Compare commits
1 Commits
| Author | SHA1 | Date |
|---|---|---|
Louis Pearson
|
540c4e6716 |
|
|
@ -1 +0,0 @@
|
|||
result
|
||||
|
|
@ -1,19 +1,4 @@
|
|||
{
|
||||
age.secrets.samsehu_DUCK_DNS_TOKEN = {
|
||||
file = ./secrets/samsehu_DUCK_DNS_TOKEN.age;
|
||||
owner = "dynamicdns";
|
||||
group = "dynamicdns";
|
||||
};
|
||||
age.secrets.LLDAP_ADMIN_PASSWORD = {
|
||||
file = ./secrets/samsehu_LLDAP_ADMIN_PASSWORD.age;
|
||||
owner = "lldap";
|
||||
group = "lldap";
|
||||
};
|
||||
age.secrets.DEX_ENVIRONMENT_FILE.file = ./secrets/samsehu_DEX_ENVIRONMENT_FILE.age;
|
||||
age.secrets.OIDC_APP_SECRET_HEADSCALE = {
|
||||
file = ./secrets/samsehu_OIDC_APP_SECRET_HEADSCALE.age;
|
||||
owner = "headscale";
|
||||
group = "headscale";
|
||||
};
|
||||
age.secrets.FORGEJO_ACTIONS_RUNNER.file = ./secrets/samsehu_FORGEJO_ACTIONS_RUNNER.age;
|
||||
age.secrets.samsehu_NFSN_API_KEY.file = ./secrets/samsehu_NFSN_API_KEY.age;
|
||||
age.secrets.samsehu_NFSN_LOGIN.file = ./secrets/samsehu_NFSN_LOGIN.age;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,20 +7,12 @@
|
|||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware/samsehu.nix
|
||||
./samsehu/matrix-conduit.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Use the `systemd-boot` boot loader
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
||||
# Added following instructions of openzfs configuration
|
||||
# randomly generated with `head -c4 /dev/urandom | od -A none -t x4`
|
||||
networking.hostId = "3e52e44f";
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.zfs.forceImportRoot = false;
|
||||
boot.zfs.extraPools = [ "zroot" ];
|
||||
|
||||
networking.hostName = "samsehu"; # Define your hostname.
|
||||
|
||||
# Pick only one of the below networking options.
|
||||
|
|
@ -63,245 +55,23 @@
|
|||
environment.systemPackages = with pkgs; [
|
||||
helix
|
||||
wget
|
||||
git
|
||||
|
||||
juanfont-headscale.headscale # install to allow debugging/control of headscale using the CLI
|
||||
|
||||
# Plugins for cockpit
|
||||
cockpit-tailscale
|
||||
cockpit-zfs-manager
|
||||
];
|
||||
|
||||
environment.variables = {
|
||||
EDITOR = "hx";
|
||||
VISUAL = "hx";
|
||||
};
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "no";
|
||||
};
|
||||
services.openssh.enable = true;
|
||||
|
||||
services.cockpit = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
WebService = {
|
||||
Origins = "https://cockpit.samsehu.perli.casa wss://cockpit.samsehu.perli.casa";
|
||||
ProtocolHeader = "X-Forwarded-Proto";
|
||||
LoginTo = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.udisks2.enable = true;
|
||||
|
||||
# Multimedia group
|
||||
users.groups.multimedia = {};
|
||||
users.users.lidarr.extraGroups = [ "aria2" ];
|
||||
users.users.radarr.extraGroups = [ "aria2" ];
|
||||
users.users.readarr.extraGroups = [ "aria2" ];
|
||||
users.users.sonarr.extraGroups = [ "aria2" ];
|
||||
users.users.bazarr.extraGroups = [ "multimedia" "aria2" ];
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /zroot/media 0770 - multimedia - -"
|
||||
];
|
||||
|
||||
services.jellyfin = { enable = true; group = "multimedia"; };
|
||||
services.lidarr = { enable = true; group = "multimedia"; };
|
||||
services.radarr = { enable = true; group = "multimedia"; };
|
||||
services.readarr = { enable = true; group = "multimedia"; };
|
||||
services.sonarr = { enable = true; group = "multimedia"; };
|
||||
services.bazarr = { enable = true; user = "bazarr"; group = "multimedia"; };
|
||||
services.prowlarr = { enable = true; };
|
||||
|
||||
users.users.komga.extraGroups = [ "multimedia" ];
|
||||
services.komgaCustom = {
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
group = "multimedia";
|
||||
settings = {
|
||||
spring.security.oauth2.client = {
|
||||
registration.dex = {
|
||||
provider = "dex";
|
||||
client-id = "komga";
|
||||
client-secret = "insecure_secret";
|
||||
