + eval "export '$(egrep -z DBUS_SESSION_BUS_ADDRESS /proc/$(${pkgs.procps}/bin/pgrep -u ${user} ${window-manager})/environ)'" + ${pkgs.libnotify}/bin/notify-send -u critical -t 9999999 'look up once in a while' + ''; + User = user; + }; + }; } diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix index b2a965de6..3fb629394 100644 --- a/makefu/2configs/nginx/euer.blog.nix +++ b/makefu/2configs/nginx/euer.blog.nix @@ -3,13 +3,9 @@ with import <stockholm/lib>; let sec = toString <secrets>; - ssl_cert = "${sec}/wildcard.krebsco.de.crt"; - ssl_key = "${sec}/wildcard.krebsco.de.key"; hostname = config.krebs.build.host.name; user = config.services.nginx.user; group = config.services.nginx.group; - external-ip = config.krebs.build.host.nets.internet.ip4.addr; - internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr; base-dir = "/var/www/blog.euer"; in { # Prepare Blog directory @@ -32,24 +28,15 @@ in { }; }; - krebs.nginx = { + services.nginx = { enable = mkDefault true; - servers = { - euer-blog = { - listen = [ "${external-ip}:80" "${external-ip}:443 ssl" - "${internal-ip}:80" "${internal-ip}:443 ssl" ]; - server-names = [ "euer.krebsco.de" "blog.euer.krebsco.de" "blog.${hostname}" ]; - extraConfig = '' - gzip on; - gzip_buffers 4 32k; - gzip_types text/plain application/x-javascript text/css; - ssl_certificate ${ssl_cert}; - ssl_certificate_key ${ssl_key}; - default_type text/plain; - ''; - locations = singleton (nameValuePair "/" '' - root ${base-dir}; - ''); + virtualHosts = { + "euer.krebsco.de" = { + #serverAliases = [ "blog.euer.krebsco.de" "blog.${hostname}" ]; + enableSSL = true; + enableACME = true; + forceSSL = true; + root = base-dir; }; }; }; diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix index bff652daf..40c376130 100644 --- a/makefu/2configs/nginx/euer.test.nix +++ b/makefu/2configs/nginx/euer.test.nix @@ -8,18 +8,16 @@ let external-ip = config.krebs.build.host.nets.internet.ip4.addr; internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr; in { - krebs.nginx = { + services.nginx = { enable = mkDefault true; - servers = { - euer-share = { - listen = [ ]; - server-names = [ "share.euer.krebsco.de" ]; - locations = singleton (nameValuePair "/" '' + virtualHosts."share.euer.krebsco.de" = { + locations."/" = { + proxyPass = "http://localhost:8000/"; + extraConfig = '' proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://localhost:8000/; - ''); + ''; }; }; }; diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix index 9d0b74871..fefdd6dc7 100644 --- a/makefu/2configs/nginx/euer.wiki.nix +++ b/makefu/2configs/nginx/euer.wiki.nix @@ -4,13 +4,6 @@ with import <stockholm/lib>; let sec = toString <secrets>; ext-dom = "wiki.euer.krebsco.de"; - acmepath = "/var/lib/acme/"; - acmechall = acmepath + "/challenges/"; - - #ssl_cert = "${sec}/wildcard.krebsco.de.crt"; - #ssl_key = "${sec}/wildcard.krebsco.de.key"; - ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem"; - ssl_key = "${acmepath}/${ext-dom}/key.pem"; user = config.services.nginx.user; group = config.services.nginx.group; @@ -25,8 +18,7 @@ let # user1 = pass1 # userN = passN tw-pass-file = "${sec}/tw-pass.ini"; - external-ip = config.krebs.build.host.nets.internet.ip4.addr; - internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr; + in { services.phpfpm = { # phpfpm does not have an enable option @@ -79,24 +71,18 @@ in { }; }; - krebs.nginx = { + services.nginx = { enable = mkDefault true; - servers = { - euer-wiki = { - listen = [ "${external-ip}:80" "${external-ip}:443 ssl" - "${internal-ip}:80" "${internal-ip}:443 ssl" ]; - server-names = [ - ext-dom - "wiki.makefu.retiolum" - "wiki.makefu" - ]; - ssl = { - enable = true; - # these certs will be needed if acme has not yet created certificates: - certificate = ssl_cert; - certificate_key = ssl_key; - force_encryption = true; - }; + virtualHosts = { + "${ext-dom}" = { + #serverAliases = [ + # "wiki.makefu.retiolum" + # "wiki.makefu" + #]; + enableSSL = true; + forceSSL = true; + enableACME = true; + # recommendedGzipSettings = true; extraConfig = '' gzip on; gzip_buffers 4 32k; @@ -104,34 +90,26 @@ in { default_type text/plain; ''; - locations = [ - (nameValuePair "/" '' - root ${wiki-dir}; - expires -1; - autoindex on; - '') - (nameValuePair "/store.php" '' - root ${tw-upload}; - client_max_body_size 200M; - fastcgi_split_path_info ^(.