Add forgejo and n8n services to nas
This commit is contained in:
parent
f79bc2a006
commit
d4f9418569
|
@ -42,6 +42,7 @@ let
|
||||||
};
|
};
|
||||||
nixos-config.file = toString ./nas/configuration.nix;
|
nixos-config.file = toString ./nas/configuration.nix;
|
||||||
"hardware.nix".file = toString ./nas/hardware.nix;
|
"hardware.nix".file = toString ./nas/hardware.nix;
|
||||||
|
"n8n.nix".file = toString ./nas/nixpkgs/n8n.nix;
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -1,11 +1,14 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
|
disabledModules = [ "services/misc/n8n.nix" ];
|
||||||
imports =
|
imports =
|
||||||
[ # Include the results of the hardware scan.
|
[ # Include the results of the hardware scan.
|
||||||
./hardware.nix
|
./hardware.nix
|
||||||
<home-manager/nixos>
|
<home-manager/nixos>
|
||||||
|
<n8n.nix>
|
||||||
];
|
];
|
||||||
|
|
||||||
nix = {
|
nix = {
|
||||||
settings = {
|
settings = {
|
||||||
auto-optimise-store = true;
|
auto-optimise-store = true;
|
||||||
|
@ -31,6 +34,10 @@
|
||||||
n8n = {
|
n8n = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
|
webhookUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||||
|
settings = {
|
||||||
|
editorBaseUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
nfs.server.enable = true;
|
nfs.server.enable = true;
|
||||||
samba-wsdd.enable = true;
|
samba-wsdd.enable = true;
|
||||||
|
@ -93,35 +100,50 @@
|
||||||
};
|
};
|
||||||
nginx = {
|
nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
recommendedProxySettings = true;
|
logError = "/var/log/nginx/debug.log info";
|
||||||
recommendedTlsSettings = true;
|
# We can only proxy one port with Tailscale Funnel so we abuse locations instead.
|
||||||
# other Nginx options
|
virtualHosts."vancouver.gmem.ca" = {
|
||||||
virtualHosts."n8n.gmem.ca" = {
|
default = true;
|
||||||
enableACME = true;
|
enableACME = false;
|
||||||
forceSSL = true;
|
forceSSL = false;
|
||||||
acmeRoot = null;
|
locations."/git/" = {
|
||||||
locations."/" = {
|
proxyWebsockets = false; # needed if you need to use WebSocket
|
||||||
proxyPass = "http://127.0.0.1:5678";
|
extraConfig =
|
||||||
|
''
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
'';
|
||||||
|
proxyPass = "http://127.0.0.1:8973/";
|
||||||
|
};
|
||||||
|
locations."/n8n/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:5678/";
|
||||||
proxyWebsockets = true; # needed if you need to use WebSocket
|
proxyWebsockets = true; # needed if you need to use WebSocket
|
||||||
extraConfig =
|
extraConfig =
|
||||||
# required when the target is also TLS server with multiple hosts
|
''
|
||||||
# "proxy_ssl_server_name on;" +
|
proxy_pass_header Authorization;
|
||||||
# required when the server wants to use HTTP Authentication
|
'';
|
||||||
"proxy_pass_header Authorization;"
|
};
|
||||||
;
|
};
|
||||||
|
};
|
||||||
|
gitea = {
|
||||||
|
enable = true;
|
||||||
|
stateDir = "/Primary/gitea";
|
||||||
|
package = pkgs.forgejo;
|
||||||
|
settings = {
|
||||||
|
server = {
|
||||||
|
ROOT_URL = "https://vancouver.scorpion-ghost.ts.net/git/";
|
||||||
|
HTTP_PORT = 8973;
|
||||||
|
};
|
||||||
|
service = {
|
||||||
|
DISABLE_REGISTRATION = true;
|
||||||
|
COOKIE_SECURE = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
security.acme = {
|
|
||||||
acceptTerms = true;
|
|
||||||
defaults = { email = "acme@gmem.ca";
|
|
||||||
dnsProvider = "route53";
|
|
||||||
credentialsFile = "/Primary/gabriel/.aws/credentials";
|
|
||||||
# We don't need to wait for propagation since this is a local DNS server
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
hostId = "e1e29bf4";
|
hostId = "e1e29bf4";
|
||||||
|
@ -144,6 +166,8 @@
|
||||||
lm_sensors
|
lm_sensors
|
||||||
screen
|
screen
|
||||||
nix-output-monitor
|
nix-output-monitor
|
||||||
|
cifs-utils
|
||||||
|
# atuin
|
||||||
];
|
];
|
||||||
|
|
||||||
time.timeZone = "Europe/London";
|
time.timeZone = "Europe/London";
|
||||||
|
|
93
krops/nas/nixpkgs/n8n.nix
Normal file
93
krops/nas/nixpkgs/n8n.nix
Normal file
|
@ -0,0 +1,93 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.n8n;
|
||||||
|
format = pkgs.formats.json {};
|
||||||
|
configFile = format.generate "n8n.json" cfg.settings;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.services.n8n = {
|
||||||
|
enable = mkEnableOption (lib.mdDoc "n8n server");
|
||||||
|
|
||||||
|
openFirewall = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = lib.mdDoc "Open ports in the firewall for the n8n web interface.";
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
type = format.type;
|
||||||
|
default = {};
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
|
||||||
|
for supported values.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
webhookUrl = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
|
||||||
|
This cannot be set through configuration and must reside in an environment variable.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
services.n8n.settings = {
|
||||||
|
# We use this to open the firewall, so we need to know about the default at eval time
|
||||||
|
port = lib.mkDefault 5678;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.n8n = {
|
||||||
|
description = "N8N service";
|
||||||
|
after = [ "network.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
environment = {
|
||||||
|
# This folder must be writeable as the application is storing
|
||||||
|
# its data in it, so the StateDirectory is a good choice
|
||||||
|
N8N_USER_FOLDER = "/var/lib/n8n";
|
||||||
|
HOME = "/var/lib/n8n";
|
||||||
|
N8N_CONFIG_FILES = "${configFile}";
|
||||||
|
WEBHOOK_URL = "${cfg.webhookUrl}";
|
||||||
|
VUE_APP_URL_BASE_API="https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||||
|
N8N_PATH="/n8n/";
|
||||||
|
# Don't phone home
|
||||||
|
N8N_DIAGNOSTICS_ENABLED = "false";
|
||||||
|
N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
ExecStart = "${pkgs.n8n}/bin/n8n";
|
||||||
|
Restart = "on-failure";
|
||||||
|
StateDirectory = "n8n";
|
||||||
|
|
||||||
|
# Basic Hardening
|
||||||
|
NoNewPrivileges = "yes";
|
||||||
|
PrivateTmp = "yes";
|
||||||
|
PrivateDevices = "yes";
|
||||||
|
DevicePolicy = "closed";
|
||||||
|
DynamicUser = "true";
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
ProtectHome = "read-only";
|
||||||
|
ProtectControlGroups = "yes";
|
||||||
|
ProtectKernelModules = "yes";
|
||||||
|
ProtectKernelTunables = "yes";
|
||||||
|
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
|
||||||
|
RestrictNamespaces = "yes";
|
||||||
|
RestrictRealtime = "yes";
|
||||||
|
RestrictSUIDSGID = "yes";
|
||||||
|
MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
|
||||||
|
LockPersonality = "yes";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall = mkIf cfg.openFirewall {
|
||||||
|
allowedTCPPorts = [ cfg.settings.port ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue