all the broken

flake.lock

@@ -83,11 +83,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759499898,
+        "lastModified": 1755946532,
-        "narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
+        "narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
+        "rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
         "type": "github"
       },
       "original": {
@@ -153,11 +153,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1759532138,
+        "lastModified": 1759348172,
-        "narHash": "sha256-sLQIlgDwMP3mEY2PwjGW+cL56QQ2n2WXoZ3GpG5QWOY=",
+        "narHash": "sha256-ZPUJX2ZA0ndcHndIA/S/nRESIJV0rifPr91SUpzJtEM=",
         "owner": "chaotic-cx",
         "repo": "nyx",
-        "rev": "bad02bbca5b5c6d45539a0d740ad0e21b1ba9afc",
+        "rev": "dd1af56ad79c965ee20c236ba6adbb2135ac02af",
         "type": "github"
       },
       "original": {
@@ -212,11 +212,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1759560021,
+        "lastModified": 1759473677,
-        "narHash": "sha256-J/rtMKVUAEqOFj0ogvcHKK8HbaKhw+tiNrDOpEM+ZDY=",
+        "narHash": "sha256-9AFDP5AhXe06aXXPsV7bDGH7KA9Wo4uUtK7pRrsxuFQ=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "6ffcbf59c119b0c6384c7d98f18cea06a9af7e9c",
+        "rev": "8532b07ced6a95d57650124c79534a3c770431ab",
         "type": "github"
       },
       "original": {
@@ -491,11 +491,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759523803,
+        "lastModified": 1758108966,
-        "narHash": "sha256-PTod9NG+i3XbbnBKMl/e5uHDBYpwIWivQ3gOWSEuIEM=",
+        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "cfc9f7bb163ad8542029d303e599c0f7eee09835",
+        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
         "type": "github"
       },
       "original": {
@@ -571,11 +571,11 @@
     },
     "hardware": {
       "locked": {
-        "lastModified": 1759582739,
+        "lastModified": 1759261527,
-        "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
+        "narHash": "sha256-wPd5oGvBBpUEzMF0kWnXge0WITNsITx/aGI9qLHgJ4g=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "3441b5242af7577230a78ffb03542add264179ab",
+        "rev": "e087756cf4abbe1a34f3544c480fc1034d68742f",
         "type": "github"
       },
       "original": {
@@ -610,11 +610,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759573136,
+        "lastModified": 1759337100,
-        "narHash": "sha256-ILSPD0Dm8p0w0fCVzOx98ZH8yFDrR75GmwmH3fS2VnE=",
+        "narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5f06ceafc6c9b773a776b9195c3f47bbe1defa43",
+        "rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
         "type": "github"
       },
       "original": {
@@ -652,11 +652,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759337100,
+        "lastModified": 1759261733,
-        "narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
+        "narHash": "sha256-G104PUPKBgJmcu4NWs0LUaPpSOTD4jiq4mamLWu3Oc0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
+        "rev": "5a21f4819ee1be645f46d6b255d49f4271ef6723",
         "type": "github"
       },
       "original": {
@@ -710,11 +710,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759490292,
+        "lastModified": 1758192433,
-        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
+        "narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
+        "rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7",
         "type": "github"
       },
       "original": {
@@ -803,11 +803,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1759530922,
+        "lastModified": 1759399554,
-        "narHash": "sha256-9NgZKpibALekGTPDc2O8lP8vFealQSZkXe+L+S7MMZU=",
+        "narHash": "sha256-FsFugHj7He5siEcmoRUdMKHB8uMzyneK/fynPS57W4E=",
         "owner": "hyprwm",
         "repo": "hyprland",
-        "rev": "76d998743ac10e712238c1016db4d8e8d16f1049",
+        "rev": "3bcfa94ee4189faaa4daf661949e88cf28c00d94",
         "type": "github"
       },
       "original": {
@@ -942,11 +942,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759080228,
+        "lastModified": 1757694755,
-        "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
+        "narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=",
         "owner": "hyprwm",
         "repo": "hyprland-qtutils",
-        "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
+        "rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c",
         "type": "github"
       },
       "original": {
@@ -971,11 +971,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758927902,
+        "lastModified": 1756810301,
-        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
+        "narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
+        "rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931",
         "type": "github"
       },
       "original": {
@@ -1006,11 +1006,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759572448,
+        "lastModified": 1759492718,
-        "narHash": "sha256-o+r44fqPQM+/hQdjFy9qV9C51Jhty6M4icFVYocyJfA=",
+        "narHash": "sha256-Mxi/LyyHE9VKUnBs4y1hXO+wRqukZJjbx/igqKQxkQk=",
         "owner": "hyprwm",
         "repo": "hyprlock",
-        "rev": "c8a6768dca626cf7d7cbc333095f048bc007b6d9",
+        "rev": "3cb799b1842016c85cca2db66fa502b8179cf0fe",
         "type": "github"
       },
       "original": {
@@ -1069,11 +1069,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759490926,
+        "lastModified": 1756117388,
-        "narHash": "sha256-7IbZGJ5qAAfZsGhBHIsP8MBsfuFYS0hsxYHVkkeDG5Q=",
+        "narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "94cce794344538c4d865e38682684ec2bbdb2ef3",
+        "rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
         "type": "github"
       },
       "original": {
@@ -1191,11 +1191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759387127,
+        "lastModified": 1759217228,
-        "narHash": "sha256-uuwJAP92SkHmnI1zo7rrK/gEuHtb97vFZcMa5w+0SZA=",
+        "narHash": "sha256-P13ExJlhMVkrc5LxZLNkIJZhjNYo3LLXnxDsUNrdnMQ=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "0cc290e05882745060fccfe6d7d073f913e0cce7",
+        "rev": "e52c15ab25f7dc68dde527c8df5bfa9d80d8e64f",
         "type": "github"
       },
       "original": {
@@ -1411,11 +1411,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1759381078,
+        "lastModified": 1758198701,
-        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+        "narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+        "rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d",
         "type": "github"
       },
       "original": {
@@ -1648,11 +1648,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759458749,
+        "lastModified": 1759286284,
-        "narHash": "sha256-WKnbJnm1B2+TO2ZUudgS39EzecQeLl4/bnRtd3y46LI=",
+        "narHash": "sha256-JLdGGc4XDutzSD1L65Ni6Ye+oTm8kWfm0KTPMcyl7Y4=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "bbc3a8ae797d1700e57a4f4bcc4e79af727d4138",
+        "rev": "f6f2da475176bb7cff51faae8b3fe879cd393545",
         "type": "github"
       },
       "original": {
@@ -1923,11 +1923,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759590499,
+        "lastModified": 1759180079,
-        "narHash": "sha256-EBToRzqe5WMz4DQyxOp9/CP+rWjdaZ2EUwbItfNf3VI=",
+        "narHash": "sha256-5hqTGqAKcLEumY3tqOtHK17CA6RkzS1I0EGKfuoyb58=",
         "ref": "refs/heads/main",
-        "rev": "6e606c8bfa6a88209488790388b1005bc489fa66",
+        "rev": "d4a254b38c7ac2b99931220d767610adfa3a57fe",
-        "revCount": 136,
+        "revCount": 135,
         "type": "git",
         "url": "https://git.sr.ht/~canasta/zen-browser-flake"
       },

