diff options
Diffstat (limited to 'services')
| -rw-r--r-- | services/cgit.nix | 103 | ||||
| -rw-r--r-- | services/ejabberd.nix | 243 | ||||
| -rw-r--r-- | services/mailserver.nix | 17 | ||||
| -rw-r--r-- | services/website.nix | 14 |
4 files changed, 377 insertions, 0 deletions
diff --git a/services/cgit.nix b/services/cgit.nix new file mode 100644 index 0000000..a7795ac --- /dev/null +++ b/services/cgit.nix @@ -0,0 +1,103 @@ +{ pkgs, fqdn, ... }: +{ + services.uwsgi = { + enable = true; + user = "public"; + group = "users"; + plugins = [ "cgi" ]; + + instance = { + type = "emperor"; + vassals = { + cgit = { + type = "normal"; + master = "true"; + socket = "/run/uwsgi/cgit.sock"; + procname-master = "uwsgi cgit"; + plugins = [ "cgi" ]; + cgi = "${pkgs.cgit}/cgit/cgit.cgi"; + }; + }; + }; + }; + + services.gitolite = { + enable = true; + user = "git"; + group = "git"; + adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILhzz/CAb74rLQkDF2weTCb0DICw1oyXNv6XmdLfEsT5 crash@crashoverburn.com"; + extraGitoliteRc = '' + $RC{UMASK} = 0027; + $RC{GIT_CONFIG_KEYS} = '.*'; + ''; + }; + + users.extraUsers.public = + { + isSystemUser = true; + group = "git"; + }; + + services.nginx.virtualHosts."code.${fqdn}" = { + addSSL = true; + enableACME = true; + root = "${pkgs.cgit}/cgit"; + locations = { + "/" = { + extraConfig = '' + try_files $uri @cgit; + ''; + }; + "@cgit" = { + extraConfig = '' + uwsgi_pass unix:/run/uwsgi/cgit.sock; + include ${pkgs.nginx}/conf/uwsgi_params; + uwsgi_modifier1 9; + ''; + }; + }; + }; + + systemd.services.create-cgit-cache = { + description = "Create cache directory for cgit"; + enable = true; + wantedBy = [ "uwsgi.service" ]; + serviceConfig = { + type = "oneshot"; + }; + script = '' + mkdir /run/cgit + chown -R public:users /run/cgit + ''; + }; + + environment.etc."cgitrc".text = '' + virtual-root=/ + + cache-size=1000 + cache-root=/run/cgit + + root-title=~/projects + root-desc=code.${fqdn} + footer= + + enable-index-owner=0 + enable-http-clone=1 + noplainemail=1 + + max-atom-items=50 + + enable-git-config=1 + enable-gitweb-owner=1 + remove-suffix=1 + + snapshots=all + readme=master:README.md + + source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py + about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh + + project-list=/var/lib/gitolite/projects.list + scan-path=/var/lib/gitolite/repositories + ''; +} diff --git a/services/ejabberd.nix b/services/ejabberd.nix new file mode 100644 index 0000000..f18cfe6 --- /dev/null +++ b/services/ejabberd.nix @@ -0,0 +1,243 @@ +{ fqdn }: { config, lib, pkgs, ... }: +let + inherit (builtins) toJSON; + inherit (pkgs) writeText; + inherit (pkgs.lib.lists) foldl'; + inherit (pkgs.lib.attrsets) mapAttrs' nameValuePair; + inherit (config.networking) domain; + + certs = config.security.acme.certs; + certDirectory = certs.${fqdn}.directory; +in { + services.ejabberd = { + enable = true; + imagemagick = true; + configFile = let + toPaths = s: mapAttrs' (n: v: nameValuePair "/${n}" v) s; + dhfile = config.security.dhparams.params.nginx.path; + toACLs = map (x: { acl = x; }); + in writeText "ejabberd.yml" (toJSON { + hosts = [ fqdn ]; + loglevel = 4; + s2s_cafile = "/etc/ssl/certs/ca-certificates.crt"; + ca_file = "/etc/ssl/certs/ca-certificates.crt"; + certfiles = [ "${certDirectory}/*.pem" ]; + listen = map (x: x // { ip = "10.0.1.30"; }) [ + { + inherit dhfile; + port = 5222; + module = "ejabberd_c2s"; + max_stanza_size = 262144; + shaper = "c2s_shaper"; + access = "c2s"; + starttls_required = true; + } + { + inherit dhfile; + port = 5223; + tls = true; + module = "ejabberd_c2s"; + max_stanza_size = 262144; + shaper = "c2s_shaper"; + access = "c2s"; + starttls_required = true; + } + { + inherit dhfile; + port = 5269; + module = "ejabberd_s2s_in"; + max_stanza_size = 524288; + } + { + inherit dhfile; + port = 5443; + module = "ejabberd_http"; + tls = true; + request_handlers = toPaths { + admin = "ejabberd_web_admin"; + api = "mod_http_api"; + bosh = "mod_bosh"; + captcha = "ejabberd_captcha"; + upload = "mod_http_upload"; + ws = "ejabberd_http_ws"; + }; + } + { + inherit dhfile; + port = 5280; + module = "ejabberd_http"; + request_handlers = toPaths { + admin = "ejabberd_web_admin"; + ".well-known/acme-challenge" = "ejabberd_acme"; + }; + } + { + port = 3478; + transport = "udp"; + module = "ejabberd_stun"; + use_turn = true; + turn_ipv4_address = "193.16.42.36"; + } + { + port = 