diff options
Diffstat (limited to 'nixos/modules/services')
47 files changed, 964 insertions, 808 deletions
diff --git a/nixos/modules/services/audio/castopod.md b/nixos/modules/services/audio/castopod.md index ee8590737a7c7..40838cc77aa6a 100644 --- a/nixos/modules/services/audio/castopod.md +++ b/nixos/modules/services/audio/castopod.md @@ -7,16 +7,18 @@ Castopod is an open-source hosting platform made for podcasters who want to enga Use the following configuration to start a public instance of Castopod on `castopod.example.com` domain: ```nix -networking.firewall.allowedTCPPorts = [ 80 443 ]; -services.castopod = { - enable = true; - database.createLocally = true; - nginx.virtualHost = { - serverName = "castopod.example.com"; - enableACME = true; - forceSSL = true; +{ + networking.firewall.allowedTCPPorts = [ 80 443 ]; + services.castopod = { + enable = true; + database.createLocally = true; + nginx.virtualHost = { + serverName = "castopod.example.com"; + enableACME = true; + forceSSL = true; + }; }; -}; +} ``` Go to `https://castopod.example.com/cp-install` to create superadmin account after applying the above configuration. diff --git a/nixos/modules/services/backup/borgbackup.md b/nixos/modules/services/backup/borgbackup.md index 39141f6ec8587..2c91174732e1f 100644 --- a/nixos/modules/services/backup/borgbackup.md +++ b/nixos/modules/services/backup/borgbackup.md @@ -21,22 +21,21 @@ A complete list of options for the Borgbase module may be found ## Basic usage for a local backup {#opt-services-backup-borgbackup-local-directory} A very basic configuration for backing up to a locally accessible directory is: -``` +```nix { opt.services.borgbackup.jobs = { - { rootBackup = { - paths = "/"; - exclude = [ "/nix" "/path/to/local/repo" ]; - repo = "/path/to/local/repo"; - doInit = true; - encryption = { - mode = "repokey"; - passphrase = "secret"; - }; - compression = "auto,lzma"; - startAt = "weekly"; + rootBackup = { + paths = "/"; + exclude = [ "/nix" "/path/to/local/repo" ]; + repo = "/path/to/local/repo"; + doInit = true; + encryption = { + mode = "repokey"; + passphrase = "secret"; }; - } + compression = "auto,lzma"; + startAt = "weekly"; + }; }; } ``` @@ -59,7 +58,7 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ/ ``` Add the following snippet to your NixOS configuration: -``` +```nix { services.borgbackup.repos = { my_borg_repo = { @@ -80,7 +79,7 @@ that you have stored a secret passphrasse in the file {file}`/run/keys/borgbackup_passphrase`, which should be only accessible by root -``` +```nix { services.borgbackup.jobs = { backupToLocalServer = { @@ -96,7 +95,7 @@ accessible by root startAt = "hourly"; }; }; -}; +} ``` The following few commands (run as root) let you test your backup. diff --git a/nixos/modules/services/databases/foundationdb.md b/nixos/modules/services/databases/foundationdb.md index 0815c139152f3..9f7addc9c140c 100644 --- a/nixos/modules/services/databases/foundationdb.md +++ b/nixos/modules/services/databases/foundationdb.md @@ -15,9 +15,11 @@ key-value store. To enable FoundationDB, add the following to your {file}`configuration.nix`: -``` -services.foundationdb.enable = true; -services.foundationdb.package = pkgs.foundationdb71; # FoundationDB 7.1.x +```nix +{ + services.foundationdb.enable = true; + services.foundationdb.package = pkgs.foundationdb71; # FoundationDB 7.1.x +} ``` The {option}`services.foundationdb.package` option is required, and @@ -109,8 +111,10 @@ default configuration. See below for more on scaling to increase this. FoundationDB stores all data for all server processes under {file}`/var/lib/foundationdb`. You can override this using {option}`services.foundationdb.dataDir`, e.g. -``` -services.foundationdb.dataDir = "/data/fdb"; +```nix +{ + services.foundationdb.dataDir = "/data/fdb"; +} ``` Similarly, logs are stored under {file}`/var/log/foundationdb` @@ -265,8 +269,10 @@ directories. For example, to create backups in {command}`/opt/fdb-backups`, first set up the paths in the module options: -``` -services.foundationdb.extraReadWritePaths = [ "/opt/fdb-backups" ]; +```nix +{ + services.foundationdb.extraReadWritePaths = [ "/opt/fdb-backups" ]; +} ``` Restart the FoundationDB service, and it will now be able to write to this diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md index 3ff1f00fa9cfb..6cce8f542a532 100644 --- a/nixos/modules/services/databases/postgresql.md +++ b/nixos/modules/services/databases/postgresql.md @@ -15,9 +15,11 @@ PostgreSQL is an advanced, free relational database. ## Configuring {#module-services-postgres-configuring} To enable PostgreSQL, add the following to your {file}`configuration.nix`: -``` -services.postgresql.enable = true; -services.postgresql.package = pkgs.postgresql_15; +```nix +{ + services.postgresql.enable = true; + services.postgresql.package = pkgs.postgresql_15; +} ``` Note that you are required to specify the desired version of PostgreSQL (e.g. `pkgs.postgresql_15`). Since upgrading your PostgreSQL version requires a database dump and reload (see below), NixOS cannot provide a default value for [](#opt-services.postgresql.package) such as the most recent release of PostgreSQL. @@ -35,8 +37,10 @@ alice=> --> By default, PostgreSQL stores its databases in {file}`/var/lib/postgresql/$psqlSchema`. You can override this using [](#opt-services.postgresql.dataDir), e.g. -``` -services.postgresql.dataDir = "/data/postgresql"; +```nix +{ + services.postgresql.dataDir = "/data/postgresql"; +} ``` ## Initializing {#module-services-postgres-initializing} @@ -95,16 +99,19 @@ databases from `ensureDatabases` and `extraUser1` from `ensureUsers` are already created. ```nix + { systemd.services.postgresql.postStart = lib.mkAfter '' $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"' $PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"' # .... ''; + } ``` ##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot} ```nix + { systemd.services."migrate-service1-db1" = { serviceConfig.Type = "oneshot"; requiredBy = "service1.service"; @@ -119,6 +126,7 @@ are already created. # .... ''; }; + } ``` #### as service user {#module-services-postgres-initializing-extra-permissions-service-user} @@ -130,6 +138,7 @@ are already created. ##### in service `preStart` {#module-services-postgres-initializing-extra-permissions-service-user-pre-start} ```nix + { environment.PSQL = "psql --port=${toString services.postgresql.port}"; path = [ postgresql ]; systemd.services."service1".preStart = '' @@ -137,11 +146,13 @@ are already created. $PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"' # .... ''; + } ``` ##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-service-user-oneshot} ```nix + { systemd.services."migrate-service1-db1" = { serviceConfig.Type = "oneshot"; requiredBy = "service1.service"; @@ -156,6 +167,7 @@ are already created. # .... ''; }; + } ``` ## Upgrading {#module-services-postgres-upgrading} @@ -174,7 +186,7 @@ $ nix-instantiate --eval -A postgresql_13.psqlSchema "13" ``` For an upgrade, a script like this can be used to simplify the process: -``` +```nix { config, pkgs, ... }: { environment.systemPackages = [ @@ -256,16 +268,18 @@ postgresql_15.pkgs.pg_partman postgresql_15.pkgs.pgroonga ``` To add plugins via NixOS configuration, set `services.postgresql.extraPlugins`: -``` -services.postgresql.package = pkgs.postgresql_12; -services.postgresql.extraPlugins = ps: with ps; [ - pg_repack - postgis -]; +```nix +{ + services.postgresql.package = pkgs.postgresql_12; + services.postgresql.extraPlugins = ps: with ps; [ + pg_repack + postgis + ]; +} ``` You can build custom PostgreSQL-with-plugins (to be used outside of NixOS) using function `.withPackages`. For example, creating a custom PostgreSQL package in an overlay can look like: -``` +```nix self: super: { postgresql_custom = self.postgresql_12.withPackages (ps: [ ps.pg_repack @@ -275,7 +289,7 @@ self: super: { ``` Here's a recipe on how to override a particular plugin through an overlay: -``` +```nix self: super: { postgresql_15 = super.postgresql_15// { pkgs = super.postgresql_15.pkgs // { diff --git a/nixos/modules/services/databases/tigerbeetle.md b/nixos/modules/services/databases/tigerbeetle.md index 47394d4430598..12d920e7bcc77 100644 --- a/nixos/modules/services/databases/tigerbeetle.md +++ b/nixos/modules/services/databases/tigerbeetle.md @@ -7,8 +7,10 @@ TigerBeetle is a distributed financial accounting database designed for mission critical safety and performance. To enable TigerBeetle, add the following to your {file}`configuration.nix`: -``` +```nix +{ services.tigerbeetle.enable = true; +} ``` When first started, the TigerBeetle service will create its data file at {file}`/var/lib/tigerbeetle` unless the file already exists, in which case it will just use the existing file. @@ -20,13 +22,15 @@ By default, TigerBeetle will only listen on a local interface. To configure it to listen on a different interface (and to configure it to connect to other replicas, if you're creating more than one), you'll have to set the `addresses` option. Note that the TigerBeetle module won't open any firewall ports automatically, so if you configure it to listen on an external interface, you'll need to ensure that connections can reach it: -``` +```nix +{ services.tigerbeetle = { enable = true; addresses = [ "0.0.0.0:3001" ]; }; networking.firewall.allowedTCPPorts = [ 3001 ]; +} ``` A complete list of options for TigerBeetle can be found [here](#opt-services.tigerbeetle.enable). diff --git a/nixos/modules/services/desktops/flatpak.md b/nixos/modules/services/desktops/flatpak.md index af71d85b5a157..5299b32a03c7a 100644 --- a/nixos/modules/services/desktops/flatpak.md +++ b/nixos/modules/services/desktops/flatpak.md @@ -8,17 +8,21 @@ Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. To enable Flatpak, add the following to your {file}`configuration.nix`: -``` +```nix +{ services.flatpak.enable = true; +} ``` For the sandboxed apps to work correctly, desktop integration portals need to be installed. If you run GNOME, this will be handled automatically for you; in other cases, you will need to add something like the following to your {file}`configuration.nix`: -``` +```nix +{ xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; xdg.portal.config.common.default = "gtk"; +} ``` Then, you will need to add a repository, for example, diff --git a/nixos/modules/services/development/athens.md b/nixos/modules/services/development/athens.md index 77663db509d59..2795930b0a029 100644 --- a/nixos/modules/services/development/athens.md +++ b/nixos/modules/services/development/athens.md @@ -18,7 +18,7 @@ A complete list