Compare commits
1 Commits
3deca06206
...
compare_br
| Author | SHA1 | Date | |
|---|---|---|---|
| d53bf7546a |
148
flake.lock
generated
148
flake.lock
generated
@@ -29,11 +29,11 @@
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760083914,
|
||||
"narHash": "sha256-I9IMO9d+z71oeqOz6gOre07tK2Du3vp2FcOW3x4FDXw=",
|
||||
"lastModified": 1758874004,
|
||||
"narHash": "sha256-+RUCBtT01Z595NpGc6Tvms+dJ/C/cn1zdjT9+gE6dbU=",
|
||||
"owner": "anyrun-org",
|
||||
"repo": "anyrun",
|
||||
"rev": "3050aa30e25957bbb9e1ac91a44d3979eccadf59",
|
||||
"rev": "3c571bc1514c4211d1d6c011a1d482f97efd9c5f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -153,11 +153,11 @@
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760148209,
|
||||
"narHash": "sha256-ssMUeLk1cmLqzNMW6l9dgGoLtOY9F9dEGplJlWJmNis=",
|
||||
"lastModified": 1759532138,
|
||||
"narHash": "sha256-sLQIlgDwMP3mEY2PwjGW+cL56QQ2n2WXoZ3GpG5QWOY=",
|
||||
"owner": "chaotic-cx",
|
||||
"repo": "nyx",
|
||||
"rev": "b51bb724939dbfa264f08522efffce2bb47b6135",
|
||||
"rev": "bad02bbca5b5c6d45539a0d740ad0e21b1ba9afc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -212,11 +212,11 @@
|
||||
"rust-analyzer-src": "rust-analyzer-src"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760164678,
|
||||
"narHash": "sha256-yxcfwZCysR6zPaFv7is3/FWd1h0h6kXME0vueSwTBhU=",
|
||||
"lastModified": 1759646430,
|
||||
"narHash": "sha256-V8mjmGzi9nS7BZfhpzYAOUg3BcCsC6MrEh9xlKq3+7s=",
|
||||
"owner": "nix-community",
|
||||
"repo": "fenix",
|
||||
"rev": "2579f163559b902959cc420a6d3bfbd98c46a323",
|
||||
"rev": "b326bea4d58c9a58b346f17c710538eac00f71d1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -571,11 +571,11 @@
|
||||
},
|
||||
"hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1760106635,
|
||||
"narHash": "sha256-2GoxVaKWTHBxRoeUYSjv0AfSOx4qw5CWSFz2b+VolKU=",
|
||||
"lastModified": 1759582739,
|
||||
"narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "9ed85f8afebf2b7478f25db0a98d0e782c0ed903",
|
||||
"rev": "3441b5242af7577230a78ffb03542add264179ab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -590,11 +590,11 @@
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1759850138,
|
||||
"narHash": "sha256-fYHIxjTvVIAEDWzenUROuzDPxy1rBCXZNPgh4b1dfgo=",
|
||||
"lastModified": 1759605748,
|
||||
"narHash": "sha256-qALSaIE4fbTo0wbPjEp7RZKbtFk1cDhRZ0BYOHW0JwQ=",
|
||||
"owner": "helix-editor",
|
||||
"repo": "helix",
|
||||
"rev": "5b0563419eeeaf0595c848865c46be4abad246a7",
|
||||
"rev": "6fffaf6a7ded9a12fb2d5715a4eb83787a5e6402",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -610,11 +610,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760130406,
|
||||
"narHash": "sha256-GKMwBaFRw/C1p1VtjDz4DyhyzjKUWyi1K50bh8lgA2E=",
|
||||
"lastModified": 1759573136,
|
||||
"narHash": "sha256-ILSPD0Dm8p0w0fCVzOx98ZH8yFDrR75GmwmH3fS2VnE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "d305eece827a3fe317a2d70138f53feccaf890a1",
|
||||
"rev": "5f06ceafc6c9b773a776b9195c3f47bbe1defa43",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -652,11 +652,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760061988,
|
||||
"narHash": "sha256-CeuMo7fjWm3XaoK+b1PGyaVIlE1GHudoxk9jrJFvfbY=",
|
||||
"lastModified": 1759337100,
|
||||
"narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c7f4214faca2f196c551b767c12a70bfa0614510",
|
||||
"rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -739,11 +739,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1759490292,
|
||||
"narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
|
||||
"lastModified": 1750621377,
|
||||
"narHash": "sha256-8u6b5oAdX0rCuoR8wFenajBRmI+mzbpNig6hSCuWUzE=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "hyprgraphics",
|
||||
"rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
|
||||
"rev": "b3d628d01693fb9bb0a6690cd4e7b80abda04310",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -803,11 +803,11 @@
|
||||
"xdph": "xdph"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760143218,
|
||||
"narHash": "sha256-OhJPROcRcwBkjOKkXr/f3/7wuSjhAIqr8WfmEUF9Uuo=",
|
||||
"lastModified": 1759530922,
|
||||
"narHash": "sha256-9NgZKpibALekGTPDc2O8lP8vFealQSZkXe+L+S7MMZU=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "hyprland",
|
||||
"rev": "d599513d4a72d66ac62ffdedc41d6653fa81b39e",
|
||||
"rev": "76d998743ac10e712238c1016db4d8e8d16f1049",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1006,11 +1006,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760023949,
|
||||
"narHash": "sha256-fu0B4duamVdbkPio/czu1XhsPLRXUJpZLDrSk3nih4U=",
|
||||
"lastModified": 1759572448,
|
||||
"narHash": "sha256-o+r44fqPQM+/hQdjFy9qV9C51Jhty6M4icFVYocyJfA=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "hyprlock",
|
||||
"rev": "36ec73f166d9434a3f27c96c575198906f77644a",
|
||||
"rev": "c8a6768dca626cf7d7cbc333095f048bc007b6d9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1044,11 +1044,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760120448,
|
||||
"narHash": "sha256-l/OxM4q/nLVv47OuS4bG2J7k0m+G7/3AMtvrV64XLb0=",
|
||||
"lastModified": 1754481642,
|
||||
"narHash": "sha256-e1phd6KwtUsS9C2ShD+fQvfk2Dgr2JQi+rTDQUW15iE=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "hyprpaper",
|
||||
"rev": "1733e0025b194c9bc083f4cd8782c5f151858a58",
|
||||
"rev": "bcb1ffa322369c4898347ab5a7399a3d18494c8f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1069,11 +1069,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1759619523,
|
||||
"narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
|
||||
"lastModified": 1759490926,
|
||||
"narHash": "sha256-7IbZGJ5qAAfZsGhBHIsP8MBsfuFYS0hsxYHVkkeDG5Q=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "hyprutils",
|
||||
"rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
|
||||
"rev": "94cce794344538c4d865e38682684ec2bbdb2ef3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1144,11 +1144,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1755184602,
|
||||
"narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
|
||||
"lastModified": 1750371869,
|
||||
"narHash": "sha256-lGk4gLjgZQ/rndUkzmPYcgbHr8gKU5u71vyrjnwfpB4=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "hyprwayland-scanner",
|
||||
"rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
|
||||
"rev": "aa38edd6e3e277ae6a97ea83a69261a5c3aab9fd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1191,11 +1191,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1759815224,
|
||||
"narHash": "sha256-HbdOyjqHm38j6o5mV24i0bn+r5ykS+VJBnWJuZ0fE+A=",
|
||||
"lastModified": 1759387127,
|
||||
"narHash": "sha256-uuwJAP92SkHmnI1zo7rrK/gEuHtb97vFZcMa5w+0SZA=",
|
||||
"owner": "Jovian-Experiments",
|
||||
"repo": "Jovian-NixOS",
|
||||
"rev": "ee974f496a080c61b3164992c850f43741edcc52",
|
||||
"rev": "0cc290e05882745060fccfe6d7d073f913e0cce7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1278,11 +1278,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760146997,
|
||||
"narHash": "sha256-x2sF8Q4tWz3DI166s+KFDXySrK+cN+/YEd3DfhnhBLQ=",
|
||||
"lastModified": 1759629535,
|
||||
"narHash": "sha256-VIXcJ2ahRgoqIUySwAz3r5mtITO2dp6tXGCVKVW6FmA=",
|
||||
"owner": "fufexan",
|
||||
"repo": "nix-gaming",
|
||||
"rev": "ad505387568d024654da88fef03d9c5319cba92f",
|
||||
"rev": "df388c42b54714bd121796a9cec9322b7fa2894e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1363,11 +1363,11 @@
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1760038930,
|
||||
"narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
|
||||
"owner": "NixOS",
|
||||
"lastModified": 1759147044,
|
||||
"narHash": "sha256-3ZPFytJOcLjTChljeaGgoaNj+tOqzgEpqZAvRe3bU90=",
|
||||
"owner": "PedroHLC",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
|
||||
"rev": "18e83bbe13aa50992777832b52bd0e0d8585fb3b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1395,11 +1395,11 @@
|
||||
},
|
||||
"nixpkgs_5": {
|
||||
"locked": {
|
||||
"lastModified": 1759381078,
|
||||
"narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
|
||||
"lastModified": 1740560979,
|
||||
"narHash": "sha256-Vr3Qi346M+8CjedtbyUevIGDZW8LcA1fTG0ugPY/Hic=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
|
||||
"rev": "5135c59491985879812717f4c9fea69604e7f26f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1443,11 +1443,11 @@
|
||||
},
|
||||
"nixpkgs_8": {
|
||||
"locked": {
|
||||
"lastModified": 1760038930,
|
||||
"narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
|
||||
"lastModified": 1759381078,
|
||||
"narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
|
||||
"rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1482,11 +1482,11 @@
|
||||
"systems": "systems_5"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760153667,
|
||||
"narHash": "sha256-F7KmXT/Izse6Q6CkD5GCImoGPaDJxl03Kd7eD+eY/bU=",
|
||||
"lastModified": 1759469269,
|
||||
"narHash": "sha256-DP833ejGUNRRHsJOB3WRTaWWXLNucaDga2ju/fGe+sc=",
|
||||
"owner": "notashelf",
|
||||
"repo": "nvf",
|
||||
"rev": "9df9d51fd9fc8f9a8fc377f984ea3b7ae796172d",
|
||||
"rev": "e48638aef3a95377689de0ef940443c64f870a09",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1626,11 +1626,11 @@
|
||||
"rust-analyzer-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1760090851,
|
||||
"narHash": "sha256-XGkBjf4Dzg6tXd0KGgKzeW4oVX/iLzLhD3rQ1cATpqM=",
|
||||
"lastModified": 1759601486,
|
||||
"narHash": "sha256-ZywfLIFtRr907us1tONwUJLeg3ssO4D01XBFHx7RdAo=",
|
||||
"owner": "rust-lang",
|
||||
"repo": "rust-analyzer",
|
||||
"rev": "b93180b4f2cb3c81ac7f17f46e3dfcb30ecc7843",
|
||||
"rev": "4ae99f0150c94f4bdf7192b4447f512ece3546fd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1648,11 +1648,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760063676,
|
||||
"narHash": "sha256-s5Fjh43skH2L+avOGioLmEHoYZffDbg3abV5h0gjeew=",
|
||||
"lastModified": 1759458749,
|
||||
"narHash": "sha256-WKnbJnm1B2+TO2ZUudgS39EzecQeLl4/bnRtd3y46LI=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "897deed0923cc5a1d560c5176abe0d172ec9716d",
|
||||
"rev": "bbc3a8ae797d1700e57a4f4bcc4e79af727d4138",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1669,11 +1669,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1759631821,
|
||||
"narHash": "sha256-V8A1L0FaU/aSXZ1QNJScxC12uP4hANeRBgI4YdhHeRM=",
|
||||
"lastModified": 1740623427,
|
||||
"narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "1d7cbdaad90f8a5255a89a6eddd8af24dc89cafe",
|
||||
"rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1815,11 +1815,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1760120816,
|
||||
"narHash": "sha256-gq9rdocpmRZCwLS5vsHozwB6b5nrOBDNc2kkEaTXHfg=",
|
||||
"lastModified": 1758728421,
|
||||
"narHash": "sha256-ySNJ008muQAds2JemiyrWYbwbG+V7S5wg3ZVKGHSFu8=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "761ae7aff00907b607125b2f57338b74177697ed",
|
||||
"rev": "5eda4ee8121f97b218f7cc73f5172098d458f1d1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1923,11 +1923,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1759969704,
|
||||
"narHash": "sha256-T7f/invcFIKHrBqD+FLf/C/HOGmpYfbZUzTDxFscpOA=",
|
||||
"lastModified": 1759590499,
|
||||
"narHash": "sha256-EBToRzqe5WMz4DQyxOp9/CP+rWjdaZ2EUwbItfNf3VI=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "1173c777dc8daddcc4959260a7b00fd8abc884c5",
|
||||
"revCount": 137,
|
||||
"rev": "6e606c8bfa6a88209488790388b1005bc489fa66",
|
||||
"revCount": 136,
|
||||
"type": "git",
|
||||
"url": "https://git.sr.ht/~canasta/zen-browser-flake"
|
||||
},
|
||||
|
||||
11
flake.nix
11
flake.nix
@@ -1,8 +1,9 @@
|
||||
{
|
||||
description = "cnix nix";
|
||||
|
||||
outputs = inputs:
|
||||
inputs.flake-parts.lib.mkFlake {inherit inputs;} {
|
||||
outputs =
|
||||
inputs:
|
||||
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
@@ -16,11 +17,13 @@
|
||||
./fmt-hooks.nix
|
||||
];
|
||||
|
||||
perSystem = {
|
||||
perSystem =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
devShells.default = pkgs.mkShell {
|
||||
packages = [
|
||||
pkgs.git
|
||||
|
||||
@@ -4,9 +4,11 @@
|
||||
homeImports,
|
||||
self,
|
||||
...
