From fb121299ab56d9a36abafdab12b42b207d7bcb60 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Oct 2019 08:45:39 +0200 Subject: ma x.r: cleanup --- makefu/2configs/hw/upower.nix | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 makefu/2configs/hw/upower.nix (limited to 'makefu/2configs') diff --git a/makefu/2configs/hw/upower.nix b/makefu/2configs/hw/upower.nix new file mode 100644 index 000000000..a3932fed3 --- /dev/null +++ b/makefu/2configs/hw/upower.nix @@ -0,0 +1,6 @@ +{ pkgs, ... }: +{ + services.upower.enable = true; + users.users.makefu.packages = [ pkgs.gnome3.gnome-power-manager ]; +} + -- cgit v1.2.3 From d82b3b9b66d8493426bfff9936d34ff5d76734dd Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Oct 2019 08:47:31 +0200 Subject: ma: fix warnings and errors for 19.09 --- makefu/2configs/hw/tp-x230.nix | 1 - makefu/2configs/hw/tp-x2x0.nix | 1 + makefu/2configs/tools/pcmanfm-extra.nix | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) (limited to 'makefu/2configs') diff --git a/makefu/2configs/hw/tp-x230.nix b/makefu/2configs/hw/tp-x230.nix index a6ded0a3e..37d1affb7 100644 --- a/makefu/2configs/hw/tp-x230.nix +++ b/makefu/2configs/hw/tp-x230.nix @@ -7,7 +7,6 @@ with import ; # configured media keys inside awesomerc # sound.mediaKeys.enable = true; - hardware.bluetooth.enable = true; # possible i915 powersave options: # options i915 enable_rc6=1 enable_fbc=1 semaphores=1 diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix index 5570bec55..564925db5 100644 --- a/makefu/2configs/hw/tp-x2x0.nix +++ b/makefu/2configs/hw/tp-x2x0.nix @@ -4,6 +4,7 @@ imports = [ ./tpm.nix ./ssd.nix + ./bluetooth.nix ]; boot.kernelModules = [ diff --git a/makefu/2configs/tools/pcmanfm-extra.nix b/makefu/2configs/tools/pcmanfm-extra.nix index 2d5d20f80..f28f9a91a 100644 --- a/makefu/2configs/tools/pcmanfm-extra.nix +++ b/makefu/2configs/tools/pcmanfm-extra.nix @@ -7,5 +7,5 @@ lxmenu-data ]; environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.gvfs}/lib/gio/modules" ]; - services.gnome3.gvfs.enable = true; + services.gvfs.enable = true; } -- cgit v1.2.3 From dc60431d5927946fbd76a605744c60f2fecee89f Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Oct 2019 11:59:17 +0200 Subject: ma owncloud: re-enable secrets, add dummy secret --- makefu/2configs/deployment/owncloud.nix | 46 +++++++++++++++++---------------- 1 file changed, 24 insertions(+), 22 deletions(-) (limited to 'makefu/2configs') diff --git a/makefu/2configs/deployment/owncloud.nix b/makefu/2configs/deployment/owncloud.nix index 6f073fd4c..6f041e1e0 100644 --- a/makefu/2configs/deployment/owncloud.nix +++ b/makefu/2configs/deployment/owncloud.nix @@ -171,27 +171,29 @@ in { networking.firewall.allowedTCPPorts = [ 80 443 ]; services.redis.enable = true; - services.mysql = { - enable = false; - package = pkgs.mariadb; - rootPassword = config.krebs.secret.files.mysql_rootPassword.path; - initialDatabases = [ - # Or use writeText instead of literalExample? - #{ name = "nextcloud"; schema = literalExample "./nextcloud.sql"; } - { - name = "nextcloud"; - schema = pkgs.writeText "nextcloud.sql" - '' - create user if not exists 'nextcloud'@'localhost' identified by 'password'; - grant all privileges on nextcloud.* to 'nextcloud'@'localhost' identified by 'password'; - ''; - } - ]; - }; + + #services.mysql = { + # enable = false; + # package = pkgs.mariadb; + # rootPassword = config.krebs.secret.files.mysql_rootPassword.path; + # initialDatabases = [ + # # Or use writeText instead of literalExample? + # #{ name = "nextcloud"; schema = literalExample "./nextcloud.sql"; } + # { + # name = "nextcloud"; + # schema = pkgs.writeText "nextcloud.sql" + # '' + # create user if not exists 'nextcloud'@'localhost' identified by 'password'; + # grant all privileges on nextcloud.* to 'nextcloud'@'localhost' identified by 'password'; + # ''; + # } + # ]; + #}; + # dataDir is only defined after mysql is enabled - # krebs.secret.files.mysql_rootPassword = { - # path = "${config.services.mysql.dataDir}/mysql_rootPassword"; - # owner.name = "root"; - # source-path = toString + "/mysql_rootPassword"; - # }; + #krebs.secret.files.mysql_rootPassword = { + # path = "${config.services.mysql.dataDir}/mysql_rootPassword"; + # owner.name = "root"; + # source-path = toString + "/mysql_rootPassword"; + #}; } -- cgit v1.2.3 From 44477523519b40d92c743c30792e1ca8c7bcc83b Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Oct 2019 14:26:50 +0200 Subject: ma nginx/euer.wiki: poolConfigs -> pools --- makefu/2configs/deployment/owncloud.nix | 36 +++++++++++++++++---------------- makefu/2configs/nginx/euer.wiki.nix | 26 +++++++++++------------- 2 files changed, 31 insertions(+), 31 deletions(-) (limited to 'makefu/2configs') diff --git a/makefu/2configs/deployment/owncloud.nix b/makefu/2configs/deployment/owncloud.nix index 6f041e1e0..38eed2fd9 100644 --- a/makefu/2configs/deployment/owncloud.nix +++ b/makefu/2configs/deployment/owncloud.nix @@ -118,23 +118,25 @@ let access_log off; ''; }; - services.phpfpm.poolConfigs."