hosts/sobotka/modules.nix

@@ -214,7 +214,7 @@
         flags = "--performance";
       };
       tailscale = {
-        enable = true;
+        enable = false;
       };
       udisks = {
         enable = true;

hosts/sobotka/server.nix

@@ -8,7 +8,7 @@
     uid = 994;
     gid = 993;
 
-    traefik = {
+    nginx = {
       enable = true;
     };
     gitea = {
@@ -42,7 +42,11 @@
       enable = true;
     };
     jellyfin = {
-      enable = true;
+      enable = false;
+      cloudflared = {
+        tunnelId = "234811e2-bc86-44b2-9abd-493686e25704";
+        credentialsFile = config.age.secrets.jellyfinCloudflared.path;
+      };
     };
     uptime-kuma = {
       enable = true;
@@ -56,7 +60,7 @@
       };
     };
     www = {
-      enable = true;
+      enable = false;
       url = "cnst.dev";
       cloudflared = {
         tunnelId = "e5076186-efb7-405a-998c-6155af7fb221";
@@ -88,14 +92,14 @@
       enable = true;
       gluetun.enable = true;
       qbittorrent = {
-        enable = true;
+        enable = false;
-        port = 8080;
+        port = 8387;
       };
       slskd = {
         enable = true;
       };
       pihole = {
-        enable = true;
+        enable = false;
         port = 8053;
       };
     };

modules/default.nix

@@ -141,7 +141,7 @@
         ./server/keepalived
         ./server/gitea
         ./server/postgres
-        ./server/traefik
+        ./server/nginx
         ./server/www
         ./server/authentik
       ];

modules/nixos/programs/pkgs/default.nix

@@ -3,17 +3,16 @@
   config,
   lib,
   ...
-}:
+}: let
-let
+  inherit
-  inherit (lib)
+    (lib)
     mkIf
     mkOption
     mkMerge
     types
     ;
   cfg = config.nixos.programs.pkgs;
-in
+in {
-{
   options = {
     nixos.programs.pkgs = {
       enable = mkOption {
@@ -51,8 +50,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages =
+    environment.systemPackages = with pkgs;
-      with pkgs;
       mkMerge [
         [
           pciutils
@@ -114,6 +112,8 @@ in
           helix
           zfs
           zfstools
+          cron
+          acme-sh
         ])
 
         (mkIf cfg.dev.enable [

modules/nixos/services/agenix/default.nix

@@ -70,7 +70,7 @@ in {
         secrets = {
           cloudflareFirewallApiKey.file = "${self}/secrets/cloudflareFirewallApiKey.age";
           cloudflareDnsApiToken.file = "${self}/secrets/cloudflareDnsApiToken.age";
-          cloudflareDnsCredentials.file = "${self}/secrets/cloudflareDnsCredentials.age";
+          # cloudflareDnsCredentials.file = "${self}/secrets/cloudflareDnsCredentials.age";
           wgCredentials.file = "${self}/secrets/wgCredentials.age";
           wgSobotkaPrivateKey.file = "${self}/secrets/wgSobotkaPrivateKey.age";
           gluetunEnvironment.file = "${self}/secrets/gluetunEnvironment.age";

modules/server/authentik/default.nix

@@ -53,11 +53,9 @@ in {
     age.secrets = {
       authentikEnv = {
         file = "${self}/secrets/authentikEnv.age";
-        owner = "authentik";
       };
       authentikCloudflared = {
         file = "${self}/secrets/authentikCloudflared.age";
-        owner = "authentik";
       };
     };
 
