From 45e0ff0b0fe3731bf413bfe218bffcf16b0c1cd4 Mon Sep 17 00:00:00 2001 From: tobinio Date: Wed, 1 Jul 2026 10:30:54 +0200 Subject: [PATCH] add modrinth-statistics --- hosts/homeserver/configuration.nix | 5 +++-- hosts/homeserver/secrets.yaml | 7 +++++-- .../services/modrinth-statistics.compose.yml | 12 ++++++++++++ .../services/modrinth-statistics.nix | 16 ++++++++++++++++ hosts/homeserver/services/postgres.nix | 18 +++++++++++++++--- hosts/homeserver/services/taskline.nix | 4 ++-- 6 files changed, 53 insertions(+), 9 deletions(-) create mode 100644 hosts/homeserver/services/modrinth-statistics.compose.yml create mode 100644 hosts/homeserver/services/modrinth-statistics.nix diff --git a/hosts/homeserver/configuration.nix b/hosts/homeserver/configuration.nix index 84bae82..097593d 100644 --- a/hosts/homeserver/configuration.nix +++ b/hosts/homeserver/configuration.nix @@ -14,6 +14,7 @@ ./services/postgres.nix ./services/nextcloud.nix ./services/backup.nix + ./services/modrinth-statistics.nix ]; # Bootloader. @@ -84,13 +85,13 @@ programs.fish.enable = true; - users.groups.taskline = {}; + users.groups.env-secrets = {}; # Define a user account. Don't forget to set a password with ‘passwd’. users.users."tobinio" = { isNormalUser = true; description = "Tobias Frischmann"; - extraGroups = [ "networkmanager" "wheel" "docker" "taskline" ]; + extraGroups = [ "networkmanager" "wheel" "docker" "env-secrets" ]; packages = with pkgs; []; openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYGHT/TFeBEMKwalsqsnoAEdI/zrulCMMIQVshV3UiqbzxwmJbQPWxnx6mSKMGx0mK2fpo3WYuFwSVpznau7PraFKQvhPynTIiDsX3m57SHwtlf2g7U+hjLrGPgjHfKOAo7biRfAs762TM5/9sb1XCm+CBC9QZDsJn6usa8gwvKV43PPcINC7UE3MFiW7gYdXd6+bGTP75ue7KyewJ8fPz37+uIbKnJKA9oqj7/eTiJKIgtV9gkvmciTtsUlJtLG8WrvQ5UU2F/Nfnh4urbyM8C6vScRWM56d5qGqBFCoNDdeJHaFFp9vVy71BdAyP+CvqpkH++OtvewHs7IrCVZN15xkfQFuhMaSkrcPjencvZYt68Gun5BXhWN3Xp4HIXoFVO0U1k7oqGs7g6FBAW4CDt84I50zvw0xXoR5R5NeUA69rybh/bsNKipmO6G0j8vKfHSPnrjttH0h5K7cPXY0KR+C5Wa9lMtjx3ZAbWk/Ytsz3iJ+Eaho3kI7C9LYb03QtQsLrcEM6lIUcYjEQeGoAzByjJRLlCiqWMbQwexRfhacytOVWWuPcGGWckoiZKRmLsxZfuH967fRBH54DiF6Fx8GRfFclHOtxcbADB0muiw3A8jZAiUYZlvqwatpxK7neQ7VIJqqjkUZE2iK6byyyh1kOxl2PsHqpXNVSzELAxQ== tobinio@fedora" diff --git a/hosts/homeserver/secrets.yaml b/hosts/homeserver/secrets.yaml index 2e06810..8d2fa0e 100644 --- a/hosts/homeserver/secrets.yaml +++ b/hosts/homeserver/secrets.yaml @@ -21,6 +21,9 @@ newt_secret: ENC[AES256_GCM,data:qLaeYhO6bt0tSJAwNhwSMxIr416Od4AksSg5XZ7X7gy5+Vp nextcloud_admin_password: ENC[AES256_GCM,data:VHcdwclX/F7awXAT8wWXfmGLWnbrB7Ac,iv:R2jSjaX4CMlWxpDRwVrE7YEMErYQUX6HMENMxJp9ggw=,tag:C8yOemdOsFQl3CoXQJntYA==,type:str] #ENC[AES256_GCM,data:KYJNIEZMTQ==,iv:MbTQlzlTX7i4TB2hnvkts3kJ+xwdgiFLB2LSzAbexAs=,tag:kg6UIdDfPXY8skaex0JSvA==,type:comment] restic_password: ENC[AES256_GCM,data:KOkaDvfS45O6xpS1JU4=,iv:LxeovfjYsHLkmXV8fIKvbOWttAz7CBRXxwwcMaGJ2lA=,tag:V7PcE4EXqsobEx+biliDYA==,type:str] +#ENC[AES256_GCM,data:NQOKvwrNwTKCtwVc1FDOLyUtx5I=,iv:zjvWQIt+XQrZ2JWTXCjt748wuFRbvbVhmM8de93NJks=,tag:tLeaeVA9o8QnSWffmmctDg==,type:comment] +nuxt_db_url: ENC[AES256_GCM,data:LNTjBUDD64kC1GQLyWsBKVn6qXBFJEocK4xggDOme6i3J6uP8bvy6JR+165uncvuL5+iAMJCcW1hi3ZoXJmZ3vS30SYC7IJgxGk5FxpudfzmaUIIObFxuUWCTKC2,iv:Ag0NvQ8KE1dsxcuJVHdGoA7+FhnCZUlENxjfNfRlgfA=,tag:OaKUrx1WAHz4L2dU0nS7jg==,type:str] +nuxt_public_umami_id: ENC[AES256_GCM,data:UUb+hfuq2dm88bxgHpD00BHSajdYoxO9kCGZIRwZAmKdZUrd,iv:CJpNJHpOkYP6bCFxC8b9W0/ghP+UUnzLXI8xOt/cp1I=,tag:L4dRS7a3vkO3ab6eN3CpfA==,type:str] sops: age: - enc: | @@ -32,7 +35,7 @@ sops: ymzV/vprvtzMGSPZLLwURHKO8PZBZ7VV8zL/wGSxFcposVnLwo5qFQ== -----END