blob: ca22192ffecbe40073f2b160700cbb59e2267a0b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
{
config,
lib,
masterDomain,
...
}:
let
cfg = config.os.srv.simplex;
internalSmpPort = 5223;
internalXftpPort = 5224;
in
{
options.os.srv.simplex = {
enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman";
tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX";
};
config = lib.mkIf cfg.enable (
lib.mkMerge [
{
assertions = [
{
assertion = config.os.srv.oci.enable;
message = "SimpleX requires os.srv.oci to be enabled to run containers.";
}
{
assertion = config.os.srv.nginx.enable;
message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
}
{
assertion = config.os.srv.sops.enable;
message = "SimpleX requires sops for managing container passwords securely.";
}
];
sops.secrets."simplex/smp-env" = { };
sops.secrets."simplex/xftp-env" = { };
virtualisation.oci-containers.containers = {
simplex-smp = {
image = "simplexchat/smp-server:latest";
ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
environment = {
ADDR = "smp.${masterDomain}";
CONFIG_DIR = "/etc/opt/simplex";
};
environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
volumes = [
"/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
"/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
"/var/lib/simplex/certs:/certificates:ro"
];
};
simplex-xftp = {
image = "simplexchat/xftp-server:latest";
ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
environment = {
ADDR = "xftp.${masterDomain}";
QUOTA = "10gb";
};
environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
volumes = [
"/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
"/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
"/var/lib/simplex/xftp/files:/srv/xftp:rw"
];
};
};
systemd.tmpfiles.rules = [
"d /var/lib/simplex/smp/config 0755 root root -"
"d /var/lib/simplex/smp/logs 0755 root root -"
"d /var/lib/simplex/rsa_certs 0755 root root -"
"d /var/lib/simplex/xftp/config 0755 root root -"
"d /var/lib/simplex/xftp/logs 0755 root root -"
"d /var/lib/simplex/xftp/files 0755 root root -"
];
networking.firewall.allowedTCPPorts = [
5223
5224
];
}
(lib.mkIf cfg.tor.enable {
assertions = [
{
assertion = config.os.srv.tor.enable;
message = "SimpleX Tor support requires os.srv.tor to be enabled.";
}
];
services.tor.relay.onionServices = {
simplex-smp = {
version = 3;
map = [
{
port = 5223;
target = {
addr = "127.0.0.1";
port = internalSmpPort;
};
}
];
};
simplex-xftp = {
version = 3;
map = [
{
port = 5224;
target = {
addr = "127.0.0.1";
port = internalXftpPort;
};
}
];
};
};
})
]
);
}
|
