mirror of
https://github.com/kmein/niveum
synced 2026-03-16 10:11:08 +01:00
Kierán Meinhardt
d03c6bb0de
feat(zaatar): convert to flake feat(tahina, tabula): convert to flake feat(makanek): convert to flake feat(manakish, zaatar): convert to flake feat(ci): build flake systems fix: ci build feat: secrets via submodule foo foo foo
116 lines
2.7 KiB
Nix
116 lines
2.7 KiB
Nix
{
|
||
lib,
|
||
config,
|
||
pkgs,
|
||
...
|
||
}: let
|
||
inherit (import ../../lib) kieran retiolumAddresses restic;
|
||
in {
|
||
imports = [
|
||
./gitea.nix
|
||
./hardware-configuration.nix
|
||
./hedgedoc.nix
|
||
./menstruation.nix
|
||
./moinbot.nix
|
||
./monitoring
|
||
./names.nix
|
||
./nextcloud.nix
|
||
./radio-news.nix
|
||
./radio.nix
|
||
./retiolum-map.nix
|
||
./tarot.nix
|
||
./tt-rss.nix
|
||
./urlwatch.nix
|
||
./weechat.nix
|
||
../../configs/monitoring.nix
|
||
../../configs/nix.nix
|
||
../../configs/save-space.nix
|
||
../../configs/retiolum.nix
|
||
../../configs/spacetime.nix
|
||
../../configs/sshd.nix
|
||
../../configs/telegram-bots
|
||
../../modules/passport.nix
|
||
];
|
||
|
||
services.restic.backups.niveum = {
|
||
initialize = true;
|
||
inherit (restic) repository;
|
||
timerConfig = {
|
||
OnCalendar = "daily";
|
||
RandomizedDelaySec = "1h";
|
||
};
|
||
passwordFile = config.age.secrets.restic.path;
|
||
paths = [
|
||
"/var/lib/codimd"
|
||
config.services.postgresqlBackup.location
|
||
"/var/lib/weechat"
|
||
"/var/lib/nextcloud"
|
||
"/var/lib/grafana"
|
||
"/var/lib/gitea"
|
||
"/var/lib/redis"
|
||
];
|
||
};
|
||
|
||
niveum.passport = {
|
||
enable = true;
|
||
introductionHTML = ''
|
||
<p>
|
||
The machine <tt>makanek</tt> is named after a Levantine type of <a href="https://en.wikipedia.org/wiki/Makanek">sausage</a> (مقانق <i>maqāniq</i>).
|
||
</p>
|
||
<p>
|
||
It runs on <a href="https://www.hetzner.com/cloud">Hetzner cloud</a>.
|
||
</p>
|
||
<figure>
|
||
<img width="200" src="https://www.albawaba.com/sites/default/files/2019-08/makanek-BeFunky-project.jpg" alt="Makanek sausages"/>
|
||
<figcaption>Makanek</figcaption>
|
||
</figure>
|
||
'';
|
||
virtualHost = "makanek.r";
|
||
|
||
services = [
|
||
{
|
||
title = "restic backup";
|
||
description = "This machine backups its state via restic backup.";
|
||
}
|
||
];
|
||
};
|
||
|
||
networking = {
|
||
firewall.allowedTCPPorts = [80 443];
|
||
hostName = "makanek";
|
||
interfaces.ens3.useDHCP = true;
|
||
retiolum = retiolumAddresses.makanek;
|
||
useDHCP = false;
|
||
};
|
||
|
||
age.secrets = {
|
||
retiolum-rsa.file = ../../secrets/makanek-retiolum-privateKey-rsa.age;
|
||
retiolum-ed25519.file = ../../secrets/makanek-retiolum-privateKey-ed25519.age;
|
||
restic.file = ../../secrets/restic.age;
|
||
};
|
||
|
||
system.stateVersion = "20.03";
|
||
|
||
services.nginx = {
|
||
enable = true;
|
||
recommendedGzipSettings = true;
|
||
recommendedOptimisation = true;
|
||
recommendedProxySettings = true;
|
||
recommendedTlsSettings = true;
|
||
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
||
};
|
||
|
||
security.acme = {
|
||
acceptTerms = true;
|
||
defaults.email = kieran.email;
|
||
};
|
||
|
||
environment.systemPackages = [
|
||
pkgs.vim
|
||
pkgs.git
|
||
pkgs.tmux
|
||
pkgs.python3
|
||
pkgs.nix-output-monitor
|
||
];
|
||
}
|