of options for the Athens module may be found ## Basic usage for a caching proxy configuration {#opt-services-development-athens-caching-proxy} A very basic configuration for Athens that acts as a caching and forwarding HTTP proxy is: -``` +```nix { services.athens = { enable = true; @@ -28,7 +28,7 @@ A very basic configuration for Athens that acts as a caching and forwarding HTTP If you want to prevent Athens from writing to disk, you can instead configure it to cache modules only in memory: -``` +```nix { services.athens = { enable = true; @@ -39,10 +39,10 @@ If you want to prevent Athens from writing to disk, you can instead configure it To use the local proxy in Go builds, you can set the proxy as environment variable: -``` +```nix { environment.variables = { - GOPROXY = "http://localhost:3000" + GOPROXY = "http://localhost:3000"; }; } ``` diff --git a/nixos/modules/services/development/blackfire.md b/nixos/modules/services/development/blackfire.md index e2e7e4780c79c..5a7fbe68f7d28 100644 --- a/nixos/modules/services/development/blackfire.md +++ b/nixos/modules/services/development/blackfire.md @@ -7,7 +7,7 @@ [Blackfire](https://blackfire.io) is a proprietary tool for profiling applications. There are several languages supported by the product but currently only PHP support is packaged in Nixpkgs. The back-end consists of a module that is loaded into the language runtime (called *probe*) and a service (*agent*) that the probe connects to and that sends the profiles to the server. To use it, you will need to enable the agent and the probe on your server. The exact method will depend on the way you use PHP but here is an example of NixOS configuration for PHP-FPM: -``` +```nix let php = pkgs.php.withExtensions ({ enabled, all }: enabled ++ (with all; [ blackfire diff --git a/nixos/modules/services/development/livebook.md b/nixos/modules/services/development/livebook.md index 5315f2c2755a0..aac9c58d081cd 100644 --- a/nixos/modules/services/development/livebook.md +++ b/nixos/modules/services/development/livebook.md @@ -9,7 +9,7 @@ Enabling the `livebook` service creates a user [`systemd`](https://www.freedesktop.org/wiki/Software/systemd/) unit which runs the server. -``` +```nix { ... }: { @@ -51,6 +51,8 @@ some features require additional packages. For example, the machine learning Kinos require `gcc` and `gnumake`. To add these, use `extraPackages`: -``` -services.livebook.extraPackages = with pkgs; [ gcc gnumake ]; +```nix +{ + services.livebook.extraPackages = with pkgs; [ gcc gnumake ]; +} ``` diff --git a/nixos/modules/services/editors/emacs.md b/nixos/modules/services/editors/emacs.md index 02f47b098d86c..885f927422bdc 100644 --- a/nixos/modules/services/editors/emacs.md +++ b/nixos/modules/services/editors/emacs.md @@ -178,7 +178,7 @@ file {file}`configuration.nix` to make it contain: ::: {.example #module-services-emacs-configuration-nix} ### Custom Emacs in `configuration.nix` -``` +```nix { environment.systemPackages = [ # [...] @@ -203,7 +203,7 @@ adding it to your {file}`~/.config/nixpkgs/config.nix` (see ::: {.example #module-services-emacs-config-nix} ### Custom Emacs in `~/.config/nixpkgs/config.nix` -``` +```nix { packageOverrides = super: let self = super.pkgs; in { myemacs = import ./emacs.nix { pkgs = self; }; @@ -228,7 +228,7 @@ only use {command}`emacsclient`), you can change your file ::: {.example #ex-emacsGtk3Nix} ### Custom Emacs build -``` +```nix { pkgs ? import <nixpkgs> {} }: let myEmacs = (pkgs.emacs.override { @@ -242,7 +242,7 @@ let rm $out/share/applications/emacs.desktop ''; }); -in [...] +in [ /* ... */ ] ``` ::: @@ -262,8 +262,10 @@ with the user's login session. To install and enable the {command}`systemd` user service for Emacs daemon, add the following to your {file}`configuration.nix`: -``` -services.emacs.enable = true; +```nix +{ + services.emacs.enable = true; +} ``` The {var}`services.emacs.package` option allows a custom @@ -323,9 +325,11 @@ In general, {command}`systemd` user services are globally enabled by symlinks in {file}`/etc/systemd/user`. In the case where Emacs daemon is not wanted for all users, it is possible to install the service but not globally enable it: -``` -services.emacs.enable = false; -services.emacs.install = true; +```nix +{ + services.emacs.enable = false; + services.emacs.install = true; +} ``` To enable the {command}`systemd` user service for just the diff --git a/nixos/modules/services/mail/mailman.md b/nixos/modules/services/mail/mailman.md index 55b61f8a25828..446aa1f921b64 100644 --- a/nixos/modules/services/mail/mailman.md +++ b/nixos/modules/services/mail/mailman.md @@ -9,7 +9,7 @@ an existing, securely configured Postfix setup, as it does not automatically con ## Basic usage with Postfix {#module-services-mailman-basic-usage} For a basic configuration with Postfix as the MTA, the following settings are suggested: -``` +```nix { config, ... }: { services.postfix = { enable = true; @@ -50,7 +50,7 @@ necessary, but outside the scope of the Mailman module. ## Using with other MTAs {#module-services-mailman-other-mtas} Mailman also supports other MTA, though with a little bit more configuration. For example, to use Mailman with Exim, you can use the following settings: -``` +```nix { config, ... }: { services = { mailman = { diff --git a/nixos/modules/services/matrix/maubot.md b/nixos/modules/services/matrix/maubot.md index f6a05db56cafd..d49066057a237 100644 --- a/nixos/modules/services/matrix/maubot.md +++ b/nixos/modules/services/matrix/maubot.md @@ -10,7 +10,9 @@ framework for Matrix. 2. If you want to use PostgreSQL instead of SQLite, do this: ```nix - services.maubot.settings.database = "postgresql://maubot@localhost/maubot"; + { + services.maubot.settings.database = "postgresql://maubot@localhost/maubot"; + } ``` If the PostgreSQL connection requires a password, you will have to @@ -18,54 +20,58 @@ framework for Matrix. 3. If you plan to expose your Maubot interface to the web, do something like this: ```nix - services.nginx.virtualHosts."matrix.example.org".locations = { - "/_matrix/maubot/" = { - proxyPass = "http://127.0.0.1:${toString config.services.maubot.settings.server.port}"; - proxyWebsockets = true; + { + services.nginx.virtualHosts."matrix.example.org".locations = { + "/_matrix/maubot/" = { + proxyPass = "http://127.0.0.1:${toString config.services.maubot.settings.server.port}"; + proxyWebsockets = true; + }; }; - }; - services.maubot.settings.server.public_url = "matrix.example.org"; - # do the following only if you want to use something other than /_matrix/maubot... - services.maubot.settings.server.ui_base_path = "/another/base/path"; + services.maubot.settings.server.public_url = "matrix.example.org"; + # do the following only if you want to use something other than /_matrix/maubot... + services.maubot.settings.server.ui_base_path = "/another/base/path"; + } ``` 4. Optionally, set `services.maubot.pythonPackages` to a list of python3 packages to make available for Maubot plugins. 5. Optionally, set `services.maubot.plugins` to a list of Maubot plugins (full list available at https://plugins.maubot.xyz/): ```nix - services.maubot.plugins = with config.services.maubot.package.plugins; [ - reactbot - # This will only change the default config! After you create a - # plugin instance, the default config will be copied into that - # instance's config in Maubot's database, and further base config - # changes won't affect the running plugin. - (rss.override { - base_config = { - update_interval = 60; - max_backoff = 7200; - spam_sleep = 2; - command_prefix = "rss"; - admins = [ "@chayleaf:pavluk.org" ]; - }; - }) - ]; - # ...or... - services.maubot.plugins = config.services.maubot.package.plugins.allOfficialPlugins; - # ...or... - services.maubot.plugins = config.services.maubot.package.plugins.allPlugins; - # ...or... - services.maubot.plugins = with config.services.maubot.package.plugins; [ - (weather.override { - # you can pass base_config as a string - base_config = '' - default_location: New York - default_units: M - default_language: - show_link: true - show_image: false - ''; - }) - ]; + { + services.maubot.plugins = with config.services.maubot.package.plugins; [ + reactbot + # This will only change the default config! After you create a + # plugin instance, the default config will be copied into that + # instance's config in Maubot's database, and further base config + # changes won't affect the running plugin. + (rss.override { + base_config = { + update_interval = 60; + max_backoff = 7200; + spam_sleep = 2; + command_prefix = "rss"; + admins = [ "@chayleaf:pavluk.org" ]; + }; + }) + ]; + # ...or... + services.maubot.plugins = config.services.maubot.package.plugins.allOfficialPlugins; + # ...or... + services.maubot.plugins = config.services.maubot.package.plugins.allPlugins; + # ...or... + services.maubot.plugins = with config.services.maubot.package.plugins; [ + (weather.override { + # you can pass base_config as a string + base_config = '' + default_location: New York + default_units: M + default_language: + show_link: true + show_image: false + ''; + }) + ]; + } ``` 6. Start Maubot at least once before doing the following steps (it's necessary to generate the initial config). diff --git a/nixos/modules/services/matrix/mjolnir.md b/nixos/modules/services/matrix/mjolnir.md index f6994eeb8fa5b..2594f05ce27bb 100644 --- a/nixos/modules/services/matrix/mjolnir.md +++ b/nixos/modules/services/matrix/mjolnir.md @@ -46,7 +46,7 @@ autoconfigure a new Pantalaimon instance, which will connect to the homeserver set in [services.mjolnir.homeserverUrl](#opt-services.mjolnir.homeserverUrl) and Mjolnir itself will be configured to connect to the new Pantalaimon instance. -``` +```nix { services.mjolnir = { enable = true; @@ -78,7 +78,7 @@ uses across an entire homeserver. To use the Antispam Module, add `matrix-synapse-plugins.matrix-synapse-mjolnir-antispam` to the Synapse plugin list and enable the `mjolnir.Module` module. -``` +```nix { services.matrix-synapse = { plugins = with pkgs; [ diff --git a/nixos/modules/services/matrix/synapse.md b/nixos/modules/services/matrix/synapse.md index 9c9c025fc5f54..7f6587ce09df8 100644 --- a/nixos/modules/services/matrix/synapse.md +++ b/nixos/modules/services/matrix/synapse.md @@ -23,7 +23,7 @@ synapse server for the `example.org` domain, served from the host `myhostname.example.org`. For more information, please refer to the [installation instructions of Synapse](https://element-hq.github.io/synapse/latest/setup/installation.html) . -``` +```nix { pkgs, lib, config, ... }: let fqdn = "${config.networking.hostName}.