hosts/losurdo/sourcehut.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config.services) sourcehut;
   4   inherit (config.users) users groups;
   5   inherit (config.security) gnupg;
   6   domain = "sourcephile.wg";
   7   sourcehut-services = [
   8     "builds"
   9     "dispatch"
  10     "git"
  11     "hg"
  12     "hub"
  13     "lists"
  14     "meta"
  15     "man"
  16     "paste"
  17     "todo"
  18   ];
  19 in
  20 {
  21 #boot.isContainer = true;
  22 #networking.firewall.allowedTCPPorts = [ 80 ];
  23 networking.hosts = {
  24   "192.168.42.2" = [domain] ++ map (d: "${d}.${domain}") sourcehut-services;
  25 };
  26 networking.nftables.ruleset = ''
  27   add rule inet filter fw2net meta skuid ${sourcehut.meta.user} tcp dport 25 counter accept comment "SMTP"
  28 '';
  29 security.gnupg.secrets = lib.genAttrs [
  30     "sourcehut/network-key"
  31     "sourcehut/service-key"
  32     "sourcehut/webhook-key"
  33     "sourcehut/oauth-client-secret"
  34   ] (p: {
  35   systemdConfig.before = [ "metasrht.service" ];
  36   systemdConfig.wantedBy = [ "metasrht.service" ];
  37 });
  38 services.minio = {
  39   enable = true;
  40   accessKey = "12345";
  41   secretKey = "12345678";
  42   #region = "";
  43   browser = true;
  44 };
  45 environment.systemPackages = [ pkgs.minio-client ];
  46 services.sourcehut = {
  47   enable = true;
  48   listenAddress = domain;
  49   /*
  50   builds = {
  51     enableWorker = true;
  52   };
  53   */
  54   #dispatch.enable = true;
  55   git.enable = true;
  56   #hub.enable = true;
  57   meta.enable = true;
  58   #man.enable = true;
  59   pages.enable = true;
  60   #paste.enable = true;
  61   #todo.enable = true;
  62   #lists.enable = true;
  63
  64   postgresql.enable = true;
  65   postfix.enable = true;
  66   redis.enable = true;
  67   #redis.firstDatabase = 0;
  68   nginx.enable = true;
  69   settings = {
  70     "sr.ht" = {
  71       environment = "production";
  72       global-domain = domain;
  73       origin = "http://${domain}";
  74       owner-email = "julm+srht@sourcephile.fr";
  75       owner-name = "Sourcephile";
  76       site-blurb = "software forge";
  77       site-info = "http://${domain}";
  78       site-name = "Sourcephile";
  79       # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen network
  80       network-key = gnupg.secrets."sourcehut/network-key".path;
  81       # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen service
  82       service-key = gnupg.secrets."sourcehut/service-key".path;
  83     };
  84     objects = {
  85       s3-upstream = "localhost";
  86       s3-access-key = "12345";
  87       s3-secret-key = pkgs.writeText "s3-secret-key" "12345678";
  88     };
  89     # nix shell nixpkgs#sourcehut.metasrht -c metasrht-manageuser -t admin -e mymail@gmail.com misuzu
  90     "builds.sr.ht" = {
  91       origin = "http://builds.${domain}";
  92       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
  93       oauth-client-id = "299db9f9c2013170";
  94     };
  95     "dispatch.sr.ht" = {
  96       origin = "http://dispatch.${domain}";
  97       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
  98       oauth-client-id = "299db9f9c2013170";
  99     };
 100     "pages.sr.ht" = {
 101       origin = "http://pages.${domain}";
 102       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 103       oauth-client-id = "299db9f9c2013170";
 104       s3-bucket = "pagesbuck";
 105     };
 106     "paste.sr.ht" = {
 107       origin = "http://paste.${domain}";
 108       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 109       oauth-client-id = "299db9f9c2013170";
 110     };
 111     "man.sr.ht" = {
 112       origin = "http://man.${domain}";
 113       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 114       oauth-client-id = "299db9f9c2013170";
 115     };
 116     "meta.sr.ht" = {
 117       origin = "http://meta.${domain}";
 118       api-origin = "http://meta.${domain}:5100";
 119     };
 120     "meta.sr.ht::settings" = {
 121       onboarding-redirect = "http://meta.${domain}";
 122       registration = true;
 123       internal-ipnet = "127.0.0.0/8,192.168.42.0/24";
 124     };
 125     "meta.sr.ht::api" = {
 126       internal-ipnet= [ "127.0.0.0/8" "::1/128" "192.168.0.0/16" "10.0.0.0/8"];
 127     };
 128     "todo.sr.ht" = {
 129       origin = "http://todo.${domain}";
 130       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 131       oauth-client-id = "299db9f9c2013170";
 132     };
 133     "git.sr.ht" = {