|
||||
}: {
|
||||
flake.nixosConfigurations = let
|
||||
# clib = import ../lib inputs.nixpkgs.lib;
|
||||
}:
|
||||
{
|
||||
flake.nixosConfigurations =
|
||||
let
|
||||
cLib = import ../lib inputs.nixpkgs.lib;
|
||||
userConfig = "${self}/home";
|
||||
systemConfig = "${self}/system";
|
||||
hostConfig = "${self}/hosts";
|
||||
@@ -22,7 +24,7 @@
|
||||
|
||||
specialArgs = {
|
||||
inherit
|
||||
# clib
|
||||
cLib
|
||||
inputs
|
||||
outputs
|
||||
self
|
||||
@@ -35,7 +37,8 @@
|
||||
smodPath
|
||||
;
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
kima = nixosSystem {
|
||||
inherit specialArgs;
|
||||
modules = [
|
||||
|
||||
@@ -29,13 +29,6 @@
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
nameservers = [
|
||||
"192.168.88.1"
|
||||
"192.168.88.69"
|
||||
];
|
||||
search = [
|
||||
"taila7448a.ts.net"
|
||||
];
|
||||
interfaces = {
|
||||
"eno1" = {
|
||||
allowedTCPPorts = [
|
||||
@@ -73,7 +66,7 @@
|
||||
};
|
||||
};
|
||||
gamescope = {
|
||||
enable = false;
|
||||
enable = true;
|
||||
};
|
||||
gimp = {
|
||||
enable = true;
|
||||
@@ -223,7 +216,7 @@
|
||||
flags = "--performance";
|
||||
};
|
||||
tailscale = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
};
|
||||
udisks = {
|
||||
enable = true;
|
||||
|
||||
@@ -68,10 +68,7 @@ in {
|
||||
|
||||
boot = {
|
||||
supportedFilesystems = ["zfs"];
|
||||
zfs = {
|
||||
package = pkgs.zfs_unstable;
|
||||
extraPools = ["data"];
|
||||
};
|
||||
zfs.extraPools = ["data"];
|
||||
};
|
||||
|
||||
services.zfs = {
|
||||
|
||||
@@ -109,7 +109,7 @@
|
||||
enable = true;
|
||||
};
|
||||
dev = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
};
|
||||
};
|
||||
mysql-workbench = {
|
||||
|
||||
@@ -3,30 +3,77 @@
|
||||
enable = true;
|
||||
email = "adam@cnst.dev";
|
||||
domain = "cnix.dev";
|
||||
ip = "192.168.88.14";
|
||||
user = "share";
|
||||
group = "share";
|
||||
uid = 994;
|
||||
gid = 993;
|
||||
|
||||
infra = {
|
||||
traefik = {
|
||||
enable = true;
|
||||
};
|
||||
gitea = {
|
||||
enable = true;
|
||||
};
|
||||
unbound = {
|
||||
enable = true;
|
||||
};
|
||||
homepage-dashboard = {
|
||||
enable = true;
|
||||
};
|
||||
n8n = {
|
||||
enable = true;
|
||||
};
|
||||
bazarr = {
|
||||
enable = true;
|
||||
};
|
||||
prowlarr = {
|
||||
enable = true;
|
||||
};
|
||||
lidarr = {
|
||||
enable = true;
|
||||
};
|
||||
sonarr = {
|
||||
enable = true;
|
||||
};
|
||||
radarr = {
|
||||
enable = true;
|
||||
};
|
||||
jellyseerr = {
|
||||
enable = true;
|
||||
};
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
};
|
||||
uptime-kuma = {
|
||||
enable = true;
|
||||
};
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
url = "vault.cnst.dev";
|
||||
cloudflared = {
|
||||
tunnelId = "fdd98086-6a4c-44f2-bba0-eb86b833cce5";
|
||||
credentialsFile = config.age.secrets.vaultwardenCloudflared.path;
|
||||
};
|
||||
};
|
||||
www = {
|
||||
enable = true;
|
||||
url = "cnst.dev";
|
||||
cloudflared = {
|
||||
tunnelId = "e5076186-efb7-405a-998c-6155af7fb221";
|
||||
credentialsFile = config.age.secrets.wwwCloudflared.path;
|
||||
};
|
||||
};
|
||||
authentik = {
|
||||
enable = true;
|
||||
url = "auth.cnst.dev";
|
||||
port = 9000;
|
||||
cloudflared = {
|
||||
tunnelId = "b66f9368-db9e-4302-8b48-527cda34a635";
|
||||
credentialsFile = config.age.secrets.authentikCloudflared.path;
|
||||
};
|
||||
};
|
||||
traefik = {
|
||||
enable = true;
|
||||
};
|
||||
tailscale = {
|
||||
enable = true;
|
||||
};
|
||||
unbound = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
adminpassFile = config.age.secrets.nextcloudAdminPass.path;
|
||||
};
|
||||
fail2ban = {
|
||||
enable = true;
|
||||
@@ -37,230 +84,19 @@
|
||||
enable = true;
|
||||
interface = "enp6s0";
|
||||
};
|
||||
gluetun = {
|
||||
enable = true;
|
||||
};
|
||||
podman = {
|
||||
enable = true;
|
||||
};
|
||||
www = {
|
||||
enable = true;
|
||||
url = "cnst.dev";
|
||||
port = 8283;
|
||||
cloudflared = {
|
||||
tunnelId = "e5076186-efb7-405a-998c-6155af7fb221";
|
||||
credentialsFile = config.age.secrets.wwwCloudflared.path;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
homepage-dashboard = {
|
||||
enable = true;
|
||||
subdomain = "dash";
|
||||
exposure = "local";
|
||||
port = 8082;
|
||||
};
|
||||
n8n = {
|
||||
enable = true;
|
||||
subdomain = "n8n";
|
||||
exposure = "local";
|
||||
port = 5678;
|
||||
homepage = {
|
||||
name = "n8n";
|
||||
description = "A workflow automation platform";
|
||||
icon = "n8n.svg";
|
||||
category = "Services";
|
||||
};
|
||||
};
|
||||
bazarr = {
|
||||
enable = true;
|
||||
subdomain = "bazarr";
|
||||
exposure = "local";
|
||||
port = 6767;
|
||||
homepage = {
|
||||
name = "Bazarr";
|
||||
description = "Subtitle manager";
|
||||
icon = "bazarr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
prowlarr = {
|
||||
enable = true;
|
||||
subdomain = "prowlarr";
|
||||
exposure = "local";
|
||||
port = 9696;
|
||||
homepage = {
|
||||
name = "prowlarr";
|
||||
description = "PVR indexer";
|
||||
icon = "prowlarr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
flaresolverr = {
|
||||
enable = true;
|
||||
subdomain = "flaresolverr";
|
||||
exposure = "local";
|
||||
port = 8191;
|
||||
homepage = {
|
||||
name = "FlareSolverr";
|
||||
description = "Proxy to bypass Cloudflare/DDoS-GUARD protection";
|
||||
icon = "flaresolverr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
lidarr = {
|
||||
enable = true;
|
||||
subdomain = "lidarr";
|
||||
exposure = "local";
|
||||
port = 8686;
|
||||
homepage = {
|
||||
name = "Lidarr";
|
||||
description = "Music collection manager";
|
||||
icon = "lidarr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
sonarr = {
|
||||
enable = true;
|
||||
subdomain = "sonarr";
|
||||
exposure = "local";
|
||||
port = 8989;
|
||||
homepage = {
|
||||
name = "Sonarr";
|
||||
description = "Internet PVR for Usenet and Torrents";
|
||||
icon = "sonarr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
radarr = {
|
||||
enable = true;
|
||||
subdomain = "radarr";
|
||||
exposure = "local";
|
||||
port = 7878;
|
||||
homepage = {
|
||||
name = "Radarr";
|
||||
description = "Movie collection manager";
|
||||
icon = "radarr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
jellyseerr = {
|
||||
enable = true;
|
||||
subdomain = "jellyseerr";
|
||||
exposure = "local";
|
||||
port = 5055;
|
||||
homepage = {
|
||||
name = "Jellyseerr";
|
||||
description = "Media request and discovery manager";
|
||||
icon = "jellyserr.svg";
|
||||
category = "Arr";
|
||||
};
|
||||
};
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
subdomain = "fin";
|
||||
exposure = "tailscale";
|
||||
port = 8096;
|
||||
homepage = {
|
||||
name = "Jellyfin";
|
||||
description = "The Free Software Media System";
|
||||
icon = "jellyfin.svg";
|
||||
category = "Media";
|
||||
};
|
||||
};
|
||||
uptime-kuma = {
|
||||
enable = true;
|
||||
subdomain = "uptime";
|
||||
exposure = "local";
|
||||
port = 3001;
|
||||
homepage = {
|
||||
name = "Uptime Kuma";
|
||||
description = "Service monitoring tool";
|
||||
icon = "uptime-kuma.svg";
|
||||
category = "Services";
|
||||
};
|
||||
};
|
||||
gitea = {
|
||||
enable = true;
|
||||
subdomain = "git";
|
||||
exposure = "tunnel";
|
||||
port = 5003;
|
||||
cloudflared = {
|
||||
tunnelId = "33e2fb8e-ecef-4d42-b845-6d15e216e448";
|
||||
credentialsFile = config.age.secrets.giteaCloudflared.path;
|
||||
};
|
||||
homepage = {
|
||||
name = "Gitea";
|
||||
description = "Git with a cup of tea";
|
||||
icon = "gitea.svg";
|
||||
category = "Services";
|
||||
};
|
||||
};
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
subdomain = "vault";
|
||||
exposure = "tunnel";
|
||||
port = 8222;
|
||||
cloudflared = {
|
||||
tunnelId = "fdd98086-6a4c-44f2-bba0-eb86b833cce5";
|
||||
credentialsFile = config.age.secrets.vaultwardenCloudflared.path;
|
||||
};
|
||||
homepage = {
|
||||
name = "Vaultwarden";
|
||||
description = "Password manager";
|
||||
icon = "vaultwarden.svg";
|
||||
category = "Services";
|
||||
};
|
||||
};
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
subdomain = "cloud";
|
||||
exposure = "local";
|
||||
port = 8182;
|
||||
homepage = {
|
||||
name = "Nextcloud";
|
||||
description = "A safe home for all your data";
|
||||
icon = "nextcloud.svg";
|
||||
category = "Services";
|
||||
};
|
||||
};
|
||||
gluetun.enable = true;
|
||||
qbittorrent = {
|
||||
enable = true;
|
||||
subdomain = "qbt";
|
||||
exposure = "local";
|
||||
port = 8080;
|
||||
homepage = {
|
||||
name = "qBittorrent";
|
||||
description = "Torrent client";
|
||||
icon = "qbittorrent.svg";
|
||||
category = "Downloads";
|
||||
};
|
||||
};
|
||||
slskd = {
|
||||
enable = true;
|
||||
subdomain = "slskd";
|
||||
exposure = "local";
|
||||
port = 5030;
|
||||
homepage = {
|
||||
name = "Soulseek";
|
||||
description = "Web-based Soulseek client";
|
||||
icon = "slskd.svg";
|
||||
category = "Downloads";
|
||||
};
|
||||
};
|
||||
pihole = {
|
||||
enable = true;
|
||||
subdomain = "pihole";
|
||||
exposure = "local";
|
||||
port = 8053;
|
||||
homepage = {
|
||||
name = "PiHole";
|
||||
description = "Adblocking and DNS service";
|
||||
icon = "pi-hole.svg";
|
||||
category = "Services";
|
||||
path = "/admin";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -4,10 +4,6 @@
|
||||
username = "cnst";
|
||||
mail = "adam@cnst.dev";
|
||||
sshUser = "sobotka";
|
||||
domains = {
|
||||
local = "cnix.dev";
|
||||
public = "cnst.dev";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
{lib}: let
|
||||
server = {
|
||||
mkDomain = config: service: let
|
||||
localDomain = config.settings.accounts.domains.local;
|
||||
publicDomain = config.settings.accounts.domains.public;
|
||||
tailscaleDomain = "ts.${publicDomain}";
|
||||
in
|
||||
if service.exposure == "tunnel"
|
||||
then publicDomain
|
||||
else if service.exposure == "tailscale"
|
||||
then tailscaleDomain
|
||||
else localDomain;
|
||||
|
||||
mkFullDomain = config: service: let
|
||||
domain = server.mkDomain config service;
|
||||
in "${service.subdomain}.${domain}";
|
||||
|
||||
mkHostDomain = config: service: let
|
||||
domain = server.mkDomain config service;
|
||||
in "${domain}";
|
||||
|
||||
mkSubDomain = config: service: "${service.subdomain}";
|
||||
};
|
||||
in {
|
||||
server = server;
|
||||
}
|
||||
@@ -123,6 +123,27 @@
|
||||
server = {
|
||||
imports = [
|
||||
./server
|
||||
./server/fail2ban
|
||||
./server/homepage-dashboard
|
||||
./server/nextcloud
|
||||
./server/vaultwarden
|
||||
./server/bazarr
|
||||
./server/prowlarr
|
||||
./server/lidarr
|
||||
./server/radarr
|
||||
./server/sonarr
|
||||
./server/jellyseerr
|
||||
./server/jellyfin
|
||||
./server/n8n
|
||||
./server/podman
|
||||
./server/unbound
|
||||
./server/uptime-kuma
|
||||
./server/keepalived
|
||||
./server/gitea
|
||||
./server/postgres
|
||||
./server/traefik
|
||||
./server/www
|
||||
./server/authentik
|
||||
];
|
||||
};
|
||||
settings = {
|
||||
|
||||
@@ -3,9 +3,10 @@
|
||||
pkgs,
|
||||
lib,
|
||||
osConfig,
|
||||
clib,
|
||||
cLib,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkIf mkEnableOption;
|
||||
cfg = osConfig.nixos.programs.hyprland;
|
||||
|
||||
@@ -13,8 +14,9 @@
|
||||
# hyprlockPkg = pkgs.hyprlock;
|
||||
#
|
||||
bg = osConfig.settings.theme.background;
|
||||
inherit (clib.theme.bgs) resolve;
|
||||
in {
|
||||
inherit (cLib.theme.bgs) resolve;