${config.networking.domain}"; @@ -158,7 +158,7 @@ in an additional file like this: by `matrix-synapse`. - Include the file like this in your configuration: - ``` + ```nix { services.matrix-synapse.extraConfigFiles = [ "/run/secrets/matrix-shared-secret" @@ -190,7 +190,7 @@ fill in the required connection details automatically when you enter your Matrix Identifier. See [Try Matrix Now!](https://matrix.org/docs/projects/try-matrix-now.html) for a list of existing clients and their supported featureset. -``` +```nix { services.nginx.virtualHosts."element.${fqdn}" = { enableACME = true; diff --git a/nixos/modules/services/misc/anki-sync-server.md b/nixos/modules/services/misc/anki-sync-server.md index 5d2b4da4d2fc2..f58d3d8ad0dab 100644 --- a/nixos/modules/services/misc/anki-sync-server.md +++ b/nixos/modules/services/misc/anki-sync-server.md @@ -16,7 +16,7 @@ unit which runs the sync server with an isolated user using the systemd `DynamicUser` option. This can be done by enabling the `anki-sync-server` service: -``` +```nix { ... }: { @@ -27,7 +27,7 @@ This can be done by enabling the `anki-sync-server` service: It is necessary to set at least one username-password pair under {option}`services.anki-sync-server.users`. For example -``` +```nix { services.anki-sync-server.users = [ { @@ -50,7 +50,7 @@ you want to expose the sync server directly to other computers (not recommended in most circumstances, because the sync server doesn't use HTTPS), then set the following options: -``` +```nix { services.anki-sync-server.host = "0.0.0.0"; services.anki-sync-server.openFirewall = true; diff --git a/nixos/modules/services/misc/forgejo.md b/nixos/modules/services/misc/forgejo.md index 14b21933e6b09..f234ebf44aefb 100644 --- a/nixos/modules/services/misc/forgejo.md +++ b/nixos/modules/services/misc/forgejo.md @@ -57,23 +57,25 @@ locations and database, instead of having to copy or rename them. Make sure to disable `services.gitea`, when doing this. ```nix -services.gitea.enable = false; - -services.forgejo = { - enable = true; - user = "gitea"; - group = "gitea"; - stateDir = "/var/lib/gitea"; - database.name = "gitea"; - database.user = "gitea"; -}; - -users.users.gitea = { - home = "/var/lib/gitea"; - useDefaultShell = true; - group = "gitea"; - isSystemUser = true; -}; - -users.groups.gitea = {}; +{ + services.gitea.enable = false; + + services.forgejo = { + enable = true; + user = "gitea"; + group = "gitea"; + stateDir = "/var/lib/gitea"; + database.name = "gitea"; + database.user = "gitea"; + }; + + users.users.gitea = { + home = "/var/lib/gitea"; + useDefaultShell = true; + group = "gitea"; + isSystemUser = true; + }; + + users.groups.gitea = {}; +} ``` diff --git a/nixos/modules/services/misc/gitlab.md b/nixos/modules/services/misc/gitlab.md index 916b23584ed0c..f7a5a80274890 100644 --- a/nixos/modules/services/misc/gitlab.md +++ b/nixos/modules/services/misc/gitlab.md @@ -10,19 +10,21 @@ configure a webserver to proxy HTTP requests to the socket. For instance, the following configuration could be used to use nginx as frontend proxy: -``` -services.nginx = { - enable = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - virtualHosts."git.example.com" = { - enableACME = true; - forceSSL = true; - locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; +```nix +{ + services.nginx = { + enable = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + virtualHosts."git.example.com" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + }; }; -}; +} ``` ## Configuring {#module-services-gitlab-configuring} @@ -35,36 +37,38 @@ The default state dir is `/var/gitlab/state`. This is where all data like the repositories and uploads will be stored. A basic configuration with some custom settings could look like this: -``` -services.gitlab = { - enable = true; - databasePasswordFile = "/var/keys/gitlab/db_password"; - initialRootPasswordFile = "/var/keys/gitlab/root_password"; - https = true; - host = "git.example.com"; - port = 443; - user = "git"; - group = "git"; - smtp = { +```nix +{ + services.gitlab = { enable = true; - address = "localhost"; - port = 25; - }; - secrets = { - dbFile = "/var/keys/gitlab/db"; - secretFile = "/var/keys/gitlab/secret"; - otpFile = "/var/keys/gitlab/otp"; - jwsFile = "/var/keys/gitlab/jws"; - }; - extraConfig = { - gitlab = { - email_from = "gitlab-no-reply@example.com"; - email_display_name = "Example GitLab"; - email_reply_to = "gitlab-no-reply@example.com"; - default_projects_features = { builds = false; }; + databasePasswordFile = "/var/keys/gitlab/db_password"; + initialRootPasswordFile = "/var/keys/gitlab/root_password"; + https = true; + host = "git.example.com"; + port = 443; + user = "git"; + group = "git"; + smtp = { + enable = true; + address = "localhost"; + port = 25; + }; + secrets = { + dbFile = "/var/keys/gitlab/db"; + secretFile = "/var/keys/gitlab/secret"; + otpFile = "/var/keys/gitlab/otp"; + jwsFile = "/var/keys/gitlab/jws"; + }; + extraConfig = { + gitlab = { + email_from = "gitlab-no-reply@example.com"; + email_display_name = "Example GitLab"; + email_reply_to = "gitlab-no-reply@example.com"; + default_projects_features = { builds = false; }; + }; }; }; -}; +} ``` If you're setting up a new GitLab instance, generate new diff --git a/nixos/modules/services/misc/sourcehut/default.md b/nixos/modules/services/misc/sourcehut/default.md index 44d58aa0bef3e..f965c395038a3 100644 --- a/nixos/modules/services/misc/sourcehut/default.md +++ b/nixos/modules/services/misc/sourcehut/default.md @@ -12,7 +12,7 @@ This NixOS module also provides basic configuration integrating Sourcehut into l and `services.postgresql` services. A very basic configuration may look like this: -``` +```nix { pkgs, ... }: let fqdn = @@ -66,9 +66,9 @@ in { # Settings to setup what certificates are used for which endpoint. virtualHosts = { "${fqdn}".enableACME = true; - "meta.${fqdn}".useACMEHost = fqdn: - "man.${fqdn}".useACMEHost = fqdn: - "git.${fqdn}".useACMEHost = fqdn: + "meta.${fqdn}".useACMEHost = fqdn; + "man.${fqdn}".useACMEHost = fqdn; + "git.${fqdn}".useACMEHost = fqdn; }; }; } diff --git a/nixos/modules/services/misc/weechat.md b/nixos/modules/services/misc/weechat.md index 21f41be5b4a0e..fb20ebe1e4db2 100644 --- a/nixos/modules/services/misc/weechat.md +++ b/nixos/modules/services/misc/weechat.md @@ -12,7 +12,7 @@ unit which runs the chat client in a detached session. This can be done by enabling the `weechat` service: -``` +```nix { ... }: { @@ -30,7 +30,7 @@ allow your another user to attach to this session, the `screenrc` needs to be tweaked by adding [multiuser](https://www.gnu.org/software/screen/manual/html_node/Multiuser.html#Multiuser) support: -``` +```nix { programs.screen.screenrc = '' multiuser on diff --git a/nixos/modules/services/monitoring/certspotter.md b/nixos/modules/services/monitoring/certspotter.md index 9bf6e1d946a04..e999bfe65ec3e 100644 --- a/nixos/modules/services/monitoring/certspotter.md +++ b/nixos/modules/services/monitoring/certspotter.md @@ -9,17 +9,19 @@ A basic config that notifies you of all certificate changes for your domain would look as follows: ```nix -services.certspotter = { - enable = true; - # replace example.org with your domain name - watchlist = [ ".example.org" ]; - emailRecipients = [ "webmaster@example.org" ]; -}; +{ + services.certspotter = { + enable = true; + # replace example.org with your domain name + watchlist = [ ".example.org" ]; + emailRecipients = [ "webmaster@example.org" ]; + }; -# Configure an SMTP client -programs.msmtp.enable = true; -# Or you can use any other module that provides sendmail, like -# services.nullmailer, services.opensmtpd, services.postfix + # Configure an SMTP client + programs.msmtp.enable = true; + # Or you can use any other module that provides sendmail, like + # services.nullmailer, services.opensmtpd, services.postfix +} ``` In this case, the leading dot in `".example.org"` means that Cert @@ -59,16 +61,18 @@ For example, you can remove `emailRecipients` and send email notifications manually using the following hook: ```nix -services.certspotter.hooks = [ - (pkgs.writeShellScript "certspotter-hook" '' - function print_email() { - echo "Subject: [certspotter] $SUMMARY" - echo "Mime-Version: 1.0" - echo "Content-Type: text/plain; charset=US-ASCII" - echo - cat "$TEXT_FILENAME" - } - print_email | ${config.services.certspotter.sendmailPath} -i webmaster@example.org - '') -]; +{ + services.certspotter.hooks = [ + (pkgs.writeShellScript "certspotter-hook" '' + function print_email() { + echo "Subject: [certspotter] $SUMMARY" + echo "Mime-Version: 1.0" + echo "Content-Type: text/plain; charset=US-ASCII" + echo + cat "$TEXT_FILENAME" + } + print_email | ${config.services.certspotter.sendmailPath} -i webmaster@example.org + '') + ]; +} ``` diff --git a/nixos/modules/services/monitoring/goss.md b/nixos/modules/services/monitoring/goss.md index 1e636aa3bdf33..bf91d42011fa7 100644 --- a/nixos/modules/services/monitoring/goss.md +++ b/nixos/modules/services/monitoring/goss.md @@ -7,7 +7,7 @@ for validating a server's configuration. A minimal configuration looks like this: -``` +```nix { services.goss = { enable = true; diff --git a/nixos/modules/services/monitoring/parsedmarc.md b/nixos/modules/services/monitoring/parsedmarc.md index eac07e0cc9fec..765846bbbaf36 100644 --- a/nixos/modules/services/monitoring/parsedmarc.md +++ b/nixos/modules/services/monitoring/parsedmarc.md @@ -11,15 +11,17 @@ email address and saves them to a local Elasticsearch instance looks like this: ```nix -services.parsedmarc = { - enable = true; - settings.imap = { - host = "imap.example.com"; - user = "alice@example.com"; - password = "/path/to/imap_password_file"; +{ + services.parsedmarc = { + enable = true; + settings.imap = { + host = "imap.example.com"; + user = "alice@example.com"; + password = "/path/to/imap_password_file"; + }; + provision.geoIp = false; # Not recommended! }; - provision.geoIp = false; # Not recommended! -}; +} ``` Note that GeoIP provisioning is disabled in the example for @@ -37,16 +39,18 @@ configured in the domain's dmarc policy is `dmarc@monitoring.example.com`. ```nix -services.parsedmarc = { - enable = true; - provision = { - localMail = { - enable = true; - hostname = monitoring.example.com; +{ + services.parsedmarc = { + enable = true; + provision = { + localMail = { + enable = true; + hostname = monitoring.example.com; + }; + geoIp = false; # Not recommended! }; - geoIp = false; # Not recommended! }; -}; +} ``` ## Grafana and GeoIP {#module-services-parsedmarc-grafana-geoip} @@ -58,55 +62,57 @@ is automatically added as a Grafana datasource, and the dashboard is added to Grafana as well. ```nix -services.parsedmarc = { - enable = true; - provision = { - localMail = { - enable = true; - hostname = url; - }; - grafana = { - datasource = true; - dashboard = true; +{ + services.parsedmarc = { + enable = true; + provision = { + localMail = { + enable = true; + hostname = url; + }; + grafana = { + datasource = true; + dashboard = true; + }; }; }; -}; -# Not required, but recommended for full functionality -services.geoipupdate = { - settings = { - AccountID = 000000; - LicenseKey = "/path/to/license_key_file"; + # Not required, but recommended for full functionality + services.geoipupdate = { + settings = { + AccountID = 000000; + LicenseKey = "/path/to/license_key_file"; + }; }; -}; -services.grafana = { - enable = true; - addr = "0.0.0.0"; - domain = url; - rootUrl = "https://" + url; - protocol = "socket"; - security = { - adminUser = "admin"; - adminPasswordFile = "/path/to/admin_password_file"; - secretKeyFile = "/path/to/secret_key_file"; + services.grafana = { + enable = true; + addr = "0.0.0.0"; + domain = url; + rootUrl = "https://" + url; + protocol = "socket"; + security = { + adminUser = "admin"; + adminPasswordFile = "/path/to/admin_password_file"; + secretKeyFile = "/path/to/secret_key_file"; + }; }; -}; -services.nginx = { - enable = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - recommendedProxySettings = true; - upstreams.grafana.servers."unix:/${config.services.grafana.socket}" = {}; - virtualHosts.