server-configuration/configuration.nix

764 lines
24 KiB
Nix
Raw Normal View History

# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{ config, lib, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
2023-12-29 22:10:20 -07:00
./hardware/samsehu.nix
2024-02-04 13:39:46 -07:00
./samsehu/matrix-conduit.nix
];
# Use the `systemd-boot` boot loader
boot.loader.systemd-boot.enable = true;
2024-01-06 14:41:24 -07:00
# Added following instructions of openzfs configuration
# randomly generated with `head -c4 /dev/urandom | od -A none -t x4`
networking.hostId = "3e52e44f";
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.forceImportRoot = false;
2024-01-09 15:21:20 -07:00
boot.zfs.extraPools = [ "zroot" ];
2024-01-06 14:41:24 -07:00
networking.hostName = "samsehu"; # Define your hostname.
# Pick only one of the below networking options.
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
# Set your time zone.
time.timeZone = "America/Denver";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# useXkbConfig = true; # use xkb.options in tty.
# };
# Enable CUPS to print documents.
services.printing.enable = true;
# Enable sound.
sound.enable = true;
hardware.pulseaudio.enable = true;
# Define a user account. Don't forget to set a password with passwd.
users.users.geemili = {
isNormalUser = true;
extraGroups = [ "wheel" ]; # Enable sudo for the user.
packages = with pkgs; [ ];
};
users.users.desttinghim = {
isNormalUser = true;
extraGroups = [ "wheel" ]; # Enable sudo for the user.
packages = with pkgs; [ ];
};
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
helix
wget
git
2024-01-06 12:30:05 -07:00
juanfont-headscale.headscale # install to allow debugging/control of headscale using the CLI
# Plugins for cockpit
cockpit-tailscale
2024-01-09 12:52:08 -07:00
cockpit-zfs-manager
];
2024-01-06 16:11:50 -07:00
environment.variables = {
EDITOR = "hx";
VISUAL = "hx";
};
# List services that you want to enable:
# Enable the OpenSSH daemon.
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "no";
};
services.cockpit = {
enable = true;
openFirewall = true;
settings = {
WebService = {
Origins = "https://cockpit.samsehu.perli.casa wss://cockpit.samsehu.perli.casa";
ProtocolHeader = "X-Forwarded-Proto";
LoginTo = false;
};
};
};
services.udisks2.enable = true;
2024-01-09 17:06:27 -07:00
# Multimedia group
users.groups.multimedia = {};
users.users.lidarr.extraGroups = [ "aria2" ];
users.users.radarr.extraGroups = [ "aria2" ];
users.users.readarr.extraGroups = [ "aria2" ];
users.users.sonarr.extraGroups = [ "aria2" ];
users.users.bazarr.extraGroups = [ "multimedia" "aria2" ];
2024-01-09 17:06:27 -07:00
systemd.tmpfiles.rules = [
"d /zroot/media 0770 - multimedia - -"
];
2024-01-09 17:06:27 -07:00
services.jellyfin = { enable = true; group = "multimedia"; };
services.lidarr = { enable = true; group = "multimedia"; };
services.radarr = { enable = true; group = "multimedia"; };
