feat(az-cld-1): add snipe-it service

hosts/AZ-CLD-1/secrets.nix

@@ -53,6 +53,14 @@
         file = ../../secrets/outline-env.age;
         owner = "outline";
       };
+      snipe-it-app-key = {
+        file = ../../secrets/snipe-it-app-key.age;
+        owner = "snipeit";
+      };
+      snipe-it-db-password = {
+        file = ../../secrets/snipe-it-db-password.age;
+        owner = "snipeit";
+      };
       pgadmin-pw = {
         file = ../../secrets/pgadmin-pw.age;
         owner = "pgadmin";

hosts/AZ-CLD-1/services/default.nix

@@ -5,11 +5,13 @@
     ./gitea.nix
     # ./gotenberg.nix
     ./metabase.nix
+    ./mysql.nix
     ./n8n.nix
     ./netbird.nix
     ./ntfy.nix
     ./outline.nix
     ./postgres.nix
+    ./snipe-it.nix
     ./traefik.nix
     ./vaultwarden.nix
     # ./zammad.nix

hosts/AZ-CLD-1/services/mysql.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  mysqlPort = config.m3ta.ports.get "mysql";
+in {
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        "bind-address" = "127.0.0.1";
+        port = mysqlPort;
+        max_connections = 200;
+        innodb_buffer_pool_size = "1G";
+        "character-set-server" = "utf8mb4";
+        "collation-server" = "utf8mb4_unicode_ci";
+        "skip-name-resolve" = true;
+      };
+      client = {
+        port = mysqlPort;
+        socket = "/run/mysqld/mysqld.sock";
+      };
+      mysqldump = {
+        quick = true;
+        "single-transaction" = true;
+      };
+    };
+  };
+
+  services.mysqlBackup = {
+    enable = true;
+    calendar = "03:40:00";
+    databases = ["snipeit"];
+    singleTransaction = true;
+  };
+
+  networking.firewall.extraCommands = ''
+    iptables -A INPUT -p tcp -s 127.0.0.1 --dport ${toString mysqlPort} -j ACCEPT
+  '';
+}

hosts/AZ-CLD-1/services/snipe-it.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  serviceName = "snipe-it";
+  servicePort = config.m3ta.ports.get serviceName;
+  mysqlPort = config.m3ta.ports.get "mysql";
+  hostName = "am.az-gruppe.com";
+in {
+  services.${serviceName} = {
+    enable = true;
+    inherit hostName;
+    appURL = "https://${hostName}";
+    appKeyFile = config.age.secrets.snipe-it-app-key.path;
+
+    database = {
+      host = "127.0.0.1";
+      port = mysqlPort;
+      name = "snipeit";
+      user = "snipeit";
+      passwordFile = config.age.secrets.snipe-it-db-password.path;
+      createLocally = false;
+    };
+
+    mail = {
+      from = {
+        name = "Snipe-IT Asset Management";
+        address = "snipe-it@az-gruppe.com";
+      };
+      replyTo = {
+        name = "Snipe-IT Asset Management";
+        address = "snipe-it@az-gruppe.com";
+      };
+      backupNotificationAddress = "sascha.koenig@azintec.com";
+    };
+
+    nginx.listen = [
+      {
+        addr = "127.0.0.1";
+        port = servicePort;
+      }
+    ];
+
+    config = {
+      APP_TRUSTED_PROXIES = "127.0.0.1";
+      SECURE_COOKIES = lib.mkForce true;
+    };
+  };
+
+  systemd.services.snipe-it-setup = {
+    after = ["mysql.service"];
+    requires = ["mysql.service"];
+    unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit";
+  };
+
+  # Traefik configuration
+  services.traefik.dynamicConfigOptions.http = {
+    services.${serviceName}.loadBalancer.servers = [
+      {
+        url = "http://localhost:${toString servicePort}/";
+      }
+    ];
+
+    routers.${serviceName} = {
+      rule = "Host(`${hostName}`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/common/ports.nix

