From 6d9652bcc2c7bc7f087d9e8ab1cd8425e6da8e2b Mon Sep 17 00:00:00 2001 From: SebastianStork Date: Fri, 11 Apr 2025 09:03:43 +0200 Subject: [PATCH] Enable hedgedoc on alto --- hosts/alto/default.nix | 22 ++++++++--- hosts/alto/secrets.yaml | 6 ++- modules/system/hedgedoc/backups.nix | 36 +++++++++++++++++ modules/system/hedgedoc/default.nix | 60 +++++++++++++++++++++++++++++ 4 files changed, 117 insertions(+), 7 deletions(-) create mode 100644 modules/system/hedgedoc/backups.nix create mode 100644 modules/system/hedgedoc/default.nix diff --git a/hosts/alto/default.nix b/hosts/alto/default.nix index 64537f1..b0e223d 100644 --- a/hosts/alto/default.nix +++ b/hosts/alto/default.nix @@ -1,7 +1,8 @@ { config, ... }: let myCfg = config.myConfig; - in + caddyServe = myCfg.tailscale.caddyServe; +in { system.stateVersion = "24.11"; @@ -13,16 +14,27 @@ let ssh.enable = true; exitNode.enable = true; - caddyServe.nextcloud = { - subdomain = "cloud"; - inherit (myCfg.nextcloud) port; + caddyServe = { + nextcloud = { + subdomain = "cloud"; + inherit (myCfg.nextcloud) port; + }; + hedgedoc = { + subdomain = "docs"; + inherit (myCfg.hedgedoc) port; + }; }; }; nextcloud = { enable = true; backups.enable = true; - inherit (myCfg.tailscale.caddyServe.nextcloud) subdomain; + inherit (caddyServe.nextcloud) subdomain; + }; + hedgedoc = { + enable = true; + backups.enable = true; + inherit (caddyServe.hedgedoc) subdomain; }; }; } diff --git a/hosts/alto/secrets.yaml b/hosts/alto/secrets.yaml index 03b28b5..0ea7684 100644 --- a/hosts/alto/secrets.yaml +++ b/hosts/alto/secrets.yaml @@ -4,6 +4,8 @@ service-tailscale-auth-key: ENC[AES256_GCM,data:9tcgzoRvxKaop1wztCIQmyej7mhou/wG nextcloud: admin-password: ENC[AES256_GCM,data:TepYe5rZox6aoa3jeIhmBxaZIQGpjjf+SAG8E39y,iv:cAanc3a5e3PF+BkiFjcME+PiTSRaNj/e78kT/RTbaxY=,tag:wbn4vWeDnSJH7jWu7hutVw==,type:str] gmail-password: ENC[AES256_GCM,data:4NVrKWXcAA8OCxMx31ZnVYOnLbw=,iv:OlAtnSor7GDaqJSBHK+b0uFzweVnbc/9EdKxWarGt2c=,tag:UoOTTN8pM0tyYd59k1A+BA==,type:str] +hedgedoc: + seb-password: ENC[AES256_GCM,data:+pejm+Ju9l1jqY/8gpWRR6I5z3VEFzPxzw==,iv:0ji6ayKljy7LoZW423xcMmKJqsbon3JGzEb8KlbR2zs=,tag:sz8Szb8wA00U9Es0q0N/tw==,type:str] restic: environment: ENC[AES256_GCM,data:v1Ui5mG7Q98CFEpq7sSpzEf86cJAcRi+sqFdvy6ZPuY9dukJD2wAGt5fuNQkMzBCKAUTHb46ga1WYf9fZ5AUOPdA1MNrJWKrXlrsYh8ZJYKOgfEVBBYPUKKGcajILNQ5SzU=,iv:Asg4CWJbGqSZh8YaxcWA0Yxau1dE4ZV9JBJSiDHufGI=,tag:46pNMWoCbciEv4cIHo7KFQ==,type:str] password: ENC[AES256_GCM,data:NVeqrWqtdgbhu3U7dAgwFeNLS9oPtnAPSrkGtvYD,iv:3l+9+bZfOpZdSCBKzXn5PqJvqo7mz/rj1tkihJqMHIs=,tag:JXigRR1adGlm8ehRv5wzIA==,type:str] @@ -32,8 +34,8 @@ sops: dEhnSkQ5SDlnbmhGSVdYaDNuc3ZkM00K7WPEZRYWAd7uGY0IcDwGgQVPrpkF/tnz ncj03JXM4BXwvEQOmD/i6wS4U4WCwkh9EauGJljVFTeu6TciomDULQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-04-07T22:05:28Z" - mac: