System Gen172 @ 2026-08-01-12:52:15 by jonas@monolith

2026-08-08 00:40:08 +02:00
parent d0c6c7c01b
commit 2e34b07ad9
3 changed files with 267 additions and 0 deletions
@@ -0,0 +1,64 @@
+{self, ...}: {
+  flake.nixosModules.korrosync-hive = {
+    config,
+    lib,
+    ...
+  }: let
+    cfg = config.hive.korrosync;
+  in {
+    options.hive.korrosync = {
+      enable = lib.mkEnableOption "Enable korrosync server";
+      localPort = lib.mkOption {
+        type = lib.types.int;
+        example = 8080;
+        default = 45988;
+        description = "Specify the local port korrosync server uses.";
+      };
+      instanceFQDN = lib.mkOption {
+        type = lib.types.singleLineStr;
+        example = "calibre.example.com";
+        description = "Fully qualified domain name of the korrosync instance";
+      };
+      blockUserCreation = lib.mkOption {
+        type = lib.types.bool;
+        description = "Disallow /user/create endpoint via nginx";
+        example = true;
+        default = true;
+      };
+    };
+
+    imports = [
+      self.nixosModules.korrosync
+    ];
+
+    config = lib.mkIf cfg.enable {
+      services.korrosync = {
+        enable = true;
+        listen-port = cfg.localPort;
+        listen-address = "127.0.0.1";
+        data-path = "/srv/korrosync";
+      };
+
+      # Fallback server with only 403
+      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
+        default = true;
+        locations."/".return = 403;
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Virtual host for korrosync
+      services.nginx.virtualHosts."${cfg.instanceFQDN}" =
+        {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.localPort}";
+          };
+        }
+        // (lib.optionalAttrs cfg.blockUserCreation {
+          locations."/users/create".return = 403;
+        });
+    };
+  };
+}