stuebinm
3f5369da14
This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
97 lines
2.3 KiB
Nix
97 lines
2.3 KiB
Nix
{ config, lib, pkgs, sources, modules, ... }:
|
|
|
|
{
|
|
imports = [
|
|
../../common
|
|
./hardware.nix
|
|
modules.encboot
|
|
modules.network.nftables modules.nftnat
|
|
((import sources.nix-hexchen) {}).profiles.nopersist
|
|
|
|
../../services/nextcloud
|
|
../../services/mattermost.nix
|
|
../../services/thelounge.nix
|
|
../../services/murmur.nix
|
|
../../services/hedgedoc-hacc.nix
|
|
../../services/hedgedoc-i4f.nix
|
|
../../services/mail.nix
|
|
../../services/syncthing.nix
|
|
../../services/gitlab.nix
|
|
../../services/nginx-pages.nix
|
|
../../services/gitlab-runner.nix
|
|
../../services/unifi.nix
|
|
../../services/lantifa.nix
|
|
../../services/wink.nix
|
|
|
|
./lxc.nix
|
|
];
|
|
|
|
hexchen.encboot = {
|
|
enable = true;
|
|
dataset = "-a";
|
|
networkDrivers = [ "igb" ];
|
|
};
|
|
|
|
boot.loader.grub.enable = true;
|
|
boot.loader.grub.version = 2;
|
|
boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ];
|
|
boot.supportedFilesystems = [ "zfs" ];
|
|
|
|
networking.hostId = "b2867696";
|
|
networking.useDHCP = true;
|
|
networking.nftables.enable = true;
|
|
hexchen.nftables.nat.enable = true;
|
|
networking.nat.internalInterfaces = ["ve-+"];
|
|
networking.nat.externalInterface = "enp35s0";
|
|
|
|
networking.interfaces.enp35s0.ipv6.addresses = [{
|
|
address = "2a01:4f9:3a:2ddb::1";
|
|
prefixLength = 64;
|
|
}];
|
|
networking.defaultGateway6 = {
|
|
address = "fe80::1";
|
|
interface = "enp35s0";
|
|
};
|
|
boot = {
|
|
kernelModules = [ "nf_nat_ftp" ];
|
|
kernel.sysctl = {
|
|
"net.ipv4.conf.all.forwarding" = lib.mkOverride 90 true;
|
|
"net.ipv4.conf.default.forwarding" = lib.mkOverride 90 true;
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedProxySettings = true;
|
|
virtualHosts = {
|
|
"parsons.hacc.space" = {
|
|
default = true;
|
|
locations."/".return = "404";
|
|
};
|
|
"hacc.space" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".return = "302 https://hacc.earth";
|
|
};
|
|
};
|
|
};
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
services.restic.backups.tardis = {
|
|
passwordFile = "/persist/restic/system";
|
|
s3CredentialsFile = "/persist/restic/system.s3creds";
|
|
paths = [
|
|
"/home"
|
|
"/persist"
|
|
];
|
|
pruneOpts = [
|
|
"--keep-daily 7"
|
|
"--keep-weekly 5"
|
|
"--keep-monthly 3"
|
|
];
|
|
repository = "b2:tardis-parsons:system";
|
|
};
|
|
|
|
system.stateVersion = "21.05";
|
|
}
|