${domain}" = '' - listen = ${socket} - user = nginx - group = nginx - pm = dynamic - pm.max_children = 32 - pm.max_requests = 500 - pm.start_servers = 2 - pm.min_spare_servers = 2 - pm.max_spare_servers = 5 - listen.owner = nginx - listen.group = nginx - php_admin_value[error_log] = 'stderr' - php_admin_flag[log_errors] = on - env[PATH] = ${lib.makeBinPath [ pkgs.php ]} - catch_workers_output = yes - ''; + services.phpfpm.pools."${domain}" = { + user = "nginx"; + group = "nginx"; + listen = socket; + settings = { + "pm" = "dynamic"; + "pm.max_children" = 32; + "pm.max_requests" = 500; + "pm.start_servers" = 2; + "pm.min_spare_servers" = 2; + "pm.max_spare_servers" = 5; + }; + extraConfig = '' + php_admin_value[error_log] = 'stderr' + php_admin_flag[log_errors] = on + env[PATH] = ${lib.makeBinPath [ pkgs.php ]} + catch_workers_output = yes + ''; + }; services.phpfpm.phpOptions = '' opcache.enable=1 opcache.enable_cli=1 diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix index 732c27784..56f44f9ad 100644 --- a/makefu/2configs/nginx/euer.wiki.nix +++ b/makefu/2configs/nginx/euer.wiki.nix @@ -23,20 +23,18 @@ let in { state = [ base-dir ]; services.phpfpm = { - # phpfpm does not have an enable option - poolConfigs = { - euer-wiki = '' - user = ${user} - group = ${group} - listen = ${fpm-socket} - listen.owner = ${user} - listen.group = ${group} - env[twconf] = ${base-cfg}; - pm = dynamic - pm.max_children = 5 - pm.start_servers = 2 - pm.min_spare_servers = 1 - pm.max_spare_servers = 3 + pools.euer-wiki = { + inherit user group; + listen = fpm-socket; + config = { + "pm" = "dynamic"; + "pm.max_children" = 5; + "pm.start_servers" = 2; + "pm.min_spare_servers" = 1; + "pm.max_spare_servers" = 3; + }; + phpEnv.twconf = base-cfg; + extraConfig = '' chdir = / php_admin_value[error_log] = 'stderr' php_admin_flag[log_errors] = on -- cgit v1.2.3 From 0116beb65839f61763d4e3e6bf9ba381de02435b Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Oct 2019 21:42:57 +0200 Subject: ma nginx/euer.wiki: use settings instead of extraConfig all the way down --- makefu/2configs/nginx/euer.wiki.nix | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) (limited to 'makefu/2configs') diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix index 56f44f9ad..a6766eeec 100644 --- a/makefu/2configs/nginx/euer.wiki.nix +++ b/makefu/2configs/nginx/euer.wiki.nix @@ -26,20 +26,19 @@ in { pools.euer-wiki = { inherit user group; listen = fpm-socket; - config = { + settings = { "pm" = "dynamic"; "pm.max_children" = 5; "pm.start_servers" = 2; "pm.min_spare_servers" = 1; "pm.max_spare_servers" = 3; + "chdir" = "/"; + "php_admin_value[error_log]" = "stderr"; + "php_admin_flag[log_errors]" = "on"; + "catch_workers_output" = "yes"; + }; phpEnv.twconf = base-cfg; - extraConfig = '' - chdir = / - php_admin_value[error_log] = 'stderr' - php_admin_flag[log_errors] = on - catch_workers_output = yes - ''; }; }; -- cgit v1.2.3 From 3aa59e62745bf4d8f750f1e131548dbd53de010b Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Oct 2019 22:41:08 +0200 Subject: ma nginx: make linter happy --- makefu/2configs/deployment/owncloud.nix | 4 ++++ makefu/2configs/nginx/euer.mon.nix | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) (limited to 'makefu/2configs') diff --git a/makefu/2configs/deployment/owncloud.nix b/makefu/2configs/deployment/owncloud.nix index 38eed2fd9..59dfa3203 100644 --- a/makefu/2configs/deployment/owncloud.nix +++ b/makefu/2configs/deployment/owncloud.nix @@ -110,6 +110,10 @@ let add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; + add_header X-Frame-Options SAMEORIGIN; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + # Optional: Don't log access to assets access_log off; ''; diff --git a/makefu/2configs/nginx/euer.mon.nix b/makefu/2configs/nginx/euer.mon.nix index 765fef535..c9db15b73 100644 --- a/makefu/2configs/nginx/euer.mon.nix +++ b/makefu/2configs/nginx/euer.mon.nix @@ -32,7 +32,7 @@ in { auth_basic "Needs Autherization to visit"; auth_basic_user_file ${authFile}; proxy_http_version 1.1; - proxy_set_header Host $http_host; + proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_redirect off; ''; -- cgit v1.2.3