client-name = "Komga";
|
||||
scope = "openid,email";
|
||||
authorization-grant-type = "authorization_code";
|
||||
redirect-uri = "{baseUrl}/{action}/oauth2/code/{registrationId}";
|
||||
};
|
||||
provider.dex = {
|
||||
user-name-attribute = "sub";
|
||||
issuer-uri = "https://dex.samsehu.perli.casa";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."netns@" = {
|
||||
description = "%I network namespace";
|
||||
before = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
|
||||
ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.wg = {
|
||||
description = "wg network interface";
|
||||
bindsTo = [ "netns@wg.service" ];
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "netns@wg.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = with pkgs; writers.writeBash "wg-up" ''
|
||||
set -e
|
||||
# Create wireguard
|
||||
${iproute}/bin/ip link add wg0 type wireguard
|
||||
# move to wg network namespace
|
||||
${iproute}/bin/ip link set wg0 netns wg
|
||||
# Connect to vpn
|
||||
${iproute}/bin/ip -n wg address add 10.65.64.220/32 dev wg0
|
||||
${iproute}/bin/ip -n wg -6 address add fc00:bbbb:bbbb:bb01::2:40db/128 dev wg0
|
||||
${iproute}/bin/ip netns exec wg ${wireguard-tools}/bin/wg setconf wg0 /var/wireguard-keys/chief-frog.conf
|
||||
# Open network
|
||||
${iproute}/bin/ip -n wg link set dev lo up
|
||||
${iproute}/bin/ip -n wg link set wg0 up
|
||||
${iproute}/bin/ip -n wg route add default dev wg0
|
||||
${iproute}/bin/ip -n wg -6 route add default dev wg0
|
||||
'';
|
||||
ExecStop = with pkgs; writers.writeBash "wg-down" ''
|
||||
${iproute}/bin/ip -n wg route del default dev wg0
|
||||
${iproute}/bin/ip -n wg -6 route del default dev wg0
|
||||
${iproute}/bin/ip -n wg link del wg0
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.aria2 = {
|
||||
enable = true;
|
||||
extraArguments = "--bt-external-ip=10.65.64.220 --input-file=/var/lib/aria2/aria2.session --save-session-interval=60";
|
||||
};
|
||||
systemd.services."aria2" = {
|
||||
bindsTo = [ "netns@wg.service" ];
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "wg.service" ];
|
||||
serviceConfig = {
|
||||
NetworkNamespacePath = "/var/run/netns/wg";
|
||||
};
|
||||
};
|
||||
|
||||
# reverse proxy the aria2 rpc from the `wg` network namespace to a unix domain socket
|
||||
systemd.services."aria2-unix-domain-rpc" = {
|
||||
bindsTo = [ "aria2.service" ];
|
||||
after = [ "aria2.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
NetworkNamespacePath = "/var/run/netns/wg";
|
||||
Type = "simple";
|
||||
User = config.services.caddy.user;
|
||||
Group = config.services.caddy.group;
|
||||
RuntimeDirectory = "aria2";
|
||||
ExecStart = with pkgs; writers.writeBash "aria2-unix-domain-rpc-listener" ''
|
||||
set -e
|
||||
${socat}/bin/socat UNIX-LISTEN:/run/aria2/rpc.sock,reuseaddr,fork TCP:localhost:6800
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.dex.serviceConfig = {
|
||||
StateDirectory = "dex";
|
||||
WorkingDirectory = "%S/dex";
|
||||
};
|
||||
services.dex = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.DEX_ENVIRONMENT_FILE.path;
|
||||
settings = {
|
||||
issuer = "https://dex.samsehu.perli.casa";
|
||||
web.http = "127.0.0.1:5556";
|
||||
|
||||
storage = {
|
||||
type = "sqlite3";
|
||||
config.file = "./dex.db";
|
||||
};
|
||||
|
||||
# services that can get a token from our dex instance
|
||||
staticClients = [
|
||||
{
|
||||
id = "forgejo";
|
||||
secretEnv = "OIDC_APP_SECRET_FORGEJO";
|
||||
name = "Forgejo";
|
||||
redirectURIs = [ "https://git.samsehu.perli.casa/user/oauth2/dex/callback" ];
|
||||
}
|
||||
{
|
||||
id = "headscale";
|
||||
secretEnv = "OIDC_APP_SECRET_HEADSCALE";
|
||||
name = "Headscale";
|
||||
redirectURIs = [ "https://headscale.samsehu.perli.casa/oidc/callback" ];
|
||||
}
|
||||
{
|
||||
id = "nextcloud";
|
||||
secret = "insecure_secret";
|
||||
name = "Nextcloud";
|
||||