@@ -65,8 +63,8 @@ in {
       fail2ban = lib.mkIf cfg.enable {
         jails = {
           authentik = {
-            serviceName = "${cfg.url}";
+            serviceName = "authentik";
-            failRegex = "^.*Username or password is incorrect. Try again. IP: <HOST>. Username: <F-USER>.*</F-USER>.$";
+            failRegex = "^.*Username or password is incorrect.*IP:\s*<HOST>";
           };
         };
       };
@@ -99,22 +97,16 @@ in {
             middlewares = {
               authentik = {
                 forwardAuth = {
-                  tls.insecureSkipVerify = true;
+                  # tls.insecureSkipVerify = true;
                   address = "https://localhost:9443/outpost.goauthentik.io/auth/traefik";
                   trustForwardHeader = true;
                   authResponseHeaders = [
                     "X-authentik-username"
                     "X-authentik-groups"
                     "X-authentik-email"
-                    "X-authentik-name"
-                    "X-authentik-uid"
                     "X-authentik-jwt"
-                    "X-authentik-meta-jwks"
-                    "X-authentik-meta-outpost"
-                    "X-authentik-meta-provider"
-                    "X-authentik-meta-app"
-                    "X-authentik-meta-version"
                   ];
+                  timeout = "10s";
                 };
               };
             };

modules/server/default.nix

@@ -17,14 +17,14 @@ in {
       default = "";
       type = types.str;
       description = ''
-        Email name to be used to access the server services via Caddy reverse proxy
+        Email name to be used to access the server services via NGINX reverse proxy
       '';
     };
     domain = mkOption {
       default = "";
       type = types.str;
       description = ''
-        Domain name to be used to access the server services via Caddy reverse proxy
+        Domain name to be used to access the server services via NGINX reverse proxy
       '';
     };
     user = lib.mkOption {
@@ -65,6 +65,11 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    _module.args = {
+      myLib = import ./lib.nix {
+        inherit lib config pkgs;
+      };
+    };
     users = {
       groups.${cfg.group} = {
         gid = cfg.gid;
@@ -93,7 +98,7 @@ in {
           "render"
           "input"
           "authentik"
-          "traefik"
+          "nginx"
         ];
       };
     };

modules/server/fail2ban/default.nix

@@ -4,11 +4,9 @@
   config,
   pkgs,
   ...
-}:
+}: let
-let
   cfg = config.server.fail2ban;
-in
+in {
-{
   options.server.fail2ban = {
     enable = lib.mkEnableOption {
       description = "Enable cloudflare fail2ban";
@@ -17,7 +15,7 @@ in
       description = "File containing your API key, scoped to Firewall Rules: Edit";
       type = lib.types.str;
       example = lib.literalExpression ''
-        Authorization: Bearer Qj06My1wXJEzcW46QCyjFbSMgVtwIGfX63Ki3NOj79o=
+        Authorization: Bearer vH6-p0y=i4w3n7TjKqZ@x8D_lR!A9b2cOezXgUuJdE5F
         '''
       '';
     };
@@ -57,54 +55,54 @@ in
         pkgs.jq
       ];
 
-      jails = lib.attrsets.mapAttrs (name: value: {
+      jails =
-        settings = {
+        lib.attrsets.mapAttrs (name: value: {
-          bantime = "30d";
+          settings = {
-          findtime = "1h";
+            bantime = "168h";
-          enabled = true;
+            findtime = "30m";
-          backend = "systemd";
+            enabled = true;
-          journalmatch = "_SYSTEMD_UNIT=${value.serviceName}.service";
+            backend = "systemd";
-          port = "http,https";
+            journalmatch = "_SYSTEMD_UNIT=${value.serviceName}.service";
-          filter = "${name}";
+            port = "http,https";
-          maxretry = 3;
+            filter = "${name}";
-          action = "cloudflare-token-agenix";
+            maxretry = value.maxRetry or 5;
-        };
+            action = "cloudflare-token-agenix";
-      }) cfg.jails;
+          };
+        })
+        cfg.jails;
     };
 
