diff options
Diffstat (limited to 'services')
| -rw-r--r-- | services/firefly_iii.nix | 140 | ||||
| -rw-r--r-- | services/kanboard.nix | 61 |
2 files changed, 201 insertions, 0 deletions
diff --git a/services/firefly_iii.nix b/services/firefly_iii.nix new file mode 100644 index 0000000..1f9bd64 --- /dev/null +++ b/services/firefly_iii.nix @@ -0,0 +1,140 @@ +{ config, lib, ... }: +let + cfg = config.wilkuu.services.firefly-iii; + inherit (lib) + types + mkOption + mkEnableOption + mkIf + ; +in +{ + options.wilkuu.services.firefly-iii = { + enable = mkEnableOption "firefly III"; + enable-importer = mkEnableOption "firefly III data importer"; + domain = mkOption { + type = types.str; + description = "domain"; + default = "fin.${config.networking.hostName}.local"; + example = "fin.wilkuu.xyz"; + }; + importer-domain = mkOption { + type = types.str; + description = "domain for the importer"; + default = "fin-imp.${config.networking.hostName}.local"; + example = "fin-imp.wilkuu.xyz"; + }; + + }; + config = mkIf cfg.enable { + services.nginx.virtualHosts = { + ${cfg.domain} = { + enableACME = lib.mkForce false; + addSSL = lib.mkForce false; + forceSSL = lib.mkForce false; + }; + ${cfg.importer-domain} = { + enableACME = lib.mkForce false; + addSSL = lib.mkForce false; + forceSSL = lib.mkForce false; + }; + }; + users.users."firefly_iii" = { + isSystemUser = true; + group = "firefly_iii"; + }; + users.groups."firefly_iii" = { }; + sops.secrets = + lib.genAttrs + [ + "firefly_iii/app_key" + "firefly_iii/email_password" + "firefly_iii/email_username" + "firefly_iii/db_password" + ] + (_: { + sopsFile = ../secrets/${config.networking.hostName}/firefly_iii.yaml; + owner = "firefly_iii"; + }); + wilkuu.services.mysql = { + enable = true; + databases."firefly_iii" = { + enable = true; + allowedUsers = [ "firefly_iii" ]; + }; + users.firefly_iii = { + sopsPlaceholder = config.sops.placeholder."firefly_iii/db_password"; + host = "localhost"; + }; + }; + services.firefly-iii = { + enableNginx = true; + virtualHost = cfg.domain; + enable = true; + user = "firefly_iii"; + group = "nginx"; + settings = { + APP_KEY_FILE = config.sops.secrets."firefly_iii/app_key".path; + APP_URL = "https://${cfg.domain}"; + + # DB + DB_CONNECTION = "mysql"; + DB_DATABASE = "firefly_iii"; + DB_HOST = "localhost"; + DB_PORT = config.services.mysql.settings.mysqld.port; + DB_USERNAME = "firefly_iii"; + DB_PASSWORD = config.sops.secrets."firefly_iii/db_password".path; + + # Proxying + TRUSTED_PROXIES = "192.168.80.100"; + + # Email + MAIL_MAILER = "stmp"; + MAIL_HOST = "mail.wilkuu.xyz"; + MAIL_FROM_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_USERNAME_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_PASSWORD_FILE = config.sops.secrets."firefly_iii/email_password".path; + MAIL_ENCRYPTION = "starttls"; + MAIL_PORT = 587; + # Locale and info + DEFAULT_LOCALE = "nl_NL"; + LANGUAGE = "en_US"; + SITE_OWNER = "jakub@wilkuu.xyz"; + + }; + }; + services.firefly-iii-data-importer = mkIf cfg.enable-importer { + enableNginx = true; + enable = true; + virtualHost = cfg.importer-domain; + user = "firefly_iii"; + group = "nginx"; + settings = { + FIREFLY_III_URL = "https://${cfg.domain}"; + VANITY_URL = "https://${cfg.domain}"; + + # FIREFLY_III_ACCESS_TOKEN = ""; #TODO + APP_URL = "https://${cfg.importer-domain}"; + LOG_CHANNEL = "syslog"; + + # Proxying + TRUSTED_PROXIES = "192.168.80.100"; + + # Email + MAIL_MAILER = "stmp"; + MAIL_HOST = "mail.wilkuu.xyz"; + MAIL_FROM_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_USERNAME_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_PASSWORD_FILE = config.sops.secrets."firefly_iii/email_password".path; + MAIL_ENCRYPTION = "starttls"; + MAIL_PORT = 587; + + # Locale and info + FALLBACK_LOCALE = "nl_NL"; + LANGUAGE = "en_US"; + + }; + }; + }; + +} diff --git a/services/kanboard.nix b/services/kanboard.nix new file mode 100644 index 0000000..c19b673 --- /dev/null +++ b/services/kanboard.nix @@ -0,0 +1,61 @@ +{pkgs, config, lib, ...}: + let + cfg = config.wilkuu.services.kanboard; + inherit (lib) mkEnableOption mkOption types mkIf; + in +{ + options.wilkuu.services.kanboard = { + enable = mkEnableOption "kanboard"; + domain = mkOption { + type = types.str; + example = "kb.wilkuu.xyz"; + }; + }; + + config = mkIf cfg.enable { + wilkuu.services.mysql.unix_users = ["kanboard"]; + wilkuu.mjmap = { + enable = lib.mkDefault true; + users = ["kanboard"]; + }; + sops.secrets."kanboard/db_password" = { + sopsFile = ../secrets/${config.networking.hostName}/kanboard.yaml; + owner = "kanboard"; + mode = "500"; + }; + sops.templates."kanboard-env" = { + content = '' + DB_PASSWORD=${config.sops.placeholder."kanboard/db_password"} + PLUGIN_INSTALLER=true + ''; + owner = "kanboard"; + mode = "500"; + }; + systemd.services.phpfpm-kanboard.serviceConfig = { + EnvironmentFile = config.sops.templates."kanboard-env".path; + }; + services.kanboard = { + nginx = { + enableACME = false; + forceSSL = false; + addSSL = false; + }; + domain = cfg.domain; + enable = true; + settings = { + PLUGIN_INSTALLER = "$PLUGIN_INSTALLER"; + PLUGINS_DIR = "${config.services.kanboard.dataDir}/plugins"; + MAIL_FROM = "Kanboard <noreply@wilkuu.nl>"; + MAIL_TRANSPORT = "sendmail"; + MAIL_SENDMAIL_COMMAND = "sendmail"; + DB_DRIVER = "mysql"; + DB_USERNAME = "kanboard"; + DB_HOSTNAME = "127.0.0.1;unix_socket=/run/mysqld/mysqld.sock"; + DB_PASSWORD = "$DB_PASSWORD"; + ENABLE_URL_REWRITE = true; + TRUSTED_PROXY_HEADERS = "HOST,X-REAL-IP,X-FORWARDED-FOR,X-FORWARDED-HOST,X-FORWARDED-SERVER"; + TRUSTED_PROXY_NETWORKS = "192.168.80.0/24,192.168.88.0/24"; + }; + }; + }; +} |