flake/hosts/lightsail-tokyo/default.nix

321 lines
8.7 KiB
Nix

{
lib,
config,
inputs,
modulesPath,
pkgs,
...
}: {
imports = [
"${modulesPath}/virtualisation/amazon-image.nix"
../../nixos/profiles/server
./anti-feature.nix
];
time.timeZone = "Asia/Tokyo";
boot.loader.grub.device = lib.mkForce "/dev/nvme0n1";
system.stateVersion = "23.11";
swapDevices = [
{
device = "/var/lib/swapfile";
size = 4 * 1024; # 4 GiB
}
];
# WORKAROUND:
systemd.services."print-host-key".enable = false;
# FIXME:
# error: 1 dependencies of derivation '/nix/store/h0wkpjfh0hr1vswyz2f7wk8n03yj0l81-linux-6.10-modules.drv' failed to build
boot.kernelPackages = pkgs.linuxPackages;
### Secrets
sops = {
secrets = builtins.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
"hysteria/auth" = {
restartUnits = ["hysteria.service"];
};
"pixivfe/environment" = {
restartUnits = ["pixivfe.service"];
};
"searx/environment" = {
restartUnits = ["searx.service"];
};
"miniflux/credentials" = {
restartUnits = ["miniflux.service"];
};
};
};
### Services
networking.firewall.allowedUDPPorts = [443]; # hysteria
networking.firewall.allowedTCPPorts = [80 443]; # caddy
systemd.tmpfiles.settings = {
"10-www" = {
"/var/www/robots/robots.txt".C.argument = toString ./robots.txt;
"/var/www/matrix/client".C.argument = toString ./matrix-client.json;
"/var/www/matrix/server".C.argument = toString ./matrix-server.json;
};
};
services.caddy = {
enable = true;
configFile = pkgs.substituteAll {
src = ./Caddyfile;
"element" = pkgs.element-web.override {
element-web-unwrapped = pkgs.element-web-unwrapped.overrideAttrs (oldAttrs: {
version = "1.11.70";
src = oldAttrs.src.overrideAttrs {
outputHash = "sha256-kx6xQIuYSXkkBTYb+fZLL3cuHFcNj7RkC60o6Fyp8LI=";
};
offlineCache = oldAttrs.offlineCache.overrideAttrs {
outputHash = "sha256-q/KbpU/haBhXZbGBITLYSywCluwN6ZZarVLmzB9tDN8=";
};
});
conf.default_server_config."m.homeserver" = {
base_url = "https://matrix.ny4.dev";
server_name = "ny4.dev";
};
};
"mastodon" = pkgs.mastodon;
};
};
services.hysteria = {
enable = true;
settings = {
auth = {
type = "userpass";
userpass = {
_secret = "/run/credentials/hysteria.service/auth";
quote = false;
};
};
masquerade = {
type = "proxy";
proxy.url = "https://ny4.dev/";
};
tls = {
cert = "/run/credentials/hysteria.service/cert";
key = "/run/credentials/hysteria.service/key";
};
};
};
systemd.services."hysteria".serviceConfig.LoadCredential = [
# FIXME: remove hardcoded path
"auth:${config.sops.secrets."hysteria/auth".path}"
"cert:/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev/tyo0.ny4.dev.crt"
"key:/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev/tyo0.ny4.dev.key"
];
# `journalctl -u murmur.service | grep Password`
services.murmur = {
enable = true;
openFirewall = true;
bandwidth = 256 * 1024; # 256 Kbit/s
};
services.searx = {
enable = true;
package = pkgs.searxng;
environmentFile = config.sops.secrets."searx/environment".path;
settings = {
general.contact_url = "mailto:guanran928@outlook.com";
search.autocomplete = "google";
server = {
port = 8100;
secret_key = "@SEARX_SECRET@";
};
};
};
services.wastebin = {
enable = true;
settings.WASTEBIN_ADDRESS_PORT = "127.0.0.1:8200";
};
services.uptime-kuma = {
enable = true;
settings.PORT = "8300";
};
services.ntfy-sh = {
enable = true;
settings = {
base-url = "https://ntfy.ny4.dev";
listen-http = "";
listen-unix = "/run/ntfy-sh/ntfy.sock";
listen-unix-mode = 511; # 0777
behind-proxy = true;
};
};
systemd.services.ntfy-sh.serviceConfig.RuntimeDirectory = ["ntfy-sh"];
services.pixivfe = {
enable = true;
EnvironmentFile = config.sops.secrets."pixivfe/environment".path;
settings = {
PIXIVFE_UNIXSOCKET = "/run/pixivfe/pixiv.sock";
PIXIVFE_IMAGEPROXY = "https://i.pixiv.re";
};
};
systemd.services.pixivfe.serviceConfig = {
RuntimeDirectory = ["pixivfe"];
ExecStartPost = pkgs.writeShellScript "pixivfe-unixsocket" ''
${pkgs.coreutils}/bin/sleep 5
${pkgs.coreutils}/bin/chmod 777 /run/pixivfe/pixiv.sock
'';
};
services.keycloak = {
enable = true;
settings = {
cache = "local";
hostname = "id.ny4.dev";
http-host = "127.0.0.1";
http-port = 8800;
proxy = "edge";
