config-perso/machines/kat-orchid/default.nix

206 lines
4.7 KiB
Nix
Raw Normal View History

2024-08-07 17:26:34 +02:00
{
config,
lib,
pkgs,
2024-10-27 09:16:42 +01:00
kat-path,
ssh-keys,
sources,
2024-08-07 17:26:34 +02:00
...
}:
{
deployment = {
targetHost = "orchid.kat";
tags = [ "kat-vms" ];
};
2024-08-07 17:26:34 +02:00
imports = [
./hardware-configuration.nix
./disks.nix
];
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
kernelParams = [ "console=ttyS0" ];
2024-10-03 17:42:38 +02:00
};
2024-08-07 17:26:34 +02:00
kat = {
fqdn = "orchid.katvayor.net";
proxies = {
ip = "192.168.122.6";
aliases = [
"simply-wise.fr"
"www.simply-wise.fr"
];
open-tcp = [
{
internal = 22;
external = 22042;
}
];
};
2024-10-20 18:52:05 +02:00
};
2024-10-20 15:11:00 +02:00
systemd.network.enable = lib.mkForce false;
2024-08-07 17:26:34 +02:00
networking = {
2024-10-03 17:42:38 +02:00
useNetworkd = lib.mkForce false;
firewall.allowedTCPPorts = [
80
443
];
2024-08-07 17:26:34 +02:00
interfaces."enp1s0" = {
useDHCP = false;
ipv4.addresses = [
{
address = "192.168.122.6";
prefixLength = 24;
}
];
ipv6.addresses = [
{
address = "fe80::6";
prefixLength = 64;
}
];
};
defaultGateway = "192.168.122.1";
defaultGateway6 = {
address = "fe80::1";
interface = "enp1s0";
};
nameservers = [
"192.168.122.1"
"fe80::1%enp1s0"
];
};
nixpkgs.config.allowUnfree = true;
security.acme = {
acceptTerms = true;
defaults.email = "root@katvayor.net";
2024-08-21 19:50:37 +02:00
certs."orchid.katvayor.net".extraDomainNames = [
"simply-wise.fr"
"www.simply-wise.fr"
];
2024-08-07 17:26:34 +02:00
};
services = {
openssh.enable = true;
qemuGuest.enable = true;
nginx = {
enable = true;
virtualHosts = {
"orchid.katvayor.net" = {
enableACME = true;
forceSSL = true;
locations = {
"/static/".alias = "/srv/orchid/";
"/" = {
recommendedProxySettings = true;
proxyPass = "https://192.168.123.2/";
};
2024-10-27 09:16:42 +01:00
};
2024-08-07 17:26:34 +02:00
};
"simply-wise.fr" = {
useACMEHost = "orchid.katvayor.net";
forceSSL = true;
serverAliases = [ "www.simply-wise.fr" ];
locations."/" = {
root = pkgs.runCommand "building" { } ''
mkdir -p $out
ln -nsf ${./building.html} $out/building.html
'';
extraConfig = ''
internal;
error_page 404 =503 /building.html;
'';
};
2024-08-21 19:50:37 +02:00
};
};
2024-08-07 17:26:34 +02:00
};
};
2024-10-27 09:16:42 +01:00
containers.wordpress =
let
inherit (config.security.acme) certs;
in
{
privateNetwork = true;
bindMounts.certs = {
hostPath = certs."orchid.katvayor.net".directory;
mountPoint = certs."orchid.katvayor.net".directory;
isReadOnly = true;
};
hostAddress = "192.168.123.1";
localAddress = "192.168.123.2";
autoStart = true;
specialArgs = {
inherit kat-path ssh-keys sources;
};
config = {
imports = [ kat-path ];
kat.addArgs = false;
boot.kernel.enable = false;
systemd.network.enable = lib.mkForce false;
networking.firewall.allowedTCPPorts = [
80
443
];
services = {
nginx = {
enable = true;
virtualHosts."orchid.katvayor.net" = {
addSSL = true;
sslCertificate = "${certs."orchid.katvayor.net".directory}/fullchain.pem";
sslCertificateKey = "${certs."orchid.katvayor.net".directory}/key.pem";
sslTrustedCertificate = "${certs."orchid.katvayor.net".directory}/chain.pem";
};
};
openssh.enable = true;
wordpress = {
webserver = "nginx";
sites."orchid.katvayor.net" = {
themes = {
inherit (pkgs.wordpressPackages.themes) twentytwentythree;
};
};
};
};
environment.systemPackages = [ pkgs.wp-cli ];
system.stateVersion = "24.11";
};
2024-10-20 15:11:00 +02:00
};
2024-08-07 17:26:34 +02:00
fileSystems."/home/orchid/content/www" = {
device = "/srv/orchid";
options = [ "bind" ];
};
2024-08-21 19:50:37 +02:00
systemd = {
tmpfiles.settings."10-srv-orchid"."/srv/orchid" = {
d = {
group = "users";
user = "orchid";
};
Z = {
group = "users";
user = "orchid";
mode = "0755";
};
};
timers.srv-tmpfiles = {
wantedBy = [ "timers.target" ];
timerConfig.OnCalendar = "*-*-* *:*:07..57/10";
};
services.srv-tmpfiles = {
path = [ pkgs.systemd ];
script = ''
systemd-tmpfiles --create --prefix=/srv
'';
};
};
2024-08-07 17:26:34 +02:00
2024-09-26 11:51:04 +02:00
users.users.orchid.isNormalUser = true;
home-manager.users.orchid = { };
2024-08-07 17:26:34 +02:00
system.stateVersion = "23.11";
}