blob: 51b957788eb7a3b94356542e12d35ef930e5b565 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
{
config,
lib,
masterDomain,
...
}:
let
cfg = config.os.srv.simplex;
internalSmpPort = 5223;
internalXftpPort = 5224;
in
{
options.os.srv.simplex = {
enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman";
tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX";
};
config = lib.mkIf cfg.enable (
lib.mkMerge [
{
assertions = [
{
assertion = config.os.srv.oci.enable;
message = "SimpleX requires os.srv.oci to be enabled to run containers.";
}
{
assertion = config.os.srv.nginx.enable;
message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
}
{
assertion = config.os.srv.sops.enable;
message = "SimpleX requires sops for managing container passwords securely.";
}
];
sops.secrets."simplex/smp-env" = { };
sops.secrets."simplex/xftp-env" = { };
virtualisation.oci-containers.containers = {
simplex-smp = {
image = "simplexchat/smp-server:latest";
ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
environment = {
ADDR = "smp.${masterDomain}";
CONFIG_DIR = "/etc/opt/simplex";
};
environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
volumes = [
"/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
"/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
"/var/lib/simplex/certs:/certificates:ro"
];
};
simplex-xftp = {
image = "simplexchat/xftp-server:latest";
ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
environment = {
ADDR = "xftp.${masterDomain}";
QUOTA = "10gb";
};
environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
volumes = [
"/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
"/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
"/var/lib/simplex/xftp/files:/srv/xftp:rw"
];
};
};
services.nginx = {
streamConfig = ''
server {
listen 5223;
proxy_pass 127.0.0.1:${toString internalSmpPort};
}
server {
listen 5224;
proxy_pass 127.0.0.1:${toString internalXftpPort};
}
'';
};
systemd.tmpfiles.rules = [
"d /var/lib/simplex/smp/config 0755 root root -"
"d /var/lib/simplex/smp/logs 0755 root root -"
"d /var/lib/simplex/rsa_certs 0755 root root -"
"d /var/lib/simplex/xftp/config 0755 root root -"
"d /var/lib/simplex/xftp/logs 0755 root root -"
"d /var/lib/simplex/xftp/files 0755 root root -"
];
networking.firewall.allowedTCPPorts = [
5223
5224
];
}
(lib.mkIf cfg.tor.enable {
assertions = [
{
assertion = config.os.srv.tor.enable;
message = "SimpleX Tor support requires os.srv.tor to be enabled.";
}
];
services.tor.relay.onionServices = {
simplex-smp = {
version = 3;
map = [
{
port = 5223;
target = {
addr = "127.0.0.1";
port = internalSmpPort;
};
}
];
};
simplex-xftp = {
version = 3;
map = [
{
port = 5224;
target = {
addr = "127.0.0.1";
port = internalXftpPort;
};
}
];
};
};
})
]
);
}
|
