Add lemmy instance and fix backup paths
This commit is contained in:
parent
9c4c156d77
commit
19f62ff6dd
|
|
@ -0,0 +1,8 @@
|
|||
# snoottube-ops
|
||||
|
||||
## how to update mastodon
|
||||
|
||||
1. do changes in glitch-soc-snoottube. push them to a branch on github
|
||||
2. in this repo, modify mastodon-staging/update.sh to set BRANCH to the name of that branch
|
||||
3. run update.sh
|
||||
4. if that succeeded, colmena apply --on backend
|
||||
|
|
@ -32,11 +32,13 @@ let
|
|||
};
|
||||
smtp = {
|
||||
createLocally = false;
|
||||
authenticate = false;
|
||||
authenticate = true;
|
||||
fromAddress = "snoot-tube-mastodon@vvn.space";
|
||||
host =
|
||||
"192.168.1.7"; # ts ip isn't reachable from the container. maybe need a mail relay on the host? use lan ip for now "100.109.126.18"; # sky-reflected-in-mirrors ts ip
|
||||
port = 25;
|
||||
"smtp.mailgun.org"; # ts ip isn't reachable from the container. maybe need a mail relay on the host? use lan ip for now "100.109.126.18"; # sky-reflected-in-mirrors ts ip
|
||||
port = 465;
|
||||
user = "no-reply@mg.vvn.space";
|
||||
passwordFile = config.sops.secrets.smtpPassword.path;
|
||||
};
|
||||
mastodonExtraConfig = {
|
||||
ALTERNATE_DOMAINS = "dev.snoot.tube,awake.snoot.tube";
|
||||
|
|
@ -89,11 +91,13 @@ let
|
|||
};
|
||||
smtp = {
|
||||
createLocally = false;
|
||||
authenticate = false;
|
||||
authenticate = true;
|
||||
fromAddress = "snoot-tube-mastodon-staging@vvn.space";
|
||||
host =
|
||||
"192.168.1.7"; # ts ip isn't reachable from the container. maybe need a mail relay on the host? use lan ip for now "100.109.126.18"; # sky-reflected-in-mirrors ts ip
|
||||
port = 25;
|
||||
"smtp.mailgun.org"; # ts ip isn't reachable from the container. maybe need a mail relay on the host? use lan ip for now "100.109.126.18"; # sky-reflected-in-mirrors ts ip
|
||||
port = 465;
|
||||
user = "no-reply@mg.vvn.space";
|
||||
passwordFile = config.sops.secrets.smtpPassword.path;
|
||||
};
|
||||
mastodonExtraConfig = {
|
||||
EMAIL_DOMAIN_ALLOWLIST = "vvn.space";
|
||||
|
|
@ -118,7 +122,7 @@ in {
|
|||
config.networking.hostName = "mastodon-snoottube";
|
||||
config.networking.firewall.enable = true;
|
||||
config.networking.firewall.allowedTCPPorts =
|
||||
[ 80 443 22 19999 19998 19980 19981 9102 4040 ];
|
||||
[ 80 443 22 19999 19998 19980 19981 9102 4040 3128 ];
|
||||
config.networking.firewall.interfaces."ve-+".allowedTCPPorts =
|
||||
[ 3128 ]; # ssh forwarded http proxy
|
||||
config.networking.firewall.interfaces."ve-+".allowedUDPPorts =
|
||||
|
|
@ -150,7 +154,7 @@ in {
|
|||
user = "root";
|
||||
monitoringPort = 0;
|
||||
extraArguments =
|
||||
