From cfa803bc828796c5a38bdfe7c1444bb4d93afde7 Mon Sep 17 00:00:00 2001 From: Lucy Hochkamp Date: Fri, 28 Feb 2025 15:48:13 +0100 Subject: [PATCH] partsdb --- hosts/ds9/containers.nix | 10 ++++--- hosts/ds9/default.nix | 55 ++++++++++---------------------------- hosts/ds9/part-db.nix | 31 +++++++++++++++++++++ hosts/picard/ts-ovpn.nix | 26 ------------------ hosts/theseus/default.nix | 1 + secrets/ds9PartDbEnv.age | Bin 0 -> 6051 bytes secrets/secrets.nix | 1 + 7 files changed, 53 insertions(+), 71 deletions(-) create mode 100644 hosts/ds9/part-db.nix delete mode 100644 hosts/picard/ts-ovpn.nix create mode 100644 secrets/ds9PartDbEnv.age diff --git a/hosts/ds9/containers.nix b/hosts/ds9/containers.nix index 6282a1a4..cd54fc7f 100644 --- a/hosts/ds9/containers.nix +++ b/hosts/ds9/containers.nix @@ -22,7 +22,7 @@ let ''; in { - imports = [ ./authentik.nix ]; + imports = [ ./authentik.nix ./part-db.nix ]; networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ]; networking.firewall.interfaces."podman+".allowedTCPPorts = [ 12300 3001 ]; fileSystems."/var/lib/containers" = { @@ -222,12 +222,14 @@ in ''; }; virtualisation.oci-containers.containers.archivebox = { - image = "archivebox/archivebox:latest"; + image = "archivebox/archivebox:dev"; environment = { ALLOWED_HOSTS = "*"; # set this to the hostname(s) you're going to serve the site from! CSRF_TRUSTED_ORIGINS = "https://archive.hailsatan.eu"; # you MUST set this to the server's URL for admin login and the REST API to work - PUBLIC_INDEX = "True"; # set to False to prevent anonymous users from viewing snapshot list - PUBLIC_SNAPSHOTS = "True"; # set to False to prevent anonymous users from viewing snapshot content + REVERSE_PROXY_USER_HEADER="X-Authentik-Username"; + REVERSE_PROXY_WHITELIST="10.88.0.1/32"; + PUBLIC_INDEX = "False"; # set to False to prevent anonymous users from viewing snapshot list + PUBLIC_SNAPSHOTS = "False"; # set to False to prevent anonymous users from viewing snapshot content PUBLIC_ADD_VIEW = "False"; # set to True to allow anonymous users to submit new URLs to archive SEARCH_BACKEND_ENGINE = "sonic"; # tells ArchiveBox to use sonic container below for fast full-text search SEARCH_BACKEND_HOST_NAME = "archivebox_sonic"; diff --git a/hosts/ds9/default.nix b/hosts/ds9/default.nix index 61c59177..e3835871 100644 --- a/hosts/ds9/default.nix +++ b/hosts/ds9/default.nix @@ -212,64 +212,37 @@ in handle @grafana { import podmanRedirWithAuth http://grafana:3000 } - handle { - import podmanRedirWithAuth http://127.0.0.1:8001 + @hoard host hoard.hailsatan.eu + handle @hoard { + import podmanRedirWithAuth http://partdb-server:80 } - handle { - abort - } - - ''; - virtualHosts."