Add mastodon

machines/T420-Laptop/default.nix

@@ -11,6 +11,7 @@
     nginx
     vsftpd
     home-assistant
+    mastodon
   ];
 
   services.logind.lidSwitch = "ignore";

modules/default.nix

@@ -33,6 +33,7 @@ builtins.listToAttrs (builtins.map (path: {
   ./servers/nginx.nix
   ./servers/vsftpd.nix
   ./servers/home-assistant.nix
+  ./servers/mastodon.nix
   ./services.nix
   ./themes.nix
   ./virtualisation.nix

modules/servers/mailserver.nix

@@ -7,6 +7,10 @@ in {
     owner = "dovecot2:dovecot2";
     services = [ "dovecot2" ];
   };
+  secrets.mailserver-mastodon = {
+    owner = "dovecot2:dovecot2";
+    services = [ "dovecot2" ];
+  };
   services.postfix = {
     dnsBlacklists = [
       "all.s5h.net"
@@ -79,6 +83,10 @@ in {
           [ "balsoft" "admin@balsoft.ru" "patches" "patches@balsoft.ru" "issues" "issues@balsoft.ru" "admin" "root@balsoft.ru" "root" ];
         hashedPasswordFile = config.secrets.mailserver.decrypted;
       };
+      "mastodon@balsoft.ru" = {
+        aliases = [ "mastodon" ];
+        hashedPasswordFile = config.secrets.mailserver-mastodon.decrypted;
+      };
     };
     localDnsResolver = false;
     certificateScheme = 1;

modules/servers/mastodon.nix

@@ -0,0 +1,19 @@
+{ config, pkgs, lib, ... }: {
+  secrets.email-mastodon = {
+    owner = "mastodon:mastodon";
+    encrypted = "/home/balsoft/.password-store/email/mastodon@balsoft.ru.gpg";
+    services = [ "mastodon-web" ];
+  };
+  services.mastodon = {
+    enable = true;
+    configureNginx = true;
+    localDomain = "social.balsoft.ru";
+    smtp = {
+      createLocally = false;
+      fromAddress = "mastodon@balsoft.ru";
+      user = "mastodon";
+      host = "balsoft.ru";
+      passwordFile = config.secrets.email-mastodon.decrypted;
+    };
+  };
+}

modules/servers/nginx.nix

@@ -21,7 +21,7 @@
           proxyPass = "http://localhost:13748";
         };
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "code.balsoft.ru" = {
         locations."/" = { proxyPass = "http://localhost:6000"; };