Koen/nix-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gonna deploy now

Browse source
This commit is contained in:
KoenDR06 2026-02-09 13:45:20 +01:00
parent c340cf4ff3
commit a6bff8a467
5 changed files with 54 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/containers/default.nix
View file

@ -1,10 +1,18 @@
{...}: { {lib, ...}: let
inherit (lib) mkOption types;
in {
imports = [ imports = [
./nginx.nix ./nginx.nix
./forgejo.nix ./forgejo.nix
./vaultwarden.nix ./vaultwarden.nix
]; ];
options = {
backupDir = mkOption {
type = types.str;
};
};
config = { config = {
networking.nat = { networking.nat = {
enable = true; enable = true;

5
modules/containers/forgejo.nix
View file

@ -10,8 +10,8 @@
cfg = config.horseman.containers.forgejo; cfg = config.horseman.containers.forgejo;
username = config.horseman.username; username = config.horseman.username;
BACKUP_DIR = config.horseman.containers.backupDir;
DATA_DIR = "/home/${username}/backups/volumes/forgejo"; DATA_DIR = "/home/${username}/backups/volumes/forgejo";
BACKUP_FILE = "/home/${username}/backups/forgejo.tar";
in { in {
options = { options = {
horseman.containers.forgejo = { horseman.containers.forgejo = {
@ -46,7 +46,8 @@ in {
environment.systemPackages = [pkgs.gnutar]; environment.systemPackages = [pkgs.gnutar];
systemd.services."backup-forgejo" = { systemd.services."backup-forgejo" = {
script = '' script = ''
${pkgs.gnutar}/bin/tar -cf ${BACKUP_FILE} ${DATA_DIR} cd ${BACKUP_DIR}
${pkgs.gnutar}/bin/tar -cf forgejo-$(date +'%Y-%m-%d').tar ${DATA_DIR}
''; '';
serviceConfig = { serviceConfig = {
User = "root"; User = "root";

53
modules/containers/nginx.nix
View file

@ -13,12 +13,15 @@ in {
options = { options = {
horseman.containers.nginx = { horseman.containers.nginx = {
enable = mkEnableOption "nginx container"; enable = mkEnableOption "nginx container";
domain = mkOption {
type = types.str;
default = "koendev.nl";
};
}; };
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
networking.extraHosts = "192.168.100.1 koendevLocal.nl public.koendevLocal.nl git.koendevLocal.nl vault.koendevLocal.nl";
containers.nginx = { containers.nginx = {
autoStart = true; autoStart = true;
privateNetwork = true; privateNetwork = true;
@ -27,11 +30,11 @@ in {
bindMounts = { bindMounts = {
"/var/www/portfolio" = { "/var/www/portfolio" = {
hostPath = "/home/horseman/Programming/portfolio/_site"; hostPath = "/var/www/portfolio";
isReadOnly = true; isReadOnly = true;
}; };
"/var/www/public" = { "/var/www/public" = {
hostPath = "/home/horseman/Public"; hostPath = "/var/www/public";
isReadOnly = true; isReadOnly = true;
}; };
}; };
@ -46,50 +49,40 @@ in {
enable = true; enable = true;
virtualHosts = { virtualHosts = {
"koendevLocal.nl" = { "${cfg.domain}" = {
# addSSL = false; forceSSL = true;
# enableACME = false; enableACME = true;
root = "/var/www/portfolio"; root = "/var/www/portfolio";
default = true; default = true;
extraConfig = '' extraConfig = ''
error_page 404 /404.html; error_page 404 /404.html;
''; '';
addSSL = true;
sslCertificate = "/var/www/portfolio/cert.pem";
sslCertificateKey = "/var/www/portfolio/key.pem";
}; };
"public.koendevLocal.nl" = { "public.${cfg.domain}" = {
forceSSL = true;
enableACME = true;
root = "/var/www/public"; root = "/var/www/public";
addSSL = true;
sslCertificate = "/var/www/portfolio/cert.pem";
sslCertificateKey = "/var/www/portfolio/key.pem";
}; };
"git.koendevLocal.nl" = { "git.${cfg.domain}" = {
# addSSL = false; forceSSL = true;
# enableACME = false; enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://${osConfig.containers.forgejo.localAddress}:${toString osConfig.horseman.containers.forgejo.port}"; proxyPass = "http://${osConfig.containers.forgejo.localAddress}:${toString osConfig.horseman.containers.forgejo.port}";
}; };
addSSL = true;
sslCertificate = "/var/www/portfolio/cert.pem";
sslCertificateKey = "/var/www/portfolio/key.pem";
}; };
"vault.koendevLocal.nl" = { "vault.${cfg.domain}" = {
# addSSL = false; forceSSL = true;
# enableACME = false; enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://${osConfig.containers.vaultwarden.localAddress}:${toString osConfig.horseman.containers.vaultwarden.port}"; proxyPass = "http://${osConfig.containers.vaultwarden.localAddress}:${toString osConfig.horseman.containers.vaultwarden.port}";
}; };
forceSSL = true;
sslCertificate = "/var/www/portfolio/cert.pem";
sslCertificateKey = "/var/www/portfolio/key.pem";
}; };
}; };
}; };

