Setup plausible analytics

fixes #423
fixes #424

modules/hosts/nixos/hetznix01/default.nix

@@ -23,9 +23,9 @@
   networking = {
     # Open ports in the firewall.
     firewall.allowedTCPPorts = [
-      22 # ssh
+      22  # ssh
-      25 # SMTP (unencrypted)
+      25  # SMTP (unencrypted)
-      80 # http to local Nginx
+      80  # http to local Nginx
       443 # https to local Nginx
       465 # SMTP with TLS 
       587 # SMTP with STARTTLS

modules/hosts/nixos/hetznix01/post-install/default.nix

@@ -1,4 +1,6 @@
-{ config, username, ... }: {
+{ config, username, ... }: let
+  domain = "technicalissues.us";
+in {
   imports = [
     ../../../../system/common/linux/lets-encrypt.nix
     ../../../../system/common/linux/restic.nix
@@ -10,33 +12,51 @@
     enable = true;
     enableImap = false;
     enableImapSsl = false;
-    fqdn = "mail.alt.technicalissues.us";
+    fqdn = "mail.alt.${domain}";
     domains = [
-      "alt.technicalissues.us"
+      "alt.${domain}"
       "indianspringsbsa.org"
     ];
     forwards = {
       "webmaster@indianspringsbsa.org" = "gene+indianspringsbsa.org@geneliverman.com";
       "newsletter@indianspringsbsa.org" = "gene+indianspringsbsa.org@geneliverman.com";
-      "@alt.technicalissues.us" = "gene+alt.technicalissues.us@geneliverman.com";
+      "@alt.${domain}" = "gene+alt.${domain}@geneliverman.com";
+      "${username}@localhost" = "${username}@technicalissues.us";
+      "root@localhost" = "root@technicalissues.us";
+      "root@${config.networking.hostName}" = "root@technicalissues.us";
     };
 
     # Use Let's Encrypt certificates from Nginx
     certificateScheme = "acme";
   };
 
-  # Cert for the mail server
-  security.acme.certs."alt.technicalissues.us" = {
-    extraDomainNames = [
-      "mail.alt.technicalissues.us"
-      "mail.indianspringsbsa.org"
-    ];
-    reloadServices = [
-      "postfix.service"
-    ];
-  };
-
   services = {
+    plausible = {
+      enable = true;
+      adminUser = {
+        # activate is used to skip the email verification of the admin-user that's
+        # automatically created by plausible. This is only supported if
+        # postgresql is configured by the module. This is done by default, but
+        # can be turned off with services.plausible.database.postgres.setup.
+        activate = true;
+        email = "${username}@technicalissues.us";
+        name = username;
+        passwordFile = config.sops.secrets.plausible_admin_pass.path;
+      };
+      database = {
+        clickhouse.setup = true;
+        postgres.setup = true;
+      };
+      mail.email = "stats@${domain}";
+      server = {
+        baseUrl = "https://stats.${domain}";
+        disableRegistration = true;
+        port = 8001;
+        # secretKeybaseFile is a path to the file which contains the secret generated
+        # with openssl as described above.
+        secretKeybaseFile = config.sops.secrets.plausible_secret_key_base.path;
+      };
+    };
     restic.backups.daily.paths = [
       "${config.users.users.${username}.home}/compose-files/owntracks"
       "/var/backup/postgresql"
@@ -77,6 +97,8 @@
         owner = config.users.users.nginx.name;
         restartUnits = ["nginx.service"];
       };
+      plausible_admin_pass.owner = config.users.users.nginx.name;
+      plausible_secret_key_base.owner = config.users.users.nginx.name;
       tailscale_key = {
         restartUnits = [ "tailscaled-autoconnect.service" ];
       };

modules/hosts/nixos/hetznix01/post-install/nginx.nix

@@ -26,6 +26,9 @@ in {
       "hetznix01.${domain}" = {
         serverAliases = [
           "technicalissues.us"
+          "alt.technicalissues.us"
+          "mail.alt.technicalissues.us"
+          "mail.indianspringsbsa.org"
         ];
         default = true;
         enableACME = true;
@@ -120,6 +123,12 @@ in {
           };
         };
       };
+      "stats.${domain}" = {
+        enableACME = true;
+        acmeRoot = null;
+        forceSSL = true;
+        locations."/".proxyPass = "http://127.0.0.1:8001";
+      };
       "utk.${domain}" = {
         enableACME = true;
         acmeRoot = null;