${url} = { - root = config.services.grafana.staticRootPath; - enableACME = true; - forceSSL = true; - locations."/".tryFiles = "$uri @grafana"; - locations."@grafana".proxyPass = "http://grafana"; + services.nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; + upstreams.grafana.servers."unix:/${config.services.grafana.socket}" = {}; + virtualHosts.${url} = { + root = config.services.grafana.staticRootPath; + enableACME = true; + forceSSL = true; + locations."/".tryFiles = "$uri @grafana"; + locations."@grafana".proxyPass = "http://grafana"; + }; }; -}; -users.users.nginx.extraGroups = [ "grafana" ]; + users.users.nginx.extraGroups = [ "grafana" ]; +} ``` diff --git a/nixos/modules/services/monitoring/prometheus/exporters.md b/nixos/modules/services/monitoring/prometheus/exporters.md index 34fadecadc749..b344534f6aee3 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.md +++ b/nixos/modules/services/monitoring/prometheus/exporters.md @@ -9,7 +9,8 @@ One of the most common exporters is the [node exporter](https://github.com/prometheus/node_exporter), it provides hardware and OS metrics from the host it's running on. The exporter could be configured as follows: -``` +```nix +{ services.prometheus.exporters.node = { enable = true; port = 9100; @@ -23,6 +24,7 @@ running on. The exporter could be configured as follows: openFirewall = true; firewallFilter = "-i br0 -p tcp -m tcp --dport 9100"; }; +} ``` It should now serve all metrics from the collectors that are explicitly enabled and the ones that are @@ -35,7 +37,8 @@ configuration see `man configuration.nix` or search through the [available options](https://nixos.org/nixos/options.html#prometheus.exporters). Prometheus can now be configured to consume the metrics produced by the exporter: -``` +```nix +{ services.prometheus = { # ... @@ -49,7 +52,8 @@ Prometheus can now be configured to consume the metrics produced by the exporter ]; # ... - } + }; +} ``` ## Adding a new exporter {#module-services-prometheus-exporters-new-exporter} @@ -75,7 +79,7 @@ example: `nixos/modules/services/monitoring/prometheus/exporters/` directory, which will be called postfix.nix and contains all exporter specific options and configuration: - ``` + ```nix # nixpkgs/nixos/modules/services/prometheus/exporters/postfix.nix { config, lib, pkgs, options }: @@ -148,7 +152,7 @@ example: Should an exporter option change at some point, it is possible to add information about the change to the exporter definition similar to `nixpkgs/nixos/modules/rename.nix`: -``` +```nix { config, lib, pkgs, options }: with lib; diff --git a/nixos/modules/services/network-filesystems/litestream/default.md b/nixos/modules/services/network-filesystems/litestream/default.md index 8d8486507b77e..626d69df84a50 100644 --- a/nixos/modules/services/network-filesystems/litestream/default.md +++ b/nixos/modules/services/network-filesystems/litestream/default.md @@ -8,7 +8,7 @@ replication tool for SQLite. Litestream service is managed by a dedicated user named `litestream` which needs permission to the database file. Here's an example config which gives required permissions to access [grafana database](#opt-services.grafana.settings.database.path): -``` +```nix { pkgs, ... }: { users.users.litestream.extraGroups = [ "grafana" ]; diff --git a/nixos/modules/services/networking/firefox-syncserver.md b/nixos/modules/services/networking/firefox-syncserver.md index 4d8777d204bb2..f6b515e67f159 100644 --- a/nixos/modules/services/networking/firefox-syncserver.md +++ b/nixos/modules/services/networking/firefox-syncserver.md @@ -7,19 +7,21 @@ A storage server for Firefox Sync that you can easily host yourself. The absolute minimal configuration for the sync server looks like this: ```nix -services.mysql.package = pkgs.mariadb; - -services.firefox-syncserver = { - enable = true; - secrets = builtins.toFile "sync-secrets" '' - SYNC_MASTER_SECRET=this-secret-is-actually-leaked-to-/nix/store - ''; - singleNode = { +{ + services.mysql.package = pkgs.mariadb; + + services.firefox-syncserver = { enable = true; - hostname = "localhost"; - url = "http://localhost:5000"; + secrets = builtins.toFile "sync-secrets" '' + SYNC_MASTER_SECRET=this-secret-is-actually-leaked-to-/nix/store + ''; + singleNode = { + enable = true; + hostname = "localhost"; + url = "http://localhost:5000"; + }; }; -}; +} ``` This will start a sync server that is only accessible locally. Once the services is diff --git a/nixos/modules/services/networking/mosquitto.md b/nixos/modules/services/networking/mosquitto.md index 5cdb598151e51..66b3ad6cfa8f1 100644 --- a/nixos/modules/services/networking/mosquitto.md +++ b/nixos/modules/services/networking/mosquitto.md @@ -7,14 +7,16 @@ Mosquitto is a MQTT broker often used for IoT or home automation data transport. A minimal configuration for Mosquitto is ```nix -services.mosquitto = { - enable = true; - listeners = [ { - acl = [ "pattern readwrite #" ]; - omitPasswordAuth = true; - settings.allow_anonymous = true; - } ]; -}; +{ + services.mosquitto = { + enable = true; + listeners = [ { + acl = [ "pattern readwrite #" ]; + omitPasswordAuth = true; + settings.allow_anonymous = true; + } ]; + }; +} ``` This will start a broker on port 1883, listening on all interfaces of the machine, allowing @@ -25,37 +27,42 @@ full read access to a user `monitor` and restricted write access to a user `serv like ```nix -services.mosquitto = { - enable = true; - listeners = [ { - users = { - monitor = { - acl = [ "read #" ]; - password = "monitor"; +{ + services.mosquitto = { + enable = true; + listeners = [ { + users = { + monitor = { + acl = [ "read #" ]; + password = "monitor"; + }; + service = { + acl = [ "write service/#" ]; + password = "service"; + }; }; - service = { - acl = [ "write service/#" ]; - password = "service"; - }; - }; - } ]; -}; + } ]; + }; +} ``` TLS authentication is configured by setting TLS-related options of the listener: ```nix -services.mosquitto = { - enable = true; - listeners = [ { - port = 8883; # port change is not required, but helpful to avoid mistakes - # ... - settings = { - cafile = "/path/to/mqtt.ca.pem"; - certfile = "/path/to/mqtt.pem"; - keyfile = "/path/to/mqtt.key"; - }; - } ]; +{ + services.mosquitto = { + enable = true; + listeners = [ { + port = 8883; # port change is not required, but helpful to avoid mistakes + # ... + settings = { + cafile = "/path/to/mqtt.ca.pem"; + certfile = "/path/to/mqtt.pem"; + keyfile = "/path/to/mqtt.key"; + }; + } ]; + }; +} ``` ## Configuration {#module-services-mosquitto-config} diff --git a/nixos/modules/services/networking/netbird.md b/nixos/modules/services/networking/netbird.md index a326207becc8e..e1f6753cbd30c 100644 --- a/nixos/modules/services/networking/netbird.md +++ b/nixos/modules/services/networking/netbird.md @@ -5,7 +5,9 @@ The absolute minimal configuration for the netbird daemon looks like this: ```nix -services.netbird.enable = true; +{ + services.netbird.enable = true; +} ``` This will set up a netbird service listening on the port `51820` associated to the @@ -14,7 +16,9 @@ This will set up a netbird service listening on the port `51820` associated to t It is strictly equivalent to setting: ```nix -services.netbird.tunnels.wt0.stateDir = "netbird"; +{ + services.netbird.tunnels.wt0.stateDir = "netbird"; +} ``` The `enable` option is mainly kept for backward compatibility, as defining netbird @@ -29,11 +33,13 @@ The following configuration will start a netbird daemon using the interface `wt1 the port 51830. Its configuration file will then be located at `/var/lib/netbird-wt1/config.json`. ```nix -services.netbird.tunnels = { - wt1 = { - port = 51830; +{ + services.netbird.tunnels = { + wt1 = { + port = 51830; + }; }; -}; +} ``` To interact with it, you will need to specify the correct daemon address: @@ -48,9 +54,11 @@ It is also possible to overwrite default options passed to the service, for example: ```nix -services.netbird.tunnels.wt1.environment = { - NB_DAEMON_ADDR = "unix:///var/run/toto.sock" -}; +{ + services.netbird.tunnels.wt1.environment = { + NB_DAEMON_ADDR = "unix:///var/run/toto.sock"; + }; +} ``` This will set the socket to interact with the netbird service to `/var/run/toto.sock`. diff --git a/nixos/modules/services/networking/pleroma.md b/nixos/modules/services/networking/pleroma.md index 7c499e1c616c2..c2313fd63e6a5 100644 --- a/nixos/modules/services/networking/pleroma.md +++ b/nixos/modules/services/networking/pleroma.md @@ -17,11 +17,13 @@ The `config.exs` file can be further customized following the instructions on th ## Initializing the database {#module-services-pleroma-initialize-db} First, the Postgresql service must be enabled in the NixOS configuration -``` -services.postgresql = { - enable = true; - package = pkgs.postgresql_13; -}; +```nix +{ + services.postgresql = { + enable = true; + package = pkgs.postgresql_13; + }; +} ``` and activated with the usual ```ShellSession @@ -38,43 +40,45 @@ $ sudo -u postgres psql -f setup.psql In this section we will enable the Pleroma service only locally, so its configurations can be improved incrementally. This is an example of configuration, where [](#opt-services.pleroma.configs) option