Noratrieb/vps
1
0
Fork 0
mirror of https://github.com/Noratrieb/vps.git synced 2026-07-12 08:17:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

paperless

Browse source
This commit is contained in:
nora 2026-05-28 22:08:46 +02:00
parent 1df84d34b6
commit 975fb518ef
39 changed files with 158 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

49
nix/modules/caddy-base/default.nix Normal file
View file

@ -0,0 +1,49 @@
{ pkgs, ... }:
let
caddy = pkgs.caddy.withPlugins {
plugins = [
"github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
"github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
];
hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
};
in
{
environment.systemPackages = [ pkgs.caddy ];
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics
networking.firewall = {
allowedTCPPorts = [
80 # HTTP
443 # HTTPS
];
allowedUDPPorts = [
443 # HTTP/3 via QUIC
];
};
services.caddy = {
enable = true;
package = caddy;
logFormat = ''
output stdout
format json
'';
globalConfig = ''
auto_https disable_redirects
servers {
metrics
}
'';
virtualHosts = {
":9010" = {
logFormat = "output discard";
extraConfig = ''
metrics /metrics
'';
};
};
};
}

39
nix/modules/caddy/default.nix
View file

@ -1,40 +1,11 @@
{ pkgs, config, lib, name, ... }:
let
caddy = pkgs.caddy.withPlugins {
plugins = [
"github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
"github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
];
hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
};
in
{
environment.systemPackages = [ caddy ];
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics
networking.firewall = {
allowedTCPPorts = [
80 # HTTP
443 # HTTPS
];
allowedUDPPorts = [
443 # HTTP/3 via QUIC
];
};
{ pkgs, config, lib, name, ... }: {
imports = [ ../caddy-base ];
age.secrets.caddy_s3_key_secret.file = ../../secrets/caddy_s3_key_secret.age;
systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.caddy_s3_key_secret.path ];
systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
services.caddy = {
enable = true;
package = caddy;
logFormat = ''
output stdout
format json
'';
globalConfig = ''
email tls@noratrieb.dev
auto_https disable_redirects
@ -59,12 +30,6 @@ in
respond "This is an HTTPS-only server, silly you. Go to https:// instead." 418
'';
};
":9010" = {
logFormat = "output discard";
extraConfig = ''
metrics /metrics
'';
};
"${name}.infra.noratrieb.dev" = {
logFormat = "";
extraConfig = ''

10
nix/modules/dns/noratrieb.dev.nix
View file

@ -14,6 +14,10 @@ let
A = lib.lists.flatten (map (host: if builtins.hasAttr "A" host then host.A else [ ]) hosts);
AAAA = lib.lists.flatten (map (host: if builtins.hasAttr "AAAA" host then host.AAAA else [ ]) hosts);
};
minipc = {
A = [ (a "100.100.2.1") ]; # tailscale IP
};
in
with hostsToDns;
# vps{1,3,4} contains root noratrieb.dev
@ -89,6 +93,12 @@ let
grafana = vps3;
infra.subdomains = hostsToDns;
# --- internal stuff
internal.subdomains = {
immich = minipc;
paperless = minipc;
};
# --- other verification
_discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];
_atproto.TXT = [ "did=did:plc:pqyzoyxk7gfcbxk65mjyncyl" ];

24
nix/modules/paperless/default.nix Normal file
View file

@ -0,0 +1,24 @@
{ config, ... }:
let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
age.secrets.paperless_env.file = ../../secrets/paperless_env.age;
services.paperless = {
enable = true;
consumptionDir = "${nasDir}/consume";
address = "0.0.0.0";
port = 8010;
environmentFile = config.age.secrets.paperless_env.path;
settings = {
PAPERLESS_TIME_ZONE = "Europe/Zurich";
PAPERLESS_ADMIN_USER = "nora";
PAPERLESS_OCR_LANGUAGE = "deu+eng";
};
exporter = {
enable = true;
directory = "${nasDir}/export_minipc";
onCalendar = "02:25:00";
};
};
networking.firewall.allowedTCPPorts = [ 8010 ];
}