services.readarr = { enable = true; group = "multimedia"; };
services.sonarr = { enable = true; group = "multimedia"; };
services.bazarr = { enable = true; user = "bazarr"; group = "multimedia"; };
2024-01-09 17:51:59 -07:00
services.prowlarr = { enable = true; };
2024-01-09 02:38:09 -07:00
users.users.komga.extraGroups = [ "multimedia" ];
services.komgaCustom = {
enable = true;
group = "multimedia";
settings = {
spring.security.oauth2.client = {
registration.dex = {
provider = "dex";
client-id = "komga";
client-secret = "insecure_secret";
client-name = "Komga";
scope = "openid,email";
authorization-grant-type = "authorization_code";
redirect-uri = "{baseUrl}/{action}/oauth2/code/{registrationId}";
};
provider.dex = {
user-name-attribute = "sub";
issuer-uri = "https://dex.samsehu.perli.casa";
};
};
};
};
2024-01-09 22:38:19 -07:00
systemd.services."netns@" = {
description = "%I network namespace";
before = [ "network.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
};
};
2024-01-07 23:53:40 -07:00
2024-01-09 22:38:19 -07:00
systemd.services.wg = {
description = "wg network interface";
bindsTo = [ "netns@wg.service" ];
requires = [ "network-online.target" ];
after = [ "netns@wg.service" ];
2024-01-09 22:38:19 -07:00
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
2024-01-09 22:38:19 -07:00
ExecStart = with pkgs; writers.writeBash "wg-up" ''
set -e
2024-01-09 23:32:20 -07:00
# Create wireguard
2024-01-09 22:38:19 -07:00
${iproute}/bin/ip link add wg0 type wireguard
# move to wg network namespace
${iproute}/bin/ip link set wg0 netns wg
2024-01-09 23:32:20 -07:00
# Connect to vpn
${iproute}/bin/ip -n wg address add 10.65.64.220/32 dev wg0
${iproute}/bin/ip -n wg -6 address add fc00:bbbb:bbbb:bb01::2:40db/128 dev wg0
${iproute}/bin/ip netns exec wg ${wireguard-tools}/bin/wg setconf wg0 /var/wireguard-keys/chief-frog.conf
2024-01-09 23:32:20 -07:00
# Open network
${iproute}/bin/ip -n wg link set dev lo up
${iproute}/bin/ip -n wg link set wg0 up
${iproute}/bin/ip -n wg route add default dev wg0
${iproute}/bin/ip -n wg -6 route add default dev wg0
2024-01-09 22:38:19 -07:00
'';
ExecStop = with pkgs; writers.writeBash "wg-down" ''
${iproute}/bin/ip -n wg route del default dev wg0
${iproute}/bin/ip -n wg -6 route del default dev wg0
${iproute}/bin/ip -n wg link del wg0
2024-01-09 22:38:19 -07:00
'';
};
};
2024-01-09 23:32:20 -07:00
services.aria2 = {
enable = true;
extraArguments = "--bt-external-ip=10.65.64.220 --input-file=/var/lib/aria2/aria2.session --save-session-interval=60";
2024-01-09 23:32:20 -07:00
};
2024-01-09 22:38:19 -07:00
systemd.services."aria2" = {
bindsTo = [ "netns@wg.service" ];
requires = [ "network-online.target" ];
after = [ "wg.service" ];
serviceConfig = {
NetworkNamespacePath = "/var/run/netns/wg";
};
};
# reverse proxy the aria2 rpc from the `wg` network namespace to a unix domain socket
systemd.services."aria2-unix-domain-rpc" = {
