Compare commits

...

5 commits

Author SHA1 Message Date
Bruno BELANYI 0b70da3ac9 fixup! hosts: nixos: porthos: services: enable pdf-edit
All checks were successful
ci/woodpecker/push/check Pipeline was successful
2024-08-22 23:59:29 +02:00
Bruno BELANYI 771da4b137 WIP: FINISH SETTING UP FAIL2BAN 2024-08-22 23:56:53 +02:00
Bruno BELANYI 1fc8790790 hosts: nixos: porthos: services: enable pdf-edit 2024-08-22 23:50:40 +02:00
Bruno BELANYI bcf9c24c16 hosts: nixos: porthos: secrets: add pdf-edit 2024-08-22 23:50:11 +02:00
Bruno BELANYI 2675f85361 nixos: services: add pdf-edit 2024-08-22 23:50:11 +02:00
5 changed files with 81 additions and 0 deletions

View file

@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg VYlHgHSLpfKb5bn1XA3aCpfX7M23DgbraLxxOfo9PDk
Rj+mDvAsWX3WwpuhTrOubmo17j/aud5+P87df5bosBA
-> ssh-ed25519 jPowng o9ZFaYrITZ6DjWw07Vk/+TkuU187/ytlEK4sw7G32G4
zmxlpDvDDEgQFqBVARXeX1ABhvfJ4uAHfa6mIxXzjAY
--- k/d9FWW8/OSo8EllwOBV74pZyX918u54jEljGk3ATUc
ü4+ø2{hE7!Ò­GA`×<>_@Íß—´¡R_ý§6J„ñL4v,6%ô‡øó#^® Ù¹ åB­§OøF|7ܽÉL]œÙj
BþóÛ¾éaòs]xS<78>Î pbÞo#¬J1QŸ=t}5Õ>Oï{+¼. M"7e»yý÷—

View file

@ -77,6 +77,8 @@ in
"paperless/password.age".publicKeys = all; "paperless/password.age".publicKeys = all;
"paperless/secret-key.age".publicKeys = all; "paperless/secret-key.age".publicKeys = all;
"pdf-edit/login.age".publicKeys = all;
"podgrab/password.age".publicKeys = all; "podgrab/password.age".publicKeys = all;
"pyload/credentials.age".publicKeys = all; "pyload/credentials.age".publicKeys = all;

View file

@ -127,6 +127,11 @@ in
passwordFile = secrets."paperless/password".path; passwordFile = secrets."paperless/password".path;
secretKeyFile = secrets."paperless/secret-key".path; secretKeyFile = secrets."paperless/secret-key".path;
}; };
# Sometimes, editing PDFs is useful
pdf-edit = {
enable = true;
loginFile = secrets."pdf-edit/login".path;
};
# The whole *arr software suite # The whole *arr software suite
pirate = { pirate = {
enable = true; enable = true;

View file

@ -26,6 +26,7 @@
./nginx ./nginx
./nix-cache ./nix-cache
./paperless ./paperless
./pdf-edit
./pirate ./pirate
./podgrab ./podgrab
./postgresql ./postgresql

View file

@ -0,0 +1,65 @@
{ config, lib, ... }:
let
cfg = config.my.services.pdf-edit;
in
{
options.my.services.pdf-edit = with lib; {
enable = mkEnableOption "PDF edition service";
port = mkOption {
type = types.port;
default = 8089;
example = 8080;
description = "Internal port for webui";
};
loginFile = mkOption {
type = types.str;
example = "/run/secrets/pdf-edit/login.env";
description = ''
`SECURITY_INITIALLOGIN_USERNAME` and `SECURITY_INITIALLOGIN_PASSWORD`
defined in the format of 'EnvironmentFile' (see `systemd.exec(5)`).
'';
};
};
config = lib.mkIf cfg.enable {
services.stirling-pdf = lib.mkIf cfg.enable {
enable = true;
environment = {
SERVER_PORT = cfg.port;
SECURITY_CSRFDISABLED = "false";
SYSTEM_SHOWUPDATE = "false"; # We don't care about update notifications
INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "true"; # Installed by the module
SECURITY_ENABLELOGIN = "true";
};
environmentFiles = [ cfg.loginFile ];
};
my.services.nginx.virtualHosts = {
pdf-edit = {
inherit (cfg) port;
};
};
services.fail2ban.jails = {
stirling-pdf = ''
enabled = true
filter = stirling-pdf
port = http,https
'';
};
environment.etc = {
"fail2ban/filter.d/stirling-pdf.conf".text = ''
[Definition]
failregex = ^.*Failed login attempt from IP: <HOST>$
journalmatch = _SYSTEMD_UNIT=stirling-pdf.service
'';
};
};
}