haccfiles/hosts/hainich/services/murmur.nix
L3D ワッフルマイスター b2d2235d4d remove newline in murmur.nix 😉
2021-04-05 06:46:34 +00:00

47 lines
1.4 KiB
Nix

{ config, lib, pkgs, ... }:
let
mumblesite = pkgs.stdenv.mkDerivation {
name = "mumble.hacc.space-website";
src = pkgs.fetchgit {
url = "https://gitlab.infra4future.de/hacc/infra4future/mumble.infra4future.de";
rev = "8949bd21346bc55175957ffb179d25ea00be4d01";
sha256 = "09qpszhxdkgkspcl6n7djgabp5km1s9v0rqb31wmm7fai9zkgmq3";
};
buildPhase = ''
${pkgs.jekyll.outPath}/bin/jekyll build
'';
installPhase = ''
mkdir -p $out
cp -r _site/* $out
'';
};
in
{
services.murmur = {
enable = true;
logDays = -1;
welcometext = "Welcome to mumble4future! Brought to you by infra4future. The server is now reachable under mumble.hacc.space, please update your bookmarks.";
sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
bandwidth = 128000;
};
networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
services.nginx.virtualHosts =
let vhost = {
forceSSL = true;
enableACME = true;
root = mumblesite.outPath;
};
in {
"mumble.infra4future.de" = vhost;
"mumble.hacc.space" = vhost;
};
# set ACLs so that the murmur user can read the certificates
security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
}