diff --git a/flake.nix b/flake.nix index c43e8c8..5486e20 100644 --- a/flake.nix +++ b/flake.nix @@ -44,31 +44,35 @@ , system ? "x86_64-linux", minimal ? false }: nixpkgs-unstable.lib.nixosSystem { inherit system; - modules = modules ++ [ ./modules agenix.nixosModules.default ] - ++ (if !minimal then [ - ({ outputs, ... }: { - nixpkgs.overlays = with outputs.overlays; [ - additions - modifications - unstable-packages - nur.overlay - ]; - # stylix compains if image is not set... - stylix.autoEnable = true; - stylix.image = ./yuyukowallpaper1809.png; - }) - home-manager-unstable.nixosModules.home-manager - nixos-cosmic.nixosModules.default - stylix.nixosModules.stylix - #todo: check how to actually do this - ./modules/graphical/stylix.nix - ./modules/graphical/cosmic.nix - ] else - [ ]); + modules = modules ++ [ + ./modules + agenix.nixosModules.default + ({ outputs, ... }: { + nixpkgs.overlays = with outputs.overlays; [ + additions + modifications + unstable-packages + ]; + }) + ] ++ (if !minimal then [ + ({ ... }: { + # stylix compains if image is not set... + stylix.autoEnable = true; + stylix.image = ./yuyukowallpaper1809.png; + }) + home-manager-unstable.nixosModules.home-manager + nixos-cosmic.nixosModules.default + stylix.nixosModules.stylix + #todo: check how to actually do this + ./modules/graphical/stylix.nix + ./modules/graphical/cosmic.nix + ] else + [ ]); specialArgs = specialArgs // { inherit inputs outputs; }; }; in flake-utils.lib.eachDefaultSystem (system: { - packages = import ./pkgs { pkgs = nixpkgs-unstable.legacyPackages.${system}; }; + packages = + import ./pkgs { pkgs = nixpkgs-unstable.legacyPackages.${system}; }; }) // { overlays = import ./overlays.nix { inherit inputs; }; @@ -141,7 +145,7 @@ ]; }; #initial install done with nix run github:nix-community/nixos-anywhere/73a6d3fef4c5b4ab9e4ac868f468ec8f9436afa7 -- --flake .#adam-site root@ - #build with nixos-rebuild switch --flake .#adam-site --target-host "root@" + #update with nixos-rebuild switch --flake .#adam-site --target-host "root@" "adam-site" = mkHost { minimal = true; system = "aarch64-linux"; diff --git a/modules/services/adam-site.nix b/modules/services/adam-site.nix new file mode 100644 index 0000000..49d02c1 --- /dev/null +++ b/modules/services/adam-site.nix @@ -0,0 +1,46 @@ + +{ config, pkgs, lib, inputs, ... }: +with lib; +let cfg = config.custom.services.adam-site; +in { + options.custom.services.adam-site = { + enable = mkEnableOption "Enables adams website"; + }; + config = lib.mkIf cfg.enable { + systemd.services.adam-site = { + description = "Adams Website"; + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + preStart = '' + if [ ! -d "$STATE_DIRECTORY/data" ]; then + mkdir -p "$STATE_DIRECTORY/data" + chmod 700 "$STATE_DIRECTORY/data" + fi + ''; + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.nodejs_20}/bin/node ${pkgs.adam-site}/server/server.mjs"; + DynamicUser = true; + StateDirectory = "adam-site"; + WorkingDirectory = "/var/lib/private/adam-site"; + Restart = "on-failure"; + RestartSec = "5s"; + PrivateMounts = mkDefault true; + PrivateTmp = mkDefault true; + PrivateUsers = mkDefault true; + ProtectClock = mkDefault true; + ProtectControlGroups = mkDefault true; + ProtectHome = mkDefault true; + ProtectHostname = mkDefault true; + ProtectKernelLogs = mkDefault true; + ProtectKernelModules = mkDefault true; + ProtectKernelTunables = mkDefault true; + ProtectSystem = mkDefault "strict"; + # Needs network access + PrivateNetwork = mkDefault false; + }; + + }; + }; +} diff --git a/modules/services/default.nix b/modules/services/default.nix index bdc414a..cea531a 100644 --- a/modules/services/default.nix +++ b/modules/services/default.nix @@ -11,5 +11,6 @@ ./fileshelter.nix ./wireguard.nix ./kop-monitor.nix + ./adam-site.nix ]; } diff --git a/pkgs/adam-site/default.nix b/pkgs/adam-site/default.nix index 0355249..0c3ce0b 100644 --- a/pkgs/adam-site/default.nix +++ b/pkgs/adam-site/default.nix @@ -6,7 +6,7 @@ buildNpmPackage rec { src = fetchGit { url = "git@github.com:oberprofis/adams.git"; ref = "main"; - rev = "0d1d5003bd5681c5dbe2ad12ed1ef7e56bb4c197"; + rev = "4f5ef5db79878e0bc244b71a979bb14e6b6177d6"; }; npmDepsHash="sha256-ndpuIqMAitnx0rswYD60l5JhDMdaKH77Qdu7zNgwj/o="; installPhase = '' diff --git a/systems/adam-site/configuration.nix b/systems/adam-site/configuration.nix index 99469a8..7879425 100644 --- a/systems/adam-site/configuration.nix +++ b/systems/adam-site/configuration.nix @@ -4,39 +4,21 @@ (modulesPath + "/profiles/qemu-guest.nix") ./disk-config.nix ]; - boot.loader.grub = { - efiSupport = true; - efiInstallAsRemovable = true; - }; + services.openssh.enable = true; networking.firewall.allowedTCPPorts = [ 22 80 443 ]; custom = { - services.acme.enable = true; + services = { + acme.enable = true; + adam-site.enable = true; + }; nftables.enable = true; nix = { settings.enable = true; }; }; - environment.systemPackages = map lib.lowPrio [ pkgs.curl pkgs.gitMinimal ]; - - users.users.root.openssh.authorizedKeys.keys = [ - # change this to your ssh key - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeP6qtVqE/gu72ZUZE8cdRi3INiUW9NqDR7SjXIzTw2" - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMypKJQvn68s8iNk9J9zghFlW4nrd03FwqfvGQ9sAmWojXe6pKrkat++8grIfB60aiIwNjHeXigVdZrpIb0QiR7+maPLPtxySTmgD7GeyAbwJrAymgKAzJcQvq5tKHtjH60KhLe4QzGXXpjoGIhl/8FhepRT6306JE8OfMwBUwOa3wcEdeJ7eK4JZdELCne3Gj16eWHy8iNIQswNtvJ70M7RACyDJARuazde3zFqkRYCP9Rqinegg/DVd+ykC2qHqM/yCersCOGn+I3hPCS1tz/AhDTQ7T9A7j5CLjv6ZbRS+B7a7u7z5qOAla468sELaiAEo2+fovlh8kib5zzWM2pK3rSEfUzFVGAAfHtrdR8pYynl3DBNC5XGzDT8xqa4B/qJIRoPmr8CMroLBOGGZQm9TJbmhfl8vT96RUwOA6qUmLQl6b0qJRRMkvlgCvKZyZ3d6pPfizQigTn1evBveqO9dgGcCAyAi0Ob6JZisTWUn5nAqe7CR1h2EKC0lqdCc=" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKJTpEPKK38MQHcLHkJ6TCqrhSQ9B2ruVx6ONRVQYJC6" - ]; - - system.stateVersion = "23.11"; - - systemd.tmpfiles.rules = [ - "d /data 0770 github-actions-runner nginx -" - "d /data/website 0770 github-actions-runner nginx -" - ]; - - services.nginx = { enable = true; - # Use recommended settings recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; @@ -46,14 +28,23 @@ sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; virtualHosts = { - #discord bot for tracking useractivity public version "imbissaggsbachdorf.at" = { forceSSL = true; enableACME = true; - locations."/".extraConfig = '' - return 200 "Hello, world!"; - ''; + locations."/".proxyPass = "http://127.0.0.1:4000"; }; }; }; + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeP6qtVqE/gu72ZUZE8cdRi3INiUW9NqDR7SjXIzTw2" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMypKJQvn68s8iNk9J9zghFlW4nrd03FwqfvGQ9sAmWojXe6pKrkat++8grIfB60aiIwNjHeXigVdZrpIb0QiR7+maPLPtxySTmgD7GeyAbwJrAymgKAzJcQvq5tKHtjH60KhLe4QzGXXpjoGIhl/8FhepRT6306JE8OfMwBUwOa3wcEdeJ7eK4JZdELCne3Gj16eWHy8iNIQswNtvJ70M7RACyDJARuazde3zFqkRYCP9Rqinegg/DVd+ykC2qHqM/yCersCOGn+I3hPCS1tz/AhDTQ7T9A7j5CLjv6ZbRS+B7a7u7z5qOAla468sELaiAEo2+fovlh8kib5zzWM2pK3rSEfUzFVGAAfHtrdR8pYynl3DBNC5XGzDT8xqa4B/qJIRoPmr8CMroLBOGGZQm9TJbmhfl8vT96RUwOA6qUmLQl6b0qJRRMkvlgCvKZyZ3d6pPfizQigTn1evBveqO9dgGcCAyAi0Ob6JZisTWUn5nAqe7CR1h2EKC0lqdCc=" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKJTpEPKK38MQHcLHkJ6TCqrhSQ9B2ruVx6ONRVQYJC6" + ]; + environment.systemPackages = map lib.lowPrio [ pkgs.curl pkgs.gitMinimal ]; + boot.loader.grub = { + efiSupport = true; + efiInstallAsRemovable = true; + }; + system.stateVersion = "23.11"; } diff --git a/systems/vm/configuration.nix b/systems/vm/configuration.nix index 1559c80..8a1dae4 100644 --- a/systems/vm/configuration.nix +++ b/systems/vm/configuration.nix @@ -1,5 +1,4 @@ -{pkgs, config, ...}: -{ +{ pkgs, config, ... }: { age.identityPaths = [ /home/kopatz/.ssh/id_rsa ]; mainUser.layout = "de"; @@ -16,8 +15,19 @@ ld.enable = true; settings.enable = true; }; - graphical = { - lxqt.enable = true; + services = { adam-site.enable = true; }; + graphical = { lxqt.enable = true; }; + }; + + environment.systemPackages = [ pkgs.firefox ]; + services.nginx = { + enable = true; + virtualHosts = { + "localhost" = { + forceSSL = false; + enableACME = false; + locations."/".proxyPass = "http://127.0.0.1:4000"; + }; }; }; }