Avery/NixOS
Avery/NixOS
1
0
Fork 0
Code Activity

Configure ACME

Browse source
This commit is contained in:
Avery 2025-02-16 17:14:00 +01:00
parent d1a2d2da3f
commit aaf9a98e7a
Signed by: Avery
GPG key ID: B684FD451B692E04
12 changed files with 14 additions and 149 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/greatyamada/services/_port-definitions.nix
View file

@ -6,8 +6,6 @@
coturn-minimum = 49192;
coturn-maximum = 49200;
forgejo-http = 3000;
inv-sig-helper = 12999;
invidious-http = 3002;
jellyfin-http = 8096;
matrix-http = 8008;
matrix-https = 8448;

4
hosts/greatyamada/services/acme.nix
View file

@ -2,11 +2,13 @@
security.acme = {
acceptTerms = true;
defaults.email = "aveeryy@protonmail.com";
# Temporarily use staging server for testing
defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
certs."rcia.dev" = {
credentialFiles.CLOUDFLARE_DNS_API_TOKEN_FILE =
"/run/secrets/cloudflare_api_token";
dnsProvider = "cloudflare";
extraDomainNames = [ "*.rcia.dev" ];
group = "nginx";
};
};
sops.secrets."cloudflare/api_token" = {

1
hosts/greatyamada/services/adguardhome.nix
View file

@ -44,6 +44,7 @@ in {
locations."/".proxyPass =
"http://127.0.0.1:${toString portDefinitions.adguardhome-http}";
extraConfig = nginxLocalServiceConfig;
useACMEHost = "rcia.dev";
};
};
}

1
hosts/greatyamada/services/default.nix
View file

@ -3,7 +3,6 @@
./acme.nix
./ddclient.nix
./forgejo.nix
./invidious
./jellyfin.nix
./minecraft
./nginx.nix

1
hosts/greatyamada/services/forgejo.nix
View file

@ -43,6 +43,7 @@ in {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString portDefinitions.forgejo-http}";
};
useACMEHost = "rcia.dev";
};
};
systemd.services.forgejo.preStart = ''

10
hosts/greatyamada/services/invidious/default.nix
View file

@ -1,10 +0,0 @@
{ ... }: {
imports = [ ./invidious.nix ./inv-sig-helper.nix ];
users = {
groups.invidious = { };
users.invidious = {
group = "invidious";
isSystemUser = true;
};
};
}

83
hosts/greatyamada/services/invidious/inv-sig-helper.nix
View file

@ -1,83 +0,0 @@
{ pkgs, ... }:
let portDefinitions = import ../_port-definitions.nix;
in {
environment.systemPackages = with pkgs; [ inv-sig-helper ];
systemd.services.inv-sig-helper = {
enable = true;
after = [ "syslog.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = "invidious";
Group = "invidious";
ExecStart =
"${pkgs.inv-sig-helper}/bin/inv_sig_helper_rust --tcp 127.0.0.1:${
toString portDefinitions.inv-sig-helper
}";
Restart = "always";
RestartSec = "2s";
Type = "simple";
WorkingDirectory = "/tmp";
BindPaths = "/tmp";
CapabilityBoundingSet = [
"~CAP_SETUID CAP_SETGID CAP_SETPCAP"
"~CAP_SYS_ADMIN"
"~CAP_SYS_PTRACE"
"~CAP_CHOWN CAP_FSETID CAP_SETFCAP"
"~CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER"
"~CAP_NET_ADMIN"
"~CAP_SYS_MODULE"
"~CAP_SYS_RAWIO"
"~CAP_SYS_TIME"
"~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE"
"~CAP_KILL"
"~CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW"
"~CAP_SYSLOG"
"~CAP_SYS_NICE CAP_SYS_RESOURCE"
"~CAP_MAC_ADMIN CAP_MAC_OVERRIDE"
"~CAP_SYS_BOOT"
"~CAP_LINUX_IMMUTABLE"
"~CAP_IPC_LOCK"
"~CAP_SYS_CHROOT"
"~CAP_BLOCK_SUSPEND"
"~CAP_LEASE"
"~CAP_SYS_PACCT"
"~CAP_SYS_TTY_CONFIG"
"~CAP_WAKE_ALARM"
];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectControlGroups = true;
ProtectHome = "tmpfs";
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
RestrictNamespaces = true;
RestrictSUIDSGID = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"~@clock"
"~@debug"
"~@module"
"~@mount"
"~@raw-io"
"~@reboot"
"~@swap"
"~@privileged"
"~@resources"
"~@cpu-emulation"
"~@obsolete"
];
};
};
}

51
hosts/greatyamada/services/invidious/invidious.nix
View file

@ -1,51 +0,0 @@
{ ... }:
let
nginxLocalServiceConfig = import ../nginx-local-config.nix;
ports = import ../_port-definitions.nix;
in {
services = {
invidious = {
enable = true;
port = ports.invidious-http;
extraSettingsFile = "/var/lib/invidious/extra_configuration";
settings = {
check_tables = true;
db.user = "invidious";
default_user_preferences = {
locale = "es";
dark_mode = "dark";
autoplay = true;
video_loop = true;
quality = "dash";
volume = 20;
};
signature_server = "localhost:${toString ports.inv-sig-helper}";
};
database = {
createLocally = false;
passwordFile = "/var/lib/invidious/db_password";
};
hmacKeyFile = "/var/lib/invidious/hmac_key";
};
nginx.virtualHosts."iv.rcia.dev" = {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString ports.invidious-http}";
};
extraConfig = nginxLocalServiceConfig;
};
};
sops.secrets = {
"invidious/db_password" = {
path = "/var/lib/invidious/db_password";
owner = "invidious";
};
"invidious/hmac" = {
path = "/var/lib/invidious/hmac_key";
owner = "invidious";
};
"invidious/extra_secrets" = {
path = "/var/lib/invidious/extra_configuration";
owner = "invidious";
};
};
}

1
hosts/greatyamada/services/jellyfin.nix
View file

@ -15,6 +15,7 @@ in {
"http://127.0.0.1:${toString portDefinitions.jellyfin-http}";
};
extraConfig = nginxLocalServiceConfig;
useACMEHost = "rcia.dev";
};
};
}

7
hosts/greatyamada/services/nginx.nix
View file

@ -2,7 +2,12 @@
services.nginx = {
enable = true;
virtualHosts = {
"rcia.dev" = { locations."/" = { root = /var/www/public; }; };
"rcia.dev" = {
forceSSL = true;
enableACME = true;
serverAliases = [ "*.rcia.dev" ];
# locations."/" = { root = /var/www/public; };
};
};
};
}

1
hosts/greatyamada/services/ntfy.nix
View file

@ -15,6 +15,7 @@ in {
proxyPass = "http://127.0.0.1:${toString ports.ntfy-http}";
recommendedProxySettings = true;
};
useACMEHost = "rcia.dev";
};
};
}

1
hosts/greatyamada/services/radicale.nix
View file

@ -24,6 +24,7 @@ in {
"http://127.0.0.1:${toString portDefinitions.radicale-http}";
};
extraConfig = nginxLocalServiceConfig;
useACMEHost = "rcia.dev";
};
};
sops.secrets."radicale/users" = {