diff options
| -rw-r--r-- | chaski/configuration.nix | 3 | ||||
| -rw-r--r-- | chaski/services/tracktrain.nix | 145 | ||||
| -rw-r--r-- | npins/sources.json | 12 | ||||
| -rw-r--r-- | pkgs/default.nix | 2 | ||||
| -rw-r--r-- | pkgs/overlay.nix | 4 | ||||
| -rw-r--r-- | secrets/chaski.yaml | 15 |
6 files changed, 171 insertions, 10 deletions
diff --git a/chaski/configuration.nix b/chaski/configuration.nix index 0271e0f..94b89df 100644 --- a/chaski/configuration.nix +++ b/chaski/configuration.nix @@ -12,7 +12,8 @@ ./services/chat.nix ./services/bahnhof-name.nix ./services/conduit.nix - ./services/headscale.nix + # ./services/headscale.nix + ./services/tracktrain.nix ]; sops.defaultSopsFile = ../secrets/chaski.yaml; diff --git a/chaski/services/tracktrain.nix b/chaski/services/tracktrain.nix new file mode 100644 index 0000000..77a1ab7 --- /dev/null +++ b/chaski/services/tracktrain.nix @@ -0,0 +1,145 @@ +{ config, lib, pkgs, inputs, ... }: + +let + tracktrain-config = '' + dbstring: "dbname=tracktrain user=tracktrain" + gtfs: ${pkgs.copyPathToStore ./gtfs.zip} + assets: ${pkgs.tracktrain}/assets + + warp: + port: 4000 + ''; +in +{ + sops.secrets = { + "tracktrain/env" = {}; + "nginx/tracktrain-auth" = { + owner = "nginx"; + }; + }; + + services.nginx.recommendedProxySettings = true; + services.nginx.virtualHosts."tracktrain.stuebinm.eu" = { + serverAliases = [ "tracktrain.ilztalbahn.eu" "ilztalbahn.infra4future.de" ]; + locations."/" = { + proxyPass = "http://192.168.42.41:4000"; + proxyWebsockets = true; + basicAuthFile = "/run/secrets/nginx/tracktrain-auth"; + }; + locations."/api" = { + proxyPass = "http://192.168.42.41:4000"; + proxyWebsockets = true; + extraConfig = '' + add_header 'Access-Control-Allow-Origin' '*' always; + ''; + }; + locations."/metrics/" = { + proxyPass = "http://localhost:2342"; + proxyWebsockets = true; + extraConfig = '' + rewrite ^/metrics/(.*) /$1 break; + ''; + }; + enableACME = true; + forceSSL = true; + }; + + + # services.prometheus = { + # enable = true; + # port = 9001; + # scrapeConfigs = [ { + # job_name = "tracktrain"; + # static_configs = [{ + # targets = [ "192.168.42.41:4000" ]; + # }]; + # } ]; + # }; + + # services.grafana = { + # enable = true; + # settings.server = { + # serve_from_sub_path = true; + # domain = "tracktrain.ilztalbahn.eu"; + # root_url = "%(protocol)s://%(domain)s:/metrics/"; + # http_port = 2342; + # http_addr = "0.0.0.0"; + # }; + + # provision = { + # enable = true; + # datasources.settings.datasources = [ { + # url = "http://localhost:9001"; + # type = "prometheus"; + # name = "prometheus"; + # } ]; + # }; + # }; + + networking.firewall.allowedTCPPorts = [ 443 ]; + + containers.tracktrain = { + autoStart = true; + privateNetwork = true; + hostAddress6 = "fd00::42:40"; + localAddress6 = "fd00::42:41"; + hostAddress = "192.168.42.40"; + localAddress = "192.168.42.41"; + + config = { config, ... }: { + + systemd.services.tracktrain = { + enable = true; + + description = "tracks trains, hopefully"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + serviceConfig = { + Type = "simple"; + # EnvironmentFile = "/secrets/env"; + DynamicUser = true; + }; + path = [ pkgs.wget pkgs.ntfy-sh ]; + script = '' + cd /tmp + ln -sf ${pkgs.writeText "config.yaml" tracktrain-config} "config.yaml" + sleep 3 + ${pkgs.tracktrain}/bin/tracktrain +RTS -T + ''; + }; + + systemd.services.postgresql.wantedBy = [ "tracktrain.service" ]; + + services.postgresql = { + enable = true; + ensureDatabases = [ "tracktrain" ]; + ensureUsers = [ { + name = "tracktrain"; + ensureDBOwnership = true; + } ]; + authentication = '' + local all all trust + ''; + }; + + networking.firewall.enable = false; + system.stateVersion = "25.11"; + + services.coredns = { + enable = true; + config = '' + .:53 { + forward . 