imterah/nix-infra
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

feature: Add mCaptcha

Browse source
This commit is contained in:
Tera << 8 2025-05-07 09:22:35 -04:00
parent 8748868d39
commit ca9db7c606
Signed by: imterah
GPG key ID: 8FA7DD57BA6CEA37
5 changed files with 181 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -17,8 +17,9 @@ This is a work-in-progress and currently is not production ready. Please check b
- [x] Configure Caddy for internal service port forwarding (difficult!)
- [ ] Install Tailscale
- [ ] Install Portainer for other servers & basic admin tasks
- [ ] Install Forgejo
- [x] Install Forgejo
- [x] Install Personal Website
- [x] Install mCaptcha
- [ ] Install Passbolt
- [ ] Install Pterodactyl Panel
- [ ] Install Immich

1
hosts/andromeda/configuration.nix
View file

@ -19,6 +19,7 @@
./stacks/traefik/docker-compose.nix
./stacks/caddy/docker-compose.nix
./stacks/forgejo/docker-compose.nix
./stacks/mcaptcha/docker-compose.nix
./stacks/terah.dev/docker-compose.nix
];

175
hosts/andromeda/stacks/mcaptcha/docker-compose.nix Normal file
View file

@ -0,0 +1,175 @@
# Auto-generated using compose2nix v0.3.1.
{ config, pkgs, lib, ... }:
{
imports = [
../../../../system/sops.nix
];
# Containers
virtualisation.oci-containers.containers."mcaptcha-cache" = {
image = "mcaptcha/cache:latest";
log-driver = "journald";
extraOptions = [
"--network-alias=cache"
"--network=mcaptcha_default"
];
};
systemd.services."docker-mcaptcha-cache" = {
serviceConfig = {
Restart = lib.mkOverride 90 "no";
};
after = [
"docker-network-mcaptcha_default.service"
];
requires = [
"docker-network-mcaptcha_default.service"
];
partOf = [
"docker-compose-mcaptcha-root.target"
];
wantedBy = [
"docker-compose-mcaptcha-root.target"
];
};
virtualisation.oci-containers.containers."mcaptcha-db" = {
image = "postgres:16.8";
environmentFiles = [ config.sops.secrets.mcaptcha_db_docker_env ];
environment = {
"PGDATA" = "/var/lib/postgresql/data/mcaptcha/";
"POSTGRES_PASSWORD" = "password";
};
volumes = [
"mcaptcha_db:/var/lib/postgresql:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=db"
"--network=mcaptcha_default"
];
};
systemd.services."docker-mcaptcha-db" = {
serviceConfig = {
Restart = lib.mkOverride 90 "no";
};
after = [
"docker-network-mcaptcha_default.service"
"docker-volume-mcaptcha_db.service"
];
requires = [
"docker-network-mcaptcha_default.service"
"docker-volume-mcaptcha_db.service"
];
partOf = [
"docker-compose-mcaptcha-root.target"
];
wantedBy = [
"docker-compose-mcaptcha-root.target"
];
};
virtualisation.oci-containers.containers."mcaptcha-mcaptcha" = {
image = "mcaptcha/mcaptcha:latest";
labels = {
"traefik.http.routers.mcaptchaterahdev.rule" = "Host(`mcaptcha.terah.dev`)";
"traefik.http.services.mcaptchaterahdev.loadbalancer.server.port" = "7000";
};
environmentFiles = [ config.sops.secrets.mcaptcha_mcaptcha_docker_env.path ];
environment = {
"MCAPTCHA__server_IP" = "0.0.0.0";
"MCAPTCHA_allow_demo" = "false";
"MCAPTCHA_allow_registration" = "false";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_avg_traffic_difficulty" = "50000";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_avg_traffic_time" = "1";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_broke_my_site_traffic_difficulty" = "5000000";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_broke_my_site_traffic_time" = "5";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_duration" = "30";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_peak_sustainable_traffic_difficulty" = "3000000";
"MCAPTCHA_captcha_DEFAULT_DIFFICULTY_STRATEGY_peak_sustainable_traffic_time" = "3";
"MCAPTCHA_captcha_ENABLE_STATS" = "true";
"MCAPTCHA_captcha_GC" = "30";
"MCAPTCHA_captcha_QUEUE_LENGTH" = "2000";
"MCAPTCHA_captcha_RUNNERS" = "4";
"MCAPTCHA_commercial" = "false";
"MCAPTCHA_database_POOL" = "4";
"MCAPTCHA_debug" = "false";
"MCAPTCHA_redis_POOL" = "4";
"MCAPTCHA_redis_URL" = "redis://cache";
"MCAPTCHA_server_DOMAIN" = "mcaptcha.terah.dev";
"MCAPTCHA_source_code" = "https://github.com/mCaptcha/mCaptcha";
"PORT" = "7000";
};
ports = [
"7000:7000/tcp"
];
dependsOn = [
"mcaptcha-cache"
"mcaptcha-db"
];
log-driver = "journald";
extraOptions = [
"--network-alias=mcaptcha"
"--network=mcaptcha_default"
];
};
systemd.services."docker-mcaptcha-mcaptcha" = {
serviceConfig = {
Restart = lib.mkOverride 90 "no";
};
after = [
"docker-network-mcaptcha_default.service"
];
requires = [
"docker-network-mcaptcha_default.service"
];
partOf = [
"docker-compose-mcaptcha-root.target"
];
wantedBy = [
"docker-compose-mcaptcha-root.target"
];
};
# Networks
systemd.services."docker-network-mcaptcha_default" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "docker network rm -f mcaptcha_default";
};
script = ''
docker network inspect mcaptcha_default || docker network create mcaptcha_default
'';
partOf = [ "docker-compose-mcaptcha-root.target" ];
wantedBy = [ "docker-compose-mcaptcha-root.target" ];
};
# Volumes
systemd.services."docker-volume-mcaptcha_db" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
docker volume inspect mcaptcha_db || docker volume create mcaptcha_db
'';
partOf = [ "docker-compose-mcaptcha-root.target" ];
wantedBy = [ "docker-compose-mcaptcha-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."docker-compose-mcaptcha-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}

2
secrets

@ -1 +1 @@
Subproject commit 60d55ae56d5ca38e387e33e8fd186d83e8320839
Subproject commit 641331a16088e444d4d22ac421916b5bde369f89

2
system/sops.nix
View file

@ -25,6 +25,8 @@ in
caddy_docker_env = {};
forgejo_db_docker_env = {};
forgejo_server_docker_env = {};
mcaptcha_db_docker_env = {};
mcaptcha_mcaptcha_docker_env = {};
};
};
}