5
modules/containers/vaultwarden.nix
View file

@ -10,8 +10,8 @@
cfg = config.horseman.containers.vaultwarden; cfg = config.horseman.containers.vaultwarden;
username = config.horseman.username; username = config.horseman.username;
BACKUP_DIR = config.horseman.containers.backupDir;
DATA_DIR = "/home/${username}/backups/volumes/vaultwarden"; DATA_DIR = "/home/${username}/backups/volumes/vaultwarden";
BACKUP_FILE = "/home/${username}/backups/vaultwarden.tar";
in { in {
options = { options = {
horseman.containers.vaultwarden = { horseman.containers.vaultwarden = {
@ -41,7 +41,8 @@ in {
environment.systemPackages = [pkgs.gnutar]; environment.systemPackages = [pkgs.gnutar];
systemd.services."backup-vaultwarden" = { systemd.services."backup-vaultwarden" = {
script = '' script = ''
${pkgs.gnutar}/bin/tar -cf ${BACKUP_FILE} ${DATA_DIR} cd ${BACKUP_DIR}
${pkgs.gnutar}/bin/tar -cf vaultwarden-$(date +'%Y-%m-%d').tar ${DATA_DIR}
''; '';
serviceConfig = { serviceConfig = {
User = "root"; User = "root";

33
secrets/containers/forgejo-secret.age
View file

@ -1,19 +1,18 @@
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9tczZkdyAvNG9K YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9tczZkdyAvWjRI
UEttaC8zNHlPVDJFT1NoOHBBKzduaThIcFR3TkdvZVF3UVFBSFhvClpLZGw0RmVp VkpQNWpZNHdiZm9jVlZvcTYxS04wUk1hTWtmdWRXL2dydGwxc3pVCklSOWZYNThu
cm1JRkNwL2RKN0lKRlEyb25YeUpjSWx0WXorNWZIa2ZHMzgKLT4gc3NoLWVkMjU1 aVBSeDBwRldwTjVzT0VOaG9kNnV5SWJnT2M1YXVRSjUwUFkKLT4gc3NoLWVkMjU1
MTkgZ1BJZFpBIEUyeGlybExFS3dPWXZOdk41TG9GYWQzajFPeVh3MjBlcjQ2b3Bn MTkgZ1BJZFpBIExmTUxudEFaR21CQzg5ejlUaXRoQW5ORmVqcUlRd1o2L0pZbTd5
NkRiRXcKSzdORWN3NC9IQ2JCRTF3UVRRc1k4eW5uQ2tMZXo0UEczWk1IS3BDbEV4 UVBIeWcKZWVSV3k4bHZqV3pDaDMxYzBnZW9FL085TG14bkl0UlZoQ25CbW9iVENv
UQotPiBzc2gtZWQyNTUxOSBXeUlGekEgR0hhQitRZ2haZExXeVNlV0pBY0JkWTY0 RQotPiBzc2gtZWQyNTUxOSBXeUlGekEgY2Zkd0VaZmxRaVV4cXBlRnNHeDMyUFFV
S05PMnNmdVh5QUUyVmhjK1psNApMVWtDR0ZUNjBHNHdUbDVEdFI3SkU3TnhtbHN4 YVVzZlF2SXFjak5LREZINFRTMAp6dmFKOTd5eUMrczZ0WUU2T3hER3lkSHlTTGZj
L3hiYnlYdmx5L2VmU3NBCi0+IHNzaC1lZDI1NTE5IGRiT2VoQSBpK2h2YlFCTk9a U1k4ZVV1THJMK0RSd21zCi0+IHNzaC1lZDI1NTE5IGRiT2VoQSB0WkJpSkZHZ1BM
Z21YZS9tQk9iUDdCQmpYNE9RK0k1SGtCbzhDdG9wVUFrCmlrNjBRQk9lWHVRRHVJ QitLdG9SdDdjckxVa0dxQ2dmQlNGekVITlllN2R3OWxZCmt2Zk5VSjNTdnB4Z2ln
dnFsSmJsTmNnaFA3MUorYkFGTklkWk94TUk3dHMKLT4gc3NoLWVkMjU1MTkgdHYv TnExNytuZ2FtVE83NWZWcm1Fd25MS1NEL3JsbzgKLT4gc3NoLWVkMjU1MTkgdHYv
Q3pnIGRUb21iKzlKY3hzcUhqaEZlK2EraEFQTmN0Nm5SZ05jdG1ia0xlN2NoelkK Q3pnIFVDMU9Kbld0aHFia3FmTEs2aGF2THdaSk1Ec2h2WWlMVjZvUkNHTFpCR1EK
d0R5Z0sxa0VDMy9aUTFJSS9jRmdDOGk5ZWVVVjIwdzJ4MUI3clR2bVE5SQotPiBi NkR6R2JaZkZtbitBMmk1UjRFS3FFZ293bFhDUWxmR2M0ZHFoSVRGV2E1ZwotPiAn
NlJDOTpCWS1ncmVhc2UKR25PbzYrN2JsTXZwbXV5Z0NuUTZ0b2dTdU11Rlh6cmFL eCFtQ3htLWdyZWFzZQp4VFZWeTlDNWlsNDI5WWlPTzNGbQotLS0gRmZIdXk3UUVw
cDlVOUUxNFd3VWg2V1ltU1N5dXZBWVM5UGI4d3cKLS0tIC9qQ0ZZUnVQRkc5dHRX ZEJjOGdnVVdlWWN5Y0VxaUJORG0ycTBQdVFGVGw1RVpZdwqD8VD14PUaG2u0/h9o
L0xpOTFxRk4xdTRCdUEwclU1dzB5RkVZbFRVZlUKhXXapogUWYhZ+Baie7Alcv7Z 6VeX+m3nJkJgsXUkGPskTHHEc+1NaZ9MQM5dXzrmjfVHBT7N27bDcYlGG2RIfehC
hnMTGD+Wti8VhvHOmwS+z66mpbidJdNwcoiGOpeCfIJyKbQehQrzsI0wWbqjyA50 Xz5jRZwSTG58wzt9
PKWqT6dq3w==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----