contains the content of the file `config.exs`, generated [in the first section](#module-services-pleroma-generate-config), but with the secrets (database password, endpoint secret key, salts, etc.) removed. Removing secrets is important, because otherwise they will be stored publicly in the Nix store. -``` -services.pleroma = { - enable = true; - secretConfigFile = "/var/lib/pleroma/secrets.exs"; - configs = [ - '' - import Config - - config :pleroma, Pleroma.Web.Endpoint, - url: [host: "pleroma.example.net", scheme: "https", port: 443], - http: [ip: {127, 0, 0, 1}, port: 4000] - - config :pleroma, :instance, - name: "Test", - email: "admin@example.net", - notify_email: "admin@example.net", - limit: 5000, - registrations_open: true - - config :pleroma, :media_proxy, - enabled: false, - redirect_on_failure: true - - config :pleroma, Pleroma.Repo, - adapter: Ecto.Adapters.Postgres, - username: "pleroma", - database: "pleroma", - hostname: "localhost" - - # Configure web push notifications - config :web_push_encryption, :vapid_details, - subject: "mailto:admin@example.net" - - # ... TO CONTINUE ... - '' - ]; -}; +```nix +{ + services.pleroma = { + enable = true; + secretConfigFile = "/var/lib/pleroma/secrets.exs"; + configs = [ + '' + import Config + + config :pleroma, Pleroma.Web.Endpoint, + url: [host: "pleroma.example.net", scheme: "https", port: 443], + http: [ip: {127, 0, 0, 1}, port: 4000] + + config :pleroma, :instance, + name: "Test", + email: "admin@example.net", + notify_email: "admin@example.net", + limit: 5000, + registrations_open: true + + config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + + config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "pleroma", + database: "pleroma", + hostname: "localhost" + + # Configure web push notifications + config :web_push_encryption, :vapid_details, + subject: "mailto:admin@example.net" + + # ... TO CONTINUE ... + '' + ]; + }; +} ``` Secrets must be moved into a file pointed by [](#opt-services.pleroma.secretConfigFile), in our case `/var/lib/pleroma/secrets.exs`. This file can be created copying the previously generated `config.exs` file and then removing all the settings, except the secrets. This is an example @@ -121,60 +125,62 @@ $ pleroma_ctl user new <nickname> <email> --admin --moderator --password <passw In this configuration, Pleroma is listening only on the local port 4000. Nginx can be configured as a Reverse Proxy, for forwarding requests from public ports to the Pleroma service. This is an example of configuration, using [Let's Encrypt](https://letsencrypt.org/) for the TLS certificates -``` -security.acme = { - email = "root@example.net"; - acceptTerms = true; -}; - -services.nginx = { - enable = true; - addSSL = true; - - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - - recommendedProxySettings = false; - # NOTE: if enabled, the NixOS proxy optimizations will override the Pleroma - # specific settings, and they will enter in conflict. - - virtualHosts = { - "pleroma.example.net" = { - http2 = true; - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://127.0.0.1:4000"; - - extraConfig = '' - etag on; - gzip on; - - add_header 'Access-Control-Allow-Origin' '*' always; - add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always; - add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always; - if ($request_method = OPTIONS) { - return 204; - } - add_header X-XSS-Protection "1; mode=block"; - add_header X-Permitted-Cross-Domain-Policies none; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header Referrer-Policy same-origin; - add_header X-Download-Options noopen; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - - client_max_body_size 16m; - # NOTE: increase if users need to upload very big files - ''; +```nix +{ + security.acme = { + email = "root@example.net"; + acceptTerms = true; + }; + + services.nginx = { + enable = true; + addSSL = true; + + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + + recommendedProxySettings = false; + # NOTE: if enabled, the NixOS proxy optimizations will override the Pleroma + # specific settings, and they will enter in conflict. + + virtualHosts = { + "pleroma.example.net" = { + http2 = true; + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://127.0.0.1:4000"; + + extraConfig = '' + etag on; + gzip on; + + add_header 'Access-Control-Allow-Origin' '*' always; + add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always; + add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always; + if ($request_method = OPTIONS) { + return 204; + } + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + + client_max_body_size 16m; + # NOTE: increase if users need to upload very big files + ''; + }; }; }; }; -}; +} ``` diff --git a/nixos/modules/services/networking/prosody.md b/nixos/modules/services/networking/prosody.md index 2da2c242a98b9..d6eee4e29f0a2 100644 --- a/nixos/modules/services/networking/prosody.md +++ b/nixos/modules/services/networking/prosody.md @@ -25,25 +25,27 @@ A good configuration to start with, including a [Multi User Chat (MUC)](https://xmpp.org/extensions/xep-0045.html) endpoint as well as a [HTTP File Upload](https://xmpp.org/extensions/xep-0363.html) endpoint will look like this: -``` -services.prosody = { - enable = true; - admins = [ "root@example.org" ]; - ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; - ssl.key = "/var/lib/acme/example.org/key.pem"; - virtualHosts."example.org" = { - enabled = true; - domain = "example.org"; - ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; - ssl.key = "/var/lib/acme/example.org/key.pem"; - }; - muc = [ { - domain = "conference.example.org"; - } ]; - uploadHttp = { - domain = "upload.example.org"; +```nix +{ + services.prosody = { + enable = true; + admins = [ "root@example.org" ]; + ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; + ssl.key = "/var/lib/acme/example.org/key.pem"; + virtualHosts."example.org" = { + enabled = true; + domain = "example.org"; + ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; + ssl.key = "/var/lib/acme/example.org/key.pem"; + }; + muc = [ { + domain = "conference.example.org"; + } ]; + uploadHttp = { + domain = "upload.example.org"; + }; }; -}; +} ``` ## Let's Encrypt Configuration {#module-services-prosody-letsencrypt} @@ -57,16 +59,18 @@ certificate by leveraging the ACME Provided the setup detailed in the previous section, you'll need the following acme configuration to generate a TLS certificate for the three endponits: -``` -security.acme = { - email = "root@example.org"; - acceptTerms = true; - certs = { - "example.org" = { - webroot = "/var/www/example.org"; - email = "root@example.org"; - extraDomainNames = [ "conference.example.org" "upload.example.org" ]; +```nix +{ + security.acme = { + email = "root@example.org"; + acceptTerms = true; + certs = { + "example.org" = { + webroot = "/var/www/example.org"; + email = "root@example.org"; + extraDomainNames = [ "conference.example.org" "upload.example.org" ]; + }; }; }; -}; +} ``` diff --git a/nixos/modules/services/networking/yggdrasil.md b/nixos/modules/services/networking/yggdrasil.md index bbaea5bc74aaf..7b899f9d6ddb6 100644 --- a/nixos/modules/services/networking/yggdrasil.md +++ b/nixos/modules/services/networking/yggdrasil.md @@ -12,7 +12,7 @@ self-arranging IPv6 network. ### Simple ephemeral node {#module-services-networking-yggdrasil-configuration-simple} An annotated example of a simple configuration: -``` +```nix { services.yggdrasil = { enable = true; @@ -39,7 +39,7 @@ An annotated example of a simple configuration: ### Persistent node with prefix {#module-services-networking-yggdrasil-configuration-prefix} A node with a fixed address that announces a prefix: -``` +```nix let address = "210:5217:69c0:9afc:1b95:b9f:8718:c3d2"; prefix = "310:5217:69c0:9afc"; @@ -90,7 +90,7 @@ in { A NixOS container attached to the Yggdrasil network via a node running on the host: -``` +```nix let yggPrefix64 = "310:5217:69c0:9afc"; # Again, taken from the output of "yggdrasilctl getself". diff --git a/nixos/modules/services/search/meilisearch.md b/nixos/modules/services/search/meilisearch.md index 299f56bf82932..b9f65861b1d1c 100644 --- a/nixos/modules/services/search/meilisearch.md +++ b/nixos/modules/services/search/meilisearch.md @@ -7,7 +7,9 @@ Meilisearch is a lightweight, fast and powerful search engine. Think elastic sea the minimum to start meilisearch is ```nix -services.meilisearch.enable = true; +{ + services.meilisearch.enable = true; +} ``` this will start the http server included with meilisearch on port 7700. diff --git a/nixos/modules/services/web-apps/akkoma.md b/nixos/modules/services/web-apps/akkoma.md index 83dd1a8b35f23..13b074b228a41 100644 --- a/nixos/modules/services/web-apps/akkoma.md +++ b/nixos/modules/services/web-apps/akkoma.md @@ -19,21 +19,23 @@ be run behind a HTTP proxy on `fediverse.example.com`. ```nix -services.akkoma.enable = true; -services.akkoma.config = { - ":pleroma" = { - ":instance" = { - name = "My Akkoma instance"; - description = "More detailed description"; - email = "admin@example.com"; - registration_open = false; - }; - - "Pleroma.Web.Endpoint" = { - url.host = "fediverse.example.com"; +{ + services.akkoma.enable = true; + services.akkoma.config = { + ":pleroma" = { + ":instance" = { + name = "My Akkoma instance"; + description = "More detailed description"; + email = "admin@example.com"; + registration_open = false; + }; + + "Pleroma.Web.Endpoint" = { + url.host = "fediverse.example.com"; + }; }; }; -}; +} ``` Please refer to the [configuration cheat sheet](https://docs.akkoma.dev/stable/configuration/cheatsheet/) @@ -55,19 +57,21 @@ Although it is possible to expose Akkoma directly, it is common practice to oper HTTP reverse proxy such as nginx. ```nix -services.akkoma.nginx = { - enableACME = true; - forceSSL = true; -}; - -services.nginx = { - enable = true; - - clientMaxBodySize = "16m"; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; -}; +{ + services.akkoma.nginx = { + enableACME = true; + forceSSL = true; + }; + + services.nginx = { + enable = true; + + clientMaxBodySize = "16m"; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + }; +} ``` Please refer to [](#module-security-acme) for details on how to provision an SSL/TLS certificate. @@ -78,51 +82,53 @@ Without the media proxy function, Akkoma does not store any remote media like pi locally, and clients have to fetch them directly from the source server. ```nix -# Enable nginx slice module distributed with Tengine -services.nginx.package = pkgs.tengine; - -# Enable media proxy -services.akkoma.config.":pleroma".":media_proxy" = { - enabled = true; - proxy_opts.redirect_on_failure = true; -}; - -# Adjust the persistent cache size as needed: -# Assuming an average object size of 128 KiB, around 1 MiB -# of memory is required for the key zone per GiB of cache. -# Ensure that the cache directory exists and is writable by nginx. -services.nginx.commonHttpConfig = '' - proxy_cache_path /var/cache/nginx/cache/akkoma-media-cache - levels= keys_zone=akkoma_media_cache:16m max_size=16g - inactive=1y use_temp_path=off; -''; - -services.akkoma.nginx = { - locations."