diff options
Diffstat (limited to 'Omni')
| -rwxr-xr-x | Omni/Cloud.nix | 1 | ||||
| -rw-r--r-- | Omni/Cloud/Cal.nix | 81 | ||||
| -rw-r--r-- | Omni/Cloud/Web.nix | 56 |
3 files changed, 82 insertions, 56 deletions
diff --git a/Omni/Cloud.nix b/Omni/Cloud.nix index 544b588..1f9706d 100755 --- a/Omni/Cloud.nix +++ b/Omni/Cloud.nix @@ -6,6 +6,7 @@ bild.os { ./Os/Base.nix ./Packages.nix ./Users.nix + ./Cloud/Cal.nix # ./Cloud/Chat.nix ./Cloud/Comms.nix ./Cloud/Git.nix diff --git a/Omni/Cloud/Cal.nix b/Omni/Cloud/Cal.nix new file mode 100644 index 0000000..3c3c46c --- /dev/null +++ b/Omni/Cloud/Cal.nix @@ -0,0 +1,81 @@ +{config, ...}: let + ports = import ./Ports.nix; + rootDomain = config.networking.domain; +in { + networking.firewall.allowedTCPPorts = [ports.radicale]; + + services.radicale = { + enable = true; + rights = { + # Allow reading root collection for authenticated users + root = { + user = ".*"; + collection = ""; + permissions = "R"; + }; + # Allow reading and writing principal collection (same as username) + principal = { + user = ".+"; + collection = "{user}"; + permissions = "RW"; + }; + # Make shared collection visible as part of root listing + shared_principal = { + user = ".+"; + collection = "shared"; + permissions = "RW"; + }; + # Allow reading and writing calendars and address books that are direct + # children of the principal collection + calendars = { + user = ".+"; + collection = "{user}/[^/]+"; + permissions = "rw"; + }; + # Allow ben full access to shared/ben, repeat this for other shared + # calendars as needed. + ben_shared = { + user = "ben"; + collection = "shared/ben(/.+)?"; + permissions = "rwD"; + }; + # Must be authed to write to the shared collections + shared_write = { + user = ".+"; + collection = "shared/[^/]+"; + permissions = "rw"; + }; + # Allow any user to read the shared collection + shared_read = { + user = ".+"; + collection = "shared(/.*)?"; + permissions = "r"; + }; + }; + settings = { + server = { + hosts = [ + "0.0.0.0:${toString ports.radicale}" + "[::]:${toString ports.radicale}" + ]; + }; + auth = { + type = "htpasswd"; + htpasswd_filename = "/etc/radicale/users"; + htpasswd_encryption = "plain"; + }; + }; + }; + + services.nginx.virtualHosts."cal.${rootDomain}" = { + locations."/".proxyPass = "http://localhost:${toString ports.radicale}"; + forceSSL = true; + useACMEHost = rootDomain; + extraConfig = '' + proxy_set_header X-Script-Name ""; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_pass_header Authorization; + ''; + }; +} diff --git a/Omni/Cloud/Web.nix b/Omni/Cloud/Web.nix index b87da38..d11fc80 100644 --- a/Omni/Cloud/Web.nix +++ b/Omni/Cloud/Web.nix @@ -36,50 +36,6 @@ in { port = ports.invidious; }; - radicale = { - enable = true; - rights = { - # Allow reading root collection for authenticated users - root = { - user = ".+"; - collection = ""; - permissions = "R"; - }; - # Allow reading and writing principal collection (same as username) - principal = { - user = ".+"; - collection = "{user}"; - permissions = "RW"; - }; - # Allow reading and writing calendars and address books that are direct - # children of the principal collection - calendars = { - user = ".+"; - collection = "{user}/[^/]+"; - permissions = "rw"; - }; - # Allow any authenticated user to modify the public collection - public = { - user = ".*"; - collection = "public/.*"; - permissions = "rw"; - }; - }; - settings = { - server = { - hosts = [ - "0.0.0.0:${toString ports.radicale}" - "[::]:${toString ports.radicale}" - ]; - }; - auth = { - type = "htpasswd"; - htpasswd_filename = "/etc/radicale/users"; - htpasswd_encryption = "plain"; - }; - }; - }; - gmnisrv = { enable = false; listen = "0.0.0.0:${toString ports.gemini} [::]:${toString ports.gemini}"; @@ -162,18 +118,6 @@ in { useACMEHost = rootDomain; }; - "cal.${rootDomain}" = { - locations."/".proxyPass = "http://localhost:${toString ports.radicale}"; - forceSSL = true; - useACMEHost = rootDomain; - extraConfig = '' - proxy_set_header X-Script-Name /radicale; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $host; - proxy_pass_header Authorization; - ''; - }; - "youtube.${rootDomain}" = { locations."/".proxyPass = "http://localhost:${toString ports.invidious}"; forceSSL = true; |