feat: Add configuration for nextcloud server

.gitignore

@@ -1 +0,0 @@
-result

agenix-config-module.nix

@@ -1,19 +1,4 @@
 {
-  age.secrets.samsehu_DUCK_DNS_TOKEN = {
+  age.secrets.samsehu_NFSN_API_KEY.file = ./secrets/samsehu_NFSN_API_KEY.age;
-    file = ./secrets/samsehu_DUCK_DNS_TOKEN.age;
+  age.secrets.samsehu_NFSN_LOGIN.file = ./secrets/samsehu_NFSN_LOGIN.age;
-    owner = "dynamicdns";
-    group = "dynamicdns";
-  };
-  age.secrets.LLDAP_ADMIN_PASSWORD = {
-    file = ./secrets/samsehu_LLDAP_ADMIN_PASSWORD.age;
-    owner = "lldap";
-    group = "lldap";
-  };
-  age.secrets.DEX_ENVIRONMENT_FILE.file = ./secrets/samsehu_DEX_ENVIRONMENT_FILE.age;
-  age.secrets.OIDC_APP_SECRET_HEADSCALE = {
-    file = ./secrets/samsehu_OIDC_APP_SECRET_HEADSCALE.age;
-    owner = "headscale";
-    group = "headscale";
-  };
-  age.secrets.FORGEJO_ACTIONS_RUNNER.file = ./secrets/samsehu_FORGEJO_ACTIONS_RUNNER.age;
 }

configuration.nix

@@ -7,20 +7,12 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-      ./hardware/samsehu.nix
+      ./hardware-configuration.nix
-      ./samsehu/matrix-conduit.nix
     ];
 
   # Use the `systemd-boot` boot loader
   boot.loader.systemd-boot.enable = true;
   
-  # Added following instructions of openzfs configuration
-  # randomly generated with `head -c4 /dev/urandom | od -A none -t x4`
-  networking.hostId = "3e52e44f"; 
-  boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.forceImportRoot = false;
-  boot.zfs.extraPools = [ "zroot" ];
-
   networking.hostName = "samsehu"; # Define your hostname.
 
   # Pick only one of the below networking options.
@@ -63,245 +55,23 @@
   environment.systemPackages = with pkgs; [
     helix
     wget
-    git
-
-    juanfont-headscale.headscale # install to allow debugging/control of headscale using the CLI
-
-    # Plugins for cockpit
-    cockpit-tailscale
-    cockpit-zfs-manager
   ];
 
-  environment.variables = {
-    EDITOR = "hx";
-    VISUAL = "hx";
-  };
-
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
-  services.openssh = {
+  services.openssh.enable = true;
-    enable = true;
-    settings.PasswordAuthentication = false;
-    settings.KbdInteractiveAuthentication = false;
-    settings.PermitRootLogin = "no";
-  };
 
   services.cockpit = {
     enable = true;
     openFirewall = true;
-    settings = {
-      WebService = {
-        Origins = "https://cockpit.samsehu.perli.casa wss://cockpit.samsehu.perli.casa";
-        ProtocolHeader = "X-Forwarded-Proto";
-        LoginTo = false;
-      };
-    };
   };
 
   services.udisks2.enable = true;
 