bindsTo = [ "aria2.service" ];
after = [ "aria2.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
NetworkNamespacePath = "/var/run/netns/wg";
Type = "simple";
User = config.services.caddy.user;
Group = config.services.caddy.group;
RuntimeDirectory = "aria2";
ExecStart = with pkgs; writers.writeBash "aria2-unix-domain-rpc-listener" ''
set -e
${socat}/bin/socat UNIX-LISTEN:/run/aria2/rpc.sock,reuseaddr,fork TCP:localhost:6800
'';
};
2024-01-09 22:38:19 -07:00
};
2024-01-11 21:43:13 -07:00
systemd.services.dex.serviceConfig = {
StateDirectory = "dex";
WorkingDirectory = "%S/dex";
};
2024-01-08 00:07:34 -07:00
services.dex = {
enable = true;
environmentFile = config.age.secrets.DEX_ENVIRONMENT_FILE.path;
settings = {
issuer = "https://dex.samsehu.perli.casa";
web.http = "127.0.0.1:5556";
storage = {
2024-01-11 21:29:38 -07:00
type = "sqlite3";
config.file = "./dex.db";
};
2024-01-08 00:07:34 -07:00
# services that can get a token from our dex instance
staticClients = [
{
id = "forgejo";
secretEnv = "OIDC_APP_SECRET_FORGEJO";
2024-01-08 00:07:34 -07:00
name = "Forgejo";
redirectURIs = [ "https://git.samsehu.perli.casa/user/oauth2/dex/callback" ];
}
{
id = "headscale";
secretEnv = "OIDC_APP_SECRET_HEADSCALE";
name = "Headscale";
redirectURIs = [ "https://headscale.samsehu.perli.casa/oidc/callback" ];
}
{
id = "nextcloud";
secret = "insecure_secret";
name = "Nextcloud";
2024-01-11 18:54:11 -07:00
redirectURIs = [ "https://nextcloud.samsehu.perli.casa/apps/oidc_login/oidc" "https://nextcloud.samsehu.perli.casa/index.php/apps/oidc_login/oidc" ];
}
2024-01-12 00:45:48 -07:00
{
id = "jellyfin";
secret = "insecure_secret";
name = "Jellyfin";
redirectURIs = [ "https://jellyfin.samsehu.perli.casa/sso/OID/redirect/dex" ];
}
{
id = "komga";
secret = "insecure_secret";
name = "Komga";
redirectURIs = [ "https://komga.samsehu.perli.casa/login/oauth2/code/dex" ];
}
2024-01-08 00:07:34 -07:00
];
# authentication sources
connectors = [
{
type = "ldap";
id = "lldap";
name = "LLDAP";
2024-01-08 00:07:34 -07:00
config = {
host = "127.0.0.1:3890";
2024-01-08 00:07:34 -07:00
insecureNoSSL = true;
insecureSkipVerify = true;
startTLS = false;
2024-01-11 21:49:07 -07:00
bindDN = "uid=Immovable1809,ou=people,dc=samsehu,dc=perli,dc=casa";
bindPW = "$LLDAP_ADMIN_PASSWORD";
2024-01-08 00:07:34 -07:00
userSearch = {
baseDN = "ou=people,dc=samsehu,dc=perli,dc=casa";
username = "uid";
2024-01-08 00:07:34 -07:00
idAttr = "uid";
emailAttr = "mail";
nameAttr = "displayName";
preferredUsernameAttr = "uid";
2024-01-08 00:07:34 -07:00
};
groupSearch = {
baseDN = "ou=groups,dc=samsehu,dc=perli,dc=casa";
filter = "(objectClass=groupOfUniqueNames)";
2024-01-08 00:07:34 -07:00
userMatchers = [
{ userAttr = "DN"; groupAttr = "member"; }
2024-01-08 00:07:34 -07:00
];
nameAttr = "cn";
2024-01-08 00:07:34 -07:00
};
};
}
];
};
};
services.blocky = {
enable = true;
settings = {
ports.dns = 53;
ports.http = 4000;
