This repository has no description
2.4 kB
92 lines
1{ config, pkgs, ... }:
2let
3 domain = "pad.lassul.us";
4in
5{
6
7 # redirect legacy domain to new one
8 services.nginx.virtualHosts."codi.lassul.us" = {
9 enableACME = true;
10 addSSL = true;
11 locations."/".return = "301 https://${domain}\$request_uri";
12 };
13
14 services.nginx.virtualHosts.${domain} = {
15 enableACME = true;
16 forceSSL = true;
17 locations."/" = {
18 proxyPass = "https://localhost:3091";
19 proxyWebsockets = true;
20 };
21 };
22
23 security.acme.certs.${domain}.group = "hedgecert";
24 users.groups.hedgecert.members = [
25 "hedgedoc"
26 "nginx"
27 ];
28
29 security.dhparams = {
30 enable = true;
31 params.hedgedoc = { };
32 };
33
34 services.borgbackup.jobs.hetzner.paths = [
35 "/var/backup"
36 "/var/lib/hedgedoc"
37 ];
38 systemd.services.hedgedoc-backup = {
39 startAt = "daily";
40 serviceConfig = {
41 ExecStart = pkgs.writers.writeDash "pad-backup" ''
42 until ${pkgs.sqlite}/bin/sqlite3 /var/lib/hedgedoc/db.hedgedoc.sqlite ".backup /var/backup/hedgedoc/backup.sq3"; do
43 sleep 1
44 done
45 '';
46 Type = "oneshot";
47 };
48 };
49
50 systemd.services.hedgedoc.environment = {
51 CMD_COOKIE_POLICY = "none";
52 CMD_CSP_ALLOW_FRAMING = "true";
53 };
54
55 services.hedgedoc = {
56 enable = true;
57 settings = {
58 allowOrigin = [ domain ];
59 db = {
60 dialect = "sqlite";
61 storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
62 };
63 useCDN = false;
64 port = 3091;
65 domain = domain;
66 allowFreeURL = true;
67 defaultPermission = "freely";
68
69 useSSL = true;
70 protocolUseSSL = true;
71 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
72 sslCertPath = "/var/lib/acme/${domain}/cert.pem";
73 sslKeyPath = "/var/lib/acme/${domain}/key.pem";
74 dhParamPath = config.security.dhparams.params.hedgedoc.path;
75 };
76
77 # https://github.com/settings/applications/2352617
78 environmentFile = config.clanCore.facts.secretUploadDirectory + "/hedgedoc.env";
79 };
80
81 clanCore.facts.services.hedgedoc-github-auth = {
82 secret."hedgedoc.env" = { };
83 generator.script = ''
84 echo "$prompt_value" > "$secrets"/hedgedoc.env
85 '';
86 generator.prompt = ''
87 goto https://github.com/settings/applications/2352617 and paste the data in the following format:
88 GITHUB_CLIENT_ID=...
89 GITHUB_CLIENT_SECRET=...
90 '';
91 };
92}