Add forgejo and n8n services to nas

krops/krops.nix

@@ -42,6 +42,7 @@ let
       };
       nixos-config.file = toString ./nas/configuration.nix;
       "hardware.nix".file = toString ./nas/hardware.nix;
+      "n8n.nix".file = toString ./nas/nixpkgs/n8n.nix;
     }
   ];
   

krops/nas/configuration.nix

@@ -1,11 +1,14 @@
 { config, pkgs, ... }:
 
 {
+  disabledModules = [ "services/misc/n8n.nix" ];
   imports =
     [ # Include the results of the hardware scan.
       ./hardware.nix
       <home-manager/nixos>
+      <n8n.nix>
     ];
+
   nix = {
     settings = {
       auto-optimise-store = true;
@@ -31,6 +34,10 @@
     n8n = {
       enable = true;
       openFirewall = true;
+      webhookUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
+      settings = {
+        editorBaseUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
+      };
     };
     nfs.server.enable = true;
     samba-wsdd.enable = true;
@@ -93,35 +100,50 @@
     };
     nginx = {
       enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      # other Nginx options
-      virtualHosts."n8n.gmem.ca" =  {
-        enableACME = true;
-        forceSSL = true;
-        acmeRoot = null;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:5678";
+      logError = "/var/log/nginx/debug.log info";
+      # We can only proxy one port with Tailscale Funnel so we abuse locations instead.
+      virtualHosts."vancouver.gmem.ca" =  {
+        default = true;
+        enableACME = false;
+        forceSSL = false;
+        locations."/git/" = {
+          proxyWebsockets = false; # needed if you need to use WebSocket
+          extraConfig =
+            ''
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            '';
+          proxyPass = "http://127.0.0.1:8973/";
+        };
+        locations."/n8n/" = {
+          proxyPass = "http://127.0.0.1:5678/";
           proxyWebsockets = true; # needed if you need to use WebSocket
           extraConfig =
-            # required when the target is also TLS server with multiple hosts
-            # "proxy_ssl_server_name on;" +
-            # required when the server wants to use HTTP Authentication
-            "proxy_pass_header Authorization;"
-          ;
+            ''
+            proxy_pass_header Authorization;
+            '';
+        };
+      };
+    };
+    gitea = {
+      enable = true;
+      stateDir = "/Primary/gitea";
+      package = pkgs.forgejo;
+      settings = {
+        server = {
+          ROOT_URL = "https://vancouver.scorpion-ghost.ts.net/git/";
+          HTTP_PORT = 8973;
+        };
+        service = {
+          DISABLE_REGISTRATION = true;
+          COOKIE_SECURE = true;
         };
       };
     };
   };
 
-  security.acme = {
-    acceptTerms = true;
-    defaults = { email = "acme@gmem.ca";
-                 dnsProvider = "route53";
-                 credentialsFile = "/Primary/gabriel/.aws/credentials";
-                 # We don't need to wait for propagation since this is a local DNS server
-               };
-  };
 
   networking = {
     hostId = "e1e29bf4";
@@ -144,6 +166,8 @@
     lm_sensors
     screen
     nix-output-monitor
+    cifs-utils
+    # atuin
   ];
 
   time.timeZone = "Europe/London";

krops/nas/nixpkgs/n8n.nix

@@ -0,0 +1,93 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.n8n;
+  format = pkgs.formats.json {};
+  configFile = format.generate "n8n.json" cfg.settings;
+in
+{
+  options.services.n8n = {
+    enable = mkEnableOption (lib.mdDoc "n8n server");
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc "Open ports in the firewall for the n8n web interface.";
+    };
+
+    settings = mkOption {
+      type = format.type;
+      default = {};
+      description = lib.mdDoc ''
+        Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
+        for supported values.
+      '';
+    };
+
+    webhookUrl = mkOption {
+      type = types.str;
+      default = "";
+      description = lib.mdDoc ''
+        WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
+        This cannot be set through configuration and must reside in an environment variable.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    services.n8n.settings = {
+      # We use this to open the firewall, so we need to know about the default at eval time
+      port = lib.mkDefault 5678;
+    };
+
+    systemd.services.n8n = {
+      description = "N8N service";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        # This folder must be writeable as the application is storing
+        # its data in it, so the StateDirectory is a good choice
+        N8N_USER_FOLDER = "/var/lib/n8n";
+        HOME = "/var/lib/n8n";
+        N8N_CONFIG_FILES = "${configFile}";
+        WEBHOOK_URL = "${cfg.webhookUrl}";
+        VUE_APP_URL_BASE_API="https://vancouver.scorpion-ghost.ts.net/n8n/";
+        N8N_PATH="/n8n/";
+        # Don't phone home
+        N8N_DIAGNOSTICS_ENABLED = "false";
+        N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
+      };
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.n8n}/bin/n8n";
+        Restart = "on-failure";
+        StateDirectory = "n8n";
+
+        # Basic Hardening
+        NoNewPrivileges = "yes";
+        PrivateTmp = "yes";
+        PrivateDevices = "yes";
+        DevicePolicy = "closed";
+        DynamicUser = "true";
+        ProtectSystem = "strict";
+        ProtectHome = "read-only";
+        ProtectControlGroups = "yes";
+        ProtectKernelModules = "yes";
+        ProtectKernelTunables = "yes";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+        RestrictNamespaces = "yes";
+        RestrictRealtime = "yes";
+        RestrictSUIDSGID = "yes";
+        MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
+        LockPersonality = "yes";
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.port ];
+    };
+  };
+}