nixos/tests/sourcehut/nodes/common.nix

   1 { config, pkgs, nodes, ... }:
   2 let
   3   domain = config.networking.domain;
   4
   5   # Note that wildcard certificates just under the TLD (eg. *.com)
   6   # would be rejected by clients like curl.
   7   tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
   8     openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
   9       -subj '/CN=${domain}' -extensions v3_req \
  10       -addext 'subjectAltName = DNS:*.${domain}'
  11     install -D -t $out key.pem cert.pem
  12   '';
  13 in
  14 {
  15   # buildsrht needs space
  16   virtualisation.diskSize = 4 * 1024;
  17   virtualisation.memorySize = 2 * 1024;
  18   networking.enableIPv6 = false;
  19
  20   services.sourcehut = {
  21     enable = true;
  22     nginx.enable = true;
  23     nginx.virtualHost = {
  24       forceSSL = true;
  25       sslCertificate = "${tls-cert}/cert.pem";
  26       sslCertificateKey = "${tls-cert}/key.pem";
  27     };
  28     postgresql.enable = true;
  29     redis.enable = true;
  30
  31     meta.enable = true;
  32
  33     settings."sr.ht" = {
  34       environment = "production";
  35       global-domain = config.networking.domain;
  36       service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
  37       network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
  38     };
  39     settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
  40     settings.mail = {
  41       smtp-from = "root+hut@${domain}";
  42       # WARNING: take care to keep pgp-privkey outside the Nix store in production,
  43       # or use LoadCredentialEncrypted=
  44       pgp-privkey = toString (pkgs.writeText "sourcehut.pgp-privkey" ''
  45         -----BEGIN PGP PRIVATE KEY BLOCK-----
  46
  47         lFgEZrFBKRYJKwYBBAHaRw8BAQdAS1Ffiytk0h0z0jfaT3qyiDUV/plVIUwOg1Yr
  48         AXP2YmsAAP0W6QMC3G2G41rzCGLeSHeGibor1+XuxvcwUpVdW7ge+BH/tDZuaXhv
  49         cy90ZXN0cy9zb3VyY2VodXQgPHJvb3QraHV0QHNvdXJjZWh1dC5sb2NhbGRvbWFp
  50         bj6IkwQTFgoAOxYhBMISh2Z08FCi969cq9R2wSP9QF2bBQJmsUEpAhsDBQsJCAcC
  51         AiICBhUKCQgLAgQWAgMBAh4HAheAAAoJENR2wSP9QF2b4JMA+wQLdxVcod/ppyvH
  52         QguGqqhkpk8KquCddOuFnQVAfHFWAQCK5putVk4mGzsoLTbOJCSGRC4pjEktZawQ
  53         MTqJmnOuC5xdBGaxQSkSCisGAQQBl1UBBQEBB0Aed6UYJyighTY+KuPNQ439st3x
  54         x04T1j58sx3AnKgYewMBCAcAAP9WLB79HO1zFRqTCnk7GIEWWogMFKVpazeBUNu9
  55         h9rzCA2+iHgEGBYKACAWIQTCEodmdPBQovevXKvUdsEj/UBdmwUCZrFBKQIbDAAK
  56         CRDUdsEj/UBdmwgJAQDVk/px/pSzqreSeDLzxlb6dOo+N1KcicsJ0akhSJUcvwD9
  57         EPhpEDZu/UBKchAutOhWwz+y6pyoF4Vt7XG+jbJQtA4=
  58         =KaQc
  59         -----END PGP PRIVATE KEY BLOCK-----
  60       '');
  61       pgp-pubkey = pkgs.writeText "sourcehut.pgp-pubkey" ''
  62         -----BEGIN PGP PUBLIC KEY BLOCK-----
  63
  64         mDMEZrFBKRYJKwYBBAHaRw8BAQdAS1Ffiytk0h0z0jfaT3qyiDUV/plVIUwOg1Yr
  65         AXP2Ymu0Nm5peG9zL3Rlc3RzL3NvdXJjZWh1dCA8cm9vdCtodXRAc291cmNlaHV0
  66         LmxvY2FsZG9tYWluPoiTBBMWCgA7FiEEwhKHZnTwUKL3r1yr1HbBI/1AXZsFAmax
  67         QSkCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ1HbBI/1AXZvgkwD7
  68         BAt3FVyh3+mnK8dCC4aqqGSmTwqq4J1064WdBUB8cVYBAIrmm61WTiYbOygtNs4k
  69         JIZELimMSS1lrBAxOomac64LuDgEZrFBKRIKKwYBBAGXVQEFAQEHQB53pRgnKKCF
  70         Nj4q481Djf2y3fHHThPWPnyzHcCcqBh7AwEIB4h4BBgWCgAgFiEEwhKHZnTwUKL3
  71         r1yr1HbBI/1AXZsFAmaxQSkCGwwACgkQ1HbBI/1AXZsICQEA1ZP6cf6Us6q3kngy
  72         88ZW+nTqPjdSnInLCdGpIUiVHL8A/RD4aRA2bv1ASnIQLrToVsM/suqcqBeFbe1x
  73         vo2yULQO
  74         =luxZ
  75         -----END PGP PUBLIC KEY BLOCK-----
  76       '';
  77       pgp-key-id = "0xC212876674F050A2F7AF5CABD476C123FD405D9B";
  78     };
  79   };
  80
  81   networking.firewall.allowedTCPPorts = [ 80 443 ];
  82   security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
  83   services.nginx = {
  84     enable = true;
  85     recommendedGzipSettings = true;
  86     recommendedOptimisation = true;
  87     recommendedTlsSettings = true;
  88     recommendedProxySettings = true;
  89   };
  90
  91   services.postgresql = {
  92     enable = true;
  93     enableTCPIP = false;
  94     settings.unix_socket_permissions = "0770";
  95   };
  96
  97   services.openssh = {
  98     enable = true;
  99     settings.PasswordAuthentication = false;
 100     settings.PermitRootLogin = "no";
 101   };
 102
 103   environment.systemPackages = with pkgs; [
 104     hut # For interacting with the Sourcehut APIs via CLI
 105     srht-gen-oauth-tok # To automatically generate user OAuth tokens
 106   ];
 107 }