nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixed cl-gemini on procul

Browse Source
This commit is contained in:
root@procul
2021-04-16 00:15:31 -05:00
parent 145996cf38
commit 8cac965a21
20 changed files with 383 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/fudo/dns.nix
+7 -2
View File
@@ -120,6 +120,11 @@ in {
};
config = mkIf cfg.enable {
networking.firewall = {
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 ];
};
services.nsd = {
enable = true;
identity = cfg.identity;
@@ -135,9 +140,9 @@ in {
@ IN SOA ns1.${dom}. hostmaster.${dom}. (
${toString builtins.currentTime}
5m
30m
2m
6w
3w
5m)
${optionalString (dom-cfg.default-host != null)
lib/fudo/git.nix
+9 -9
View File
@@ -120,15 +120,15 @@ in {
enable = true;
clonePort = cfg.ssh.listen-port;
};
# settings = mkIf (cfg.ssh != null) {
# server = {
# START_SSH_SERVER = true;
# SSH_DOMAIN = cfg.hostname;
# SSH_PORT = cfg.ssh.listen-port;
# SSH_LISTEN_PORT = cfg.ssh.listen-port;
# SSH_LISTEN_HOST = cfg.ssh.listen-ip;
# };
# };
settings = mkIf (cfg.ssh != null) {
server = {
START_SSH_SERVER = true;
SSH_DOMAIN = cfg.hostname;
# SSH_PORT = cfg.ssh.listen-port;
SSH_LISTEN_PORT = cfg.ssh.listen-port;
SSH_LISTEN_HOST = cfg.ssh.listen-ip;
};
};
};
nginx = {
lib/fudo/kdc.nix
+1 -1
View File
@@ -32,7 +32,7 @@ let
pkgs.writeShellScript "initialize-kdc-db.sh" ''
if [ ! -e ${key-file} ]; then
${pkgs.heimdalFull}/bin/kstash --key-file=${key-file} --random-key
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- init --realm-max-ticket-life="${max-lifetime}" --realm-max-renewable-life="${max-renewal}" RUS.SELBY.CA
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- init --realm-max-ticket-life="${max-lifetime}" --realm-max-renewable-life="${max-renewal}" ${realm}
${add-hosts-principals realm kdc-conf}
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- ext_keytab --keytab=${primary-keytab} */${local-hostname}@${realm}
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- ext_keytab --keytab=${kadmin-keytab} kadmin/admin@${realm}
lib/fudo/mail.nix
+4
View File
@@ -177,6 +177,10 @@ in {
];
config = mkIf cfg.enable {
networking.firewall = {
allowedTCPPorts = [ 25 110 143 587 993 995 ];
};
users = {
users = {
mailuser = {
lib/informis/cl-gemini.nix
+66 -99
View File
@@ -4,43 +4,7 @@ with lib;
let
cfg = config.informis.cl-gemini;
lisp-libs = with pkgs.lispPackages; [
asdf-package-system
asdf-system-connections
alexandria
asdf-package-system
asdf-system-connections
cl_plus_ssl
cl-ppcre
quicklisp
quri
uiop
usocket
];
launchServer = ip: port: root: public-dir: key: cert: slynk-port: feeds-string: textfiles-archive:
pkgs.writeText "launch-server.lisp" ''
(load (merge-pathnames "quicklisp/setup.lisp" (user-homedir-pathname)))
(ql:quickload :slynk)
(ql:quickload :cl-gemini)
${optionalString (slynk-port != null) "(slynk:create-server :port ${toString slynk-port} :dont-close t)"}
${feeds-string}
(cl-gemini:start-gemini-server "${ip}" "${key}" "${cert}"
:port ${toString port}
:document-root "${root}"
:textfiles-root "${textfiles-archive}"
:file-cmd "${pkgs.file}/bin/file"
:log-stream *standard-output*
:threaded t
:separate-thread t)
(loop (sleep 60))
'';
sbcl-with-ssl = pkgs.sbcl.overrideAttrs (oldAttrs: rec {
extraLibs = with pkgs; [
openssl_1_1.dev
];
});
lisp-helper = import ../lisp.nix { inherit pkgs; };
feedOpts = with types; {
options = {
@@ -71,6 +35,19 @@ let
concatStringsSep "\n"
(mapAttrsToList register-feed feeds);
ensure-certificates = hostname: user: key: cert: pkgs.writeShellScript "ensure-gemini-certificates.sh" ''
if [[ ! -e ${key} ]]; then
TARGET_CERT_DIR=$(${pkgs.coreutils}/bin/dirname ${cert})
TARGET_KEY_DIR=$(${pkgs.coreutils}/bin/dirname ${key})
if [[ ! -d $TARGET_CERT_DIR ]]; then mkdir -p $TARGET_CERT_DIR; fi
if [[ ! -d $TARGET_KEY_DIR ]]; then mkdir -p $TARGET_KEY_DIR; fi
