upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-14 10:30:52 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up nas structure

Browse source
This commit is contained in:
Nick 2025-12-08 03:32:04 -06:00
parent 312c52d613
commit e341e5878f
19 changed files with 1106 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

243
modules/nixos/nas/guests/firefly-iii/config/default.nix Normal file
View file

@ -0,0 +1,243 @@
{
flake,
config,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = {
name = "firefly-iii";
};
smtpCfg = instances.smtp;
in
{
fireflyVM =
{
user,
ip,
mac,
userMac,
ssh,
host,
owner,
mnt,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
firefly-iii = {
enable = true;
enableNginx = false;
poolConfig = {
"listen.owner" = config.services.caddy.user;
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 4;
"pm.max_requests" = 500;
};
settings = {
APP_URL = "https://${host}";
APP_KEY_FILE = "/etc/firefly-secrets/pass";
DB_PASSWORD_FILE = "/etc/firefly-secrets/data";
DB_CONNECTION = "pgsql";
DB_HOST = "/run/postgresql";
DB_DATABASE = "firefly-iii";
DB_USERNAME = "firefly-iii";
MAIL_MAILER = smtpCfg.name;
MAIL_HOST = smtpCfg.hostname;
MAIL_PORT = smtpCfg.ports.port0;
MAIL_FROM = smtpCfg.email.address0;
MAIL_USERNAME = smtpCfg.email.address0;
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/smtp";
MAIL_ENCRYPTION = "tls";
SITE_OWNER = owner;
};
};
phpfpm.pools.firefly-iii.phpEnv = {
TRUSTED_PROXIES = "*";
APP_URL = "https://${host}";
};
firefly-iii-data-importer = {
enable = true;
};
caddy = {
enable = true;
virtualHosts.":80" = {
extraConfig = ''
root * ${config.services.firefly-iii.package}/public
file_server
encode gzip
php_fastcgi unix//run/phpfpm/firefly-iii.sock {
env HTTPS {http.request.header.X-Forwarded-Proto}
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
}
'';
};
};
postgresql = {
enable = true;
ensureDatabases = [ "firefly-iii" ];
ensureUsers = [
{
name = "firefly-iii";
ensureDBOwnership = true;
}
];
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22
587
8084
8081
];
systemd = {
services = {
caddy = {
after = [ "phpfpm-firefly-iii.service" ];
requires = [ "phpfpm-firefly-iii.service" ];
};
fix-secrets-permissions = {
description = "Fix secrets permissions for firefly-iii";
wantedBy = [ "multi-user.target" ];
before = [
"firefly-iii-setup.service"
"phpfpm-firefly-iii.service"
];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/firefly-secrets
cp /run/secrets/${user}-pass /etc/firefly-secrets/${user}-pass
cp /run/secrets/${user}-data /etc/firefly-secrets/${user}-data
cp /run/secrets/${user}-smtp /etc/firefly-secrets/${user}-smtp
chmod 755 /etc/firefly-secrets
chmod 644 /etc/firefly-secrets/*
'';
};
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${ip}/24"; }
];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-ff-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-firefly";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/config";
tag = "${serviceCfg.name}_${user}_config";
}
{
mountPoint = "/var/lib/postgresql";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
];
sops = {
secrets = builtins.listToAttrs (
map
(secret: {
name = "${serviceCfg.name}/${user}-${secret}";
value = {
owner = "root";
group = "root";
mode = "0644";
};
})
[
"pass"
"data"
"smtp"
]
);
};
};
}