128 lines
3.7 KiB
Nix
128 lines
3.7 KiB
Nix
{ config, pkgs, lib, ... }:
|
||
|
||
let
|
||
domain = "frontendfriendly.xyz";
|
||
host = "stackoverflow.${domain}";
|
||
upstreamPort = 7101;
|
||
|
||
# 1) Fetch source from GitHub
|
||
anonymousOverflowSrc = pkgs.fetchFromGitHub {
|
||
owner = "httpjamesm";
|
||
repo = "AnonymousOverflow";
|
||
rev = "v1.13.0"; # pin a release tag
|
||
# TODO: replace with real hash after first build
|
||
sha256 = "sha256-hvcOJctvNswEws+cCoeGQSvFzZvnThhKk3fJ7TnNulY=";
|
||
};
|
||
|
||
# 2) Build the Go binary
|
||
anonymousOverflowPkg = pkgs.buildGoModule {
|
||
pname = "anonymousoverflow";
|
||
version = "1.13.0";
|
||
|
||
src = anonymousOverflowSrc;
|
||
|
||
# code is at repo root
|
||
subPackages = [ "." ];
|
||
|
||
# TODO: replace with real vendor hash after first build
|
||
vendorHash = "sha256-P3kUGFJhj/pTNeVTwtg4IqhoHBH9rROfkr+ZsrUtmdo=";
|
||
};
|
||
in
|
||
{
|
||
containers.anonymousoverflow = {
|
||
autoStart = true;
|
||
|
||
# Simple veth connection between host and container
|
||
privateNetwork = true;
|
||
hostAddress = "10.250.0.1";
|
||
localAddress = "10.250.0.2";
|
||
|
||
# Rootfs is generated from this NixOS config:
|
||
config = { config, pkgs, ... }:
|
||
|
||
let
|
||
# 1) Fetch AnonymousOverflow source
|
||
anonymousOverflowSrc = pkgs.fetchFromGitHub {
|
||
owner = "httpjamesm";
|
||
repo = "AnonymousOverflow";
|
||
# Pin some tag or commit
|
||
rev = "v1.13.0";
|
||
# TODO: replace with real hash after first build
|
||
sha256 = "sha256-hvcOJctvNswEws+cCoeGQSvFzZvnThhKk3fJ7TnNulY=";
|
||
};
|
||
|
||
# 2) Build the Go binary
|
||
anonymousOverflowPkg = pkgs.buildGoModule {
|
||
pname = "anonymousoverflow";
|
||
version = "1.13.0";
|
||
|
||
src = anonymousOverflowSrc;
|
||
|
||
# repo root
|
||
subPackages = [ "." ];
|
||
|
||
# TODO: replace with real vendor hash after first build
|
||
vendorHash = "sha256-P3kUGFJhj/pTNeVTwtg4IqhoHBH9rROfkr+ZsrUtmdo=";
|
||
};
|
||
in
|
||
{
|
||
# Set this to match your host’s stateVersion
|
||
system.stateVersion = "24.11";
|
||
|
||
# Optional but nice: container firewall allowing port 80
|
||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||
|
||
systemd.services.anonymousoverflow = {
|
||
description = "AnonymousOverflow StackOverflow frontend (container)";
|
||
wantedBy = [ "multi-user.target" ];
|
||
after = [ "network-online.target" ];
|
||
wants = [ "network-online.target" ];
|
||
|
||
serviceConfig = {
|
||
# Runs as root in container; that’s fine here, it needs port 80
|
||
ExecStart = "${anonymousOverflowPkg}/bin/anonymousoverflow";
|
||
|
||
Restart = "always";
|
||
RestartSec = 3;
|
||
};
|
||
};
|
||
|
||
# If AO needs env vars / config, set them here:
|
||
# systemd.services.anonymousoverflow.serviceConfig.Environment = [
|
||
# "PORT=80"
|
||
# "BIND_ADDR=0.0.0.0"
|
||
# ];
|
||
};
|
||
};
|
||
|
||
#################################
|
||
## Anubis in front of it ##
|
||
#################################
|
||
|
||
services.anubis.instances.anonymousoverflow = {
|
||
enable = true;
|
||
|
||
settings = {
|
||
# Must use this prefix form: /run/anubis/anubis-<name>/...
|
||
BIND = "/run/anubis/anubis-anonymousoverflow/anubis.sock";
|
||
METRICS_BIND = "/run/anubis/anubis-anonymousoverflow/metrics.sock";
|
||
|
||
# If you keep the default :8080:
|
||
# TARGET = "http://127.0.0.1:8080";
|
||
|
||
# If you configure the app to listen on 127.0.0.1:${upstreamPort}:
|
||
TARGET = "http://10.250.0.2:${toString upstreamPort}";
|
||
|
||
SERVE_ROBOTS_TXT = true;
|
||
};
|
||
};
|
||
|
||
#################################
|
||
## Caddy vhost ##
|
||
#################################
|
||
|
||
services.caddy.virtualHosts.${host}.extraConfig = ''
|
||
reverse_proxy unix//run/anubis/anubis-anonymousoverflow/anubis.sock
|
||
'';
|
||
}
|