-  # Multimedia group
+  services.jellyfin = {
-  users.groups.multimedia = {};
-  users.users.lidarr.extraGroups = [ "aria2" ];
-  users.users.radarr.extraGroups = [ "aria2" ];
-  users.users.readarr.extraGroups = [ "aria2" ];
-  users.users.sonarr.extraGroups = [ "aria2" ];
-  users.users.bazarr.extraGroups = [ "multimedia" "aria2" ];
-  systemd.tmpfiles.rules = [
-    "d /zroot/media 0770 - multimedia - -"
-  ];
-
-  services.jellyfin = { enable = true; group = "multimedia"; };
-  services.lidarr   = { enable = true; group = "multimedia"; };
-  services.radarr   = { enable = true; group = "multimedia"; };
-  services.readarr  = { enable = true; group = "multimedia"; };
-  services.sonarr   = { enable = true; group = "multimedia"; };
-  services.bazarr   = { enable = true; user = "bazarr"; group = "multimedia"; };
-  services.prowlarr = { enable = true; };
-
-  users.users.komga.extraGroups = [ "multimedia" ];
-  services.komgaCustom = {
     enable = true;
-    group = "multimedia";
+    openFirewall = true;
-    settings = {
-      spring.security.oauth2.client = {
-        registration.dex = {
-          provider = "dex";
-          client-id = "komga";
-          client-secret = "insecure_secret";
-          client-name = "Komga";
-          scope = "openid,email";
-          authorization-grant-type = "authorization_code";
-          redirect-uri = "{baseUrl}/{action}/oauth2/code/{registrationId}";
-        };
-        provider.dex = {
-          user-name-attribute = "sub";
-          issuer-uri = "https://dex.samsehu.perli.casa";
-        };
-      };
-    };
-  };
-
-  systemd.services."netns@" = {
-    description = "%I network namespace";
-    before = [ "network.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
-      ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
-    };
-  };
-
-  systemd.services.wg = {
-    description = "wg network interface";
-    bindsTo = [ "netns@wg.service" ];
-    requires = [ "network-online.target" ];
-  after = [ "netns@wg.service" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = with pkgs; writers.writeBash "wg-up" ''
-        set -e
-        # Create wireguard
-        ${iproute}/bin/ip link add wg0 type wireguard
-        # move to wg network namespace
-        ${iproute}/bin/ip link set wg0 netns wg
-        # Connect to vpn
-        ${iproute}/bin/ip -n wg address add 10.65.64.220/32 dev wg0
-        ${iproute}/bin/ip -n wg -6 address add fc00:bbbb:bbbb:bb01::2:40db/128 dev wg0
-        ${iproute}/bin/ip netns exec wg ${wireguard-tools}/bin/wg setconf wg0 /var/wireguard-keys/chief-frog.conf
-        # Open network
-        ${iproute}/bin/ip -n wg link set dev lo up
-        ${iproute}/bin/ip -n wg link set wg0 up
-        ${iproute}/bin/ip -n wg route add default dev wg0
-        ${iproute}/bin/ip -n wg -6 route add default dev wg0
-      '';
-      ExecStop = with pkgs; writers.writeBash "wg-down" ''
-        ${iproute}/bin/ip -n wg route del default dev wg0
-        ${iproute}/bin/ip -n wg -6 route del default dev wg0
-        ${iproute}/bin/ip -n wg link del wg0
-      '';
-    };
-  };
-
-  services.aria2 = {
-    enable = true;
-    extraArguments = "--bt-external-ip=10.65.64.220 --input-file=/var/lib/aria2/aria2.session --save-session-interval=60";
-  };
-  systemd.services."aria2" = {
-    bindsTo = [ "netns@wg.service" ];
-    requires = [ "network-online.target" ];
-    after = [ "wg.service" ];
-    serviceConfig = {
-      NetworkNamespacePath = "/var/run/netns/wg";
-    };
-  };
-
-  # reverse proxy the aria2 rpc from the `wg` network namespace to a unix domain socket
-  systemd.services."aria2-unix-domain-rpc" = {
-    bindsTo = [ "aria2.service" ];
-    after = [ "aria2.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      NetworkNamespacePath = "/var/run/netns/wg";
-      Type = "simple";
-      User = config.services.caddy.user;
-      Group = config.services.caddy.group;
-      RuntimeDirectory = "aria2";
-      ExecStart = with pkgs; writers.writeBash "aria2-unix-domain-rpc-listener" ''
-        set -e
-        ${socat}/bin/socat UNIX-LISTEN:/run/aria2/rpc.sock,reuseaddr,fork TCP:localhost:6800
-      '';
-    };
-  };
-  
-  systemd.services.dex.serviceConfig = {
-    StateDirectory = "dex";
-    WorkingDirectory = "%S/dex";
-  };
-  services.dex = {
-    enable = true;
-    environmentFile = config.age.secrets.DEX_ENVIRONMENT_FILE.path;
-    settings = {
-      issuer = "https://dex.samsehu.perli.casa";
-      web.http = "127.0.0.1:5556";
-
-      storage = {
-        type = "sqlite3";
-        config.file = "./dex.db";
-      };
-
-      # services that can get a token from our dex instance
-      staticClients = [
-        {
-          id = "forgejo";
-          secretEnv = "OIDC_APP_SECRET_FORGEJO";
-          name = "Forgejo";
-          redirectURIs = [ "https://git.samsehu.perli.casa/user/oauth2/dex/callback" ];
-        }
-        {
-          id = "headscale";
-          secretEnv = "OIDC_APP_SECRET_HEADSCALE";
-          name = "Headscale";
-          redirectURIs = [ "https://headscale.samsehu.perli.casa/oidc/callback" ];
-        }
-        {
-          id = "nextcloud";
-          secret = "insecure_secret";
-          name = "Nextcloud";
-          redirectURIs = [ "https://nextcloud.samsehu.perli.casa/apps/oidc_login/oidc"  "https://nextcloud.samsehu.perli.casa/index.php/apps/oidc_login/oidc" ];
-        }
-        {
-          id = "jellyfin";
-          secret = "insecure_secret";
-          name = "Jellyfin";
-          redirectURIs = [ "https://jellyfin.samsehu.perli.casa/sso/OID/redirect/dex" ];
-        }
-        {
-          id = "komga";
-          secret = "insecure_secret";
-          name = "Komga";
-          redirectURIs = [ "https://komga.samsehu.perli.casa/login/oauth2/code/dex" ];
-        }
-      ];
-
-      # authentication sources
-      connectors = [
-        {
-          type = "ldap";
-          id = "lldap";
-          name = "LLDAP";
-          config = {
-            host = "127.0.0.1:3890";
-            insecureNoSSL = true;
-            insecureSkipVerify = true;
-            startTLS = false;
-            bindDN = "uid=Immovable1809,ou=people,dc=samsehu,dc=perli,dc=casa";
-            bindPW = "$LLDAP_ADMIN_PASSWORD";
-
-            userSearch = {
-              baseDN = "ou=people,dc=samsehu,dc=perli,dc=casa";
-              username = "uid";
-              idAttr = "uid";
-              emailAttr = "mail";
-              nameAttr = "displayName";
-              preferredUsernameAttr = "uid";
-            };
-
-            groupSearch = {
-              baseDN = "ou=groups,dc=samsehu,dc=perli,dc=casa";
-              filter = "(objectClass=groupOfUniqueNames)";
-              userMatchers = [
-                { userAttr = "DN"; groupAttr = "member"; }
-              ];
-              nameAttr = "cn";
-            };
-          };
-        }
-      ];
-    };
   };
 
