From b938a41bee796b9565bb85bf6050ba90348d6b50 Mon Sep 17 00:00:00 2001 From: Philipp Date: Sun, 11 May 2025 18:54:32 +0200 Subject: [PATCH] add forgejo, add linkwarden, nixfmt, add secrets --- .sops.yaml | 4 + modules/nixos/services/forgejo/default.nix | 72 ++++++ modules/nixos/services/linkwarden/default.nix | 230 ++++++++++++++++++ .../technitium-dns-server/default.nix | 5 +- packages/linkwarden/default.nix | 145 +++++++++++ secrets/blarm-linkwarden.env | 8 + systems/x86_64-linux/blarm/default.nix | 9 +- systems/x86_64-linux/bodenheizung/default.nix | 3 +- 8 files changed, 471 insertions(+), 5 deletions(-) create mode 100644 modules/nixos/services/forgejo/default.nix create mode 100644 modules/nixos/services/linkwarden/default.nix create mode 100644 packages/linkwarden/default.nix create mode 100644 secrets/blarm-linkwarden.env diff --git a/.sops.yaml b/.sops.yaml index 3c3bb45..f04d450 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -13,3 +13,7 @@ creation_rules: key_groups: - age: - *primary + - path_regex: secrets/blarm-linkwarden.env + key_groups: + - age: + - *primary diff --git a/modules/nixos/services/forgejo/default.nix b/modules/nixos/services/forgejo/default.nix new file mode 100644 index 0000000..61cc28a --- /dev/null +++ b/modules/nixos/services/forgejo/default.nix @@ -0,0 +1,72 @@ +{ + lib, + pkgs, + config, + namespace, + ... +}: +with lib; +with lib.${namespace}; +let + cfg = config.${namespace}.services.forgejo; +in +{ + options.${namespace}.services.forgejo = { + enable = mkEnableOption "Forgejo"; + + package = mkOption { + description = "The package of Forgejo to use."; + type = types.package; + default = pkgs.forgejo-lts; + }; + + port = mkOption { + description = "The port to serve Forgejo on."; + type = types.nullOr types.int; + default = 3001; + }; + + ssh_user = mkOption { + description = "The ssh user to use Forgejo as."; + type = types.nullOr types.str; + default = "forgejo"; + }; + + domain = mkOption { + description = "The domain to serve Forgejo on."; + type = types.nullOr types.str; + default = "git.monapona.dev"; + }; + + ssh_domain = mkOption { + description = "The domain to serve Forgejo on."; + type = types.nullOr types.str; + default = "monapona.dev"; + }; + + user = mkOption { + description = "The user to run Forgejo as."; + type = types.nullOr types.str; + default = "git"; + }; + + }; + config = mkIf cfg.enable { + networking.firewall.allowedTCPPorts = [ + cfg.port + ]; + + services.forgejo = { + enable = true; + package = cfg.package; + database.type = "postgres"; + settings.server = { + DOMAIN = cfg.domain; + HTTP_PORT = cfg.port; + ROOT_URL = "https://git.monapona.dev"; + SSH_DOMAIN = cfg.ssh_domain; + BUILTIN_SSH_SERVER_USER = cfg.ssh_user; + }; + }; + }; +} diff --git a/modules/nixos/services/linkwarden/default.nix b/modules/nixos/services/linkwarden/default.nix new file mode 100644 index 0000000..b67a057 --- /dev/null +++ b/modules/nixos/services/linkwarden/default.nix @@ -0,0 +1,230 @@ +{ + lib, + config, + pkgs, + namespace, + ... +}: + +let + cfg = config.${namespace}.services.linkwarden; + isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host; + + inherit (lib) + types + mkIf + mkOption + mkEnableOption + ; +in +{ + options.