96 lines
2.3 KiB
Nix
96 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
serviceName = "snipe-it";
|
|
servicePort = config.m3ta.ports.get serviceName;
|
|
mysqlPort = config.m3ta.ports.get "mysql";
|
|
hostName = "am.az-gruppe.com";
|
|
|
|
restoreDefaults = pkgs.writeShellScript "snipe-it-restore-defaults" ''
|
|
set -euo pipefail
|
|
src="${pkgs.snipe-it}/share/snipe-it/uploads"
|
|
dst="/var/lib/snipe-it/public/uploads"
|
|
|
|
if [ -d "$src" ] && [ -d "$dst" ]; then
|
|
# -n = kein Überschreiben existierender Dateien (User-Uploads bleiben erhalten)
|
|
cp -rn "$src/." "$dst/"
|
|
fi
|
|
'';
|
|
in {
|
|
services.${serviceName} = {
|
|
enable = true;
|
|
inherit hostName;
|
|
appURL = "https://${hostName}";
|
|
appKeyFile = config.age.secrets.snipe-it-app-key.path;
|
|
|
|
database = {
|
|
host = "127.0.0.1";
|
|
port = mysqlPort;
|
|
name = "snipeit";
|
|
user = "snipeit";
|
|
passwordFile = config.age.secrets.snipe-it-db-password.path;
|
|
createLocally = false;
|
|
};
|
|
|
|
mail = {
|
|
driver = "smtp";
|
|
host = "smtp.eu.mailgun.org";
|
|
port = 587;
|
|
encryption = "tls";
|
|
user = "bot@az-gruppe.com";
|
|
passwordFile = config.age.secrets.snipe-it-mail-password.path;
|
|
from = {
|
|
name = "AZ - Asset Management";
|
|
address = "bot@az-gruppe.com";
|
|
};
|
|
replyTo = {
|
|
name = "Snipe-IT Asset Management";
|
|
address = "bot@az-gruppe.com";
|
|
};
|
|
backupNotificationAddress = "sascha.koenig@azintec.com";
|
|
};
|
|
|
|
nginx.listen = [
|
|
{
|
|
addr = "127.0.0.1";
|
|
port = servicePort;
|
|
}
|
|
];
|
|
|
|
config = {
|
|
APP_TRUSTED_PROXIES = "127.0.0.1";
|
|
SECURE_COOKIES = lib.mkForce true;
|
|
};
|
|
};
|
|
|
|
systemd.services.snipe-it-setup = {
|
|
after = ["mysql.service"];
|
|
requires = ["mysql.service"];
|
|
unitConfig.ConditionPathExists = "${config.services.mysql.dataDir}/snipeit";
|
|
serviceConfig = {
|
|
ExecStartPre = ["+${restoreDefaults}"];
|
|
};
|
|
};
|
|
|
|
# Traefik configuration
|
|
services.traefik.dynamicConfigOptions.http = {
|
|
services.${serviceName}.loadBalancer.servers = [
|
|
{
|
|
url = "http://localhost:${toString servicePort}/";
|
|
}
|
|
];
|
|
|
|
routers.${serviceName} = {
|
|
rule = "Host(`${hostName}`)";
|
|
tls = {
|
|
certResolver = "ionos";
|
|
};
|
|
service = serviceName;
|
|
entrypoints = "websecure";
|
|
};
|
|
};
|
|
}
|