Add forgejo and n8n services to nas
This commit is contained in:
parent
f79bc2a006
commit
d4f9418569
|
@ -42,6 +42,7 @@ let
|
|||
};
|
||||
nixos-config.file = toString ./nas/configuration.nix;
|
||||
"hardware.nix".file = toString ./nas/hardware.nix;
|
||||
"n8n.nix".file = toString ./nas/nixpkgs/n8n.nix;
|
||||
}
|
||||
];
|
||||
|
||||
|
|
|
@ -1,11 +1,14 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
disabledModules = [ "services/misc/n8n.nix" ];
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware.nix
|
||||
<home-manager/nixos>
|
||||
<n8n.nix>
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
auto-optimise-store = true;
|
||||
|
@ -31,6 +34,10 @@
|
|||
n8n = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
webhookUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||
settings = {
|
||||
editorBaseUrl = "https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||
};
|
||||
};
|
||||
nfs.server.enable = true;
|
||||
samba-wsdd.enable = true;
|
||||
|
@ -93,35 +100,50 @@
|
|||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
# other Nginx options
|
||||
virtualHosts."n8n.gmem.ca" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
acmeRoot = null;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5678";
|
||||
logError = "/var/log/nginx/debug.log info";
|
||||
# We can only proxy one port with Tailscale Funnel so we abuse locations instead.
|
||||
virtualHosts."vancouver.gmem.ca" = {
|
||||
default = true;
|
||||
enableACME = false;
|
||||
forceSSL = false;
|
||||
locations."/git/" = {
|
||||
proxyWebsockets = false; # needed if you need to use WebSocket
|
||||
extraConfig =
|
||||
''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
proxyPass = "http://127.0.0.1:8973/";
|
||||
};
|
||||
locations."/n8n/" = {
|
||||
proxyPass = "http://127.0.0.1:5678/";
|
||||
proxyWebsockets = true; # needed if you need to use WebSocket
|
||||
extraConfig =
|
||||
# required when the target is also TLS server with multiple hosts
|
||||
# "proxy_ssl_server_name on;" +
|
||||
# required when the server wants to use HTTP Authentication
|
||||
"proxy_pass_header Authorization;"
|
||||
;
|
||||
''
|
||||
proxy_pass_header Authorization;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
gitea = {
|
||||
enable = true;
|
||||
stateDir = "/Primary/gitea";
|
||||
package = pkgs.forgejo;
|
||||
settings = {
|
||||
server = {
|
||||
ROOT_URL = "https://vancouver.scorpion-ghost.ts.net/git/";
|
||||
HTTP_PORT = 8973;
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true;
|
||||
COOKIE_SECURE = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = { email = "acme@gmem.ca";
|
||||
dnsProvider = "route53";
|
||||
credentialsFile = "/Primary/gabriel/.aws/credentials";
|
||||
# We don't need to wait for propagation since this is a local DNS server
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostId = "e1e29bf4";
|
||||
|
@ -144,6 +166,8 @@
|
|||
lm_sensors
|
||||
screen
|
||||
nix-output-monitor
|
||||
cifs-utils
|
||||
# atuin
|
||||
];
|
||||
|
||||
time.timeZone = "Europe/London";
|
||||
|
|
93
krops/nas/nixpkgs/n8n.nix
Normal file
93
krops/nas/nixpkgs/n8n.nix
Normal file
|
@ -0,0 +1,93 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.n8n;
|
||||
format = pkgs.formats.json {};
|
||||
configFile = format.generate "n8n.json" cfg.settings;
|
||||
in
|
||||
{
|
||||
options.services.n8n = {
|
||||
enable = mkEnableOption (lib.mdDoc "n8n server");
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Open ports in the firewall for the n8n web interface.";
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = format.type;
|
||||
default = {};
|
||||
description = lib.mdDoc ''
|
||||
Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
|
||||
for supported values.
|
||||
'';
|
||||
};
|
||||
|
||||
webhookUrl = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = lib.mdDoc ''
|
||||
WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
|
||||
This cannot be set through configuration and must reside in an environment variable.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.n8n.settings = {
|
||||
# We use this to open the firewall, so we need to know about the default at eval time
|
||||
port = lib.mkDefault 5678;
|
||||
};
|
||||
|
||||
systemd.services.n8n = {
|
||||
description = "N8N service";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = {
|
||||
# This folder must be writeable as the application is storing
|
||||
# its data in it, so the StateDirectory is a good choice
|
||||
N8N_USER_FOLDER = "/var/lib/n8n";
|
||||
HOME = "/var/lib/n8n";
|
||||
N8N_CONFIG_FILES = "${configFile}";
|
||||
WEBHOOK_URL = "${cfg.webhookUrl}";
|
||||
VUE_APP_URL_BASE_API="https://vancouver.scorpion-ghost.ts.net/n8n/";
|
||||
N8N_PATH="/n8n/";
|
||||
# Don't phone home
|
||||
N8N_DIAGNOSTICS_ENABLED = "false";
|
||||
N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.n8n}/bin/n8n";
|
||||
Restart = "on-failure";
|
||||
StateDirectory = "n8n";
|
||||
|
||||
# Basic Hardening
|
||||
NoNewPrivileges = "yes";
|
||||
PrivateTmp = "yes";
|
||||
PrivateDevices = "yes";
|
||||
DevicePolicy = "closed";
|
||||
DynamicUser = "true";
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = "read-only";
|
||||
ProtectControlGroups = "yes";
|
||||
ProtectKernelModules = "yes";
|
||||
ProtectKernelTunables = "yes";
|
||||
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
|
||||
RestrictNamespaces = "yes";
|
||||
RestrictRealtime = "yes";
|
||||
RestrictSUIDSGID = "yes";
|
||||
MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
|
||||
LockPersonality = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [ cfg.settings.port ];
|
||||
};
|
||||
};
|
||||
}
|
Loading…
Reference in a new issue