|
||||
in
|
||||
{
|
||||
config = mkIf cfg.enable {
|
||||
programs.hyprlock = {
|
||||
enable = true;
|
||||
|
||||
@@ -88,7 +88,7 @@ in
|
||||
hyprpicker
|
||||
libnotify
|
||||
pamixer
|
||||
loupe
|
||||
oculante
|
||||
adwaita-icon-theme
|
||||
qt5.qtwayland
|
||||
qt6.qtwayland
|
||||
|
||||
@@ -3,15 +3,16 @@
|
||||
pkgs,
|
||||
inputs,
|
||||
osConfig,
|
||||
clib,
|
||||
cLib,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkIf;
|
||||
|
||||
cfg = osConfig.nixos.programs.hyprland;
|
||||
hyprpaperFlake = inputs.hyprpaper.packages.${pkgs.system}.default;
|
||||
bg = osConfig.settings.theme.background;
|
||||
bgs = clib.theme.bgs;
|
||||
bgs = cLib.theme.bgs;
|
||||
|
||||
monitorMappings = [
|
||||
{
|
||||
@@ -31,7 +32,8 @@
|
||||
bg = bg.primary;
|
||||
}
|
||||
];
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = mkIf cfg.enable {
|
||||
services.hyprpaper = {
|
||||
enable = true;
|
||||
|
||||
@@ -84,15 +84,15 @@ in
|
||||
"application/pdf" = "org.pwmt.zathura-pdf-mupdf.desktop";
|
||||
"inode/directory" = "thunar.desktop";
|
||||
|
||||
"image/apng" = "feh.desktop";
|
||||
"image/avif" = "feh.desktop";
|
||||
"image/bmp" = "feh.desktop";
|
||||
"image/gif" = "feh.desktop";
|
||||
"image/jpeg" = "feh.desktop";
|
||||
"image/png" = "feh.desktop";
|
||||
"image/svg+xml" = "feh.desktop";
|
||||
"image/tiff" = "feh.desktop";
|
||||
"image/webp" = "feh.desktop";
|
||||
"image/apng" = "oculante.desktop";
|
||||
"image/avif" = "oculante.desktop";
|
||||
"image/bmp" = "oculante.desktop";
|
||||
"image/gif" = "oculante.desktop";
|
||||
"image/jpeg" = "oculante.desktop";
|
||||
"image/png" = "oculante.desktop";
|
||||
"image/svg+xml" = "oculante.desktop";
|
||||
"image/tiff" = "oculante.desktop";
|
||||
"image/webp" = "oculante.desktop";
|
||||
|
||||
"video/H264" = [
|
||||
"mpv.desktop"
|
||||
|
||||
@@ -2,47 +2,38 @@
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
mkIf
|
||||
mkEnableOption
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
cfg = config.nixos.hardware.network;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options = {
|
||||
nixos.hardware.network = {
|
||||
enable = mkEnableOption "Enable the custom networking module";
|
||||
nameservers = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = "The list of nameservers ";
|
||||
};
|
||||
search = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = "Domain search paths";
|
||||
};
|
||||
interfaces = mkOption {
|
||||
type = types.attrsOf (
|
||||
types.submodule {
|
||||
options = {
|
||||
allowedTCPPorts = mkOption {
|
||||
type = types.listOf types.int;
|
||||
default = [];
|
||||
default = [ ];
|
||||
description = "List of allowed TCP ports for this interface.";
|
||||
};
|
||||
allowedUDPPorts = mkOption {
|
||||
type = types.listOf types.int;
|
||||
default = [];
|
||||
default = [ ];
|
||||
description = "List of allowed UDP ports for this interface.";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
default = {};
|
||||
default = { };
|
||||
description = "Network interface configurations.";
|
||||
};
|
||||
extraHosts = mkOption {
|
||||
@@ -56,7 +47,7 @@ in {
|
||||
config = mkIf cfg.enable {
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.interfaces != {} -> config.networking.networkmanager.enable;
|
||||
assertion = cfg.interfaces != { } -> config.networking.networkmanager.enable;
|
||||
message = "Network interfaces configured but NetworkManager is not enabled";
|
||||
}
|
||||
];
|
||||
@@ -64,8 +55,6 @@ in {
|
||||
networking = {
|
||||
networkmanager.enable = true;
|
||||
nftables.enable = true;
|
||||
nameservers = cfg.nameservers;
|
||||
search = cfg.search;
|
||||
firewall = {
|
||||
enable = true;
|
||||
inherit (cfg) interfaces;
|
||||
@@ -74,8 +63,8 @@ in {
|
||||
};
|
||||
|
||||
systemd.services.NetworkManager = {
|
||||
wants = ["nftables.service"];
|
||||
after = ["nftables.service"];
|
||||
wants = [ "nftables.service" ];
|
||||
after = [ "nftables.service" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -78,7 +78,6 @@ in
|
||||
openssl
|
||||
xmrig
|
||||
ocl-icd
|
||||
dig
|
||||
]
|
||||
|
||||
(mkIf cfg.common.enable [
|
||||
@@ -97,6 +96,9 @@ in
|
||||
])
|
||||
|
||||
(mkIf cfg.desktop.enable [
|
||||
protonup
|
||||
winetricks
|
||||
wine
|
||||
geekbench
|
||||
unigine-heaven
|
||||
])
|
||||
@@ -107,13 +109,15 @@ in
|
||||
|
||||
(mkIf cfg.server.enable [
|
||||
nvtopPackages.intel
|
||||
nvtopPackages.amd
|
||||
dig
|
||||
helix
|
||||
zfs
|
||||
zfstools
|
||||
])
|
||||
|
||||
(mkIf cfg.dev.enable [
|
||||
# lldb_20 # some biuld error atm
|
||||
sqlite
|
||||
gemini-cli
|
||||
nfs-utils
|
||||
gcc
|
||||
@@ -140,6 +144,7 @@ in
|
||||
prettierd
|
||||
# php84Packages.php-cs-fixer
|
||||
shfmt
|
||||
luaformatter
|
||||
black
|
||||
])
|
||||
];
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
@@ -18,20 +17,6 @@ in
|
||||
enable = true;
|
||||
gamescopeSession.enable = true;
|
||||
};
|
||||
gamescope = {
|
||||
enable = true;
|
||||
capSysNice = true;
|
||||
args = [
|
||||
"--rt"
|
||||
"--expose-wayland"
|
||||
];
|
||||
};
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
protonup
|
||||
wine
|
||||
winetricks
|
||||
wine-wayland
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -45,6 +45,7 @@ in
|
||||
# nodePackages_latest.sql-formatter
|
||||
prettierd
|
||||
shfmt
|
||||
luaformatter
|
||||
black
|
||||
];
|
||||
};
|
||||
|
||||
@@ -1,14 +1,15 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
unit = "authentik";
|
||||
cfg = config.server.infra.${unit};
|
||||
srv = config.server.infra.www.domain;
|
||||
cfg = config.server.${unit};
|
||||
srv = config.server;
|
||||
in {
|
||||
options.server.infra.${unit} = {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
@@ -16,10 +17,6 @@ in {
|
||||
type = lib.types.str;
|
||||
default = "auth.${srv.www.domain}";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
description = "The local port the service runs on";
|
||||
};
|
||||
cloudflared = {
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
@@ -34,11 +31,21 @@ in {
|
||||
example = "00000000-0000-0000-0000-000000000000";
|
||||
};
|
||||
};
|
||||
homepage = {
|
||||
name = "Authentik";
|
||||
description = "An open-source IdP for modern SSO";
|
||||
icon = "authentik.svg";
|
||||
category = "Services";
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Authentik";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "An open-source IdP for modern SSO";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "authentik.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Services";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -46,18 +53,24 @@ in {
|
||||
age.secrets = {
|
||||
authentikEnv = {
|
||||
file = "${self}/secrets/authentikEnv.age";
|
||||
owner = "authentik";
|
||||
group = "authentik";
|
||||
mode = "0400";
|
||||
};
|
||||
authentikCloudflared = {
|
||||
file = "${self}/secrets/authentikCloudflared.age";
|
||||
owner = "authentik";
|
||||
group = "authentik";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
|
||||
server.infra = {
|
||||
fail2ban = {
|
||||
server = {
|
||||
fail2ban = lib.mkIf cfg.enable {
|
||||
jails = {
|
||||
authentik = {
|
||||
serviceName = "authentik";
|
||||
failRegex = ''^.*Username or password is incorrect.*IP:\s*<HOST>'';
|
||||
failRegex = "^.*Username or password is incorrect.*IP:\s*<HOST>";
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -90,6 +103,7 @@ in {
|
||||
middlewares = {
|
||||
authentik = {
|
||||
forwardAuth = {
|
||||
# tls.insecureSkipVerify = true;
|
||||
address = "https://localhost:9443/outpost.goauthentik.io/auth/traefik";
|
||||
trustForwardHeader = true;
|
||||
authResponseHeaders = [
|
||||
@@ -105,6 +119,7 @@ in {
|
||||
"X-authentik-meta-app"
|
||||
"X-authentik-meta-version"
|
||||
];
|
||||
timeout = "10s";
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -120,7 +135,7 @@ in {
|
||||
routers = {
|
||||
auth = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
|
||||
rule = "Host(`${cfg.url}`) || HostRegexp(`{subdomain:[a-z0-9]+}.${srv.www.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
|
||||
service = "auth";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
62
modules/server/bazarr/default.nix
Normal file
62
modules/server/bazarr/default.nix
Normal file
@@ -0,0 +1,62 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "bazarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${unit}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Bazarr";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Subtitle manager";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "bazarr.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Arr";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.bazarr.loadBalancer.servers = [{url = "http://127.0.0.1:${toString config.services.${unit}.listenPort}";}];
|
||||
routers = {
|
||||
bazarr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "bazarr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,16 +1,101 @@
|
||||
{
|
||||
self,
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
clib = import "${self}/lib/server" {inherit lib;};
|
||||
in {
|
||||
imports = [
|
||||
{
|
||||
_module.args.clib = clib;
|
||||
}
|
||||
./options.nix
|
||||
./infra
|
||||
./services
|
||||
hardDrives = [
|
||||
"/dev/disk/by-label/data"
|
||||
];
|
||||
inherit (lib) mkOption types;
|
||||
cfg = config.server;
|
||||
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
|
||||
in {
|
||||
options.server = {
|
||||
enable = lib.mkEnableOption "The server services and configuration variables";
|
||||
email = mkOption {
|
||||
default = "";
|
||||
type = types.str;
|
||||
description = ''
|
||||
Email name to be used to access the server services via Caddy reverse proxy
|
||||
'';
|
||||
};
|
||||
domain = mkOption {
|
||||
default = "";
|
||||
type = types.str;
|
||||
description = ''
|
||||
Domain name to be used to access the server services via Caddy reverse proxy
|
||||
'';
|
||||
};
|
||||
user = lib.mkOption {
|
||||
default = "share";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
User to run the server services as
|
||||
'';
|
||||
};
|
||||
group = lib.mkOption {
|
||||
default = "share";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Group to run the server services as
|
||||
'';
|
||||
};
|
||||
uid = lib.mkOption {
|
||||
default = 1000;
|
||||
type = lib.types.int;
|
||||
description = ''
|
||||
UID to run the server services as
|
||||
'';
|
||||
};
|
||||
gid = lib.mkOption {
|
||||
default = 1000;
|
||||
type = lib.types.int;
|
||||
description = ''
|
||||
GID to run the server services as
|
||||
'';
|
||||
};
|
||||
timeZone = lib.mkOption {
|
||||
default = "Europe/Stockholm";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Time zone to be used for the server services
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
users = {
|
||||
groups.${cfg.group} = {
|
||||
gid = cfg.gid;
|
||||
};
|
||||
users.${cfg.user} = {
|
||||
uid = cfg.uid;
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
extraGroups = ifTheyExist [
|
||||
"audio"
|
||||
"video"
|
||||
"docker"
|
||||
"libvirtd"
|
||||
"qemu-libvirtd"
|
||||
"rtkit"
|
||||
"fail2ban"
|
||||
"vaultwarden"
|
||||
"qbittorrent"
|
||||
"lidarr"
|
||||
"prowlarr"
|
||||
"bazarr"
|
||||
"sonarr"
|
||||
"radarr"
|
||||
"media"
|
||||
"share"
|
||||
"render"
|
||||
"input"
|
||||
"authentik"
|
||||