   services.blocky = {
@@ -339,377 +109,107 @@
           default = [ "ads" ];
         };
       };
-      customDNS = {
-        rewrite = {
-          "cockpit.samsehu.perli.casa" = "samsehu.perli.casa";
-          "git.samsehu.perli.casa" = "samsehu.perli.casa";
-          "nextcloud.samsehu.perli.casa" = "samsehu.perli.casa";
-        };
-        mapping = {
-          "samsehu.perli.casa" = "192.168.0.69";
-        };
-      };
     };
   };
 
   services.forgejo = {
     enable = true;
-    lfs.enable = true;
-    settings = {
-      server.ROOT_URL = "https://git.samsehu.perli.casa/";
-      server.HTTP_ADDR = "127.0.0.1";
-      actions.ENABLED = true;
-    };
   };
 
-  virtualisation.docker = {
-    enable = true;
-  };
-
-  services.gitea-actions-runner = {
-    package = pkgs.forgejo-actions-runner;
-    instances.default = {
-      enable = true;
-      name = "monolith";
-      url = "https://git.samsehu.perli.casa";
-      tokenFile = config.age.secrets.FORGEJO_ACTIONS_RUNNER.path;
-      labels = [ ];
-    };
-  };
-
-  # lldap LDAP authentication server
-  users.users.lldap = {
-    # allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
-    isSystemUser = true;
-    group = "lldap";
-  };
-  users.groups.lldap = {};
   services.lldap = {
     enable = true;
     settings = {
-      ldap_base_dn = "dc=samsehu,dc=perli,dc=casa";
+      ldap_base_dn = "dc=twins,dc=pearson";
       # Sets the root administrator's user name
-      ldap_user_dn = "Immovable1809";
+      ldap_user_dn = "admin";
-      http_host = "127.0.0.1";
+      # Default administrator password
-    };
+      ldap_user_pass = "extending pulsate nastily";
-    environment = {
-      LLDAP_LDAP_USER_PASS_FILE = config.age.secrets.LLDAP_ADMIN_PASSWORD.path;
     };
   };
 
-  # Dynamic DNS through duck dns
+  services.nginx = {
-  users.users.dynamicdns = {
+    enable = true;
-    # allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
+
-    isSystemUser = true;
+    # Use recommended settings
-    group = "dynamicdns";
+    recommendedGzipSettings = true;
-  };
+    recommendedOptimisation = true;
-  users.groups.dynamicdns = {};
+    recommendedProxySettings = true;
-  systemd.services.dynamic-dns-updater = {
+    recommendedTlsSettings = true;
-    serviceConfig.User = "dynamicdns";
+
-    path = [ pkgs.curl ];
+    # Only allow PFS-enabled ciphers with AES256
-    script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} https://www.duckdns.org/update";
+    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-    startAt = "hourly";
+
-  };
+    # Setup Nextcloud virtual host to listen on ports
-  systemd.timers.dynamic-dns-updater = {
+    virtualHosts = {
-    timerConfig.RandomizedDelaySec = "15m";
+      "nextcloud.samsehu.local" = {
-  };
+        # Force HTTP redirect to HTTPS
-  systemd.services.dynamic-dns-updater6 = {
+        forceSSL = true;
-    serviceConfig.User = "dynamicdns";
+        # LetsEncrypt
-    path = [ pkgs.curl ];
+        enableACME = true;
-    script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} --url-query ipv6=$(ip -j -6 addr show scope global | jq -r .[0].addr_info.[0].local) https://www.duckdns.org/update";
+      };
-    startAt = "hourly";
+    };
-  };
-  systemd.timers.dynamic-dns-updater6 = {
-    timerConfig.RandomizedDelaySec = "15m";
   };
 
