blob: 18789e6525ca6a6eaf1f42ff8dfb6dcae29435e6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
{ pkgs, config, lib, ... }:
let
domain = "bnc.oxapentane.com";
certDir = config.security.acme.certs.${domain}.directory;
in
{
# so soju can read the cert
users.groups.soju-tls = {};
sops.secrets = {
mythicbeasts-acme-bnc-api = {
owner = "root";
group = "root";
mode = "0400";
};
mythicbeasts-acme-bnc-api-secret = {
owner = "root";
group = "root";
mode = "0400";
};
};
# get the cert via DNS
security.acme = {
acceptTerms = true;
certs.${domain} = {
dnsProvider = "mythicbeasts";
credentialFiles = {
"MYTHICBEASTS_USERNAME_FILE" = config.sops.secrets.mythicbeasts-acme-bnc-api.path;
"MYTHICBEASTS_PASSWORD_FILE" = config.sops.secrets.mythicbeasts-acme-bnc-api-secret.path;
};
group = "soju-tls";
reloadServices = [
"soju.service"
];
};
};
# open port
networking.firewall.allowedTCPPorts = [
6697
];
# soju config
services.soju = {
enable = true;
hostName = domain;
listen = [
"ircs://:6697"
];
tlsCertificate = "${certDir}/fullchain.pem";
tlsCertificateKey = "${certDir}/key.pem";
adminSocket.enable = true;
enableMessageLogging = true;
};
systemd.services.soju = {
wants = [ "acme-${domain}.service" ];
after = [ "acme-${domain}.service" ];
serviceConfig.SupplementaryGroups = [ "soju-tls" ];
};
# make sure that creds are there, before contacting letsencrypt
systemd.services."acme-order-renew-${domain}" =
lib.mkIf config.sops.useSystemdActivation
{
requires = [ "sops-install-secrets.service" ];
after = [ "sops-install-secrets.service" ];
};
environment.systemPackages = [ pkgs.soju ];
}
|
