all repos — nixfiles @ 5846fa14c3d802a93776642958a9aa2ed67f51f2

System and user configuration, managed by nix and home-manager

system/roles/goatcounter.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
{
  config,
  ...
}:
let
  domain = config.networking.domain;
in
{
  imports = [
    ./mailer.nix
    ../settings/programs/sqlite.nix
  ];

  environment.systemPackages = [
    config.services.goatcounter.package
  ];

  services.goatcounter = {
    enable = true;
    address = "localhost";
    port = 8082;
    proxy = true;
    extraArgs = [
      "-db"
      "sqlite3+db/goatcounter.sqlite3"
      "-websocket"
      "-automigrate"
      "-email-from"
      "goatcounter@${domain}"
      "-smtp"
      "smtp://localhost:25"
      "-ratelimit"
      "api-count:100/1"
    ];
  };

  services.caddy.virtualHosts = {
    "stats.${domain}" =
      let
        srv = config.services.goatcounter;
      in
      {
        serverAliases = [
          "stats.searchix.ovh"
          "stats.stable.searchix.ovh"
        ] ++ map (d: "${d}.stats.${domain}") [ ];

        # TODO: switch to on-demand TLS
        extraConfig = ''
          reverse_proxy ${srv.address}:${toString srv.port}
        '';
      };
  };

  ## actalis doesn't allow wildcard on free tier
  # security.acme.certs."stats.${domain}" = {
  #   extraDomainNames = [ "*.stats.${domain}" ];
  # };
}