"-o ExitOnForwardFailure=yes -o ConnectTimeout=10 -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -N -R 4433:${prodConfig.localAddress}:443 -L 3128:localhost:3128 -L 19981:localhost:19980 -L 19998:localhost:19999 -L 4040:localhost:4040 -g -i /root/.ssh/id_ed25519_to_ingress snoot.tube -p 6922";
|
||||
"-o ExitOnForwardFailure=yes -o ConnectTimeout=10 -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -N -R 4433:${prodConfig.localAddress}:443 -L 3128:localhost:3128 -L 19981:localhost:19980 -L 19998:localhost:19999 -L 4040:localhost:4040 -R 8800:localhost:8800 -g -i /root/.ssh/id_ed25519_to_ingress snoot.tube -p 6922";
|
||||
}
|
||||
{
|
||||
name = "staging_ingress";
|
||||
|
|
@ -176,6 +180,7 @@ in {
|
|||
stagingContainer.activationScript;
|
||||
|
||||
config.sops.secrets.oauth2_proxy_keys = { };
|
||||
config.sops.secrets.smtpPassword = { };
|
||||
|
||||
config.environment.systemPackages = [
|
||||
(let
|
||||
|
|
@ -199,7 +204,7 @@ in {
|
|||
config.sops.secrets.borgbase_ssh_private_key =
|
||||
{ }; # it is extremely important for this to have a trailing newline, or connecting will fail
|
||||
config.services.borgbackup.jobs."borgbase" = {
|
||||
paths = [ "/var/lib/mastodon-container" "/var/backup" ];
|
||||
paths = [ "/var/lib/mastodon-container" ];
|
||||
exclude = [ ];
|
||||
|
||||
repo = "h5g87o5w@h5g87o5w.repo.borgbase.com:repo";
|
||||
|
|
|
|||
|
|
@ -194,6 +194,25 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
virtualHosts."lemmy.snoot.tube" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://lemmy_backend_ssh"; # ssh forwarded
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
proxy_set_header Connection "";
|
||||
'';
|
||||
};
|
||||
|
||||
locations."/robots.txt" = {
|
||||
extraConfig = ''
|
||||
return 200 'User-agent: *\nDisallow: /';
|
||||
add_header Content-Type text/plain;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
upstreams.backend_ssh = {
|
||||
servers = {
|
||||
"localhost:4433" = { };
|
||||
|
|
@ -213,6 +232,17 @@ in {
|
|||
keepalive_timeout 30s;
|
||||
'';
|
||||
};
|
||||
|
||||
upstreams.lemmy_backend_ssh = {
|
||||
servers = {
|
||||
"localhost:8800" = { };
|
||||
};
|
||||
extraConfig = ''
|
||||
keepalive 32;
|
||||
keepalive_timeout 30s;
|
||||
'';
|
||||
};
|
||||
|
||||
appendHttpConfig = ''
|
||||
log_format mylogformat '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@
|
|||
];
|
||||
};
|
||||
backend = { name, nodes, pkgs, ... }: {
|
||||
deployment.targetHost = "192.168.1.39";
|
||||
deployment.targetHost = "mastodon-snoottube.lan.vvn.space";
|
||||
deployment.targetUser = "root";
|
||||
|
||||
imports = [
|
||||
|
|
@ -117,6 +117,7 @@
|
|||
./configs/backend.nix
|
||||
nixos-generators.nixosModules.proxmox # proxmox base machine config.
