flake/hosts/lightsail-tokyo/default.nix

151 lines
3.7 KiB
Nix

{
lib,
modulesPath,
pkgs,
...
}: {
imports = [
"${modulesPath}/virtualisation/amazon-image.nix"
../../nixos/profiles/server
./anti-feature.nix
./services/forgejo.nix
./services/hysteria.nix
./services/keycloak.nix
./services/miniflux.nix
./services/murmur.nix
./services/ntfy.nix
./services/pixivfe.nix
./services/searx.nix
];
time.timeZone = "Asia/Tokyo";
boot.loader.grub.device = lib.mkForce "/dev/nvme0n1";
system.stateVersion = "23.11";
swapDevices = [
{
device = "/var/lib/swapfile";
size = 4 * 1024; # 4 GiB
}
];
# WORKAROUND:
systemd.services."print-host-key".enable = false;
### Secrets
sops.secrets = lib.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
"hysteria/auth" = {
restartUnits = ["hysteria.service"];
};
"pixivfe/environment" = {
restartUnits = ["pixivfe.service"];
};
"searx/environment" = {
restartUnits = ["searx.service"];
};
"miniflux/environment" = {
restartUnits = ["miniflux.service"];
};
};
### Services
networking.firewall.allowedUDPPorts = [443]; # hysteria
networking.firewall.allowedTCPPorts = [80 443]; # caddy
systemd.tmpfiles.settings = {
"10-www" = {
"/var/www/robots/robots.txt".C.argument = toString ./robots.txt;
"/var/www/matrix/client".C.argument = toString ./matrix-client.json;
"/var/www/matrix/server".C.argument = toString ./matrix-server.json;
};
};
services.caddy = {
enable = true;
configFile = pkgs.substituteAll {
src = ./Caddyfile;
"element" = pkgs.element-web.override {
element-web-unwrapped = pkgs.element-web-unwrapped.overrideAttrs (oldAttrs: {
version = "1.11.74-rc.0";
src = oldAttrs.src.overrideAttrs {
outputHash = "sha256-Dik4vBzybkb6Q7OgEDrQ3FBaUGOmUxr9SplyNm1JWZU=";
};
offlineCache = oldAttrs.offlineCache.overrideAttrs {
outputHash = "sha256-+SSsFUVIVuNpy+CQT6+oFIGvzQLAHEokibXtxsidumQ=";
};
});
conf.default_server_config."m.homeserver" = {
base_url = "https://matrix.ny4.dev";
server_name = "ny4.dev";
};
};
"cinny" = pkgs.cinny.override {
conf = {
defaultHomeserver = 0;
homeserverList = ["ny4.dev"];
};
};
"mastodon" = pkgs.mastodon;
};
};
services.postgresql = {
package = pkgs.postgresql_16;
settings = {
max_connections = 200;
shared_buffers = "256MB";
effective_cache_size = "768MB";
maintenance_work_mem = "64MB";
checkpoint_completion_target = 0.9;
wal_buffers = "7864kB";
default_statistics_target = 100;
random_page_cost = 1.1;
effective_io_concurrency = 200;
work_mem = "655kB";
huge_pages = "off";
min_wal_size = "1GB";
max_wal_size = "4GB";
};
};
services.wastebin = {
enable = true;
settings.WASTEBIN_ADDRESS_PORT = "127.0.0.1:8200";
};
services.uptime-kuma = {
enable = true;
settings.PORT = "8300";
};
services.redlib = {
enable = true;
address = "127.0.0.1";
port = 9400;
};
### Prevents me from bankrupt
# https://fmk.im/p/shutdown-aws/
services.vnstat.enable = true;
systemd.services."no-bankrupt" = {
serviceConfig.Type = "oneshot";
path = with pkgs; [coreutils gawk vnstat systemd];
script = ''
TRAFF_TOTAL=1900
TRAFF_USED=$(vnstat --oneline b | awk -F ';' '{print $11}')
CHANGE_TO_GB=$(($TRAFF_USED / 1073741824))
if [ $CHANGE_TO_GB -gt $TRAFF_TOTAL ]; then
shutdown -h now
fi
'';
};
systemd.timers."no-bankrupt" = {
timerConfig.OnCalendar = "*:0:0"; # Check every hour
};
}