applications/pelican/Notes.md

@@ -1,16 +0,0 @@
-# Notes on Pelican
-
-## Panel
-
-* ``pelican-install`` is in env that can be used to isntall
-* then go to ``panel-address.skynet.ie/installer`` to finish the setup  
-
-## Wing
-
-In the config the ssl must be set as so:
-```yaml
-  ssl:
-    enabled: true
-    cert: /var/lib/acme/skynet/fullchain.pem
-    key: /var/lib/acme/skynet/key.pem
-```

applications/pelican/nginx.nix

@@ -1,10 +1,6 @@
-{
+{ lib, config, pkgs, ... }:
-  lib,
+with lib;
-  config,
+let
-  pkgs,
-  ...
-}:
-with lib; let
   appUser = "nginx";
   name = "panel";
   module = "pelican-panel";
@@ -12,14 +8,15 @@ with lib; let
   serverName = "${name}.<DOMAIN NAME>";
   dataDir = "/var/www/pelican/public";
   port = 443;
-in {
+in
+{
   options.modules.nginx.${name} = {
     enable = mkEnableOption "Enable ${name}";
   };
 
   config = mkIf cfg.enable {
     modules.${module}.enable = true;
-    networking.firewall.allowedTCPPorts = [port];
+    networking.firewall.allowedTCPPorts = [ port ];
 
     services.phpfpm.pools.${appUser} = {
       user = appUser;
@@ -39,13 +36,7 @@ in {
 
     services.nginx.virtualHosts."${serverName}" = {
       root = "${dataDir}";
-      listen = [
+      listen = [{ inherit port; addr="0.0.0.0"; ssl=true; }];
-        {
-          inherit port;
-          addr = "0.0.0.0";
-          ssl = true;
-        }
-      ];
 
       forceSSL = true;
       enableACME = true;

applications/pelican/panel/panel.nix

@@ -1,10 +1,5 @@
-{
+{ inputs, pkgs, lib, config, ... }:
-  inputs,
+
-  pkgs,
-  lib,
-  config,
-  ...
-}:
 with lib; let
   cfg = config.modules.pelican-panel;
   dir = "/var/www/pelican";
@@ -31,18 +26,12 @@ in {
       pkgs.php83Extensions.zip
       pkgs.php83Extensions.intl
       pkgs.php83Extensions.sqlite3
-      (import ./pelican-install.nix {
+      ( import ./pelican-install.nix { inherit pkgs; inherit dir; } )
-        inherit pkgs;
+      ( import ./pelican-update.nix { inherit pkgs; inherit dir; } )
-        inherit dir;
-      })
-      (import ./pelican-update.nix {
-        inherit pkgs;
-        inherit dir;
-      })
     ];
 
     systemd.timers."pelican-cron" = {
-      wantedBy = ["timers.target"];
+      wantedBy = [ "timers.target" ];
       timerConfig = {
         OnBootSec = "5m";
         OnUnitActiveSec = "1m";
@@ -60,7 +49,7 @@ in {
     };
 
     systemd.services.pelican-queue = {
-      wantedBy = ["multi-user.target"];
+      wantedBy = [ "multi-user.target" ];
       serviceConfig = {
           User = "nginx";
           Group = "nginx";

applications/pelican/panel/pelican-install.nix

@@ -1,7 +1,5 @@
-{
+{ pkgs, dir }:
-  pkgs,
+
-  dir,
-}:
 pkgs.writeShellScriptBin "pelican-install" ''
   DIR=${dir}
 
@@ -24,7 +22,7 @@ pkgs.writeShellScriptBin "pelican-install" ''
 
   echo "Setting permissions ..."
   chmod -R 755 storage/* bootstrap/cache/
-  chown -R nginx:acme $DIR
+  chown -R nginx:nginx $DIR
 
   echo "Pelican panel installed successfully"
 ''

applications/pelican/panel/pelican-update.nix

@@ -1,7 +1,5 @@
-{
+{ pkgs, dir }:
-  pkgs,
+
-  dir,
-}:
 pkgs.writeShellScriptBin "pelican-update" ''
   DIR=${dir}
 
