AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add joplin-server and fix nginx

Browse Source
This commit is contained in:
Dmitriy Kholkin 2022-10-09 00:39:52 +03:00
parent 931cd596c4
commit 5357b7a2df
3 changed files with 49 additions and 82 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
profiles/servers/joplin-server.nix
View File

@ -1,36 +1,27 @@
{ config, lib, pkgs, ... }: { { config, lib, pkgs, ... }: {
secrets.joplin-env = { };
secrets.joplin-db-env = { };
virtualisation.oci-containers.containers = { virtualisation.oci-containers.containers = {
joplin = { joplin = {
autoStart = true; autoStart = true;
dependsOn = [ "joplin-db" ]; dependsOn = [ "joplin-db" ];
environment = { environmentFiles = [ config.secrets.joplin-env.decrypted ];
DB_CLIENT = "pg";
POSTGRES_DATABASE = "joplin";
POSTGRES_USER = "test";
POSTGRES_PASSWORD = "test";
POSTGRES_PORT = "5432";
POSTGRES_HOST = "joplin-db";
APP_PORT = "22300";
APP_BASE_URL = "joplin.ataraxiadev.com";
};
extraOptions = [ extraOptions = [
"--network=joplin" "--network=joplin"
]; ];
ports = [ "127.0.0.1:22300:22300" ]; ports = [ "127.0.0.1:22300:22300" ];
image = "joplin:latest-dev"; image = "joplin:latest-dev";
volumes = [ "/srv/joplin/data:/data" ];
}; };
joplin-db = { joplin-db = {
autoStart = true; autoStart = true;
environment = { environmentFiles = [ config.secrets.joplin-db-env.decrypted ];
POSTGRES_PASSWORD= "test";
POSTGRES_USER = "test";
POSTGRES_DB = "joplin";
};
extraOptions = [ extraOptions = [
"--network=joplin" "--network=joplin"
]; ];
image = "postgres:13"; image = "postgres:13";
# volumes = [ "/server/data/postgres:/var/lib/postgresql/data" ]; volumes = [ "/srv/joplin/postgres:/var/lib/postgresql/data" ];
}; };
}; };
systemd.services.create-joplin-network = with config.virtualisation.oci-containers; { systemd.services.create-joplin-network = with config.virtualisation.oci-containers; {

8
profiles/servers/mailserver.nix
View File

@ -11,6 +11,10 @@ in {
owner = "dovecot2:dovecot2"; owner = "dovecot2:dovecot2";
services = [ "dovecot2" ]; services = [ "dovecot2" ];
}; };
secrets.mailserver-joplin = {
owner = "dovecot2:dovecot2";
services = [ "dovecot2" ];
};
secrets.mailserver-vaultwarden = { secrets.mailserver-vaultwarden = {
owner = "dovecot2:dovecot2"; owner = "dovecot2:dovecot2";
services = [ "dovecot2" ]; services = [ "dovecot2" ];
@ -115,6 +119,10 @@ in {
[ "minichka76" "kpoxa@ataraxiadev.com" "kpoxa" ]; [ "minichka76" "kpoxa@ataraxiadev.com" "kpoxa" ];
hashedPasswordFile = config.secrets.mailserver-minichka.decrypted; hashedPasswordFile = config.secrets.mailserver-minichka.decrypted;
}; };
"joplin@ataraxiadev.com" = {
aliases = [ "joplin" ];
hashedPasswordFile = config.secrets.mailserver-joplin.decrypted;
};
"vaultwarden@ataraxiadev.com" = { "vaultwarden@ataraxiadev.com" = {
aliases = [ "vaultwarden" ]; aliases = [ "vaultwarden" ];
hashedPasswordFile = config.secrets.mailserver-vaultwarden.decrypted; hashedPasswordFile = config.secrets.mailserver-vaultwarden.decrypted;