|
||||
./modules/prometheus_exporters.nix
|
||||
./modules/lemmy.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -0,0 +1,88 @@
|
|||
version: "3.3"
|
||||
|
||||
networks:
|
||||
# communication to web and clients
|
||||
lemmyexternalproxy:
|
||||
# communication between lemmy services
|
||||
lemmyinternal:
|
||||
driver: bridge
|
||||
internal: true
|
||||
|
||||
services:
|
||||
proxy:
|
||||
image: nginx:1-alpine
|
||||
networks:
|
||||
- lemmyinternal
|
||||
- lemmyexternalproxy
|
||||
ports:
|
||||
# only ports facing any connection from outside
|
||||
- 8800:80
|
||||
volumes:
|
||||
- ./nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
restart: always
|
||||
depends_on:
|
||||
- pictrs
|
||||
- lemmy-ui
|
||||
|
||||
lemmy:
|
||||
image: dessalines/lemmy:0.17.3
|
||||
hostname: lemmy
|
||||
networks:
|
||||
- lemmyinternal
|
||||
- lemmyexternalproxy
|
||||
restart: always
|
||||
environment:
|
||||
- RUST_LOG="warn,lemmy_server=warn,lemmy_api=warn,lemmy_api_common=warn,lemmy_api_crud=warn,lemmy_apub=warn,lemmy_db_schema=warn,lemmy_db_views=warn,lemmy_db_views_actor=warn,lemmy_db_views_moderator=info,lemmy_routes=warn,lemmy_utils=warn,lemmy_websocket=warn"
|
||||
#- RUST_LOG="warn,lemmy_server=info,lemmy_api=info,lemmy_api_common=info,lemmy_api_crud=info,lemmy_apub=info,lemmy_db_schema=info,lemmy_db_views=info,lemmy_db_views_actor=info,lemmy_db_views_moderator=info,lemmy_routes=info,lemmy_utils=info,lemmy_websocket=info"
|
||||
- LEMMY_DATABASE_URL=postgres://$POSTGRES_USER:$POSTGRES_PASSWORD@postgres:5432/$POSTGRES_DB
|
||||
- http_proxy=http://mastodon-snoottube.lan.vvn.space:3128
|
||||
- https_proxy=http://mastodon-snoottube.lan.vvn.space:3128
|
||||
- no_proxy="127.0.0.1,localhost,mastodon-snoottube.lan.vvn.space,pictrs,postgresql"
|
||||
volumes:
|
||||
- ./lemmy.hjson:/config/config.hjson
|
||||
depends_on:
|
||||
- postgres
|
||||
- pictrs
|
||||
|
||||
lemmy-ui:
|
||||
image: dessalines/lemmy-ui:0.17.3
|
||||
networks:
|
||||
- lemmyinternal
|
||||
environment:
|
||||
# this needs to match the hostname defined in the lemmy service
|
||||
- LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
|
||||
# set the outside hostname here
|
||||
- LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.snoot.tube
|
||||
- LEMMY_HTTPS=true
|
||||
depends_on:
|
||||
- lemmy
|
||||
restart: always
|
||||
|
||||
pictrs:
|
||||
image: asonix/pictrs:0.3.1
|
||||
# this needs to match the pictrs url in lemmy.hjson
|
||||
hostname: pictrs
|
||||
# we can set options to pictrs like this, here we set max. image size and forced format for conversion
|
||||
# entrypoint: /sbin/tini -- /usr/local/bin/pict-rs -p /mnt -m 4 --image-format webp
|
||||
networks:
|
||||
- lemmyinternal
|
||||
environment:
|
||||
- PICTRS__API_KEY=DLLPkiVXGyQoZcyXAjymMpK34piNF4H4Ys4KU3Gf2bFqwxgN2s3B
|
||||
user: 991:991
|
||||
volumes:
|
||||
- ./volumes/pictrs:/mnt
|
||||
restart: always
|
||||
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
# this needs to match the database host in lemmy.hson
|
||||
hostname: postgres
|
||||
networks:
|
||||
- lemmyinternal
|
||||
environment:
|
||||
- POSTGRES_USER=$POSTGRES_USER
|
||||
- POSTGRES_PASSWORD=$POSTGRES_PASSWORD
|
||||
- POSTGRES_DB=$POSTGRES_DB
|
||||
volumes:
|
||||
- ./volumes/postgres:/var/lib/postgresql/data
|
||||
restart: always
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
version: '2.2'
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:14-alpine
|
||||
environment:
|
||||
- POSTGRES_USER=$POSTGRES_USER
|
||||
- POSTGRES_PASSWORD=$POSTGRES_PASSWORD
|
||||
- POSTGRES_DB=$POSTGRES_DB
|
||||
volumes:
|
||||
- ./volumes/postgres:/var/lib/postgresql/data