"traefik"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,9 +5,9 @@
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
cfg = config.server.infra.fail2ban;
|
||||
cfg = config.server.fail2ban;
|
||||
in {
|
||||
options.server.infra.fail2ban = {
|
||||
options.server.fail2ban = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable cloudflare fail2ban";
|
||||
};
|
||||
@@ -30,28 +30,14 @@ in {
|
||||
example = "vaultwarden";
|
||||
type = lib.types.str;
|
||||
};
|
||||
_groupsre = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
example = ''(?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)'';
|
||||
default = "";
|
||||
};
|
||||
failRegex = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
example = ''
|
||||
^Login failed from IP: <HOST>$
|
||||
^Two-factor challenge failed from <HOST>$
|
||||
'';
|
||||
type = lib.types.str;
|
||||
example = "Login failed from IP: <HOST>";
|
||||
};
|
||||
ignoreRegex = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
};
|
||||
datePattern = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
example = '',?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"'';
|
||||
description = "Optional datepattern line for the fail2ban filter.";
|
||||
};
|
||||
maxRetry = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 3;
|
||||
@@ -61,7 +47,6 @@ in {
|
||||
);
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.fail2ban = {
|
||||
enable = true;
|
||||
@@ -90,17 +75,10 @@ in {
|
||||
environment.etc = lib.attrsets.mergeAttrsList [
|
||||
(lib.attrsets.mapAttrs' (
|
||||
name: value: (lib.nameValuePair "fail2ban/filter.d/${name}.conf" {
|
||||
text =
|
||||
''
|
||||
text = ''
|
||||
[Definition]
|
||||
failregex = ${value.failRegex}
|
||||
ignoreregex = ${value.ignoreRegex}
|
||||
''
|
||||
+ lib.optionalString (value.datePattern != "") ''
|
||||
datepattern = ${value.datePattern}
|
||||
''
|
||||
+ lib.optionalString (value._groupsre != "") ''
|
||||
_groupsre = ${value._groupsre}
|
||||
'';
|
||||
})
|
||||
)
|
||||
125
modules/server/gitea/default.nix
Normal file
125
modules/server/gitea/default.nix
Normal file
@@ -0,0 +1,125 @@
|
||||
# taken from @jtojnar
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "gitea";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "git.${srv.domain}";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 5003;
|
||||
description = "The port to host Gitea on.";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Gitea";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Git with a cup of tea";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "gitea.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Services";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
appName = "cnix code forge";
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
socket = "/run/postgresql";
|
||||
name = "gitea";
|
||||
user = "gitea";
|
||||
createDatabase = false;
|
||||
};
|
||||
|
||||
lfs = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
settings = {
|
||||
cors = {
|
||||
ENABLED = true;
|
||||
SCHEME = "https";
|
||||
ALLOW_DOMAIN = cfg.url;
|
||||
};
|
||||
log = {
|
||||
MODE = "console";
|
||||
};
|
||||
mailer = {
|
||||
ENABLED = false;
|
||||
MAILER_TYPE = "sendmail";
|
||||
FROM = "noreply+adam@cnst.dev";
|
||||
SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
|
||||
};
|
||||
picture = {
|
||||
DISABLE_GRAVATAR = true;
|
||||
};
|
||||
repository = {
|
||||
DEFAULT_BRANCH = "main";
|
||||
DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
|
||||
DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
|
||||
};
|
||||
indexer = {
|
||||
REPO_INDEXER_ENABLED = true;
|
||||
};
|
||||
server = {
|
||||
DOMAIN = cfg.url;
|
||||
LANDING_PAGE = "explore";
|
||||
HTTP_PORT = cfg.port;
|
||||
ROOT_URL = "https://${cfg.url}/";
|
||||
};
|
||||
security = {
|
||||
DISABLE_GIT_HOOKS = false;
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true;
|
||||
};
|
||||
session = {
|
||||
COOKIE_SECURE = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.gitea.loadBalancer.servers = [{url = "http://127.0.0.1:5003";}];
|
||||
routers = {
|
||||
gitea = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "gitea";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
server.postgresql.databases = [
|
||||
{
|
||||
database = "gitea";
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -2,27 +2,51 @@
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
clib,
|
||||
...
|
||||
}: let
|
||||
unit = "homepage-dashboard";
|
||||
cfg = config.server.services.${unit};
|
||||
cfg = config.server.homepage-dashboard;
|
||||
srv = config.server;
|
||||
in {
|
||||
options.server.homepage-dashboard = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
misc = lib.mkOption {
|
||||
default = [];
|
||||
type = lib.types.listOf (
|
||||
lib.types.attrsOf (
|
||||
lib.types.submodule {
|
||||
options = {
|
||||
description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
href = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
siteMonitor = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
age.secrets = {
|
||||
homepageEnvironment = {
|
||||
file = "${self}/secrets/homepageEnvironment.age";
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
glances.enable = true;
|
||||
|
||||
${unit} = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.homepageEnvironment.path;
|
||||
|
||||
settings = {
|
||||
layout = [
|
||||
{
|
||||
@@ -57,12 +81,10 @@ in {
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
headerStyle = "clean";
|
||||
statusStyle = "dot";
|
||||
hideVersion = "true";
|
||||
};
|
||||
|
||||
widgets = [
|
||||
{
|
||||
openmeteo = {
|
||||
@@ -79,11 +101,10 @@ in {
|
||||
label = "SYSTEM";
|
||||
memory = true;
|
||||
cpu = true;
|
||||
uptime = false;
|
||||
uptime = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
services = let
|
||||
homepageCategories = [
|
||||
"Arr"
|
||||
@@ -91,37 +112,31 @@ in {
|
||||
"Downloads"
|
||||
"Services"
|
||||
];
|
||||
allServices = srv.services;
|
||||
|
||||
getDomain = s: clib.server.mkHostDomain config s;
|
||||
|
||||
homepageServicesFor = category:
|
||||
lib.filterAttrs
|
||||
(
|
||||
name: value:
|
||||
name
|
||||
!= unit
|
||||
&& value ? homepage
|
||||
&& value.homepage.category == category
|
||||
hl = config.server;
|
||||
mergedServices = hl // hl.podman;
|
||||
homepageServices = x: (lib.attrsets.filterAttrs (
|
||||
name: value: value ? homepage && value.homepage.category == x
|
||||
)
|
||||
allServices;
|
||||
mergedServices);
|
||||
in
|
||||
lib.lists.forEach homepageCategories (cat: {
|
||||
"${cat}" =
|
||||
lib.lists.forEach
|
||||
(lib.attrsets.mapAttrsToList (name: _value: name) (homepageServicesFor cat))
|
||||
(x: let
|
||||
service = allServices.${x};
|
||||
domain = getDomain service;
|
||||
in {
|
||||
"${service.homepage.name}" = {
|
||||
icon = service.homepage.icon;
|
||||
description = service.homepage.description;
|
||||
href = "https://${domain}";
|
||||
siteMonitor = "https://${domain}";
|
||||
(lib.attrsets.mapAttrsToList (name: value: {
|
||||
inherit name;
|
||||
url = value.url;
|
||||
homepage = value.homepage;
|
||||
}) (homepageServices "${cat}"))
|
||||
(x: {
|
||||
"${x.homepage.name}" = {
|
||||
icon = x.homepage.icon;
|
||||
description = x.homepage.description;
|
||||
href = "https://${x.url}${x.homepage.path or ""}";
|
||||
siteMonitor = "https://${x.url}${x.homepage.path or ""}";
|
||||
};
|
||||
});
|
||||
})
|
||||
++ [{Misc = cfg.misc;}]
|
||||
++ [
|
||||
{
|
||||
Glances = let
|
||||
@@ -197,6 +212,25 @@ in {
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.homepage.loadBalancer.servers = [
|
||||
{url = "http://127.0.0.1:${toString config.services.${unit}.listenPort}";}
|
||||
];
|
||||
routers = {
|
||||
homepage = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`cnix.dev`)";
|
||||
service = "homepage";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
./authentik
|
||||
./fail2ban
|
||||
./keepalived
|
||||
./podman
|
||||
./postgres
|
||||
./tailscale
|
||||
./traefik
|
||||
./unbound
|
||||
./www
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
filenames:
|
||||
- /var/log/traefik/access.log
|
||||
poll_without_inotify: true
|
||||
labels:
|
||||
type: traefik
|
||||
@@ -1,162 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
infra = config.server.infra;
|
||||
cfg = config.server.services;
|
||||
|
||||
getPiholeSecret = hostname:
|
||||
if hostname == "ziggy"
|
||||
then [config.age.secrets.piholeZiggy.path]
|
||||
else if hostname == "sobotka"
|
||||
then [config.age.secrets.pihole.path]
|
||||
else throw "Unknown hostname: ${hostname}";
|
||||
in {
|
||||
options.server.infra = {
|
||||
podman.enable = lib.mkEnableOption "Enables Podman";
|
||||
gluetun.enable = lib.mkEnableOption "Enables gluetun";
|
||||
};
|
||||
config = lib.mkIf infra.podman.enable {
|
||||
age.secrets = {
|
||||
pihole.file = "${self}/secrets/${config.networking.hostName}Pihole.age";
|
||||
slskd.file = "${self}/secrets/slskd.age";
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
containers.enable = true;
|
||||
podman.enable = true;
|
||||
};
|
||||
|
||||
networking.firewall = lib.mkIf cfg.pihole.enable {
|
||||
allowedTCPPorts = [
|
||||
53
|
||||
5335
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
5335
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers = lib.mkMerge [
|
||||
(lib.mkIf infra.gluetun.enable {
|
||||
gluetun = {
|
||||
image = "qmcgaw/gluetun";
|
||||
ports = [
|
||||
"8388:8388"
|
||||
"58846:58846"
|
||||
"8080:8080"
|
||||
"5030:5030"
|
||||
"5031:5031"
|
||||
"50300:50300"
|
||||
];
|
||||
devices = ["/dev/net/tun:/dev/net/tun"];
|
||||
autoStart = true;
|
||||
extraOptions = [
|
||||
"--cap-add=NET_ADMIN"
|
||||
];
|
||||
volumes = ["/var:/gluetun"];
|
||||
environmentFiles = [
|
||||
config.age.secrets.gluetunEnvironment.path
|
||||
];
|
||||
environment = {
|
||||
DEV_MODE = "false";
|
||||
VPN_SERVICE_PROVIDER = "mullvad";
|
||||
VPN_TYPE = "wireguard";
|
||||
SERVER_CITIES = "Stockholm";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.qbittorrent.enable {
|
||||
qbittorrent = {
|
||||
image = "ghcr.io/hotio/qbittorrent:latest";
|
||||
autoStart = true;
|
||||
dependsOn = ["gluetun"];
|
||||
ports = [
|
||||
"8080:8080"
|
||||
"58846:58846"
|
||||
];
|
||||
extraOptions = [
|
||||
"--network=container:gluetun"
|
||||
];
|
||||
volumes = [
|
||||
"/var/lib/qbittorrent:/config:rw"
|
||||
"/mnt/data/media/downloads:/downloads:rw"
|
||||
];
|
||||
environmentFiles = [
|
||||
config.age.secrets.gluetunEnvironment.path
|
||||
];
|
||||
environment = {
|
||||
PUID = "994";
|
||||
PGID = "993";
|
||||
TZ = "Europe/Stockholm";
|
||||
WEBUI_PORT = "${builtins.toString cfg.qbittorrent.port}";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.slskd.enable {
|
||||
slskd = {
|
||||
image = "slskd/slskd:latest";
|
||||
autoStart = true;
|
||||
dependsOn = ["gluetun"];
|
||||
ports = [
|
||||
"5030:5030"
|
||||
"5031:5031"
|
||||
"50300:50300"
|
||||
];
|
||||
extraOptions = [
|
||||
"--network=container:gluetun"
|
||||
];
|
||||
volumes = [
|
||||
"/var/lib/slskd:/app:rw"
|
||||
"/mnt/data/media/downloads:/downloads:rw"
|
||||
];
|
||||
environmentFiles = [
|
||||
config.age.secrets.gluetunEnvironment.path
|
||||
config.age.secrets.slskd.path
|
||||
];
|
||||
environment = {
|
||||
TZ = "Europe/Stockholm";
|
||||
PUID = "981";
|
||||
PGID = "982";
