fixup postgres and hedgedoc

hosts/common.nix

@@ -128,3 +128,4 @@
     };
   };
 }
+

hosts/md/default.nix

@@ -6,7 +6,7 @@
     ../../services/openssh.nix
     ./hedgedoc.nix
     ../../services/nginx.nix
-    ./nginx
+    ./nginx.nix
     ./postgres.nix
   ];
 

hosts/md/hedgedoc.nix

@@ -4,15 +4,11 @@
   services.hedgedoc = {
     enable = true;
     settings = {
-      domain = "${config.networking.fqdn}";
-      #environmentFile = config.age.secrets.hedgedoc_settings.path;
+      domain = "md.${config.networking.domain}";
+      environmentFile = config.age.secrets.hedgedoc_db_password.path;
+      dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@sql.berlin.ccc.de:5432/hedgedoc";
+      db.dialect = "postgresql";
       protocolUseSSL = true;
-      db = {
-        dialect = "postgresql";
-        host = "/run/postgresql";
-        username = "hedgedoc";
-        database = "hedgedoc";
-      };
       enableStatsApi = true;
     };
   };

hosts/md/nginx.nix

@@ -4,7 +4,7 @@ let
   cfg = config.services.hedgedoc.settings;
 in
 {
-  nginx.virtualHosts."${config.networking.fqdn}" = {
+  services.nginx.virtualHosts."md.${config.networking.domain}" = {
     default = true;
     quic = true;
     kTLS = true;
@@ -14,6 +14,9 @@ in
       "/" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
         recommendedProxySettings = true;
+        extraConfig = ''
+          #add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
+        '';
       };
       "/socket.io/" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
@@ -23,16 +26,20 @@ in
       "/metrics" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
         recommendedProxySettings = true;
-        #allow 195.160.173.255;
-        #allow 2001:678:760:cccb::ffff;
-        #deny all;
+        extraConfig = ''
+          allow 195.160.173.14;
+          allow 2001:678:760:cccb::14;
+          deny all;
+        '';
       };
       "/status" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
         recommendedProxySettings = true;
-        #allow 195.160.173.255;
-        #allow 2001:678:760:cccb::ffff;
-        #deny all;
+        extraConfig = ''
+          allow 195.160.173.14;
+          allow 2001:678:760:cccb::14;
+          deny all;
+        '';
       };
     };
   };

hosts/md/postgres.nix

@@ -1,23 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  services = {
-    postgresql = {
-      enable = true;
-      package = pkgs.postgresql_18;
-      enableJIT = true;
-      initdbArgs = [
-        "--locale=C"
-        "--encoding=UTF8"
-      ];
-      ensureUsers = [{ name = cfg.db.username; ensureDBOwnership = true; }];
-      ensureDatabases = [ cfg.db.database ];
-    };
-    postgresqlBackup = {
-      enable = true;
-      startAt = "*-*-* 09:00:00";
-      compression = "zstd";
-    };
-  };
-}
-

hosts/sql/postgres.nix

@@ -58,6 +58,11 @@ in
       ensureDatabases = map (e: e.database) entries;
       authentication = "${builtins.concatStringsSep "\n" (map (e: e.auth) entries)}";
     };
+    postgresqlBackup = {
+      enable = true;
+      startAt = "*-*-* 09:00:00";
+      compression = "zstd";
+    };
   };
   systemd.services.postgresql.postStart = ''
     ${config.services.postgresql.package}/bin/psql \