redirectURIs = [ "https://nextcloud.samsehu.perli.casa/apps/oidc_login/oidc" "https://nextcloud.samsehu.perli.casa/index.php/apps/oidc_login/oidc" ];
|
||||
}
|
||||
{
|
||||
id = "jellyfin";
|
||||
secret = "insecure_secret";
|
||||
name = "Jellyfin";
|
||||
redirectURIs = [ "https://jellyfin.samsehu.perli.casa/sso/OID/redirect/dex" ];
|
||||
}
|
||||
{
|
||||
id = "komga";
|
||||
secret = "insecure_secret";
|
||||
name = "Komga";
|
||||
redirectURIs = [ "https://komga.samsehu.perli.casa/login/oauth2/code/dex" ];
|
||||
}
|
||||
];
|
||||
|
||||
# authentication sources
|
||||
connectors = [
|
||||
{
|
||||
type = "ldap";
|
||||
id = "lldap";
|
||||
name = "LLDAP";
|
||||
config = {
|
||||
host = "127.0.0.1:3890";
|
||||
insecureNoSSL = true;
|
||||
insecureSkipVerify = true;
|
||||
startTLS = false;
|
||||
bindDN = "uid=Immovable1809,ou=people,dc=samsehu,dc=perli,dc=casa";
|
||||
bindPW = "$LLDAP_ADMIN_PASSWORD";
|
||||
|
||||
userSearch = {
|
||||
baseDN = "ou=people,dc=samsehu,dc=perli,dc=casa";
|
||||
username = "uid";
|
||||
idAttr = "uid";
|
||||
emailAttr = "mail";
|
||||
nameAttr = "displayName";
|
||||
preferredUsernameAttr = "uid";
|
||||
};
|
||||
|
||||
groupSearch = {
|
||||
baseDN = "ou=groups,dc=samsehu,dc=perli,dc=casa";
|
||||
filter = "(objectClass=groupOfUniqueNames)";
|
||||
userMatchers = [
|
||||
{ userAttr = "DN"; groupAttr = "member"; }
|
||||
];
|
||||
nameAttr = "cn";
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
services.blocky = {
|
||||
|
|
@ -339,377 +109,107 @@
|
|||
default = [ "ads" ];
|
||||
};
|
||||
};
|
||||
customDNS = {
|
||||
rewrite = {
|
||||
"cockpit.samsehu.perli.casa" = "samsehu.perli.casa";
|
||||
"git.samsehu.perli.casa" = "samsehu.perli.casa";
|
||||
"nextcloud.samsehu.perli.casa" = "samsehu.perli.casa";
|
||||
};
|
||||
mapping = {
|
||||
"samsehu.perli.casa" = "192.168.0.69";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server.ROOT_URL = "https://git.samsehu.perli.casa/";
|
||||
server.HTTP_ADDR = "127.0.0.1";
|
||||
actions.ENABLED = true;
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-actions-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = "monolith";
|
||||
url = "https://git.samsehu.perli.casa";
|
||||
tokenFile = config.age.secrets.FORGEJO_ACTIONS_RUNNER.path;
|
||||
labels = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
# lldap LDAP authentication server
|
||||
users.users.lldap = {
|
||||
# allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
|
||||
isSystemUser = true;
|
||||
group = "lldap";
|
||||
};
|
||||
users.groups.lldap = {};
|
||||
services.lldap = {
|
||||
enable = true;
|
||||
settings = {
|
||||
ldap_base_dn = "dc=samsehu,dc=perli,dc=casa";
|
||||
ldap_base_dn = "dc=twins,dc=pearson";
|
||||
# Sets the root administrator's user name
|
||||
ldap_user_dn = "Immovable1809";
|
||||
http_host = "127.0.0.1";
|
||||
};
|
||||
environment = {
|
||||
LLDAP_LDAP_USER_PASS_FILE = config.age.secrets.LLDAP_ADMIN_PASSWORD.path;
|
||||
ldap_user_dn = "admin";
|
||||
# Default administrator password
|
||||
ldap_user_pass = "extending pulsate nastily";
|
||||
};
|
||||
};
|
||||
|
||||
# Dynamic DNS through duck dns
|
||||
users.users.dynamicdns = {
|
||||
# allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
|
||||
isSystemUser = true;
|
||||
group = "dynamicdns";
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
# Use recommended settings
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
# Only allow PFS-enabled ciphers with AES256
|
||||
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
||||
|
||||
# Setup Nextcloud virtual host to listen on ports
|
||||
virtualHosts = {
|
||||
"nextcloud.samsehu.local" = {
|
||||
# Force HTTP redirect to HTTPS
|
||||
forceSSL = true;
|
||||
# LetsEncrypt
|
||||
enableACME = true;
|
||||
};
|
||||
users.groups.dynamicdns = {};
|
||||
systemd.services.dynamic-dns-updater = {
|
||||
