Finally setup urouter and iva.bz using nix

Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev>
This commit is contained in:
Ivan Bushchik 2023-12-20 20:17:29 +03:00
parent b761ec24d1
commit bc7a9a5b4c
No known key found for this signature in database
GPG key ID: 2F16FBF3262E090C
5 changed files with 130 additions and 2 deletions

View file

@ -67,7 +67,7 @@ curl https://iva.bz/nix | sh
- Setup services (which I host)
- [x] ivabus.dev
- [x] iva.bz (proxying not-Nix env)
- [x] iva.bz (native Nix, yay!)
- [x] ивабус.рф (proxying not-Nix env)
- Setup "secret" roles (I need them)
- Setup router (in progress with `periculo`, aughhhhhhhhh it seems like I need to crosscompile it for 30 days straight, so no fast progress)

View file

@ -30,6 +30,42 @@ in {
server = {
ivabus-dev.enable = true;
slides-ivabus-dev.enable = true;
urouter = {
enable = true;
settings = {
alias = [
{
"uri" = "/";
"alias" = "https://ivabus.dev";
"is_url" = true;
}
{
"uri" = "/";
"alias" = "dotfiles";
"curl_only" = true;
}
{
"uri" = "d";
"alias" = "dotfiles";
}
{
"uri" = "e";
"alias" = "env";
}
{
"uri" = "nix";
"alias" = "nix";
}
{
"uri" = "truth";
"alias" = "truth.py";
}
];
};
dir = "/var/urouter";
port = 8090;
address = "0.0.0.0";
};
};
};
@ -61,7 +97,7 @@ in {
# Semi-static configuration, needs rethinking
services.nginx = {
virtualHosts."iva.bz" = {
locations."/".proxyPass = "http://${secrets.maas-address}:8081";
locations."/".proxyPass = "http://localhost:8090";
enableACME = true;
addSSL = true;
http3 = true;

16
pkgs/urouter.nix Normal file
View file

@ -0,0 +1,16 @@
{ pkgs ? import <nixpkgs> { system = builtins.currentSystem; }, lib ? pkgs.lib
, rustPlatform ? pkgs.rustPlatform, fetchCrate ? pkgs.fetchCrate }:
rustPlatform.buildRustPackage rec {
pname = "urouter";
version = "0.3.5";
src = fetchCrate {
inherit pname version;
sha256 = "sha256-kLCJXLtcbF3IeTylbd7EpDx3cjt0sRz1P90iJYlLi7Y=";
};
cargoSha256 = "sha256-zePizgFOoSDILz8PL74RQ+iPFXJY+l41M4EwLwzJRPU=";
nativeBuildInputs = [ pkgs.pkg-config ];
}

View file

@ -16,5 +16,6 @@
./server/nginx.nix
./server/ivabus-dev.nix
./server/slides-ivabus-dev.nix
./server/urouter.nix
];
}

75
roles/server/urouter.nix Normal file
View file

@ -0,0 +1,75 @@
{ config, lib, pkgs, ... }:
let
cfg = config.my.roles.server.urouter;
aliasFormat = pkgs.formats.json { };
in {
options.my.roles.server.urouter = {
enable = lib.mkEnableOption "Enable urouter";
settings = lib.mkOption rec {
type = aliasFormat.type;
apply = lib.recursiveUpdate default;
default = { alias = [ ]; };
example = {
alias = [
{
uri = "/";
alias = "https://someurl";
is_url = true;
}
{
uri = "/";
alias = "some_file";
curl_only = true;
}
];
};
description = lib.mdDoc ''
alias.json configuration in Nix format.
'';
};
dir = lib.mkOption {
type = lib.types.str;
default = "/var/urouter";
example = "/home/user/urouter";
};
address = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
example = "0200::1";
};
port = lib.mkOption {
type = lib.types.ints.u16;
default = 8080;
example = 80;
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = false;
description = lib.mdDoc "Whether to open the TCP port in the firewall";
};
};
config = lib.mkIf (cfg.enable) {
networking.firewall.allowedTCPPorts =
lib.mkIf cfg.openFirewall [ cfg.port ];
systemd.services.urouter = {
description = "urouter HTTP Service";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''
${
pkgs.callPackage ../../pkgs/urouter.nix { }
}/bin/urouter --alias-file-is-set-not-a-list --alias-file ${
aliasFormat.generate "alias.json" cfg.settings
} --dir ${cfg.dir} --address ${cfg.address} --port ${builtins.toString cfg.port}
'';
BindReadOnlyPaths = [ cfg.dir ];
};
};
};
}