summaryrefslogtreecommitdiffstats
path: root/tv/1systems/cd.nix
diff options
context:
space:
mode:
Diffstat (limited to 'tv/1systems/cd.nix')
-rw-r--r--tv/1systems/cd.nix64
1 files changed, 44 insertions, 20 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 32d956b8a..2ad4a1505 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -18,7 +18,7 @@ with config.krebs.lib;
enable = true;
ssl_cert = ../Zcerts/charybdis_cd.crt.pem;
};
- tv.iptables.input-retiolum-accept-new-tcp = [
+ tv.iptables.input-retiolum-accept-tcp = [
config.tv.charybdis.port
config.tv.charybdis.sslport
];
@@ -28,14 +28,14 @@ with config.krebs.lib;
enable = true;
hosts = [ "jabber.viljetic.de" ];
};
- tv.iptables.input-internet-accept-new-tcp = [
+ tv.iptables.input-internet-accept-tcp = [
"xmpp-client"
"xmpp-server"
];
}
{
krebs.github-hosts-sync.enable = true;
- tv.iptables.input-internet-accept-new-tcp =
+ tv.iptables.input-internet-accept-tcp =
singleton config.krebs.github-hosts-sync.port;
}
{
@@ -44,20 +44,50 @@ with config.krebs.lib;
"cgit.cd.viljetic.de"
];
# TODO make public_html also available to cd, cd.retiolum (AKA default)
- krebs.nginx.servers.public_html = {
- server-names = singleton "cd.viljetic.de";
- locations = singleton (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
- alias /home/$1/public_html$2;
- '');
+ krebs.nginx.servers."https://viljetic.de" = {
+ server-names = singleton "viljetic.de";
+ listen = mkForce []; # disable default
+ ssl = {
+ enable = true;
+ certificate = "/var/lib/acme/viljetic.de/fullchain.pem";
+ certificate_key = "/var/lib/acme/viljetic.de/key.pem";
+ };
+ locations = [
+ (nameValuePair "/" ''
+ root ${pkgs.viljetic-pages};
+ '')
+ (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
+ alias /home/$1/public_html$2;
+ '')
+ ];
};
- krebs.nginx.servers.viljetic = {
+ krebs.nginx.servers."http://viljetic.de" = {
server-names = singleton "viljetic.de";
- # TODO directly set root (instead via location)
- locations = singleton (nameValuePair "/" ''
- root ${pkgs.viljetic-pages};
- '');
+ locations = [
+ (nameValuePair "/.well-known/acme-challenge/" ''
+ root /var/lib/acme/challenges/viljetic.de/;
+ '')
+ (nameValuePair "/" ''
+ return 301 https://viljetic.de$request_uri;
+ '')
+ ];
+ };
+ security.acme = {
+ certs."viljetic.de" = {
+ email = "tomislav@viljetic.de";
+ webroot = "/var/lib/acme/challenges/viljetic.de";
+ plugins = [
+ "account_key.json"
+ "key.pem"
+ "fullchain.pem"
+ ];
+ user = "nginx";
+ };
};
- tv.iptables.input-internet-accept-new-tcp = singleton "http";
+ tv.iptables.input-internet-accept-tcp = [
+ "http"
+ "https"
+ ];
}
];
@@ -78,13 +108,7 @@ with config.krebs.lib;
iotop
iptables
nethogs
- ntp # ntpate
rxvt_unicode.terminfo
tcpdump
];
-
- services.journald.extraConfig = ''
- SystemMaxUse=1G
- RuntimeMaxUse=128M
- '';
}