     environment.etc = lib.attrsets.mergeAttrsList [
       (lib.attrsets.mapAttrs' (
-        name: value:
+          name: value: (lib.nameValuePair "fail2ban/filter.d/${name}.conf" {
-        (lib.nameValuePair "fail2ban/filter.d/${name}.conf" {
+            text = ''
-          text = ''
+              [Definition]
-            [Definition]
+              failregex = ${value.failRegex}
-            failregex = ${value.failRegex}
+              ignoreregex = ${value.ignoreRegex}
-            ignoreregex = ${value.ignoreRegex}
+            '';
-          '';
+          })
-        })
+        )
-      ) cfg.jails)
+        cfg.jails)
       {
-        "fail2ban/action.d/cloudflare-token-agenix.conf".text =
+        "fail2ban/action.d/cloudflare-token-agenix.conf".text = let
-          let
+          notes = "Fail2Ban on ${config.networking.hostName}";
-            notes = "Fail2Ban on ${config.networking.hostName}";
+          cfapi = "https://api.cloudflare.com/client/v4/zones/${cfg.zoneId}/firewall/access_rules/rules";
-            cfapi = "https://api.cloudflare.com/client/v4/zones/${cfg.zoneId}/firewall/access_rules/rules";
+        in ''
-          in
+          [Definition]
-          ''
+          actionstart =
-            [Definition]
+          actionstop =
-            actionstart =
+          actioncheck =
-            actionstop =
+          actionunban = id=$(curl -s -X GET "${cfapi}" \
-            actioncheck =
+              -H @${cfg.apiKeyFile} -H "Content-Type: application/json" \
-            actionunban = id=$(curl -s -X GET "${cfapi}" \
+                  | jq -r '.result[] | select(.notes == "${notes}" and .configuration.target == "ip" and .configuration.value == "<ip>") | .id')
-                -H @${cfg.apiKeyFile} -H "Content-Type: application/json" \
+              if [ -z "$id" ]; then echo "id for <ip> cannot be found"; exit 0; fi; \
-                    | jq -r '.result[] | select(.notes == "${notes}" and .configuration.target == "ip" and .configuration.value == "<ip>") | .id')
+              curl -s -X DELETE "${cfapi}/$id" \
-                if [ -z "$id" ]; then echo "id for <ip> cannot be found"; exit 0; fi; \
+                  -H @${cfg.apiKeyFile} -H "Content-Type: application/json" \
-                curl -s -X DELETE "${cfapi}/$id" \
+                  --data '{"cascade": "none"}'
-                    -H @${cfg.apiKeyFile} -H "Content-Type: application/json" \
+          actionban = curl -X POST "${cfapi}" -H @${cfg.apiKeyFile} -H "Content-Type: application/json" --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"${notes}"}'
-                    --data '{"cascade": "none"}'
+          [Init]
-            actionban = curl -X POST "${cfapi}" -H @${cfg.apiKeyFile} -H "Content-Type: application/json" --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"${notes}"}'
+          name = cloudflare-token-agenix
-            [Init]
+        '';
-            name = cloudflare-token-agenix
-          '';
       }
     ];
   };

modules/server/gitea/default.nix

@@ -99,23 +99,6 @@ in {
       };
     };
 
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.gitea.loadBalancer.servers = [{url = "http://127.0.0.1:5003";}];
-          routers = {
-            gitea = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "gitea";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-
     server.postgresql.databases = [
       {
         database = "gitea";

modules/server/homepage-dashboard/default.nix

@@ -212,25 +212,6 @@ in {
             }
           ];
       };
-
-      traefik = {
-        dynamicConfigOptions = {
-          http = {
-            services.homepage.loadBalancer.servers = [
-              {url = "http://127.0.0.1:${toString config.services.${unit}.listenPort}";}
-            ];
-            routers = {
-              homepage = {
-                entryPoints = ["websecure"];
-                rule = "Host(`cnix.dev`)";
-                service = "homepage";
-                tls.certResolver = "letsencrypt";
-                # middlewares = ["authentik"];
-              };
-            };
-          };
-        };
-      };
     };
   };
 }

modules/server/jellyfin/default.nix

@@ -2,23 +2,38 @@
   config,
   lib,
   pkgs,
+  self,
   ...
 }: let
-  service = "jellyfin";
+  unit = "jellyfin";
-  cfg = config.server.${service};
+  cfg = config.server.${unit};
   srv = config.server;
 in {
-  options.server.${service} = {
+  options.server.${unit} = {
     enable = lib.mkEnableOption {
-      description = "Enable ${service}";
+      description = "Enable ${unit}";
     };
     configDir = lib.mkOption {
       type = lib.types.str;
-      default = "/var/lib/${service}";
+      default = "/var/lib/${unit}";
     };
     url = lib.mkOption {
       type = lib.types.str;
-      default = "jellyfin.${srv.domain}";
+      default = "jellyfin.${srv.www.url}";
+    };
+    cloudflared = {
+      credentialsFile = lib.mkOption {
+        type = lib.types.str;
+        example = lib.literalExpression ''
+          pkgs.writeText "cloudflare-credentials.json" '''
+          {"AccountTag":"secret"."TunnelSecret":"secret","TunnelID":"secret"}
+          '''
+        '';
+      };
+      tunnelId = lib.mkOption {
+        type = lib.types.str;
+        example = "00000000-0000-0000-0000-000000000000";
+      };
     };
     homepage.name = lib.mkOption {
       type = lib.types.str;
@@ -38,17 +53,62 @@ in {
     };
   };
   config = lib.mkIf cfg.enable {
-    services.${service} = {
+    age.secrets = {
-      enable = true;
+      jellyfinCloudflared = {
-      user = srv.user;
+        file = "${self}/secrets/jellyfinCloudflared.age";
-      group = srv.group;
+        owner = "${srv.user}";
+        group = "${srv.group}";
+        mode = "0400";
+      };
     };
+
+    services = {
+      cloudflared = {
+        enable = true;
+        tunnels.${cfg.cloudflared.tunnelId} = {
+          credentialsFile = cfg.cloudflared.credentialsFile;
+          default = "http_status:404";
+          ingress."${cfg.url}".service = "http://127.0.0.1:8096";
+        };
+      };
+
+      ${unit} = {
+        enable = true;
+        user = srv.user;
+        group = srv.group;
+      };
+    };
+
     environment.systemPackages = with pkgs; [
       jellyfin-ffmpeg
     ];
     services.traefik = {
       dynamicConfigOptions = {
         http = {
+          middlewares = {
+            secureHeaders = {
+              headers = {
+                stsSeconds = 31536000;
+                forceSTSHeader = true;
+                stsIncludeSubdomains = true;
+                stsPreload = true;
+                browserXssFilter = true;
+                frameDeny = true;
+                referrerPolicy = "no-referrer";
+                contentTypeNosniff = true;
+                customResponseHeaders = {
+                  "Content-Security-Policy" = "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';";
+                };
+              };
+            };
+            ratelimit = {
+              rateLimit = {
+                average = 10;
+                burst = 20;
+              };
+            };
+          };
+
           services.jellyfin.loadBalancer.servers = [{url = "http://127.0.0.1:8096";}];
           routers = {
             jellyfin = {
@@ -56,7 +116,7 @@ in {
               rule = "Host(`${cfg.url}`)";
               service = "jellyfin";
               tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
+              middlewares = ["authentik" "secureHeaders" "ratelimit"];
             };
           };
         };

