oibot/Tobserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Setup sops

Browse source
This commit is contained in:
Tobias Ostner 2026-04-11 18:52:36 +02:00
parent 3bb85d77de
commit 41cb36d15f
9 changed files with 163 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

89
modules/mempool.nix
View file

@ -1,5 +1,58 @@
{ config, pkgs, lib, ...}:
{
sops.secrets."mempool/mariadb-password" = {
owner = "root";
group = "root";
mode = "0400";
};
sops.secrets."mempool/mariadb-root-password" = {
owner = "root";
group = "root";
mode = "0400";
};
sops.templates."mempool-db.env" = {
owner = "root";
group = "root";
mode = "0400";
content = ''
MARIADB_DATABASE=mempool
MARIADB_USER=mempool
MARIADB_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"}
MARIADB_ROOT_PASSWORD=${config.sops.placeholder."mempool/mariadb-root-password"}
'';
};
sops.templates."mempool-backend.env" = {
owner = "root";
group = "root";
mode = "0400";
content = ''
MEMPOOL_NETWORK=mainnet
MEMPOOL_BACKEND=electrum
MEMPOOL_HTTP_PORT=8999
ELECTRUM_HOST=host.containers.internal
ELECTRUM_PORT=50001
ELECTRUM_TLS_ENABLED=false
CORE_RPC_HOST=host.containers.internal
CORE_RPC_PORT=8332
CORE_RPC_COOKIE=true
CORE_RPC_COOKIE_PATH=/bitcoin/.cookie
DATABASE_ENABLED=true
DATABASE_HOST=mempool-db
DATABASE_PORT=3306
DATABASE_DATABASE=mempool
DATABASE_USERNAME=mempool
DATABASE_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"}
STATISTICS_ENABLED=true
'';
};
virtualisation.oci-containers = {
backend = "podman";
@ -7,12 +60,9 @@
mempool-db = {
image = "mariadb:11";
autoStart = true;
environment = {
MARIADB_DATABASE = "mempool";
MARIADB_USER = "mempool";
MARIADB_PASSWORD = "mempool";
MARIADB_ROOT_PASSWORD = "root";
};
environmentFiles = [
config.sops.templates."mempool-db.env".path
];
volumes = [
"/srv/mempool/mysql:/var/lib/mysql"
];
@ -26,30 +76,9 @@
extraOptions = [
"--add-host=host.containers.internal:host-gateway"
];
environment = {
MEMPOOL_NETWORK = "mainnet";
MEMPOOL_BACKEND = "electrum";
MEMPOOL_HTTP_PORT = "8999";
ELECTRUM_HOST = "host.containers.internal";
ELECTRUM_PORT = "50001";
ELECTRUM_TLS_ENABLED = "false";
CORE_RPC_HOST = "host.containers.internal";
CORE_RPC_PORT = "8332";
CORE_RPC_COOKIE = "true";
CORE_RPC_COOKIE_PATH = "/bitcoin/.cookie";
DATABASE_ENABLED = "true";
DATABASE_HOST = "mempool-db";
DATABASE_PORT = "3306";
DATABASE_DATABASE = "mempool";
DATABASE_USERNAME = "mempool";
DATABASE_PASSWORD = "mempool";
STATISTICS_ENABLED = "true";
};
environmentFiles = [
config.sops.templates."mempool-backend.env".path
];
volumes = [
"/run/mempool/bitcoind.cookie:/bitcoin/.cookie:ro"
];

11
modules/nextcloud.nix
View file

@ -1,6 +1,15 @@
{ config, pkgs, lib, ... }:
{
sops.secrets."nextcloud/mail-json" = {
sopsFile = ../secrets/nextcloud-mail.json;
format = "json";
key = "";
owner = "root";
group = "root";
mode = "0400";
};
services = {
nextcloud = {
@ -64,7 +73,7 @@
"opcache.max_accelerated_files" = "30000";
};
secretFile = "/run/secrets/nextcloud-mail.json";
secretFile = config.sops.secrets."nextcloud/mail-json".path;
};
restic.backups.nextcloud = {