m3tam3re/nixos-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

postgres upgrade@m3-atlas

Browse Source
This commit is contained in:
Sascha Koenig 2025-05-12 16:06:40 +02:00
parent 7854d75742
commit e0aa2783bb
6 changed files with 38 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
home/m3tam3re/m3-kratos.nix
View File

@ -13,7 +13,6 @@ in {
../features/cli
../features/coding
../features/desktop
./services/librechat.nix
];
options.features.desktop.hyprland.enable =

1
hosts/common/users/m3tam3re.nix
View File

@ -7,6 +7,7 @@
users.users.m3tam3re = {
#initialHashedPassword = "$y$j9T$IoChbWGYRh.rKfmm0G86X0$bYgsWqDRkvX.EBzJTX.Z0RsTlwspADpvEF3QErNyCMC";
password = "12345";
linger = true;
isNormalUser = true;
description = "m3tam3re";
extraGroups = [

2
hosts/m3-atlas/services/containers/baserow.nix
View File

@ -1,6 +1,6 @@
{config, ...}: {
virtualisation.oci-containers.containers."baserow" = {
image = "docker.io/baserow/baserow:1.31.1";
image = "docker.io/baserow/baserow:1.33.2";
environmentFiles = [config.age.secrets.baserow-env.path];
ports = ["127.0.0.1:3001:80"];
volumes = ["baserow_data:/baserow/data"];

7
hosts/m3-atlas/services/mysql.nix
View File

@ -18,5 +18,10 @@
calendar = "03:00:00";
databases = ["ghost" "matomo"];
};
networking.firewall.allowedTCPPorts = [3306];
networking.firewall = {
extraCommands = ''
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport 3306 -j ACCEPT
'';
};
}

3
hosts/m3-atlas/services/paperless.nix
View File

@ -7,10 +7,11 @@
configureTika = true;
settings = {
PAPERLESS_URL = "https://pl.m3ta.dev";
DATABASE_URL = "postgresql://paperless:paperless@localhost:5432/paperless";
DATABASE_URL = "postgresql://paperless:paperless@127.0.0.1:5432/paperless";
PAPERLESS_CONSUMER_IGNORE_PATTERN = [
".DS_STORE/*"
"desktop.ini"
".env"
];
PAPERLESS_OCR_LANGUAGE = "deu+eng";
PAPERLESS_OCR_USER_ARGS = {

40
hosts/m3-atlas/services/postgres.nix
View File

@ -2,23 +2,39 @@
services.postgresql = {
enable = true;
enableTCPIP = true;
package = pkgs.postgresql_15;
package = pkgs.postgresql_17;
extensions = with pkgs.postgresql17Packages; [
pgvector
];
authentication = pkgs.lib.mkOverride 10 ''
local all all trust
host all all 127.0.0.1/32 trust
host all all ::1/128 trust
host all all 10.89.0.0/16 trust
'';
initialScript = pkgs.writeText "backend-initScript" ''
CREATE USER baserow WITH ENCRYPTED PASSWORD 'baserow';
CREATE DATABASE baserow;
ALTER DATABASE baserow OWNER to baserow;
# Local connections (Unix socket)
local all postgres peer
local paperless paperless scram-sha-256
# Localhost connections (IPv4 and IPv6)
host all postgres 127.0.0.1/32 scram-sha-256
host all postgres ::1/128 scram-sha-256
host paperless paperless 127.0.0.1/32 scram-sha-256
host paperless paperless ::1/128 scram-sha-256
# Podman network connections for Baserow
host baserow baserow 10.89.0.0/24 scram-sha-256
# Deny all other connections
local all all reject
host all all 0.0.0.0/0 reject
host all all ::/0 reject
'';
};
services.postgresqlBackup = {
enable = true;
startAt = "03:10:00";
databases = ["baserow"];
databases = ["baserow" "paperless"];
};
networking.firewall = {
extraCommands = ''
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 5432 -j ACCEPT
iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport 5432 -j ACCEPT
'';
};
networking.firewall.allowedTCPPorts = [5432];
}