|
||||
restart: always
|
||||
|
||||
lemmy:
|
||||
image: dessalines/lemmy:0.17.3
|
||||
ports:
|
||||
- "127.0.0.1:8536:8536"
|
||||
- "127.0.0.1:6669:6669"
|
||||
restart: always
|
||||
environment:
|
||||
- RUST_LOG="warn,lemmy_server=info,lemmy_api=info,lemmy_api_common=info,lemmy_api_crud=info,lemmy_apub=info,lemmy_db_schema=info,lemmy_db_views=info,lemmy_db_views_actor=info,lemmy_db_views_moderator=info,lemmy_routes=info,lemmy_utils=info,lemmy_websocket=info"
|
||||
- LEMMY_DATABASE_URL=postgres://$POSTGRES_USER:$POSTGRES_PASSWORD@postgres:5432/$POSTGRES_DB
|
||||
volumes:
|
||||
- ./lemmy.hjson:/config/config.hjson
|
||||
depends_on:
|
||||
- postgres
|
||||
- pictrs
|
||||
|
||||
lemmy-ui:
|
||||
image: dessalines/lemmy-ui:0.16.6
|
||||
ports:
|
||||
- "127.0.0.1:1235:1234"
|
||||
restart: always
|
||||
environment:
|
||||
- LEMMY_INTERNAL_HOST=lemmy:8536
|
||||
- LEMMY_EXTERNAL_HOST=localhost:8536
|
||||
- LEMMY_HTTPS=true
|
||||
depends_on:
|
||||
- lemmy
|
||||
|
||||
pictrs:
|
||||
image: asonix/pictrs:0.3.1
|
||||
ports:
|
||||
- "127.0.0.1:8537:8080"
|
||||
- "127.0.0.1:6670:6669"
|
||||
user: 991:991
|
||||
volumes:
|
||||
- ./volumes/pictrs:/mnt
|
||||
restart: always
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
{
|
||||
# for more info about the config, check out the documentation
|
||||
# https://join-lemmy.org/docs/en/administration/configuration.html
|
||||
# only few config options are covered in this example config
|
||||
|
||||
setup: {
|
||||
# username for the admin user
|
||||
admin_username: "viv"
|
||||
# password for the admin user
|
||||
admin_password: "secret"
|
||||
# name of the site (can be changed later)
|
||||
site_name: "lemmy.snoot.tube"
|
||||
}
|
||||
|
||||
# the domain name of your instance (eg "lemmy.ml")
|
||||
hostname: "lemmy.snoot.tube"
|
||||
# address where lemmy should listen for incoming requests
|
||||
bind: "0.0.0.0"
|
||||
# port where lemmy should listen for incoming requests
|
||||
port: 8536
|
||||
# Whether the site is available over TLS. Needs to be true for federation to work.
|
||||
tls_enabled: true
|
||||
|
||||
# pictrs host
|
||||
pictrs: {
|
||||
url: "http://pictrs:8080/"
|
||||
api_key: "DLLPkiVXGyQoZcyXAjymMpK34piNF4H4Ys4KU3Gf2bFqwxgN2s3B"
|
||||
}
|
||||
|
||||
# settings related to the postgresql database
|
||||
database: {
|
||||
# maximum number of active sql connections
|
||||
pool_size: 5
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
# for more info about the config, check out the documentation
|
||||
# https://join-lemmy.org/docs/en/administration/configuration.html
|
||||
|
||||
setup: {
|
||||
# username for the admin user
|
||||
admin_username: "vivlim"
|
||||
# password for the admin user
|
||||
admin_password: "secret"
|
||||
# name of the site (can be changed later)
|
||||
site_name: "lemmy.snoot.tube"
|
||||
}
|
||||
|
||||
#opentelemetry_url: "http://otel:4137"
|
||||
|
||||
# the domain name of your instance (eg "lemmy.ml")
|
||||
hostname: "lemmy.snoot.tube"
|
||||
# address where lemmy should listen for incoming requests
|
||||
bind: "0.0.0.0"
|
||||
# port where lemmy should listen for incoming requests
|
||||
port: 8536
|
||||
# settings related to the postgresql database
|
||||
pictrs_config: {
|
||||
url: "http://pictrs:8080"
|
||||
api_key: "API_KEY"
|
||||
}
|
||||
database: {
|
||||
# maximum number of active sql connections
|
||||
pool_size: 5
|
||||
}
|
||||
slur_filter:
|
||||
'''
|
||||
(fag(g|got|tard)?\b|cock\s?sucker(s|ing)?|ni((g{2,}|q)+|[gq]{2,})[e3r]+(s|z)?|mudslime?s?|kikes?|\bspi(c|k)s?\b|\bchinks?|gooks?|bitch(es|ing|y)?|whor(es?|ing)|\btr(a|@)nn?(y|ies?)|\b(b|re|r)tard(ed)?s?)
