2020-02-11 16:41:00 +01:00
|
|
|
# This file configures camden.tazj.in, my homeserver.
|
2020-02-21 13:47:29 +01:00
|
|
|
{ depot, lib, ... }:
|
2020-02-11 16:41:00 +01:00
|
|
|
|
|
|
|
config: let
|
2020-02-21 13:47:29 +01:00
|
|
|
nixpkgs = import depot.third_party.nixpkgsSrc {
|
2020-02-11 16:41:00 +01:00
|
|
|
config.allowUnfree = true;
|
|
|
|
};
|
2020-02-21 13:47:29 +01:00
|
|
|
in lib.fix(self: {
|
2020-02-11 16:41:00 +01:00
|
|
|
# camden is intended to boot unattended, despite having an encrypted
|
|
|
|
# root partition.
|
|
|
|
#
|
|
|
|
# The below configuration uses an externally connected USB drive
|
|
|
|
# that contains a LUKS key file to unlock the disk automatically at
|
|
|
|
# boot.
|
|
|
|
#
|
|
|
|
# TODO(tazjin): Configure LUKS unlocking via SSH instead.
|
|
|
|
boot = {
|
|
|
|
initrd = {
|
|
|
|
availableKernelModules = [
|
|
|
|
"ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sdhci_pci"
|
|
|
|
"rtsx_usb_sdmmc" "r8169"
|
|
|
|
];
|
|
|
|
|
|
|
|
kernelModules = [ "dm-snapshot" ];
|
|
|
|
|
|
|
|
luks.devices.camden-crypt = {
|
|
|
|
fallbackToPassword = true;
|
|
|
|
device = "/dev/disk/by-label/camden-crypt";
|
|
|
|
keyFile = "/dev/sdb";
|
|
|
|
keyFileSize = 4096;
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
loader = {
|
|
|
|
systemd-boot.enable = true;
|
|
|
|
efi.canTouchEfiVariables = true;
|
|
|
|
};
|
|
|
|
|
|
|
|
cleanTmpDir = true;
|
|
|
|
};
|
|
|
|
|
|
|
|
fileSystems = {
|
|
|
|
"/" = {
|
|
|
|
device = "/dev/disk/by-label/camden-root";
|
|
|
|
fsType = "ext4";
|
|
|
|
};
|
|
|
|
|
|
|
|
"/home" = {
|
|
|
|
device = "/dev/disk/by-label/camden-home";
|
|
|
|
fsType = "ext4";
|
|
|
|
};
|
|
|
|
|
|
|
|
"/boot" = {
|
|
|
|
device = "/dev/disk/by-label/BOOT";
|
|
|
|
fsType = "vfat";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2020-02-11 17:46:15 +01:00
|
|
|
nix = {
|
|
|
|
maxJobs = lib.mkDefault 4;
|
|
|
|
|
|
|
|
nixPath = [
|
|
|
|
"depot=/home/tazjin/depot"
|
2020-02-21 13:47:29 +01:00
|
|
|
"nixpkgs=${depot.third_party.nixpkgsSrc}"
|
2020-02-11 17:46:15 +01:00
|
|
|
];
|
2020-02-17 02:00:12 +01:00
|
|
|
|
|
|
|
trustedUsers = [ "root" "tazjin" ];
|
2020-02-11 17:46:15 +01:00
|
|
|
};
|
|
|
|
nixpkgs.pkgs = nixpkgs;
|
2020-02-11 16:41:00 +01:00
|
|
|
|
|
|
|
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
|
|
|
|
|
|
|
networking = {
|
|
|
|
hostName = "camden";
|
|
|
|
interfaces.enp1s0.useDHCP = true;
|
2020-04-04 03:38:51 +02:00
|
|
|
firewall.allowedTCPPorts = [ 22 8080 80 443 1935 ];
|
2020-02-11 16:41:00 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
time.timeZone = "UTC";
|
|
|
|
|
|
|
|
# System-wide application setup
|
|
|
|
programs.fish.enable = true;
|
2020-02-17 01:06:55 +01:00
|
|
|
programs.mosh.enable = true;
|
|
|
|
|
2020-02-11 17:27:34 +01:00
|
|
|
environment.systemPackages =
|
|
|
|
# programs from the depot
|
2020-02-21 13:47:29 +01:00
|
|
|
(with depot; [
|
2020-02-11 17:27:34 +01:00
|
|
|
third_party.git
|
2020-04-20 00:30:19 +02:00
|
|
|
third_party.honk
|
2020-02-17 01:52:07 +01:00
|
|
|
third_party.pounce
|
2020-02-11 17:27:34 +01:00
|
|
|
]) ++
|
|
|
|
|
|
|
|
# programs from nixpkgs
|
|
|
|
(with nixpkgs; [
|
2020-02-17 01:22:19 +01:00
|
|
|
curl
|
|
|
|
direnv
|
|
|
|
emacs26-nox
|
|
|
|
gnupg
|
|
|
|
htop
|
2020-02-21 16:43:07 +01:00
|
|
|
jq
|
2020-02-17 01:22:19 +01:00
|
|
|
pass
|
|
|
|
pciutils
|
2020-02-11 17:27:34 +01:00
|
|
|
]);
