diff --git a/hosts/AZ-CLD-1/secrets.nix b/hosts/AZ-CLD-1/secrets.nix index d7fa332..74968c7 100644 --- a/hosts/AZ-CLD-1/secrets.nix +++ b/hosts/AZ-CLD-1/secrets.nix @@ -53,6 +53,14 @@ file = ../../secrets/outline-env.age; owner = "outline"; }; + snipe-it-app-key = { + file = ../../secrets/snipe-it-app-key.age; + owner = "snipeit"; + }; + snipe-it-db-password = { + file = ../../secrets/snipe-it-db-password.age; + owner = "snipeit"; + }; pgadmin-pw = { file = ../../secrets/pgadmin-pw.age; owner = "pgadmin"; diff --git a/hosts/AZ-CLD-1/services/default.nix b/hosts/AZ-CLD-1/services/default.nix index c9745cd..943fb1a 100644 --- a/hosts/AZ-CLD-1/services/default.nix +++ b/hosts/AZ-CLD-1/services/default.nix @@ -5,11 +5,13 @@ ./gitea.nix # ./gotenberg.nix ./metabase.nix + ./mysql.nix ./n8n.nix ./netbird.nix ./ntfy.nix ./outline.nix ./postgres.nix + ./snipe-it.nix ./traefik.nix ./vaultwarden.nix # ./zammad.nix diff --git a/hosts/AZ-CLD-1/services/mysql.nix b/hosts/AZ-CLD-1/services/mysql.nix new file mode 100644 index 0000000..96bebd3 --- /dev/null +++ b/hosts/AZ-CLD-1/services/mysql.nix @@ -0,0 +1,42 @@ +{ + config, + pkgs, + ... +}: let + mysqlPort = config.m3ta.ports.get "mysql"; +in { + services.mysql = { + enable = true; + package = pkgs.mariadb; + settings = { + mysqld = { + "bind-address" = "127.0.0.1"; + port = mysqlPort; + max_connections = 200; + innodb_buffer_pool_size = "1G"; + "character-set-server" = "utf8mb4"; + "collation-server" = "utf8mb4_unicode_ci"; + "skip-name-resolve" = true; + }; + client = { + port = mysqlPort; + socket = "/run/mysqld/mysqld.sock"; + }; + mysqldump = { + quick = true; + "single-transaction" = true; + }; + }; + }; + + services.mysqlBackup = { + enable = true; + calendar = "03:40:00"; + databases = ["snipeit"]; + singleTransaction = true; + }; + + networking.firewall.extraCommands = '' + iptables -A INPUT -p tcp -s 127.0.0.1 --dport ${toString mysqlPort} -j ACCEPT + ''; +} diff --git a/hosts/AZ-CLD-1/services/snipe-it.nix b/hosts/AZ-CLD-1/services/snipe-it.nix new file mode 100644 index 0000000..516ffab --- /dev/null +++ b/hosts/AZ-CLD-1/services/snipe-it.nix @@ -0,0 +1,74 @@ +{ + config, + lib, + ... +}: let + serviceName = "snipe-it"; + servicePort = config.m3ta.ports.get serviceName; + mysqlPort = config.m3ta.ports.get "mysql"; + hostName = "am.az-gruppe.com"; +in { + services.${serviceName} = { + enable = true; + inherit hostName; + appURL = "https://${hostName}"; + appKeyFile = config.age.secrets.snipe-it-app-key.path; + + database = { + host = "127.0.0.1"; + port = mysqlPort; + name = "snipeit"; + user = "snipeit"; + passwordFile = config.age.secrets.snipe-it-db-password.path; + createLocally = false; + }; + + mail = { + from = { + name = "Snipe-IT Asset Management"; + address = "snipe-it@az-gruppe.com"; + }; + replyTo = { + name = "Snipe-IT Asset Management"; + address = "snipe-it@az-gruppe.com"; + }; + backupNotificationAddress = "sascha.koenig@azintec.com"; + }; + + nginx.listen = [ + { + addr = "127.0.0.1"; + port = servicePort; + } + ]; + + config = { + APP_TRUSTED_PROXIES = "127.0.0.1"; + SECURE_COOKIES = lib.mkForce true; + }; + }; + + systemd.services.snipe-it-setup = { + after = ["mysql.service"]; + requires = ["mysql.service"]; + unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit"; + }; + + # Traefik configuration + services.traefik.dynamicConfigOptions.http = { + services.