|
||||
SLSKD_REMOTE_CONFIGURATION = "true";
|
||||
SLSKD_REMOTE_FILE_MANAGEMENT = "true";
|
||||
SLSKD_DOWNLOADS_DIR = "/downloads";
|
||||
SLSKD_UMASK = "022";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.pihole.enable {
|
||||
pihole = {
|
||||
autoStart = true;
|
||||
image = "pihole/pihole:2025.08.0";
|
||||
volumes = [
|
||||
"/var/lib/pihole:/etc/pihole/"
|
||||
"/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
|
||||
];
|
||||
environment = {
|
||||
TZ = "Europe/Stockholm";
|
||||
CUSTOM_CACHE_SIZE = "0";
|
||||
WEBTHEME = "default-darker";
|
||||
};
|
||||
environmentFiles = getPiholeSecret config.networking.hostName;
|
||||
ports = [
|
||||
"53:53/tcp"
|
||||
"53:53/udp"
|
||||
"8053:80/tcp"
|
||||
];
|
||||
extraOptions = [
|
||||
"--cap-add=NET_ADMIN"
|
||||
"--cap-add=SYS_NICE"
|
||||
"--cap-add=SYS_TIME"
|
||||
];
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.server.infra.tailscale;
|
||||
in {
|
||||
options.server.infra.tailscale = {
|
||||
enable = mkEnableOption "Enable tailscale server configuration";
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
age.secrets.sobotkaTsAuth.file = "${self}/secrets/sobotkaTsAuth.age";
|
||||
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
useRoutingFeatures = "server";
|
||||
authKeyFile = config.age.secrets.sobotkaTsAuth.path;
|
||||
extraSetFlags = [
|
||||
"--advertise-exit-node"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,202 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
clib,
|
||||
config,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkEnableOption mkIf types;
|
||||
|
||||
cfg = config.server.infra.traefik;
|
||||
srv = config.server;
|
||||
|
||||
# Generates all Traefik routers from the central service list
|
||||
# generateRouters = services:
|
||||
# lib.mapAttrs' (
|
||||
# name: service: let
|
||||
# domain =
|
||||
# if service.exposure == "tunnel"
|
||||
# then "cnst.dev"
|
||||
# else if service.exposure == "tailscale"
|
||||
# then "ts.cnst.dev"
|
||||
# else srv.domain;
|
||||
# in
|
||||
# lib.nameValuePair "${service.subdomain}" {
|
||||
# entryPoints = ["websecure"];
|
||||
# rule = "Host(`${service.subdomain}.${domain}`)";
|
||||
# service = service.subdomain;
|
||||
# tls.certResolver = "letsencrypt";
|
||||
# }
|
||||
# ) (lib.filterAttrs (name: service: service.enable) services);
|
||||
|
||||
generateRouters = services: config:
|
||||
lib.mapAttrs' (
|
||||
name: service:
|
||||
lib.nameValuePair name {
|
||||
entryPoints = ["websecure"];
|
||||
# FIX 3: Use backticks for the Host rule and interpolation
|
||||
rule = "Host(`${clib.server.mkFullDomain config service}`)";
|
||||
service = name;
|
||||
tls.certResolver = "letsencrypt";
|
||||
}
|
||||
) (lib.filterAttrs (_: s: s.enable) services);
|
||||
|
||||
generateServices = services:
|
||||
lib.mapAttrs' (name: service:
|
||||
lib.nameValuePair name {
|
||||
loadBalancer.servers = [{url = "http://localhost:${toString service.port}";}];
|
||||
}) (lib.filterAttrs (name: service: service.enable) services);
|
||||
|
||||
getCloudflareCredentials = hostname:
|
||||
if hostname == "ziggy"
|
||||
then config.age.secrets.cloudflareDnsCredentialsZiggy.path
|
||||
else if hostname == "sobotka"
|
||||
then config.age.secrets.cloudflareDnsCredentials.path
|
||||
else throw "Unknown hostname: ${hostname}";
|
||||
in {
|
||||
options.server.infra.traefik = {
|
||||
enable = mkEnableOption "Enable global Traefik reverse proxy with ACME";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
age.secrets = {
|
||||
traefikEnv = {
|
||||
file = "${self}/secrets/traefikEnv.age";
|
||||
mode = "640";
|
||||
owner = "traefik";
|
||||
group = "traefik";
|
||||
};
|
||||
crowdsecApi.file = "${self}/secrets/crowdsecApi.age";
|
||||
};
|
||||
|
||||
systemd.services.traefik = {
|
||||
serviceConfig = {
|
||||
EnvironmentFile = [config.age.secrets.traefikEnv.path];
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
|
||||
services = {
|
||||
tailscale.permitCertUid = "traefik";
|
||||
traefik = {
|
||||
enable = true;
|
||||
|
||||
staticConfigOptions = {
|
||||
log = {
|
||||
level = "DEBUG";
|
||||
};
|
||||
|
||||
accesslog = {filepath = "/var/lib/traefik/logs/access.log";};
|
||||
|
||||
tracing = {};
|
||||
api = {
|
||||
dashboard = true;
|
||||
insecure = false;
|
||||
};
|
||||
|
||||
certificatesResolvers = {
|
||||
vpn.tailscale = {};
|
||||
letsencrypt = {
|
||||
acme = {
|
||||
email = "adam@cnst.dev";
|
||||
storage = "/var/lib/traefik/cert.json";
|
||||
dnsChallenge = {
|
||||
provider = "cloudflare";
|
||||
resolvers = [
|
||||
"1.1.1.1:53"
|
||||
"1.0.0.1:53"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
entryPoints = {
|
||||
# redis = {
|
||||
# address = "0.0.0.0:6381";
|
||||
# };
|
||||
# postgres = {
|
||||
# address = "0.0.0.0:5433";
|
||||
# };
|
||||
web = {
|
||||
address = ":80";
|
||||
forwardedHeaders.insecure = true;
|
||||
http.redirections.entryPoint = {
|
||||
to = "websecure";
|
||||
scheme = "https";
|
||||
permanent = true;
|
||||
};
|
||||
# http.middlewares = "crowdsec@file";
|
||||
};
|
||||
|
||||
websecure = {
|
||||
address = ":443";
|
||||
forwardedHeaders.insecure = true;
|
||||
http.tls = {
|
||||
certResolver = "letsencrypt";
|
||||
domains = [
|
||||
{
|
||||
main = "cnix.dev";
|
||||
sans = ["*.cnix.dev"];
|
||||
}
|
||||
{
|
||||
main = "ts.cnst.dev";
|
||||
sans = ["*ts.cnst.dev"];
|
||||
}
|
||||
];
|
||||
};
|
||||
# http.middlewares = "crowdsec@file";
|
||||
};
|
||||
|
||||
experimental = {
|
||||
address = ":1111";
|
||||
forwardedHeaders.insecure = true;
|
||||
};
|
||||
};
|
||||
|
||||
experimental = {
|
||||
# Install the Crowdsec Bouncer plugin
|
||||
plugins = {
|
||||
#enabled = "true";
|
||||
bouncer = {
|
||||
moduleName = "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin";
|
||||
version = "v1.4.5";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services = generateServices srv.services;
|
||||
|
||||
routers =
|
||||
(generateRouters srv.services config)
|
||||
// {
|
||||
api = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`traefik.${srv.domain}`)";
|
||||
service = "api@internal";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
};
|
||||
# middlewares = {
|
||||
# crowdsec = {
|
||||
# plugin = {
|
||||
# bouncer = {
|
||||
# enabled = "true";
|
||||
# logLevel = "DEBUG";
|
||||
# crowdsecLapiKeyFile = config.age.secrets.crowdsecApi.path;
|
||||
# crowdsecMode = "live";
|
||||
# crowdsecLapiHost = ":4223";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
66
modules/server/jellyfin/default.nix
Normal file
66
modules/server/jellyfin/default.nix
Normal file
@@ -0,0 +1,66 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
service = "jellyfin";
|
||||
cfg = config.server.${service};
|
||||
srv = config.server;
|
||||
in {
|
||||
options.server.${service} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${service}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "jellyfin.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Jellyfin";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "The Free Software Media System";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "jellyfin.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Media";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
jellyfin-ffmpeg
|
||||
];
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.jellyfin.loadBalancer.servers = [{url = "http://127.0.0.1:8096";}];
|
||||
routers = {
|
||||
jellyfin = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "jellyfin";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
61
modules/server/jellyseerr/default.nix
Normal file
61
modules/server/jellyseerr/default.nix
Normal file
@@ -0,0 +1,61 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "jellyseerr";
|
||||
srv = config.server;
|
||||
cfg = config.server.${service};
|
||||
in {
|
||||
options.server.${service} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${service}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${srv.domain}";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 5055;
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Jellyseerr";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Media request and discovery manager";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "jellyseerr.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Arr";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
port = cfg.port;
|
||||
};
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.jellyseerr.loadBalancer.servers = [{url = "http://127.0.0.1:${toString cfg.port}";}];
|
||||
routers = {
|
||||
jellyseerr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "jellyseerr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -3,24 +3,27 @@
|
||||
config,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
unit = "keepalived";
|
||||
cfg = config.server.infra.${unit};
|
||||
cfg = config.server.${unit};
|
||||
|
||||
hostCfg = hostname:
|
||||
if hostname == "sobotka"
|
||||
then {
|
||||
hostCfg =
|
||||
hostname:
|
||||
if hostname == "sobotka" then
|
||||
{
|
||||
ip = "192.168.88.14";
|
||||
priority = 20;
|
||||
state = "MASTER";
|
||||
}
|
||||
else if hostname == "ziggy"
|
||||
then {
|
||||
else if hostname == "ziggy" then
|
||||
{
|
||||
ip = "192.168.88.12";
|
||||
priority = 10;
|
||||
state = "BACKUP";
|
||||
}
|
||||
else throw "No keepalived config defined for host ${hostname}";
|
||||
else
|
||||
throw "No keepalived config defined for host ${hostname}";
|
||||
|
||||
_self = hostCfg config.networking.hostName;
|
||||
|
||||
@@ -31,8 +34,9 @@
|
||||
|
||||
# Remove self from peers
|
||||
peers = builtins.filter (ip: ip != _self.ip) allPeers;
|
||||
in {
|
||||
options.server.infra.${unit} = {
|
||||
in
|
||||
{
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
62
modules/server/lidarr/default.nix
Normal file
62
modules/server/lidarr/default.nix
Normal file
@@ -0,0 +1,62 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "lidarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${unit}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Lidarr";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Music collection manager";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "lidarr.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Arr";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.lidarr.loadBalancer.servers = [{url = "http://127.0.0.1:8686";}];
|
||||
routers = {
|
||||
lidarr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "lidarr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
64
modules/server/n8n/default.nix
Normal file
64
modules/server/n8n/default.nix
Normal file
@@ -0,0 +1,64 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "n8n";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${unit}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "n8n";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "A workflow automation platform";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "n8n.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Services";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
n8n = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.n8n.loadBalancer.servers = [{url = "http://127.0.0.1:5678";}];
|
||||
routers = {
|
||||
n8n = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "n8n";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -6,30 +6,64 @@
|
||||
...