/proxy" = { - proxyPass = "http://unix:/run/akkoma/socket"; - - extraConfig = '' - proxy_cache akkoma_media_cache; - - # Cache objects in slices of 1 MiB - slice 1m; - proxy_cache_key $host$uri$is_args$args$slice_range; - proxy_set_header Range $slice_range; - - # Decouple proxy and upstream responses - proxy_buffering on; - proxy_cache_lock on; - proxy_ignore_client_abort on; - - # Default cache times for various responses - proxy_cache_valid 200 1y; - proxy_cache_valid 206 301 304 1h; - - # Allow serving of stale items - proxy_cache_use_stale error timeout invalid_header updating; - ''; +{ + # Enable nginx slice module distributed with Tengine + services.nginx.package = pkgs.tengine; + + # Enable media proxy + services.akkoma.config.":pleroma".":media_proxy" = { + enabled = true; + proxy_opts.redirect_on_failure = true; }; -}; + + # Adjust the persistent cache size as needed: + # Assuming an average object size of 128 KiB, around 1 MiB + # of memory is required for the key zone per GiB of cache. + # Ensure that the cache directory exists and is writable by nginx. + services.nginx.commonHttpConfig = '' + proxy_cache_path /var/cache/nginx/cache/akkoma-media-cache + levels= keys_zone=akkoma_media_cache:16m max_size=16g + inactive=1y use_temp_path=off; + ''; + + services.akkoma.nginx = { + locations."/proxy" = { + proxyPass = "http://unix:/run/akkoma/socket"; + + extraConfig = '' + proxy_cache akkoma_media_cache; + + # Cache objects in slices of 1 MiB + slice 1m; + proxy_cache_key $host$uri$is_args$args$slice_range; + proxy_set_header Range $slice_range; + + # Decouple proxy and upstream responses + proxy_buffering on; + proxy_cache_lock on; + proxy_ignore_client_abort on; + + # Default cache times for various responses + proxy_cache_valid 200 1y; + proxy_cache_valid 206 301 304 1h; + + # Allow serving of stale items + proxy_cache_use_stale error timeout invalid_header updating; + ''; + }; + }; +} ``` #### Prefetch remote media {#modules-services-akkoma-prefetch-remote-media} @@ -132,10 +138,12 @@ fetches all media associated with a post through the media proxy, as soon as the received by the instance. ```nix -services.akkoma.config.":pleroma".":mrf".policies = - map (pkgs.formats.elixirConf { }).lib.mkRaw [ - "Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy" -]; +{ + services.akkoma.config.":pleroma".":mrf".policies = + map (pkgs.formats.elixirConf { }).lib.mkRaw [ + "Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy" + ]; +} ``` #### Media previews {#modules-services-akkoma-media-previews} @@ -143,11 +151,13 @@ services.akkoma.config.":pleroma".":mrf".policies = Akkoma can generate previews for media. ```nix -services.akkoma.config.":pleroma".":media_preview_proxy" = { - enabled = true; - thumbnail_max_width = 1920; - thumbnail_max_height = 1080; -}; +{ + services.akkoma.config.":pleroma".":media_preview_proxy" = { + enabled = true; + thumbnail_max_width = 1920; + thumbnail_max_height = 1080; + }; +} ``` ## Frontend management {#modules-services-akkoma-frontend-management} @@ -160,29 +170,31 @@ The following example overrides the primary frontend’s default configuration u derivation. ```nix -services.akkoma.frontends.primary.package = pkgs.runCommand "akkoma-fe" { - config = builtins.toJSON { - expertLevel = 1; - collapseMessageWithSubject = false; - stopGifs = false; - replyVisibility = "following"; - webPushHideIfCW = true; - hideScopeNotice = true; - renderMisskeyMarkdown = false; - hideSiteFavicon = true; - postContentType = "text/markdown"; - showNavShortcuts = false; - }; - nativeBuildInputs = with pkgs; [ jq xorg.lndir ]; - passAsFile = [ "config" ]; -} '' - mkdir $out - lndir ${pkgs.akkoma-frontends.akkoma-fe} $out - - rm $out/static/config.json - jq -s add ${pkgs.akkoma-frontends.akkoma-fe}/static/config.json ${config} \ - >$out/static/config.json -''; +{ + services.akkoma.frontends.primary.package = pkgs.runCommand "akkoma-fe" { + config = builtins.toJSON { + expertLevel = 1; + collapseMessageWithSubject = false; + stopGifs = false; + replyVisibility = "following"; + webPushHideIfCW = true; + hideScopeNotice = true; + renderMisskeyMarkdown = false; + hideSiteFavicon = true; + postContentType = "text/markdown"; + showNavShortcuts = false; + }; + nativeBuildInputs = with pkgs; [ jq xorg.lndir ]; + passAsFile = [ "config" ]; + } '' + mkdir $out + lndir ${pkgs.akkoma-frontends.akkoma-fe} $out + + rm $out/static/config.json + jq -s add ${pkgs.akkoma-frontends.akkoma-fe}/static/config.json ${config} \ + >$out/static/config.json + ''; +} ``` ## Federation policies {#modules-services-akkoma-federation-policies} @@ -198,28 +210,30 @@ of the fediverse and providing a pleasant experience to the users of an instance ```nix -services.akkoma.config.":pleroma" = with (pkgs.formats.elixirConf { }).lib; { - ":mrf".policies = map mkRaw [ - "Pleroma.Web.ActivityPub.MRF.SimplePolicy" - ]; - - ":mrf_simple" = { - # Tag all media as sensitive - media_nsfw = mkMap { - "nsfw.weird.kinky" = "Untagged NSFW content"; - }; - - # Reject all activities except deletes - reject = mkMap { - "kiwifarms.cc" = "Persistent harassment of users, no moderation"; - }; - - # Force posts to be visible by followers only - followers_only = mkMap { - "beta.birdsite.live" = "Avoid polluting timelines with Twitter posts"; +{ + services.akkoma.config.":pleroma" = with (pkgs.formats.elixirConf { }).lib; { + ":mrf".policies = map mkRaw [ + "Pleroma.Web.ActivityPub.MRF.SimplePolicy" + ]; + + ":mrf_simple" = { + # Tag all media as sensitive + media_nsfw = mkMap { + "nsfw.weird.kinky" = "Untagged NSFW content"; + }; + + # Reject all activities except deletes + reject = mkMap { + "kiwifarms.cc" = "Persistent harassment of users, no moderation"; + }; + + # Force posts to be visible by followers only + followers_only = mkMap { + "beta.birdsite.live" = "Avoid polluting timelines with Twitter posts"; + }; }; }; -}; +} ``` ## Upload filters {#modules-services-akkoma-upload-filters} @@ -228,12 +242,14 @@ This example strips GPS and location metadata from uploads, deduplicates them an the file name. ```nix -services.akkoma.config.":pleroma"."Pleroma.Upload".filters = - map (pkgs.formats.elixirConf { }).lib.mkRaw [ - "Pleroma.Upload.Filter.Exiftool" - "Pleroma.Upload.Filter.Dedupe" - "Pleroma.Upload.Filter.AnonymizeFilename" - ]; +{ + services.akkoma.config.":pleroma"."Pleroma.Upload".filters = + map (pkgs.formats.elixirConf { }).lib.mkRaw [ + "Pleroma.Upload.Filter.Exiftool" + "Pleroma.Upload.Filter.Dedupe" + "Pleroma.Upload.Filter.AnonymizeFilename" + ]; +} ``` ## Migration from Pleroma {#modules-services-akkoma-migration-pleroma} @@ -286,9 +302,11 @@ To re‐use the Pleroma data in place, disable Pleroma and enable Akkoma, pointi Pleroma database and upload directory. ```nix -# Adjust these settings according to the database name and upload directory path used by Pleroma -services.akkoma.config.":pleroma"."Pleroma.Repo".database = "pleroma"; -services.akkoma.config.":pleroma".":instance".upload_dir = "/var/lib/pleroma/uploads"; +{ + # Adjust these settings according to the database name and upload directory path used by Pleroma + services.akkoma.config.":pleroma"."Pleroma.Repo".database = "pleroma"; + services.akkoma.config.":pleroma".":instance".upload_dir = "/var/lib/pleroma/uploads"; +} ``` Please keep in mind that after the Akkoma service has been started, any migrations applied by @@ -304,7 +322,9 @@ details. The Akkoma systemd service may be confined to a chroot with ```nix -services.systemd.akkoma.confinement.enable = true; +{ + services.systemd.akkoma.confinement.enable = true; +} ``` Confinement of services is not generally supported in NixOS and therefore disabled by default. diff --git a/nixos/modules/services/web-apps/c2fmzq-server.md b/nixos/modules/services/web-apps/c2fmzq-server.md index 236953bd4ff7a..d8e59b3ad2103 100644 --- a/nixos/modules/services/web-apps/c2fmzq-server.md +++ b/nixos/modules/services/web-apps/c2fmzq-server.md @@ -4,7 +4,7 @@ c2FmZQ is an application that can securely encrypt, store, and share files, including but not limited to pictures and videos. The service `c2fmzq-server` can be enabled by setting -``` +```nix { services.c2fmzq-server.enable = true; } @@ -17,7 +17,7 @@ In principle the server can be exposed directly on a public interface and there are command line options to manage HTTPS certificates directly, but the module is designed to be served behind a reverse proxy or only accessed via localhost. -``` +```nix { services.c2fmzq-server = { enable = true; diff --git a/nixos/modules/services/web-apps/discourse.md b/nixos/modules/services/web-apps/discourse.md index 35180bea87d90..d4b9c93c4ead0 100644 --- a/nixos/modules/services/web-apps/discourse.md +++ b/nixos/modules/services/web-apps/discourse.md @@ -6,20 +6,22 @@ modern and open source discussion platform. ## Basic usage {#module-services-discourse-basic-usage} A minimal configuration using Let's Encrypt for TLS certificates looks like this: -``` -services.discourse = { - enable = true; - hostname = "discourse.example.com"; - admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; +```nix +{ + services.discourse = { + enable = true; + hostname = "discourse.example.com"; + admin = { + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; + }; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; -}; -security.acme.email = "me@example.com"; -security.acme.acceptTerms = true; + security.acme.email = "me@example.com"; + security.acme.acceptTerms = true; +} ``` Provided a proper DNS setup, you'll be able to connect to the @@ -34,20 +36,22 @@ the [](#opt-services.discourse.sslCertificate) and [](#opt-services.discourse.sslCertificateKey) options: -``` -services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; - admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; +```nix +{ + services.discourse = { + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; + admin = { + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; + }; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; -}; +} ``` ## Database access {#module-services-discourse-database} @@ -80,27 +84,29 @@ A basic setup which