thohlt/archtika
1
0
Fork 0
mirror of https://github.com/thiloho/archtika.git synced 2025-11-22 02:41:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20 from archtika/devel

Browse Source 
Set prod module nix configuration
This commit is contained in:
Thilo Hohlt
2024-12-08 18:03:15 +01:00
committed by GitHub
parent 5a9526174f a6c0cf5167
commit fe42f275a5
2 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
nix/deploy/prod/default.nix
View File

@@ -6,8 +6,9 @@
../../module.nix ../../module.nix
]; ];
networking.hostName = "archtika-prod"; networking.hostName = "archtika-demo";
/*
services.archtika = { services.archtika = {
enable = true; enable = true;
package = localArchtikaPackage; package = localArchtikaPackage;
@@ -15,5 +16,11 @@
acmeEmail = "thilo.hohlt@tutanota.com"; acmeEmail = "thilo.hohlt@tutanota.com";
dnsProvider = "porkbun"; dnsProvider = "porkbun";
dnsEnvironmentFile = /var/lib/porkbun.env; dnsEnvironmentFile = /var/lib/porkbun.env;
settings = {
disableRegistration = true;
maxWebsiteStorageSize = 50;
maxUserWebsites = 2;
};
}; };
*/
} }

21
nix/module.nix
View File

@@ -28,9 +28,13 @@ let
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@privileged" "~@resources"]; SystemCallFilter = [
"@system-service"
ReadWritePaths = ["/var/www/archtika-websites"]; "~@privileged"
"~@resources"
];
ReadWritePaths = [ "/var/www/archtika-websites" ];
}; };
in in
{ {
@@ -154,7 +158,11 @@ in
Restart = "always"; Restart = "always";
WorkingDirectory = "${cfg.package}/rest-api"; WorkingDirectory = "${cfg.package}/rest-api";
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"]; RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
}; };
script = '' script = ''
@@ -181,7 +189,10 @@ in
Restart = "always"; Restart = "always";
WorkingDirectory = "${cfg.package}/web-app"; WorkingDirectory = "${cfg.package}/web-app";
RestrictAddressFamilies = ["AF_INET" "AF_INET6"]; RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
}; };
script = '' script = ''