upstreams = {
# Picks 2 random resolvers and returns answer from fastest one. Read docs for more info.
strategy = "parallel_best";
groups.default = [
# CloudFlare
"https://one.one.one.one/dns-query"
# OpenDNS
"https://doh.opendns.com/dns-query"
# Google
"8.8.8.8"
"8.8.4.4"
"2001:4860:4860::8888"
"2001:4860:4860::8844"
# Comcast/Our ISP
"75.75.75.75"
"75.75.76.76"
];
};
bootstrapDns = {
upstream = "https://one.one.one.one/dns-query";
ips = [ "1.1.1.1" "1.0.0.1" ];
};
blocking = {
blackLists = {
ads = ["https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"];
};
clientGroupsBlock = {
default = [ "ads" ];
};
};
2024-01-06 12:30:05 -07:00
customDNS = {
rewrite = {
"cockpit.samsehu.perli.casa" = "samsehu.perli.casa";
"git.samsehu.perli.casa" = "samsehu.perli.casa";
"nextcloud.samsehu.perli.casa" = "samsehu.perli.casa";
2024-01-06 12:30:05 -07:00
};
mapping = {
"samsehu.perli.casa" = "192.168.0.69";
2024-01-06 12:30:05 -07:00
};
};
};
};
services.forgejo = {
enable = true;
settings = {
server.ROOT_URL = "https://git.samsehu.perli.casa/";
server.HTTP_ADDR = "127.0.0.1";
};
};
# lldap LDAP authentication server
users.users.lldap = {
# allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
isSystemUser = true;
group = "lldap";
};
users.groups.lldap = {};
services.lldap = {
enable = true;
settings = {
ldap_base_dn = "dc=samsehu,dc=perli,dc=casa";
# Sets the root administrator's user name
ldap_user_dn = "Immovable1809";
http_host = "127.0.0.1";
};
environment = {
LLDAP_LDAP_USER_PASS_FILE = config.age.secrets.LLDAP_ADMIN_PASSWORD.path;
};
};
2023-12-30 12:00:30 -07:00
# Dynamic DNS through duck dns
users.users.dynamicdns = {
# allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
isSystemUser = true;
group = "dynamicdns";
};
users.groups.dynamicdns = {};
systemd.services.dynamic-dns-updater = {
serviceConfig.User = "dynamicdns";
path = [ pkgs.curl ];
script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} https://www.duckdns.org/update";
2023-12-30 12:00:30 -07:00
startAt = "hourly";
};
systemd.timers.dynamic-dns-updater = {
timerConfig.RandomizedDelaySec = "15m";
};
2024-02-04 15:57:53 -07:00
systemd.services.dynamic-dns-updater6 = {
serviceConfig.User = "dynamicdns";
path = [ pkgs.curl ];
script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} --url-query ipv6=$(ip -j -6 addr show scope global | jq -r .[0].addr_info.[0].local) https://www.duckdns.org/update";
startAt = "hourly";
};
systemd.timers.dynamic-dns-updater6 = {
timerConfig.RandomizedDelaySec = "15m";
};
2023-12-30 12:00:30 -07:00
2024-01-06 15:45:08 -07:00
# Next cloud setup
services.nginx.enable = false;
services.nextcloud = {
enable = true;
2024-01-06 17:49:51 -07:00
hostName = "nextcloud.samsehu.perli.casa";
config.adminpassFile = "/var/nextcloud-admin-pass";
config.trustedProxies = [
"100.64.0.3"
];
caching.apcu = true;
2024-01-07 01:27:54 -07:00
# OIDC configuration
extraOptions = {
overwritewebroot = "/";
allow_user_to_change_display_name = false;
lost_password_link = "disabled";
oidc_login_provider_url = "https://dex.samsehu.perli.casa";
oidc_login_client_id = "nextcloud";
oidc_login_client_secret = "insecure_secret";
oidc_login_auto_redirect = true;
oidc_login_end_session_redirect = false;
oidc_login_button_text = "Log in with Dex";
oidc_login_hide_password_form = false;
oidc_login_use_id_token = true;
config.oidc_login_attributes = {
"id" = "preferred_username";
"name" = "name";
"mail" = "mail";
"groups" = "groups";
};
oidc_login_default_group = "oidc";
oidc_login_use_external_storage = true;
oidc_login_scope = "openid profile email groups";
oidc_login_proxy_ldap = false;
oidc_login_disable_registration = false;
oidc_login_redir_fallback = false;
oidc_login_alt_login_page = "assets/login.php";
oidc_login_tls_verify = true;
oidc_create_groups = false;
oidc_login_webdav_enabled = false;