|
||||
}: let
|
||||
unit = "nextcloud";
|
||||
cfg = config.server.services.${unit};
|
||||
cfg = config.server.${unit};
|
||||
srv = config.server;
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
adminpassFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
};
|
||||
adminuser = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "cnst";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "cloud.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Nextcloud";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "A safe home for all your data";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "nextcloud.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Services";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
age.secrets = {
|
||||
nextcloudAdminPass.file = "${self}/secrets/nextcloudAdminPass.age";
|
||||
nextcloudCloudflared.file = "${self}/secrets/nextcloudCloudflared.age";
|
||||
};
|
||||
|
||||
server.infra.fail2ban.jails.nextcloud = {
|
||||
serviceName = "${unit}";
|
||||
_groupsre = ''(?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)'';
|
||||
failRegex = ''
|
||||
^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
|
||||
^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
|
||||
^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
|
||||
'';
|
||||
datePattern = '',?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"'';
|
||||
server.fail2ban = lib.mkIf config.server.fail2ban.enable {
|
||||
jails = {
|
||||
nextcloud = {
|
||||
serviceName = "phpfpm-nextcloud";
|
||||
failRegex = "^.*Login failed:.*(Remote IP: <HOST>).*$";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
${unit} = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud32;
|
||||
package = pkgs.nextcloud31;
|
||||
hostName = "nextcloud";
|
||||
configureRedis = true;
|
||||
caching = {
|
||||
@@ -67,7 +101,7 @@ in {
|
||||
dbhost = "/run/postgresql";
|
||||
dbname = "nextcloud";
|
||||
adminuser = "cnst";
|
||||
adminpassFile = config.age.secrets.nextcloudAdminPass.path;
|
||||
adminpassFile = cfg.adminpassFile;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -86,9 +120,21 @@ in {
|
||||
forceSSL = false;
|
||||
};
|
||||
};
|
||||
|
||||
traefik.dynamicConfigOptions.http = {
|
||||
routers.nextcloud = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "nextcloud";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
services.nextcloud.loadBalancer.servers = [
|
||||
{url = "http://127.0.0.1:8182";}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
server.infra.postgresql.databases = [
|
||||
server.postgresql.databases = [
|
||||
{
|
||||
database = "nextcloud";
|
||||
}
|
||||
@@ -1,180 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkOption types;
|
||||
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
|
||||
cfg = config.server;
|
||||
in {
|
||||
options.server = {
|
||||
enable = lib.mkEnableOption "The server services and configuration variables";
|
||||
email = mkOption {
|
||||
default = "";
|
||||
type = types.str;
|
||||
description = ''
|
||||
Email name to be used to access the server services via Caddy reverse proxy
|
||||
'';
|
||||
};
|
||||
domain = mkOption {
|
||||
default = "";
|
||||
type = types.str;
|
||||
description = ''
|
||||
Domain name to be used to access the server services via Caddy reverse proxy
|
||||
'';
|
||||
};
|
||||
ip = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "127.0.0.1";
|
||||
description = "The local IP of the service.";
|
||||
};
|
||||
user = lib.mkOption {
|
||||
default = "share";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
User to run the server services as
|
||||
'';
|
||||
};
|
||||
group = lib.mkOption {
|
||||
default = "share";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Group to run the server services as
|
||||
'';
|
||||
};
|
||||
uid = lib.mkOption {
|
||||
default = 1000;
|
||||
type = lib.types.int;
|
||||
description = ''
|
||||
UID to run the server services as
|
||||
'';
|
||||
};
|
||||
gid = lib.mkOption {
|
||||
default = 1000;
|
||||
type = lib.types.int;
|
||||
description = ''
|
||||
GID to run the server services as
|
||||
'';
|
||||
};
|
||||
timeZone = lib.mkOption {
|
||||
default = "Europe/Stockholm";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Time zone to be used for the server services
|
||||
'';
|
||||
};
|
||||
services = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
|
||||
options = {
|
||||
enable = lib.mkEnableOption "the service";
|
||||
subdomain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = "The subdomain for the service (e.g., 'jellyfin')";
|
||||
};
|
||||
exposure = lib.mkOption {
|
||||
type = lib.types.enum ["local" "tunnel" "tailscale"];
|
||||
default = "local";
|
||||
description = "Controls where the service is exposed";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 80;
|
||||
description = "The port to host service on.";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/${name}";
|
||||
description = "Configuration directory for ${name}.";
|
||||
};
|
||||
cloudflared = lib.mkOption {
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = lib.literalExpression ''
|
||||
pkgs.writeText "cloudflare-credentials.json" '''
|
||||
{"AccountTag":"secret","TunnelSecret":"secret","TunnelID":"secret"}
|
||||
'''
|
||||
'';
|
||||
};
|
||||
tunnelId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "00000000-0000-0000-0000-000000000000";
|
||||
};
|
||||
};
|
||||
};
|
||||
description = "Cloudflare tunnel configuration for this service.";
|
||||
};
|
||||
homepage = lib.mkOption {
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = "Display name on the homepage.";
|
||||
};
|
||||
description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = "A short description for the homepage tile.";
|
||||
};
|
||||
icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Zervices c00l stuff";
|
||||
description = "Icon file name for the homepage tile.";
|
||||
};
|
||||
category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = "Homepage category grouping.";
|
||||
};
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
example = "/admin";
|
||||
description = "Optional path suffix for homepage links (e.g. /admin).";
|
||||
};
|
||||
};
|
||||
};
|
||||
description = "Homepage metadata for this service.";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
users = {
|
||||
groups.${cfg.group} = {
|
||||
gid = cfg.gid;
|
||||
};
|
||||
users.${cfg.user} = {
|
||||
uid = cfg.uid;
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
extraGroups = ifTheyExist [
|
||||
"audio"
|
||||
"video"
|
||||
"docker"
|
||||
"libvirtd"
|
||||
"qemu-libvirtd"
|
||||
"rtkit"
|
||||
"fail2ban"
|
||||
"vaultwarden"
|
||||
"qbittorrent"
|
||||
"lidarr"
|
||||
"prowlarr"
|
||||
"bazarr"
|
||||
"sonarr"
|
||||
"radarr"
|
||||
"media"
|
||||
"share"
|
||||
"render"
|
||||
"input"
|
||||
"authentik"
|
||||
"traefik"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
321
modules/server/podman/default.nix
Normal file
321
modules/server/podman/default.nix
Normal file
@@ -0,0 +1,321 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
srv = config.server;
|
||||
cfg = config.server.podman;
|
||||
|
||||
piholeUrl =
|
||||
if config.networking.hostName == "sobotka"
|
||||
then "pihole0"
|
||||
else if config.networking.hostName == "ziggy"
|
||||
then "pihole1"
|
||||
else throw "Unknown hostname";
|
||||
|
||||
getPiholeSecret = hostname:
|
||||
if hostname == "ziggy"
|
||||
then [config.age.secrets.piholeZiggy.path]
|
||||
else if hostname == "sobotka"
|
||||
then [config.age.secrets.pihole.path]
|
||||
else throw "Unknown hostname: ${hostname}";
|
||||
in {
|
||||
options.server.podman = {
|
||||
enable = lib.mkEnableOption "Enables Podman";
|
||||
gluetun.enable = lib.mkEnableOption "Enables gluetun";
|
||||
|
||||
qbittorrent = {
|
||||
enable = lib.mkEnableOption "Enable qBittorrent";
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "qbt.${srv.domain}";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 8080;
|
||||
description = "The port to host qBittorrent on.";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "qBittorrent";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Torrent client";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "qbittorrent.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Downloads";
|
||||
};
|
||||
};
|
||||
|
||||
slskd = {
|
||||
enable = lib.mkEnableOption "Enable Soulseek";
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "slskd.${srv.domain}";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 5030;
|
||||
description = "The port to host Soulseek webui on.";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "slskd";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Web-based Soulseek client";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "slskd.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Downloads";
|
||||
};
|
||||
};
|
||||
|
||||
pihole = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 8053;
|
||||
description = "The port to host PiHole on.";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${piholeUrl}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "PiHole";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Adblocking and DNS service";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "pi-hole.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Services";
|
||||
};
|
||||
homepage.path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/admin";
|
||||
description = "Optional path suffix for homepage links (e.g. /admin).";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
age.secrets = {
|
||||
pihole.file = "${self}/secrets/${config.networking.hostName}Pihole.age";
|
||||
slskd.file = "${self}/secrets/slskd.age";
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
containers.enable = true;
|
||||
podman.enable = true;
|
||||
};
|
||||
|
||||
networking.firewall = lib.mkIf cfg.pihole.enable {
|
||||
allowedTCPPorts = [
|
||||
53
|
||||
5335
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
5335
|
||||
];
|
||||
};
|
||||
|
||||
services.traefik = lib.mkMerge [
|
||||
(lib.mkIf cfg.pihole.enable {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services = {
|
||||
pihole.loadBalancer.servers = [{url = "http://localhost:${toString cfg.pihole.port}";}];
|
||||
};
|
||||
routers = {
|
||||
pihole = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.pihole.url}`)";
|
||||
service = "pihole";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.qbittorrent.enable {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services = {
|
||||
qbittorrent.loadBalancer.servers = [{url = "http://localhost:${toString cfg.qbittorrent.port}";}];
|
||||
};
|
||||
routers = {
|
||||
qbittorrent = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.qbittorrent.url}`)";
|
||||
service = "qbittorrent";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.slskd.enable {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services = {
|
||||
slskd.loadBalancer.servers = [{url = "http://localhost:${toString cfg.slskd.port}";}];
|
||||
};
|
||||
routers = {
|
||||
slskd = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.slskd.url}`)";
|
||||
service = "slskd";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
virtualisation.oci-containers.containers = lib.mkMerge [
|
||||
(lib.mkIf cfg.gluetun.enable {
|
||||
gluetun = {
|
||||
image = "qmcgaw/gluetun";
|
||||
ports = [
|
||||
"8388:8388"
|
||||
"58846:58846"
|
||||
"8080:8080"
|
||||
"5030:5030"
|
||||
"5031:5031"
|
||||
"50300:50300"
|
||||
];
|
||||
devices = ["/dev/net/tun:/dev/net/tun"];
|
||||
autoStart = true;
|
||||
extraOptions = [
|
||||
"--cap-add=NET_ADMIN"
|
||||
];
|
||||
volumes = ["/var:/gluetun"];
|
||||
environmentFiles = [
|
||||
config.age.secrets.gluetunEnvironment.path
|
||||
];
|
||||
environment = {
|
||||
DEV_MODE = "false";
|
||||
VPN_SERVICE_PROVIDER = "mullvad";
|
||||
VPN_TYPE = "wireguard";
|
||||
SERVER_CITIES = "Stockholm";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.qbittorrent.enable {
|
||||
qbittorrent = {
|
||||
image = "ghcr.io/hotio/qbittorrent:latest";
|
||||
autoStart = true;
|
||||
dependsOn = ["gluetun"];
|
||||
ports = [
|
||||
"8080:8080"
|
||||
"58846:58846"
|
||||
];
|
||||
extraOptions = [
|
||||
"--network=container:gluetun"
|
||||
];
|
||||
volumes = [
|
||||
"/var/lib/qbittorrent:/config:rw"
|
||||
"/mnt/data/media/downloads:/downloads:rw"
|
||||
];
|
||||
environmentFiles = [
|
||||
config.age.secrets.gluetunEnvironment.path
|
||||
];
|
||||
environment = {
|
||||
PUID = "994";
|
||||
PGID = "993";
|
||||
TZ = "Europe/Stockholm";
|
||||
WEBUI_PORT = "${builtins.toString cfg.qbittorrent.port}";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.slskd.enable {
|
||||
slskd = {
|
||||
image = "slskd/slskd:latest";
|
||||
autoStart = true;
|
||||
dependsOn = ["gluetun"];
|
||||
ports = [
|
||||
"5030:5030"
|
||||
"5031:5031"
|
||||
"50300:50300"
|
||||
];
|
||||
extraOptions = [
|
||||
"--network=container:gluetun"
|
||||
];
|
||||
volumes = [
|
||||
"/var/lib/slskd:/app:rw"
|
||||
"/mnt/data/media/downloads:/downloads:rw"
|
||||
];
|
||||
environmentFiles = [
|
||||
config.age.secrets.gluetunEnvironment.path
|
||||
config.age.secrets.slskd.path
|
||||
];
|
||||
environment = {
|
||||
TZ = "Europe/Stockholm";
|
||||
PUID = "981";
|
||||
PGID = "982";
|
||||
SLSKD_REMOTE_CONFIGURATION = "true";
|
||||
SLSKD_REMOTE_FILE_MANAGEMENT = "true";
