commit f7eb4ae98b7ec9d6d23a703051b3475740410b36
author Skyler Grey <minion@clicks.codes> Mon May 06 12:38:44 2024 +0000
committer Skyler Grey <minion@clicks.codes> Thu May 30 08:59:55 2024 +0000
tree 40c0caec9fb11242ddaa865320c8f949212f69a5
parent 50bbc8f50325d0f0cd7fc2096a66c4eb1663d4d9

Add wikijs for Aux

As part of the infra and docs teams for Auxolotl, we've decided to host
their wiki for them.

This was difficult for a few reasons
- They do not use Cloudflare, so our standard https certificate
  provisioning will not work
- They do not want our automatic www subdomains
- We already run wiki.js for TransPlace, and are not able to take that
  down. Nix doesn't allow us to add multiple wiki.js instances alongside
  each other
- This is not permanent, so we want to make it really easy to move to
  another server at a moment's notice, for example we don't want to tie
  it in to our postgres server

As a mitigation for these
- We override our normal ACME configuration. This forces cloudflare by
  default. We have added an "ugly hack" to avoid it forcing cloudflare
  for aux
- We update helpers to add a "specific" domain, i.e. do not add www
  aliases
- We use a nix container to host the wiki.js and another postgres server

Change-Id: Iecead03467f2b4a958d83cc6f92a8a0304323e35
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/682
Tested-by: Skyler Grey <minion@clicks.codes>
Reviewed-by: Samuel Shuert <coded@clicks.codes>

modules/common/nginx.nix

diff --git a/modules/common/nginx.nix b/modules/common/nginx.nix
index 5bc99ad..38a2c74 100644
--- a/modules/common/nginx.nix
+++ b/modules/common/nginx.nix
@@ -8,6 +8,7 @@
             options = {
               host = lib.mkOption { type = str; };
               extraHosts = lib.mkOption { type = listOf str; };
+              specific = lib.mkOption { type = bool; };
               secure = lib.mkOption { type = bool; };
               service = lib.mkOption {
                 type = let
@@ -192,10 +193,14 @@
     users.users.nginx.extraGroups = [ config.users.users.acme.group ];
   };
 } (if base != null then {
-  config.security.acme.certs = lib.mkForce (builtins.mapAttrs (_: v:
-    (lib.filterAttrs (n: _: n != "directory" && n != "credentialsFile") v) // {
-      webroot = null;
-      dnsProvider = "cloudflare";
-    }) base.config.security.acme.certs);
+  config.security.acme.certs = lib.mkForce (builtins.mapAttrs (domain: v:
+    if builtins.match ".*\.auxolotl\.org" domain != null then
+      (lib.filterAttrs (n: _: n != "directory" && n != "credentialsFile") v)
+    else
+      (lib.filterAttrs (n: _: n != "directory" && n != "credentialsFile") v) // {
+        webroot = null;
+        dnsProvider = "cloudflare";
+      }
+    ) base.config.security.acme.certs);
 } else
   { })