feat(az-cld-1): add snipe-it service

2026-06-18 10:28:14 +02:00
parent e344edfe2c
commit a3d4bd7ab5
8 changed files with 152 additions and 0 deletions
@@ -0,0 +1,74 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  serviceName = "snipe-it";
+  servicePort = config.m3ta.ports.get serviceName;
+  mysqlPort = config.m3ta.ports.get "mysql";
+  hostName = "am.az-gruppe.com";
+in {
+  services.${serviceName} = {
+    enable = true;
+    inherit hostName;
+    appURL = "https://${hostName}";
+    appKeyFile = config.age.secrets.snipe-it-app-key.path;
+
+    database = {
+      host = "127.0.0.1";
+      port = mysqlPort;
+      name = "snipeit";
+      user = "snipeit";
+      passwordFile = config.age.secrets.snipe-it-db-password.path;
+      createLocally = false;
+    };
+
+    mail = {
+      from = {
+        name = "Snipe-IT Asset Management";
+        address = "snipe-it@az-gruppe.com";
+      };
+      replyTo = {
+        name = "Snipe-IT Asset Management";
+        address = "snipe-it@az-gruppe.com";
+      };
+      backupNotificationAddress = "sascha.koenig@azintec.com";
+    };
+
+    nginx.listen = [
+      {
+        addr = "127.0.0.1";
+        port = servicePort;
+      }
+    ];
+
+    config = {
+      APP_TRUSTED_PROXIES = "127.0.0.1";
+      SECURE_COOKIES = lib.mkForce true;
+    };
+  };
+
+  systemd.services.snipe-it-setup = {
+    after = ["mysql.service"];
+    requires = ["mysql.service"];
+    unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit";
+  };
+
+  # Traefik configuration
+  services.traefik.dynamicConfigOptions.http = {
+    services.${serviceName}.loadBalancer.servers = [
+      {
+        url = "http://localhost:${toString servicePort}/";
+      }
+    ];
+
+    routers.${serviceName} = {
+      rule = "Host(`${hostName}`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+    };
+  };
+}