84 lines
2 KiB
Nix
84 lines
2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
EnvironmentFile = [ config.age.secrets.netbox-environment.path ];
|
|
cfg = config.bagel.services.netbox;
|
|
inherit (lib) mkEnableOption mkOption mkIf types;
|
|
in
|
|
|
|
{
|
|
options.bagel.services.netbox = {
|
|
enable = mkEnableOption "Netbox";
|
|
domain = mkOption {
|
|
type = types.str;
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# FIXME: why
|
|
nixpkgs.config.permittedInsecurePackages = [ pkgs.netbox_3_7.name ];
|
|
|
|
age.secrets.netbox-environment.file = ../../secrets/floral/netbox-environment.age;
|
|
services = {
|
|
netbox = {
|
|
enable = true;
|
|
package = pkgs.netbox_3_7;
|
|
secretKeyFile = "/dev/null";
|
|
listenAddress = "127.0.0.1";
|
|
settings = {
|
|
ALLOWED_HOSTS = [ cfg.domain ];
|
|
REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth";
|
|
};
|
|
|
|
extraConfig = lib.mkForce ''
|
|
from os import environ as env
|
|
|
|
SECRET_KEY = env["SECRET_KEY"]
|
|
|
|
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = env["NETBOX_OIDC_URL"]
|
|
SOCIAL_AUTH_OIDC_KEY = env["NETBOX_OIDC_KEY"]
|
|
SOCIAL_AUTH_OIDC_SECRET = env["NETBOX_OIDC_SECRET"]
|
|
'';
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
virtualHosts."${cfg.domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
locations."/".proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
|
|
locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services = {
|
|
netbox.serviceConfig = {
|
|
inherit EnvironmentFile;
|
|
|
|
TimeoutStartSec = 600;
|
|
};
|
|
|
|
netbox-housekeeping.serviceConfig = {
|
|
inherit EnvironmentFile;
|
|
};
|
|
|
|
netbox-rq.serviceConfig = {
|
|
inherit EnvironmentFile;
|
|
};
|
|
};
|
|
|
|
users.users.nginx.extraGroups = [ "netbox" ];
|
|
networking.firewall.allowedTCPPorts = [
|
|
443
|
|
80
|
|
];
|
|
};
|
|
}
|