${serviceName}.loadBalancer.servers = [ + { + url = "http://localhost:${toString servicePort}/"; + } + ]; + + routers.${serviceName} = { + rule = "Host(`${hostName}`)"; + tls = { + certResolver = "ionos"; + }; + service = serviceName; + entrypoints = "websecure"; + }; + }; +} diff --git a/hosts/common/ports.nix b/hosts/common/ports.nix index 6c8de0e..f1d7b7a 100644 --- a/hosts/common/ports.nix +++ b/hosts/common/ports.nix @@ -23,6 +23,7 @@ metabase = 3013; baserow = 3050; frappe-lms = 3052; + snipe-it = 3053; librechat = 3040; librechat-dev = 3141; @@ -39,6 +40,7 @@ postgres = 5432; pgadmin = 5050; + mysql = 3306; }; hostOverrides = { diff --git a/secrets.nix b/secrets.nix index a21236d..72cd0b2 100644 --- a/secrets.nix +++ b/secrets.nix @@ -39,6 +39,8 @@ in { "secrets/netbird-server-env.age".publicKeys = systems ++ users; "secrets/netbird-proxy-env.age".publicKeys = systems ++ users; "secrets/outline-env.age".publicKeys = systems ++ users; + "secrets/snipe-it-app-key.age".publicKeys = systems ++ users; + "secrets/snipe-it-db-password.age".publicKeys = systems ++ users; "secrets/pgadmin-pw.age".publicKeys = systems ++ users; "secrets/vaultwarden-env.age".publicKeys = systems ++ users; "secrets/vaultwarden-db.age".publicKeys = systems ++ users; diff --git a/secrets/snipe-it-app-key.age b/secrets/snipe-it-app-key.age new file mode 100644 index 0000000..293ac45 --- /dev/null +++ b/secrets/snipe-it-app-key.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 ZhVseg GRkQQzDc0/uAS5EQhVuAFMsLHiLv5+l1fy386rh21A8 +WtoJ7LHn0XjUSB3TWZsIksmoYPfGioFwPTPkau5kJi0 +-> ssh-ed25519 SrHaqA ExCO6iMRiKPijwnRKA4cSCVCS4W2XJhMA80z9dpBzG0 +BQzXGUgiMUMLIe5VC++8r3qrfqwH3rBx9oiHKk6/qes +-> ssh-ed25519 lGqVZg 2+0lZ1pvSj/mqt/XDwwlF0DgP39JhabpMuFu2//iiQM +3jqnkxlhgCCwaRq9ejySZYk4cEDxVQDB3atymA14B04 +-> ssh-ed25519 CSMyhg VUV3cfueHoxhHDzUUJgS5O8yBV+Eftrtr98orxbvhUI +Gpnrqg+WYjsG0YTk3l7LT8u0sU8mVa2R3UJTDtb4dUc +--- gwCzURLiUxXmH3WmvDV13Ux2APQTBAVN1sFUQ+40SeY +%/JeO2s9s[Ǣ,EobsVqhVZ&]_UO:*r1r[ȳDAuk \ No newline at end of file diff --git a/secrets/snipe-it-db-password.age b/secrets/snipe-it-db-password.age new file mode 100644 index 0000000..dfdb191 --- /dev/null +++ b/secrets/snipe-it-db-password.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 ZhVseg /EkpDSh5G+kJXg+3K2UWQzET5LOklMcWmPr+wBBYNVY +sQWfcn1TGXfms9XDvrbDyAT53zfDk2HtU6wpdJZilRE +-> ssh-ed25519 SrHaqA xColHLU5LniOnaPUlSBEaY3XtyhBVNR5qJ6E1Q7v3zE +tMYICKjfL3AU92WTtGaeVldPGCvpINWB0ceXp4bf6nE +-> ssh-ed25519 lGqVZg yBVLMlFDN6Tnw6szhaltqCSmuO1BBQYCs/Jyt4v6BWQ +M9e1Exe3dkWj4o5B9pB7zEJ1W+8CLe3sEy51mOXzW/A +-> ssh-ed25519 CSMyhg hVbApibix4HqsT8T1/+KEqlPNPIB8T6fnp1HGtBDYEE +PAZzboVCDly8HsKjSP4zUwuzEda6+RL5PAIbyaOMGa0 +--- S9PkCc0D+hh0rvzGx3RluRK/t9vZ+RCGrmfgGlo0nSA +=A}[WxE,' &)'t,"o tV' \ No newline at end of file