Add wikijs for Aux
As part of the infra and docs teams for Auxolotl, we've decided to host
their wiki for them.
This was difficult for a few reasons
- They do not use Cloudflare, so our standard https certificate
provisioning will not work
- They do not want our automatic www subdomains
- We already run wiki.js for TransPlace, and are not able to take that
down. Nix doesn't allow us to add multiple wiki.js instances alongside
each other
- This is not permanent, so we want to make it really easy to move to
another server at a moment's notice, for example we don't want to tie
it in to our postgres server
As a mitigation for these
- We override our normal ACME configuration. This forces cloudflare by
default. We have added an "ugly hack" to avoid it forcing cloudflare
for aux
- We update helpers to add a "specific" domain, i.e. do not add www
aliases
- We use a nix container to host the wiki.js and another postgres server
Change-Id: Iecead03467f2b4a958d83cc6f92a8a0304323e35
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/682
Tested-by: Skyler Grey <minion@clicks.codes>
Reviewed-by: Samuel Shuert <coded@clicks.codes>
diff --git a/modules/common/aux.nix b/modules/common/aux.nix
new file mode 100644
index 0000000..501884f
--- /dev/null
+++ b/modules/common/aux.nix
@@ -0,0 +1,63 @@
+{
+ networking.nat = {
+ enable = true;
+ internalInterfaces = ["ve-aux-wikijs"];
+ externalInterface = "enp1s0";
+ };
+
+ containers.aux-wikijs = {
+ autoStart = true;
+ privateNetwork = true;
+
+ hostAddress = "10.0.101.1";
+ localAddress = "10.0.101.2";
+
+ config = { config, pkgs, lib, ... }: {
+ services.wiki-js = {
+ enable = true;
+
+ settings = {
+ bindIP = "0.0.0.0";
+ port = 1024;
+
+ db = {
+ host = "127.0.0.1";
+ user = "wiki";
+ pass = "internalonly";
+ };
+ };
+ };
+
+ system.stateVersion = "22.11";
+
+ services.postgresql = {
+ enable = true;
+ ensureDatabases = [
+ "wiki"
+ ];
+ ensureUsers = [
+ {
+ name = "wiki";
+ ensureDBOwnership = true;
+ }
+ ];
+ };
+
+ systemd.services.postgresql.postStart = ''
+ $PSQL -tAc "ALTER USER wiki PASSWORD 'internalonly';"
+ '';
+
+ networking = {
+ firewall = {
+ enable = true;
+ allowedTCPPorts = [ 1024 ];
+ };
+ # Use systemd-resolved inside the container
+ # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+ useHostResolvConf = lib.mkForce false;
+
+ nameservers = [ "1.1.1.1" "1.0.0.1" ];
+ };
+ };
+ };
+}