forked from hacc/haccfiles
stuebinm
dbbdde76c7
Since the delivery of mumble.hacc.space/murmur.hacc.space via gitlab pages broke (for whatever reason), I've packaged the site into an ad-hoc nix derivation, which is now delivered locally by nginx instead. This has a couple benefits (mainly that we no longer depend on gitlab pages), but also the downside that we can't just update the site via gitlab's CI/CD pipelines anymore.
48 lines
1.4 KiB
Nix
48 lines
1.4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
|
|
let
|
|
mumblesite = pkgs.stdenv.mkDerivation {
|
|
name = "mumble.hacc.space-website";
|
|
src = pkgs.fetchgit {
|
|
url = "https://gitlab.infra4future.de/hacc/infra4future/mumble.infra4future.de";
|
|
rev = "597c4a2fa7a146f2fd58924cb2b181d530a2a866";
|
|
sha256 = "15vh0xqx0xcm09ij877jxkd6gb5nm2hbmyz47y5019xywa766s3h";
|
|
};
|
|
buildPhase = ''
|
|
${pkgs.jekyll.outPath}/bin/jekyll build
|
|
'';
|
|
installPhase = ''
|
|
mkdir -p $out
|
|
cp -r _site/* $out
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
services.murmur = {
|
|
enable = true;
|
|
logDays = -1;
|
|
welcometext = "Welcome to mumble4future! Brought to you by infra4future. The server is now reachable under mumble.hacc.space, please update your bookmarks.";
|
|
sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
|
|
sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
|
|
bandwidth = 128000;
|
|
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
|
|
networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
|
|
|
|
services.nginx.virtualHosts =
|
|
let vhost = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
root = mumblesite.outPath;
|
|
};
|
|
in {
|
|
"mumble.infra4future.de" = vhost;
|
|
"mumble.hacc.space" = vhost;
|
|
};
|
|
|
|
# set ACLs so that the murmur user can read the certificates
|
|
security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
|
|
}
|