|
||||
'''
|
||||
# # optional: email sending configuration
|
||||
email: {
|
||||
# hostname and port of the smtp server
|
||||
smtp_server: "sky-reflected-in-mirrors.lan.vvn.space"
|
||||
# login name for smtp server
|
||||
#smtp_login: ""
|
||||
# password to login to the smtp server
|
||||
#smtp_password: ""
|
||||
# address to send emails from, eg "noreply@your-instance.com"
|
||||
smtp_from_address: "snoot-tube-lemmy@vvn.space"
|
||||
# whether or not smtp connections should use tls
|
||||
tls_type: "none"
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
worker_processes 1;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
http {
|
||||
upstream lemmy {
|
||||
# this needs to map to the lemmy (server) docker service hostname
|
||||
server "lemmy:8536";
|
||||
}
|
||||
upstream lemmy-ui {
|
||||
# this needs to map to the lemmy-ui docker service hostname
|
||||
server "lemmy-ui:1234";
|
||||
}
|
||||
|
||||
server {
|
||||
# this is the port inside docker, not the public one yet
|
||||
listen 80;
|
||||
# change if needed, this is facing the public web
|
||||
server_name lemmy.snoot.tube;
|
||||
server_tokens off;
|
||||
|
||||
gzip on;
|
||||
gzip_types text/css application/javascript image/svg+xml;
|
||||
gzip_vary on;
|
||||
|
||||
# Upload limit, relevant for pictrs
|
||||
client_max_body_size 20M;
|
||||
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
# frontend general requests
|
||||
location / {
|
||||
# distinguish between ui requests and backend
|
||||
# don't change lemmy-ui or lemmy here, they refer to the upstream definitions on top
|
||||
set $proxpass "http://lemmy-ui";
|
||||
|
||||
if ($http_accept = "application/activity+json") {
|
||||
set $proxpass "http://lemmy";
|
||||
}
|
||||
if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
|
||||
set $proxpass "http://lemmy";
|
||||
}
|
||||
if ($request_method = POST) {
|
||||
set $proxpass "http://lemmy";
|
||||
}
|
||||
proxy_pass $proxpass;
|
||||
|
||||
rewrite ^(.+)/+$ $1 permanent;
|
||||
# Send actual client IP upstream
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
|
||||
# backend
|
||||
location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
|
||||
proxy_pass "http://lemmy";
|
||||
# proxy common stuff
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
# Send actual client IP upstream
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
{ ... }:
|
||||
{ containerName, hostAddress, localAddress,
|
||||
forwardPorts, imports, disabledModules,
|
||||
autoStart, preExecShellScript, dockerComposeYaml, activationScriptExtras }: {
|
||||
|
||||
containerConfig = {
|
||||
#ephemeral = true;
|
||||
inherit autoStart;
|
||||
privateNetwork = true;
|
||||
inherit hostAddress;
|
||||
inherit localAddress;
|
||||
inherit forwardPorts;
|
||||
bindMounts = {
|
||||
"/var/lib/docker-compose-project" = {
|
||||
