diff options
Diffstat (limited to '')
| -rw-r--r-- | hosts/by-name/server2/configuration.nix | 140 | ||||
| -rw-r--r-- | hosts/by-name/server2/secrets/grafana/adminPassword.age | 17 | ||||
| -rw-r--r-- | hosts/by-name/server2/secrets/grafana/secretKey.age | 18 | ||||
| -rw-r--r-- | hosts/by-name/server2/secrets/nextcloud/adminpassFile.age | 14 |
4 files changed, 181 insertions, 8 deletions
diff --git a/hosts/by-name/server2/configuration.nix b/hosts/by-name/server2/configuration.nix index c373d28..26f4e61 100644 --- a/hosts/by-name/server2/configuration.nix +++ b/hosts/by-name/server2/configuration.nix @@ -1,4 +1,8 @@ -{config, ...}: { +{ + lib, + pkgs, + ... +}: { imports = [ ./networking.nix # network configuration that just works ./hardware.nix @@ -12,13 +16,9 @@ }; vhack = { - back = { + atuin-sync = { enable = true; - domain = "issues.foss-syndicate.org"; - settings = { - scan_path = "${config.services.gitolite.dataDir}/repositories"; - project_list = "${config.services.gitolite.dataDir}/projects.list"; - }; + fqdn = "atuin-sync.vhack.eu"; }; backup = { enable = true; @@ -26,6 +26,30 @@ privatePassword = ./secrets/backup/backuppass.age; user = "u384702-sub3"; }; + + monitoring = { + enable = true; + prometheus = { + remoteWriteReceiver = "prometheus-server2.vhack.eu"; + }; + grafana = { + fqdn = "grafana.vhack.eu"; + + contactPoints = ["admin@vhack.eu"]; + adminPassword = ./secrets/grafana/adminPassword.age; + secretKey = ./secrets/grafana/secretKey.age; + }; + }; + + dns = { + enable = true; + openFirewall = true; + interfaces = [ + "185.16.61.132" + "2a03:4000:a:106::1" + ]; + zones = import ../../../zones {inherit lib;}; + }; etesync = { enable = true; secretFile = ./secrets/etesync/secret_file.age; @@ -47,7 +71,83 @@ mail = { enable = true; fqdn = "mail.foss-syndicate.org"; + + domains = [ + "vhack.eu" + + "s-schoeffel.de" + "b-peetz.de" + + "sils.li" + "nightingale.sils.li" + "sils.sils.li" + + "jaki.li" + ]; + + accounts = { + "sils@vhack.eu" = { + hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm"; + }; + "soispha@vhack.eu" = { + hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW"; + aliases = [ + "abuse@vhack.eu" + "admin@vhack.eu" + "postmaster@vhack.eu" + ]; + }; + + "soispha@b-peetz.de" = { + hashedPassword = "$y$j9T$asnEgvMxJrbeabfyp1AOe/$0dJ0/Rta57V8nHCLVGOHrXsXeEhBCaKx/HTuPHXZj04"; + }; + "benedikt.peetz@b-peetz.de" = { + hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy"; + aliases = ["@b-peetz.de"]; + }; + "silas.schoeffel@s-schoeffel.de" = { + hashedPassword = "$2b$05$Qb8rl7ncpCcTbsSdsduJBuOITp8RTD6sfOTjuxJsVtD9vjAYY9n8e"; + aliases = ["@s-schoeffel.de"]; + }; + + "nightingale@vhack.eu" = { + hashedPassword = "$2b$05$nDKVVq1EktKXWqGFhnOLP.plLovXFyvWSuptK9GIkxA5DScKFx6YS"; + aliases = [ + "@nightingale.sils.li" + ]; + }; + "sils@sils.li" = { + hashedPassword = "$2b$05$Ebzh2ZhuWkz1p4tqJ172IejNZg10FtCxPDY4k6umYrpirXg7ezIRq"; + aliases = [ + "@sils.sils.li" + "@sils.li" + ]; + }; + "mail@jaki.li" = { + hashedPassword = "$y$j9T$jaG/lkAOfYXUNiJt11DoE.