-  # Next cloud setup
-  services.nginx.enable = false;
   services.nextcloud = {
     enable = true;
-    hostName = "nextcloud.samsehu.perli.casa";
+    hostName = "nextcloud.samsehu.local";
-    config.adminpassFile = "/var/nextcloud-admin-pass";
+    # Enable built-in virtual host management
-    config.trustedProxies = [
+    # Takes care of somewhat complicated setup
-      "100.64.0.3"
+    nginx.enable = true;
-    ];
-    caching.apcu = true;
 
-    # OIDC configuration
+    # Use HTTPS for links
-    extraOptions = {
+    https = true;
-        overwritewebroot = "/";
 
-        allow_user_to_change_display_name = false;
-        lost_password_link = "disabled";
-        oidc_login_provider_url = "https://dex.samsehu.perli.casa";
-        oidc_login_client_id = "nextcloud";
-        oidc_login_client_secret = "insecure_secret";
-        oidc_login_auto_redirect = true;
-        oidc_login_end_session_redirect = false;
-        oidc_login_button_text = "Log in with Dex";
-        oidc_login_hide_password_form = false;
-        oidc_login_use_id_token = true;
-        config.oidc_login_attributes = {
-          "id" = "preferred_username";
-          "name" = "name";
-          "mail" = "mail";
-          "groups" = "groups";
-        };
-        oidc_login_default_group = "oidc";
-        oidc_login_use_external_storage = true;
-        oidc_login_scope = "openid profile email groups";
-        oidc_login_proxy_ldap = false;
-        oidc_login_disable_registration = false;
-        oidc_login_redir_fallback = false;
-        oidc_login_alt_login_page = "assets/login.php";
-        oidc_login_tls_verify = true;
-        oidc_create_groups = false;
-        oidc_login_webdav_enabled = false;
-        oidc_login_password_authentication = false;
-        oidc_login_public_key_caching_time = 86400;
-        oidc_login_min_time_between_jwks_requests = 10;
-        oidc_login_well_known_caching_time = 86400;
-        oidc_login_update_avatar = false;
-    };
-
-    # Auto update apps
     autoUpdateApps.enable = true;
+    audoUpdateApps.startAt = "05:00:00";
 
-    extraApps = {
+    config = {
-      oidc_login = pkgs.fetchNextcloudApp {
+      overwriteProtocol = "https";
-        appName = "OpenID Connect Login";
-        appVersion = "3.0.2";
-        sha256 = "sha256-cN5azlThKPKRVip14yfUNR85of5z+N6NVI7sg6pSGQI=";
-        license = "agpl3Plus";
-        url = "https://github.com/pulsejet/nextcloud-oidc-login/releases/download/v3.0.2/oidc_login.tar.gz";
-      };
-      gpoddersync = pkgs.fetchNextcloudApp { 
-        appName = "Gpodder Sync";
-        appVersion = "3.8.2";
-        sha256 = "sha256-eeBvRZUDVIaym0ngfPD2d7aY3SI/7lPWkrYPnqSh5Kw=";
-        license = "agpl3Plus";
-        url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz";
-      };
-    };
-  };
-  services.phpfpm.pools.nextcloud.settings = {
-    "listen.owner" = config.services.caddy.user;
-    "listen.group" = config.services.caddy.group;
-  };
 
-  # Reverse proxy with Caddy
+      dbtype = "pgsql";
-  services.caddy = {
+      dbuser = "nextcloud";
-    enable = true;
+      dbhost = "/run/postgresql";
-    globalConfig = ''
+      dbname = "nextcloud";
-      email "fresh.car0178@geemili.xyz"
+      dbpassFile = "/var/nextcloud-db-pass";
-    '';
 