+\.php)(/.+)$; - fastcgi_pass unix:${fpm-socket}; - include ${pkgs.nginx}/conf/fastcgi_params; - include ${pkgs.nginx}/conf/fastcgi.conf; - '') - (nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${ext-dom}/; - '') - - ]; + locations = { + "/" = { + root = wiki-dir; + extraConfig = '' + expires -1; + autoindex on; + ''; + }; + "/store.php" = { + root = tw-upload; + extraConfig = '' + client_max_body_size 200M; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:${fpm-socket}; + include ${pkgs.nginx}/conf/fastcgi_params; + include ${pkgs.nginx}/conf/fastcgi.conf; + ''; + }; + }; }; }; }; - security.acme.certs."${ext-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${ext-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - postRun = "systemctl reload nginx.service"; - extraDomains."${ext-dom}" = null ; - }; } diff --git a/makefu/2configs/nginx/icecult.nix b/makefu/2configs/nginx/icecult.nix index ce4f62e55..e817e55d8 100644 --- a/makefu/2configs/nginx/icecult.nix +++ b/makefu/2configs/nginx/icecult.nix @@ -10,19 +10,17 @@ let sha256 = "0l8q7kw3w1kpvmy8hza9vr5liiycivbljkmwpacaifbay5y98z58"; }; in{ - krebs.nginx = { + services.nginx = { enable = true; - servers.default = { - extraConfig = '' - root ${icecult}/app; + virtualHosts.default = { + root = "${icecult}/app"; + locations = { + "/rpc".proxyPass = "http://10.42.22.163:3121"; + "/rpc".extraConfig = '' + rewrite /rpc/(.*) /$1 break; + proxy_http_version 1.1; ''; - locations = [ - (nameValuePair "/rpc" '' - rewrite /rpc/(.*) /$1 break; - proxy_http_version 1.1; - proxy_pass http://10.42.22.163:3121; - '') - ]; + }; }; }; } diff --git a/makefu/2configs/nginx/public_html.nix b/makefu/2configs/nginx/public_html.nix index 9545e98f4..676d1f110 100644 --- a/makefu/2configs/nginx/public_html.nix +++ b/makefu/2configs/nginx/public_html.nix @@ -3,13 +3,16 @@ with import <stockholm/lib>; { - krebs.nginx = { + services.nginx = { enable = true; - servers.default.locations = [ - (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' - alias /home/$1/public_html$2; - autoindex on; - '') - ]; + virtualHosts.default = { + default = true; + locations = { + "~ ^/~(.+?)(/.*)?\$".extraConfig = '' + alias /home/$1/public_html$2; + autoindex on; + ''; + }; + }; }; } diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix index 593f23199..44345dcd8 100644 --- a/makefu/2configs/nginx/update.connector.one.nix +++ b/makefu/2configs/nginx/update.connector.one.nix @@ -1,25 +1,19 @@ { config, lib, pkgs, ... }: with import <stockholm/lib>; -let - hostname = config.krebs.build.host.name; - external-ip = config.krebs.build.host.nets.internet.ip4.addr; -in { - krebs.nginx = { +{ + services.nginx = { enable = mkDefault true; - servers = { - update-connector-one = { - listen = [ "${external-ip}:80" ]; - server-names = [ - "update.connector.one" - "firmware.connector.one" - ]; - locations = singleton (nameValuePair "/" '' - autoindex on; - root /var/www/update.connector.one; - sendfile on; - gzip on; - ''); + virtualHosts."update.connector.one" = { + locations = { + "/" = { + root = "/var/www/update.connector.one"; + extraConfig = '' + autoindex on; + sendfile on; + gzip on; + ''; + }; }; }; }; diff --git a/makefu/2configs/omo-share.nix b/makefu/2configs/omo-share.nix index f2ed42230..d1a9fabd7 100644 --- a/makefu/2configs/omo-share.nix +++ b/makefu/2configs/omo-share.nix @@ -7,38 +7,6 @@ let local-ip = "192.168.1.11"; # local-ip = config.krebs.build.host.nets.retiolum.ip4.addr; in { - krebs.nginx = { - enable = mkDefault true; - servers = { - omo-share = { - listen = [ "${local-ip}:80" ]; - locations = singleton (nameValuePair "/" '' - - access_log off; - # sendfile off; - # tcp_nopush on; |