|
2020-02-11 16:41:00 +01:00
|
|
|
|
2020-02-12 02:04:12 +01:00
|
|
|
users = {
|
|
|
|
# Set up my own user for logging in and doing things ...
|
|
|
|
users.tazjin = {
|
|
|
|
isNormalUser = true;
|
|
|
|
uid = 1000;
|
|
|
|
extraGroups = [ "git" "wheel" ];
|
|
|
|
shell = nixpkgs.fish;
|
|
|
|
};
|
|
|
|
|
|
|
|
# Set up a user & group for general git shenanigans
|
|
|
|
groups.git = {};
|
|
|
|
users.git = {
|
|
|
|
group = "git";
|
|
|
|
isNormalUser = false;
|
|
|
|
};
|
2020-02-11 16:41:00 +01:00
|
|
|
};
|
|
|
|
|
2020-02-11 21:54:31 +01:00
|
|
|
# Services setup
|
|
|
|
services.openssh.enable = true;
|
|
|
|
services.haveged.enable = true;
|
|
|
|
|
2020-02-11 17:27:34 +01:00
|
|
|
# Join Tailscale into home network
|
2020-04-04 14:17:18 +02:00
|
|
|
services.tailscale.enable = true;
|
2020-02-11 17:27:34 +01:00
|
|
|
|
2020-02-12 02:04:12 +01:00
|
|
|
# Run cgit for the depot. The onion here is nginx(thttpd(cgit)).
|
|
|
|
systemd.services.cgit = {
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
2020-02-21 13:47:29 +01:00
|
|
|
script = "${depot.web.cgit-taz}/bin/cgit-launch";
|
2020-02-12 02:04:12 +01:00
|
|
|
|
|
|
|
serviceConfig = {
|
|
|
|
Restart = "on-failure";
|
|
|
|
User = "git";
|
|
|
|
Group = "git";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2020-02-12 02:08:27 +01:00
|
|
|
# Provision a TLS certificate outside of nginx to avoid
|
|
|
|
# nixpkgs#38144
|
2020-03-01 02:11:28 +01:00
|
|
|
security.acme = {
|
|
|
|
acceptTerms = true;
|
|
|
|
email = "mail@tazj.in";
|
|
|
|
|
|
|
|
certs."tazj.in" = {
|
|
|
|
user = "nginx";
|
|
|
|
group = "nginx";
|
|
|
|
webroot = "/var/lib/acme/acme-challenge";
|
|
|
|
extraDomains = {
|
|
|
|
"git.tazj.in" = null;
|
|
|
|
"www.tazj.in" = null;
|
|
|
|
|
|
|
|
# Local domains (for this machine only)
|
|
|
|
"camden.tazj.in" = null;
|
|
|
|
"git.camden.tazj.in" = null;
|
|
|
|
};
|
|
|
|
postRun = "systemctl reload nginx";
|
2020-02-14 12:49:04 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2020-02-21 16:35:51 +01:00
|
|
|
# Forward logs to Google Cloud Platform
|
|
|
|
services.journaldriver = {
|
|
|
|
enable = true;
|
|
|
|
logStream = "home";
|
|
|
|
googleCloudProject = "tazjins-infrastructure";
|
|
|
|
applicationCredentials = "/etc/gcp/key.json";
|
|
|
|
};
|
|
|
|
|
2020-02-11 20:32:21 +01:00
|
|
|
# serve my website
|
|
|
|
services.nginx = {
|
|
|
|
enable = true;
|
|
|
|
enableReload = true;
|
2020-04-04 03:38:51 +02:00
|
|
|
package = with nixpkgs; nginx.override {
|
|
|
|
modules = [ nginxModules.rtmp ];
|
|
|
|
};
|
2020-02-11 20:32:21 +01:00
|
|
|
|
2020-02-12 02:08:27 +01:00
|
|
|
recommendedTlsSettings = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
|
|
recommendedProxySettings = true;
|
2020-02-11 20:32:21 +01:00
|
|
|
|
2020-04-04 03:38:51 +02:00
|
|
|
|
|
|
|
appendConfig = ''
|
|
|
|
rtmp_auto_push on;
|
|
|
|
rtmp {
|
|
|
|
server {
|
|
|
|
listen 1935;
|
|
|
|
chunk_size 4000;
|
|
|
|
