quotes.bfob.gg: add to clouvider-lon01
This commit is contained in:
parent
d8b3e75a4e
commit
ef81a0c080
4 changed files with 75 additions and 1 deletions
|
@ -11,6 +11,7 @@ in {
|
|||
../lib/zfs.nix
|
||||
../lib/bgp.nix
|
||||
../lib/whitby-distributed.nix
|
||||
../lib/quotes.bfob.gg.nix
|
||||
];
|
||||
|
||||
boot.initrd = {
|
||||
|
@ -205,6 +206,7 @@ in {
|
|||
enable = true;
|
||||
virtualHosts = {
|
||||
"clouvider-lon01.as205479.net" = {
|
||||
default = true;
|
||||
listen = [
|
||||
{addr = "185.198.188.29"; port = 80; ssl = false;}
|
||||
{addr = "[2a0a:54c0:0:17::2]"; port = 80; ssl = false;}
|
||||
|
|
|
@ -170,5 +170,12 @@ in
|
|||
system.nixos.tags = lib.mkBefore [
|
||||
depot.version
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
64
ops/nixos/lib/quotes.bfob.gg.nix
Normal file
64
ops/nixos/lib/quotes.bfob.gg.nix
Normal file
|
@ -0,0 +1,64 @@
|
|||
{ config, depot, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (depot.ops) secrets;
|
||||
pkg = depot.web.quotes;
|
||||
|
||||
sock = "/run/quotesdb/gunicorn.sock";
|
||||
in
|
||||
{
|
||||
config = {
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
email = lib.mkDefault "letsencrypt@lukegb.com";
|
||||
certs."bfob.gg" = {
|
||||
group = config.services.nginx.group;
|
||||
dnsProvider = "cloudflare";
|
||||
credentialsFile = secrets.cloudflareCredentials;
|
||||
extraDomainNames = ["*.bfob.gg"];
|
||||
};
|
||||
};
|
||||
services.nginx = {
|
||||
enable = lib.mkDefault true;
|
||||
virtualHosts."qdb.bfob.gg" = {
|
||||
useACMEHost = "bfob.gg";
|
||||
globalRedirect = "quotes.bfob.gg";
|
||||
forceSSL = true;
|
||||
};
|
||||
virtualHosts."quotes.bfob.gg" = {
|
||||
useACMEHost = "bfob.gg";
|
||||
forceSSL = true;
|
||||
locations."/static" = {
|
||||
root = "${pkg}/share";
|
||||
};
|
||||
locations."/" = {
|
||||
proxyPass = "http://unix:${sock}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = lib.mkDefault true;
|
||||
ensureDatabases = lib.mkAfter [ "quotesdb" ];
|
||||
ensureUsers = lib.mkAfter [{
|
||||
name = "quotesdb";
|
||||
ensurePermissions = {
|
||||
"DATABASE quotesdb" = "ALL PRIVILEGES";
|
||||
};
|
||||
}];
|
||||
};
|
||||
|
||||
systemd.services.quotesdb = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
EnvironmentFile = secrets.quotesdb.environment;
|
||||
RuntimeDirectory = "quotesdb";
|
||||
ExecStart = "${pkg}/bin/quotes --workers 3 --bind unix:${sock}";
|
||||
DynamicUser = true;
|
||||
Group = "nginx";
|
||||
UMask = "0007";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
|
@ -20,6 +20,8 @@ in {
|
|||
../lib/zfs.nix
|
||||
../lib/graphical-client.nix
|
||||
../lib/whitby-distributed.nix
|
||||
|
||||
../lib/quotes.bfob.gg.nix
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
|
@ -270,7 +272,6 @@ in {
|
|||
mandatoryFeatures = [ ];
|
||||
}];
|
||||
|
||||
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
|
|
Loading…
Reference in a new issue