serviceConfig.User = "dynamicdns";
|
||||
path = [ pkgs.curl ];
|
||||
script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} https://www.duckdns.org/update";
|
||||
startAt = "hourly";
|
||||
};
|
||||
systemd.timers.dynamic-dns-updater = {
|
||||
timerConfig.RandomizedDelaySec = "15m";
|
||||
};
|
||||
systemd.services.dynamic-dns-updater6 = {
|
||||
serviceConfig.User = "dynamicdns";
|
||||
path = [ pkgs.curl ];
|
||||
script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} --url-query ipv6=$(ip -j -6 addr show scope global | jq -r .[0].addr_info.[0].local) https://www.duckdns.org/update";
|
||||
startAt = "hourly";
|
||||
};
|
||||
systemd.timers.dynamic-dns-updater6 = {
|
||||
timerConfig.RandomizedDelaySec = "15m";
|
||||
};
|
||||
|
||||
# Next cloud setup
|
||||
services.nginx.enable = false;
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
hostName = "nextcloud.samsehu.perli.casa";
|
||||
config.adminpassFile = "/var/nextcloud-admin-pass";
|
||||
config.trustedProxies = [
|
||||
"100.64.0.3"
|
||||
];
|
||||
caching.apcu = true;
|
||||
hostName = "nextcloud.samsehu.local";
|
||||
# Enable built-in virtual host management
|
||||
# Takes care of somewhat complicated setup
|
||||
nginx.enable = true;
|
||||
|
||||
# OIDC configuration
|
||||
extraOptions = {
|
||||
overwritewebroot = "/";
|
||||
# Use HTTPS for links
|
||||
https = true;
|
||||
|
||||
allow_user_to_change_display_name = false;
|
||||
lost_password_link = "disabled";
|
||||
oidc_login_provider_url = "https://dex.samsehu.perli.casa";
|
||||
oidc_login_client_id = "nextcloud";
|
||||
oidc_login_client_secret = "insecure_secret";
|
||||
oidc_login_auto_redirect = true;
|
||||
oidc_login_end_session_redirect = false;
|
||||
oidc_login_button_text = "Log in with Dex";
|
||||
oidc_login_hide_password_form = false;
|
||||
oidc_login_use_id_token = true;
|
||||
config.oidc_login_attributes = {
|
||||
"id" = "preferred_username";
|
||||
"name" = "name";
|
||||
"mail" = "mail";
|
||||
"groups" = "groups";
|
||||
};
|
||||
oidc_login_default_group = "oidc";
|
||||
oidc_login_use_external_storage = true;
|
||||
oidc_login_scope = "openid profile email groups";
|
||||
oidc_login_proxy_ldap = false;
|
||||
oidc_login_disable_registration = false;
|
||||
oidc_login_redir_fallback = false;
|
||||
oidc_login_alt_login_page = "assets/login.php";
|
||||
oidc_login_tls_verify = true;
|
||||
oidc_create_groups = false;
|
||||
oidc_login_webdav_enabled = false;
|
||||
oidc_login_password_authentication = false;
|
||||
oidc_login_public_key_caching_time = 86400;
|
||||
oidc_login_min_time_between_jwks_requests = 10;
|
||||
oidc_login_well_known_caching_time = 86400;
|
||||
oidc_login_update_avatar = false;
|
||||
};
|
||||
|
||||
# Auto update apps
|
||||
autoUpdateApps.enable = true;
|
||||
audoUpdateApps.startAt = "05:00:00";
|
||||
|
||||
extraApps = {
|
||||
oidc_login = pkgs.fetchNextcloudApp {
|
||||
appName = "OpenID Connect Login";
|
||||
appVersion = "3.0.2";
|
||||
sha256 = "sha256-cN5azlThKPKRVip14yfUNR85of5z+N6NVI7sg6pSGQI=";
|
||||
license = "agpl3Plus";
|
||||
url = "https://github.com/pulsejet/nextcloud-oidc-login/releases/download/v3.0.2/oidc_login.tar.gz";
|
||||
config = {
|
||||
overwriteProtocol = "https";
|
||||
|
||||
dbtype = "pgsql";
|
||||
dbuser = "nextcloud";
|
||||
dbhost = "/run/postgresql";
|
||||
dbname = "nextcloud";
|
||||
dbpassFile = "/var/nextcloud-db-pass";
|
||||
|
||||
adminpassFile = "/path/to/admin-pass-file";
|
||||
adminuser = "admin";
|
||||
};
|
||||
gpoddersync = pkgs.fetchNextcloudApp {
|
||||
appName = "Gpodder Sync";
|
||||
appVersion = "3.8.2";
|
||||
sha256 = "sha256-eeBvRZUDVIaym0ngfPD2d7aY3SI/7lPWkrYPnqSh5Kw=";
|
||||
license = "agpl3Plus";
|
||||
url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.phpfpm.pools.nextcloud.settings = {
|
||||
"listen.owner" = config.services.caddy.user;
|
||||