assumes you want to use your configured [hostname](#opt-services.discourse.hostname) as email domain can be done like this: -``` -services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; - admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; - }; - mail.outgoing = { - serverAddress = "smtp.emailprovider.com"; - port = 587; - username = "user@emailprovider.com"; - passwordFile = "/path/to/smtp_password_file"; +```nix +{ + services.discourse = { + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; + admin = { + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; + }; + mail.outgoing = { + serverAddress = "smtp.emailprovider.com"; + port = 587; + username = "user@emailprovider.com"; + passwordFile = "/path/to/smtp_password_file"; + }; + mail.incoming.enable = true; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; - mail.incoming.enable = true; - secretKeyBaseFile = "/path/to/secret_key_base_file"; -}; +} ``` This assumes you have set up an MX record for the address you've @@ -162,44 +168,46 @@ The following example sets the title and description of the Discourse instance and enables GitHub login in the site settings, and changes a few request limits in the backend settings: -``` -services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; - admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; - }; - mail.outgoing = { - serverAddress = "smtp.emailprovider.com"; - port = 587; - username = "user@emailprovider.com"; - passwordFile = "/path/to/smtp_password_file"; - }; - mail.incoming.enable = true; - siteSettings = { - required = { - title = "My Cats"; - site_description = "Discuss My Cats (and be nice plz)"; +```nix +{ + services.discourse = { + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; + admin = { + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; }; - login = { - enable_github_logins = true; - github_client_id = "a2f6dfe838cb3206ce20"; - github_client_secret._secret = /run/keys/discourse_github_client_secret; + mail.outgoing = { + serverAddress = "smtp.emailprovider.com"; + port = 587; + username = "user@emailprovider.com"; + passwordFile = "/path/to/smtp_password_file"; }; + mail.incoming.enable = true; + siteSettings = { + required = { + title = "My Cats"; + site_description = "Discuss My Cats (and be nice plz)"; + }; + login = { + enable_github_logins = true; + github_client_id = "a2f6dfe838cb3206ce20"; + github_client_secret._secret = /run/keys/discourse_github_client_secret; + }; + }; + backendSettings = { + max_reqs_per_ip_per_minute = 300; + max_reqs_per_ip_per_10_seconds = 60; + max_asset_reqs_per_ip_per_10_seconds = 250; + max_reqs_per_ip_mode = "warn+block"; + }; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; - backendSettings = { - max_reqs_per_ip_per_minute = 300; - max_reqs_per_ip_per_10_seconds = 60; - max_asset_reqs_per_ip_per_10_seconds = 250; - max_reqs_per_ip_mode = "warn+block"; - }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; -}; +} ``` In the resulting site settings file, the @@ -253,34 +261,36 @@ and [discourse-solved](https://github.com/discourse/discourse-solved) plugins, and disable `discourse-spoiler-alert` by default: -``` -services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; - admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; - }; - mail.outgoing = { - serverAddress = "smtp.emailprovider.com"; - port = 587; - username = "user@emailprovider.com"; - passwordFile = "/path/to/smtp_password_file"; - }; - mail.incoming.enable = true; - plugins = with config.services.discourse.package.plugins; [ - discourse-spoiler-alert - discourse-solved - ]; - siteSettings = { - plugins = { - spoiler_enabled = false; +```nix +{ + services.discourse = { + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; + admin = { + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; + }; + mail.outgoing = { + serverAddress = "smtp.emailprovider.com"; + port = 587; + username = "user@emailprovider.com"; + passwordFile = "/path/to/smtp_password_file"; + }; + mail.incoming.enable = true; + plugins = with config.services.discourse.package.plugins; [ + discourse-spoiler-alert + discourse-solved + ]; + siteSettings = { + plugins = { + spoiler_enabled = false; + }; }; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; -}; +} ``` diff --git a/nixos/modules/services/web-apps/gotosocial.md b/nixos/modules/services/web-apps/gotosocial.md index a290d7d1893a1..b3540f0d5811f 100644 --- a/nixos/modules/services/web-apps/gotosocial.md +++ b/nixos/modules/services/web-apps/gotosocial.md @@ -8,17 +8,19 @@ The following configuration sets up the PostgreSQL as database backend and binds GoToSocial to `127.0.0.1:8080`, expecting to be run behind a HTTP proxy on `gotosocial.example.com`. ```nix -services.gotosocial = { - enable = true; - setupPostgresqlDB = true; - settings = { - application-name = "My GoToSocial"; - host = "gotosocial.example.com"; - protocol = "https"; - bind-address = "127.0.0.1"; - port = 8080; +{ + services.gotosocial = { + enable = true; + setupPostgresqlDB = true; + settings = { + application-name = "My GoToSocial"; + host = "gotosocial.example.com"; + protocol = "https"; + bind-address = "127.0.0.1"; + port = 8080; + }; }; -}; +} ``` Please refer to the [GoToSocial Documentation](https://docs.gotosocial.org/en/latest/configuration/general/) @@ -30,24 +32,26 @@ Although it is possible to expose GoToSocial directly, it is common practice to HTTP reverse proxy such as nginx. ```nix -networking.firewall.allowedTCPPorts = [ 80 443 ]; -services.nginx = { - enable = true; - clientMaxBodySize = "40M"; - virtualHosts = with config.services.gotosocial.settings; { - "${host}" = { - enableACME = true; - forceSSL = true; - locations = { - "/" = { - recommendedProxySettings = true; - proxyWebsockets = true; - proxyPass = "http://${bind-address}:${toString port}"; +{ + networking.firewall.allowedTCPPorts = [ 80 443 ]; + services.nginx = { + enable = true; + clientMaxBodySize = "40M"; + virtualHosts = with config.services.gotosocial.settings; { + "${host}" = { + enableACME = true; + forceSSL = true; + locations = { + "/" = { + recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://${bind-address}:${toString port}"; + }; }; }; }; }; -}; +} ``` Please refer to [](#module-security-acme) for details on how to provision an SSL/TLS certificate. diff --git a/nixos/modules/services/web-apps/grocy.md b/nixos/modules/services/web-apps/grocy.md index 62aad4b103df1..f4b5769c2479c 100644 --- a/nixos/modules/services/web-apps/grocy.md +++ b/nixos/modules/services/web-apps/grocy.md @@ -6,7 +6,7 @@ ## Basic usage {#module-services-grocy-basic-usage} A very basic configuration may look like this: -``` +```nix { pkgs, ... }: { services.grocy = { @@ -29,7 +29,7 @@ of the application. The configuration for `grocy` is located at `/etc/grocy/config.php`. By default, the following settings can be defined in the NixOS-configuration: -``` +```nix { pkgs, ... }: { services.grocy.settings = { @@ -56,7 +56,7 @@ By default, the following settings can be defined in the NixOS-configuration: If you want to alter the configuration file on your own, you can do this manually with an expression like this: -``` +```nix { lib, ... }: { environment.etc."grocy/config.php".text = lib.mkAfter '' diff --git a/nixos/modules/services/web-apps/jitsi-meet.md b/nixos/modules/services/web-apps/jitsi-meet.md index 060ef9752650a..577f82e315be5 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.md +++ b/nixos/modules/services/web-apps/jitsi-meet.md @@ -6,7 +6,7 @@ private, self-hosted video conferencing solution. ## Basic usage {#module-services-jitsi-basic-usage} A minimal configuration using Let's Encrypt for TLS certificates looks like this: -``` +```nix { services.jitsi-meet = { enable = true; @@ -22,7 +22,7 @@ A minimal configuration using Let's Encrypt for TLS certificates looks like this ## Configuration {#module-services-jitsi-configuration} Here is the minimal configuration with additional configurations: -``` +```nix { services.jitsi-meet = { enable = true; diff --git a/nixos/modules/services/web-apps/keycloak.md b/nixos/modules/services/web-apps/keycloak.md index aa8de40d642b1..020bee4003489 100644 --- a/nixos/modules/services/web-apps/keycloak.md +++ b/nixos/modules/services/web-apps/keycloak.md @@ -126,16 +126,18 @@ should be set to. See the description of ## Example configuration {#module-services-keycloak-example-config} A basic configuration with some custom settings could look like this: -``` -services.keycloak = { - enable = true; - settings = { - hostname = "keycloak.example.com"; - hostname-strict-backchannel = true; +```nix +{ + services.keycloak = { + enable = true; + settings = { + hostname = "keycloak.example.com"; + hostname-strict-backchannel = true; + }; + initialAdminPassword = "e6Wcm0RrtegMEHl"; # change on first login + sslCertificate = "/run/keys/ssl_cert"; + sslCertificateKey = "/run/keys/ssl_key"; + database.passwordFile = "/run/keys/db_password"; }; - initialAdminPassword = "e6Wcm0RrtegMEHl"; # change on first login - sslCertificate = "/run/keys/ssl_cert"; - sslCertificateKey = "/run/keys/ssl_key"; - database.passwordFile = "/run/keys/db_password"; -}; +} ``` diff --git a/nixos/modules/services/web-apps/lemmy.md b/nixos/modules/services/web-apps/lemmy.md index faafe096d1382..0ed23607d00b9 100644 --- a/nixos/modules/services/web-apps/lemmy.md +++ b/nixos/modules/services/web-apps/lemmy.md @@ -7,13 +7,15 @@ Lemmy is a federated alternative to reddit in rust. the minimum to start lemmy is ```nix -services.lemmy = { - enable = true; - settings = { - hostname = "lemmy.union.rocks"; - database.createLocally = true; +{ + services.lemmy = { + enable = true; + settings = { + hostname = "lemmy.union.rocks"; + database.createLocally = true; + }; + caddy.enable = true; }; - caddy.enable = true; } ``` diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md index 5db83d7e44634..06a8712b0b8ae 100644 --- a/nixos/modules/services/web-apps/nextcloud.md +++ b/nixos/modules/services/web-apps/nextcloud.md @@ -25,7 +25,7 @@ to `true`, Nextcloud will automatically be configured to connect to it through socket. A very basic configuration may look like this: -``` +```nix { pkgs, ... }: { services.nextcloud = { @@ -130,7 +130,7 @@ settings `listen.owner` & `listen.group` in the [corresponding `phpfpm` pool](#opt-services.phpfpm.pools). An exemplary configuration may look like this: -``` +```nix { config, lib, pkgs, ... }: { services.nginx.enable = false; services.nextcloud = { @@ -205,7 +205,7 @@ If major-releases will be abandoned by upstream, we should check first if those in NixOS for a safe upgrade-path before removing those. In that