chaski: re-add tracktrain

this is a spiritual revert of a85c8907e863d44c80a4caac5da097de3bf0b2bc.

infra4future.de sadly is no more; hence chaski now also serves as the
main host to serve gtfs realtime requests

1 files changed, 145 insertions, 0 deletions

diff --git a/chaski/services/tracktrain.nix b/chaski/services/tracktrain.nix
new file mode 100644
index 0000000..77a1ab7
--- /dev/null
+++ b/chaski/services/tracktrain.nix
@@ -0,0 +1,145 @@
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  tracktrain-config = ''
+    dbstring: "dbname=tracktrain user=tracktrain"
+    gtfs: ${pkgs.copyPathToStore ./gtfs.zip}
+    assets: ${pkgs.tracktrain}/assets
+
+    warp:
+      port: 4000
+  '';
+in
+{
+  sops.secrets = {
+    "tracktrain/env" = {};
+    "nginx/tracktrain-auth" = {
+      owner = "nginx";
+    };
+  };
+
+  services.nginx.recommendedProxySettings = true;
+  services.nginx.virtualHosts."tracktrain.stuebinm.eu" = {
+    serverAliases = [ "tracktrain.ilztalbahn.eu" "ilztalbahn.infra4future.de" ];
+    locations."/" = {
+      proxyPass = "http://192.168.42.41:4000";
+      proxyWebsockets = true;
+      basicAuthFile = "/run/secrets/nginx/tracktrain-auth";
+    };
+    locations."/api" = {
+      proxyPass = "http://192.168.42.41:4000";
+      proxyWebsockets = true;
+      extraConfig = ''
+        add_header 'Access-Control-Allow-Origin' '*' always;
+      '';
+    };
+    locations."/metrics/" = {
+      proxyPass = "http://localhost:2342";
+      proxyWebsockets = true;
+      extraConfig = ''
+        rewrite  ^/metrics/(.*)  /$1 break;
+      '';
+    };
+    enableACME = true;
+    forceSSL = true;
+  };
+
+
+  # services.prometheus = {
+  #   enable = true;
+  #   port = 9001;
+  #   scrapeConfigs = [ {
+  #     job_name = "tracktrain";
+  #     static_configs = [{
+  #       targets = [  "192.168.42.41:4000" ];
+  #     }];
+  #   } ];
+  # };
+
+  # services.grafana = {
+  #   enable = true;
+  #   settings.server = {
+  #     serve_from_sub_path = true;
+  #     domain = "tracktrain.ilztalbahn.eu";
+  #     root_url = "%(protocol)s://%(domain)s:/metrics/";
+  #     http_port = 2342;
+  #     http_addr = "0.0.0.0";
+  #   };
+
+  #   provision = {
+  #     enable = true;
+  #     datasources.settings.datasources = [ {
+  #       url = "http://localhost:9001";
+  #       type = "prometheus";
+  #       name = "prometheus";
+  #     } ];
+  #   };
+  # };
+
+  networking.firewall.allowedTCPPorts = [ 443 ];
+
+  containers.tracktrain = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress6 = "fd00::42:40";
+    localAddress6 = "fd00::42:41";
+    hostAddress = "192.168.42.40";
+    localAddress = "192.168.42.41";
+
+    config = { config, ... }: {
+
+      systemd.services.tracktrain = {
+        enable = true;
+
+        description = "tracks trains, hopefully";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "simple";
+          # EnvironmentFile = "/secrets/env";
+          DynamicUser = true;
+        };
+        path = [ pkgs.wget pkgs.ntfy-sh ];
+        script = ''
+          cd /tmp
+          ln -sf ${pkgs.writeText "config.yaml" tracktrain-config} "config.yaml"
+          sleep 3
+          ${pkgs.tracktrain}/bin/tracktrain +RTS -T
+        '';
+      };
+
+      systemd.services.postgresql.wantedBy = [ "tracktrain.service" ];
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "tracktrain" ];
+        ensureUsers = [ {
+          name = "tracktrain";
+          ensureDBOwnership = true;
+        } ];
+        authentication = ''
+          local all all trust
+        '';
+      };
+
+      networking.firewall.enable = false;
+      system.stateVersion = "25.11";
+
+      services.coredns = {
+        enable = true;
+        config = ''
+          .:53 {
+          forward . 1.1.1.1
+          }
+        '';
+      };
+    };
+  };
+
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "ve-tracktrain" ];
+    externalInterface = "ens3";
+  };
+
+}