modules/server/lib.nix

@@ -0,0 +1,148 @@
+# from @jtojnar
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  mkVirtualHost = {
+    path ? null,
+    config ? "",
+    acme ? null,
+    redirect ? null,
+    ...
+  } @ args:
+    (
+      if lib.isString acme
+      then {
+        useACMEHost = acme;
+        forceSSL = true;
+      }
+      else {}
+    )
+    // (
+      if lib.isBool acme
+      then {
+        enableACME = acme;
+        forceSSL = true;
+      }
+      else {}
+    )
+    // (
+      if redirect != null
+      then {
+        globalRedirect = redirect;
+      }
+      else {}
+    )
+    // (
+      if path != null
+      then {
+        root = "/var/www/" + path;
+      }
+      else {}
+    )
+    // {
+      extraConfig = config;
+    }
+    // builtins.removeAttrs args [
+      "path"
+      "config"
+      "acme"
+      "redirect"
+    ];
+  mkPhpPool = {
+    user,
+    debug ? false,
+    settings ? {},
+    ...
+  } @ args:
+    {
+      inherit user;
+      settings =
+        {
+          "listen.owner" = "nginx";
+          "listen.group" = "root";
+          "pm" = "dynamic";
+          "pm.max_children" = 5;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 1;
+          "pm.max_spare_servers" = 3;
+        }
+        // (
+          lib.optionalAttrs debug {
+            # log worker's stdout, but this has a performance hit
+            "catch_workers_output" = true;
+          }
+          // settings
+        );
+    }
+    // builtins.removeAttrs args [
+      "user"
+      "debug"
+      "settings"
+    ];
+  enablePHP = sockName: ''
+    fastcgi_pass unix:${config.services.phpfpm.pools.${sockName}.socket};
+    include ${config.services.nginx.package}/conf/fastcgi.conf;
+    fastcgi_param PATH_INFO $fastcgi_path_info;
+    fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
+  '';
+
+  /*
+  Adds extra options to ssh key that will only allow it to be used for rsync.
+  See sshd(8) manual page for details.
+  */
+  restrictToRsync = directory: key: ''command="${pkgs.rrsync}/bin/rrsync -wo ${directory}",restrict ${key}'';
+
+  /*
+  Emulate systemd credentials.
+  Those will only be available to the user the service is running under,
+  not being aware of dropped euid.
+  http://systemd.io/CREDENTIALS/
+  */
+  emulateCredentials = let
+    parseCredential = credential: let
+      matches = builtins.match "(.+):(.+)" credential;
+    in
+      assert lib.assertMsg (matches != null) "A credential needs to match “id:value” format"; {
+        id = builtins.elemAt matches 0;
+        value = builtins.elemAt matches 1;
+      };
+
+    parseCredentials = credentials:
+      builtins.map parseCredential (
+        if builtins.isList credentials
+        then credentials
+        else lib.splitString "," credentials
+      );
+  in
+    serviceConfig:
+      lib.mkMerge [
+        (builtins.removeAttrs serviceConfig [
+          "SetCredential"
+          "LoadCredential"
+        ])
+        {
+          Environment = [
+            "CREDENTIALS_DIRECTORY=${
+              pkgs.runCommand "credentials" {} ''
+                mkdir "$out"
+                ${lib.concatMapStringsSep "\n" ({
+                  id,
+                  value,
+                }: ''ln -s "${value}" "$out/${id}"'') (
+                  parseCredentials serviceConfig.LoadCredential or []
+                )}
+                ${lib.concatMapStringsSep "\n" ({
+                  id,
+                  value,
+                }: ''echo -n "${value}" > "$out/${id}"'') (
+                  parseCredentials serviceConfig.SetCredential or []
+                )}
+              ''
+            }"
+          ];
+        }
+      ];
+}

