hacc/haccfiles
8
0
Fork 1
Code Issues 1 Pull requests Projects Releases Wiki Activity

fix mumble website

Browse source 
This does two things:
 - add a group "mumblecert" which is allowed to read the mumble.hacc.space
   cert, and add both nginx and murmur's users to it
 - remove the website's derivation from services/murmur.nix and instead
   add it to the websites/ dir and handle it the same as all our other sites
This commit is contained in:
stuebinm 2022-01-18 09:08:27 +01:00
parent 6f0d8a6af9
commit b9aa3050d7
3 changed files with 6 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
nix/sources.json
View file

@ -37,12 +37,6 @@
"url_template": "https://releases.mattermost.com/<version>/mattermost-<version>-linux-amd64.tar.gz", "url_template": "https://releases.mattermost.com/<version>/mattermost-<version>-linux-amd64.tar.gz",
"version": "6.1.0" "version": "6.1.0"
}, },
"mumble-website": {
"branch": "master",
"repo": "https://gitlab.infra4future.de/hacc/infra4future/mumble.infra4future.de.git",
"rev": "3a70bf8aa1f4bb56524d36153b84cfb538c4f787",
"type": "git"
},
"niv": { "niv": {
"branch": "master", "branch": "master",
"description": "Easy dependency management for Nix projects", "description": "Easy dependency management for Nix projects",

32
services/murmur.nix
View file

@ -1,18 +1,5 @@
{ config, lib, pkgs, sources, ... }: { config, lib, pkgs, sources, ... }:
let
mumblesite = pkgs.stdenv.mkDerivation {
name = "mumble.hacc.space-website";
src = sources.mumble-website.outPath.outPath;
buildPhase = ''
${pkgs.jekyll.outPath}/bin/jekyll build
'';
installPhase = ''
mkdir -p $out
cp -r _site/* $out
'';
};
in
{ {
hexchen.bindmounts."/var/lib/murmur" = "/persist/var/lib/murmur"; hexchen.bindmounts."/var/lib/murmur" = "/persist/var/lib/murmur";
@ -28,18 +15,9 @@ in
networking.firewall.allowedTCPPorts = [ config.services.murmur.port ]; networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
networking.firewall.allowedUDPPorts = [ config.services.murmur.port ]; networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
# services.nginx.virtualHosts = # the mumble cert has its own group so that both nginx and murmur can read it
# let vhost = { users.groups.mumblecert = {};
# forceSSL = true; security.acme.certs."mumble.hacc.space".group = "mumblecert";
# enableACME = true; users.users.nginx.extraGroups = [ "mumblecert" ];
# root = mumblesite.outPath; users.users.murmur.extraGroups = [ "mumblecert" ];
# };
# in {
# "mumble.infra4future.de" = vhost;
# "mumble.hacc.space" = vhost;
# };
# set ACLs so that the murmur user can read the certificates
security.acme.certs."mumble.hacc.space".postRun = "${pkgs.acl}/bin/setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
security.acme.certs."mumble.hacc.space".group = "murmur";
} }

1
websites/mumble.hacc.space/default.nix Normal file
View file

@ -0,0 +1 @@
import ../mumble.infra4future.de