ENC[AES256_GCM,data:HuoqNVicXopTQPJcaXhlCpZBhSqAIhVmhL3Pwxe+L0XE6SB08wJZkdI44Tc9QpfyzU/tAFQQqR85Y8cPODCena/RCDHPPNsYmi38DTf+zQkZEfTgC7PBpeyPeLy4StMPC2MCAyEEnwqx6Lfel0qGrwMJYP3K9C+wZhAfEnlLObY=,iv:mrRXbC3ce2JVswIZOBsevPc894yPWd0hJ783f+JGASA=,tag:m8kpzfGq063NVShMG/67bw==,type:str] + lastmodified: "2025-04-10T21:05:17Z" + mac: ENC[AES256_GCM,data:FnKhhgp+UMy5LAgrDi33bkBtPr3vLMe5ocrxyP6Fu6q9hCG2onruetlp7NzSIaWcTiZqkSJ79RTDhEeZ1cALF0BY6PkvmbkiTF/wxhTk88q2AcC+AvdW3U7s7W9RQoZS1Vg2t4gCNv0j7f/1lZZ/p3z16NQ/XRZm1pYzpGy+ZNM=,iv:RrnkosL4nH/zIOEGIynPb70BXnLa254ueJXSbG29OQQ=,tag:nWtfIuj9jaqGC8dbXNvuag==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.9.4 diff --git a/modules/system/hedgedoc/backups.nix b/modules/system/hedgedoc/backups.nix new file mode 100644 index 0000000..7425f11 --- /dev/null +++ b/modules/system/hedgedoc/backups.nix @@ -0,0 +1,36 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + options.myConfig.hedgedoc.backups.enable = lib.mkEnableOption ""; + + config = lib.mkIf config.myConfig.hedgedoc.backups.enable { + myConfig.resticBackup.hedgedoc = { + healthchecks.enable = true; + + extraConfig = { + backupPrepareCommand = '' + ${lib.getExe' pkgs.systemd "systemctl"} stop hedgedoc.service + ''; + backupCleanupCommand = '' + ${lib.getExe' pkgs.systemd "systemctl"} start hedgedoc.service + ''; + paths = [ "/var/lib/hedgedoc" ]; + }; + }; + + environment.systemPackages = [ + (pkgs.writeShellApplication { + name = "hedgedoc-restore"; + text = '' + sudo systemctl stop hedgedoc.service + sudo restic-hedgedoc restore --target / latest + sudo systemctl start hedgedoc.service + ''; + }) + ]; + }; +} diff --git a/modules/system/hedgedoc/default.nix b/modules/system/hedgedoc/default.nix new file mode 100644 index 0000000..6b53f6c --- /dev/null +++ b/modules/system/hedgedoc/default.nix @@ -0,0 +1,60 @@ +{ + config, + pkgs, + lib, + ... +}: +let + cfg = config.myConfig.hedgedoc; + + user = config.users.users.hedgedoc.name; + inherit (config.users.users.hedgedoc) group; + + manage_users = "CMD_CONFIG_FILE=/run/hedgedoc/config.json NODE_ENV=production ${lib.getExe' pkgs.hedgedoc "manage_users"}"; +in +{ + options.myConfig.hedgedoc = { + enable = lib.mkEnableOption ""; + subdomain = lib.mkOption { + type = lib.types.nonEmptyStr; + default = ""; + }; + port = lib.mkOption { + type = lib.types.port; + default = 3000; + }; + }; + + config = lib.mkIf cfg.enable { + services.hedgedoc = { + enable = true; + + settings = { + domain = "${cfg.subdomain}.${config.networking.domain}"; + port = cfg.port; + protocolUseSSL = true; + + allowAnonymous = false; + allowEmailRegister = false; + defaultPermission = "limited"; + }; + }; + + sops.secrets."hedgedoc/seb-password" = { + owner = user; + inherit group; + }; + + systemd.services.hedgedoc.postStart = + let + manageUserSeb = + mode: + "${manage_users} --${mode} sebastian.stork@pm.me --pass \"$(cat ${ + config.sops.secrets."hedgedoc/seb-password".path + })\""; + in + "${manageUserSeb "add"} || ${manageUserSeb "reset"}"; + + environment.shellAliases.hedgedoc-manage-users = "sudo --user=${user} ${manage_users}"; + }; +}