DuN0z/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CLEAN: nix develop

Browse source
This commit is contained in:
DuN0z 2025-10-05 08:20:57 +02:00
parent daeb15f821
commit c495445e91
22 changed files with 439 additions and 423 deletions
Download patch file Download diff file Expand all files Collapse all files

81
modules/services/forgejo.nix
View file

@ -1,6 +1,4 @@
# NixOS module Forgejo avec SQLite, SSH et reverse proxy Caddy
{ config, pkgs, lib, ... }: {
{pkgs, ...}: {
# --- Utilisateur dédié ---
users.users.git = {
isSystemUser = true;
@ -11,52 +9,51 @@
users.groups.git = {};
# --- Forgejo ---
services.forgejo = {
enable = true;
user = "git";
group = "git";
database = {
type = "sqlite3";
path = "/var/lib/forgejo/data/gitea.db";
services = {
forgejo = {
enable = true;
user = "git";
group = "git";
database = {
type = "sqlite3";
path = "/var/lib/forgejo/data/gitea.db";
};
settings = {
server = {
DOMAIN = "govel.porzh.me";
ROOT_URL = "https://govel.porzh.me/";
SSH_DOMAIN = "govel.porzh.me";
HTTP_PORT = 3000;
SSH_PORT = 22;
START_SSH_SERVER = false;
};
service = {
DISABLE_REGISTRATION = true;
REGISTER_EMAIL_CONFIRM = false;
};
repository = {
DEFAULT_BRANCH = "main";
};
};
};
settings = {
server = {
DOMAIN = "govel.porzh.me";
ROOT_URL = "https://govel.porzh.me/";
SSH_DOMAIN = "govel.porzh.me";
HTTP_PORT = 3000;
SSH_PORT = 22;
START_SSH_SERVER = false;
};
service = {
DISABLE_REGISTRATION = true;
REGISTER_EMAIL_CONFIRM = false;
};
repository = {
DEFAULT_BRANCH = "main";
openssh.enable = true;
caddy = {
enable = true;
virtualHosts."govel.porzh.me" = {
extraConfig = ''
reverse_proxy localhost:3000
'';
};
};
};
# --- Ouvrir les ports nécessaires ---
networking.firewall.allowedTCPPorts = [ 80 443 2222 ];
# --- Rediriger port SSH interne de Forgejo ---
services.openssh.enable = true;
networking.firewall.interfaces."eth0".allowedTCPPorts = [ 22 ]; # pour admin
# --- Caddy pour govel.porzh.me ---
services.caddy = {
enable = true;
virtualHosts."govel.porzh.me" = {
extraConfig = ''
reverse_proxy localhost:3000
'';
};
networking.firewall = {
allowedTCPPorts = [80 443 2222];
interfaces."eth0".allowedTCPPorts = [22];
};
# --- Pour que Forgejo génère les bonnes URLs Git ---
# networking.hostName = "git"; # non strictement obligatoire
# networking.hostName = "git"; # non strictement obligatoire
# --- Optionnel : config DNS ---
# git.lomig.me -> ton IP publique (ou IP locale si LAN)
@ -67,6 +64,4 @@
# --- Astuce : génère une paire de clés pour l’accès SSH Git ---
# ssh-keygen -t ed25519 -f ~/.ssh/id_git_forgejo
# puis ajoute la clé publique dans ton compte Forgejo
}

34
modules/services/ftp.nix
View file

@ -1,14 +1,14 @@
{ config, pkgs, lib, ... }: {
_: {
# -------------------------------------------------
# 1️⃣ Création de l’utilisateur système dédié FTP
# -------------------------------------------------
users.users.ftpuser = {
isSystemUser = true; # pas de login shell
description = "Compte FTP dédié";
home = "/srv/ftp/ftpuser";
createHome = true;
group = "ftpuser";
shell = "/usr/bin/nologin";
isSystemUser = true; # pas de login shell
description = "Compte FTP dédié";
home = "/srv/ftp/ftpuser";
createHome = true;
group = "ftpuser";
shell = "/usr/bin/nologin";
};
users.groups.ftpuser = {};
@ -16,11 +16,11 @@
extraConfig = ''
Match User ftpuser
ChrootDirectory /srv/ftp/ftpuser
ForceCommand internal-sftp
AllowTcpForwarding no
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
'';
};
};
# -------------------------------------------------
# 2️⃣ Permissions du répertoire home (méthode A)
@ -48,22 +48,20 @@
# Chroot chaque utilisateur local dans son $HOME
chrootlocalUser = true;
allowWriteableChroot = true ;
extraConfig = ''
pasv_min_port=40000
pasv_max_port=40004
'';
allowWriteableChroot = true;
extraConfig = ''
pasv_min_port=40000
pasv_max_port=40004
'';
};
# -------------------------------------------------
# 4️⃣ Ouverture des ports dans le firewall NixOS
# -------------------------------------------------
networking.firewall = {
allowedTCPPorts = [ 21 40000 40001 40002 40003 40004 ];
allowedTCPPorts = [21 40000 40001 40002 40003 40004];
# Si vous utilisez FTPS implicite (port 990) :
# allowedTCPPorts = [ 21 990 40000 40001 40002 40003 40004 ];
};
}

14
modules/services/goaccess.nix
View file

@ -1,9 +1,9 @@
{ pkgs, ... }: {
{pkgs, ...}: {
environment.systemPackages = with pkgs; [
goaccess
];
# Service pour générer le rapport statique GoAccess
# Service pour générer le rapport statique GoAccess
systemd.services.goaccess-report = {
description = "Generate GoAccess HTML report";
serviceConfig = {
@ -11,10 +11,10 @@
};
};
# Timer pour régénérer le rapport toutes les heures
# Timer pour régénérer le rapport toutes les heures
systemd.timers.goaccess-report = {
description = "Hourly GoAccess report generation";
wantedBy = [ "timers.target" ];
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = "hourly";
Persistent = true;
@ -28,10 +28,8 @@
file_server browse
try_files {path} {path}/ /index.html
'';
'';
};
};
};
}
}

4
modules/services/pihole.nix
View file

@ -11,7 +11,7 @@
environment = {
TZ = "Europe/Paris";
WEBPASSWORD = "changeme"; # Change à ta convenance
WEBPASSWORD = "changeme"; # Change à ta convenance
PIHOLE_DNS_ = "1.1.1.1;1.0.0.1";
};
@ -19,6 +19,6 @@
"/srv/pihole/etc-pihole:/etc/pihole"
"/srv/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
];
extraOptions = [ "--cap-add=NET_ADMIN" ];
extraOptions = ["--cap-add=NET_ADMIN"];
};
}