hostPath = "/var/lib/${containerName}-container/docker-compose-project";
|
||||
isReadOnly = false;
|
||||
};
|
||||
dev-fuse = { hostPath = "/dev/fuse"; mountPoint = "/dev/fuse"; };
|
||||
dev-mount = { hostPath = "/dev/mapper"; mountPoint = "/dev/mapper"; };
|
||||
};
|
||||
|
||||
# enable nested containers https://wiki.archlinux.org/title/systemd-nspawn#Run_docker_in_systemd-nspawn
|
||||
enableTun = true;
|
||||
additionalCapabilities = ["all"];
|
||||
|
||||
allowedDevices = [
|
||||
{ node = "/dev/fuse"; modifier = "rwm"; }
|
||||
{ node = "/dev/mapper/control"; modifier = "rwm"; }
|
||||
];
|
||||
|
||||
extraFlags = []; # systemd-nspawn
|
||||
config = { pkgs, ... }: {
|
||||
inherit imports;
|
||||
inherit disabledModules;
|
||||
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
firewall.allowedTCPPorts = [ 443 80 ];
|
||||
proxy.default = "http://outer:3128";
|
||||
proxy.noProxy = "127.0.0.1,localhost,outer,${hostAddress}";
|
||||
extraHosts = ''
|
||||
${hostAddress} outer
|
||||
'';
|
||||
};
|
||||
|
||||
# docker
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
};
|
||||
|
||||
systemd.services.docker-lemmy = {
|
||||
description = "${containerName} docker-compose";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "docker.service" "docker.socket" ];
|
||||
requires = [ "docker.service" ];
|
||||
serviceConfig = {
|
||||
ExecStartPre = "${pkgs.writeShellScript "docker-compose-pre-exec" ''
|
||||
cd /var/lib/docker-compose-project/
|
||||
ln -sf ${dockerComposeYaml} /var/lib/docker-compose-project/docker-compose.yml
|
||||
${preExecShellScript}
|
||||
''}";
|
||||
ExecStart = "${pkgs.docker-compose}/bin/docker-compose --project-directory=/var/lib/docker-compose-project up";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
activationScript = { envFile }: ''
|
||||
mkdir -p /var/lib/${containerName}-container/docker-compose-project
|
||||
mkdir -p /var/lib/${containerName}-container/secrets
|
||||
cp ${envFile} /var/lib/${containerName}-container/docker-compose-project/.env
|
||||
${activationScriptExtras}
|
||||
'';
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
{ ... }:
|
||||
{ containerName, hostAddress, localAddress,
|
||||
forwardPorts, imports, disabledModules,
|
||||
autoStart, preExecShellScript, dockerComposeYaml, activationScriptExtras }: {
|
||||
|
||||
containerConfig = {
|
||||
#ephemeral = true;
|
||||
inherit autoStart;
|
||||
privateNetwork = true;
|
||||
inherit hostAddress;
|
||||
inherit localAddress;
|
||||
inherit forwardPorts;
|
||||
bindMounts = {
|
||||
"/var/lib/docker-compose-project" = {
|
||||
hostPath = "/var/lib/${containerName}-container/docker-compose-project";
|
||||
isReadOnly = false;
|
||||
};
|
||||
dev-fuse = { hostPath = "/dev/fuse"; mountPoint = "/dev/fuse"; };
|
||||
dev-mount = { hostPath = "/dev/mapper"; mountPoint = "/dev/mapper"; };
|
||||
};
|
||||
|
||||