modules/server/nginx/default.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  config,
+  pkgs,
+  self,
+  myLib,
+  ...
+}: let
+  inherit (myLib) mkVirtualHost;
+  inherit (lib) mkEnableOption mkIf types;
+
+  unit = "nginx";
+  cfg = config.server.nginx;
+  srv = config.server;
+in {
+  options.server.nginx = {
+    enable = mkEnableOption "Enable global NGINX reverse proxy with ACME";
+  };
+
+  config = mkIf cfg.enable {
+    age.secrets = {
+      nginxEnv = {
+        file = "${self}/secrets/nginxEnv.age";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [80 443];
+
+    security = {
+      acme = {
+        acceptTerms = true;
+        defaults.email = config.server.email;
+        certs.${srv.domain} = {
+          reloadServices = ["nginx.service"];
+          domain = "${srv.domain}";
+          extraDomainNames = ["*.${srv.domain}"];
+          dnsProvider = "cloudflare";
+          dnsPropagationCheck = true;
+          group = config.services.nginx.group;
+          environmentFile = config.age.secrets.nginxEnv.path;
+        };
+      };
+      dhparams = {
+        enable = true;
+        params.nginx = {};
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      resolver.addresses = config.networking.nameservers;
+      sslDhparam = config.security.dhparams.params.nginx.path;
+      appendHttpConfig = ''
+        proxy_headers_hash_max_size 512;
+        proxy_headers_hash_bucket_size 128;
+      '';
+
+      virtualHosts = let
+        labDomain = "cnix.dev";
+        labCert = {
+          useACMEHost = "cnix.dev";
+          forceSSL = true;
+        };
+      in {
+        # proxies on domain with https, only accessible within local network
+        "${labDomain}" =
+          labCert
+          // {
+            locations."/".proxyPass = "http://127.0.0.1:${toString config.services.homepage-dashboard.listenPort}";
+          };
+      };
+    };
+    users.users.nginx.extraGroups = ["acme"];
+  };
+}

modules/server/podman/default.nix

@@ -34,7 +34,7 @@ in {
       };
       port = lib.mkOption {
         type = lib.types.int;
-        default = 8080;
+        default = 8387;
         description = "The port to host qBittorrent on.";
       };
       homepage.name = lib.mkOption {
@@ -143,62 +143,6 @@ in {
       ];
     };
 
-    services.traefik = lib.mkMerge [
-      (lib.mkIf cfg.pihole.enable {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              pihole.loadBalancer.servers = [{url = "http://localhost:${toString cfg.pihole.port}";}];
-            };
-            routers = {
-              pihole = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.pihole.url}`)";
-                service = "pihole";
-                tls.certResolver = "letsencrypt";
-              };
-            };
-          };
-        };
-      })
-
-      (lib.mkIf cfg.qbittorrent.enable {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              qbittorrent.loadBalancer.servers = [{url = "http://localhost:${toString cfg.qbittorrent.port}";}];
-            };
-            routers = {
-              qbittorrent = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.qbittorrent.url}`)";
-                service = "qbittorrent";
-                tls.certResolver = "letsencrypt";
-              };
-            };
-          };
-        };
-      })
-
-      (lib.mkIf cfg.slskd.enable {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              slskd.loadBalancer.servers = [{url = "http://localhost:${toString cfg.slskd.port}";}];
-            };
-            routers = {
-              slskd = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.slskd.url}`)";
-                service = "slskd";
-                tls.certResolver = "letsencrypt";
-              };
-            };
-          };
-        };
-      })
-    ];
-
     virtualisation.oci-containers.containers = lib.mkMerge [
       (lib.mkIf cfg.gluetun.enable {
         gluetun = {
@@ -206,7 +150,7 @@ in {
           ports = [
             "8388:8388"
             "58846:58846"
-            "8080:8080"
+            "8387:8387"
             "5030:5030"
             "5031:5031"
             "50300:50300"
@@ -235,7 +179,7 @@ in {
           autoStart = true;
           dependsOn = ["gluetun"];
           ports = [
-            "8080:8080"
+            "8387:8387"
             "58846:58846"
           ];
           extraOptions = [

modules/server/sonarr/default.nix

@@ -43,15 +43,16 @@ in {
       group = srv.group;
     };
     services.traefik = {
+      # staticConfigOptions.entryPoints.${unit}.address = "127.0.0.1:8989";
       dynamicConfigOptions = {
         http = {
-          services.sonarr.loadBalancer.servers = [{url = "http://127.0.0.1:8989";}];
+          # services.sonarr.loadBalancer.servers = [{url = "http://127.0.0.1:8989";}];
           routers = {
             sonarr = {
               entryPoints = ["websecure"];
               rule = "Host(`${cfg.url}`)";
               service = "sonarr";
-              tls.certResolver = "letsencrypt";
+              # tls.certResolver = "letsencrypt";
               # middlewares = ["authentik"];
             };
           };

