93 lines
No EOL
2.1 KiB
Nix
93 lines
No EOL
2.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.services.skynet_ulfm;
|
|
in {
|
|
|
|
imports = [
|
|
./acme.nix
|
|
./dns.nix
|
|
./firewall.nix
|
|
./nginx.nix
|
|
];
|
|
|
|
options.services.skynet_ulfm = {
|
|
enable = mkEnableOption "ULFM service";
|
|
|
|
host = {
|
|
ip = mkOption {
|
|
type = types.str;
|
|
};
|
|
|
|
name = mkOption {
|
|
type = types.str;
|
|
};
|
|
};
|
|
|
|
domain = {
|
|
tld = mkOption {
|
|
type = types.str;
|
|
default = "ie";
|
|
};
|
|
|
|
base = mkOption {
|
|
type = types.str;
|
|
default = "skynet";
|
|
};
|
|
|
|
sub = mkOption {
|
|
type = types.str;
|
|
default = "ulfm";
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# shove the entire config file into secrets
|
|
age.secrets.ulfm.file = ../secrets/stream_ulfm.age;
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
8000
|
|
];
|
|
|
|
skynet_dns.records.cname = [
|
|
"${cfg.domain.sub} CNAME ${cfg.host.name}"
|
|
];
|
|
|
|
skynet_firewall.forward = [
|
|
"ip daddr ${cfg.host.ip} tcp dport 80 counter packets 0 bytes 0 accept"
|
|
"ip daddr ${cfg.host.ip} tcp dport 443 counter packets 0 bytes 0 accept"
|
|
"ip daddr ${cfg.host.ip} tcp dport 8000 counter packets 0 bytes 0 accept"
|
|
];
|
|
|
|
users.groups."icecast" = {};
|
|
|
|
users.users."icecast2" = {
|
|
createHome = true;
|
|
isSystemUser = true;
|
|
home = "/etc/icecast2";
|
|
group = "icecast";
|
|
};
|
|
|
|
systemd.services.icecast = {
|
|
after = [ "network.target" ];
|
|
description = "Icecast Network Audio Streaming Server";
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
preStart = "mkdir -p /var/log/icecast && chown nobody:nogroup /var/log/icecast";
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = "${pkgs.icecast}/bin/icecast -c /run/agenix/ulfm";
|
|
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
|
|
forceSSL = true;
|
|
useACMEHost = "skynet";
|
|
locations."/".proxyPass = "http://localhost:8000";
|
|
};
|
|
|
|
};
|
|
|
|
} |