*.hailsatan.eu".extraConfig = '' - import blockBots - # tailscale only - bind [fd7a:115c:a1e0:ab12:4843:cd96:6253:6019] @immich host immich.hailsatan.eu handle @immich { - import podmanRedir http://immich-server:2283 + import podmanRedirWithAuth http://immich-server:2283 } @cd host cd.hailsatan.eu handle @cd { - import podmanRedir http://changedetection:5000 - } - @grafana host grafana.hailsatan.eu - handle @grafana { - import podmanRedirWithAuth http://grafana:3000 + import podmanRedirWithAuth http://changedetection:5000 } @node-red host node-red.hailsatan.eu handle @node-red { - import podmanRedir http://node-red:1880 + import podmanRedirWithAuth http://node-red:1880 } @labello host labello.hailsatan.eu handle @labello { - import podmanRedir http://labello:4242 + import podmanRedirWithAuth http://labello:4242 } - - - # @bzzt-api host bzzt-api.hailsatan.eu - # handle @bzzt-api { - # reverse_proxy http://127.0.0.1:5001 - # } - # @bzzt-lcg host bzzt-lcg.hailsatan.eu - # handle @bzzt-lcg { - # reverse_proxy http://127.0.0.1:5003 - # } - # @bzzt host bzzt.hailsatan.eu - # handle @bzzt { - # reverse_proxy http://127.0.0.1:5002 - # } - - @archivebox host archivebox.hailsatan.eu handle @archivebox { - import podmanRedir http://archivebox:8000 - } - @jellyfin host j.hailsatan.eu - handle @jellyfin { - import podmanRedir http://jellyfin:8096 + handle /api/* { + import podmanRedir http://archivebox:8000 + } + handle { + import podmanRedirWithAuth http://archivebox:8000 + } } handle { - reverse_proxy http://127.0.0.1:8001 + import podmanRedirWithAuth http://127.0.0.1:8001 } ''; }; diff --git a/hosts/ds9/part-db.nix b/hosts/ds9/part-db.nix new file mode 100644 index 00000000..23b07046 --- /dev/null +++ b/hosts/ds9/part-db.nix @@ -0,0 +1,31 @@ +{ pkgs, config, lib, inputs, ... }: +{ + ragon.agenix.secrets.ds9PartDbEnv = { }; + virtualisation.quadlet = + { + containers = { + partdb-server.containerConfig.image = "jbtronics/part-db1"; + partdb-server.containerConfig.networks = [ + "db-net" + "podman" + ]; + partdb-server.containerConfig.volumes = [ + "partdb-uploads:/var/www/html/uploads" + "partdb-media:/var/www/html/public/media" + ]; + partdb-server.containerConfig.environments = { + APP_ENV = "docker"; + DEFAULT_LANG = "en"; + DEFAULT_TIMEZONE = "Europe/Berlin"; + BASE_CURRENCY = "EUR"; + INSTANCE_NAME = "xynos_hoard"; + TRUSTED_PROXIES = "10.88.0.0/16"; + DEFAULT_URI = "https://hoard.hailsatan.eu/"; + }; + partdb-server.serviceConfig.TimeoutStartSec = "60"; + partdb-server.containerConfig.environmentFiles = [ + config.age.secrets.ds9PartDbEnv.path + ]; + }; + }; +} diff --git a/hosts/picard/ts-ovpn.nix b/hosts/picard/ts-ovpn.nix deleted file mode 100644 index f9863e68..00000000 --- a/hosts/picard/ts-ovpn.