${pkgs.openssl}/bin/openssl req -new -subj "/CN=.${hostname}" -addext "subjectAltName = DNS:${hostname}, DNS:.${hostname}" -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes -out ${cert} -keyout ${key}
${pkgs.coreutils}/bin/chown -R ${user}:nogroup ${cert}
${pkgs.coreutils}/bin/chown -R ${user}:nogroup ${key}
${pkgs.coreutils}/bin/chmod 0444 ${cert}
${pkgs.coreutils}/bin/chmod 0400 ${key}
fi
'';
in {
options.informis.cl-gemini = with types; {
@@ -82,6 +59,18 @@ in {
default = 1965;
};
hostname = mkOption {
type = str;
description = "Hostname at which the server is available (for generating the SSL certificate).";
example = "my.hostname.com";
};
user = mkOption {
type = str;
description = "User as which to run the cl-gemini server.";
default = "cl-gemini";
};
server-ip = mkOption {
type = str;
description = "IP on which to serve Gemini traffic.";
@@ -101,15 +90,17 @@ in {
};
ssl-private-key = mkOption {
type = path;
type = str;
description = "Path to the pem-encoded server private key.";
example = /path/to/secret/key.pem;
example = "/path/to/secret/key.pem";
default = "${config.users.users.cl-gemini.home}/private/server-key.pem";
};
ssl-certificate = mkOption {
type = path;
type = str;
description = "Path to the pem-encoded server public certificate.";
example = /path/to/cert.pem;
example = "/path/to/cert.pem";
default = "${config.users.users.cl-gemini.home}/private/server-cert.pem";
};
slynk-port = mkOption {
@@ -140,73 +131,49 @@ in {
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
cl-gemini
];
networking.firewall.allowedTCPPorts = [ cfg.port ];
users.users = {
cl-gemini = {
${cfg.user} = {
isSystemUser = true;
group = "nogroup";
createHome = true;
home = "/var/lib/cl-gemini";
home = "/var/lib/${cfg.user}";
};
};
environment.etc = {
"cl-gemini/key.pem" = {
mode = "0400";
user = "cl-gemini";
source = cfg.ssl-private-key;
systemd.services = {
cl-gemini = {
description = "cl-gemini Gemini server (https://gemini.circumlunar.space/)";
serviceConfig = {
ExecStartPre = "${ensure-certificates cfg.hostname cfg.user cfg.ssl-private-key cfg.ssl-certificate}";
ExecStart = "${pkgs.cl-gemini}/bin/launch-server.sh";
Restart = "on-failure";
PIDFile = "/run/cl-gemini.$USERNAME.uid";
User = cfg.user;
};
environment = {
GEMINI_SLYNK_PORT = mkIf (cfg.slynk-port != null) (toString cfg.slynk-port);
GEMINI_LISTEN_IP = cfg.server-ip;
GEMINI_PRIVATE_KEY = cfg.ssl-private-key;
GEMINI_CERTIFICATE = cfg.ssl-certificate;
GEMINI_LISTEN_PORT = toString cfg.port;
GEMINI_DOCUMENT_ROOT = cfg.document-root;
GEMINI_TEXTFILES_ROOT = cfg.textfiles-archive;
CL_SOURCE_REGISTRY = lisp-helper.lisp-source-registry pkgs.cl-gemini;
};
path = with pkgs; [
gcc
file
getent
];
wantedBy = [ "multi-user.target" ];
};
"cl-gemini/cert.pem" = {
mode = "0444";
user = "cl-gemini";
source = cfg.ssl-certificate;
};
};
systemd.services.cl-gemini = {
description = "cl-gemini Gemini server (https://gemini.circumlunar.space/)";
serviceConfig = let
feed-registrations = register-feeds cfg.feeds;
in {
ExecStartPre = "${pkgs.lispPackages.quicklisp}/bin/quicklisp init";
ExecStart = "${sbcl-with-ssl}/bin/sbcl --load ${
launchServer
cfg.server-ip
cfg.port
cfg.document-root
cfg.user-public
"/etc/cl-gemini/key.pem"
"/etc/cl-gemini/cert.pem"
cfg.slynk-port
feed-registrations
cfg.textfiles-archive
}";
Restart = "on-failure";
PIDFile = "/run/cl-gemini.$USERNAME.uid";
User = "cl-gemini";
};
environment = {
LD_LIBRARY_PATH = "${pkgs.openssl_1_1.out}/lib";
CL_SOURCE_REGISTRY = concatStringsSep ":"
(["${config.users.users.cl-gemini.home}/quicklisp/quicklisp"] ++
(map
(pkg: "${pkg}//")
(lisp-libs ++ [pkgs.cl-gemini])));
};
path = with pkgs; [
gcc
file
getent
];
wantedBy = [ "default.target" ];
};
};
}
lib/lisp.nix
+9
View File
@@ -0,0 +1,9 @@
{ pkgs, ... }:
with pkgs.lib;
let
in rec {
gather-dependencies = pkg: unique (pkg.propagatedBuildInputs ++ (concatMap gather-dependencies pkg.propagatedBuildInputs));
lisp-source-registry = pkg: concatStringsSep ":" (map (p: "${p}//") (gather-dependencies pkg));
}