# proxy-headers = "xforwarded"; # FIXME: Key material not provided to setup HTTPS.
};
database.passwordFile = toString (pkgs.writeText "password" "keycloak");
};
# TODO: eventually, use blog homepage
services.homepage-dashboard = {
enable = true;
listenPort = 9200;
settings = {
useEqualHeights = true;
cardBlur = "sm";
layout."Services" = {
style = "row";
columns = "4";
};
};
services = let
getDesc = pkg: pkg.meta.description;
mapAttrsToList' = lib.mapAttrsToList (name: value: {"${name}" = value;}); # also sorts the thing alphabetically
in
mapAttrsToList' {
"Services" = mapAttrsToList' {
"Mumble" = {
description = "${getDesc pkgs.mumble} (Connect with tyo0.ny4.dev:64738)";
};
"Ntfy" = {
description = getDesc pkgs.ntfy;
href = "https://ntfy.ny4.dev/";
};
"Redlib" = {
description = getDesc pkgs.redlib;
href = "https://reddit.ny4.dev/";
};
"SearXNG" = {
description = getDesc pkgs.searxng;
href = "https://searx.ny4.dev/";
};
"Wastebin" = {
description = getDesc pkgs.wastebin;
href = "https://pb.ny4.dev/";
};
};
"Links" = mapAttrsToList' {
"Blog".href = "https://blog.ny4.dev/";
"Forgejo".href = "https://git.ny4.dev/nyancat";
"GitHub".href = "https://github.com/Guanran928";
"Mastodon".herf = "https://mastodon.ny4.dev/@nyancat";
"Matrix".href = "https://matrix.to/#/@nyancat:ny4.dev";
};
"Private stuff" = mapAttrsToList' {
"Forgejo" = {
description = getDesc pkgs.forgejo;
href = "https://git.ny4.dev/";
};
"Mastodon" = rec {
description = getDesc pkgs.mastodon;
href = "https://mastodon.ny4.dev/";
widget.type = "mastodon";
widget.url = href;
};
"Matrix" = {
description = getDesc pkgs.element-web;
href = "https://element.ny4.dev/";
};
"Miniflux" = {
description = getDesc pkgs.miniflux;
href = "https://rss.ny4.dev/";
};
"PixivFE" = {
description = getDesc inputs.self.legacyPackages.${pkgs.stdenv.hostPlatform.system}.pixivfe;
href = "https://pixiv.ny4.dev";
};
"Uptime Kuma" = {
description = getDesc pkgs.uptime-kuma;
href = "https://uptime.ny4.dev/";
};
};
};
};
services.forgejo = {
enable = true;
database.type = "postgres";
settings = {
server = {
DOMAIN = "git.ny4.dev";
PROTOCOL = "http+unix";
ROOT_URL = "https://git.ny4.dev/";
SSH_DOMAIN = "tyo0.ny4.dev";
};
service = {
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
};
};
};
services.miniflux = {
enable = true;
adminCredentialsFile = config.sops.secrets."miniflux/credentials".path;
config = {
LISTEN_ADDR = "127.0.0.1:9300";
BASE_URL = "https://rss.ny4.dev";
};
};
services.libreddit = {
enable = true;
package = pkgs.redlib;
address = "127.0.0.1";
port = 9400;
};
### Prevents me from bankrupt
# https://fmk.im/p/shutdown-aws/
services.vnstat.enable = true;
systemd.services."no-bankrupt" = {
serviceConfig.Type = "oneshot";
path = with pkgs; [coreutils gawk vnstat systemd];
script = ''
TRAFF_TOTAL=1900
TRAFF_USED=$(vnstat --oneline b | awk -F ';' '{print $11}')
CHANGE_TO_GB=$(($TRAFF_USED / 1073741824))
if [ $CHANGE_TO_GB -gt $TRAFF_TOTAL ]; then
shutdown -h now
fi
'';
};
systemd.timers."no-bankrupt" = {
timerConfig.OnCalendar = "*:0:0"; # Check every hour
};
}