-    virtualHosts."lldap.samsehu.perli.casa".extraConfig = ''
+      adminpassFile = "/path/to/admin-pass-file";
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      adminuser = "admin";
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:17170
-      }
-      respond 403
-    '';
-
-    virtualHosts."headscale.samsehu.perli.casa".extraConfig = ''
-      reverse_proxy localhost:64639
-    '';
-
-    virtualHosts."cockpit.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:9090
-      }
-      respond 403
-    '';
-
-    virtualHosts."git.samsehu.perli.casa".extraConfig = ''
-      reverse_proxy localhost:3000
-    '';
-
-    virtualHosts."jellyfin.samsehu.perli.casa".extraConfig = ''
-      reverse_proxy localhost:8096
-    '';
-
-    virtualHosts."nextcloud.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        # https://docs.nextcloud.com/server/27/admin_manual/issues/general_troubleshooting.html#service-discovery
-        redir /.well-known/carddav /remote.php/dav 301
-        redir /.well-known/caldav /remote.php/dav 301
-
-        root * ${config.services.nextcloud.package}
-        php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket} {
-          root ${config.services.nextcloud.package}
-          capture_stderr
-        }
-        file_server
-      }
-      respond 403
-    '';
-
-    virtualHosts."dex.samsehu.perli.casa".extraConfig = ''
-      reverse_proxy localhost:5556
-    '';
-
-    virtualHosts."aria.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48 private_ranges
-      handle @connected_via_tailscale {
-        handle /rpc {
-          reverse_proxy unix//run/aria2/rpc.sock
-        }
-        handle /jsonrpc {
-          reverse_proxy unix//run/aria2/rpc.sock
-        }
-        handle_path /ariang* {
-          root * ${pkgs.ariang}/share/ariang
-          file_server
-        }
-        redir / /ariang/#!/settings/rpc/set?protocol=wss&host=aria.samsehu.perli.casa&port=443&secret=YXJpYTJycGM=&interface=jsonrpc
-      }
-      respond 403
-    '';
-
-    virtualHosts."lid.arr.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:8686
-      }
-      respond 403
-    '';
-    virtualHosts."rad.arr.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:7878
-      }
-      respond 403
-    '';
-    virtualHosts."read.arr.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:8787
-      }
-      respond 403
-    '';
-    virtualHosts."son.arr.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:8989
-      }
-      respond 403
-    '';
-    virtualHosts."baz.arr.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:6767
-      }
-      respond 403
-    '';
-    virtualHosts."prowl.arr.samsehu.perli.casa".extraConfig = ''
-      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
-      handle @connected_via_tailscale {
-        reverse_proxy localhost:9696
-      }
-      respond 403
-    '';
-    virtualHosts."komga.samsehu.perli.casa".extraConfig = ''
-      reverse_proxy localhost:25600
-    '';
-  };
-
-  # Headscale for access to the network while away from home
-  users.users.headscale = {
-    isSystemUser = true;
-    group = "headscale";
-  };
-  users.groups.headscale = {};
-  services.headscale = {
-    enable = true;
-    package = pkgs.juanfont-headscale.headscale;
-    settings = {
-      server_url = "https://headscale.samsehu.perli.casa";
-      listen_addr = "127.0.0.1:64639";
-      metrics_listen_addr = "127.0.0.1:64640";
-      tls_cert_path = null;
-      tls_key_path = null;
-
-      dns_config = {
-        override_local_dns = true;
-        nameservers = [ "100.64.0.3" ];
-        magic_dns = true;
-        base_domain = "ts.samsehu.perli.casa";
-        restricted_nameservers = {
-          "samsehu.perli.casa" = [ "100.64.0.3" ];
-        };
-        extra_records = [
-          { name = "samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "cockpit.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "git.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "nextcloud.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "lldap.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "dex.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "jellyfin.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "aria.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "lid.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "rad.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "read.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "son.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "baz.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "prowl.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-          { name = "komga.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
-        ];
-      };
-
-      oidc = {
-        issuer = "https://dex.samsehu.perli.casa";
-        client_id = "headscale";
-        client_secret_path = config.age.secrets.OIDC_APP_SECRET_HEADSCALE.path;
-        scope = [ "openid" "profile" "email" ];
-      };
-
-      acl_policy_path = pkgs.writeText "acl_policy.hujson" ''
-        {
-          "groups": {
-            "group:servers": [
-              "samsehu",
-            ],
-            "group:admin": [
-              "geemili",
-              "desttinghim",
-            ],
-          },
-          "acls": [
-            {
-              "action": "accept",
-              "src": ["group:admin"],
-              "dst": ["*:*"],
-            }
-          ],
-          "ssh": [
-            {
-              "action": "accept",
-              "src": ["group:admin"],
-              "dst": ["group:servers"],
-              "users": ["group:admin", "geemili", "desttinghim", "forgejo"],
-            },
-            {
-              "action": "accept",
-              "src": ["geemili"],
-              "dst": ["geemili"],
-              "users": ["geemili"],
-            },
-          ],
-        }
-      '';
     };
   };
 
-  services.tailscale.enable = true;
+  services.postgresql = {
+    enable = true;
+
+    ensureDatabases = [ "nextcloud" ];
+    ensureUsers = [
+      { name = "nextcloud";
+        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+
+  systemd.services."nextcloud-setup" = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+
+  # ACME client service for configuring SSL certificate
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "fresh.car0178@geemili.xyz";
+    certs."samsehu.perli.casa" = {
+      domain = "samsehu.perli.casa";
+      dnsProvider = "nearlyfreespeech";
+      credentialFiles = {
+        "NEARLYFREESPECH_API_KEY" = config.age.secrets.samsehu_NFSN_API_KEY.path;
+        "NEARLYFREESPECH_LOGIN" = config.age.secrets.samsehu_NFSN_LOGIN.path;
+      };
+    };
+  };
 