@@ -36,7 +34,7 @@ pkgs.writeShellScriptBin "pelican-update" ''
   php artisan migrate --seed --force
 
   echo "Setting permissions ..."
-  chown -R nginx:acme $DIR
+  chown -R nginx:nginx $DIR
 
   echo "Restart Pelican queue service ..."
   systemctl restart pelican-queue.service

applications/pelican/pelican.nix

@@ -1,279 +0,0 @@
-{
-  inputs,
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-with lib; let
-  name = "pelican";
-  cfg = config.services.skynet."${name}";
-  php_pool = name;
-  domain_panel = "${cfg.panel.domain.sub}.${cfg.panel.domain.base}.${cfg.panel.domain.tld}";
-in {
-  imports = [
-  ];
-
-  options.services.skynet."${name}" = {
-    panel = {
-      enable = mkEnableOption "Pelican Panel";
-
-      dir = mkOption {
-        type = types.str;
-        default = "/var/www/pelican";
-      };
-
-      domain = {
-        tld = mkOption {
-          type = types.str;
-          default = "ie";
-        };
-
-        base = mkOption {
-          type = types.str;
-          default = "skynet";
-        };
-
-        sub = mkOption {
-          type = types.str;
-          #default = name;
-          default = "panel-test";
-        };
-      };
-    };
-
-    wing = {
-      enable = mkEnableOption "Pelican Wing";
-
-      node_name = mkOption {
-        type = types.str;
-      };
-    };
-  };
-
-  config = mkMerge [
-    (mkIf cfg.panel.enable {
-      services.skynet.acme.domains = [
-        domain_panel
-      ];
-
-      # using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
-      services.skynet.dns.records = [
-        {
-          record = cfg.panel.domain.sub;
-          r_type = "CNAME";
-          value = config.services.skynet.host.name;
-        }
-      ];
-
-      environment.systemPackages = let
-        dir = cfg.panel.dir;
-      in [
-        pkgs.curl
-        pkgs.gnutar
-        pkgs.unzip
-        pkgs.php83
-        pkgs.php83Packages.composer
-        pkgs.php83Extensions.gd
-        pkgs.php83Extensions.mysqli
-        pkgs.php83Extensions.mbstring
-        pkgs.php83Extensions.bcmath
-        pkgs.php83Extensions.xml
-        pkgs.php83Extensions.curl
-        pkgs.php83Extensions.zip
-        pkgs.php83Extensions.intl
-        pkgs.php83Extensions.sqlite3
-        (import ./pelican-panel-install.nix {
-          inherit pkgs;
-          inherit dir;
-        })
-        (import ./pelican-panel-update.nix {
-          inherit pkgs;
-          inherit dir;
-        })
-      ];
-
-      systemd.timers."pelican-cron" = {
-        wantedBy = ["timers.target"];
-        timerConfig = {
-          OnBootSec = "5m";
-          OnUnitActiveSec = "1m";
-          Unit = "pelican-cron.service";
-        };
-      };
-
-      systemd.services."pelican-cron" = {
-        script = ''
-          ${pkgs.php83}/bin/php ${cfg.panel.dir}/artisan schedule:run >> /dev/null 2>&1
-        '';
-        serviceConfig = {
-          Type = "oneshot";
-        };
-      };
-
-      systemd.services.pelican-queue = {
-        wantedBy = ["multi-user.target"];
-        serviceConfig = {
-          User = config.services.nginx.user;
-          Group = config.services.nginx.group;
-          Restart = "always";
-          ExecStart = "${pkgs.php83}/bin/php -q ${cfg.panel.dir}/artisan queue:work --tries=3";
-          startLimitInterval = 180;
-          startLimitBurst = 30;
-          RestartSec = "5";
-        };
-      };
-
-      services.phpfpm.pools.${php_pool} = {
-        user = config.services.nginx.user;
-        group = config.services.nginx.group;
-        settings = {
-          "listen.owner" = config.services.nginx.user;
-          "listen.group" = config.services.nginx.group;
-          "listen.mode" = "0600";
-          "pm" = "dynamic";
-          "pm.max_children" = 75;
-          "pm.start_servers" = 10;
-          "pm.min_spare_servers" = 5;
-          "pm.max_spare_servers" = 20;
-          "pm.max_requests" = 500;
-          "catch_workers_output" = 1;
-        };
-      };
-
-      services.nginx.virtualHosts."${domain_panel}" = {
-        root = "${cfg.panel.dir}/public";