1.1.1.1 + } + ''; + }; + }; + }; + + networking.nat = { + enable = true; + internalInterfaces = [ "ve-tracktrain" ]; + externalInterface = "ens3"; + }; + +} diff --git a/npins/sources.json b/npins/sources.json index 8525b6c..0cc2d25 100644 --- a/npins/sources.json +++ b/npins/sources.json @@ -341,6 +341,18 @@ "url": "https://github.com/Mic92/sops-nix/archive/614e256310e0a4f8a9ccae3fa80c11844fba7042.tar.gz", "hash": "09zy236xxrj2i85lwzcl4agmdfkf7hxnxiz5nyq350hb0wjbh4by" }, + "tracktrain": { + "type": "Git", + "repository": { + "type": "Git", + "url": "https://stuebinm.eu/git/tracktrain" + }, + "branch": "main", + "submodules": false, + "revision": "3cd83d99fe477e78639c795a6b8ff4c844eb34a1", + "url": null, + "hash": "143ijhqir43a054abaagsjngxlc9j6vm0wfqw3gfwkhm5m9nic2c" + }, "traveltext": { "type": "Git", "repository": { diff --git a/pkgs/default.nix b/pkgs/default.nix index 2eeaf7c..5563b52 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -6,7 +6,7 @@ isabelle-utils isabat travelynx crs-tracker crs-php bahnhof-name matrix-to hikari heartwood radicle-interface radicle-tui inweb nomsring bookwyrm mollysocket git-annex-remote-remarkable2 ntfy-matrix-bot transport_validator - mergiraf git-who plover plover-dev; + mergiraf git-who plover plover-dev tracktrain; pkgs = nixpkgs; } diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 10796b1..abd3da2 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -180,6 +180,10 @@ in ''; }; + tracktrain = self.callPackage inputs.tracktrain { + compiler = "default"; + }; + bahnhof-name = let haskellPkgs = self.haskellPackages.override (old: { diff --git a/secrets/chaski.yaml b/secrets/chaski.yaml index 7f07b2c..31c18b3 100644 --- a/secrets/chaski.yaml +++ b/secrets/chaski.yaml @@ -1,10 +1,10 @@ ntfy-matrix-bot: env: ENC[AES256_GCM,data:mk/7fcdfsq+BOB8QK7LzVhYMDmMLw0cB0qq3p2IGWQAJtodqlqQMJukVF0jpoJLB/9GMcCweloVikus9K23/lcUPMZFHCdpMRR94puGROub8RF+v6XvegC741utlsLWGnS+Z/U8atHoI2rptdh4OV9lwELFYMpwDC/2IhxnhIyqWbAKnuWGdJcNVAKF6QxI0gY854xKoxRNXs3BrctoubSbBSyarjQiFgpk=,iv:jip5eTFPyBa199/SZhfezMY+Og8i1rh+2dmfVzBRPpo=,tag:xyLR34PqtJI63M5qnMvemQ==,type:str] +tracktrain: + env: "" +nginx: + tracktrain-auth: ENC[AES256_GCM,data:VlcsqohpTdTJ56DtKfjkGZD671jW5LBLWhcKfBQAmYq0RBtiBTzM0oZTYGl7quUZPuIAB0bM8alEcGsPQep8wAre,iv:+I0PQr4LwjwC2xTJDXpr7UxqTAhDCk3JvMlsmaOK6L8=,tag:LzjbqFruDNWGFm03yft79A==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age18wkr3kjalalzrq9l05q32gnlaqr7t6rqqzde307m83rs9fp4xcfsdtj9gt enc: | @@ -24,8 +24,7 @@ sops: aFF6Nkowc3kxckFGNWRqSUxYdXZOd0kKsoRAtnnhIkaPACXgaGzMNW6uAG4pAg4d DdgcTPKdAEv0uAqAmndsll+vWE1C0FaUwe37/jmBfAKrXpN7GwVa4g== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-03-27T22:32:40Z" - mac: ENC[AES256_GCM,data:MJTMrHLh9rL7p1Y+e4if51ZYvfYWDV25eJvJ3unZwIAahF5GoOav4rb1hU1hLObZFhtlyjgHe/VGP2D+QsDARJOop0kGiybnfHqz7Vh7KIWhjDwsxaBPkxMUovxrEhxnwHR8+zKqNs+Vcl06ZaJ2F6U0rJRqyxO2CK5aSnuqDtE=,iv:qDsnPrVlnwnmWFJYxgCBCvg1/qgFl1IOC3QEifXaEbs=,tag:/oVJDam2l7pD+g2tIBAakg==,type:str] - pgp: [] + lastmodified: "2026-03-29T21:30:26Z" + mac: ENC[AES256_GCM,data:4zial4AotTlj7/EifC6A9SptDM0HjdBJcINRUPGv0FT8QjinfQD8kQTlRh6LOr+2jfcNkoll5Inxt4Aibl0FpYjiaiML2T2RZXb3e12JE7gcE1ndNBWMbS2DRF2DWPrQywoW2a6IzI3oAC9dZxrFBVkx8mPYGWBtxifmYCBqPfU=,iv:9OBOAR+HS/hDwEh7DK+Vc6s+pwFWDlduq1sxb9aXkvk=,tag:hCFbxL8pFivX7QCDQ6QmYg==,type:str] unencrypted_suffix: _unencrypted - version: 3.8.1 + version: 3.12.1 |