$ZKTeev6b5TCBEXZzNLH12hOmy5mL.Fitp0V6saWXR73"; + aliases = [ + "postmaster@jaki.li" + "abuse@jaki.li" + "admin@jaki.li" + ]; + }; + + # Mail-Account used by hosted software + "mastodon@vhack.eu" = { + hashedPassword = "$2b$05$pSby3x2p3cHg0FyAE8IiJ.nYUqtAIR10JA8HNpHwMAiLXqc.ltSK."; + }; + "peertube@vhack.eu" = { + hashedPassword = "$y$j9T$hyWQ8Awd2Xrc6qsK.2hwE1$LxACfaeW.yHGbkQL95dWtID9.zXL/aMwT6lp.yU/0g0"; + }; + }; }; + nextcloud = { + enable = true; + package = pkgs.nextcloud33; + hostname = "nextcloud.vhack.eu"; + adminpassFile = ./secrets/nextcloud/adminpassFile.age; + }; + nginx = { enable = true; redirects = { @@ -63,8 +163,32 @@ "/var/log" ]; }; - redlib.enable = true; + redlib.enable = false; rust-motd.enable = true; + sharkey = { + enable = true; + fqdn = "sharkey.vhack.eu"; + settings = { + id = "aidx"; + + maxNoteLength = 8192; + maxFileSize = 1024 * 1024 * 1024; + proxyRemoteFiles = true; + + # > At the suggestion of Sharkey maintainers, + # > this allows the server to run multiple workers + # > and without this (and postgres tuning), the instance runs slowly. + # Copied from: https://github.com/sodiboo/system/blob/b63c7b27f49043e8701b3ff5e1441cd27d5a2fff/sharkey.mod.nix#L21-L23 + clusterLimit = 3; + + signToActivityPubGet = true; + CheckActivityPubGetSigned = false; + }; + }; + taskchampion-sync = { + enable = true; + fqdn = "taskchampion.vhack.eu"; + }; users.enable = true; }; diff --git a/hosts/by-name/server2/secrets/grafana/adminPassword.age b/hosts/by-name/server2/secrets/grafana/adminPassword.age new file mode 100644 index 0000000..ff072fc --- /dev/null +++ b/hosts/by-name/server2/secrets/grafana/adminPassword.age @@ -0,0 +1,17 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bi9zRm5RRmU0YjJ4N3pi +S2lNNGZRNUpycnUrZ3VRdFBsdkdIRjVTakRFCkxtVG1VbUFTbHpBZlYxV2pMSU5p +a0lRcGVPWUUwMWpKdm5oYktWRklyWEUKLT4gWDI1NTE5IHNzN2NXRWYxdjladFF6 +ejk4eW43eUFsSStIV3FpWVJZREhLVEpjRkkvWFkKdlZtOG5pbDVvd0hwUEdMZnVn +WFAvYWJDUEVBckc3M3NVQUdvdFVqNDB0QQotPiBzc2gtZWQyNTUxOSBYUG94RFEg +RkpweWRJQklNUHVRWUhicXdDUVc3cXhyRi9KOS9wYWxDYnNNcjIzWmhERQpZZnpr +eHRWbnI0cFd1T3h3TTVGZ1JiUzUrNUpSNkUwM2UyWTVYZ2VHVHBnCi0+IC5eKT0+ +eS1ncmVhc2Ugc0YvI25zZyAub3YgPDNtbmsKejExd2NBV0E2Q1pLSVhyQTRLaWZ6 +dmZSZHhidjBqeW10RnIxNStVTGIyY1RMS25xaUlxRDVxMlpKQQotLS0gc3BER0to +dGdicEd3d1QzWWdoTmpkM1V5L0VvVG82cnNGY0hJTWUwVVBmTQpRQwKmFmQj10Z1 +AXllRSWcTSCzcM7fCVjCRcTF2lsxtXiXUkTS59yfNih02myuYCFIUG/MDl3A3pur +WckFpQVHTdvQ9ilYORI/zi9LTmPy8TZYYcdmXnNRelfZ3fAqiR8ScIEG3P0smNyP +9h6BcfiWYG2ppANLOeZxHz/UoG/LORXJyXoTCuiG8KJ714jX8f3CMX3+m9q/GmAX +VZiYvvbGgrN5T5QrZE+8quRM1laAXmnmbDynODfhNFNw4/I0Opi0CF5MSObmvzKN +z6vsc/kTGMqbip6k/LKvzea+jXMc8b8BeO0Y +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server2/secrets/grafana/secretKey.age b/hosts/by-name/server2/secrets/grafana/secretKey.age new file mode 100644 index 0000000..bfe4afe --- /dev/null +++ b/hosts/by-name/server2/secrets/grafana/secretKey.age @@ -0,0 +1,18 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsYlhkcFdwL2NDUllGVko3 +bTEwVE00MjRoZUpXMGFWZFFSMXNBUkpFRVU4CkJwSU5RUnlITnRSZklVZjNBN3Ix +NDdUS0ZpWVNBWEY3MVZYVlBkZkM3VlUKLT4gWDI1NTE5IHdsSm55NCtIT0Z4cUhx +dE9pM0RmSHUrUGZTYXhuQlM4TGVKcm5MWGZNekkKQXZmZ05JVmZYdzJIYlN5WmxV +Zlh0TWlxWWZucldweHpjdFM5TGJKZnprOAotPiBzc2gtZWQyNTUxOSBYUG94RFEg +SjVTVXVJRjQrc0RIenVIVmNmZEtQS1lWbVNhSzY5QjJXRUxNY1JvVGdIOAo5V0Y5 +SGhTRlZUcFE3eU1iazBwYzh0Q2UxTnA2UTJQQ2VhaW1INnBGTTQwCi0+IGdeazN5 +ZmstZ3JlYXNlIGpZSGUgTUYja2N5RCAhICNaeT8KVnFRWjJXQ1lMekJQZG5jbGk4 +KzB5YVVmMGRFT1pUZzF3dkJBby94NXZjbkFOYlQ1dy9VWUFnaVRlTHpkUXdZaQox +R1BMN3RjVXFwbitqU1pETzdlc0VqOFZhbVBrRlFiOWl3TWZkNzlCSS9kNkhBVUcw +Zk5UbFRrZXhWQ2QrZwotLS0gbFV3MXRoYjZ4QVo0UU9iMmpGVllNcDdJZFQvUEFR +UXpWYmptWmdWSllLVQrTggsrW+giXmbRL6Jq3VqT8uXhqHs5ZTCnPQSpKth04fzr +mNLKMIi2kRJm3hJCaSPBrLpDuop+08hjGe0l0CxvuRlnFUOZkh+C/kFWOI3ecaWt +TYVDkKNLXjrhyfw/rVHy03czluQncFYHFKib8djDqYTUa0ORj+M5cIgAzWODyCWB +IGftRRjhDMHhQzq0GRwwu6jNA+ovT1cN1aMmafQFmqTR7BqO18HqKsGdtirFLV3o +qrvHjqz1cJNKYEU89ogLJydTJHyuPhuPeHBl +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age b/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age new file mode 100644 index 0000000..2b831f3 --- /dev/null +++ b/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age @@ -0,0 +1,14 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxanRqM3pOT29DWitxUERF +RjRURVZUWGpOSzFoZVpCSzJIN0RGZDAzWEZzCkczaExmOGgxQUQwV2NleUdHMXBB +eTZLZXpGZE1hcXBhWWhVcEQ5OFBQWUkKLT4gWDI1NTE5IG5DVmlEaDhTWk9xaWs2 +TnF1K1ZtK2UyeDgvOEFlbVUzc0V1VnZoSmFobEkKczNrSGdwZEVxVFNES3dzcVgy +SmRYNS9WR29mNGNCQW84bHZsZzNTRGZCQQotPiBzc2gtZWQyNTUxOSBYUG94RFEg +Y2ZQd25odWRRbUdqM3gxMzBrQ1Y3UjRwQ0JsRldtblRaYnVKWHZud2p5awpZdkNm +bk82RVVId2tsOXlKb2psa25pNFpManN4bjQwblBWUWdGaWxxQ1B3Ci0+ICNqaTBs +KE8tZ3JlYXNlIE1KZGEgNzAKSGNMSlRGTzN5d3ZXcFZNTkxlZHprVlVQTzJ4K2Vp +MG1YMTFHRmV6L2tMMGUKLS0tIE44WHBBZk1qcmRnK2lPczdiQ294SW50UFdrUHUw +d0EreHNod29LL2pjd2cKw1rpd83gONZaOiV5lQ+QOtIZzoIkaOvRD/8avsbeFsP7 +AB/jiOfOwYJ0DVbNMjopwnzpcAFsLWs6Gg0wQhjNsl349TIcTAS0xLTJYTm8DwQy +FmzftPMHAuJ/IPGzb3hQOFqpuFAPkunfiOgZ/N7N/+LLNMC5NxkkSH8m8gDBCCk= +-----END AGE ENCRYPTED FILE----- |