imnyang/nix-flakes
Watch
1
0
Fork
You've already forked nix-flakes
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wow

Browse source
This commit is contained in:
암냥 2026-08-26 14:38:38 +09:00
commit 132226e710
6 changed files with 174 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

83
hosts/server/hikari/hako/services/api.nix Normal file
View file

@ -0,0 +1,83 @@
{ inputs, pkgs, ... }:
let
apiDependencies = pkgs.stdenv.mkDerivation {
pname = "imnyang-api-dependencies";
version = "unstable";
src = inputs.api;
nativeBuildInputs = [ pkgs.bun ];
dontConfigure = true;
buildPhase = ''
export HOME="$TMPDIR/home"
mkdir -p "$HOME"
bun install --frozen-lockfile --no-progress
'';
installPhase = ''
mkdir -p "$out"
cp -a node_modules "$out/node_modules"
'';
outputHashMode = "recursive";
outputHash = "sha256-ke6cG/cBON6d6giFo1RAQ4gMfIbmagJfCI1FfZl1w/8=";
};
apiPackage = pkgs.stdenv.mkDerivation {
pname = "imnyang-api";
version = "unstable";
src = inputs.api;
nativeBuildInputs = [ pkgs.bun ];
dontConfigure = true;
buildPhase = ''
cp -a ${apiDependencies}/node_modules ./node_modules
bun run build
'';
installPhase = ''
install -Dm755 server "$out/bin/server"
mkdir -p "$out/share/imnyang-api"
cp -r src/mitda "$out/share/imnyang-api/mitda"
'';
};
in
{
systemd.services.api = {
description = "Elysia";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
path = [ pkgs.dnsutils ];
preStart = ''
if ! test -e /var/lib/imnyang-api/nadae.hrts; then
printf '0\n' > /var/lib/imnyang-api/nadae.hrts
fi
'';
serviceConfig = {
Type = "simple";
User = "imnyang";
WorkingDirectory = "/var/lib/imnyang-api";
StateDirectory = "imnyang-api";
StateDirectoryMode = "0750";
ExecStart = "${apiPackage}/bin/server";
Restart = "always";
RestartSec = 5;
Environment = [
"NODE_ENV=production"
"MITDA_ASSETS_DIR=${apiPackage}/share/imnyang-api/mitda"
];
NoNewPrivileges = true;
PrivateTmp = true;
ProtectHome = true;
ProtectSystem = "strict";
};
};
}

64
hosts/server/hikari/hako/services/caddy.nix
View file

@ -27,7 +27,7 @@ let
@serverError expression {http.error.status_code} in [500, 502, 504, 505]
handle @serverError {
rewrite * /server.html
rewrite * /5xx.html
root * /var/static/error
file_server
}
@ -118,6 +118,31 @@ let
"twohearts.imnya.ng"
"whs.imnya.ng"
];
cloudflareIpRanges = [
"103.21.244.0/22"
"103.22.200.0/22"
"103.31.4.0/22"
"104.16.0.0/13"
"104.24.0.0/14"
"108.162.192.0/18"
"131.0.72.0/22"
"141.101.64.0/18"
"162.158.0.0/15"
"172.64.0.0/13"
"173.245.48.0/20"
"188.114.96.0/20"
"190.93.240.0/20"
"197.234.240.0/22"
"198.41.128.0/17"
"2400:cb00::/32"
"2606:4700::/32"
"2803:f800::/32"
"2405:b500::/32"
"2405:8100::/32"
"2a06:98c0::/29"
"2c0f:f248::/32"
];
in
{
services.caddy = {
@ -126,6 +151,17 @@ in
openFirewall = true;
package = pkgs.caddy;
globalConfig = ''
admin unix//run/caddy/admin.socket
storage file_system /var/lib/caddy
servers {
trusted_proxies static ${builtins.concatStringsSep " " cloudflareIpRanges}
client_ip_headers Cf-Connecting-Ip
}
debug
'';
virtualHosts =
builtins.listToAttrs (
map (host: {
@ -134,12 +170,23 @@ in
}) staticHosts
)
// {
"api.imnya.ng".extraConfig = reverseProxyWithHeaders "10.11.8.101:1108";
"nou.imnya.ng".extraConfig = reverseProxyWithHeaders "10.11.8.101:6974";
"api.imnya.ng".extraConfig = reverseProxyWithHeaders "127.0.0.1:1108";
"docs.imnya.ng".extraConfig = reverseProxy "100.70.1.1:3939";
"panel.imnya.ng".extraConfig = reverseProxy "127.0.0.1:32981";
"monitorss.imnya.ng".extraConfig = reverseProxy "127.0.0.1:3132";
"ip.imnya.ng".extraConfig = ''
header Access-Control-Allow-Origin "*"
header Access-Control-Allow-Methods "GET, OPTIONS"
header Access-Control-Allow-Headers "*"
@options method OPTIONS
respond @options 204
@ip path /
respond @ip "{http.request.header.Cf-Connecting-Ip}"
'';
"imnya.ng".extraConfig = withErrors ''
handle_path /.well-known/webfinger {
root * /var/www/imnya.ng
@ -240,7 +287,6 @@ in
reverse_proxy 10.20.30.101:6769
'';
"t.hrts.kr".extraConfig = reverseProxy "10.11.8.101:4041";
"wakapi.hrts.kr".extraConfig = reverseProxy "127.0.0.1:13000";
"ziit.hrts.kr".extraConfig = reverseProxy "127.0.0.1:6030";
"hikari-panel.hrts.kr".extraConfig = reverseProxy "10.11.8.104:8080";
@ -261,7 +307,6 @@ in
"auth.hrts.kr".extraConfig = reverseProxy "10.11.8.32:1411";
"git.hrts.kr".extraConfig = reverseProxy "127.0.0.1:3000";
"api-ftp.hrts.kr".extraConfig = reverseProxy "10.11.8.101:25716";
"panel.hrts.kr".extraConfig = reverseProxy "127.0.0.1:3929";
"pgadmin.hrts.kr".extraConfig = reverseProxy "127.0.0.1:5050";
"al-1s.hrts.kr".extraConfig = reverseProxy "127.0.0.1:9120";
@ -322,4 +367,13 @@ in
"demo.mizuki.guru".extraConfig = reverseProxy "10.20.30.103:3000";
};
};
systemd.services.caddy = {
requires = [ "mnt-static.mount" ];
after = [ "mnt-static.mount" "systemd-tmpfiles-setup.service" ];
serviceConfig = {
RuntimeDirectory = "caddy";
RuntimeDirectoryMode = "0755";
};
};
}