{ config, lib, pkgs, profiles, modules, evalConfig, sources, ... }: { containers.pad-hacc = { privateNetwork = true; hostAddress = "192.168.100.1"; localAddress = "192.168.100.5"; autoStart = true; bindMounts = { "/persist" = { hostPath = "/persist/containers/pad-hacc"; isReadOnly = false; }; }; path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: { boot.isContainer = true; networking.useDHCP = false; users.users.root.hashedPassword = ""; system.stateVersion = "21.11"; imports = [ ((import sources.nix-hexchen) {}).profiles.nopersist ]; nixpkgs.config.allowUnfree = true; networking.firewall.enable = false; networking.defaultGateway = { address = "192.168.100.1"; interface = "eth0"; }; services.coredns = { enable = true; config = '' .:53 { forward . 1.1.1.1 } ''; }; services.hedgedoc = { enable = true; configuration = { allowAnonymous = true; allowFreeURL = true; allowGravatar = false; allowOrigin = [ "localhost" "pad.hacc.space" "fff-muc.de" ]; db = { host = "/run/postgresql"; username = "codimd"; dialect = "postgres"; database = "codimd"; }; defaultPermission = "limited"; domain = "pad.hacc.space"; host = "0.0.0.0"; protocolUseSSL = true; hsts.preload = false; email = false; oauth2 = { authorizationURL = "https://login.infra4future.de/oauth2/authorize"; tokenURL = "https://login.infra4future.de/oauth2/token"; clientID = "hedgedoc"; # must be set to make the NixOS module happy, but env var takes precedence clientSecret = "lol nope"; }; }; environmentFile = "/persist/secrets.env"; }; systemd.services.hedgedoc.environment = { "CMD_LOGLEVEL" = "warn"; "CMD_OAUTH2_USER_PROFILE_URL" = "https://login.infra4future.de/oauth2/userinfo"; "CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR" = "nickname"; "CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR" = "name"; "CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR" = "email"; "CMD_OAUTH2_PROVIDERNAME" = "Infra4Future"; }; services.postgresql = { enable = true; ensureDatabases = [ "codimd" ]; ensureUsers = [{ name = "codimd"; ensurePermissions = { "DATABASE codimd" = "ALL PRIVILEGES"; }; }]; authentication = '' local all all trust host codimd codimd 127.0.0.1/32 trust ''; package = pkgs.postgresql_11; }; services.postgresqlBackup = { enable = true; databases = [ "codimd" ]; startAt = "*-*-* 23:45:00"; location = "/persist/backups/postgres"; }; })).config.system.build.toplevel; }; services.nginx.virtualHosts."pad.hacc.earth" = { enableACME = true; forceSSL = true; globalRedirect = "pad.hacc.space"; }; services.nginx.virtualHosts."pad.hacc.space" = { forceSSL = true; enableACME = true; locations."/" = { proxyPass = "http://${config.containers.pad-hacc.localAddress}:3000"; extraConfig = '' add_header Access-Control-Allow-Origin "*"; proxy_buffering off; ''; }; }; }