   # Enable automatic upgrades
   system.autoUpgrade.enable = true;
   system.autoUpgrade.allowReboot = true;
-  system.autoUpgrade.flake = "git+http://127.0.0.1:3000/Twins/server-configuration.git";
 
   # Enable automatic garbage collection
   nix.gc = {
@@ -718,39 +218,35 @@
     options = "--delete-older-than 30d";
   };
 
-  nix.settings.trusted-users = [ "geemili" ];
-
   # Open ports in the firewall.
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [
     # Blocky DNS
     53
 
+    # Nextcloud / nginx
+    80 
+    443
+
     # Blocky API
     4000
 
-    # Caddy HTTP and HTTPS
+    # Forgejo web interface
-    80
+    3000
-    443
+
+    # lldap LDAP
+    3890
+
+    # lldap HTTP; user login and administration
+    17170
   ];
   networking.firewall.allowedUDPPorts = [
     # Blocky DNS
     53
-
-    # mDNS
-    5353
-
-    # Headscale UDP port for STUN protocol
-    3478
   ];
 
   # Use systemd-resolved and set networkmanager to allow mdns
-  services.resolved = {
+  services.resolved.enable = true;
-    enable = true;
-    extraConfig = ''
-      DNSStubListener=false
-    '';
-  };
   networking.networkmanager.connectionConfig."connection.mdns" = 2; # 2 == yes
 
   # Copy the NixOS configuration file and link it from the resulting system

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1716561646,
+        "lastModified": 1703433843,
-        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
+        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
+        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
         "type": "github"
       },
       "original": {
@@ -45,24 +45,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -84,35 +66,13 @@
         "type": "github"
       }
     },
-    "juanfont-headscale": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1702219574,
-        "narHash": "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=",
-        "owner": "juanfont",
-        "repo": "headscale",
-        "rev": "6049ec758ca46b5c6ee7abba4f3d472fb1e2ffa6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "juanfont",
-        "ref": "v0.23.0-alpha2",
-        "repo": "headscale",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1716633019,
+        "lastModified": 1703467016,
-        "narHash": "sha256-xim1b5/HZYbWaZKyI7cn9TJCM6ewNVZnesRr00mXeS4=",
+        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9d29cd266cebf80234c98dd0b87256b6be0af44e",
+        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
         "type": "github"
       },
       "original": {
@@ -125,7 +85,6 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "juanfont-headscale": "juanfont-headscale",
         "nixpkgs": "nixpkgs"
       }
     },
@@ -143,21 +102,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -5,33 +5,16 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    juanfont-headscale = {
+  };
-      url = "github:juanfont/headscale/v0.23.0-alpha2";
+
-      inputs.nixpkgs.follows = "nixpkgs";
+  outputs = { self, nixpkgs, agenix }: {
+    nixosConfigurations.samsehu = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        ./agenix-config-module.nix
+        ./configuration.nix
+        agenix.nixosModules.default
+      ];
     };
   };
-
-  outputs = { self, nixpkgs, agenix, juanfont-headscale }: {
-      packages.x86_64-linux = let pkgs = import nixpkgs { system = "x86_64-linux"; }; in rec {
-        cockpit-tailscale = pkgs.callPackage ./pkgs/cockpit-tailscale.nix {};
-        cockpit-zfs-manager = pkgs.callPackage ./pkgs/cockpit-zfs-manager.nix {};
-      };
-
-      nixosConfigurations.samsehu = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ({config, pkgs, ...}: {
-            nixpkgs.overlays = [ (final: prev: {
-              juanfont-headscale = juanfont-headscale.packages.${prev.system};
-              cockpit-tailscale = self.packages.${prev.system}.cockpit-tailscale;
-              cockpit-zfs-manager = self.packages.${prev.system}.cockpit-zfs-manager;
-            })];
-          })
-          ./agenix-config-module.nix
-          ./configuration.nix
-          ./services/komga.nix
-          agenix.nixosModules.default
-        ];
-      };
-  };
 }

pkgs/cockpit-tailscale.nix

@@ -1,15 +0,0 @@
-{ lib, stdenv, fetchzip }:
-stdenv.mkDerivation rec {
-  pname = "cockpit-tailscale";
-  version = "0.0.6";
-
-  src = fetchzip {
-    url = "https://github.com/spotsnel/cockpit-tailscale/releases/download/v${version}/cockpit-tailscale-v${version}.tar.gz";
-    sha256 = "sha256-ESUZdt8GVEToyrv6UP8lOff67LsumdJAY1lXvC3fBaI=";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/cockpit
-    cp -r ${src} $out/share/cockpit/tailscale
-  '';
-}