100
profiles/servers/nginx.nix
View File

@ -35,7 +35,7 @@
"shoko.ataraxiadev.com" "shoko.ataraxiadev.com"
"bathist.ataraxiadev.com" "bathist.ataraxiadev.com"
"microbin.ataraxiadev.com" "microbin.ataraxiadev.com"
# "joplin.ataraxiadev.com" "joplin.ataraxiadev.com"
]; ];
}; };
}; };
@ -52,9 +52,7 @@
proxy_hide_header X-Frame-Options; proxy_hide_header X-Frame-Options;
proxy_hide_header Content-Security-Policy; proxy_hide_header Content-Security-Policy;
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
# add_header Content-Security-Policy "frame-ancestors 'self' https://*.ataraxiadev.com moz-extension://43a2224f-fe82-45d7-bdc3-c218984e73c8";
add_header X-Robots-Tag "none"; add_header X-Robots-Tag "none";
# add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header X-Content-Type-Options "nosniff"; add_header X-Content-Type-Options "nosniff";
''; '';
virtualHosts = let virtualHosts = let
@ -63,25 +61,18 @@
enableACME = false; enableACME = false;
forceSSL = true; forceSSL = true;
}; };
proxySettings = { proxySettings = ''
extraConfig = '' proxy_set_header Host $host;
proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Server $host; '';
''; hardened = ''
}; add_header Content-Security-Policy "frame-ancestors 'self' https://*.ataraxiadev.com";
hardened = { add_header Referrer-Policy "strict-origin-when-cross-origin";
extraConfig = '' '';
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "frame-ancestors 'self' https://*.ataraxiadev.com";
add_header X-Robots-Tag "none";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header X-Content-Type-Options "nosniff";
'';
};
in { in {
"ataraxiadev.com" = { "ataraxiadev.com" = {
locations."/.well-known/matrix" = { locations."/.well-known/matrix" = {
@ -123,13 +114,7 @@
proxyPass = "http://matrix.pve:81"; proxyPass = "http://matrix.pve:81";
extraConfig = '' extraConfig = ''
proxy_hide_header Content-Security-Policy; proxy_hide_header Content-Security-Policy;
proxy_set_header Host $host; '' + proxySettings;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
'';
}; };
} // default; } // default;
"matrix:8448" = { "matrix:8448" = {
@ -141,52 +126,54 @@
}]; }];
locations."/" = { locations."/" = {
proxyPass = "http://matrix.pve:8449"; proxyPass = "http://matrix.pve:8449";
} // proxySettings; extraConfig = proxySettings;
};
} // default; } // default;
"startpage.ataraxiadev.com" = { "startpage.ataraxiadev.com" = {
locations."/" = { locations."/" = {
root = "/srv/http/startpage.ataraxiadev.com/"; root = "/srv/http/startpage.ataraxiadev.com/";
# extraConfig = '' # extraConfig = hardened;
# add_header X-XSS-Protection "1; mode=block";
# add_header X-Robots-Tag "none";
# add_header Referrer-Policy "strict-origin-when-cross-origin";
# add_header X-Content-Type-Options "nosniff";
# '';
}; };
} // default; } // default;
"vw.ataraxiadev.com" = { "vw.ataraxiadev.com" = {
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8812"; proxyPass = "http://localhost:8812";
} // proxySettings; extraConfig = proxySettings;
};
locations."/notifications/hub" = { locations."/notifications/hub" = {
proxyPass = "http://localhost:3012"; proxyPass = "http://localhost:3012";
proxyWebsockets = true; proxyWebsockets = true;
} // proxySettings; extraConfig = proxySettings;
};
locations."/notifications/hub/negotiate" = { locations."/notifications/hub/negotiate" = {
proxyPass = "http://localhost:8812"; proxyPass = "http://localhost:8812";
} // proxySettings; extraConfig = proxySettings;
};
} // default; } // default;
"code.ataraxiadev.com" = { "code.ataraxiadev.com" = {
locations."/" = { locations."/" = {
proxyPass = "http://localhost:6000"; proxyPass = "http://localhost:6000";
} // proxySettings; extraConfig = proxySettings;
};
} // default; } // default;
"bathist.ataraxiadev.com" = { "bathist.ataraxiadev.com" = {
locations."/" = { locations."/" = {
proxyPass = "http://localhost:9999"; proxyPass = "http://localhost:9999";
} // proxySettings; extraConfig = proxySettings;
};
} // default; } // default;
"file.ataraxiadev.com" = { "file.ataraxiadev.com" = {
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8088"; proxyPass = "http://localhost:8088";
} // proxySettings; extraConfig = proxySettings;
};
} // default; } // default;
"webmail.ataraxiadev.com" = { "webmail.ataraxiadev.com" = {
locations."/" = { locations."/" = {
extraConfig = '' extraConfig = ''
client_max_body_size 30M; client_max_body_size 30M;
''; '' + proxySettings;
} // proxySettings; };
} // default; } // default;
"media-stack" = { "media-stack" = {
serverAliases = [ serverAliases = [
@ -207,12 +194,6 @@
proxyPass = "http://localhost:8100"; proxyPass = "http://localhost:8100";
proxyWebsockets = true; proxyWebsockets = true;
extraConfig = '' extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_buffer_size 128k; proxy_buffer_size 128k;
proxy_buffers 4 256k; proxy_buffers 4 256k;
proxy_busy_buffers_size 256k; proxy_busy_buffers_size 256k;
@ -220,34 +201,21 @@
proxy_connect_timeout 600; proxy_connect_timeout 600;
proxy_send_timeout 600; proxy_send_timeout 600;
proxy_read_timeout 15m; proxy_read_timeout 15m;
''; '' + proxySettings;
}; };
} // default; } // default;
"microbin.ataraxiadev.com" = { "microbin.ataraxiadev.com" = {
locations."/" = { locations."/" = {
proxyPass = "http://localhost:9988"; proxyPass = "http://localhost:9988";
extraConfig = '' extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
client_max_body_size 40M; client_max_body_size 40M;
''; '' + proxySettings;
}; };
} // default; } // default;
"joplin.ataraxiadev.com" = { "joplin.ataraxiadev.com" = {
locations."/" = { locations."/" = {
proxyPass = "http://localhost:22300"; proxyPass = "http://localhost:22300";
extraConfig = '' extraConfig = proxySettings;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
'';
}; };
} // default; } // default;
}; };