ktiu/omniflake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'refs/remotes/origin/main'

Browse source
This commit is contained in:
Till 2025-10-13 16:28:48 +02:00
commit 7f358ab0c5
29 changed files with 337 additions and 192 deletions
Download patch file Download diff file Expand all files Collapse all files

54
system/web-server/dex.nix Normal file
View file

@ -0,0 +1,54 @@
{ config, pkgs, ... }:
let
dex = {
hostname = "dex.${config.networking.domain}";
};
in {
services.dex = {
enable = true;
environmentFile = "/var/custom-access/dex-environemnt";
settings = {
issuer = "https://${dex.hostname}";
storage.type = "sqlite3";
web.http = "127.0.0.1:5556";
staticClients = [
{
id = "outline";
name = "Outline Client";
redirectURIs = [ "https://${outline.hostname}/auth/oidc.callback" ];
secretFile = "/var/custom-access/outline-oidc-secret.txt";
}
];
enablePasswordDB = true;
# staticPasswords = [
# {
# email = "till@ktiu.net";
# # gen hash with $ htpasswd -nBC 10 "" | tr -d ':\n'
# hash = "";
# username = "bootstrap-admin";
# # $ uuidgen
# userID = "";
# }
# ];
};
};
security.acme.certs."${config.networking.domain}".extraDomainNames = [
"dex.${config.networking.domain}"
];
services.nginx.virtualHosts = {
"dex.${config.networking.domain}" = {
onlySSL = true;
useACMEHost = config.networking.domain;
locations."/" = {
proxyPass = "http://${config.services.dex.settings.web.http}";
proxyWebsockets = true;
};
};
};
}

2
system/web-server/ksh-map.nix
View file

@ -1,7 +1,7 @@
{ config, pkgs, ... }:
{
services.nginx.virtualHosts."karte.nichtzudritt.de" = {
services.nginx.virtualHosts."kshmap.ktiu.net" = {
forceSSL = true;
enableACME = true;
root = "/var/www/ksh-map/dist";

14
system/web-server/mail/postfix.nix
View file

@ -2,13 +2,13 @@
let
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
/^Received:/ IGNORE
/^X-Originating-IP:/ IGNORE
/^X-Mailer:/ IGNORE
/^User-Agent:/ IGNORE
/^X-Enigmail:/ IGNORE
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@ktiu.net>
submissionheadercleanuprules = pkgs.writetext "submission_header_cleanup_rules" ''
/^received:/ ignore
/^x-originating-ip:/ ignore
/^x-mailer:/ ignore
/^user-agent:/ ignore
/^x-enigmail:/ ignore
/^message-id:\s+<(.*?)@.*?>/ replace message-id: <$1@ktiu.net>
'';
in {

43
system/web-server/outline.nix
View file

@ -7,11 +7,6 @@ let
mail = "outline@${config.networking.domain}";
};
# bootstrapping only
# dex = {
# hostname = "dex.${config.networking.domain}";
# };
in {
services.outline = {
@ -42,38 +37,8 @@ in {
# };
};
# services.dex = {
# enable = true;
# environmentFile = "/var/custom-access/dex-environemnt";
# settings = {
# issuer = "https://${dex.hostname}";
# storage.type = "sqlite3";
# web.http = "127.0.0.1:5556";
# staticClients = [
# {
# id = "outline";
# name = "Outline Client";
# redirectURIs = [ "https://${outline.hostname}/auth/oidc.callback" ];
# secretFile = "/var/custom-access/outline-oidc-secret.txt";
# }
# ];
# enablePasswordDB = true;
# staticPasswords = [
# {
# email = "till@ktiu.net";
# # gen hash with $ htpasswd -nBC 10 "" | tr -d ':\n'
# hash = "";
# username = "bootstrap-admin";
# # $ uuidgen
# userID = "";
# }
# ];
# };
# };
security.acme.certs."${config.networking.domain}".extraDomainNames = [
"outline.${config.networking.domain}"
# "dex.${config.networking.domain}"
];
services.nginx.virtualHosts = {
@ -89,13 +54,5 @@ in {
};
};
# "dex.${config.networking.domain}" = {
# onlySSL = true;
# useACMEHost = config.networking.domain;
# locations."/" = {
# proxyPass = "http://${config.services.dex.settings.web.http}";
# proxyWebsockets = true;
# };
# };
};
}