all repos — nixfiles @ 5daa66fd9b3c12064ce35febaf311caba30bfd24

System and user configuration, managed by nix and home-manager

extract redis-website configuration to role

Alin
commit

5daa66fd9b3c12064ce35febaf311caba30bfd24

parent

4c0b7383ff18d2c9934365562f7aab0a3c4e05a2

2 files changed, 39 insertions(+), 31 deletions(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -38,14 +38,12 @@ ../roles/goatcounter.nix
     ../roles/mailer.nix
     ../roles/push-notifications.nix
     ../roles/readeck.nix
+    ../roles/redis-website.nix
     ../roles/searchix.nix
     ../roles/sso.nix
     ../roles/video-library.nix
     ../roles/git-server.nix
   ];
-  age.secrets = {
-    redis-website.file = ../../secrets/redis-website.age;
-  };
 
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
 

@@ -111,12 +109,10 @@ hosts = lib.mkForce {
       ${net-ip4} = [
         "${hostname}.${domain}"
         hostname
-        "redis"
       ];
       ${net-ip6} = [
         "${hostname}.${domain}"
         hostname
-        "redis"
       ];
     };
     defaultGateway = {

@@ -155,7 +151,6 @@ firewall = {
       allowedTCPPorts = [
         53
         853
-        6379
         9418
       ];
       allowedUDPPorts = [

@@ -276,10 +271,6 @@ security.acme = {
     certs."${oldDomain}" = {
       extraDomainNames = [ "*.${oldDomain}" ];
     };
-    certs."redis.${domain}" = {
-      group = "redis-website";
-      reloadServices = [ "redis-website" ];
-    };
   };
 
   services.caddy = {

@@ -325,26 +316,5 @@ enable = true;
     internalInterfaces = [ "ve-+" ];
     externalInterface = netif;
     enableIPv6 = true;
-  };
-
-  services.redis = {
-    servers = {
-      website = {
-        enable = true;
-        port = 0;
-        bind = null;
-        databases = 1;
-        maxclients = 20;
-        requirePassFile = config.age.secrets.redis-website.path;
-        settings = {
-          notify-keyspace-events = "KEA";
-          tls-port = 6379;
-          tls-cert-file = "/var/lib/acme/redis.${domain}/cert.pem";
-          tls-key-file = "/var/lib/acme/redis.${domain}/key.pem";
-          tls-ca-cert-file = "/etc/ssl/certs/ca-certificates.crt";
-          tls-auth-clients = false;
-        };
-      };
-    };
   };
 }
A system/roles/redis-website.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  ...
+}:
+let
+  domain = config.networking.domain;
+in
+{
+  age.secrets.redis-website.file = ../../secrets/redis-website.age;
+
+  networking.firewall.allowedTCPPorts = [ 6379 ];
+
+  services.redis = {
+    servers = {
+      website = {
+        enable = true;
+        port = 0;
+        bind = null;
+        databases = 1;
+        maxclients = 20;
+        requirePassFile = config.age.secrets.redis-website.path;
+        settings = {
+          notify-keyspace-events = "KEA";
+          tls-port = 6379;
+          tls-cert-file = "/var/lib/acme/redis.${domain}/cert.pem";
+          tls-key-file = "/var/lib/acme/redis.${domain}/key.pem";
+          tls-ca-cert-file = "/etc/ssl/certs/ca-certificates.crt";
+          tls-auth-clients = false;
+        };
+      };
+    };
+  };
+
+  security.acme.certs."redis.${domain}" = {
+    group = "redis-website";
+    reloadServices = [ "redis-website" ];
+  };
+}