diff --git a/sys/platforms/vps/default.nix b/sys/platforms/vps/default.nix index dab0ef9..a93fee3 100644 --- a/sys/platforms/vps/default.nix +++ b/sys/platforms/vps/default.nix @@ -17,6 +17,12 @@ with lib; { ./networkMap.nix ]; + + local.soju = { + enable = true; + fullyQualifiedDomain = "soju.posixlycorrect.com"; + }; + local.sys = { baseline.enable = true; diff --git a/sys/platforms/vps/srv/default.nix b/sys/platforms/vps/srv/default.nix index b47e653..71beeca 100644 --- a/sys/platforms/vps/srv/default.nix +++ b/sys/platforms/vps/srv/default.nix @@ -18,6 +18,5 @@ with lib; { ./immich.nix ./mealie.nix ./dufs.nix - ./soju.nix ]; } diff --git a/sys/platforms/vps/srv/soju.nix b/sys/platforms/vps/srv/soju.nix deleted file mode 100644 index 86d2772..0000000 --- a/sys/platforms/vps/srv/soju.nix +++ /dev/null @@ -1,45 +0,0 @@ -{ - lib, - pkgs, - config, - ... -}: -with lib; { - security.acme.certs."soju.posixlycorrect.com" = { - reloadServices = ["soju.service"]; - group = "soju"; - }; - - networking.firewall.allowedTCPPorts = [6697]; - - services.soju = let - sojuCertDir = config.security.acme.certs."soju.posixlycorrect.com".directory; - in { - enable = true; - hostName = "soju.posixlycorrect.com"; - listen = ["ircs://[::]:6697"]; - tlsCertificate = "${sojuCertDir}/fullchain.pem"; - tlsCertificateKey = "${sojuCertDir}/key.pem"; - }; - - systemd.services.soju = { - after = ["acme-soju.posixlycorrect.com.service"]; - serviceConfig = { - DynamicUser = mkForce false; # fuck dynamic users - User = "soju"; - Group = "soju"; - ProtectSystem = "strict"; - ProtectHome = "read-only"; - PrivateTmp = true; - RemoveIPC = true; - }; - }; - - users = { - users.soju = { - isSystemUser = true; - group = "soju"; - }; - groups.soju = {}; - }; -}