|
||||
SLSKD_DOWNLOADS_DIR = "/downloads";
|
||||
SLSKD_UMASK = "022";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.pihole.enable {
|
||||
pihole = {
|
||||
autoStart = true;
|
||||
image = "pihole/pihole:latest";
|
||||
volumes = [
|
||||
"/var/lib/pihole:/etc/pihole/"
|
||||
"/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
|
||||
];
|
||||
environment = {
|
||||
TZ = "Europe/Stockholm";
|
||||
CUSTOM_CACHE_SIZE = "0";
|
||||
WEBTHEME = "default-darker";
|
||||
};
|
||||
environmentFiles = getPiholeSecret config.networking.hostName;
|
||||
ports = [
|
||||
"53:53/tcp"
|
||||
"53:53/udp"
|
||||
"8053:80/tcp"
|
||||
];
|
||||
extraOptions = [
|
||||
"--cap-add=NET_ADMIN"
|
||||
"--cap-add=SYS_NICE"
|
||||
"--cap-add=SYS_TIME"
|
||||
];
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -7,10 +7,10 @@
|
||||
}: let
|
||||
inherit (lib) types mkOption;
|
||||
|
||||
cfg = config.server.infra.postgresql;
|
||||
cfg = config.server.postgresql;
|
||||
in {
|
||||
options = {
|
||||
server.infra.postgresql = {
|
||||
server.postgresql = {
|
||||
upgradeTargetPackage = mkOption {
|
||||
type = types.nullOr types.package;
|
||||
default = null;
|
||||
@@ -7,7 +7,7 @@
|
||||
}: let
|
||||
inherit (lib) types mkOption;
|
||||
|
||||
cfg = config.server.infra.postgresql;
|
||||
cfg = config.server.postgresql;
|
||||
|
||||
database = {name, ...}: {
|
||||
options = {
|
||||
@@ -31,7 +31,7 @@
|
||||
};
|
||||
in {
|
||||
options = {
|
||||
server.infra.postgresql = {
|
||||
server.postgresql = {
|
||||
databases = mkOption {
|
||||
type = types.listOf (types.submodule database);
|
||||
default = [];
|
||||
80
modules/server/prowlarr/default.nix
Normal file
80
modules/server/prowlarr/default.nix
Normal file
@@ -0,0 +1,80 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "prowlarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${unit}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Prowlarr";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "PVR indexer";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "prowlarr.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Arr";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
${unit} = {
|
||||
enable = true;
|
||||
};
|
||||
flaresolverr = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services = {
|
||||
prowlarr = {
|
||||
loadBalancer.servers = [{url = "http://127.0.0.1:9696";}];
|
||||
};
|
||||
flaresolverr = {
|
||||
loadBalancer.servers = [{url = "http://127.0.0.1:8191";}];
|
||||
};
|
||||
};
|
||||
routers = {
|
||||
prowlarr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "prowlarr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
flaresolverr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`flaresolverr.${srv.domain}`)";
|
||||
service = "flaresolverr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
62
modules/server/radarr/default.nix
Normal file
62
modules/server/radarr/default.nix
Normal file
@@ -0,0 +1,62 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "radarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${unit}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Radarr";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Film collection manager";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "radarr.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Arr";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.radarr.loadBalancer.servers = [{url = "http://127.0.0.1:7878";}];
|
||||
routers = {
|
||||
radarr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "radarr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "bazarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
./bazarr
|
||||
./flaresolverr
|
||||
./gitea
|
||||
./homepage-dashboard
|
||||
./jellyfin
|
||||
./jellyseerr
|
||||
./lidarr
|
||||
./n8n
|
||||
./nextcloud
|
||||
./prowlarr
|
||||
./radarr
|
||||
./sonarr
|
||||
./uptime-kuma
|
||||
./vaultwarden
|
||||
];
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "flaresolverr";
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
${unit} = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,94 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
unit = "gitea";
|
||||
cfg = config.server.services.${unit};
|
||||
domain = "${cfg.subdomain}.${config.server.infra.www.url}";
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
age.secrets.giteaCloudflared.file = "${self}/secrets/giteaCloudflared.age";
|
||||
|
||||
server.infra = {
|
||||
fail2ban.jails.${unit} = {
|
||||
serviceName = "${unit}";
|
||||
failRegex = ''.*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>'';
|
||||
};
|
||||
|
||||
postgresql.databases = [
|
||||
{database = "gitea";}
|
||||
];
|
||||
};
|
||||
|
||||
services = {
|
||||
cloudflared = {
|
||||
enable = true;
|
||||
tunnels.${cfg.cloudflared.tunnelId} = {
|
||||
credentialsFile = cfg.cloudflared.credentialsFile;
|
||||
default = "http_status:404";
|
||||
ingress."${domain}".service = "http://localhost:${toString cfg.port}";
|
||||
};
|
||||
};
|
||||
|
||||
gitea = {
|
||||
enable = true;
|
||||
appName = "cnix code forge";
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
socket = "/run/postgresql";
|
||||
name = "gitea";
|
||||
user = "gitea";
|
||||
createDatabase = false;
|
||||
};
|
||||
|
||||
lfs.enable = true;
|
||||
|
||||
settings = {
|
||||
cors = {
|
||||
ENABLED = true;
|
||||
SCHEME = "https";
|
||||
ALLOW_DOMAIN = domain;
|
||||
};
|
||||
|
||||
log.MODE = "console";
|
||||
|
||||
mailer = {
|
||||
ENABLED = false;
|
||||
MAILER_TYPE = "sendmail";
|
||||
FROM = "noreply+adam@cnst.dev";
|
||||
SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
|
||||
};
|
||||
|
||||
picture.DISABLE_GRAVATAR = true;
|
||||
|
||||
repository = {
|
||||
DEFAULT_BRANCH = "main";
|
||||
DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
|
||||
DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
|
||||
};
|
||||
|
||||
indexer.REPO_INDEXER_ENABLED = true;
|
||||
|
||||
oauth2_client = {
|
||||
ENABLE_AUTO_REGISTRATION = true;
|
||||
ACCOUNT_LINKING = "auto";
|
||||
};
|
||||
|
||||
server = {
|
||||
DOMAIN = domain;
|
||||
LANDING_PAGE = "explore";
|
||||
HTTP_PORT = cfg.port;
|
||||
ROOT_URL = "https://${domain}/";
|
||||
};
|
||||
|
||||
security.DISABLE_GIT_HOOKS = false;
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
session.COOKIE_SECURE = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
unit = "jellyfin";
|
||||
cfg = config.server.services.${unit};
|
||||
srv = config.server;
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
jellyfin-ffmpeg
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "jellyseerr";
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
port = cfg.port;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "lidarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "n8n";
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
n8n = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "prowlarr";
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
${unit} = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "radarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "sonarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "uptime-kuma";
|
||||
cfg = config.server.services.${unit};
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
${unit} = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,59 +0,0 @@
|
||||
# from @fufexan & @notthebee
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
unit = "vaultwarden";
|
||||
cfg = config.server.services.${unit};
|
||||
domain = "${cfg.subdomain}.${config.server.infra.www.url}";
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
age.secrets = {
|
||||
vaultwardenCloudflared.file = "${self}/secrets/vaultwardenCloudflared.age";
|
||||
vaultwardenEnvironment.file = "${self}/secrets/vaultwardenEnvironment.age";
|
||||
};
|
||||
|
||||
server.infra.fail2ban.jails.${unit} = {
|
||||
serviceName = "${unit}";
|
||||
failRegex = ''^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$'';
|
||||
};
|
||||
|
||||
services = {
|
||||
cloudflared = {
|
||||
enable = true;
|
||||
tunnels.${cfg.cloudflared.tunnelId} = {
|
||||
credentialsFile = cfg.cloudflared.credentialsFile;
|
||||
default = "http_status:404";
|
||||
ingress."${domain}".service = "http://localhost:${toString cfg.port}";
|
||||
};
|
||||
};
|
||||
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.vaultwardenEnvironment.path;
|
||||
|
||||
backupDir = "/var/backup/vaultwarden";
|
||||
|
||||
config = {
|
||||
DOMAIN = "https://${domain}";
|
||||
SIGNUPS_ALLOWED = false;
|
||||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = cfg.port;
|
||||
IP_HEADER = "CF-Connecting-IP";
|
||||
|
||||
logLevel = "warn";
|
||||
extendedLogging = true;
|
||||
useSyslog = true;
|
||||
invitationsAllowed = true;
|
||||
showPasswordHint = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services.backup-vaultwarden.serviceConfig = {
|
||||
User = "root";
|
||||
Group = "root";
|
||||
};
|
||||
};
|
||||
}
|
||||
62
modules/server/sonarr/default.nix
Normal file
62
modules/server/sonarr/default.nix
Normal file
@@ -0,0 +1,62 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "sonarr";
|
||||
srv = config.server;
|
||||
cfg = config.server.${unit};
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${unit}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${unit}.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Sonarr";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Series collection manager";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "sonarr.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Arr";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.${unit} = {
|
||||
enable = true;
|
||||
user = srv.user;
|
||||
group = srv.group;
|
||||
};
|
||||
services.traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.sonarr.loadBalancer.servers = [{url = "http://127.0.0.1:8989";}];
|
||||
routers = {
|
||||
sonarr = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "sonarr";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
100
modules/server/traefik/default.nix
Normal file
100
modules/server/traefik/default.nix
Normal file
@@ -0,0 +1,100 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkEnableOption mkIf types;
|
||||
|
||||
cfg = config.server.traefik;
|
||||
getCloudflareCredentials = hostname:
|
||||
if hostname == "ziggy"
|
||||
then config.age.secrets.cloudflareDnsCredentialsZiggy.path
|
||||
else if hostname == "sobotka"
|
||||
then config.age.secrets.cloudflareDnsCredentials.path
|
||||
else throw "Unknown hostname: ${hostname}";
|
||||
in {
|
||||
options.server.traefik = {
|
||||
enable = mkEnableOption "Enable global Traefik reverse proxy with ACME";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
age.secrets.traefikEnv = {
|
||||
file = "${self}/secrets/traefikEnv.age";
|
||||
mode = "640";
|
||||
owner = "root";
|
||||
group = "traefik";
|
||||
};
|
||||
|
||||
systemd.services.traefik = {
|
||||
serviceConfig = {
|
||||
EnvironmentFile = [config.age.secrets.traefikEnv.path];
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
|
||||
services = {
|
||||
tailscale.permitCertUid = "traefik";
|
||||
traefik = {
|
||||
enable = true;
|
||||
|
||||
staticConfigOptions = {
|
||||
log = {
|
||||
level = "DEBUG";
|
||||
};
|
||||
|
||||
tracing = {};
|
||||
api = {
|
||||
dashboard = true;
|
||||
};
|
||||
certificatesResolvers = {
|
||||
tailscale.tailscale = {};
|
||||
letsencrypt = {
|
||||
acme = {
|
||||
email = "adam@cnst.dev";
|
||||
storage = "/var/lib/traefik/cert.json";
|
||||
dnsChallenge = {
|
||||
provider = "cloudflare";
|
||||
resolvers = [
|
||||
"1.1.1.1:53"
|
||||
"1.0.0.1:53"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
entryPoints = {
|
||||
redis = {
|
||||
address = "0.0.0.0:6381";
|
||||
};
|
||||
postgres = {
|
||||
address = "0.0.0.0:5433";
|
||||
};
|
||||
web = {
|
||||
address = "0.0.0.0:80";
|
||||
http.redirections.entryPoint = {
|
||||
to = "websecure";
|
||||
scheme = "https";
|
||||
permanent = true;
|
||||
};
|
||||
};
|
||||
websecure = {
|
||||
address = "0.0.0.0:443";
|
||||
http.tls = {
|
||||
certResolver = "letsencrypt";
|
||||
domains = [
|
||||
{
|
||||
main = "cnix.dev";
|
||||
sans = ["*.cnix.dev"];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -5,25 +5,7 @@
|
||||
...
|
||||
}: let
|
||||
unit = "unbound";
|
||||
cfg = config.server.infra.${unit};
|
||||
srv = config.server;
|
||||
|
||||
svcNames = lib.attrNames srv.services;
|
||||
|
||||
localARecords = builtins.concatLists (map (
|
||||
name: let
|
||||
s = srv.services.${name};
|
||||
in
|
||||
if s != null && s.enable && s.subdomain != null
|
||||
then [''"${s.subdomain}.${srv.domain}. A ${srv.ip}"'']
|
||||
else []
|
||||
)
|
||||
svcNames);
|
||||
|
||||
revParts = lib.lists.reverseList (lib.splitString "." srv.ip);
|
||||
revName = lib.concatStringsSep "." revParts;
|
||||
|
||||
localPTRs = ["${revName}.in-addr.arpa. PTR traefik.${srv.domain}"];
|
||||
cfg = config.server.${unit};
|
||||
|
||||
hostIp = hostname:
|
||||
if hostname == "ziggy"
|
||||
@@ -32,12 +14,11 @@
|
||||
then "192.168.88.14"
|
||||
else throw "No IP defined for host ${hostname}";
|
||||
in {
|
||||
options.server.infra.${unit} = {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
# resolved.enable = lib.mkForce false;
|
||||
@@ -116,10 +97,6 @@ in {
|
||||
"255.255.255.255/32"
|
||||
"2001:db8::/32"
|
||||
];
|
||||
local-data = localARecords;