@@ -23,6 +23,7 @@
       metabase = 3013;
       baserow = 3050;
       frappe-lms = 3052;
+      snipe-it = 3053;
 
       librechat = 3040;
       librechat-dev = 3141;
@@ -39,6 +40,7 @@
 
       postgres = 5432;
       pgadmin = 5050;
+      mysql = 3306;
     };
 
     hostOverrides = {

secrets.nix

@@ -39,6 +39,8 @@ in {
   "secrets/netbird-server-env.age".publicKeys = systems ++ users;
   "secrets/netbird-proxy-env.age".publicKeys = systems ++ users;
   "secrets/outline-env.age".publicKeys = systems ++ users;
+  "secrets/snipe-it-app-key.age".publicKeys = systems ++ users;
+  "secrets/snipe-it-db-password.age".publicKeys = systems ++ users;
   "secrets/pgadmin-pw.age".publicKeys = systems ++ users;
   "secrets/vaultwarden-env.age".publicKeys = systems ++ users;
   "secrets/vaultwarden-db.age".publicKeys = systems ++ users;

secrets/snipe-it-app-key.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZhVseg GRkQQzDc0/uAS5EQhVuAFMsLHiLv5+l1fy386rh21A8
+WtoJ7LHn0XjUSB3TWZsIksmoYPfGioFwPTPkau5kJi0
+-> ssh-ed25519 SrHaqA ExCO6iMRiKPijwnRKA4cSCVCS4W2XJhMA80z9dpBzG0
+BQzXGUgiMUMLIe5VC++8r3qrfqwH3rBx9oiHKk6/qes
+-> ssh-ed25519 lGqVZg 2+0lZ1pvSj/mqt/XDwwlF0DgP39JhabpMuFu2//iiQM
+3jqnkxlhgCCwaRq9ejySZYk4cEDxVQDB3atymA14B04
+-> ssh-ed25519 CSMyhg VUV3cfueHoxhHDzUUJgS5O8yBV+Eftrtr98orxbvhUI
+Gpnrqg+WYjsG0YTk3l7LT8u0sU8mVa2R3UJTDtb4dUc
+--- gwCzURLiUxXmH3WmvDV13Ux2APQTBAVN1sFUQ+40SeY
+Ë%îƒ/ËJeO2s9€Àžs[Ç¢¹–,EobsV‚Ô�qhV·­Z& Â]_UO²€­Î:*r1rÊÑ[³­ëȳÐüDôAuk¡

secrets/snipe-it-db-password.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZhVseg /EkpDSh5G+kJXg+3K2UWQzET5LOklMcWmPr+wBBYNVY
+sQWfcn1TGXfms9XDvrbDyAT53zfDk2HtU6wpdJZilRE
+-> ssh-ed25519 SrHaqA xColHLU5LniOnaPUlSBEaY3XtyhBVNR5qJ6E1Q7v3zE
+tMYICKjfL3AU92WTtGaeVldPGCvpINWB0ceXp4bf6nE
+-> ssh-ed25519 lGqVZg yBVLMlFDN6Tnw6szhaltqCSmuO1BBQYCs/Jyt4v6BWQ
+M9e1Exe3dkWj4o5B9pB7zEJ1W+8CLe3sEy51mOXzW/A
+-> ssh-ed25519 CSMyhg hVbApibix4HqsT8T1/+KEqlPNPIB8T6fnp1HGtBDYEE
+PAZzboVCDly8HsKjSP4zUwuzEda6+RL5PAIbyaOMGa0
+--- S9PkCc0D+hh0rvzGx3RluRK/t9vZ+RCGrmfgGlo0nSA
+‡=ÀƒíA}<†‡·OCdùÓIÊ[¦ÿô.Ô^‘Ú¸Q§Rñ ŤhÉÕ=bVnfÎ>[W´xóE†˜,øÛ'𠌨¶&°)'t,œ"Úíæ�o
Ýå	çÖtV'‚