This repository has no description
1.2 kB
32 lines
1# starkstrom is deliberately not in the shared kartei registry; its retiolum
2# identity lives in retiolum/ (self.retiolum), which every superconfig machine
3# injects into its tinc host set and /etc/hosts. Move that entry into
4# kartei/lass if the rest of krebs should be able to reach it too.
5{
6 imports = [
7 ../../configs
8 ../../configs/retiolum.nix
9 ../../configs/ssh-redirect.nix
10 ../../configs/autoupdate.nix
11 ../../configs/sigexec/executor.nix
12 ./ipfs.nix
13 ./ipfs-endpoint.nix
14 ];
15
16 # The fleet has no retiolum route here (see kartei note above), so the
17 # sigexec dashboard on neoprism reaches this executor over public TLS
18 # instead: nginx strips /sigexec/ so the executor verifies the same paths
19 # the statements were signed over (/jobs etc).
20 services.nginx.virtualHosts."starkstrom.lassul.us".locations."/sigexec/" = {
21 proxyPass = "http://127.0.0.1:7601/";
22 extraConfig = ''
23 # Long-lived chunked job streams: unbuffered, generous timeouts (logs on
24 # a pending job blocks until approval).
25 proxy_buffering off;
26 proxy_read_timeout 1d;
27 proxy_send_timeout 1d;
28 '';
29 };
30
31 system.stateVersion = "25.11";
32}