AGE ENCRYPTED FILE----- recipient: age185ejn50rqg7tnzcrkp5f9w7p6vf4ex3k9k472xlyvpenanrgnv4q6kyx9n - lastmodified: "2026-06-19T07:21:47Z" - mac: ENC[AES256_GCM,data:0XKRsWYWUJW6d2Pkq1WonmTiT+h9kNhTYE4vrPOqp3awsPcGh+A+zjhrnjmr16J3tI2bRhR6FGWTqM4bFYi4oGbCzNamj4gIB9JJXEmd2Z6wp/i+S3B8EubPtadguZyz84pFjB813bOTuGsjzjIt2A7hgh7p1MJnKXls4fwbaWc=,iv:5YMIlCDH+K8MKXkFoCSk1tZu6nifkbExa+NtYGElfcE=,tag:ft4GT3FtEsTjLdStEge+0Q==,type:str] + lastmodified: "2026-06-19T12:14:25Z" + mac: ENC[AES256_GCM,data:ucBEGmMJeiowyXiRtuwSH3gNoEJYOdRF8T1XxePEEr12zTyTuUVU3dgEu0Bh1IKtutEZ8rEBrdywE0zUjOZ2PhM9ELp052tEv8D2eXSZfmt4pBAS1onLoH1Z8UxzqZJGGh8EOXyFZUJZZiF/SZHrM79d2b4pDlrCr70AiRvH+O0=,iv:USb+NWOf0k0xwGnXsmEZDrQkmFIFYHQQXwVKV8FycvQ=,tag:YAuBJEHrxf29qXOW6/C0jQ==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 diff --git a/hosts/homeserver/services/modrinth-statistics.compose.yml b/hosts/homeserver/services/modrinth-statistics.compose.yml new file mode 100644 index 0000000..e1c45b9 --- /dev/null +++ b/hosts/homeserver/services/modrinth-statistics.compose.yml @@ -0,0 +1,12 @@ +services: + modrinth-statistics: + image: atcr.io/tobinio.dev/modrinth-statistics:v3.0.0 + restart: unless-stopped + ports: + - 3002:3000 + env_file: + - /run/secrets/rendered/modrinth-statistics.env + volumes: + - /srv/apps/modrinth-statistics/data:/app/.data + extra_hosts: + - host.docker.internal:host-gateway diff --git a/hosts/homeserver/services/modrinth-statistics.nix b/hosts/homeserver/services/modrinth-statistics.nix new file mode 100644 index 0000000..806d4c3 --- /dev/null +++ b/hosts/homeserver/services/modrinth-statistics.nix @@ -0,0 +1,16 @@ +{ config, ... }: +{ + sops.secrets = { + nuxt_public_umami_id = {}; + nuxt_db_url = {}; + }; + + sops.templates."modrinth-statistics.env" = { + content = '' + NUXT_PUBLIC_UMAMI_ID=${config.sops.placeholder.nuxt_public_umami_id} + NUXT_DB_URL=${config.sops.placeholder.nuxt_db_url} + ''; + group = "env-secrets"; + mode = "0440"; + }; +} diff --git a/hosts/homeserver/services/postgres.nix b/hosts/homeserver/services/postgres.nix index 35cc347..0f67a50 100644 --- a/hosts/homeserver/services/postgres.nix +++ b/hosts/homeserver/services/postgres.nix @@ -1,16 +1,27 @@ { config, pkgs, ... }: { + systemd.services.postgresql = { + after = [ "docker.service" ]; + requires = [ "docker.service" ]; + }; + services.postgresql = { enable = true; + settings.listen_addresses = pkgs.lib.mkForce "127.0.0.1,172.17.0.1"; + dataDir = "/srv/postgresql"; - ensureDatabases = [ "nextcloud" ]; + ensureDatabases = [ "nextcloud" "modrinth-statistics" ]; ensureUsers = [ { name = "nextcloud"; ensureDBOwnership = true; + } + { + name = "modrinth-statistics"; + ensureDBOwnership = true; } { name = "admin"; @@ -20,8 +31,9 @@ authentication = pkgs.lib.mkOverride 10 '' #type database DBuser auth-method - local all postgres peer - local nextcloud nextcloud peer + local all all peer + + host all all 172.16.0.0/12 scram-sha-256 host all admin 127.0.0.1/32 scram-sha-256 host all admin ::1/128 scram-sha-256 diff --git a/hosts/homeserver/services/taskline.nix b/hosts/homeserver/services/taskline.nix index feafdd5..ef5ba3b 100644 --- a/hosts/homeserver/services/taskline.nix +++ b/hosts/homeserver/services/taskline.nix @@ -31,7 +31,7 @@ NUXT_PUBLIC_API_BASE=${config.sops.placeholder.nuxt_public_api_base} ''; - group = "taskline"; + group = "env-secrets"; mode = "0440"; }; @@ -44,7 +44,7 @@ API_DATABASE_URL=${config.sops.placeholder.api_database_url} ''; - group = "taskline"; + group = "env-secrets"; mode = "0440"; }; } -- 2.51.2