Compare commits

...

3 Commits

Author SHA1 Message Date
Eli Ribble 422aa2abb5 Get PHP working
I can do a basic phpinfo() with this.
2025-04-11 07:11:09 -07:00
Eli Ribble 484c34ef59 Get nginx up and the cert working.
I decided to remove the porkbun provider just to simplify things since
DNS validation incurs a much longer wait than HTTP validation. I also
removed the default address stuff since they would need a port and they
shouldn't be required - I pulled them from sovr which is doing more
exotic things with IPv6.

I also disabled systemd.network since I got a warning about networking
conflict.

I moved the firewall directive to the networking file.

At this point the system comes up and nginx is hosting a static page.
2025-04-10 17:49:34 -07:00
Eli Ribble eb61a1fb6e Initial config for AFAF server. 2025-04-10 16:48:42 -07:00
3 changed files with 186 additions and 0 deletions

View File

@ -0,0 +1,132 @@
{ config, lib, pkgs, ... }: {
imports = [
./hardware-configuration.nix
./networking.nix # generated at runtime by nixos-infect
];
boot.tmp.cleanOnBoot = true;
environment.systemPackages = with pkgs; [
fish
git
neovim
tmux
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
wget
];
i18n.defaultLocale = "en_US.UTF-8";
nix.settings.experimental-features = [ "nix-command" "flakes" ];
programs.neovim.enable = true;
programs.neovim.defaultEditor = true;
security.acme = {
acceptTerms = true;
#certs."new.anythingforafriend.com" = {
#dnsProvider = "porkbun";
#domain = "anythingforafriend.com";
#environmentFile = "/opt/keys/porkbun";
#group = "nginx";
#};
defaults.email = "eli@gleipnir.technology";
};
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
services.cloud-init = {
enable = true;
network.enable = false;
};
services.phpfpm.pools.anythingforafriend = {
user = "www-data";
settings = {
"listen.owner" = config.services.nginx.user;
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.max_requests" = 500;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 5;
"php_admin_value[error_log]" = "stderr";
"php_admin_flag[log_errors]" = true;
"catch_workers_output" = true;
};
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
};
services.nginx = {
enable = true;
virtualHosts."new.anythingforafriend.com" = {
addSSL = true;
enableACME = true;
locations."/" = {
extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:${config.services.phpfpm.pools.anythingforafriend.socket};
include ${pkgs.nginx}/conf/fastcgi.conf;
'';
root = "/var/www/new.anythingforafriend.com";
};
};
};
services.openssh = {
enable = true;
# require public key authentication for better security
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "no";
};
# Set your time zone.
time.timeZone = "America/Phoenix";
users.groups.deploy = {};
users.groups.www-data = {};
users.users.www-data = {
isSystemUser = true;
createHome = true;
home = "/var/www/new.anythingforafriend.com";
group = "www-data";
};
users.users.deploy = {
extraGroups = [ "deploy" ];
isNormalUser = true;
};
users.users.eliribble = {
extraGroups = [ "wheel" ]; # Enable sudo for the user.
initialHashedPassword = "$y$j9T$XYOMZR8RZEiTnpaF8lsxv1$H7YbWDpzbnYXTLN0ZMhvtKOlSMy64P7C/RdLBaeaNf/";
isNormalUser = true;
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBvhtF6nRWlA6PVs71Eek7p0p2PxTd3P6ZEGFV2t75MB eliribble@nixos"];
};
users.users.root.openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBvhtF6nRWlA6PVs71Eek7p0p2PxTd3P6ZEGFV2t75MB eliribble@nixos'' ];
zramSwap.enable = true;
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "23.11";
}

View File

@ -0,0 +1,9 @@
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.loader.grub.device = "/dev/vda";
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
}

View File

@ -0,0 +1,45 @@
{ lib, ... }: {
# This file was populated at runtime with the networking
# details gathered from the active system.
networking = {
nameservers = [ "67.207.67.2"
"67.207.67.3"
];
defaultGateway = "165.232.144.1";
defaultGateway6 = {
address = "2604:a880:4:1d0::1";
interface = "eth0";
};
domain = "";
dhcpcd.enable = false;
firewall.enable = false;
hostName = "anythingforafriend";
usePredictableInterfaceNames = lib.mkForce false;
interfaces = {
eth0 = {
ipv4.addresses = [
{ address="165.232.148.220"; prefixLength=20; }
{ address="10.48.0.6"; prefixLength=16; }
];
ipv6.addresses = [
{ address="2604:a880:4:1d0::8824:2000"; prefixLength=64; }
{ address="fe80::d07c:78ff:feb9:fc84"; prefixLength=64; }
];
ipv4.routes = [ { address = "165.232.144.1"; prefixLength = 32; } ];
ipv6.routes = [ { address = "2604:a880:4:1d0::1"; prefixLength = 128; } ];
};
eth1 = {
ipv4.addresses = [
{ address="10.124.0.3"; prefixLength=20; }
];
ipv6.addresses = [
{ address="fe80::a05e:22ff:fec7:6692"; prefixLength=64; }
];
};
};
};
services.udev.extraRules = ''
ATTR{address}=="d2:7c:78:b9:fc:84", NAME="eth0"
ATTR{address}=="a2:5e:22:c7:66:92", NAME="eth1"
'';
}