forked from DGNum/infrastructure
92 lines
2.3 KiB
Nix
92 lines
2.3 KiB
Nix
|
{
|
||
|
|
config,
|
||
|
|
lib,
|
||
|
|
pkgs,
|
||
|
|
nixpkgs,
|
||
|
|
...
|
||
|
|
}:
|
||
|
|
|
||
|
|
let
|
||
|
|
environment = {
|
||
|
|
ACME_ACCEPT_TERMS = "true";
|
||
|
|
ACME_EMAIL = "acme@dgnum.eu";
|
||
|
|
DNS_PROVIDER = "ovh";
|
||
|
|
OVH_ENDPOINT = "ovh-eu";
|
||
|
|
ENABLE_HTTP_SERVER = "false";
|
||
|
|
GITEA_ROOT = "https://git.dgnum.eu";
|
||
|
|
PORT = "8010";
|
||
|
|
PAGES_DOMAIN = "dgnum.page";
|
||
|
|
RAW_DOMAIN = "raw.dgnum.page";
|
||
|
|
PAGES_BRANCHES = "pages,main,master";
|
||
|
|
};
|
||
|
|
|
||
|
|
# Necessary until upstream cuts a new release because of
|
||
|
|
# https://codeberg.org/Codeberg/pages-server/issues/235
|
||
|
|
# that is fixed on main
|
||
|
|
package = nixpkgs.unstable.codeberg-pages.overrideAttrs (_: {
|
||
|
|
src = pkgs.fetchFromGitea {
|
||
|
|
domain = "codeberg.org";
|
||
|
|
owner = "Codeberg";
|
||
|
|
repo = "pages-server";
|
||
|
|
rev = "9524b1eb12f77fa345cc8a220f67ae244da0ab12";
|
||
|
|
hash = "sha256-RZjwy0Vdqu2XdF14hwXvQ7Bj11+1Q2VxDm1GTU1brA8=";
|
||
|
|
};
|
||
|
|
vendorHash = "sha256-xfn3uMeea25dG7On28mU38i5Izo9YVKDXNFT7WipiYI=";
|
||
|
|
});
|
||
|
|
in
|
||
|
|
|
||
|
|
{
|
||
|
|
|
||
|
|
systemd.services.codeberg-pages = {
|
||
|
|
inherit environment;
|
||
|
|
description = "Codeberg pages server";
|
||
|
|
after = [ "network.target" ];
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
serviceConfig = {
|
||
|
|
Type = "simple";
|
||
|
|
StateDirectory = "codeberg-pages";
|
||
|
|
EnvironmentFile = config.age.secrets."pages-environment_file".path;
|
||
|
|
WorkingDirectory = "/var/lib/codeberg-pages";
|
||
|
|
DynamicUser = true;
|
||
|
|
ExecStart = lib.getExe package;
|
||
|
|
Restart = "on-failure";
|
||
|
|
ProtectHome = true;
|
||
|
|
ProtectSystem = "strict";
|
||
|
|
PrivateTmp = true;
|
||
|
|
PrivateDevices = true;
|
||
|
|
ProtectHostname = true;
|
||
|
|
ProtectClock = true;
|
||
|
|
ProtectKernelTunables = true;
|
||
|
|
ProtectKernelModules = true;
|
||
|
|
ProtectKernelLogs = true;
|
||
|
|
ProtectControlGroups = true;
|
||
|
|
NoNewPrivileges = true;
|
||
|
|
RestrictRealtime = true;
|
||
|
|
RestrictSUIDSGID = true;
|
||
|
|
RemoveIPC = true;
|
||
|
|
PrivateMounts = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
services.nginx = {
|
||
|
|
streamConfig = ''
|
||
|
|
map $ssl_preread_server_name $sni_upstream {
|
||
|
|
hostnames;
|
||
|
|
default 127.0.0.1:8010;
|
||
|
|
${lib.concatMapStringsSep "\n" (vhost: " ${vhost} 127.0.0.1:8446;") (
|
||
|
|
lib.attrNames config.services.nginx.virtualHosts
|
||
|
|
)}
|
||
|
|
}
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen [::]:443;
|
||
|
|
ssl_preread on;
|
||
|
|
proxy_pass $sni_upstream;
|
||
|
|
}
|
||
|
|
|
||
|
|
'';
|
||
|
|
defaultSSLListenPort = 8446;
|
||
|
|
};
|
||
|
|
|
||
|
|
}
|