111 lines
3.4 KiB
Nix
111 lines
3.4 KiB
Nix
{
|
|
self,
|
|
hostPath,
|
|
tree,
|
|
lib,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (lib.attrsets) attrValues;
|
|
|
|
containerAddresses = import "${hostPath}/data/containerAddresses.nix";
|
|
hostIP = containerAddresses.host;
|
|
containerIP = containerAddresses.containers.storage;
|
|
|
|
# 32GB
|
|
clientMaxBodySize = "${toString (8192 * 4)}M";
|
|
|
|
ports = import ./data/ports.nix;
|
|
in {
|
|
containers.storage = {
|
|
autoStart = true;
|
|
privateNetwork = true;
|
|
hostAddress = hostIP;
|
|
localAddress = containerIP;
|
|
|
|
specialArgs = {
|
|
inherit inputs;
|
|
inherit tree;
|
|
inherit self;
|
|
inherit hostPath;
|
|
};
|
|
|
|
config = {...}: {
|
|
nixpkgs.pkgs = pkgs;
|
|
|
|
imports = with tree;
|
|
[
|
|
presets.nixos.containerBase
|
|
|
|
profiles.sshd
|
|
profiles.firewallAllow.ssh
|
|
|
|
./secrets.nix
|
|
]
|
|
++ (with hosts.hetzner-arm.containers.storage.profiles; [
|
|
rcloneConfigs
|
|
rcloneServe
|
|
rcloneSync
|
|
users
|
|
]);
|
|
|
|
environment.systemPackages = with pkgs; [rclone];
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = attrValues ports;
|
|
};
|
|
|
|
home-manager.users.root.home.stateVersion = "23.05";
|
|
system.stateVersion = "23.05";
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."storage-webdav.owo.monster" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations = {
|
|
"/Main/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_webdav_main}";
|
|
"/Media/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_webdav_media}";
|
|
"/MusicRO/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_webdav_music_ro}";
|
|
"/Public/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_webdav_public}";
|
|
"/Uploads/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_webdav_uploads}";
|
|
};
|
|
extraConfig = ''
|
|
client_max_body_size ${clientMaxBodySize};
|
|
'';
|
|
};
|
|
|
|
services.nginx.virtualHosts."storage-http.owo.monster" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations = {
|
|
"/Music/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_http_music}";
|
|
"/Public/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_http_public}";
|
|
"/Uploads/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_http_uploads_public}";
|
|
};
|
|
extraConfig = ''
|
|
client_max_body_size ${clientMaxBodySize};
|
|
'';
|
|
};
|
|
|
|
services.nginx.virtualHosts."storage-restic.owo.monster" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations = {
|
|
"/Music/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_music}";
|
|
"/Vault/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_vault}";
|
|
"/Social/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_social}";
|
|
"/Quassel/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_quassel}";
|
|
"/PostgreSQL/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_postgresql}";
|
|
"/Mail/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_mail}";
|
|
"/Forgejo/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_forgejo}";
|
|
"/CalDAV/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_caldav}";
|
|
};
|
|
extraConfig = ''
|
|
client_max_body_size ${clientMaxBodySize};
|
|
'';
|
|
};
|
|
}
|