modules/server/traefik/default.nix

@@ -1,100 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}: let
-  inherit (lib) mkEnableOption mkIf types;
-
-  cfg = config.server.traefik;
-  getCloudflareCredentials = hostname:
-    if hostname == "ziggy"
-    then config.age.secrets.cloudflareDnsCredentialsZiggy.path
-    else if hostname == "sobotka"
-    then config.age.secrets.cloudflareDnsCredentials.path
-    else throw "Unknown hostname: ${hostname}";
-in {
-  options.server.traefik = {
-    enable = mkEnableOption "Enable global Traefik reverse proxy with ACME";
-  };
-
-  config = mkIf cfg.enable {
-    age.secrets.traefikEnv = {
-      file = "${self}/secrets/traefikEnv.age";
-      mode = "640";
-      owner = "root";
-      group = "traefik";
-    };
-
-    systemd.services.traefik = {
-      serviceConfig = {
-        EnvironmentFile = [config.age.secrets.traefikEnv.path];
-      };
-    };
-    networking.firewall.allowedTCPPorts = [80 443];
-
-    services = {
-      tailscale.permitCertUid = "traefik";
-      traefik = {
-        enable = true;
-
-        staticConfigOptions = {
-          log = {
-            level = "DEBUG";
-          };
-
-          tracing = {};
-          api = {
-            dashboard = true;
-          };
-          certificatesResolvers = {
-            tailscale.tailscale = {};
-            letsencrypt = {
-              acme = {
-                email = "adam@cnst.dev";
-                storage = "/var/lib/traefik/cert.json";
-                dnsChallenge = {
-                  provider = "cloudflare";
-                  resolvers = [
-                    "1.1.1.1:53"
-                    "1.0.0.1:53"
-                  ];
-                };
-              };
-            };
-          };
-
-          entryPoints = {
-            redis = {
-              address = "0.0.0.0:6381";
-            };
-            postgres = {
-              address = "0.0.0.0:5433";
-            };
-            web = {
-              address = "0.0.0.0:80";
-              http.redirections.entryPoint = {
-                to = "websecure";
-                scheme = "https";
-                permanent = true;
-              };
-            };
-            websecure = {
-              address = "0.0.0.0:443";
-              http.tls = {
-                certResolver = "letsencrypt";
-                domains = [
-                  {
-                    main = "cnix.dev";
-                    sans = ["*.cnix.dev"];
-                  }
-                ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

modules/server/www/default.nix

@@ -44,9 +44,11 @@ in {
     server = {
       fail2ban = lib.mkIf config.server.www.enable {
         jails = {
-          www = {
+          nginx-404 = {
-            serviceName = "cnst.dev";
+            serviceName = "nginx";
-            failRegex = "^.*Username or password is incorrect. Try again. IP: <HOST>. Username: <F-USER>.*</F-USER>.$";
+            failRegex = ''^.*\[error\].*directory index of.* is forbidden.*client: <HOST>.*$'';
+            ignoreRegex = "";
+            maxRetry = 5;
           };
         };
       };
@@ -64,14 +66,23 @@ in {
         virtualHosts."webfinger" = {
           forceSSL = false;
           serverName = cfg.url;
-          root = "/etc/webfinger";
+          root = "/var/www/webfinger";
+
           locations."= /.well-known/webfinger" = {
-            root = "/etc/webfinger";
+            root = "/var/www/webfinger";
             extraConfig = ''
               default_type application/jrd+json;
               try_files /.well-known/webfinger =404;
             '';
           };
+
+          locations."= /robots.txt" = {
+            root = "/var/www/webfinger";
+            extraConfig = ''
+              default_type text/plain;
+              try_files /robots.txt =404;
+            '';
+          };
         };
       };
 
@@ -85,29 +96,23 @@ in {
       };
     };
 
-    environment.etc."webfinger/.well-known/webfinger".text = ''
+    environment.etc = {
-      {
+      "webfinger/.well-known/webfinger".text = ''
-        "subject": "acct:adam@${cfg.url}",
+        {
-        "links": [
+          "subject": "acct:adam@${cfg.url}",
-          {
+          "links": [
-            "rel": "http://openid.net/specs/connect/1.0/issuer",
+            {
-            "href": "https://auth.${cfg.url}/application/o/tailscale/"
+              "rel": "http://openid.net/specs/connect/1.0/issuer",
-          }
+              "href": "https://auth.${cfg.url}/application/o/tailscale/"
-        ]
+            }
-      }
+          ]
-    '';
+        }
+      '';
 
-    services.traefik.dynamicConfigOptions.http = {
+      "webfinger/robots.txt".text = ''
-      routers.webfinger = {
+        User-agent: *
-        entryPoints = ["websecure"];
+        Disallow: /
-        rule = "Host(`${cfg.url}`) && Path(`/.well-known/webfinger`)";
+      '';
-        service = "webfinger";
-        tls.certResolver = "letsencrypt";
-      };
-
-      services.webfinger.loadBalancer.servers = [
-        {url = "http://127.0.0.1:8283";}
-      ];
     };
   };
 }