pkgs/cockpit-zfs-manager.nix

@@ -1,17 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }:
-stdenv.mkDerivation rec {
-  pname = "cockpit-zfs-manager";
-  version = "816af25099fccc46a3bff5f831b39d98ef33d514";
-
-  src = fetchFromGitHub {
-    owner = "leroycep";
-    repo = "cockpit-zfs-manager";
-    rev = "${version}";
-    hash = "sha256-aLdsHHVVG6eJrvh3B4grZkDEbCZyDJjX2PuKkON8UcI=";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/cockpit
-    cp -r ${src}/zfs $out/share/cockpit/zfs
-  '';
-}

samsehu/matrix-conduit.nix

@@ -1,35 +0,0 @@
-
-# Edit this configuration file to define what should be installed on
-# your system. Help is available in the configuration.nix(5) man page, on
-# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
-
-{ config, lib, pkgs, ... }:
-
-let
-  homeserver-url = "samsehu.perli.casa";
-in
-{
-  # configure matrix-conduit as a server to host chat communications with end-to-end encryption
-  services.matrix-conduit = {
-    enable = true;    
-    settings.global = {
-      server_name = "${homeserver-url}";
-      trusted_servers = [];
-    };
-  };
-
-  # Reverse proxy with Caddy
-  services.caddy.virtualHosts."${homeserver-url}" = {
-    serverAliases = [ "${homeserver-url}:8448" ];
-    extraConfig =  ''
-      respond /.well-known/matrix/server `{ "m.server": "${homeserver-url}" }` 200
-      respond /.well-known/matrix/client `{ "m.homeserver": { "base_url": "https://${homeserver-url}" } }` 200
-      reverse_proxy /_matrix/* localhost:${toString config.services.matrix-conduit.settings.global.port}
-    '';
-  };
-
-  # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
-  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
-}
-

secrets/samsehu_FORGEJO_ACTIONS_RUNNER.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yXNDbw n4kYnQIXz7rkvduE9oJ5XRxJfZJTUILuZ0r9s2+rW2g
-OtBaRY+mIQrPXS0+rg99u2aElUeguwJPk+yoK5jO+Z0
--> ssh-ed25519 BTX+xA HIqdxxh8HwoDjfznL4caRc7HvkWYwn2S2h3bsHdaIRc
-rOFUTg2u/S83YJpJTAzRfVL3rdot+4Z1orEGYV+4J58
---- 8BznEX1nb6xDa74lWVT2fgJo7MzFXLhnapbrU1Cqe70
-v\šIµ˜Iì&FÖlŽ¦µg]pƒÁr/s—6±ÍÇck¯ÿm!éTññÔj¿>(5-¦'•`
ªxâ	õ:Ø`<60>{ÁIxðw`“a7`

secrets/samsehu_LLDAP_ADMIN_PASSWORD.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yXNDbw Juf0JMdCTwIPaPdK2llGdbtWG/4m5sD9iIuuvjM8HgM
-EhOuE1WJjVHcf7UZYxCdT0sa78n5bzh6kH7e08oY6x4
--> ssh-ed25519 BTX+xA qBEbn6EWkOEO9PDmJCcYIWrEk652RumOCbaqIt4mVgU
-kCFkAXKya+lQctHK+i6f66zemcuqKmI9+cwuJKOpBLg
---- cGf7Y9c6vyaFzKoZubiC3SelLhhm+r/iWAxqjLZWmRw
-œLÇqáÅÄÞ°
-DCëb‡ÖÐ3ÜßÉß(jÄ„œ&íxWÏn’2ÜŸP› )—z†‘œoK]>B6•yYÒ…õvw•%r«jKÇ7

secrets/samsehu_NFSN_API_KEY.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yXNDbw fIJwXjhuKTVLjQXxRAzkcXQR5sIrfbNYlyDJHeQjDgE
+/zdUzjnkojy5zTynh2dh3YAowIzBc630tsJnsRC9fJA
+-> ssh-ed25519 BTX+xA 1xfWcwHEzRm+pAYtjsimUelhjPzX2ftXCqTT8ZC5Ai4
+ev6pWXEMB/5r5lvGIXnwb/5Y+y+KtF+82kXQsW27L8Q
+--- TmO1kU6MHMyRRScZ4JFs67Dt8PNeuT900kEZFgB/+hM
+/g`Þ‡”WU±»=#¾©É¬Þ >}ºb™—~xE]Ü´'îï<>…$’¸‹[”‚ÄåÎ

