more server stuff

flake.nix

@@ -75,10 +75,12 @@
           ./system/hardware/arielle.nix
           ./system
           ./system/web-server
+          ./system/web-server/radicale.nix
           ./system/web-server/outline.nix
           ./system/web-server/jenkins.nix
           ./system/web-server/mail.nix
           ./system/web-server/ksh-map.nix
+          ./system/web-server/fundkorb-button.nix
         ];
       };
 

system/web-server/fundkorb-button.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }:
+
+{
+  services.nginx.virtualHosts."fundkorb.ktiu.net" = {
+    addSSL = true;
+    enableACME = true;
+    root = "/var/www/fundkorb-button/html";
+    location."/" = {
+      basicAuth = "Fundkorb build trigger";
+      basicAuthFile = "/var/www/fundkorb-button/.htpasswd";
+    };
+  };
+}

system/web-server/mail.nix

@@ -32,10 +32,13 @@ in {
     enable = true;
     virtualHosts = {
       "ktiu.net" = {
-        addSSL = true;
+        forceSSL = true;
         enableACME = true;
         locations."/" = {
-          return = "418 'Ich bin eine Teekanne.'";
+          return = "200 'This domain used for e-mail hosting only.'";
+          extraConfig = ''
+            add_header Content-Type text/plain;
+          '';
         };
       };
       "${config.networking.fqdn}" = {
@@ -45,7 +48,8 @@ in {
           root = "/var/lib/acme/.challenges";
         };
         locations."/" = {
-          return = "301 http://${config.networking.domain}";
+          # return = "301 http://${config.networking.domain}";
+          return = "404";
         };
       };
     };

system/web-server/outline.nix

@@ -2,18 +2,17 @@
 
 {
 
-  # services.outline = {
+  services.outline = {
-  #   enable = true;
+    enable = true;
-  #   storage.storageType = "local";
+    storage.storageType = "local";
     # smtp = {
     #   host = "localhost";
     # };
-  # };
+  };
 
   services.nginx.virtualHosts."outline.ktiu.net" = {
     addSSL = true;
     enableACME = true;
-    # root = "/var/www/myhost.org";
     locations."/" = {
       proxyPass = "http://127.0.0.1:3000";
       extraConfig = 

system/web-server/radicale.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, ... }:
+
+{
+  services.nginx.virtualHosts."kalender.ktiu.net" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:5232/";
+      extraConfig = ''
+        proxy_set_header X-Script-Name /;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_pass_header Authorization;
+      '';
+    };
+  };
+
+  services.radicale = {
+    enable = true;
+    settings = {
+      server = {
+        hosts = [ "0.0.0.0:5232" "[::]:5232" ];
+      };
+      auth = {
+        type = "htpasswd";
+        htpasswd_filename = "/etc/radicale/users";
+        htpasswd_encryption = "bcrypt";
+      };
+      storage = {
+        filesystem_folder = "/var/lib/radicale/collections";
+      };
+    };
+  };
+
+}