modules/hosts/nixos/hetznix01/secrets.yaml

@@ -4,6 +4,8 @@ matrix_secrets_yaml: ENC[AES256_GCM,data:6DLtAZIYBlL7iQVS/FBeUEhHyAOFZ5JRNqFBqi5
 matrix_homeserver_signing_key: ENC[AES256_GCM,data:+RflNxFfS2w9LbavT7YnCQIhJWI49kN7pOa9/dH0BpDWxKQaLE4ZYBYq0ikAgcHaF3+rBL3f6KxUacw=,iv:6+nZzuxBUwjM74XHCD89YWfyuMRcoIwQlHLiNN4NWdc=,tag:91yigynRz6QdEd4rF7d/9g==,type:str]
 mqtt_recorder_pass: ENC[AES256_GCM,data:N44nv2mk5zguWXNHdKsxhoKUjiduD1hzsAb6,iv:aLudKuUBTPXgtAF33exELH/PESD0CqoDaydeqdhcmbA=,tag:3lhrqO8jxJiRHWZjWSRa0g==,type:str]
 owntracks_basic_auth: ENC[AES256_GCM,data:GX1U1uf7+erE+g9GzhXK5ED2QicfcbpRCwpJDw6Zr9X2FtdMYleH5mhLxw==,iv:PflRq+P50+oFf4wv5wwlY6V9bApGuJ3tlYTvJZ5mg0E=,tag:VHBY5qv7rX74DGURsYaWpw==,type:str]
+plausible_admin_pass: ENC[AES256_GCM,data:nMGHMTp3YsDGP3YA9qmZqRCBA5BonS7SaLo=,iv:gN9qu+35DHiJVKh8vHF6KAwrFqgfdNNCC0+q3L/mBGg=,tag:XKlzT4Bp9IIKTSAmjDhd1Q==,type:str]
+plausible_secret_key_base: ENC[AES256_GCM,data:6Co3VO9Ocmd6cppRpm763jjpRE9yCb75FnrrvCD5XtQPoq6c7ZnCPfSPzWF7jOv6e0g+ghao015myEe3pmNlPcx55KE4LpPwNGHdGbFHmNsGiIDrDUC3Hw==,iv:0FXSF//7FAGrQKiMOfHFoWE539MzCnz7xUTHxxatTCI=,tag:cKMFwyLYScKVM3v+6hvwzg==,type:str]
 tailscale_key: ENC[AES256_GCM,data:Bl00WuIrLvxmt7aNsoXC6G7XFls7waZMzdfo/MsEOZl/i3wHwrjrmgwd3V4GkaJ42UjrC1OLobrkuLves4w=,iv:tlCu0EWgvhvs1ANdtQr7KWHJ2RjpHniUm/rFC4L/MHs=,tag:+8eov9w+SPGZPnjMdrN8gA==,type:str]
 sops:
     kms: []
@@ -20,8 +22,8 @@ sops:
             WkI4ejBaODI0d0tjWHpTT3VWTXNyaXcKMDtvHN4gcZqBNslyC+NwYW05zgs8QuPV
             W6EktAz+xu6kx5BJbli5GkUFmj52AtEGIqZ1Sr4a0pKQACC87XcTQA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-19T01:44:04Z"
+    lastmodified: "2024-06-29T04:40:44Z"
-    mac: ENC[AES256_GCM,data:PU4r7DhcG6OgqTCeKBtxyAHDErGH6Eh33sOd+KuImQ74ajgahFNfd4zO27OldZbSERkOYLuFqw7w9+zblV3eaaXRQx97Ek3z4oMtJFv2t9lnNfG0lm45c1eECKV742mzTDi6/bcnQMdn/CaGli8DL45IGGctW+beXRJza0S3wEY=,iv:51WymgQc4OWcannaD4g+fjp4vc75WonWsOMS3Jyz7Xo=,tag:dmNFFgkuKQxy2Snb/HjX/A==,type:str]
+    mac: ENC[AES256_GCM,data:94kylK+CFinvS2tjvu9vIanSjyVGkzu4IfDWvXvzxazR2U61IXuuaykPF3iDFKA9bC2cV4symPLmx7hAHFdN87mycOvkprUQzJTXORLdPjW90piaMvlETOH/lrjDq7R0TeIFfwj1hOrj0HrCg8tR6g49agl8uO/HoZQUtarZAf0=,iv:azMsvPUrR95r+dEWlBFilTdh+Zx26FNVcECX315njkI=,tag:DFZSHW3zq7ZD2KliTjL31A==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1