-
-        forceSSL = true;
-        useACMEHost = "skynet";
-
-        extraConfig = ''
-          index index.html index.htm index.php;
-          charset utf-8;
-
-          access_log off;
-          error_log  /var/log/nginx/pelican.app-error.log error;
-
-          client_max_body_size 100m;
-          client_body_timeout 120s;
-
-          sendfile off;
-
-          ssl_session_cache shared:SSL:10m;
-          ssl_protocols TLSv1.2 TLSv1.3;
-          ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
-          ssl_prefer_server_ciphers on;
-
-          add_header X-Content-Type-Options nosniff;
-          add_header X-XSS-Protection "1; mode=block";
-          add_header X-Robots-Tag none;
-          add_header Content-Security-Policy "frame-ancestors 'self'";
-          add_header X-Frame-Options DENY;
-          add_header Referrer-Policy same-origin;
-        '';
-
-        locations = {
-          "/" = {
-            extraConfig = ''
-              try_files $uri $uri/ /index.php?$query_string;
-            '';
-          };
-
-          "/favicon.ico".extraConfig = ''
-            access_log off;
-            log_not_found off;
-          '';
-
-          "/robots.txt".extraConfig = ''
-            access_log off;
-            log_not_found off;
-          '';
-
-          "~ \\.php$" = {
-            extraConfig = ''
-              fastcgi_split_path_info ^(.+\.php)(/.+)$;
-              fastcgi_pass unix:${config.services.phpfpm.pools.${php_pool}.socket};
-              fastcgi_index index.php;
-              include ${config.services.nginx.package}/conf/fastcgi_params;
-              fastcgi_param PHP_VALUE "upload_max_filesize = 100M \n post_max_size=100M";
-              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-              fastcgi_param HTTP_PROXY "";
-              fastcgi_intercept_errors off;
-              fastcgi_buffer_size 16k;
-              fastcgi_buffers 4 16k;
-              fastcgi_connect_timeout 300;
-              fastcgi_send_timeout 300;
-              fastcgi_read_timeout 300;
-            '';
-          };
-
-          "~ /\\.ht".extraConfig = ''
-            deny all;
-          '';
-        };
-      };
-    })
-
-    (mkIf cfg.wing.enable {
-      services.skynet.acme.domains = [
-        "${cfg.wing.node_name}.${domain_panel}"
-      ];
-
-      # using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
-      services.skynet.dns.records = [
-        {
-          record = "${cfg.wing.node_name}.${cfg.panel.domain.sub}";
-          r_type = "CNAME";
-          value = config.services.skynet.host.name;
-        }
-      ];
-      services.nginx.virtualHosts = {
-        "${cfg.wing.node_name}.${domain_panel}" = {
-          forceSSL = true;
-          useACMEHost = "skynet";
-          locations."/".proxyPass = "http://127.0.0.1:8080";
-        };
-      };
-
-      networking.firewall.allowedTCPPorts = [8080 8443];
-
-      virtualisation.docker.enable = true;
-
-      environment.systemPackages = [
-        (pkgs.callPackage ./pelican-wing-package.nix {})
-      ];
-
-      users.groups.pelican = {};
-      users.users.pelican = {
-        #createHome = true;
-        isSystemUser = true;
-        #home = "/etc/pelican";
-        group = "pelican";
-        extraGroups = ["docker" "acme"];
-        # X11 is to ensure the directory can be traversed
-        #homeMode = "711";
-      };
-
-      systemd.services.pelican-wings = {
-        description = "Wings Daemon";
-        after = ["docker.service"];
-        requires = ["docker.service"];
-        partOf = ["docker.service"];
-
-        serviceConfig = {
-          User = "root";
-          WorkingDirectory = "/etc/pelican";
-          LimitNOFILE = 4096;
-          PIDFile = "/var/run/wings/daemon.pid";
-          ExecStart = "/run/current-system/sw/bin/wings";
-          Restart = "on-failure";
-          startLimitInterval = 180;
-          startLimitBurst = 30;
-          RestartSec = "5";
-        };
-
-        wantedBy = ["multi-user.target"];
-      };
-    })
-  ];
-}

