first commit

2026-05-05 08:30:51 +02:00
commit c0e781bf00
107 changed files with 7024 additions and 0 deletions
--- a/hosts/AZ-CLD-1/services/containers/baserow.nix
+++ b/hosts/AZ-CLD-1/services/containers/baserow.nix
@@ -0,0 +1,70 @@
+{config, ...}: let
+  serviceName = "baserow";
+  servicePort = config.m3ta.ports.get serviceName;
+in {
+  virtualisation.oci-containers.containers.${serviceName} = {
+    image = "docker.io/baserow/baserow:2.1.6";
+    environment = {
+      BASEROW_AMOUNT_OF_GUNICORN_WORKERS = "4";
+      BASEROW_AMOUNT_OF_WORKERS = "2";
+      DATABASE_CONN_MAX_AGE = "60";
+      # Proxy: tell Django the connection is HTTPS so cookies get Secure flag
+      BASEROW_ENABLE_SECURE_PROXY_SSL_HEADER = "yes";
+      # Published apps run on different origins — allow cross-origin cookie delivery
+      BASEROW_FRONTEND_SAME_SITE_COOKIE = "none";
+      # Valid base domain for published app subdomains
+      BASEROW_BUILDER_DOMAINS = "az-gruppe.com";
+      # Disable Caddy's on_demand TLS — Traefik handles TLS termination
+      BASEROW_CADDY_GLOBAL_CONF = "auto_https off";
+    };
+    environmentFiles = [config.age.secrets.baserow-env.path];
+    ports = ["127.0.0.1:${toString servicePort}:80"];
+    volumes = ["baserow_data:/baserow/data"];
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.10" "--network=web"];
+  };
+
+  # Traefik configuration
+  services.traefik.dynamicConfigOptions.http = {
+    services.${serviceName}.loadBalancer.servers = [
+      {
+        url = "http://localhost:${toString servicePort}/";
+      }
+    ];
+
+    middlewares."${serviceName}-headers".headers = {
+      customRequestHeaders = {
+        X-Forwarded-Proto = "https";
+        X-Forwarded-Port = "443";
+      };
+    };
+
+    routers.${serviceName} = {
+      rule = "Host(`br.az-gruppe.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+      middlewares = ["${serviceName}-headers"];
+    };
+
+    routers.azubi = {
+      rule = "Host(`azubi.az-gruppe.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+      middlewares = ["${serviceName}-headers"];
+    };
+    routers.ausbilder = {
+      rule = "Host(`ausbilder.az-gruppe.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = serviceName;
+      entrypoints = "websecure";
+      middlewares = ["${serviceName}-headers"];
+    };
+  };
+}