secrets/samsehu_NFSN_LOGIN.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yXNDbw 62eQ1z2NUFkXLhNo7Cu++sLJC544LuGO9pF78eDqyBA
+FDhNUIerQRbCAK4YWjRw7pws2m7ohalSy08BuWDQhUM
+-> ssh-ed25519 BTX+xA lzBif7+dwdtGCHugVucaPNIxXnPkeJt0NbXwggs4UAg
+eReSeftMwXfV3hKmgpdNP1uI/sCJqe8ReYZCnkvd1zc
+--- u61FruBB1mBYUUpjsvOgZVfdMC8QnX6Mm7QXUGMjWt8
+Þè²bБ戛ó^?‹ ?%0ZÒ81àx•ÀÙݽ04@›5vöŽ<C3B6>

secrets/samsehu_OIDC_APP_SECRET_FORGEJO.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yXNDbw rq3zM6yBAOw27casxuak0MTrhHXXfQranR8pL0osS3A
-6aDqYlDmYLLvxdorIxs4WB24mouWUHqbT5s3qgIx/lA
--> ssh-ed25519 BTX+xA 1zd7nxWxmVfu1yMI4K5McNSV0ULLcZ0fVCGNNXIBw3k
-n1clgjKA4UjBRnokQm99x+q9OBi4muPdD70l1XMak4o
---- URplj0eiKdqp222NxhGDYUmz+bho1zxam1hsf7trJ/g
-‡
-g(ÒÚÅàÑÁÑÕÔ«Ì1{ëï¡.YÌIqQ³úÓ”<%½-£6¼CEKüv9#Aóö³%@Vì·çˆKWŸ”‹ï

secrets/secrets.nix

@@ -5,10 +5,6 @@ let
   samsehu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRkyyUcmLsnX0oo1QzGeyPEqIc/i4ExcZClVoERggl9";
 in
 {
-  "samsehu_DUCK_DNS_TOKEN.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_NFSN_API_KEY.age".publicKeys = geemili ++ [ samsehu ];
-  "samsehu_DEX_ENVIRONMENT_FILE.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_NFSN_LOGIN.age".publicKeys = geemili ++ [ samsehu ];
-  "samsehu_OIDC_APP_SECRET_HEADSCALE.age".publicKeys = geemili ++ [ samsehu ];
-  "samsehu_OIDC_APP_SECRET_FORGEJO.age".publicKeys = geemili ++ [ samsehu ];
-  "samsehu_LLDAP_ADMIN_PASSWORD.age".publicKeys = geemili ++ [ samsehu ];
-  "samsehu_FORGEJO_ACTIONS_RUNNER.age".publicKeys = geemili ++ [ samsehu ];
 }

services/komga.nix

@@ -1,111 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.komgaCustom;
-  settingsFormat = pkgs.formats.yaml {};
-in  
-{
-  options = {
-    services.komgaCustom = {
-      enable = mkEnableOption (lib.mdDoc "Komga, a free and open source comics/mangas media server");
-
-      port = mkOption {
-        type = types.port;
-        default = 25600;
-        description = lib.mdDoc ''
-          The port that Komga will listen on.
-        '';
-      };
-
-      user = mkOption {
-        type = types.str;
-        default = "komga";
-        description = lib.mdDoc ''
-          User account under which Komga runs.
-        '';
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "komga";
-        description = lib.mdDoc ''
-          Group under which Komga runs.
-        '';
-      };
-
-      stateDir = mkOption {
-        type = types.str;
-        default = "/var/lib/komga";
-        description = lib.mdDoc ''
-          State and configuration directory Komga will use.
-        '';
-      };
-
-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to open the firewall for the port in {option}`services.komga.port`.
-        '';
-      };
-
-      settings = mkOption {
-        type = settingsFormat.type;
-        default = {};
-        description = lib.mdDoc ''
-          Configuration for application.yaml, see
-          <link xlink:href="https://komga.org/docs/installation/configuration"
-          for supported settings.
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
-
-    users.groups = mkIf (cfg.group == "komga") {
-      komga = {};
-    };
-
-    users.users = mkIf (cfg.user == "komga") {
-      komga = {
-        group = cfg.group;
-        home = cfg.stateDir;
-        description = "Komga Daemon user";
-        isSystemUser = true;
-      };
-    };
-
-    systemd.services.komgaCustom = {
-      environment = {
-        SERVER_PORT = builtins.toString cfg.port;
-        KOMGA_CONFIGDIR = cfg.stateDir;
-      };
-
-      description = "Komga is a free and open source comics/mangas media server";
-
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-
-        Type = "simple";
-        Restart = "on-failure";
-        ExecStartPre = pkgs.writeShellScript "komga-config-setup" ''
-          ln -sf ${settingsFormat.generate "application.yml" cfg.settings} ${cfg.stateDir}/application.yml
-        '';
-        ExecStart = "${pkgs.komga}/bin/komga";
-
-        StateDirectory = mkIf (cfg.stateDir == "/var/lib/komga") "komga";
-      };
-
-    };
-  };
-}