secrets/jellyfinCloudflared.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 t9iOEg dULaZVrpkeN1HqwM+HSU46XJjQznBOxa+wUDSSciK1w
+FxqlulfViojLLoskKu56Utiq57rkDC6TocoaFQOgahc
+-> ssh-ed25519 KUYMFA QYnb24Av6Vy17Lb5gC6dzQszOxa5bRP2PgFetmqhfCA
+MaIes8V0NkyTAzFzbRuCMzMLwhYljYHwhXPKEZEdlC4
+-> ssh-ed25519 76RhUQ NLoyNp/z5MXE3Hrmv7CCDYB1X8R1OORm2MZVMbgNDQs
+6U8r3wpXNtQdkIH+lo7cDrnjPw9B6eF/jMeb+iW9T1I
+-> ssh-ed25519 Jf8sqw GOWsvhSzrHJGJFOgsXr+O1jq7jnjyzKc82Mu7ntrI2Q
+P3n32btGFtUxB28/a0iz6lBTM6UP3EYUrq0y8BR49IM
+--- geE2uS2TMspihaNwgzH4FQKYoUFFRhjTS6V7F/cdTE0
+%<25>^<5E>E3򿈾<33><F2BF88BE><EFBFBD>gg<67><67>ٸk<D9B8><6B>;<3B>lE+b<>x<EFBFBD>Ҝ-<2D>X<>Et'&^<5E>=c<><63>9<EFBFBD>v*<2A>

secrets/nginxEnv.age

@@ -1,11 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 t9iOEg pfPhWigjvnJ5tfVv8qPpk3VYvLH9I01HVVbpu+r2NjY
+-> ssh-ed25519 t9iOEg SCmn/7gQOD3fRn0PKPXxNBDKNSqUcnejG8tPwjoNT1I
-Kaj8aZv+9pSYjwoE7EHWGHfsZIPFZOgUVaKf8VxWKcQ
+vd57xXCQ16PPPMlNysw6BWSIP/EgB3HrWlesBiQUVA0
--> ssh-ed25519 KUYMFA 9Xy82Cl3HUQcFDcJMxxnnIfLOngW8xLfVE0S1wRliGg
+-> ssh-ed25519 KUYMFA WVn1OhFDxMMEHFa1yHpBmWskbcRgHyBiDWZjPv8NfX8
-mOOcyJp5+ZqFwdkZkHC63+cMA0ToGcuI6kqMjAJ9jJk
+8BCp/iUFkRsAGnc+0MEfpRXo1/Xla4WO3qYZMSl7LGw
--> ssh-ed25519 76RhUQ +OvUSQwpy6+xxlom8bJFn8CBdSKECa9YY0U+YYNYdGM
+-> ssh-ed25519 76RhUQ ZfdS1EWtBOwd7+hVnJ/JqxUCDTYmfEs1OwyzXajFMmg
-MWfmfGzd6/lOPvggUG8uJgBAp1CTqSdk+NDkk7vSQEQ
+eE0ahMgW76RFu9y9Z+PE6IzaLX3ydhhJvjk5vu2EgXo
--> ssh-ed25519 Jf8sqw jQR/wT/+f63cJdFzR/Ogw6pdiYXoyVNu1+UCni2BYSM
+-> ssh-ed25519 Jf8sqw Pr/LkT5RQysShzjqEZlXFRHim3WpAav04c/GGftDTiA
-Iicwg/XJJskvWFmAbxFDh3gSJyjid5fw9JXmDJPhzkU
+TWWRURLPnkpsxxSdSQem9sAoUoLt5wQe0CYl1xl1RaA
---- xK8vBWioTgSDPHkKh7SJxstCzYtUSmTz6QuN/+niFME
+--- cfGjcdOvwxLDlANhDe44U5JXGAyRYPZMVtC48PuhLNo
-<08><>f<<3C>`VR<56><52>p<><70>)>|<7C>+aئI<D8A6>g<08><0B><><EFBFBD><EFBFBD><EFBFBD><19><>x<EFBFBD><78>HH+<2B>緭<EFBFBD><E7B7AD>o>$4H<><48><EFBFBD>缂<EFBFBD>B?<3F>l6TSqμ<71>Ǿ<EFBFBD><C7BE>Kj-l
+<EFBFBD>Zyr<>#*K<><4B><EFBFBD><EFBFBD><0B><1F>
+$<24><>FB<46>$<24>^<5E>BT<42><54>#D<>v<EFBFBD><76>3<EFBFBD><13><f<>dG$<24><><EFBFBD><~<7E><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m<EFBFBD><6D>8^<1A><><EFBFBD>\#	Z<>-8<><38><EFBFBD>D<EFBFBD>dM<64><4D>

secrets/secrets.nix

@@ -58,9 +58,10 @@ in {
   "sobotkaPihole.age".publicKeys = kima ++ sobotka;
   "slskd.age".publicKeys = kima ++ sobotka;
   "authentikEnv.age".publicKeys = kima ++ sobotka;
-  "traefikEnv.age".publicKeys = kima ++ sobotka;
+  "nginxEnv.age".publicKeys = kima ++ sobotka;
   "wwwCloudflared.age".publicKeys = kima ++ sobotka;
   "authentikCloudflared.age".publicKeys = kima ++ sobotka;
+  "jellyfinCloudflared.age".publicKeys = kima ++ sobotka;
 
   # Ziggy-specific
   "cloudflareDnsCredentialsZiggy.age".publicKeys = kima ++ ziggy;