char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Somrun soju and use nginx to SNI-discriminate between soju and t4t ircd0b247a

main
branchesmainall refs →
2.0 KiB76 linesraw
1{ config, lib, pkgs, ... }:
2let
3  domain = "irc.t4t.associates";
4  cert = config.security.acme.certs.${domain};
5in
6{
7  security.acme.certs.${domain} = {
8    server = "https://dv.acme-v02.api.pki.goog/directory";
9    extraLegoFlags = [ "--eab" ];
10    environmentFile = "/var/lib/secrets/google-acme.env";
11    group = "irc-certs";
12    reloadServices = [ "ergochat.service" ];
13  };
14
15  services.nginx.virtualHosts.${domain} = {
16    enableACME = true;
17    locations."/".return = "404";
18  };
19
20  users.groups.irc-certs.members = [ "nginx" ];
21
22  services.ergochat = {
23    enable = true;
24    settings = {
25      allow-environment-overrides = true;
26      network.name = "t4t.associates";
27      server = {
28        name = domain;
29        # The module otherwise retains its default plaintext listener.
30        listeners = lib.mkForce {
31          "127.0.0.1:16697" = {
32            proxy = true;
33            tls = {
34              cert = "${cert.directory}/fullchain.pem";
35              key = "${cert.directory}/key.pem";
36            };
37          };
38        };
39        proxy-allowed-from = [ "127.0.0.1/32" ];
40      };
41      accounts = {
42        registration = {
43          enabled = true;
44          allow-before-connect = true;
45        };
46        require-sasl.enabled = false;
47      };
48      api = {
49        enabled = true;
50        listener = "127.0.0.1:8089";
51      };
52      logging = [
53        {
54          method = "stdout";
55          type = "* -userinput -useroutput";
56          level = "info";
57        }
58      ];
59    };
60  };
61
62  systemd.services.ergochat = {
63    requires = [ "acme-${domain}.service" ];
64    after = [ "acme-${domain}.service" ];
65    serviceConfig = {
66      # Ergo's reload notification lacks MONOTONIC_USEC, required by notify-reload.
67      Type = lib.mkForce "notify";
68      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
69      EnvironmentFile = "/var/lib/secrets/ergo.env";
70      SupplementaryGroups = [ "irc-certs" ];
71      StateDirectoryMode = "0700";
72      Restart = "on-failure";
73      RestartSec = "5s";
74    };
75  };
76}