 134       origin = "http://git.${domain}";
 135       outgoing-domain = "http://git.${domain}";
 136       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 137       oauth-client-id = "299db9f9c2013170";
 138     };
 139     "hub.sr.ht" = {
 140       origin = "http://hub.${domain}";
 141       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 142       oauth-client-id = "299db9f9c2013170";
 143     };
 144     "lists.sr.ht" = {
 145       origin = "http://lists.${domain}";
 146       oauth-client-secret = gnupg.secrets."sourcehut/oauth-client-secret".path;
 147       oauth-client-id = "299db9f9c2013170";
 148     };
 149     "lists.sr.ht::worker" = {
 150       #sock = "/var/lib/postfix/queue/private/srht-lmtp";
 151     };
 152     # nix shell nixpkgs#sourcehut.coresrht -c srht-keygen webhook
 153     #webhooks.private-key= "U7yd/8mGs/v0O3kId4jpeSghUCa9tqP1fYQwSV8UOqo=";
 154     webhooks.private-key = gnupg.secrets."sourcehut/webhook-key".path;
 155     mail = {
 156       smtp-host = "localhost";
 157       smtp-port = 25;
 158       smtp-user = null;
 159       smtp-password = null;
 160       smtp-from = "sourcehut@sourcephile.fr";
 161       error-to = "julm+sourcehut+error@sourcephile.fr";
 162       error-from = "sourcehut+error@sourcephile.fr";
 163       pgp-privkey = null;
 164       pgp-pubkey = null;
 165       pgp-key-id = null;
 166     };
 167   };
 168 };
 169 services.nginx.virtualHosts = {
 170   "builds.${domain}".forceSSL = lib.mkForce false;
 171   "dispatch.${domain}".forceSSL = lib.mkForce false;
 172   "git.${domain}".forceSSL = lib.mkForce false;
 173   "hub.${domain}".forceSSL = lib.mkForce false;
 174   "lists.${domain}".forceSSL = lib.mkForce false;
 175   "logs.${domain}".forceSSL = lib.mkForce false;
 176   "man.${domain}".forceSSL = lib.mkForce false;
 177   "paste.${domain}".forceSSL = lib.mkForce false;
 178   "pages.${domain}".forceSSL = lib.mkForce false;
 179   "todo.${domain}".forceSSL = lib.mkForce false;
 180   "meta.${domain}" = {
 181     forceSSL = lib.mkForce false;
 182     /*
 183     extraConfig = ''
 184       access_log /var/log/nginx/${domain}/meta/access.log json;
 185       error_log /var/log/nginx/${domain}/meta/error.log warn;
 186     '';
 187     */
 188   };
 189   "${domain}".forceSSL = lib.mkForce false;
 190 };
 191 systemd.services.nginx.serviceConfig.LogsDirectory =
 192   lib.mkForce ["/var/log/nginx/${domain}/meta"];
 193 systemd.services.postgresql = {
 194   /*
 195     connection_limit=64 \
 196     encoding=UTF8 \
 197     lc_collate=fr_FR.UTF-8 \
 198     lc_type=fr_FR.UTF-8 \
 199     owner="${sourcehut.git.database}" \
 200     pg_createdb "${sourcehut.git.database}" >/dev/null </dev/null
 201
 202     pg_adduser "${sourcehut.git.database}" "${sourcehut.git.database}" >/dev/null
 203   */
 204   postStart = lib.mkAfter ''
 205     $PSQL -d "${sourcehut.dispatch.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 206       GRANT USAGE,CREATE ON schema public TO "${sourcehut.dispatch.user}";
 207     EOF
 208     $PSQL -d "${sourcehut.git.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 209       GRANT USAGE,CREATE ON schema public TO "${sourcehut.git.user}";
 210     EOF
 211     $PSQL -d "${sourcehut.hub.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 212       GRANT USAGE,CREATE ON schema public TO "${sourcehut.hub.user}";
 213     EOF
 214     $PSQL -d "${sourcehut.man.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 215       GRANT USAGE,CREATE ON schema public TO "${sourcehut.man.user}";
 216     EOF
 217     $PSQL -d "${sourcehut.meta.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 218       GRANT USAGE,CREATE ON schema public TO "${sourcehut.meta.user}";
 219       GRANT USAGE,CREATE ON schema public TO "${users.sshsrht.name}";
 220     EOF
 221     $PSQL -d "${sourcehut.pages.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 222       GRANT USAGE,CREATE ON schema public TO "${sourcehut.pages.user}";
 223     EOF
 224     $PSQL -d "${sourcehut.paste.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 225       GRANT USAGE,CREATE ON schema public TO "${sourcehut.paste.user}";
 226     EOF
 227     $PSQL -d "${sourcehut.todo.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 228       GRANT USAGE,CREATE ON schema public TO "${sourcehut.todo.user}";
 229     EOF
 230     $PSQL -d "${sourcehut.lists.database}" -AqtX --set ON_ERROR_STOP=1 -f - <<EOF
 231       GRANT USAGE,CREATE ON schema public TO "${sourcehut.lists.user}";
 232     EOF
 233   '';
 234 };
 235 }