${namespace}.services.linkwarden = { + enable = mkEnableOption "Linkwarden"; + package = lib.mkPackageOption pkgs.awesome-flake "linkwarden" { }; + + storageLocation = mkOption { + type = types.path; + default = "/var/lib/linkwarden"; + description = "Directory used to store media files. If it is not the default, the directory has to be created manually such that the linkwarden user is able to read and write to it."; + }; + cacheLocation = mkOption { + type = types.path; + default = "/var/cache/linkwarden"; + description = "Directory used as cache. If it is not the default, the directory has to be created manually such that the linkwarden user is able to read and write to it."; + }; + + enableRegistration = mkEnableOption "registration for new users"; + + environment = mkOption { + type = types.attrsOf types.str; + default = { }; + example = { + PAGINATION_TAKE_COUNT = "50"; + }; + description = '' + Extra configuration environment variables. Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options. + ''; + }; + + secretsFile = mkOption { + type = types.str // { + # We don't want users to be able to pass a path literal here but + # it should look like a path. + check = it: lib.isString it && lib.types.path.check it; + }; + example = "/run/secrets/linkwarden"; + description = '' + Path of a file with extra environment variables to be loaded from disk. + This file is not added to the nix store, so it can be used to pass secrets to linkwarden. + Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options. + + Linkwarden needs at least a nextauth secret. To set a database password use POSTGRES_PASSWORD: + ``` + NEXTAUTH_SECRET= + POSTGRES_PASSWORD= + ``` + ''; + }; + + host = mkOption { + type = types.str; + default = "0.0.0.0"; + description = "The host that Linkwarden will listen on."; + }; + port = mkOption { + type = types.port; + default = 3000; + description = "The port that Linkwarden will listen on."; + }; + openFirewall = mkOption { + type = types.bool; + default = true; + description = "Whether to open the Linkwarden port in the firewall"; + }; + user = mkOption { + type = types.str; + default = "linkwarden"; + description = "The user Linkwarden should run as."; + }; + group = mkOption { + type = types.str; + default = "linkwarden"; + description = "The group Linkwarden should run as."; + }; + + database = { + enable = + mkEnableOption "the postgresql database for use with Linkwarden. See {option}`services.postgresql`" + // { + default = true; + }; + createDB = mkEnableOption "the automatic creation of the database for Linkwarden." // { + default = true; + }; + name = mkOption { + type = types.str; + default = "linkwarden"; + description = "The name of the Linkwarden database."; + }; + host = mkOption { + type = types.str; + default = "/run/postgresql"; + example = "127.0.0.1"; + description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path."; + }; + port = mkOption { + type = types.port; + default = 5432; + description = "Port of the postgresql server."; + }; + user = mkOption { + type = types.str; + default = "linkwarden"; + description = "The database user for Linkwarden."; + }; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = cfg.database.createDB -> cfg.database.name == cfg.database.user; + message = "The postgres module requires the database name and the database user name to be the same."; + } + ]; + + services.postgresql = mkIf cfg.database.enable { + enable = true; + ensureDatabases = mkIf cfg.database.createDB [ cfg.database.name ]; + ensureUsers = mkIf cfg.database.createDB [ + { + name = cfg.database.user; + ensureDBOwnership = true; + ensureClauses.login = true; + } + ]; + }; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; + + ${namespace}.services.linkwarden.environment = { + LINKWARDEN_HOST = cfg.host; + LINKWARDEN_PORT = toString cfg.port; + LINKWARDEN_CACHE_DIR = cfg.cacheLocation; + STORAGE_FOLDER = cfg.storageLocation; + NEXT_PUBLIC_DISABLE_REGISTRATION = mkIf (!cfg.enableRegistration) "true"; + DATABASE_URL = mkIf isPostgresUnixSocket "postgresql://${lib.strings.escapeURL cfg.database.user}@localhost/${lib.strings.escapeURL cfg.database.name}?host=${cfg.database.host}"; + DATABASE_PORT = toString cfg.database.port; + DATABASE_HOST = mkIf (!isPostgresUnixSocket) cfg.database.host; + DATABASE_NAME = cfg.database.name; + DATABASE_USER = cfg.database.user; + }; + + systemd.services.linkwarden = { + description = "Linkwarden (Self-hosted collaborative bookmark manager to collect, organize, and preserve webpages, articles, and more...)"; + requires = [ + "network-online.target" + ] ++ lib.optionals cfg.database.enable [ "postgresql.service" ]; + after = [ + "network-online.target" + ] ++ lib.optionals cfg.database.enable [ "postgresql.service" ]; + wantedBy = [ "multi-user.target" ]; + environment = cfg.environment // { + # Required, otherwise chrome dumps core + CHROME_CONFIG_HOME = cfg.cacheLocation; + }; + + serviceConfig = { + Type = "simple"; + Restart = "on-failure"; + RestartSec = 3; + + ExecStart = lib.getExe cfg.package; + EnvironmentFile = cfg.secretsFile; + StateDirectory = "linkwarden"; + CacheDirectory = "linkwarden"; + User = cfg.user; + Group = cfg.group; + + # Hardening + CapabilityBoundingSet = ""; + NoNewPrivileges = true; + PrivateUsers = true; + PrivateTmp = true; + PrivateDevices = true; + PrivateMounts = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + }; + }; + + users.users = mkIf (cfg.user == "linkwarden") { + linkwarden = { + name = "linkwarden"; + group = cfg.group; + isSystemUser = true; + }; + }; + users.groups = mkIf (cfg.group == "linkwarden") { linkwarden = { }; }; + + sops.secrets.linkwarden = { + format = "dotenv"; + sopsFile = ../../../../secrets/blarm-linkwarden.env; + }; + + meta.maintainers = with lib.maintainers; [ jvanbruegge ]; + }; +} diff --git a/modules/nixos/services/technitium-dns-server/default.nix b/modules/nixos/services/technitium-dns-server/default.nix index 18912e8..6913f3a 100644 --- a/modules/nixos/services/technitium-dns-server/default.nix +++ b/modules/nixos/services/technitium-dns-server/default.nix @@ -105,5 +105,8 @@ in }; }; - meta.maintainers = with lib.maintainers; [ fabianrig Spaenny ]; + meta.maintainers = with lib.maintainers; [ + fabianrig + Spaenny + ]; } diff --git a/packages/linkwarden/default.nix b/packages/linkwarden/default.nix new file mode 100644 index 0000000..a262381 --- /dev/null +++ b/packages/linkwarden/default.nix @@ -0,0 +1,145 @@ +{ + lib, + stdenvNoCC, + buildNpmPackage, + fetchFromGitHub, + fetchYarnDeps, + makeWrapper, + nixosTests, + yarnBuildHook, + yarnConfigHook, + # dependencies + bash, + monolith, + nodejs, + openssl, + playwright-driver, + prisma, + prisma-engines, +}: + +let + bcrypt = buildNpmPackage rec { + pname = "bcrypt"; + version = "5.1.1"; + + src = fetchFromGitHub { + owner = "kelektiv"; + repo = "node.bcrypt.js"; + rev = "v${version}"; + hash = "sha256-mgfYEgvgC5JwgUhU8Kn/f1D7n9ljnIODkKotEcxQnDQ="; + }; + + npmDepsHash = "sha256-CPXZ/yLEjTBIyTPVrgCvb+UGZJ6yRZUJOvBSZpLSABY="; + + npmBuildScript = "install"; + + postInstall = '' + cp -r lib $out/lib/node_modules/bcrypt/ + ''; + }; +in +stdenvNoCC.mkDerivation rec { + pname = "linkwarden"; + version = "2.10.0"; + + src = fetchFromGitHub { + owner = "linkwarden"; + repo = "linkwarden"; + tag = "v${version}"; + hash = "sha256-mtygHx09VqrVq5eiCm8UbVM+bjA6n4MbRRT1HcWnUAo="; + }; + + yarnOfflineCache = fetchYarnDeps { + yarnLock = src + "/yarn.lock"; + hash = "sha256-D6iZp7O90ZwxyiwRZ1H67eUphh3kRplu3ucOEJIRR/w="; + }; + + nativeBuildInputs = [ + makeWrapper + nodejs + prisma + yarnBuildHook + yarnConfigHook + ]; + + buildInputs = [ + openssl + ]; + + NODE_ENV = "production"; + + postPatch = '' + substituteInPlace package.json \ + --replace-fail "yarn worker:prod" "ts-node --transpile-only --skip-project scripts/worker.ts" + + for f in lib/api/storage/*Folder.ts lib/api/storage/*File.ts; do + substituteInPlace $f \ + --replace-fail 'path.join(process.cwd(), storagePath + "/" + file' 'path.join(storagePath, file' + done + ''; + + preBuild = '' + export PRISMA_CLIENT_ENGINE_TYPE='binary' + export PRISMA_QUERY_ENGINE_LIBRARY="${prisma-engines}/lib/libquery_engine.node" + export PRISMA_QUERY_ENGINE_BINARY="${prisma-engines}/bin/query-engine" + export PRISMA_SCHEMA_ENGINE_BINARY="${prisma-engines}/bin/schema-engine" + prisma generate + ''; + + postBuild = '' + substituteInPlace node_modules/next/dist/server/image-optimizer.js \ + --replace-fail 'this.cacheDir = (0, _path.join)(distDir, "cache", "images");' 'this.cacheDir = (0, _path.join)(process.env.LINKWARDEN_CACHE_DIR, "cache", "images");' + ''; + + installPhase = '' + runHook preInstall + + rm -r node_modules/bcrypt node_modules/@next/swc-* + ln -s ${bcrypt}/lib/node_modules/bcrypt node_modules/ + mkdir -p $out/share/linkwarden/.next $out/bin + cp -r * .next $out/share/linkwarden/ + + echo "#!${lib.getExe bash} -e + export DATABASE_URL=\''${DATABASE_URL-"postgresql://\$DATABASE_USER:\$POSTGRES_PASSWORD@\$DATABASE_HOST:\$DATABASE_PORT/\$DATABASE_NAME"} + export npm_config_cache="\$LINKWARDEN_CACHE_DIR/npm" + ${lib.getExe prisma} migrate deploy --schema $out/share/linkwarden/prisma/schema.prisma \ + && ${lib.getExe' nodejs "npm"} start --prefix $out/share/linkwarden -- -H \$LINKWARDEN_HOST -p \$LINKWARDEN_PORT + " > $out/bin/start.sh + chmod +x $out/bin/start.sh + + makeWrapper $out/bin/start.sh $out/bin/linkwarden \ + --prefix PATH : "${ + lib.makeBinPath [ + bash + monolith + openssl + ] + }" \ + --set-default PRISMA_CLIENT_ENGINE_TYPE 'binary' \ + --set-default PRISMA_QUERY_ENGINE_LIBRARY "${prisma-engines}/lib/libquery_engine.node" \ + --set-default PRISMA_QUERY_ENGINE_BINARY "${prisma-engines}/bin/query-engine" \ + --set-default PRISMA_SCHEMA_ENGINE_BINARY "${prisma-engines}/bin/schema-engine" \ + --set-default PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH ${playwright-driver.browsers-chromium}/chromium-*/chrome-linux/chrome \ + --set-default LINKWARDEN_CACHE_DIR /var/cache/linkwarden \ + --set-default LINKWARDEN_HOST localhost \ + --set-default LINKWARDEN_PORT 3000 \ + --set-default STORAGE_FOLDER /var/lib/linkwarden + + runHook postInstall + ''; + + passthru.tests = { + inherit (nixosTests) linkwarden; + }; + + meta = { + description = "Self-hosted collaborative bookmark manager to collect, organize, and preserve webpages, articles, and more..."; + homepage = "https://linkwarden.app/"; + license = lib.licenses.agpl3Only; + maintainers = with lib.maintainers; [ jvanbruegge ]; + platforms = lib.platforms.linux; + mainProgram = "linkwarden"; + }; + +} diff --git a/secrets/blarm-linkwarden.env b/secrets/blarm-linkwarden.env new file mode 100644 index 0000000..77b730e --- /dev/null +++ b/secrets/blarm-linkwarden.env @@ -0,0 +1,8 @@ +NEXTAUTH_SECRET=ENC[AES256_GCM,data:IRzTUPV1ItsHevsBF09iRniT3qfHK1rI71rZpsIl2VD1CqyY,iv:1UEBXI2nCcQ9adZ1i1tbn5gXNjU4KNED0PUZe2gBRj4=,tag:NbiQVlDhqKINTFveBiVyQQ==,type:str] +NEXT_PUBLIC_DISABLE_REGISTRATION=ENC[AES256_GCM,data:Yg/yQGU=,iv:NrjL6lQcbTdoJ5chh7DxMt9K+D0Z/nuNeYJdyNiVQfw=,tag:qP1JNA4//CcGO9znlaem3g==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYK01BODRjT3QySUxyWVo0\nRzhwNFZxZzJ5aVRjcXNHS21YbzAxTTl0REhvClg5ZldhV1VzY1JUdXlzcTcyOENR\naWh3Q1I0R0M5VmU4bzY0L1Nva2p2UHMKLS0tIHI3dmFRQVdIR0VEOXExaUJVZWZW\nTVc2Z1VPRTF3WWlhcWhIK0Vja1RvcEUKbR2QyCPch+WgGNb8oAMHvQ8LoC/xrauQ\ns7xBQS6NgPAXaRNLIJRDzEA5QI+ImFrQ4uKTpjkJdpulG8tSprGKNg==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age132m0pg4utk3cjve2lgcjffvz7cevl0fq5krufu9sgud7wu2wgurqk49kgl +sops_lastmodified=2025-05-10T15:47:50Z +sops_mac=ENC[AES256_GCM,data:VlE5P6lAyI6UcpLWwRVoB8bGXMuJR0BM9M5Mfz+/vIIhQUkzNTvAuF93gXCoMGaJmAvr8ItKjkIMA+ZLDZ5xxM4flnJ3bg4WIgIJE0ZL9YTFdrYBDr3aoDPCeo+fAony4rhSFiMXW8DR1h0UO331+KVHBFfheN97jImgv4ZBM9g=,iv:mmRDuprqs5PPMHarNkHEMH2MHSCJIda2bjjwT0loiK4=,tag:u3cG02Ckv+j9Vt9nhA1l8Q==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.10.2 diff --git a/systems/x86_64-linux/blarm/default.nix b/systems/x86_64-linux/blarm/default.nix index c25671c..37b87fb 100644 --- a/systems/x86_64-linux/blarm/default.nix +++ b/systems/x86_64-linux/blarm/default.nix @@ -56,11 +56,14 @@ with lib.${namespace}; cinny = enabled; ente-auth = enabled; restic = enabled; + linkwarden = { + enable = true; + secretsFile = "/run/secrets/linkwarden"; + }; + forgejo = enabled; }; - container = { - invidious = enabled; - }; + #container.invidious = enabled; system.sops = enabled; cli.neovim = enabled; diff --git a/systems/x86_64-linux/bodenheizung/default.nix b/systems/x86_64-linux/bodenheizung/default.nix index 10fe271..2bcf658 100644 --- a/systems/x86_64-linux/bodenheizung/default.nix +++ b/systems/x86_64-linux/bodenheizung/default.nix @@ -16,7 +16,8 @@ with lib.${namespace}; systemd-boot = { enable = true; consoleMode = "max"; - }; }; + }; + }; }; virtualisation.libvirtd.enable = true;