feat(az-cld-1): add snipe-it service

hosts/AZ-CLD-1/secrets.nix

@@ -53,6 +53,14 @@
         file = ../../secrets/outline-env.age;
         owner = "outline";
       };
+      snipe-it-app-key = {
+        file = ../../secrets/snipe-it-app-key.age;
+        owner = "snipeit";
+      };
+      snipe-it-db-password = {
+        file = ../../secrets/snipe-it-db-password.age;
+        owner = "snipeit";
+      };
       pgadmin-pw = {
         file = ../../secrets/pgadmin-pw.age;
         owner = "pgadmin";

hosts/AZ-CLD-1/services/default.nix

@@ -5,11 +5,13 @@
     ./gitea.nix
     # ./gotenberg.nix
     ./metabase.nix
+    ./mysql.nix
     ./n8n.nix
     ./netbird.nix
     ./ntfy.nix
     ./outline.nix
     ./postgres.nix
+    ./snipe-it.nix
     ./traefik.nix
     ./vaultwarden.nix
     # ./zammad.nix

hosts/AZ-CLD-1/services/mysql.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  mysqlPort = config.m3ta.ports.get "mysql";
+in {
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        "bind-address" = "127.0.0.1";
+        port = mysqlPort;
+        max_connections = 200;
+        innodb_buffer_pool_size = "1G";
+        "character-set-server" = "utf8mb4";
+        "collation-server" = "utf8mb4_unicode_ci";
+        "skip-name-resolve" = true;
+      };
+      client = {
+        port = mysqlPort;
+        socket = "/run/mysqld/mysqld.sock";
+      };
+      mysqldump = {
+        quick = true;
+        "single-transaction" = true;
+      };
+    };
+  };
+
+  services.mysqlBackup = {
+    enable = true;
+    calendar = "03:40:00";
+    databases = ["snipeit"];
+    singleTransaction = true;
+  };
+
+  networking.firewall.extraCommands = ''
+    iptables -A INPUT -p tcp -s 127.0.0.1 --dport ${toString mysqlPort} -j ACCEPT
+  '';
+}

hosts/AZ-CLD-1/services/snipe-it.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  serviceName = "snipe-it";
+  servicePort = config.m3ta.ports.get serviceName;
+  mysqlPort = config.m3ta.ports.get "mysql";
+  hostName = "am.az-gruppe.com";
+in {
+  services.${serviceName} = {
+    enable = true;
+    inherit hostName;
+    appURL = "https://${hostName}";
+    appKeyFile = config.age.secrets.snipe-it-app-key.path;
+
+    database = {
+      host = "127.0.0.1";
+      port = mysqlPort;
+      name = "snipeit";
+      user = "snipeit";
+      passwordFile = config.age.secrets.snipe-it-db-password.path;
+      createLocally = false;
+    };
+
+    mail = {
+      from = {
+        name = "Snipe-IT Asset Management";
+        address = "snipe-it@az-gruppe.com";
+      };
+      replyTo = {
+        name = "Snipe-IT Asset Management";
+        address = "snipe-it@az-gruppe.com";
+      };
+      backupNotificationAddress = "sascha.koenig@azintec.com";
+    };
+
+    nginx.listen = [
+      {
+        addr = "127.0.0.1";
+        port = servicePort;
+      }
+    ];
+
+    config = {
+      APP_TRUSTED_PROXIES = "127.0.0.1";
+      SECURE_COOKIES = lib.mkForce true;
+    };
+  };
+
+  systemd.services.snipe-it-setup = {
+    after = ["mysql.service"];
+    requires = ["mysql.service"];
+    unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit";
+  };
+
+  # Traefik configuration
+  services.traefik.dynamicConfigOptions.http = {
+    services.${serviceName}.loadBalancer.servers = [
+      {
+        url = "http://localhost:${toString servicePort}/";
+      }
+    ];
+
+    routers.${serviceName} = {
+      rule = "Host(`${hostName}`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/common/ports.nix

@@ -23,6 +23,7 @@
       metabase = 3013;
       baserow = 3050;
       frappe-lms = 3052;
+      snipe-it = 3053;
 
       librechat = 3040;
       librechat-dev = 3141;
@@ -39,6 +40,7 @@
 
       postgres = 5432;
       pgadmin = 5050;
+      mysql = 3306;
     };
 
     hostOverrides = {