# enable nested containers https://wiki.archlinux.org/title/systemd-nspawn#Run_docker_in_systemd-nspawn
|
||||
enableTun = true;
|
||||
additionalCapabilities = ["all"];
|
||||
|
||||
allowedDevices = [
|
||||
{ node = "/dev/fuse"; modifier = "rwm"; }
|
||||
{ node = "/dev/mapper/control"; modifier = "rwm"; }
|
||||
];
|
||||
|
||||
extraFlags = []; # systemd-nspawn
|
||||
config = { pkgs, ... }: {
|
||||
inherit imports;
|
||||
inherit disabledModules;
|
||||
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
firewall.allowedTCPPorts = [ 443 80 ];
|
||||
proxy.default = "http://outer:3128";
|
||||
proxy.noProxy = "127.0.0.1,localhost,outer,${hostAddress}";
|
||||
extraHosts = ''
|
||||
${hostAddress} outer
|
||||
'';
|
||||
};
|
||||
|
||||
# docker
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
};
|
||||
|
||||
systemd.services.docker-lemmy = {
|
||||
description = "${containerName} docker-compose";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "docker.service" "docker.socket" ];
|
||||
requires = [ "docker.service" ];
|
||||
serviceConfig = {
|
||||
ExecStartPre = "${pkgs.writeShellScript "docker-compose-pre-exec" ''
|
||||
cd /var/lib/docker-compose-project/
|
||||
ln -sf ${dockerComposeYaml} /var/lib/docker-compose-project/docker-compose.yml
|
||||
${preExecShellScript}
|
||||
''}";
|
||||
ExecStart = "${pkgs.docker-compose}/bin/docker-compose --project-directory=/var/lib/docker-compose-project up";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
activationScript = { envFile }: ''
|
||||
mkdir -p /var/lib/${containerName}-container/docker-compose-project
|
||||
mkdir -p /var/lib/${containerName}-container/secrets
|
||||
cp ${envFile} /var/lib/${containerName}-container/docker-compose-project/.env
|
||||
${activationScriptExtras}
|
||||
'';
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
{ lib, pkgs, config, ... }:
|
||||
{
|
||||
config.sops.secrets.lemmyEnv = {};
|
||||
# envFile should contain at minimum:
|
||||
# - POSTGRES_USER
|
||||
# - POSTGRES_PASSWORD
|
||||
# - POSTGRES_DB
|
||||
|
||||
# docker
|
||||
config.virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
};
|
||||
|
||||
config.systemd.services.docker-lemmy = {
|
||||
description = "lemmy docker-compose";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "docker.service" "docker.socket" ];
|
||||
requires = [ "docker.service" ];
|
||||
serviceConfig = {
|
||||
ExecStartPre = "${pkgs.writeShellScript "docker-lemmy-pre-exec" ''
|
||||
mkdir -p /var/lib/docker-lemmy
|
||||
ln -sfT ${../lemmy/docker-compose.yml} /var/lib/docker-lemmy/docker-compose.yml
|
||||
cp -f ${../lemmy/lemmy.hjson} /var/lib/docker-lemmy/lemmy.hjson
|
||||
cp -f ${../lemmy/nginx.conf} /var/lib/docker-lemmy/nginx.conf
|
||||
|
||||
mkdir -p /var/lib/docker-lemmy/volumes/pictrs
|
||||
chown 991:991 /var/lib/docker-lemmy/volumes/pictrs
|
||||
''}";
|
||||