"listen.group" = config.services.caddy.group;
|
||||
};
|
||||
|
||||
# Reverse proxy with Caddy
|
||||
services.caddy = {
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
globalConfig = ''
|
||||
email "fresh.car0178@geemili.xyz"
|
||||
'';
|
||||
|
||||
virtualHosts."lldap.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:17170
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
ensureUsers = [
|
||||
{ name = "nextcloud";
|
||||
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
|
||||
virtualHosts."headscale.samsehu.perli.casa".extraConfig = ''
|
||||
reverse_proxy localhost:64639
|
||||
'';
|
||||
|
||||
virtualHosts."cockpit.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:9090
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
|
||||
virtualHosts."git.samsehu.perli.casa".extraConfig = ''
|
||||
reverse_proxy localhost:3000
|
||||
'';
|
||||
|
||||
virtualHosts."jellyfin.samsehu.perli.casa".extraConfig = ''
|
||||
reverse_proxy localhost:8096
|
||||
'';
|
||||
|
||||
virtualHosts."nextcloud.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
# https://docs.nextcloud.com/server/27/admin_manual/issues/general_troubleshooting.html#service-discovery
|
||||
redir /.well-known/carddav /remote.php/dav 301
|
||||
redir /.well-known/caldav /remote.php/dav 301
|
||||
|
||||
root * ${config.services.nextcloud.package}
|
||||
php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket} {
|
||||
root ${config.services.nextcloud.package}
|
||||
capture_stderr
|
||||
}
|
||||
file_server
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
|
||||
virtualHosts."dex.samsehu.perli.casa".extraConfig = ''
|
||||
reverse_proxy localhost:5556
|
||||
'';
|
||||
|
||||
virtualHosts."aria.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48 private_ranges
|
||||
handle @connected_via_tailscale {
|
||||
handle /rpc {
|
||||
reverse_proxy unix//run/aria2/rpc.sock
|
||||
}
|
||||
handle /jsonrpc {
|
||||
reverse_proxy unix//run/aria2/rpc.sock
|
||||
}
|
||||
handle_path /ariang* {
|
||||
root * ${pkgs.ariang}/share/ariang
|
||||
file_server
|
||||
}
|
||||
redir / /ariang/#!/settings/rpc/set?protocol=wss&host=aria.samsehu.perli.casa&port=443&secret=YXJpYTJycGM=&interface=jsonrpc
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
|
||||
virtualHosts."lid.arr.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:8686
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
virtualHosts."rad.arr.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:7878
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
virtualHosts."read.arr.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:8787
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
virtualHosts."son.arr.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:8989
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
virtualHosts."baz.arr.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:6767
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
virtualHosts."prowl.arr.samsehu.perli.casa".extraConfig = ''
|
||||
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
|
||||
handle @connected_via_tailscale {
|
||||
reverse_proxy localhost:9696
|
||||
}
|
||||
respond 403
|
||||
'';
|
||||
virtualHosts."komga.samsehu.perli.casa".extraConfig = ''
|
||||
reverse_proxy localhost:25600
|
||||
'';
|
||||
};
|
||||
|
||||
# Headscale for access to the network while away from home
|
||||
users.users.headscale = {
|
||||
isSystemUser = true;
|
||||
group = "headscale";
|
||||
};
|
||||
users.groups.headscale = {};
|
||||
services.headscale = {
|
||||
enable = true;
|
||||
package = pkgs.juanfont-headscale.headscale;
|
||||
settings = {
|
||||
server_url = "https://headscale.samsehu.perli.casa";
|
||||
listen_addr = "127.0.0.1:64639";
|
||||
metrics_listen_addr = "127.0.0.1:64640";
|
||||
tls_cert_path = null;
|
||||
tls_key_path = null;
|
||||
|
||||
dns_config = {
|
||||
override_local_dns = true;
