nixos-config/machines/fuuko/configuration.nix
Simon Bruder 8748cfdf11
fuuko: Remove drone
I don’t actually use it and it is somewhat of a risk to run
code-execution-as-a-service. Also, the confinement does not work
currently (tries to write to /var/empty), which prompted the removal,
because the low usage does not justify that amount of maintainance.
2022-01-14 17:20:52 +01:00

80 lines
1.8 KiB
Nix

{ config, lib, pkgs, ... }:
{
imports = [
./hardware-configuration.nix
../../modules
../../users/simon
./services/ankisyncd.nix
./services/binary-cache.nix
./services/dnsmasq.nix
./services/factorio.nix
./services/gitea.nix
./services/grafana.nix
./services/hedgedoc.nix
./services/hydra.nix
./services/matrix
./services/media-backup.nix
./services/media.nix
./services/prometheus.nix
./services/scan.nix
./services/torrent.nix
./services/wordclock-dimmer.nix
];
sbruder = {
wireguard.home.enable = true;
nginx.hardening.enable = true;
restic.system = {
enable = true;
extraPaths = [
"/data"
];
extraExcludes = [
"/data/media/video"
"/data/misc"
"/data/torrent"
];
prune = true;
};
unfree.allowSoftware = true;
};
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."fuuko.home.sbruder.de" = {
enableACME = true;
forceSSL = true;
};
virtualHosts."sbruder.de" = {
enableACME = true;
forceSSL = true;
root = pkgs.sbruder.contact;
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
systemd.services.nginx.serviceConfig.SupplementaryGroups = lib.singleton "keys";
services.postgresqlBackup = {
enable = true;
startAt = [ ]; # triggered by restic system backup
location = "/data/backup/postgresql";
};
systemd.services.restic-backups-system = {
after = [ "postgresqlBackup.service" ];
wants = [ "postgresqlBackup.service" ];
};
networking.hostName = "fuuko";
system.stateVersion = "20.09";
}