139 lines
3.6 KiB
Nix
139 lines
3.6 KiB
Nix
{
|
|
ssh-pub-keys,
|
|
spacebar-server,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: let
|
|
botPolicies-nix = {
|
|
dnsbl = false;
|
|
status_codes = {
|
|
CHALLENGE = 200;
|
|
DENY = 200;
|
|
};
|
|
bots = [
|
|
{
|
|
name = "catch-everything";
|
|
user_agent_regex = ".*";
|
|
action = "CHALLENGE";
|
|
}
|
|
];
|
|
};
|
|
in {
|
|
services.anubis = {
|
|
instances.spacebar = {
|
|
enable = true;
|
|
settings = {
|
|
BIND = "[::1]:9780";
|
|
BIND_NETWORK = "tcp";
|
|
DIFFICULTY = 4;
|
|
METRICS_BIND = "[::1]:9781";
|
|
METRICS_BIND_NETWORK = "tcp";
|
|
POLICY_FNAME = "/etc/anubis/spacebar.botPolicies.yaml";
|
|
TARGET = "http://localhost:8282";
|
|
};
|
|
};
|
|
};
|
|
environment.etc."anubis/spacebar.botPolicies.yaml" = {
|
|
source = (pkgs.formats.yaml {}).generate "" botPolicies-nix;
|
|
mode = "644";
|
|
};
|
|
systemd.services.spacebar-server = {
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = "${lib.getExe spacebar-server.packages.x86_64-linux.default}";
|
|
RemainAfterExit = true;
|
|
User = "spacebar";
|
|
Group = "spacebar";
|
|
};
|
|
environment = {
|
|
DATABASE = "/var/lib/spacebar-server/database.db";
|
|
STORAGE_LOCATION = "/var/lib/spacebar-server/files/";
|
|
};
|
|
};
|
|
users.users.spacebar = {
|
|
isSystemUser = true;
|
|
group = "spacebar";
|
|
description = "spacebar";
|
|
home = "/var/lib/spacebar-server";
|
|
createHome = true;
|
|
packages = [pkgs.git spacebar-server.packages.x86_64-linux.default];
|
|
shell = pkgs.bash;
|
|
openssh.authorizedKeys.keys = ssh-pub-keys;
|
|
};
|
|
users.groups.spacebar = {};
|
|
|
|
# Enable container name DNS for non-default Docker networks.
|
|
# https://github.com/NixOS/nixpkgs/issues/226365
|
|
networking.firewall.interfaces."docker+".allowedUDPPorts = [53];
|
|
|
|
virtualisation.oci-containers.backend = "docker";
|
|
|
|
# Containers
|
|
virtualisation.oci-containers.containers."spaceclient-jank" = {
|
|
image = "docker.io/compose2nix/spaceclient-jank";
|
|
ports = [
|
|
"8282:8080/tcp"
|
|
];
|
|
log-driver = "journald";
|
|
extraOptions = [
|
|
"--network-alias=jank"
|
|
"--network=spaceclient_default"
|
|
];
|
|
};
|
|
systemd.services."docker-spaceclient-jank" = {
|
|
serviceConfig = {
|
|
Restart = lib.mkOverride 90 "always";
|
|
};
|
|
after = [
|
|
"docker-network-spaceclient_default.service"
|
|
];
|
|
requires = [
|
|
"docker-network-spaceclient_default.service"
|
|
];
|
|
partOf = [
|
|
"docker-compose-spaceclient-root.target"
|
|
];
|
|
wantedBy = [
|
|
"docker-compose-spaceclient-root.target"
|
|
];
|
|
};
|
|
|
|
# Networks
|
|
systemd.services."docker-network-spaceclient_default" = {
|
|
path = [pkgs.docker];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStop = "docker network rm -f spaceclient_default";
|
|
};
|
|
script = ''
|
|
docker network inspect spaceclient_default || docker network create spaceclient_default
|
|
'';
|
|
partOf = ["docker-compose-spaceclient-root.target"];
|
|
wantedBy = ["docker-compose-spaceclient-root.target"];
|
|
};
|
|
|
|
# Builds
|
|
systemd.services."docker-build-spaceclient-jank" = {
|
|
path = [pkgs.docker pkgs.git];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
TimeoutSec = 300;
|
|
};
|
|
script = ''
|
|
cd /home/mtgmonkey/spaceclient
|
|
docker build -t compose2nix/spaceclient-jank .
|
|
'';
|
|
};
|
|
|
|
# Root service
|
|
# When started, this will automatically create all resources and start
|
|
# the containers. When stopped, this will teardown all resources.
|
|
systemd.targets."docker-compose-spaceclient-root" = {
|
|
unitConfig = {
|
|
Description = "Root target generated by compose2nix.";
|
|
};
|
|
wantedBy = ["multi-user.target"];
|
|
};
|
|
}
|