146 lines
3.7 KiB
Nix
146 lines
3.7 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
shb,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.shb.hledger;
|
|
|
|
fqdn = "${cfg.subdomain}.${cfg.domain}";
|
|
in
|
|
{
|
|
imports = [
|
|
../blocks/nginx.nix
|
|
];
|
|
|
|
options.shb.hledger = {
|
|
enable = lib.mkEnableOption "selfhostblocks.hledger";
|
|
|
|
subdomain = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Subdomain under which Authelia will be served.";
|
|
example = "ha";
|
|
};
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "domain under which Authelia will be served.";
|
|
example = "mydomain.com";
|
|
};
|
|
|
|
dataDir = lib.mkOption {
|
|
description = "Folder where Hledger will store all its data.";
|
|
type = lib.types.str;
|
|
default = "/var/lib/hledger";
|
|
};
|
|
|
|
ssl = lib.mkOption {
|
|
description = "Path to SSL files";
|
|
type = lib.types.nullOr shb.contracts.ssl.certs;
|
|
default = null;
|
|
};
|
|
|
|
port = lib.mkOption {
|
|
type = lib.types.int;
|
|
description = "HLedger port";
|
|
default = 5000;
|
|
};
|
|
|
|
localNetworkIPRange = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Local network range, to restrict access to the UI to only those IPs.";
|
|
default = null;
|
|
example = "192.168.1.1/24";
|
|
};
|
|
|
|
authEndpoint = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
description = "OIDC endpoint for SSO";
|
|
example = "https://authelia.example.com";
|
|
default = null;
|
|
};
|
|
|
|
backup = lib.mkOption {
|
|
description = ''
|
|
Backup configuration.
|
|
'';
|
|
default = { };
|
|
type = lib.types.submodule {
|
|
options = shb.contracts.backup.mkRequester {
|
|
user = "hledger";
|
|
sourceDirectories = [
|
|
cfg.dataDir
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
extraArguments = lib.mkOption {
|
|
description = "Extra arguments append to the hledger command.";
|
|
default = [ "--forecast" ];
|
|
type = lib.types.listOf lib.types.str;
|
|
};
|
|
|
|
dashboard = lib.mkOption {
|
|
description = ''
|
|
Dashboard contract consumer
|
|
'';
|
|
default = { };
|
|
type = lib.types.submodule {
|
|
options = shb.contracts.dashboard.mkRequester {
|
|
externalUrl = "https://${cfg.subdomain}.${cfg.domain}";
|
|
externalUrlText = "https://\${config.shb.hledger.subdomain}.\${config.shb.hledger.domain}";
|
|
internalUrl = "http://127.0.0.1:${toString config.services.hledger-web.port}";
|
|
internalUrlText = "http://127.0.0.1:\${config.services.hledger-web.port}";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.hledger-web = {
|
|
enable = true;
|
|
# Must be empty otherwise it repeats the fqdn, we get something like https://${fqdn}/${fqdn}/
|
|
baseUrl = "";
|
|
|
|
stateDir = cfg.dataDir;
|
|
journalFiles = [ "hledger.journal" ];
|
|
|
|
host = "127.0.0.1";
|
|
port = cfg.port;
|
|
|
|
allow = "edit";
|
|
extraOptions = cfg.extraArguments;
|
|
};
|
|
|
|
systemd.services.hledger-web = {
|
|
# If the hledger.journal file does not exist, hledger-web refuses to start, so we create an
|
|
# empty one if it does not exist yet..
|
|
preStart = ''
|
|
test -f /var/lib/hledger/hledger.journal || touch /var/lib/hledger/hledger.journal
|
|
'';
|
|
serviceConfig.StateDirectory = "hledger";
|
|
};
|
|
|
|
shb.nginx.vhosts = [
|
|
{
|
|
inherit (cfg)
|
|
subdomain
|
|
domain
|
|
authEndpoint
|
|
ssl
|
|
;
|
|
upstream = "http://${toString config.services.hledger-web.host}:${toString config.services.hledger-web.port}";
|
|
autheliaRules = [
|
|
{
|
|
domain = fqdn;
|
|
policy = "two_factor";
|
|
subject = [ "group:hledger_user" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
};
|
|
}
|