awkawbandClaude Sonnet 5
38ec3c76f7
Packages HortusFox from source via php.buildComposerProject and provides a NixOS module (services.hortusfox-web) to deploy it as a full service (mariadb + phpfpm + nginx/caddy + ACME + cron timers). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
50 lines
1.4 KiB
Nix
50 lines
1.4 KiB
Nix
{ pkgs, modulesPath, ... }:
|
|
|
|
{
|
|
imports = [
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
../nixos-module
|
|
];
|
|
|
|
#nixpkgs.config.allowUnfree = true;
|
|
|
|
# `nix flake check` builds config.system.build.toplevel (a fully bootable
|
|
# system), even though this config is only ever meant to be built as
|
|
# `.config.system.build.vm` (see justfile). These satisfy its assertions
|
|
# without affecting the VM build itself.
|
|
fileSystems."/" = {
|
|
device = "/dev/disk/by-label/nixos";
|
|
fsType = "ext4";
|
|
};
|
|
boot.loader.grub.devices = [ "/dev/vda" ];
|
|
|
|
# Required by services.hortusfox-web's forceSSL+enableACME nginx vhost.
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "test@example.invalid";
|
|
};
|
|
|
|
users.users.root.initialPassword = "toor";
|
|
|
|
services.hortusfox-web = {
|
|
enable = true;
|
|
proxy.server = "nginx";
|
|
# No real domain/internet-reachable cert here, so serve plain HTTP --
|
|
# otherwise forceSSL+enableACME breaks the VM (see justfile's hostfwd
|
|
# to test over http://localhost:8080/).
|
|
proxy.ssl = false;
|
|
# Matches justfile's hostfwd (host 127.0.0.1:8080 -> guest 80), so
|
|
# login/session redirects land back on the forwarded port instead of
|
|
# the guest's own (unforwarded) port 80.
|
|
port = 8080;
|
|
adminAccount.passwordFile = ./hortusfox_web_test_password;
|
|
secretFile = ./test.env;
|
|
settings.APP_DEBUG = true;
|
|
};
|
|
|
|
networking.firewall.enable = false;
|
|
|
|
services.resolved.enable = true;
|
|
}
|
|
|