oidc_login_password_authentication = false;
oidc_login_public_key_caching_time = 86400;
oidc_login_min_time_between_jwks_requests = 10;
oidc_login_well_known_caching_time = 86400;
oidc_login_update_avatar = false;
};
2024-01-07 01:27:54 -07:00
# Auto update apps
2024-01-07 01:30:57 -07:00
autoUpdateApps.enable = true;
2024-01-07 15:39:41 -07:00
extraApps = {
oidc_login = pkgs.fetchNextcloudApp {
appName = "OpenID Connect Login";
appVersion = "3.0.2";
sha256 = "sha256-cN5azlThKPKRVip14yfUNR85of5z+N6NVI7sg6pSGQI=";
license = "agpl3Plus";
url = "https://github.com/pulsejet/nextcloud-oidc-login/releases/download/v3.0.2/oidc_login.tar.gz";
};
gpoddersync = pkgs.fetchNextcloudApp {
2024-01-07 15:39:41 -07:00
appName = "Gpodder Sync";
appVersion = "3.8.2";
sha256 = "sha256-eeBvRZUDVIaym0ngfPD2d7aY3SI/7lPWkrYPnqSh5Kw=";
license = "agpl3Plus";
url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz";
};
};
2024-01-06 15:45:08 -07:00
};
services.phpfpm.pools.nextcloud.settings = {
"listen.owner" = config.services.caddy.user;
"listen.group" = config.services.caddy.group;
};
2023-12-30 12:00:30 -07:00
# Reverse proxy with Caddy
services.caddy = {
enable = true;
globalConfig = ''
email "fresh.car0178@geemili.xyz"
'';
virtualHosts."lldap.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:17170
}
respond 403
'';
virtualHosts."headscale.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:64639
'';
virtualHosts."cockpit.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:9090
}
respond 403
'';
virtualHosts."git.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:3000
'';
virtualHosts."jellyfin.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:8096
2023-12-30 12:00:30 -07:00
'';
2024-01-06 15:45:08 -07:00
virtualHosts."nextcloud.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
# https://docs.nextcloud.com/server/27/admin_manual/issues/general_troubleshooting.html#service-discovery
redir /.well-known/carddav /remote.php/dav 301
redir /.well-known/caldav /remote.php/dav 301
root * ${config.services.nextcloud.package}
php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket} {
root ${config.services.nextcloud.package}
capture_stderr
}
file_server
}
respond 403
2024-01-06 15:45:08 -07:00
'';
2024-01-07 14:08:19 -07:00
2024-01-08 00:07:34 -07:00
virtualHosts."dex.samsehu.perli.casa".extraConfig = ''
2024-01-10 00:59:22 -07:00
reverse_proxy localhost:5556
2024-01-08 00:07:34 -07:00
'';
2024-01-07 23:08:10 -07:00
2024-01-08 21:05:21 -07:00
virtualHosts."aria.samsehu.perli.casa".extraConfig = ''
2024-01-29 23:07:28 -07:00
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48 private_ranges
handle @connected_via_tailscale {
handle /rpc {
reverse_proxy unix//run/aria2/rpc.sock
}
handle /jsonrpc {
reverse_proxy unix//run/aria2/rpc.sock
}
handle_path /ariang* {
root * ${pkgs.ariang}/share/ariang
file_server
}
redir / /ariang/#!/settings/rpc/set?protocol=wss&host=aria.samsehu.perli.casa&port=443&secret=YXJpYTJycGM=&interface=jsonrpc
2024-01-08 21:45:50 -07:00
}
respond 403
2024-01-07 23:53:40 -07:00
'';
2024-01-09 02:43:17 -07:00
virtualHosts."lid.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:8686
}
respond 403
'';
virtualHosts."rad.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:7878
}
respond 403
'';
virtualHosts."read.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:8787
}
respond 403
'';
virtualHosts."son.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:8989
}
respond 403
2024-01-09 02:43:17 -07:00
'';
2024-01-13 00:47:56 -07:00
virtualHosts."baz.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:6767
}
respond 403
'';
2024-01-09 17:51:59 -07:00
virtualHosts."prowl.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:9696
}
respond 403
'';
virtualHosts."komga.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:25600
'';
2023-12-30 12:00:30 -07:00
