NGIpkgs Overview

{...}: {
  networking.firewall.allowedTCPPorts = [80];

  services = {
    atomic-server = {
      enable = true;
    };
  };
}

{...}: {
  networking.firewall.allowedTCPPorts = [80];

  services = {
    kbin = {
      enable = true;
      # settings.APP_DEBUG = "1";
    };

    postgresql = {
      enable = true;
      authentication = "host all all 127.0.0.1/32 trust";
      ensureUsers = [
        {
          name = "kbin";
          ensureDBOwnership = true;
        }
      ];
      ensureDatabases = ["kbin"];
      enableTCPIP = true;
    };
  };
}

{...}: {
  programs.libervia.enable = true;
}

{...}: {
  services.openfire-server = {
    enable = true;
    openFirewall = true;
  };
}

{
  config,
  pkgs,
  ...
}: let
  storageBase = "/var/lib/peertube";
  storageDir = subdir: "${storageBase}/${subdir}/";
in {
  environment = {
    # Sets the initial password of the root user to a fixed value. Make sure to change the password afterwards!
    etc."peertube-envvars".text = ''
      PT_INITIAL_ROOT_PASSWORD=changeme
    '';
  };

  services.peertube = {
    enable = true;

    # The system user & their group under which peertube will run
    user = "peertube";
    group = "peertube";

    # Do *NOT* use this in production, follow the docs and properly generate a secret here! i.e. using the output of:
    # openssl rand -hex 32
    # https://docs.joinpeertube.org/install/any-os#peertube-configuration
    secrets.secretsFile = pkgs.writeText "secrets.txt" "secrets";

    # Configure locally-running instances of redis server & database.
    database.createLocally = true;
    redis.createLocally = true;

    # Where we're running
    localDomain = "localhost";
    listenWeb = 9000;

    # Example settings, adjust as desired
    settings = {
      listen = {
        hostname = "0.0.0.0";
      };
      log = {
        level = "debug";
      };
      storage = {
        tmp = storageDir "tmp";
        logs = storageDir "logs";
        cache = storageDir "cache";
        plugins = storageDir "plugins";
      };
    };

    plugins = {
      enable = true;

      # The plugins you wish to use.
      plugins = with pkgs; [
        peertube-plugin-akismet
        peertube-plugin-auth-ldap
        peertube-plugin-auth-openid-connect
        peertube-plugin-auth-saml2
        peertube-plugin-auto-block-videos
        peertube-plugin-auto-mute
        peertube-plugin-hello-world
        peertube-plugin-logo-framasoft
        peertube-plugin-matomo
        peertube-plugin-privacy-remover
        peertube-plugin-transcoding-custom-quality
        peertube-plugin-transcoding-profile-debug
        peertube-plugin-video-annotation
        peertube-theme-background-red
        peertube-theme-dark
        peertube-theme-framasoft

        peertube-plugin-livechat
      ];
    };

    # For initial password
    serviceEnvironmentFile = "/etc/peertube-envvars";
  };

  systemd.tmpfiles.settings = let
    dirArgs = {
      mode = "0700";
      inherit (config.services.peertube) user group;
    };
  in {
    "99-peertube-plugins-test-setup" = {
      "${storageBase}".d = dirArgs;
      "${storageDir "tmp"}".d = dirArgs;
      "${storageDir "logs"}".d = dirArgs;
      "${storageDir "cache"}".d = dirArgs;
      "${storageDir "plugins"}".d = dirArgs;
    };
  };
}

{
  config,
  pkgs,
  ...
}: {
  networking = {
    firewall.allowedTCPPorts = [config.services.nginx.defaultHTTPListenPort];
    hostName = "server";
    domain = "example.com";
  };

  sops = {
    # See <https://github.com/Mic92/sops-nix>.

    age.keyFile = "/dev/null"; # For a production configuration, set this option.
    defaultSopsFile = "/dev/null"; # For a production configuration, set this option.
    validateSopsFiles = false; # For a production configuration, remove this line.

    secrets = let
      pretalxSecret = {
        owner = config.services.ngi-pretalx.user;
        group = config.services.ngi-pretalx.group;
      };
    in {
      "pretalx/database/password" = pretalxSecret;
      "pretalx/redis/location" = pretalxSecret;
      "pretalx/init/admin/password" = pretalxSecret;
      "pretalx/celery/backend" = pretalxSecret;
      "pretalx/celery/broker" = pretalxSecret;
    };
  };

  services = {
    ngi-pretalx = {
      enable = true;
      package = pkgs.pretalxFull;
      nginx = {
        # For a production configuration use this attribute set to configure the virtual host for pretalx.
      };
      database = {
        user = "pretalx";
        passwordFile = config.sops.secrets."pretalx/database/password".path;
      };
      redis = {
        enable = true;
        locationFile = config.sops.secrets."pretalx/redis/location".path;
      };
      celery = {
        enable = true;
        backendFile = config.sops.secrets."pretalx/celery/backend".path;
        brokerFile = config.sops.secrets."pretalx/celery/broker".path;
      };
      init = {
        admin = {
          email = "pretalx@localhost";
          passwordFile = config.sops.secrets."pretalx/init/admin/password".path;
        };
        organiser = {
          name = "NGI Packages";
          slug = "ngipkgs";
        };
      };
      mail.enable = false;
    };

    redis.servers."pretalx" = {
      enable = true;
      user = config.services.ngi-pretalx.user;
    };

    nginx = {
      enable = true;
      recommendedTlsSettings = true;
      recommendedOptimisation = true;
      recommendedGzipSettings = true;
      recommendedProxySettings = true;
    };
  };
}

{
  config,
  pkgs,
  ...
}: {
  services = {
    ngi-pretalx.database = {
      backend = "mysql";
      host = "/var/run/mysqld/mysqld.sock";
      user = "pretalx";
    };

    mysql = {
      enable = true;
      package = pkgs.mariadb;
      ensureUsers = [
        {
          name = config.services.ngi-pretalx.database.user;
          ensurePermissions."${config.services.ngi-pretalx.database.name}.*" = "ALL PRIVILEGES";
        }
      ];
      ensureDatabases = [config.services.ngi-pretalx.database.name];
    };
  };
}

{config, ...}: {
  services = {
    ngi-pretalx.database = {
      backend = "postgresql";
      user = "pretalx";
    };

    postgresql = {
      enable = true;
      authentication = "local all all trust";
      ensureUsers = [
        {
          name = config.services.ngi-pretalx.database.user;
          ensureDBOwnership = true;
        }
      ];
      ensureDatabases = [config.services.ngi-pretalx.database.name];
    };
  };
}

{
  services.vula.enable = true;
  services.vula.openFirewall = true;
}

{
  config,
  lib,
  pkgs,
  ...
}: {
  services.weblate = {
    enable = true;
    localDomain = "weblate.example.org";
    # Manually deployed secret. Can be generated with
    # `weblate-generate-secret-key > django-secret` when run as the weblate user.
    djangoSecretKeyFile = "/var/lib/weblate/django-secret";
    smtp = {
      enable = true;
      # Specify a valid account and server for your mail provider.
      user = "weblate@example.org";
      host = "mail.example.org";
      # Manually deployed secret
      passwordFile = "/var/lib/weblate/smtp-password";
    };
  };

  # Accept Letsencrypt TOS and provide contact email
  security.acme = {
    defaults.email = "letsencrypt@example.org";
    acceptTerms = true;
  };
}