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ config, pkgs, options, ... }: { - imports = [ - ../../nixos-modules/services/tailscale-openvpn.nix - ../../nixos-modules/system/agenix.nix - ]; - ragon = { - agenix.secrets."ovpnNl" = { }; - agenix.secrets."ovpnDe" = { }; - agenix.secrets."ovpnTu" = { }; - agenix.secrets."ovpnCrt1" = { }; - agenix.secrets."ovpnPw1" = { }; - agenix.secrets."ovpnPw2" = { }; - agenix.secrets."ovpnScript" = { }; - agenix.secrets."tailscaleKey" = { }; - services.tailscale-openvpn = { - enable = true; - tsAuthKey = config.age.secrets.tailscaleKey.path; - config = { - nl = config.age.secrets.ovpnNl.path; - de = config.age.secrets.ovpnDe.path; - tu = config.age.secrets.ovpnTu.path; - }; - script = config.age.secrets.ovpnScript.path; - }; - }; -} diff --git a/hosts/theseus/default.nix b/hosts/theseus/default.nix index 47732553..acf150a0 100644 --- a/hosts/theseus/default.nix +++ b/hosts/theseus/default.nix @@ -207,6 +207,7 @@ discord # shitcord unstable.signal-desktop unstable.firefoxpwa + mosh unstable.plexamp # firefox obsidian diff --git a/secrets/ds9PartDbEnv.age b/secrets/ds9PartDbEnv.age new file mode 100644 index 0000000000000000000000000000000000000000..9ea2202719797b9f6388b90ce1bef8b4d7565c7f GIT binary patch literal 6051 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUlOp2&TD_5v6jfe^i zi}dm;3wKS+u!!^xEex z%PjPYaw^C%O)scOFODdzFwSyJO({$E3M=so^+dO=G~FXSyj-C$BGD|;-zPKJSl_+E z%`qu8M86=&EHd9HwIbWpJijnIxhyg?IWo#AB#r8JKHZaD;wRm&``^uU`GZ2Ld$}TiYUX<2ye%VP|MZT~OGi`FD1)?IBZFLTqY~dJmryRJ;H;3y;LNZRSH}#4&_MkhZ4+%%4|i8L(=sEo z!kml<%W_}Gl3)wV3=F>od3hQ;IV$LDS4I>S7N)1U7x?6wnuK~dS2!8*1l8RYv%j8-#fT>z74(m!>7> zrW6}GTA=$aBCpKLyIi3(rOc$nG(5j5%P}uFt2ntV)X3j0$GObdDNNfrBP6HPG%wjA z$Jin&FPkeXyTrpFSwB6?Hz+s2xF9IsqCCnnq^Qaz!>hDB!q_0w+dnJNSKB=!0K;$Q zemZ-^C@6GtcQmRn2ub%#H8HmED+u+g%;wV7)m6y#^)+;ltSZcOajq;& zs!S;{E=o2t4lb)SwzRA$F3k1u_j1&B4^0fyF6L6}n145~=tr~SE(M7x6(*A%nc_DJ zaM#*7*e}+qx;WeY+uDz_>$@$LD{Dh0I!Zp|Yq@+$liIaUdZuAqNPC=jDt{yEuC>*zNru%|eyH`oq3uJ_&876M) zba8VEzEIC>BBpHgEj{!EANM6ujcM29)7Snv`?)lBd5pCwk7uXf#Xnk8+`EshA5H$4k}r6M!|Lew|0k6anI{But#aOVaBlL1_6dbg?tU;*_t=rBKXIqT z{v-KecZ}w8YI1*_7`yU1$8rbPKyl|^OV~?qDo*wMGexU$-Ct!ml( zj(0itqZh`$Rg=z{a8$$O68o>C!gr>TeQP?-d81;|7jsze_vX#96EXF z%`f&xyyB%T9#gn;Z(g%z<7B>Lu!X--J%D#hWAJZW}Hl1^-JK%r}^vmF{<(!sZ0~oyHGAD@pVG^wGSV!98vgGrhccWC-Eb1 z^sa@g+#7yHR~+CLnZADFL}iti_peNMJ1ZYl?c`FaVJ)f?vn{yxc=62-8ZV?64rru> zb+qc&WS4B(c}6=xJLlrk>7`L;zVEVHlvm}vJ14|jDq%;s_FBzF7hXCvEl>{I&w8>{ zK6}m9FvmHLA?)3UYuQs)Ke_d5MFi8OXY3Dm?mw;nuVsPxn@)oz2W2vEaB^IX@Adm9&) z7_se;6-`hNW-*(cxQcdyApQy((=if6m z6jR!t9C9)JhtjU{QZBNndDmB!