thohlt/archtika
1
0
Fork 0
mirror of https://github.com/thiloho/archtika.git synced 2025-11-22 10:51:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

Set prod module nix configuration

Browse Source
This commit is contained in:
thiloho
2024-12-08 18:01:48 +01:00
parent 18210d501b
commit a6c0cf5167
2 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
nix/deploy/prod/default.nix
View File

@@ -6,8 +6,9 @@
../../module.nix ../../module.nix
]; ];
networking.hostName = "archtika-prod"; networking.hostName = "archtika-demo";
/*
services.archtika = { services.archtika = {
enable = true; enable = true;
package = localArchtikaPackage; package = localArchtikaPackage;
@@ -15,5 +16,11 @@
acmeEmail = "thilo.hohlt@tutanota.com"; acmeEmail = "thilo.hohlt@tutanota.com";
dnsProvider = "porkbun"; dnsProvider = "porkbun";
dnsEnvironmentFile = /var/lib/porkbun.env; dnsEnvironmentFile = /var/lib/porkbun.env;
settings = {
disableRegistration = true;
maxWebsiteStorageSize = 50;
maxUserWebsites = 2;
}; };
};
*/
} }

19
nix/module.nix
View File

@@ -28,9 +28,13 @@ let
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@privileged" "~@resources"]; SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
ReadWritePaths = ["/var/www/archtika-websites"]; ReadWritePaths = [ "/var/www/archtika-websites" ];
}; };
in in
{ {
@@ -154,7 +158,11 @@ in
Restart = "always"; Restart = "always";
WorkingDirectory = "${cfg.package}/rest-api"; WorkingDirectory = "${cfg.package}/rest-api";
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"]; RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
}; };
script = '' script = ''
@@ -181,7 +189,10 @@ in
Restart = "always"; Restart = "always";
WorkingDirectory = "${cfg.package}/web-app"; WorkingDirectory = "${cfg.package}/web-app";
RestrictAddressFamilies = ["AF_INET" "AF_INET6"]; RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
}; };
script = '' script = ''