Init commit

2026-07-02 12:46:42 +00:00 · 2023-10-08 11:42:08 +02:00
commit bf276c349f
56 changed files with 6779 additions and 0 deletions
@@ -0,0 +1,169 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, materusFlake, ... }:
+
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./pleroma.nix
+          ];
+
+  materus.profile.nix.enable = true;
+
+
+
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  # boot.loader.grub.efiSupport = true;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  networking.hostName = "valkyrie"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable = false; # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  time.timeZone = "Europe/Warsaw";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "pl_PL.UTF-8";
+  console = {
+    font = "lat2-16";
+    keyMap = "pl";
+    useXkbConfig = false; # use xkbOptions in tty.
+  };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+
+
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.materus = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = with pkgs; [
+    ];
+    openssh.authorizedKeys.keyFiles = [ (materusFlake.selfPath + /extraFiles/keys/ssh/materus.pub) ];
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    nano
+    git
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.openFirewall = false;
+  services.openssh.settings.PermitRootLogin = "no";
+  services.openssh.settings.PasswordAuthentication = true;
+
+
+  services.adguardhome.enable = true;
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = true;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+
+  services.nginx = {
+    enable = true;
+    package = pkgs.tengine;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15;
+    enableTCPIP = true;
+    authentication = pkgs.lib.mkOverride 10 ''
+      local all all trust
+    '';
+  };
+
+
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "materus+acme@podkos.pl";
+  security.acme.certs."materus.pl" = {
+    domain = "materus.pl";
+    group = "nginx";
+    extraDomainNames = [ "*.materus.pl" ];
+    dnsProvider = "ovh";
+    credentialsFile = "/materus/config/private/valkyrie/certs.secret";
+  };
+
+  security.acme.certs."podkos.pl" = {
+    domain = "podkos.pl";
+    group = "nginx";
+    extraDomainNames = [ "*.podkos.pl" ];
+    dnsProvider = "ovh";
+    credentialsFile = "/materus/config/private/valkyrie/certs.secret";
+  };
+
+  security.acme.certs."podkos.xyz" = {
+    domain = "podkos.xyz";
+    group = "nginx";
+    extraDomainNames = [ "*.podkos.xyz" ];
+    dnsProvider = "ovh";
+    credentialsFile = "/materus/config/private/valkyrie/certs.secret";
+  };
+
+}
+
@@ -0,0 +1,16 @@
+{ config, pkgs, materusPkgs, lib, ... }:
+{
+  home.stateVersion = "23.05";
+  home.homeDirectory = "/home/materus";
+  materus.profile = {
+    fonts.enable = false;
+    nixpkgs.enable = false;
+    enableDesktop = false;
+    enableTerminal = false;
+    enableTerminalExtra = false;
+    enableNixDevel = false;
+
+    fish.enable = true;
+    bash.enable = true;
+  };
+}
@@ -0,0 +1,47 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernel.sysctl = { "net.ipv4.ip_forward" = 1; };
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = true;
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/924b1a69-2256-444f-baf6-d2d9405e451d";
+      fsType = "ext4";
+    };
+
+  fileSystems."/etc/nixos" =
+    {
+      device = "/materus/config/nixos-config";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 4 * 1024;
+    }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = false;
+  networking.nameservers = [ "9.9.9.9" "1.1.1.1" "8.8.8.8" ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
@@ -0,0 +1,146 @@
+{ config, pkgs, lib, materusFlake, ... }:
+let
+
+  socketPath = "/run/pleroma/http.sock";
+
+
+  socketChmod = with pkgs; with lib; pkgs.writers.writeBashBin "pleroma-socket"
+    ''
+      coproc {
+          ${inotify-tools}/bin/inotifywait -q -m -e create ${escapeShellArg (dirOf socketPath)}
+        }
+
+        trap 'kill "$COPROC_PID"' EXIT TERM
+
+        until ${pkgs.coreutils}/bin/test -S ${escapeShellArg socketPath}
+          do read -r -u "''${COPROC[0]}"
+        done
+
+      ${pkgs.coreutils}/bin/chmod 0666 ${socketPath}
+    '';
+
+  soapbox = pkgs.stdenv.mkDerivation rec {
+    pname = "soapbox";
+    version = "v3.2.0";
+    dontBuild = true;
+    dontConfigure = true;
+    src = pkgs.fetchurl {
+      name = "soapbox";
+      url = "https://gitlab.com/soapbox-pub/soapbox/-/jobs/artifacts/${version}/download?job=build-production";
+      sha256 = "sha256-AdW6JK7JkIKLZ8X+N9STeOHqmGNUdhcXyC9jsQPTa9o=";
+    };
+    nativeBuildInputs = [pkgs.unzip];
+    unpackPhase = ''
+    unzip $src -d .