|
||||
|
||||
# Example PTR entry: "14.88.168.192.in-addr.arpa. PTR traefik.cnix.dev."
|
||||
# local-data-ptr = localPTRs;
|
||||
};
|
||||
};
|
||||
};
|
||||
62
modules/server/uptime-kuma/default.nix
Normal file
62
modules/server/uptime-kuma/default.nix
Normal file
@@ -0,0 +1,62 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
unit = "uptime-kuma";
|
||||
cfg = config.server.${unit};
|
||||
srv = config.server;
|
||||
in {
|
||||
options.server.${unit} = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable ${unit}";
|
||||
};
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/uptime-kuma";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "uptime.${srv.domain}";
|
||||
};
|
||||
homepage.name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Uptime Kuma";
|
||||
};
|
||||
homepage.description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Service monitoring tool";
|
||||
};
|
||||
homepage.icon = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "uptime-kuma.svg";
|
||||
};
|
||||
homepage.category = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Services";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services = {
|
||||
${unit} = {
|
||||
enable = true;
|
||||
};
|
||||
traefik = {
|
||||
dynamicConfigOptions = {
|
||||
http = {
|
||||
services.uptime-kuma.loadBalancer.servers = [{url = "http://127.0.0.1:3001";}];
|
||||
routers = {
|
||||
uptime-kuma = {
|
||||
entryPoints = ["websecure"];
|
||||
rule = "Host(`${cfg.url}`)";
|
||||
service = "uptime-kuma";
|
||||
tls.certResolver = "letsencrypt";
|
||||
# middlewares = ["authentik"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
89
modules/server/vaultwarden/default.nix
Normal file
89
modules/server/vaultwarden/default.nix
Normal file
@@ -0,0 +1,89 @@
|
||||
# from @fufexan & @notthebee
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkIf mkEnableOption;
|
||||
vcfg = config.services.vaultwarden.config;
|
||||
cfg = config.server.vaultwarden;
|
||||
in {
|
||||
options = {
|
||||
server.vaultwarden = {
|
||||
enable = mkEnableOption "Enables vaultwarden";
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${cfg.domain}";
|
||||
};
|
||||
cloudflared = {
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = lib.literalExpression ''
|
||||
pkgs.writeText "cloudflare-credentials.json" '''
|
||||
{"AccountTag":"secret"."TunnelSecret":"secret","TunnelID":"secret"}
|
||||
'''
|
||||
'';
|
||||
};
|
||||
tunnelId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "00000000-0000-0000-0000-000000000000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
age.secrets = {
|
||||
vaultwardenCloudflared.file = "${self}/secrets/vaultwardenCloudflared.age";
|
||||
vaultwardenEnvironment.file = "${self}/secrets/vaultwardenEnvironment.age";
|
||||
};
|
||||
|
||||
server = {
|
||||
fail2ban = lib.mkIf config.server.fail2ban.enable {
|
||||
jails = {
|
||||
vaultwarden = {
|
||||
serviceName = "vaultwarden";
|
||||
failRegex = "^.*Username or password is incorrect. Try again. IP: <HOST>. Username: <F-USER>.*</F-USER>.$";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.backup-vaultwarden.serviceConfig = {
|
||||
User = "root";
|
||||
Group = "root";
|
||||
};
|
||||
|
||||
services = {
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.vaultwardenEnvironment.path;
|
||||
|
||||
backupDir = "/var/backup/vaultwarden";
|
||||
|
||||
config = {
|
||||
DOMAIN = "https://${cfg.url}";
|
||||
SIGNUPS_ALLOWED = false;
|
||||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = 8222;
|
||||
IP_HEADER = "CF-Connecting-IP";
|
||||
|
||||
logLevel = "warn";
|
||||
extendedLogging = true;
|
||||
useSyslog = true;
|
||||
invitationsAllowed = false;
|
||||
showPasswordHint = false;
|
||||
};
|
||||
};
|
||||
cloudflared = {
|
||||
enable = true;
|
||||
tunnels.${cfg.cloudflared.tunnelId} = {
|
||||
credentialsFile = cfg.cloudflared.credentialsFile;
|
||||
default = "http_status:404";
|
||||
ingress."${cfg.url}".service = "http://${vcfg.ROCKET_ADDRESS}:${toString vcfg.ROCKET_PORT}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,13 +1,22 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkIf mkEnableOption mkOption types;
|
||||
cfg = config.server.infra.www;
|
||||
in {
|
||||
options.server.infra.www = {
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
mkOption
|
||||
mkEnableOption
|
||||
mkIf
|
||||
types
|
||||
;
|
||||
cfg = config.server.www;
|
||||
srv = config.server;
|
||||
in
|
||||
{
|
||||
options.server.www = {
|
||||
enable = mkEnableOption {
|
||||
description = "Enable personal website";
|
||||
};
|
||||
@@ -18,12 +27,6 @@ in {
|
||||
Public domain name to be used to access the server services via Traefik reverse proxy
|
||||
'';
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 8283;
|
||||
description = "The port to host webservice on.";
|
||||
};
|
||||
|
||||
cloudflared = {
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
@@ -45,13 +48,13 @@ in {
|
||||
wwwCloudflared.file = "${self}/secrets/wwwCloudflared.age";
|
||||
};
|
||||
|
||||
server.infra = {
|
||||
fail2ban = {
|
||||
server = {
|
||||
fail2ban = lib.mkIf config.server.www.enable {
|
||||
jails = {
|
||||
nginx-404 = {
|
||||
serviceName = "nginx";
|
||||
failRegex = ''^.*\[error\].*directory index of.* is forbidden.*client: <HOST>.*$'';
|
||||
ignoreRegex = '''';
|
||||
ignoreRegex = "";
|
||||
maxRetry = 5;
|
||||
};
|
||||
};
|
||||
@@ -121,14 +124,14 @@ in {
|
||||
|
||||
services.traefik.dynamicConfigOptions.http = {
|
||||
routers.webfinger = {
|
||||
entryPoints = ["websecure"];
|
||||
entryPoints = [ "websecure" ];
|
||||
rule = "Host(`${cfg.url}`) && Path(`/.well-known/webfinger`)";
|
||||
service = "webfinger";
|
||||
tls.certResolver = "letsencrypt";
|
||||
};
|
||||
|
||||
services.webfinger.loadBalancer.servers = [
|
||||
{url = "http://127.0.0.1:8283";}
|
||||
{ url = "http://127.0.0.1:8283"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -2,7 +2,8 @@
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkOption types;
|
||||
|
||||
sshKeys = {
|
||||
@@ -15,14 +16,14 @@
|
||||
keyName = config.settings.accounts.sshUser or null;
|
||||
|
||||
selectedKey =
|
||||
if keyName != null
|
||||
then
|
||||
if keyName != null then
|
||||
lib.attrByPath [
|
||||
keyName
|
||||
] (builtins.abort "No SSH key defined for hostname/key '${toString keyName}'")
|
||||
sshKeys
|
||||
else builtins.abort "No accounts.sshUser provided, cannot select SSH key.";
|
||||
in {
|
||||
] (builtins.abort "No SSH key defined for hostname/key '${toString keyName}'") sshKeys
|
||||
else
|
||||
builtins.abort "No accounts.sshUser provided, cannot select SSH key.";
|
||||
in
|
||||
{
|
||||
options.settings.accounts = {
|
||||
username = mkOption {
|
||||
type = types.str;
|
||||
@@ -45,21 +46,5 @@ in {
|
||||
default = null;
|
||||
description = "Optional override for selecting an SSH key by name";
|
||||
};
|
||||
domains = lib.mkOption {
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
local = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "127.0.0.1";
|
||||
description = "The local domain of the host";
|
||||
};
|
||||
public = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "example.com";
|
||||
description = "The public domain of the host";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 t9iOEg lf7aPbZX2v3WGzE/KI/069DBObphqrDtjq7rhNriGl8
|
||||
Vv+Pqk6DbcE5R1A9135gVKroCex1xKsCLPETZdT3yTg
|
||||
-> ssh-ed25519 KUYMFA XxtBSmCwrQCZ9G3VcCrbzTdMshTK1pjlHPYj7fke818
|
||||
9tO2EcnHPD6v3TNeuZdL+zP39SM5R5q7om5sCFDB8lg
|
||||
-> ssh-ed25519 76RhUQ I6O/fYFRqYxExC9uLijZr6/kFze7uze0cIudCsl2jTo
|
||||
WAwb822vVj5UtUAdE1oVJ0/q6nQbWqdx0OHuGEogO7M
|
||||
-> ssh-ed25519 Jf8sqw gWBoe4HhXNw7Ih58lQ/L2vBoQfbU1ht8+ZSLUx/4TWk
|
||||
xor0ieJ2UI5bK4rSlCM0dX61PVbxYE37FNry0YSmHG4
|
||||
--- Cp8b3eTb3NfjPFvBE12a2c+Yni2jW6DZUK10IaXmmvo
|
||||
w<EFBFBD>xq<EFBFBD><EFBFBD>z:<3A>.{<7B>?<3F><><EFBFBD>f<EFBFBD><66> <1D><><16><>A<EFBFBD>jT<6A><54>{<7B>J <20><>
|
||||
@@ -1,12 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 t9iOEg RnlIwFO8LSwzj94G0Uru9qibXqOOpCU2kWWdNa2tRFU
|
||||
lIC3K/jjBMKRfLfepoNYIkBe5rhHuR0l3Uf1Xuk8uZg
|
||||
-> ssh-ed25519 KUYMFA k16GBRcaaSwJm/8+Vm2QBOu05u6eEro/7YYj7kbuNSU
|
||||
VCpt918MBBFfFZKKypV9pSwz/Zhsxr+Ob6YjFuJ/oL0
|
||||
-> ssh-ed25519 76RhUQ FIKn3nuOT1ywu6pmYBbpC54HhpJGeMFejp5c0XibfAY
|
||||
WDsh/5G4wXYt21yIDxmI6u1l/xPOdZRxgTazf6QLXP8
|
||||
-> ssh-ed25519 Jf8sqw 2EvD96Ec8h97ACoOBYzn1Ugx4ZyYSHIRnsmtB5lb/XQ
|
||||
mFY8O8qwWWihsLe5ayB5iGm1JUY2B/9el/XSf5sPe7M
|
||||
--- uuwibRk7LS4/lUx9gwL+x5NMrxLjGM1Yf55bzjxQTKM
|
||||
<EFBFBD>H<>Ԅ6K<36>A<01>~<7E><>)!B<08><>^S!W d<><64>$.:S'c<>d<EFBFBD><64><EFBFBD>_WW<57>Bj<42>,<2C><>l<EFBFBD><6C><EFBFBD><EFBFBD><EFBFBD> V<>S<EFBFBD><53>h<EFBFBD>
|
||||
h<EFBFBD><EFBFBD><12><>k
|
||||
Binary file not shown.
@@ -1,11 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 t9iOEg MLi7IOM8QlpvlCMSmo4SwZbTwZ9pyysSbiMMuWD/dyU
|
||||
cotV5TJf7oyyXIaAmu8n9Ie1rl27i8w7hsduwtQFnis
|
||||
-> ssh-ed25519 KUYMFA BhFQ/RXOH8L7gl/FSabAUv28fbaod+muvTGSV3rYQSs
|
||||
fWqwAkhSAmg6YB+yEtj0e83Q4XO/r+TBnMTN7vXBNqU
|
||||
-> ssh-ed25519 76RhUQ b1fDfGPNdJ9c3wtr8ww0mW5K4fKJxpxxTZy/ZCECWzs
|
||||
qhbvucUrv7dzOPKUmUaRs/AtXtwQfy/qp5HnaYzZ5eQ
|
||||
-> ssh-ed25519 Jf8sqw 19D2ztjyxJfGQAiUOTdgWyC0ZFso/wrC9VPEkmI34U8
|
||||
PavT5O8M6Zc2Num9Hb2sY+F3UmMPqRgjUZxuvP6AhyM
|
||||
--- uYOcbsL7JWoDF2mRUDLhXrbp6ssLFbQ9+a6RhAXNNPA
|
||||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD> X<><58>PC<50><43>h<EFBFBD>;
|
||||
@@ -48,7 +48,6 @@ in {
|
||||
"homepageEnvironment.age".publicKeys = kima ++ sobotka;
|
||||
"cloudflareFirewallApiKey.age".publicKeys = kima ++ sobotka;
|
||||
"vaultwardenCloudflared.age".publicKeys = kima ++ sobotka;
|
||||
"giteaCloudflared.age".publicKeys = kima ++ sobotka;
|
||||
"nextcloudCloudflared.age".publicKeys = kima ++ sobotka;
|
||||
"nextcloudAdminPass.age".publicKeys = kima ++ sobotka;
|
||||
"cloudflareDnsApiToken.age".publicKeys = kima ++ sobotka;
|
||||
@@ -62,9 +61,6 @@ in {
|
||||
"traefikEnv.age".publicKeys = kima ++ sobotka;
|
||||
"wwwCloudflared.age".publicKeys = kima ++ sobotka;
|
||||
"authentikCloudflared.age".publicKeys = kima ++ sobotka;
|
||||
"sobotkaTsAuth.age".publicKeys = kima ++ sobotka;
|
||||
"mikrotikSecret.age".publicKeys = kima ++ sobotka;
|
||||
"crowdsecApi.age".publicKeys = kima ++ sobotka;
|
||||
|
||||
# Ziggy-specific
|
||||
"cloudflareDnsCredentialsZiggy.age".publicKeys = kima ++ ziggy;
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 t9iOEg fftdt8orBZoM0sDRAXf0TScDLosNWWWIg7JmmuunuWM
|
||||
2IfpTH6ptSyLnBtBStkk7SINct6LtBHrL6h22BVNb+k
|
||||
-> ssh-ed25519 KUYMFA HI04mnVOGPRsRhnqCkbO4My/sBq5v/3UYxDVcfIe4RM
|
||||
fcSApUYCnJlpzVW5e77CFoSHamEmP+6ztMmzp2WlJvY
|
||||
-> ssh-ed25519 76RhUQ c2FbmTXGl/F+1acZFEJUoenkxiIGdoXkT67VgxvoFHg
|
||||
eWExqblEp5VIeXuPEuvj4QAIWtFX5KLfMyh6/fZ9bnA
|
||||
-> ssh-ed25519 Jf8sqw IAcUf70EufTyjsva8XIlXOfPxwXvtr9AFl0LwrdAMgc
|
||||
bY098fejLaFbUMX0iF89gz8kiOGZHI8JIg4NzX4ItFw
|
||||
--- WNqpLyRM2EqISbZky++NbKLw4GCEgwbz2O5+VO7aKzE
|
||||
<EFBFBD><EFBFBD><1A><>(5<0F>q <09><>m<EFBFBD>C<EFBFBD><43>G<EFBFBD> r<><72><16><><EFBFBD><EFBFBD> ޒ3<DE92><33><17> <1F>7<><37><EFBFBD>rG<72>i<EFBFBD>c7<63>i<EFBFBD>P<EFBFBD><50>l<EFBFBD><19>7<EFBFBD><<3C>r?cGo<47>^ǚ<>W<0E>V<EFBFBD><56>f ,2<>Qg!<21>t_<74>
|
||||
Binary file not shown.
@@ -11,7 +11,7 @@
|
||||
enable = true;
|
||||
};
|
||||
chromium = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
};
|
||||
discord = {
|
||||
enable = true;
|
||||
|
||||
Reference in New Issue
Block a user