>x)eeciQnvfordLaI3O`r~mz6GxSQyQbcjAWbsn816 z-8uW!b{=PXU?Y*>oGCtI^P*eDSGq%erCLtpPkpmvYw+f7+vV@(J8bSa=ZgamR_$7@LVEnHtjbH{NpEe2-~1gF*RG6G4fM z+vfMK|2L0MY;M$t)Gb$<7@hoOPRutAKirl6)qm>gkWKsTU%YQremylQ+2~iwx?faV-lz^Dx}VX=doMt%*PR?#y+%@48X2?4!fsol~TA z3i=xwzJ7J-oZYSS9&p5B9VO1RKp<4^8 z{@Z0*{`>HiarsN}*m<*`RNlJtiEZMXU8~ktgd9I>Xlf+!OEdej_mVHwUqlW#IW2oo zHjkf`=dPOWU#8XCp^g{L72p>$;JhQ&|vAIHx8=X!Q;{+kokngQl+7xvD) zbjtPiYf~MT4V#R&#e4duc+GZQKT)4#7k~?r7e#bDMRPIVC1a74PWAJ zb*eA&{rhi!*orq&cbYiLLJ}-)Jr?axes=iclegSgnsic3f9#FU3Uo40TVBK-zFnhE3oyw~VRDVq2__h+3YTg^y**;89 z)R@6qv6uf;n7jV_+~bS5cORT0HQztnzLo)dqJh58b%A=RxBB`7@94=~VS(e+{*&DZc;gQo-H}u9+;K?h2n@yWKJVML^`~ zRaX)P-ECxbGY=>?9_?AaZtkQlU)i;?cblJUd1+|*Ql+nW+k44FDi$1Rp&BYhuM@lH z{or4_{X~HGZI!brA?LQOdFr5`)plvsp}le^W7wCL`1Jk%=*NFPzlH0p>ym&nCbuUq zyQNmtc!$QFpZLo#PVxM~=v9B;GsQ67@Y*7KU7cZ1N9B$=OX?RJ%-y25Z5{8*6$05S zqylE?#~gUNG~2HCYqZzxU%3GmZ#`_?npeIHS@7U;#e2y*lepokjdF|iV&fg&~P7D1Km)&r%- zhx!LL8Am_P4QKrwEq<@t;M7Hzc(WN*KW|%n{JiI$ifN_BZS98A+=5H$iV8iVcFaNE zs}yfY%-j66q5RnQHNwJ~HJ>a)ca}W?ogoicjF^+mogji#Gk)DZlzel91ZGMSB)s$VP1qgjTUyPt^IX~=nR7wO0z#|zIo+8jwV5fCzdibHRn3-!$b*q9mS)IryCU$Q zHnHV@X>H}+rvBYif9{*``Qj$|rpEcbSTk$-m=dbeHHO6im?*%XVGJVs@kf&eWm+gqI zmRQZKEt<_%a$kM*)%7`^O08$k|C+jbmTYYF`=klY!JXQwDC;xMSjz-|67jT<@jiF`G^s_Rb5^VXX;#sH`67oVzST4`Dj0O z;*O56TpYeNi=ilb$(&O|u2bRKQbzZju_XF}ePBsctBm0$N=X{BebZNX@QT_k!hl7WwYkcMAom1!( zDcxGM{dz}v`lOO=I-$+Y%w--a<>#xUgxUK9wg)rWKZ^-kt|ES>dWk`UMH%xlg*@vT z?vVc>HYYb7je7j??@G9voQ6`OxunS878dg+3Uo+;)&hfXh_q@1R{Rb{@M@~1PL zXKPIF@sxj5D>!+zW4b4^dbU_yTf>$Q`=eI(%L?0m@w{?E{VT8k!_;r=HX6mqk$2X82<_QkV$*fDb9HM|g~5(bXV(0x zkh@k^v%c`ioi7)5ZIaG)pIMXeHu=J>tl#QW>X@D@p4}I#Tlv_%tV6Q6V#~(0tGC^_ zE&Ikj?xyVGYe{9x4PRW~4BoIVH~(d(n0U?Hbba-$r)=!_OI~HA%52qMV|A|9|N185 zM$W0hx_!GBu5sPIZTW>gri=CNo)e4W=iv0& z;k-stIOEf?;92G@3m7g=xRBOec1>kh;%S!J(&I4~oXlKTs-K-A&Tx2->RQE999t&t zt+KxLW&6Z{D}G=0pPv|6SNV3vM@f~Kh6?@7pVsJKIOwGOxo^+k_oRCHE+T%>v`@~@x$Lb*-7z9biF z#al{ll3v2r7CG(i>7a{Z-pU_tieLOFy67ZJV(KaFjDTrMvlqo`ajmtxm&vkk# z{sI4tQxhhAm0xfFn>q0EVW$H-b#`kfBo}`@bG}cBBd7RZSpUmXwlU0n|#*mWIpej zTD(t6X#U~4t=1Yd1LwOn&B@y(`@UlR_gM#@H8f`}^|VZS5}dVgfn%X$zH~rNYD|63 z=J0w)KK4_67mSLyy{+Y5B`-e9o}g6kP*N@7*R(pP6j9!g2b^Gl~nBNR=#Z=<>hK<`!74 z&}l0+p?q@k693xx)~@LX*KFCe?qYLZg66KT$Ks?y!s5c!&+I+2z`5L~H6x#+OYjqa z$GV<*DfSZE%RWg@)6?-^&v9ahP;lq*gxdKIQ@Nj~cugrOoUJ7Hu-#$v+9#qb@`z0*wTKU;$p4Duw;relR zk>YOk3Eqh)rd3N8Al;3Yp ztyfi?|NHoi8QW{VUz>NJZVJCuU+NO?M$_l=rN7oMzG%dKkAb1~MH?=$yC=_2Ulm=$>HXnL%e_ShpC#3@O)6P( z*X`X#rSL}UoAMU-AFRH1_#0bY%d3y~|CN_WRR>-DxmLkz zb>)?n$CSTl70gPhS`f8P=dh%g(%SCshw+TMCw^Gp^OB71C~jL=ef8wo!xhOdli8c) zoKA4N%xO&PE}7)J{inxQpIxWc?-pB?v+EtV1Ou}%Yv$#CBezxB4H92Wf_M)-oIEGQ zo&Ti4!j&_a{EP2o{M!^r1=Po*~b^A7#a<0YXhJYV` z+Ll<~H1*D|67z4&$`*+5Tpt?trS;fUXWxc0h412`Z})p-N4lAx;W61CoN|2kVk!2E zC41`s88L0hV2rPPv9Lzw@$Kcl=gPmts