1
0
Fork 0
dotfiles/container/weewx/default.nix

117 lines
2.5 KiB
Nix
Raw Normal View History

2023-03-24 21:30:50 +00:00
{ config, lib, ... }:
2023-03-17 20:58:31 +00:00
2022-07-30 22:36:06 +00:00
let
2023-03-17 20:58:31 +00:00
secret = import ../../secret/container/weewx;
data-dir = "/etc/container-weewx";
2022-07-30 22:36:06 +00:00
in
{
2023-03-18 23:14:03 +00:00
virtualisation.oci-containers.containers.weewx = {
image = "ghcr.io/nifoc/weewx-docker:master";
ports = [ "127.0.0.1:8000:8000" ];
environment = {
"TZ" = "Europe/Berlin";
2022-07-30 22:36:06 +00:00
};
2023-03-18 23:14:03 +00:00
volumes = [
"${data-dir}:/data"
];
extraOptions = [
"--label=com.centurylinklabs.watchtower.enable=true"
"--label=io.containers.autoupdate=registry"
];
2022-07-30 22:36:06 +00:00
};
2023-03-06 21:20:26 +00:00
2023-03-24 21:30:50 +00:00
systemd.services.podman-weewx.serviceConfig = {
TimeoutStopSec = lib.mkForce 5;
};
2023-03-17 20:58:31 +00:00
systemd.tmpfiles.rules = [
"d ${data-dir} 0755 421 421"
"d ${data-dir}/html 0755 421 421"
2023-03-25 13:08:09 +00:00
"d ${data-dir}/skin-wdc 0755 421 421"
2023-03-17 20:58:31 +00:00
];
2023-03-24 23:06:34 +00:00
services.mosquitto.listeners = [
{
address = "0.0.0.0";
port = 1883;
settings = {
protocol = "mqtt";
2023-03-17 21:08:56 +00:00
};
2023-03-17 20:58:31 +00:00
2023-03-24 23:06:34 +00:00
users = {
weewx-proxy = {
hashedPasswordFile = config.age.secrets.mosquitto-password-weewx-proxy.path;
acl = [ "write weewx/+" ];
};
weewx = {
hashedPasswordFile = config.age.secrets.mosquitto-password-weewx.path;
acl = [ "read weewx/+" "write weather/+" ];
};
2023-03-17 20:58:31 +00:00
};
2023-03-24 23:06:34 +00:00
}
{
address = "127.0.0.1";
port = 9883;
settings = {
protocol = "websockets";
allow_anonymous = true;
2023-03-24 23:06:34 +00:00
};
acl = [ "topic read weather/+" ];
2023-03-24 23:06:34 +00:00
}
];
2023-03-17 20:58:31 +00:00
2023-03-17 21:20:33 +00:00
networking.firewall.interfaces =
let
mosquittoPorts = [ 1883 ];
in
{
"enp7s0".allowedTCPPorts = mosquittoPorts;
"tailscale0".allowedTCPPorts = mosquittoPorts;
"podman+".allowedTCPPorts = mosquittoPorts;
};
2023-03-17 20:58:31 +00:00
services.nginx.virtualHosts."${secret.container.weewx.hostname}" = {
2023-03-06 21:20:26 +00:00
http3 = true;
2023-03-12 11:22:44 +00:00
kTLS = true;
2023-03-06 21:20:26 +00:00
2023-03-17 20:58:31 +00:00
root = "${data-dir}/html/wdc";
2023-03-06 21:20:26 +00:00
forceSSL = true;
useACMEHost = "kempkens.io";
2023-03-06 21:21:22 +00:00
extraConfig = ''
index index.html;
2023-03-06 22:39:49 +00:00
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
2023-03-06 21:21:22 +00:00
'';
2023-03-06 21:22:15 +00:00
locations."~* \.html$".extraConfig = ''
2023-03-06 21:20:26 +00:00
expires modified 120s;
'';
2023-03-06 21:22:15 +00:00
locations."~* \.(js|css)$".extraConfig = ''
2023-03-06 21:20:26 +00:00
expires 1h;
'';
locations."~ ^/dwd/(icons|warn_icons)/" = {
root = "${data-dir}/static_html";
2023-03-24 21:30:50 +00:00
extraConfig = ''
expires 7d;
'';
2023-03-06 21:20:26 +00:00
};
2023-03-06 21:22:15 +00:00
locations."~ ^/dwd/[\w]+\.(gif|png)".extraConfig = ''
2023-03-06 21:20:26 +00:00
expires modified 1h;
'';
2023-03-24 23:31:06 +00:00
locations."/mqtt" = {
recommendedProxySettings = true;
proxyPass = "http://127.0.0.1:9883";
proxyWebsockets = true;
};
2023-03-06 21:20:26 +00:00
};
2023-03-17 20:58:31 +00:00
}