From 05f67b62c6901a1597c208d8fe2629cc46f57b41 Mon Sep 17 00:00:00 2001 From: kalipso Date: Mon, 14 Sep 2026 14:18:48 +0200 Subject: [PATCH 1/3] [wordpress] init --- machines/hosts.nix | 7 +- machines/wordpress/configuration.nix | 139 +++++++++++++++++++++++++++ 2 files changed, 145 insertions(+), 1 deletion(-) create mode 100644 machines/wordpress/configuration.nix diff --git a/machines/hosts.nix b/machines/hosts.nix index 5a264b8..29bbe9c 100644 --- a/machines/hosts.nix +++ b/machines/hosts.nix @@ -133,7 +133,12 @@ in network = createMaloNet "20" "52:DA:0D:F9:EF:F6"; }; - # last host id: 20 + wordpress = { + type = "microvm"; + network = createMaloNet "21" "52:DA:0D:F9:EF:F6"; + }; + + # last host id: 21 }; }; } diff --git a/machines/wordpress/configuration.nix b/machines/wordpress/configuration.nix new file mode 100644 index 0000000..63aba76 --- /dev/null +++ b/machines/wordpress/configuration.nix @@ -0,0 +1,139 @@ +{ config, lib, pkgs, inputs, ... }: + +# 1. copy wp folder to host +# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R +# 3. create user through webinterface +# 4. delete hello world post +# 5. run importer + +with lib; + +let + + user = "wordpress"; + stateDir = "/var/lib/wordpress/rm16bleibt.org"; + webserver = config.services.nginx; + uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads"; + fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts"; + +in { + networking = { + hostName = mkDefault "wordpress"; + useDHCP = false; + }; + + imports = [ + inputs.self.nixosModules.malobeo.users + ../modules/sshd.nix + ]; + + malobeo.users = { + malobeo = false; + admin = true; + }; + + users.users.wordpress = { + group = webserver.group; + isSystemUser = true; + }; + + systemd.tmpfiles.rules = [ + "d '${stateDir}' 0750 ${user} ${webserver.group} - -" + "d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -" + "d '${uploadsDir}' 0750 ${user} ${webserver.group} - -" + "Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -" + "d '${fontsDir}' 0750 ${user} ${webserver.group} - -" + "Z '${fontsDir}' 0750 ${user} ${webserver.group} - -" + ]; + + services.phpfpm.pools = { + "wordpress-rm16bleibt.org" = { + user = user; + group = webserver.group; + settings = { + "pm" = "dynamic"; + "pm.max_children" = 32; + "pm.start_servers" = 2; + "pm.min_spare_servers" = 2; + "pm.max_spare_servers" = 4; + "pm.max_requests" = 500; + "listen.owner" = webserver.user; + "listen.group" = webserver.group; + }; + }; + }; + + services.mysql = { + enable = true; + #package = mkDefault pkgs.mariadb; + package = pkgs.mysql84; + ensureDatabases = ["wordpress"]; + ensureUsers = [ + { + name = "wordpress"; + ensurePermissions = { + "wordpress.*" = "ALL PRIVILEGES"; + }; + } + ]; + }; + + services.nginx = { + enable = true; + virtualHosts."rm16bleibt.org" = { + #serverName = "rm16bleibt.org"; + root = "/var/lib/wordpress/rm16bleibt.org"; + extraConfig = '' + index index.php; + ''; + locations = { + "/" = { + priority = 200; + extraConfig = '' + try_files $uri $uri/ /index.php$is_args$args; + ''; + }; + "~ \\.php$" = { + priority = 500; + extraConfig = '' + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket}; + fastcgi_index index.php; + include "${config.services.nginx.package}/conf/fastcgi.conf"; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; + + # Mitigate https://httpoxy.org/ vulnerabilities + fastcgi_param HTTP_PROXY ""; + fastcgi_intercept_errors off; + fastcgi_buffer_size 16k; + fastcgi_buffers 4 16k; + fastcgi_connect_timeout 300; + fastcgi_send_timeout 300; + fastcgi_read_timeout 300; + ''; + }; + "~ /\\." = { + priority = 800; + extraConfig = "deny all;"; + }; + "~* /(?:uploads|files)/.*\\.php$" = { + priority = 900; + extraConfig = "deny all;"; + }; + "~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = { + priority = 1000; + extraConfig = '' + expires max; + log_not_found off; + ''; + }; + }; + }; + }; + + networking.firewall.allowedTCPPorts = [ 80 ]; + + system.stateVersion = "22.11"; # Did you read the comment? +} + -- 2.54.0 From 6f0a1e29a58960129c0ac34eaa5d2b9ef5a592f0 Mon Sep 17 00:00:00 2001 From: kalipso Date: Mon, 14 Sep 2026 14:19:38 +0200 Subject: [PATCH 2/3] [fanny] forward wordpress --- machines/fanny/configuration.nix | 15 +++++++++++++++ machines/fanny/dyndns.nix | 2 ++ 2 files changed, 17 insertions(+) diff --git a/machines/fanny/configuration.nix b/machines/fanny/configuration.nix index 4d6b5c6..30f2597 100644 --- a/machines/fanny/configuration.nix +++ b/machines/fanny/configuration.nix @@ -313,6 +313,21 @@ in ''; }; }; + + virtualHosts."www.rm16bleibt.org" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}:80"; + recommendedProxySettings = true; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Port 443; + proxy_set_header X-Forwarded-Proto https; + ''; + }; + }; + virtualHosts."cache.malobeo.org" = { forceSSL = true; enableACME = true; diff --git a/machines/fanny/dyndns.nix b/machines/fanny/dyndns.nix index 0f43958..e135141 100644 --- a/machines/fanny/dyndns.nix +++ b/machines/fanny/dyndns.nix @@ -8,9 +8,11 @@ KEYCLOUD=$(cat /run/secrets/njalacloud) KEYZINES=$(cat /run/secrets/njalazines) KEYANATAMAP=$(cat /run/secrets/njalaantamap) + KEYRM16=$(cat /run/secrets/njalarm16) ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto" ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto" ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto" + ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=www.rm16bleibt.org&k="$KEYRM16"&auto" ''; serviceConfig = { Type = "oneshot"; -- 2.54.0 From babcf4dd762f2324a79fe9fe1f697527c94e16db Mon Sep 17 00:00:00 2001 From: kalipso Date: Mon, 14 Sep 2026 14:29:27 +0200 Subject: [PATCH 3/3] [fanny] deploy wordpress --- machines/fanny/configuration.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/machines/fanny/configuration.nix b/machines/fanny/configuration.nix index 30f2597..43d8c18 100644 --- a/machines/fanny/configuration.nix +++ b/machines/fanny/configuration.nix @@ -148,6 +148,7 @@ in "pretalx" "antamap" "ns1" + "wordpress" ]; networking = { -- 2.54.0