1
0
Fork 0
dotfiles/system/nixos/anonymous-overflow.nix

63 lines
1.8 KiB
Nix
Raw Normal View History

2023-02-15 19:35:46 +00:00
{ pkgs, config, ... }:
let
anonymous-overflow-pkg = pkgs.anonymous-overflow;
in
{
systemd.services.anonymous-overflow = {
description = "View StackOverflow in privacy and without the clutter";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
DynamicUser = true;
StateDirectory = "anonymous-overflow";
EnvironmentFile = [ config.age.secrets.anonymous-overflow-config.path ];
WorkingDirectory = "${anonymous-overflow-pkg}/share/anonymous-overflow";
2023-02-15 19:35:46 +00:00
ExecStart = "${anonymous-overflow-pkg}/bin/anonymousoverflow";
Restart = "on-failure";
RestartSec = "5s";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
2023-02-15 19:35:46 +00:00
};
};
services.nginx.virtualHosts."overflow.daniel.sx" = {
listenAddresses = [ "100.113.242.85" "[fd7a:115c:a1e0:ab12:4843:cd96:6271:f255]" ];
http3 = true;
2023-03-06 09:21:34 +00:00
root = "${anonymous-overflow-pkg}/share/anonymous-overflow/public/";
onlySSL = true;
useACMEHost = "daniel.sx";
locations."/" = {
tryFiles = "$uri @proxy";
};
locations."/static".extraConfig = ''
rewrite ^/static(/.*)$ $1 last;
'';
locations."@proxy" = {
recommendedProxySettings = true;
proxyPass = "http://127.0.0.1:8003";
2023-02-15 19:35:46 +00:00
};
};
}