|
|
|
|
application tvl {
|
|
|
|
live on;
|
|
|
|
|
|
|
|
allow publish 88.98.195.213;
|
|
|
|
allow publish 10.0.1.0/24;
|
|
|
|
deny publish all;
|
|
|
|
|
|
|
|
allow play all;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
|
2020-02-11 20:32:21 +01:00
|
|
|
commonHttpConfig = ''
|
|
|
|
log_format json_combined escape=json
|
|
|
|
'{'
|
|
|
|
'"remote_addr":"$remote_addr",'
|
2020-02-21 17:10:08 +01:00
|
|
|
'"method":"$request_method",'
|
|
|
|
'"uri":"$request_uri",'
|
|
|
|
'"status":$status,'
|
2020-02-21 17:12:48 +01:00
|
|
|
'"request_size":$request_length,'
|
2020-02-21 17:10:08 +01:00
|
|
|
'"response_size":$body_bytes_sent,'
|
|
|
|
'"response_time":$request_time,'
|
|
|
|
'"referrer":"$http_referer",'
|
|
|
|
'"user_agent":"$http_user_agent"'
|
2020-02-11 20:32:21 +01:00
|
|
|
'}';
|
|
|
|
|
2020-02-21 17:01:54 +01:00
|
|
|
access_log syslog:server=unix:/dev/log,nohostname json_combined;
|
2020-02-11 20:32:21 +01:00
|
|
|
'';
|
|
|
|
|
|
|
|
virtualHosts.homepage = {
|
2020-02-14 13:00:12 +01:00
|
|
|
serverName = "tazj.in";
|
|
|
|
serverAliases = [ "camden.tazj.in" ];
|
2020-02-11 20:32:21 +01:00
|
|
|
default = true;
|
2020-02-14 12:49:04 +01:00
|
|
|
useACMEHost = "tazj.in";
|
2020-02-21 13:47:29 +01:00
|
|
|
root = depot.web.homepage;
|
2020-02-11 20:32:21 +01:00
|
|
|
addSSL = true;
|
|
|
|
|
|
|
|
extraConfig = ''
|
2020-02-21 13:47:29 +01:00
|
|
|
${depot.web.blog.oldRedirects}
|
2020-02-11 20:32:21 +01:00
|
|
|
|
2020-04-04 22:46:16 +02:00
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
|
|
|
2020-02-11 20:32:21 +01:00
|
|
|
location ~* \.(webp|woff2)$ {
|
|
|
|
add_header Cache-Control "public, max-age=31536000";
|
|
|
|
}
|
|
|
|
|
|
|
|
location /blog/ {
|
2020-02-21 13:47:29 +01:00
|
|
|
alias ${depot.web.blog.rendered}/;
|
2020-02-11 20:32:21 +01:00
|
|
|
|
|
|
|
if ($request_uri ~ ^/(.*)\.html$) {
|
|
|
|
return 302 /$1;
|
|
|
|
}
|
|
|
|
|
|
|
|
try_files $uri $uri.html $uri/ =404;
|
|
|
|
}
|
2020-02-11 21:54:50 +01:00
|
|
|
|
|
|
|
location /blobs/ {
|
|
|
|
alias /var/www/blobs/;
|
|
|
|
}
|
2020-02-11 20:32:21 +01:00
|
|
|
'';
|
|
|
|
};
|
2020-02-12 02:09:03 +01:00
|
|
|
|
|
|
|
virtualHosts.cgit = {
|
2020-02-14 12:49:04 +01:00
|
|
|
serverName = "git.tazj.in";
|
2020-02-14 13:00:12 +01:00
|
|
|
serverAliases = [ "git.camden.tazj.in" ];
|
2020-02-14 12:49:04 +01:00
|
|
|
useACMEHost = "tazj.in";
|
2020-02-12 02:09:03 +01:00
|
|
|
addSSL = true;
|
|
|
|
|
|
|
|
extraConfig = ''
|
|
|
|
# Static assets must always hit the root.
|
|
|
|
location ~ ^/(favicon\.ico|cgit\.(css|png))$ {
|
|
|
|
proxy_pass http://localhost:2448;
|
|
|
|
}
|
|
|
|
|
|
|
|
# Everything else hits the depot directly.
|
|
|
|
location / {
|
|
|
|
proxy_pass http://localhost:2448/cgit.cgi/depot/;
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
};
|
2020-02-11 20:32:21 +01:00
|
|
|
};
|
|
|
|
|
2020-02-11 16:41:00 +01:00
|
|
|
system.stateVersion = "19.09";
|
|
|
|
})
|