1883; + module = "mod_mqtt"; + backlog = 1000; + } + ]; + s2s_use_starttls = "required"; + acl = { + local.user_regexp = ""; + loopback.ip = [ + "127.0.0.1/8" + "::1/128" + ]; + admin.user = [ "crash@${fqdn}" ]; + }; + access_rules = { + c2s = { + deny = "blocked"; + allow = "all"; + }; + } // mapAttrs' (n: v: nameValuePair n { allow = v; }) { + local = "local"; + announce = "admin"; + configure = "admin"; + muc_create = "local"; + pubsub_createnode = "local"; + trusted_network = "loopback"; + }; + api_permissions = { + "console commands" = { + from = [ "ejabberd_ctl" ]; + who = "all"; + what = "*"; + }; + "admin access" = { + who = { + access.allow = toACLs [ + "local" + "admin" + ]; + oauth = { + scope = "ejabberd:admin"; + access.allow = toACLs [ + "loopback" + "admin" + ]; + }; + }; + what = [ + "*" + "!stop" + "!start" + ]; + }; + "public commands" = { + who.ip = "127.0.0.1/8"; + what = [ + "status" + "connected_users_number" + ]; + }; + }; + shaper = { + normal = { + rate = 3000; + burst_size = 20000; + }; + fast = 100000; + }; + shaper_rules = { + max_user_sessions = 10; + max_user_offline_messages = { + "5000" = "admin"; + "100" = "all"; + }; + c2s_shaper = { + none = "admin"; + normal = "all"; + }; + s2s_shaper = "fast"; + }; + modules = mapAttrs' (n: v: nameValuePair "mod_${n}" v) ({ + announce.access = "announce"; + http_upload = { + put_url = "https://@HOST@:5443/upload"; + custom_headers = { + Access-Control-Allow-Origin = "https://@HOST@"; + Access-Control-Allow-Methods = "GET,HEAD,PUT,OPTIONS"; + Access-Control-Allow-Headers = "Content-Type"; + }; + }; + mam = { + assume_mam_usage = true; + default = "always"; + }; + muc = { + access = [ "allow" ]; + access_admin = [ { allow = "admin"; } ]; + access_create = "muc_create"; + access_persistent = "muc_create"; + access_mam = [ "allow" ]; + default_room_options.mam = true; + }; + offline.access_max_user_messages = "max_user_offline_messages"; + proxy65 = { + access = "local"; + max_connections = 5; + }; + pubsub = { + access_createnode = "pubsub_createnode"; + plugins = [ + "flat" + "pep" + ]; + force_node_config."storage:bookmarks".access_model = "whitelist"; + }; + register.ip_access = "trusted_network"; + roster.versioning = true; + stream_mgmt.resend_on_timeout = "if_offline"; + version.show_os = false; + } // foldl' (a: x: a // { ${x} = {}; }) {} [ + "adhoc" "admin_extra" "avatar" + "blocking" "bosh" + "caps" "carboncopy" "client_state" "configure" + "disco" + "fail2ban" + "http_api" + "last" + "mqtt" "muc_admin" + "ping" "privacy" "private" "push" "push_keepalive" + "s2s_dialback" "shared_roster" "stun_disco" + "vcard" "vcard_xupdate" + ]); + }); + package = pkgs.ejabberd.override { + withZlib = true; + withTools = true; + }; + }; + security.acme.certs.${fqdn} = { + extraDomainNames = map (x: "${x}.${fqdn}") [ + "pubsub" + "proxy" + "upload" + "conference" + ]; + group = "ejabberd-cert"; + postRun = "systemctl restart ejabberd.service"; + }; + users.groups.ejabberd-cert.members = [ "ejabberd" "nginx" ]; + security.dhparams = { + enable = true; + params.nginx = {}; + }; + networking.firewall.allowedTCPPorts = [ + 5222 # xmpp-client + 5223 # xmpp-client + 5269 # xmpp-server + 5280 # xmpp-bosh + 5443 # https + 3478 # xmpp-stun + ]; +} diff --git a/services/mailserver.nix b/services/mailserver.nix new file mode 100644 index 0000000..7d6f1d8 --- /dev/null +++ b/services/mailserver.nix @@ -0,0 +1,17 @@ +{ pkgs, hashedPasswordFile, ... }: +{ + mailserver = { + fqdn = "mail.crashoverburn.com"; + domains = [ "mail.crashoverburn.com" "crashoverburn.com" ]; + enable = true; + # A list of all login accounts. To create the password hashes, use + # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt' + loginAccounts = { + "crash@crashoverburn.com" = { + inherit hashedPasswordFile; + aliases = [ "postmaster@mail.crashoverburn.com" "overburn@crashoverburn.com" ]; + }; + }; + certificateScheme = "acme-nginx"; + }; +}
\ No newline at end of file diff --git a/services/website.nix b/services/website.nix new file mode 100644 index 0000000..d36f538 --- /dev/null +++ b/services/website.nix @@ -0,0 +1,14 @@ +{ webroot }: { config, lib, pkgs, ... }: +{ + services.nginx.enable = true; + services.nginx.virtualHosts."crashoverburn.com" = { + addSSL = true; + enableACME = true; + root = webroot; + }; + services.nginx.virtualHosts."crashoverburn.online" = { + addSSL = true; + enableACME = true; + root = webroot; + }; +} |