infrastructure

commit f3f7dea3d666079bb1c3a113b2cb46e53fa1165f
parent e71819ce9c76e383d14080a9589926d8f71f21ab
Author: Silas Brack <silasbrack@gmail.com>
Date:   Thu,  2 Apr 2026 10:28:03 +0200

Add MediaWiki

Diffstat:
M
flake.nix
 | 
1
+
M
nixos/configuration-debian-2gb-hel1-1.nix
 | 
39
++++++++++++++++++++++++++++++++++++++-
M
secrets.yaml
 | 
7
++++---

3 files changed, 43 insertions(+), 4 deletions(-)
diff --git a/flake.nix b/flake.nix
@@ -48,6 +48,7 @@
         in
         pkgs.mkShell {
           buildInputs = with pkgs; [
+	    git
             gnumake
             age
             curl
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -72,6 +72,10 @@
   sops.secrets.hetzner_wireguard_key = {
     restartUnits = [ "wg-quick-wg0.service" ];
   };
+  sops.secrets.mediawiki_admin_password = {
+    owner = "mediawiki";
+    mode = "0400";
+  };
 
   networking.wg-quick.interfaces = {
     wg0 = {
@@ -115,6 +119,39 @@
   };
   services.nginx.enable = true;
 
+  # MediaWiki
+  services.mediawiki = {
+    enable = true;
+    name = "My Wiki";
+    webserver = "nginx";
+    passwordFile = config.sops.secrets.mediawiki_admin_password.path;
+    database = {
+      type = "postgres";
+      createLocally = true;
+    };
+    nginx.hostName = "wiki.fnarglebeast.com";
+    uploadsDir = "/var/lib/mediawiki/uploads";
+    extraConfig = ''
+      $wgEnableUploads = true;
+      $wgUseImageMagick = true;
+
+      # Security: disable anonymous editing (require login)
+      $wgGroupPermissions['*']['edit'] = false;
+      $wgGroupPermissions['*']['createpage'] = false;
+      $wgGroupPermissions['*']['createtalk'] = false;
+
+      # Security: disable account creation by anonymous users
+      $wgGroupPermissions['*']['createaccount'] = false;
+
+      # Security: restrict upload file types
+      $wgFileExtensions = ['png', 'gif', 'jpg', 'jpeg', 'webp', 'pdf'];
+    '';
+  };
+  services.nginx.virtualHosts."wiki.fnarglebeast.com" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
   # services.simple-web-app = {
   #   enable = true;
   #   package = simple-web-app.packages."x86_64-linux".default;
@@ -213,7 +250,7 @@
   };
 
   systemd.services.nginx.serviceConfig = {
-    ReadWritePaths = [ "/var/lib/mkv/volume" ];
+    ReadWritePaths = [ "/mnt/volume-hel1-1/mkv" ];
     ProtectSystem = lib.mkForce "full"; # downgrade from strict
   };
 
diff --git a/secrets.yaml b/secrets.yaml
@@ -2,6 +2,7 @@ server_wireguard_key: ENC[AES256_GCM,data:21uPlSLnedqeXxIjS+HhJ0lAD6T/diIkjAAhbr
 hetzner_wireguard_key: ENC[AES256_GCM,data:mHPlUfbysQdmdxy107G1/Xhi0JB/c3Fz3QYKj6j6VXMVy0d7Lma7nr/G3bE=,iv:UGMm8uDUHUJGeLZ8dVsAiFj+43sHoxZSWF+hPcv8QVs=,tag:YSdMv8xj7cTdT05BVXkKPA==,type:str]
 freshrss_password: ENC[AES256_GCM,data:oK/KbYmiux2YdXtNiTVJQUWO5+2K2eDx,iv:v3+cOq6oQGXcp22jDmncoJJFbqF/KZCh9CjcsDTrA50=,tag:aIFGAcfcfkT0QrIsO6lIrQ==,type:str]
 livebook_password_env_file: ENC[AES256_GCM,data:aic46wuBFngu24R3U6sGXNuB8zQSj6YWIum8szgt6UDJ3PZpYlCT6yNEEZ/NlQ87C4NUELWPE402qZ/hPqjW0X0HcEpXIBnQ4ZcO8uoI0zbMeLFMgGw3+27Uq3dyfMxfCWfBe/VHGBK1i8hKEZ0xzIdPktyTF/bZUnsXXgKvoJtJToWXMbX0/g==,iv:zhZvELSPfIcjAu/ZDastRCJJXg7z5Q0qdPA+N3UqBjg=,tag:QfdwD/hpb/6zc6SiNWj/8A==,type:str]
+mediawiki_admin_password: ENC[AES256_GCM,data:Db4YvAIccl/9TqOZY9UnmIAS,iv:0Ar13Hnr5f/CB34DLMNJvWoNPmpaTxR2W8WsiC3QxNQ=,tag:fnURqRo2XHCFi9w9wx4QWA==,type:str]
 sops:
     age:
         - recipient: age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
@@ -31,7 +32,7 @@ sops:
             dXNXQkF5SXZjWHRPNjZaR29YZ1pRQ3MKJvGVAm8M9oIQBHJH1o0NG8x0c4qvgvHr
             1T/ghKHZWIpbXzct1LNy+5T10OgRxm5++NKuuuiAXW2XmnkJu1Bc3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-30T18:54:33Z"
-    mac: ENC[AES256_GCM,data:SRpWQDznuwGoy95soxciTCuJdD/To2PJzusR/t6G/QPPwWoR3JcR2vZz4q5n4RmHnneJdXkWhMU+x0Gu116A5q2jIrfE51weGjyL8nhVsdvyp5Y12tLsFmqy588jHGaVTWxN/Z20bmmvNIh/gmFP7E0z1a9nt2NwRQVhhibWbXg=,iv:34cdBBgRd89sEyN3PoGdrRLfn9RSW6hN+mWQSLtB6fs=,tag:dg89FnuaCRYAhq6IoLDOZQ==,type:str]
+    lastmodified: "2026-03-31T18:34:36Z"
+    mac: ENC[AES256_GCM,data:elKFld/Xs0JPddB4dWYYn5kRA/eBZnDdTvwDJIFznLs6Y5dtescl5tdLpX/rTd7yKkbEXaBcbZNztV5cMl8FU9VwdqE0GzhRTWhfxJy1ethKvjtDqvOO4ndh6ebiriqh9Hty08u8LnbePMlBKofOUccH0C+2VBQAe/mv/4FHa5U=,iv:/aFDAFecNTcAfPiKhCu9buolhJTu/XRmV0l2PuJ6Hoc=,tag:srKZd/XM+sqXl7IMXy/g2A==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0