agent
a3c730e1db
Renames every domain in the config: Caddy virtual hosts (auth, hello, nextcloud, git, panel), the ACME contact email, Authelia's session cookie domain / portal URL / default redirect and TOTP issuer, Nextcloud's hostName and overwritehost, and Forgejo's DOMAIN (ROOT_URL and ssh clone URLs follow from it; the panel picks them up via panel.nix). Panel docs and examples updated too, and a README paragraph that had run together is split again. Requires DNS for auth/hello/nextcloud/git/panel.reudy.net (or a *.reudy.net wildcard) pointing at the server before deploying. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
89 lines
No EOL
2.9 KiB
Nix
89 lines
No EOL
2.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
forgejoServer = config.services.forgejo.settings.server;
|
|
in
|
|
{
|
|
environment.systemPackages = [
|
|
(pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
|
|
];
|
|
|
|
users.groups.panelroutes = { };
|
|
|
|
users.users.reudy.extraGroups = [ "panelroutes" ];
|
|
users.users.caddy.extraGroups = [ "panelroutes" ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/containers 0750 reudy panelroutes -"
|
|
"d /var/lib/containers/stacks 0750 reudy panelroutes -"
|
|
"d /var/lib/containers/volumes 0750 reudy panelroutes -"
|
|
"d /var/lib/containers/routes 0750 reudy panelroutes -"
|
|
"d /var/lib/containers/state 0750 reudy panelroutes -"
|
|
"d /var/lib/containers/state/apps 0750 reudy panelroutes -"
|
|
"d /var/lib/containers/backups 0750 reudy panelroutes -"
|
|
"f /var/lib/containers/routes/routes.caddy 0640 reudy panelroutes -"
|
|
];
|
|
|
|
systemd.services.panel-api = {
|
|
description = "Minimal panel API service";
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
path = [
|
|
pkgs.podman
|
|
pkgs.podman-compose
|
|
pkgs.curl
|
|
pkgs.coreutils
|
|
pkgs.zip
|
|
pkgs.unzip
|
|
pkgs.git
|
|
pkgs.util-linux # flock, used by panelctl to serialise routes file writes
|
|
pkgs.openssh # cloning repositories over ssh with the panel's deploy key
|
|
];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = "reudy";
|
|
Group = "panelroutes";
|
|
Restart = "always";
|
|
RestartSec = 3;
|
|
WorkingDirectory = "/var/lib/containers";
|
|
ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}";
|
|
};
|
|
|
|
environment = {
|
|
PANEL_API_BIND = "127.0.0.1";
|
|
PANEL_API_PORT = "9911";
|
|
PANEL_BASE_DIR = "/var/lib/containers";
|
|
PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
|
|
PANEL_FRONTEND_DIR = "${./panel/frontend}";
|
|
|
|
# Forgejo integration (repo picker, private clones, commit links).
|
|
# The API is reached on localhost; clones use the public URLs.
|
|
PANEL_FORGEJO_URL = lib.removeSuffix "/" forgejoServer.ROOT_URL;
|
|
PANEL_FORGEJO_API_URL = "http://${forgejoServer.HTTP_ADDR}:${toString forgejoServer.HTTP_PORT}";
|
|
PANEL_FORGEJO_SSH_URL = "ssh://${forgejoServer.BUILTIN_SSH_SERVER_USER}@${forgejoServer.DOMAIN}:${toString forgejoServer.SSH_PORT}";
|
|
};
|
|
};
|
|
|
|
services.caddy.virtualHosts."panel.reudy.net".extraConfig = ''
|
|
forward_auth 127.0.0.1:9091 {
|
|
uri /api/authz/forward-auth
|
|
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
|
}
|
|
reverse_proxy 127.0.0.1:9911
|
|
'';
|
|
|
|
systemd.paths."caddy-routes-reload" = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
pathConfig = {
|
|
PathChanged = "/var/lib/containers/routes/routes.caddy";
|
|
};
|
|
};
|
|
|
|
systemd.services."caddy-routes-reload" = {
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service";
|
|
};
|
|
};
|
|
} |