applications/pelican/wings/package.nix

@@ -1,10 +1,5 @@
-{
+{ stdenv, lib, fetchurl, docker, gnutar }:
-  stdenv,
+
-  lib,
-  fetchurl,
-  docker,
-  gnutar,
-}:
 stdenv.mkDerivation rec {
   pname = "pelican-wings";
   version = "v1.0.0-beta6";
@@ -14,9 +9,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-a2T4BjqS8Hy5YqwDEJpbvGqqsrVjdRhxvJLgk3MCXag=";
   };
 
-  buildInputs = [docker gnutar];
+  buildInputs = [ docker gnutar ];
 
-  phases = ["installPhase"];
+  phases = [ "installPhase" ];
 
   installPhase = ''
     install -D $src $out/bin/wings

applications/pelican/wings/wings.nix

@@ -1,10 +1,5 @@
-{
+{ inputs, pkgs, lib, config, ... }:
-  inputs,
+
-  pkgs,
-  lib,
-  config,
-  ...
-}:
 with lib; let
   cfg = config.modules.pelican-wings;
 in {
@@ -15,19 +10,19 @@ in {
   };
 
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [8080 8443];
+    networking.firewall.allowedTCPPorts = [ 8080 8443 ];
 
     virtualisation.docker.enable = true;
 
     environment.systemPackages = [
-      (pkgs.callPackage ./package.nix {})
+      ( pkgs.callPackage ./package.nix {} )
     ];
 
     systemd.services.pelican-wings = {
       description = "Wings Daemon";
-      after = ["docker.service"];
+      after = [ "docker.service" ];
-      requires = ["docker.service"];
+      requires = [ "docker.service" ];
-      partOf = ["docker.service"];
+      partOf = [ "docker.service" ];
 
       serviceConfig = {
         User = "root";
@@ -41,7 +36,7 @@ in {
         RestartSec = "5";
       };
 
-      wantedBy = ["multi-user.target"];
+      wantedBy = [ "multi-user.target" ];
     };
   };
 }

flake.nix

@@ -148,9 +148,6 @@
 
       # metrics
       ariia = import ./machines/ariia.nix;
-
-      # games server - panel/host
-      optimus = import ./machines/optimus.nix;
     };
   };
 }

machines/retired/optimus.nix

@@ -16,8 +16,8 @@ Notes:
   ...
 }: let
   # name of the server, sets teh hostname and record for it
-  name = "optimus-test";
+  name = "optimus";
-  ip_pub = "193.1.99.85";
+  ip_pub = "193.1.99.112";
   hostname = "${name}.skynet.ie";
   host = {
     ip = ip_pub;
@@ -26,7 +26,7 @@ Notes:
   };
 in {
   imports = [
-    ../applications/pelican/pelican.nix
+    ../applications/games.nix
   ];
 
   deployment = {
@@ -39,13 +39,7 @@ in {
 
   services.skynet = {
     host = host;
-    #backup.enable = true;
+    backup.enable = true;
-    pelican = {
+    games.enable = true;
-      panel.enable = true;
-      wing = {
-        enable = true;
-        node_name = "node01";
-      };
-    };
   };
 }