mirror of
https://github.com/oqyude/nixos.git
synced 2026-06-11 12:40:44 +03:00
remnawave init
This commit is contained in:
@@ -7,6 +7,193 @@
|
||||
...
|
||||
}:
|
||||
{
|
||||
# Runtime
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
|
||||
# Enable container name DNS for all Podman networks.
|
||||
networking.firewall.interfaces = let
|
||||
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
|
||||
in {
|
||||
"${matchAll}".allowedUDPPorts = [ 53 ];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.backend = "podman";
|
||||
|
||||
# Containers
|
||||
virtualisation.oci-containers.containers."remnawave-panel-1" = {
|
||||
image = "ghcr.io/remnawave/backend:latest";
|
||||
environment = {
|
||||
"API_INSTANCES" = "1";
|
||||
"APP_PORT" = "3000";
|
||||
"BANDWIDTH_USAGE_NOTIFICATIONS_ENABLED" = "false";
|
||||
"BANDWIDTH_USAGE_NOTIFICATIONS_THRESHOLD" = "[60, 80]";
|
||||
"FRONT_END_DOMAIN" = "*";
|
||||
"IS_DOCS_ENABLED" = "false";
|
||||
"IS_TELEGRAM_NOTIFICATIONS_ENABLED" = "false";
|
||||
"METRICS_PASS" = "admin";
|
||||
"METRICS_PORT" = "3001";
|
||||
"METRICS_USER" = "admin";
|
||||
"NOT_CONNECTED_USERS_NOTIFICATIONS_AFTER_HOURS" = "[6, 24, 48]";
|
||||
"NOT_CONNECTED_USERS_NOTIFICATIONS_ENABLED" = "false";
|
||||
"PANEL_DOMAIN" = "rw.zeroq.ru";
|
||||
"POSTGRES_DB" = "remnawave";
|
||||
"POSTGRES_USER" = "remnawave";
|
||||
"REDIS_SOCKET" = "/var/run/valkey/valkey.sock";
|
||||
"SCALAR_PATH" = "/scalar";
|
||||
"SUB_PUBLIC_DOMAIN" = "rw.zeroq.ru/api/sub";
|
||||
"SWAGGER_PATH" = "/docs";
|
||||
# "TELEGRAM_BOT_TOKEN" = "change_me";
|
||||
# "TELEGRAM_NOTIFY_CRM" = "change_me";
|
||||
# "TELEGRAM_NOTIFY_NODES" = "change_me";
|
||||
# "TELEGRAM_NOTIFY_SERVICE" = "change_me";
|
||||
# "TELEGRAM_NOTIFY_TBLOCKER" = "change_me";
|
||||
# "TELEGRAM_NOTIFY_USERS" = "change_me";
|
||||
"WEBHOOK_ENABLED" = "false";
|
||||
# "WEBHOOK_URL" = "https://your-webhook-url.com/endpoint";
|
||||
};
|
||||
environmentFiles = [
|
||||
"/run/secrets/remnawave-env"
|
||||
];
|
||||
ports = [
|
||||
"3003:3003/tcp"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=remnawave-panel-1"
|
||||
"--network=host" # "--network=remnawavebackend_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-remnawave-panel-1" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
partOf = [
|
||||
"podman-compose-remnawave-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-remnawave-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
# Builds
|
||||
# systemd.services."podman-build-remnawave-panel-1" = {
|
||||
# path = [ pkgs.podman pkgs.git ];
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# TimeoutSec = 300;
|
||||
# };
|
||||
# script = ''
|
||||
# cd /mnt/s/Deploy/remnawave-backend
|
||||
# podman build -t compose2nix/remnawave-panel-1 .
|
||||
# '';
|
||||
# };
|
||||
|
||||
# Root service
|
||||
# When started, this will automatically create all resources and start
|
||||
# the containers. When stopped, this will teardown all resources.
|
||||
systemd.targets."podman-compose-remnawave-root" = {
|
||||
unitConfig = {
|
||||
Description = "Root target generated by compose2nix.";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
services = {
|
||||
postgresql = {
|
||||
ensureDatabases = [ "remnawave" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "remnawave";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
remnawave-env = {
|
||||
description = "Generate remnawave env file";
|
||||
requiredBy = [ "podman-remnawave-panel-1.service" ];
|
||||
before = [ "podman-remnawave-panel-1.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
};
|
||||
script = ''
|
||||
cat > /run/secrets/remnawave-env <<EOF
|
||||
DATABASE_URL=$(cat ${config.sops.secrets.DATABASE_URL.path})
|
||||
DATABASE_PASSWORD=$(cat ${config.sops.secrets.DATABASE_PASSWORD.path})
|
||||
JWT_AUTH_SECRET=$(cat ${config.sops.secrets.JWT_AUTH_SECRET.path})
|
||||
JWT_API_TOKENS_SECRET=$(cat ${config.sops.secrets.JWT_API_TOKENS_SECRET.path})
|
||||
CLOUDFLARE_TOKEN=$(cat ${config.sops.secrets.CLOUDFLARE_TOKEN.path})
|
||||
WEBHOOK_SECRET_HEADER=$(cat ${config.sops.secrets.WEBHOOK_SECRET_HEADER.path})
|
||||
EOF
|
||||
chmod 600 /run/secrets/remnawave-env
|
||||
'';
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
remnawave-db-init = {
|
||||
description = "Initialize Remnawave DB user";
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "postgres";
|
||||
};
|
||||
script = ''
|
||||
PASSWORD=$(cat ${config.sops.secrets.DATABASE_PASSWORD.path})
|
||||
${pkgs.postgresql}/bin/psql -v ON_ERROR_STOP=1 <<EOF
|
||||
DO \$\$
|
||||
BEGIN
|
||||
IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname='remnawave') THEN
|
||||
EXECUTE format('ALTER ROLE remnawave WITH PASSWORD %L', '$PASSWORD');
|
||||
END IF;
|
||||
END
|
||||
\$\$ LANGUAGE plpgsql;
|
||||
EOF
|
||||
'';
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
DATABASE_PASSWORD = {
|
||||
key = "DATABASE_PASSWORD";
|
||||
sopsFile = ./secrets/remnawave.yaml;
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0400";
|
||||
};
|
||||
WEBHOOK_SECRET_HEADER = {
|
||||
key = "WEBHOOK_SECRET_HEADER";
|
||||
sopsFile = ./secrets/remnawave.yaml;
|
||||
mode = "0400";
|
||||
};
|
||||
DATABASE_URL = {
|
||||
key = "DATABASE_URL";
|
||||
sopsFile = ./secrets/remnawave.yaml;
|
||||
mode = "0400";
|
||||
};
|
||||
JWT_AUTH_SECRET = {
|
||||
key = "JWT_AUTH_SECRET";
|
||||
sopsFile = ./secrets/remnawave.yaml;
|
||||
mode = "0400";
|
||||
};
|
||||
JWT_API_TOKENS_SECRET = {
|
||||
key = "JWT_API_TOKENS_SECRET";
|
||||
sopsFile = ./secrets/remnawave.yaml;
|
||||
mode = "0400";
|
||||
};
|
||||
CLOUDFLARE_TOKEN = {
|
||||
key = "CLOUDFLARE_TOKEN";
|
||||
sopsFile = ./secrets/remnawave.yaml;
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
|
||||
"d ${xlib.dirs.services-mnt-folder}/containers 0755 root root -"
|
||||
|
||||
Reference in New Issue
Block a user