ExecStart = "${pkgs.docker-compose}/bin/docker-compose --project-directory=/var/lib/docker-lemmy --env-file ${config.sops.secrets.lemmyEnv.path} up";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -1,6 +1,8 @@
|
|||
borgbase_ssh_private_key: ENC[AES256_GCM,data:68JE3REEyQJBCUkXqIcU2Pqjltu4PDe387PFEMaB3h5eMD0Ase0DZLmGOZm1HImN8dbJqWjcdyHhPSktpqHL7NbLt1z0jBMxSg4Ya5OYP4AUC9SZnIrg7Xc+EpOFRQNoyKsKrbjHvTr5tdVAJlGT/gOPb1LH+599s77MhlPzk/aVUDGSND754KcTwjfos6uLSCys+/kubHN/aTkEh7avNGSIgs1jja1Yao3h8XHj2q08Pz4YF9hvospqcNkoIR9niqrFtadwLjtUwf5pLtLhvrCF1WsFHmlNIcucGmACMkJeXSGf0NVSnCN91Thd4WZ87OUPslZ3/QqCQktBcg6aTLCRjus4hIr6mtwYoHeNOCJUFSw3QGTLP4DoUMntV49XMsEtDR9RjUcuvL893bb99Zibvf6zVD11FaYYuYpXpGg011/2Of5xI6zkiUYAI3LvY3J4EYq1ib+IGpQInjR/P6LpCpe85FIXwv3K4g4oArNr/pyCMdfeXqEU4HYPqgfYWWxCfethNwd9lSPzIeEtf78Bl8DzPD/f3fNp,iv:MbaclvUTDkZ9UYAW1gI4jenc1zlBSgNtg0HvOfb01BM=,tag:ST2/tBVQ2EtxSRygkTxliA==,type:str]
|
||||
borg_backup_repo_passphrase: ENC[AES256_GCM,data:F0Ovhhoe5HOrNY9FkZQOqosA4q9pm18Ar/XmzJzQlugNjmY=,iv:96DvUJFEo4n4ZTnpNya9LaRE2RL7shnVHl0OcRZCaxE=,tag:J9mbfJv7oh1T7BhRUfJ7Wg==,type:str]
|
||||
oauth2_proxy_keys: ENC[AES256_GCM,data:PQ3DoIilLPWM2RsdkX6LjSKLYc74XE0OtmkBgvYqoax1ZmPf1W0QZOlTmgFX8rN4j/KgDMtX++X3QH8n/hTLCV0yzVYLz/YJIGtdwE2SYH1evuBulBMJjsP2LogbZnG4wJr7CHKXKDx7dOha5JUhzmuxl3r+rCTzFbE5N4Vs+FnMdDPIBZS7s0/p0ZCpd0C9/thgrsL6xc2golxr5uT9K2f2+0Cf6NttlF90J3blM8xpZTfOCmgHrefpr4USlw==,iv:Fdag02/pcVep5siVvNJtJwvFkmHUy+KIsi8+gohtjg0=,tag:uMqop8tINurqHf8q9wJ1IQ==,type:str]
|
||||
lemmyEnv: ENC[AES256_GCM,data:+L3tMPsFlrv/6aysU6ReHq/zHQg2mVscXYNzBEbsYDWUCrZWqR1b7BsaOVhlU1bpTNSptxY3vMndKrktW5yhZg2bOs7Hs2Q0ygrlFmPKV8Y3KhCZ7mJ5kRPYSBj8LsAYW3Qo+aX8vh/j377jDg==,iv:W/ER43SYDm7q6+p1H/rLba1sWdOsjUbcR+pLH0i4+xs=,tag:1MaUNZsAZ4MRbaIw5qDs5w==,type:str]
|
||||
smtpPassword: ENC[AES256_GCM,data:IRYKb4bvPta1XqS4FA20yrymq+S3ZXOuEk2qVgFSt45IgEgGiPqDYBZZQAREj40qf/g=,iv:CnoX0JU8pEgOomoQmoQBoR2S6nPDCvxfVtYl6Kee9CU=,tag:1YzmjxpkgIt875PuZ4EjJw==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -43,8 +45,8 @@ sops:
|
|||
WDJkeWZxTEJaNXVneDZEVjl0VEFFcFkKqGg6vjN5MR9/zl5f6dbyvw4J6UR9EUmX
|
||||
FO4Ke8gnjojGrzd2OsnB57nKH+OQEty3MUSK2uS22/tsSzqBh+PWOw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-01-11T06:00:28Z"
|
||||
mac: ENC[AES256_GCM,data:fM4l4rq9RGtHR3FbJkI0yABtXdr/YLmzD3xSFxm02Of6k64DEkuOVdyBVYQ/DqbGkuuNwga58KYXUmgLZ5JB+BH6SuHfSLg8H06A8Ya5KEL7Yu6AUB+KMPwohoxkobf08oI50mGhZQ9lEeCWD7oRhowCnYrFaO2b20o7++qVoog=,iv:4SmRkPY4yDRMcNNI6Tjiuh3a/jcH7qVyR5ogH50973U=,tag:PPg/v70PqXbKzqFU2X1wtQ==,type:str]
|
||||
lastmodified: "2023-06-28T03:17:10Z"
|
||||
mac: ENC[AES256_GCM,data:82wmX2wqrhPdeu2TrtDVDvT2sf4/RCeXhBXF/0S6usii8nALMaPwAW8OhkfSG3CyJOxX+4hjK3Lo3EltaBorVARp4r9rGIcVvajAaeUreUuloGjJvb/CGbvgz/Aj8tXXZsSuqnZzNSTjxH7rjL6R8xJhSiULUaAa3vtnjvVkS+w=,iv:Caq9dLwN90/XCTK+8bTghpd+xKaQGkopaCFtriXxubA=,tag:w6rbbyi/+4JY7Tlf5qsaVg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.3
|
||||
|
|
|
|||
Loading…
Reference in New Issue