mikael/nixfiles-emily
1
0
Fork 0
forked from emily/nixfiles
Code Pull requests Activity

added fernglas

Browse source
This commit is contained in:
emily 2024-01-09 17:02:32 +01:00
parent f331ef5ed9
commit 3b30956d9e
Signed by untrusted user: emily
GPG key ID: F6F4C66207FCF995
2 changed files with 22 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
config/hosts/web02/configuration.nix
View file

@ -1,5 +1,6 @@
{ config, pkgs, lib, ... }: { config, inputs, pkgs, lib, ... }:
let let
bmpPort = 11019;
extraConfig = '' extraConfig = ''
add_header Strict-Transport-Security $hsts_header; add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
@ -17,7 +18,7 @@ let
in { in {
networking = { networking = {
hostName = "web02"; hostName = "web02";
firewall.allowedTCPPorts = [ 80 443 ]; firewall.allowedTCPPorts = [ 80 443 bmpPort ];
firewall.allowedUDPPorts = [ 443 ]; firewall.allowedUDPPorts = [ 443 ];
}; };
systemd.network.networks."98-eth-default" = { systemd.network.networks."98-eth-default" = {
@ -32,23 +33,22 @@ in {
group = "lg"; group = "lg";
}; };
users.groups."lg" = {}; users.groups."lg" = {};
services.phpfpm.pools."lg" = {
user = "lg";
settings = {
"listen.owner" = config.services.nginx.user;
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.max_requests" = 500;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 5;
"php_admin_value[error_log]" = "stderr";
"php_admin_flag[log_errors]" = true;
"catch_workers_output" = true;
};
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
};
services.vnstat.enable = true; services.vnstat.enable = true;
services.fernglas = {
enable = true;
settings = {
api.bind = "[::1]:3000";
collectors = {
bmp_collector = {
collector_type = "Bmp";
bind = "[::]:${toString bmpPort}";
peers = {
"45.150.123.0" = {};
};
};
};
};
};
services.nginx = { services.nginx = {
package = pkgs.nginxQuic; package = pkgs.nginxQuic;
enable = true; enable = true;
@ -106,19 +106,9 @@ in {
}; };
}; };
"lg.kyouma.net" = { "lg.kyouma.net" = {
root = "/var/www/lg.kyouma.net";
useACMEHost = "kyouma.net"; useACMEHost = "kyouma.net";
locations."/".tryFiles = "$uri /$uri /index.php$is_args$args"; locations."/".root = inputs.fernglas.packages.${config.nixpkgs.hostPlatform.system}.fernglas-frontend;
locations."~ \\.php$".extraConfig = '' locations."/api/".proxyPass = "http://${config.services.fernglas.settings.api.bind}";
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:${config.services.phpfpm.pools.lg.socket};
fastcgi_index index.php;
fastcgi_buffering on;
fastcgi_buffer_size 1k;
fastcgi_buffers 128 1k;
include ${pkgs.nginxQuic}/conf/fastcgi_params;
include ${pkgs.nginxQuic}/conf/fastcgi.conf;
'';
}; };
}; };
}; };

2
flake.nix
View file

@ -3,6 +3,7 @@
inputs = { inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
nixos-hardware.url = "github:nixos/nixos-hardware"; nixos-hardware.url = "github:nixos/nixos-hardware";
fernglas.url = "github:wobcom/fernglas";
}; };
outputs = { self, nixpkgs, nixos-hardware, ... }@attrs: { outputs = { self, nixpkgs, nixos-hardware, ... }@attrs: {
@ -11,6 +12,7 @@
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = attrs; specialArgs = attrs;
modules = [ modules = [
fernglas.nixosModules.default
./config/common ./config/common
./config/lxc.nix ./config/lxc.nix
./config/hosts/web02/configuration.nix ./config/hosts/web02/configuration.nix