+    '';
+    installPhase = ''
+    mv ./static $out
+    '';
+
+  };
+
+in
+{
+  systemd.tmpfiles.rules = [
+    "d    /var/lib/pleroma   0766    pleroma    pleroma     -"
+    "d    /var/lib/pleroma/static   0766    pleroma    pleroma     -"
+    "d    /var/lib/pleroma/uploads   0766    pleroma    pleroma     -"
+    "L+   /var/lib/pleroma/static/frontends/soapbox/${soapbox.version}  0766 pleroma pleroma - ${soapbox}"
+  ];
+
+  services.nginx.virtualHosts."podkos.xyz" = {
+    http2 = true;
+    useACMEHost = "podkos.xyz";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://unix:${socketPath}";
+      extraConfig = ''
+        etag on;
+        gzip on;
+
+        add_header 'Access-Control-Allow-Origin' '*' always;
+        add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
+        add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
+        if ($request_method = OPTIONS) {
+          return 204;
+        }
+
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+        add_header Referrer-Policy same-origin;
+        add_header X-Download-Options noopen;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+
+        client_max_body_size 8m;
+      
+      
+      '';
+    };
+
+  };
+  systemd.services.pleroma.serviceConfig = {
+    RuntimeDirectory = "pleroma";
+    RuntimeDirectoryPreserve = true;
+
+
+    ExecStartPost = "${socketChmod}/bin/pleroma-socket";
+    ExecStopPost = ''${pkgs.coreutils}/bin/rm -f ${socketPath}'';
+  };
+
+
+
+
+  services.pleroma = {
+    enable = true;
+    secretConfigFile = "/var/lib/pleroma/secrets.exs";
+    configs = [
+      ''
+        import Config
+
+        config :pleroma, Pleroma.Web.Endpoint,
+          url: [host: "podkos.xyz", scheme: "https", port: 443],
+          http: [ip: {:local, "${socketPath}"}, port: 0]
+
+        config :pleroma, :instance,
+          name: "Podziemia Kosmosu",
+          email: "admin@podkos.xyz",
+          notify_email: "noreply@podkos.xyz",
+          limit: 5000,
+          registrations_open: false
+
+        config :pleroma, :media_proxy,
+          enabled: false,
+          redirect_on_failure: true
+
+        config :pleroma, Pleroma.Repo,
+          adapter: Ecto.Adapters.Postgres,
+          socket: "/run/postgresql/.s.PGSQL.5432",
+          username: "pleroma",
+          database: "pleroma"
+          
+
+        # Configure web push notifications
+        config :web_push_encryption, :vapid_details,
+          subject: "mailto:admin@podkos.x yz"
+        config :pleroma, :frontends,
+          primary: %{
+            "name" => "soapbox",
+            "ref" => "${soapbox.version}"
+          }
+
+        config :pleroma, :database, rum_enabled: false
+        config :pleroma, :instance, static_dir: "/var/lib/pleroma/static"
+        config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads"
+
+        config :pleroma, configurable_from_database: true  
+        config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.AnonymizeFilename]
+      ''
+    ];
+  };
+}