mirror of
https://github.com/ivabus/nixos
synced 2024-11-10 02:25:18 +03:00
Finally setup urouter and iva.bz using nix
Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev>
This commit is contained in:
parent
b761ec24d1
commit
bc7a9a5b4c
|
@ -67,7 +67,7 @@ curl https://iva.bz/nix | sh
|
|||
|
||||
- Setup services (which I host)
|
||||
- [x] ivabus.dev
|
||||
- [x] iva.bz (proxying not-Nix env)
|
||||
- [x] iva.bz (native Nix, yay!)
|
||||
- [x] ивабус.рф (proxying not-Nix env)
|
||||
- Setup "secret" roles (I need them)
|
||||
- Setup router (in progress with `periculo`, aughhhhhhhhh it seems like I need to crosscompile it for 30 days straight, so no fast progress)
|
||||
|
|
|
@ -30,6 +30,42 @@ in {
|
|||
server = {
|
||||
ivabus-dev.enable = true;
|
||||
slides-ivabus-dev.enable = true;
|
||||
urouter = {
|
||||
enable = true;
|
||||
settings = {
|
||||
alias = [
|
||||
{
|
||||
"uri" = "/";
|
||||
"alias" = "https://ivabus.dev";
|
||||
"is_url" = true;
|
||||
}
|
||||
{
|
||||
"uri" = "/";
|
||||
"alias" = "dotfiles";
|
||||
"curl_only" = true;
|
||||
}
|
||||
{
|
||||
"uri" = "d";
|
||||
"alias" = "dotfiles";
|
||||
}
|
||||
{
|
||||
"uri" = "e";
|
||||
"alias" = "env";
|
||||
}
|
||||
{
|
||||
"uri" = "nix";
|
||||
"alias" = "nix";
|
||||
}
|
||||
{
|
||||
"uri" = "truth";
|
||||
"alias" = "truth.py";
|
||||
}
|
||||
];
|
||||
};
|
||||
dir = "/var/urouter";
|
||||
port = 8090;
|
||||
address = "0.0.0.0";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -61,7 +97,7 @@ in {
|
|||
# Semi-static configuration, needs rethinking
|
||||
services.nginx = {
|
||||
virtualHosts."iva.bz" = {
|
||||
locations."/".proxyPass = "http://${secrets.maas-address}:8081";
|
||||
locations."/".proxyPass = "http://localhost:8090";
|
||||
enableACME = true;
|
||||
addSSL = true;
|
||||
http3 = true;
|
||||
|
|
16
pkgs/urouter.nix
Normal file
16
pkgs/urouter.nix
Normal file
|
@ -0,0 +1,16 @@
|
|||
{ pkgs ? import <nixpkgs> { system = builtins.currentSystem; }, lib ? pkgs.lib
|
||||
, rustPlatform ? pkgs.rustPlatform, fetchCrate ? pkgs.fetchCrate }:
|
||||
|
||||
rustPlatform.buildRustPackage rec {
|
||||
pname = "urouter";
|
||||
version = "0.3.5";
|
||||
|
||||
src = fetchCrate {
|
||||
inherit pname version;
|
||||
sha256 = "sha256-kLCJXLtcbF3IeTylbd7EpDx3cjt0sRz1P90iJYlLi7Y=";
|
||||
};
|
||||
|
||||
cargoSha256 = "sha256-zePizgFOoSDILz8PL74RQ+iPFXJY+l41M4EwLwzJRPU=";
|
||||
|
||||
nativeBuildInputs = [ pkgs.pkg-config ];
|
||||
}
|
|
@ -16,5 +16,6 @@
|
|||
./server/nginx.nix
|
||||
./server/ivabus-dev.nix
|
||||
./server/slides-ivabus-dev.nix
|
||||
./server/urouter.nix
|
||||
];
|
||||
}
|
||||
|
|
75
roles/server/urouter.nix
Normal file
75
roles/server/urouter.nix
Normal file
|
@ -0,0 +1,75 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.my.roles.server.urouter;
|
||||
aliasFormat = pkgs.formats.json { };
|
||||
in {
|
||||
options.my.roles.server.urouter = {
|
||||
enable = lib.mkEnableOption "Enable urouter";
|
||||
settings = lib.mkOption rec {
|
||||
type = aliasFormat.type;
|
||||
apply = lib.recursiveUpdate default;
|
||||
default = { alias = [ ]; };
|
||||
example = {
|
||||
alias = [
|
||||
{
|
||||
uri = "/";
|
||||
alias = "https://someurl";
|
||||
is_url = true;
|
||||
}
|
||||
{
|
||||
uri = "/";
|
||||
alias = "some_file";
|
||||
curl_only = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
description = lib.mdDoc ''
|
||||
alias.json configuration in Nix format.
|
||||
'';
|
||||
};
|
||||
|
||||
dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/urouter";
|
||||
example = "/home/user/urouter";
|
||||
};
|
||||
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "0.0.0.0";
|
||||
example = "0200::1";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.ints.u16;
|
||||
default = 8080;
|
||||
example = 80;
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Whether to open the TCP port in the firewall";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf (cfg.enable) {
|
||||
networking.firewall.allowedTCPPorts =
|
||||
lib.mkIf cfg.openFirewall [ cfg.port ];
|
||||
|
||||
systemd.services.urouter = {
|
||||
description = "urouter HTTP Service";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${
|
||||
pkgs.callPackage ../../pkgs/urouter.nix { }
|
||||
}/bin/urouter --alias-file-is-set-not-a-list --alias-file ${
|
||||
aliasFormat.generate "alias.json" cfg.settings
|
||||
} --dir ${cfg.dir} --address ${cfg.address} --port ${builtins.toString cfg.port}
|
||||
'';
|
||||
BindReadOnlyPaths = [ cfg.dir ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
Loading…
Reference in a new issue