};
# Headscale for access to the network while away from home
users.users.headscale = {
isSystemUser = true;
group = "headscale";
};
users.groups.headscale = {};
services.headscale = {
enable = true;
2024-01-06 12:30:05 -07:00
package = pkgs.juanfont-headscale.headscale;
settings = {
server_url = "https://headscale.samsehu.perli.casa";
listen_addr = "127.0.0.1:64639";
metrics_listen_addr = "127.0.0.1:64640";
tls_cert_path = null;
tls_key_path = null;
2024-01-01 01:57:51 -07:00
dns_config = {
2024-01-18 14:15:44 -07:00
override_local_dns = true;
2024-01-06 16:01:49 -07:00
nameservers = [ "100.64.0.3" ];
2024-01-01 01:57:51 -07:00
magic_dns = true;
base_domain = "ts.samsehu.perli.casa";
restricted_nameservers = {
"samsehu.perli.casa" = [ "100.64.0.3" ];
};
extra_records = [
{ name = "samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "cockpit.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "git.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "nextcloud.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
2024-01-09 18:43:41 -07:00
{ name = "lldap.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
2024-01-08 00:07:34 -07:00
{ name = "dex.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "jellyfin.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
2024-01-08 21:05:21 -07:00
{ name = "aria.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "lid.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "rad.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "read.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "son.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
2024-01-13 00:47:56 -07:00
{ name = "baz.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
2024-01-09 17:51:59 -07:00
{ name = "prowl.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "komga.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
];
2024-01-01 01:57:51 -07:00
};
2024-01-06 12:30:05 -07:00
oidc = {
issuer = "https://dex.samsehu.perli.casa";
client_id = "headscale";
client_secret_path = config.age.secrets.OIDC_APP_SECRET_HEADSCALE.path;
scope = [ "openid" "profile" "email" ];
};
2024-01-06 12:30:05 -07:00
acl_policy_path = pkgs.writeText "acl_policy.hujson" ''
{
"groups": {
2024-01-06 14:42:34 -07:00
"group:servers": [
"samsehu",
],
2024-01-06 12:30:05 -07:00
"group:admin": [
"geemili",
"desttinghim",
],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["*:*"],
}
],
"ssh": [
{
"action": "accept",
2024-01-06 14:42:34 -07:00
"src": ["group:admin"],
"dst": ["group:servers"],
"users": ["group:admin", "geemili", "desttinghim", "forgejo"],
2024-01-06 12:30:05 -07:00
},
{
"action": "accept",
"src": ["geemili"],
"dst": ["geemili"],
"users": ["geemili"],
},
2024-01-06 12:30:05 -07:00
],
}
'';
};
};
services.tailscale.enable = true;
# Enable automatic upgrades
system.autoUpgrade.enable = true;
system.autoUpgrade.allowReboot = true;
system.autoUpgrade.flake = "git+http://127.0.0.1:3000/Twins/server-configuration.git";
# Enable automatic garbage collection
nix.gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
nix.settings.trusted-users = [ "geemili" ];
# Open ports in the firewall.
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [
# Blocky DNS
53
# Blocky API
4000
2023-12-30 12:00:30 -07:00
# Caddy HTTP and HTTPS
80
443
];
networking.firewall.allowedUDPPorts = [
# Blocky DNS
53
2023-12-30 22:14:03 -07:00
# mDNS
5353
# Headscale UDP port for STUN protocol
3478
];
2023-12-29 19:50:55 -07:00
# Use systemd-resolved and set networkmanager to allow mdns
2024-01-06 14:42:34 -07:00
services.resolved = {
enable = true;
extraConfig = ''
DNSStubListener=false
'';
};
2023-12-29 19:50:55 -07:00
networking.networkmanager.connectionConfig."connection.mdns" = 2; # 2 == yes
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "23.11"; # Did you read the comment?
}