summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--takemi-os.scm43
1 files changed, 37 insertions, 6 deletions
diff --git a/takemi-os.scm b/takemi-os.scm
index 693321e..f611d92 100644
--- a/takemi-os.scm
+++ b/takemi-os.scm
@@ -2,6 +2,7 @@
(gnu packages version-control)
(gnu services certbot)
(gnu services cgit)
+ (gnu services ci)
(gnu services networking)
(gnu services ssh)
(gnu services version-control)
@@ -88,6 +89,7 @@
(authorized-keys
`(("dave" ,dave-pub-key)
("publish" ,dave-pub-key)))))
+ ;; Git repository hosting.
(service gitolite-service-type
(gitolite-configuration
(admin-pubkey dave-pub-key)
@@ -96,6 +98,10 @@
;; cgit will work.
(umask #o0027)
(git-config-keys "gitweb\\..*")))))
+ ;; Continuous integration.
+ (service laminar-service-type)
+ ;; TLS certificates. Certbot extends nginx with configuration to
+ ;; redirect all HTTP requests to HTTPS.
(service (service-type
(inherit certbot-service-type)
(extensions
@@ -117,6 +123,7 @@
(domains '("dthompson.us"
"www.dthompson.us"
"git.dthompson.us"
+ "ci.dthompson.us"
"files.dthompson.us"
"haunt.dthompson.us"))
;; Send SIGHUP signal to nginx to trigger a
@@ -145,6 +152,28 @@
(raw-content '("autoindex on;"))
(ssl-certificate letsencrypt-cert)
(ssl-certificate-key letsencrypt-cert-key))
+ (nginx-server-configuration
+ ;; Laminar recommends using HTTP2 here.
+ (listen '("443 ssl http2"))
+ (server-name '("ci.dthompson.us"))
+ (locations
+ (list
+ ;; Reverse proxy to Laminar daemon.
+ (nginx-location-configuration
+ (uri "/")
+ (body '("proxy_pass http://127.0.0.1:8080;"
+ "proxy_http_version 1.1;"
+ "proxy_set_header Connection \"\";")))
+ ;; Serve static files directly.
+ (nginx-location-configuration
+ (uri "/archive")
+ (body '("alias /var/lib/laminar/archive/;")))))
+ (ssl-certificate letsencrypt-cert)
+ (ssl-certificate-key letsencrypt-cert-key)
+ ;; Modern TLS only.
+ (raw-content
+ '("ssl_protocols TLSv1.3;"
+ "ssl_ciphers EECDH+AESGCM:EDH+AESGCM;")))
;; I used to have the Haunt website under
;; its own subdomain, and some sites still
;; point to it.
@@ -159,12 +188,7 @@
(body '("rewrite .* https://dthompson.us/projects/haunt.html permanent;")))))
(ssl-certificate letsencrypt-cert)
(ssl-certificate-key letsencrypt-cert-key))))))
- (service fcgiwrap-service-type
- (fcgiwrap-configuration
- ;; Use git group for read-only access to gitolite
- ;; repos.
- (group "git")
- (socket (string-append "tcp:" fcgiwrap-socket))))
+ ;; Git repository viewer.
(let ((cgit (specification->package "cgit")))
(service (service-type
(inherit cgit-service-type)
@@ -248,6 +272,13 @@
("fastcgi_pass " ,fcgiwrap-socket ";"))))))
(ssl-certificate letsencrypt-cert)
(ssl-certificate-key letsencrypt-cert-key)))))))
+ ;; fcgriwrap wraps cgit.
+ (service fcgiwrap-service-type
+ (fcgiwrap-configuration
+ ;; Use git group for read-only access to gitolite
+ ;; repos.
+ (group "git")
+ (socket (string-append "tcp:" fcgiwrap-socket))))
(modify-services %base-services
(guix-service-type config =>
(guix-configuration