forked from Fediversity/Fediversity
72 lines
2 KiB
Nix
72 lines
2 KiB
Nix
|
{ config, lib, pkgs, ... }: {
|
||
|
|
|
||
|
|
# open up access to the mastodon web interface
|
||
|
|
networking.firewall.allowedTCPPorts = [ 443 ];
|
||
|
|
|
||
|
|
services.mastodon = {
|
||
|
|
enable = true;
|
||
|
|
|
||
|
|
# TODO: set up a domain name, and a DNS service so that this can run not in a vm
|
||
|
|
# localDomain = "domain.social";
|
||
|
|
configureNginx = true;
|
||
|
|
|
||
|
|
# TODO: configure a mailserver so this works
|
||
|
|
smtp.fromAddress = "mastodon_vm";
|
||
|
|
|
||
|
|
# TODO: this is hardware-dependent. let's figure it out when we have hardware
|
||
|
|
# streamingProcesses = 1;
|
||
|
|
};
|
||
|
|
|
||
|
|
security.acme = {
|
||
|
|
acceptTerms = true;
|
||
|
|
preliminarySelfsigned = true;
|
||
|
|
# TODO: configure a mailserver so we can set up acme
|
||
|
|
# defaults.email = "test@example.com";
|
||
|
|
};
|
||
|
|
|
||
|
|
# let us log in
|
||
|
|
users.mutableUsers = false;
|
||
|
|
users.users.root.password = " ";
|
||
|
|
|
||
|
|
# access to convenient things
|
||
|
|
environment.systemPackages = with pkgs; [ w3m python3 ];
|
||
|
|
nix.extraOptions = ''
|
||
|
|
extra-experimental-features = nix-command flakes
|
||
|
|
'';
|
||
|
|
|
||
|
|
# these configurations only apply when producing a VM (e.g. nixos-rebuild build-vm)
|
||
|
|
virtualisation.vmVariant = { config, ... }: {
|
||
|
|
services.mastodon = {
|
||
|
|
# redirects to localhost, but allows it to have a proper domain name
|
||
|
|
# SEE: local.gd
|
||
|
|
localDomain = "social.local.gd";
|
||
|
|
|
||
|
|
# from the documentation: recommended is the amount of your CPU cores minus one.
|
||
|
|
# but it also must be a positive integer
|
||
|
|
streamingProcesses = let
|
||
|
|
ncores = config.virtualistation.cores;
|
||
|
|
max = x: y: if x > y then x else y;
|
||
|
|
in
|
||
|
|
max 1 (ncores - 1);
|
||
|
|
};
|
||
|
|
|
||
|
|
security.acme = {
|
||
|
|
defaults = {
|
||
|
|
# invalid server; the systemd service will fail, and we won't get properly signed certificates
|
||
|
|
# but let's not spam the letsencrypt servers (and we don't own this domain anyways)
|
||
|
|
server = "https://127.0.0.1";
|
||
|
|
email = "none";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
virtualisation.forwardPorts = [
|
||
|
|
{
|
||
|
|
from = "host";
|
||
|
|
host.port = 44443;
|
||
|
|
guest.port = 443;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|