case we should keep those packages, but mark them as insecure in an expression like this (in `<nixpkgs/pkgs/servers/nextcloud/default.nix>`): -``` +```nix /* ... */ { nextcloud17 = generic { diff --git a/nixos/modules/services/web-apps/pict-rs.md b/nixos/modules/services/web-apps/pict-rs.md index 2fa6bb3aebced..56c51e0d72594 100644 --- a/nixos/modules/services/web-apps/pict-rs.md +++ b/nixos/modules/services/web-apps/pict-rs.md @@ -7,7 +7,9 @@ pict-rs is a a simple image hosting service. the minimum to start pict-rs is ```nix -services.pict-rs.enable = true; +{ + services.pict-rs.enable = true; +} ``` this will start the http server on port 8080 by default. diff --git a/nixos/modules/services/web-apps/plausible.md b/nixos/modules/services/web-apps/plausible.md index 1328ce69441a0..d3673eabddd41 100644 --- a/nixos/modules/services/web-apps/plausible.md +++ b/nixos/modules/services/web-apps/plausible.md @@ -11,7 +11,7 @@ $ openssl rand -base64 64 ``` After that, `plausible` can be deployed like this: -``` +```nix { services.plausible = { enable = true; diff --git a/nixos/modules/services/web-apps/suwayomi-server.md b/nixos/modules/services/web-apps/suwayomi-server.md index 18e7a631443f4..2185556a87212 100644 --- a/nixos/modules/services/web-apps/suwayomi-server.md +++ b/nixos/modules/services/web-apps/suwayomi-server.md @@ -100,7 +100,7 @@ Not all the configuration options are available directly in this module, but you server = { port = 4567; autoDownloadNewChapters = false; - maxSourcesInParallel" = 6; + maxSourcesInParallel = 6; extensionRepos = [ "https://raw.githubusercontent.com/MY_ACCOUNT/MY_REPO/repo/index.min.json" ]; diff --git a/nixos/modules/services/web-servers/garage.md b/nixos/modules/services/web-servers/garage.md index 3a9b85ce06036..fbefd1914d873 100644 --- a/nixos/modules/services/web-servers/garage.md +++ b/nixos/modules/services/web-servers/garage.md @@ -80,7 +80,7 @@ If major-releases will be abandoned by upstream, we should check first if those in NixOS for a safe upgrade-path before removing those. In that case we should keep those packages, but mark them as insecure in an expression like this (in `<nixpkgs/pkgs/tools/filesystem/garage/default.nix>`): -``` +```nix /* ... */ { garage_0_7_3 = generic { diff --git a/nixos/modules/services/x11/desktop-managers/gnome.md b/nixos/modules/services/x11/desktop-managers/gnome.md index aa36f66970ec4..2b4bd06df04f2 100644 --- a/nixos/modules/services/x11/desktop-managers/gnome.md +++ b/nixos/modules/services/x11/desktop-managers/gnome.md @@ -8,9 +8,11 @@ All of the core apps, optional apps, games, and core developer tools from GNOME To enable the GNOME desktop use: -``` -services.xserver.desktopManager.gnome.enable = true; -services.xserver.displayManager.gdm.enable = true; +```nix +{ + services.xserver.desktopManager.gnome.enable = true; + services.xserver.displayManager.gdm.enable = true; +} ``` ::: {.note} @@ -23,8 +25,10 @@ The default applications used in NixOS are very minimal, inspired by the default If you’d like to only use the GNOME desktop and not the apps, you can disable them with: -``` -services.gnome.core-utilities.enable = false; +```nix +{ + services.gnome.core-utilities.enable = false; +} ``` and none of them will be installed. @@ -37,9 +41,11 @@ Note that this mechanism can only exclude core utilities, games and core develop It is also possible to disable many of the [core services](https://github.com/NixOS/nixpkgs/blob/b8ec4fd2a4edc4e30d02ba7b1a2cc1358f3db1d5/nixos/modules/services/x11/desktop-managers/gnome.nix#L329-L348). For example, if you do not need indexing files, you can disable Tracker with: -``` -services.gnome.tracker-miners.enable = false; -services.gnome.tracker.enable = false; +```nix +{ + services.gnome.tracker-miners.enable = false; + services.gnome.tracker.enable = false; +} ``` Note, however, that doing so is not supported and might break some applications. Notably, GNOME Music cannot work without Tracker. @@ -48,39 +54,47 @@ Note, however, that doing so is not supported and might break some applications. You can install all of the GNOME games with: -``` -services.gnome.games.enable = true; +```nix +{ + services.gnome.games.enable = true; +} ``` ### GNOME core developer tools {#sec-gnome-core-developer-tools} You can install GNOME core developer tools with: -``` -services.gnome.core-developer-tools.enable = true; +```nix +{ + services.gnome.core-developer-tools.enable = true; +} ``` ## Enabling GNOME Flashback {#sec-gnome-enable-flashback} GNOME Flashback provides a desktop environment based on the classic GNOME 2 architecture. You can enable the default GNOME Flashback session, which uses the Metacity window manager, with: -``` -services.xserver.desktopManager.gnome.flashback.enableMetacity = true; +```nix +{ + services.xserver.desktopManager.gnome.flashback.enableMetacity = true; +} ``` It is also possible to create custom sessions that replace Metacity with a different window manager using [](#opt-services.xserver.desktopManager.gnome.flashback.customSessions). The following example uses `xmonad` window manager: -``` -services.xserver.desktopManager.gnome.flashback.customSessions = [ - { - wmName = "xmonad"; - wmLabel = "XMonad"; - wmCommand = "${pkgs.haskellPackages.xmonad}/bin/xmonad"; - enableGnomePanel = false; - } -]; +```nix +{ + services.xserver.desktopManager.gnome.flashback.customSessions = [ + { + wmName = "xmonad"; + wmLabel = "XMonad"; + wmCommand = "${pkgs.haskellPackages.xmonad}/bin/xmonad"; + enableGnomePanel = false; + } + ]; +} ``` ## Icons and GTK Themes {#sec-gnome-icons-and-gtk-themes} @@ -104,12 +118,14 @@ Some packages that include Shell extensions, like `gnome.gpaste`, don’t have t You can install them like any other package: -``` -environment.systemPackages = [ - gnomeExtensions.dash-to-dock - gnomeExtensions.gsconnect - gnomeExtensions.mpris-indicator-button -]; +```nix +{ + environment.systemPackages = [ + gnomeExtensions.dash-to-dock + gnomeExtensions.gsconnect + gnomeExtensions.mpris-indicator-button + ]; +} ``` Unfortunately, we lack a way for these to be managed in a completely declarative way. @@ -136,23 +152,25 @@ You can use `dconf-editor` tool to explore which GSettings you can set. ### Example {#sec-gnome-gsettings-overrides-example} -``` -services.xserver.desktopManager.gnome = { - extraGSettingsOverrides = '' - # Change default background - [org.gnome.desktop.background] - picture-uri='file://${pkgs.nixos-artwork.wallpapers.mosaic-blue.gnomeFilePath}' - - # Favorite apps in gnome-shell - [org.gnome.shell] - favorite-apps=['org.gnome.Console.desktop', 'org.gnome.Nautilus.desktop'] - ''; - - extraGSettingsOverridePackages = [ - pkgs.gsettings-desktop-schemas # for org.gnome.desktop - pkgs.gnome.gnome-shell # for org.gnome.shell - ]; -}; +```nix +{ + services.xserver.desktopManager.gnome = { + extraGSettingsOverrides = '' + # Change default background + [org.gnome.desktop.background] + picture-uri='file://${pkgs.nixos-artwork.wallpapers.mosaic-blue.gnomeFilePath}' + + # Favorite apps in gnome-shell + [org.gnome.shell] + favorite-apps=['org.gnome.Console.desktop', 'org.gnome.Nautilus.desktop'] + ''; + + extraGSettingsOverridePackages = [ + pkgs.gsettings-desktop-schemas # for org.gnome.desktop + pkgs.gnome.gnome-shell # for org.gnome.shell + ]; + }; +} ``` ## Frequently Asked Questions {#sec-gnome-faq} diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.md b/nixos/modules/services/x11/desktop-managers/pantheon.md index 1c14ede847495..ce251ec2d3940 100644 --- a/nixos/modules/services/x11/desktop-managers/pantheon.md +++ b/nixos/modules/services/x11/desktop-managers/pantheon.md @@ -5,17 +5,23 @@ Pantheon is the desktop environment created for the elementary OS distribution. ## Enabling Pantheon {#sec-pantheon-enable} All of Pantheon is working in NixOS and the applications should be available, aside from a few [exceptions](https://github.com/NixOS/nixpkgs/issues/58161). To enable Pantheon, set -``` -services.xserver.desktopManager.pantheon.enable = true; +```nix +{ + services.xserver.desktopManager.pantheon.enable = true; +} ``` This automatically enables LightDM and Pantheon's LightDM greeter. If you'd like to disable this, set -``` -services.xserver.displayManager.lightdm.greeters.pantheon.enable = false; -services.xserver.displayManager.lightdm.enable = false; +```nix +{ + services.xserver.displayManager.lightdm.greeters.pantheon.enable = false; + services.xserver.displayManager.lightdm.enable = false; +} ``` but please be aware using Pantheon without LightDM as a display manager will break screenlocking from the UI. The NixOS module for Pantheon installs all of Pantheon's default applications. If you'd like to not install Pantheon's apps, set -``` -services.pantheon.apps.enable = false; +```nix +{ + services.pantheon.apps.enable = false; +} ``` You can also use [](#opt-environment.pantheon.excludePackages) to remove any other app (like `elementary-mail`). @@ -29,30 +35,33 @@ Wingpanel and Switchboard work differently than they do in other distributions, to configure the programs with plugs or indicators. The difference in NixOS is both these programs are patched to load plugins from a directory that is the value of an environment variable. All of which is controlled in Nix. If you need to configure the particular packages manually you can override the packages like: -``` +```nix wingpanel-with-indicators.override { indicators = [ pkgs.some-special-indicator ]; -}; +} +``` +```nix switchboard-with-plugs.override { plugs = [ pkgs.some-special-plug ]; -}; +} ``` please note that, like how the NixOS options describe these as extra plugins, this would only add to the default plugins included with the programs. If for some reason you'd like to configure which plugins to use exactly, both packages have an argument for this: -``` +```nix wingpanel-with-indicators.override { useDefaultIndicators = false; indicators = specialListOfIndicators; -}; - +} +``` +```nix switchboard-with-plugs.override { useDefaultPlugs = false; plugs = specialListOfPlugs; -}; +} ``` this could be most useful for testing a particular plug-in in isolation. diff --git a/nixos/modules/services/x11/display-managers/xpra.nix b/nixos/modules/services/x11/display-managers/xpra.nix index 0861530f21e84..3e7c6b01b3e91 100644 --- a/nixos/modules/services/x11/display-managers/xpra.nix +++ b/nixos/modules/services/x11/display-managers/xpra.nix @@ -251,7 +251,6 @@ in environment.systemPackages = [pkgs.xpra]; - virtualisation.virtualbox.guest.x11 = false; hardware.pulseaudio.enable = mkDefault cfg.pulseaudio; hardware.pulseaudio.systemWide = mkDefault cfg.pulseaudio; }; |