|
||||
nameservers = [ "100.64.0.3" ];
|
||||
magic_dns = true;
|
||||
base_domain = "ts.samsehu.perli.casa";
|
||||
restricted_nameservers = {
|
||||
"samsehu.perli.casa" = [ "100.64.0.3" ];
|
||||
};
|
||||
extra_records = [
|
||||
{ name = "samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "cockpit.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "git.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "nextcloud.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "lldap.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "dex.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "jellyfin.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "aria.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "lid.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "rad.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "read.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "son.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "baz.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "prowl.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
{ name = "komga.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
|
||||
];
|
||||
};
|
||||
|
||||
oidc = {
|
||||
issuer = "https://dex.samsehu.perli.casa";
|
||||
client_id = "headscale";
|
||||
client_secret_path = config.age.secrets.OIDC_APP_SECRET_HEADSCALE.path;
|
||||
scope = [ "openid" "profile" "email" ];
|
||||
systemd.services."nextcloud-setup" = {
|
||||
requires = ["postgresql.service"];
|
||||
after = ["postgresql.service"];
|
||||
};
|
||||
|
||||
acl_policy_path = pkgs.writeText "acl_policy.hujson" ''
|
||||
{
|
||||
"groups": {
|
||||
"group:servers": [
|
||||
"samsehu",
|
||||
],
|
||||
"group:admin": [
|
||||
"geemili",
|
||||
"desttinghim",
|
||||
],
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": ["group:admin"],
|
||||
"dst": ["*:*"],
|
||||
}
|
||||
],
|
||||
"ssh": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": ["group:admin"],
|
||||
"dst": ["group:servers"],
|
||||
"users": ["group:admin", "geemili", "desttinghim", "forgejo"],
|
||||
},
|
||||
{
|
||||
"action": "accept",
|
||||
"src": ["geemili"],
|
||||
"dst": ["geemili"],
|
||||
"users": ["geemili"],
|
||||
},
|
||||
],
|
||||
}
|
||||
'';
|
||||
# ACME client service for configuring SSL certificate
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "fresh.car0178@geemili.xyz";
|
||||
certs."samsehu.perli.casa" = {
|
||||
domain = "samsehu.perli.casa";
|
||||
dnsProvider = "nearlyfreespeech";
|
||||
credentialFiles = {
|
||||
"NEARLYFREESPECH_API_KEY" = config.age.secrets.samsehu_NFSN_API_KEY.path;
|
||||
"NEARLYFREESPECH_LOGIN" = config.age.secrets.samsehu_NFSN_LOGIN.path;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# Enable automatic upgrades
|
||||
system.autoUpgrade.enable = true;
|
||||
system.autoUpgrade.allowReboot = true;
|
||||
system.autoUpgrade.flake = "git+http://127.0.0.1:3000/Twins/server-configuration.git";
|
||||
|
||||
# Enable automatic garbage collection
|
||||
nix.gc = {
|
||||
|
|
@ -718,39 +218,35 @@
|
|||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = [ "geemili" ];
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
# Blocky DNS
|
||||
53
|
||||
|
||||
# Nextcloud / nginx
|
||||
80
|
||||
443
|
||||
|
||||
# Blocky API
|
||||
4000
|
||||
|
||||
# Caddy HTTP and HTTPS
|
||||
80
|
||||
443
|
||||
# Forgejo web interface
|
||||
3000
|
||||
|
||||
# lldap LDAP
|
||||
3890
|
||||
|
||||
# lldap HTTP; user login and administration
|
||||
17170
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
# Blocky DNS
|
||||
53
|
||||
|
||||
# mDNS
|
||||
5353
|
||||
|
||||
# Headscale UDP port for STUN protocol
|
||||
3478
|
||||
];
|
||||
|
||||
# Use systemd-resolved and set networkmanager to allow mdns
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
DNSStubListener=false
|
||||
'';
|
||||
};
|
||||
services.resolved.enable = true;
|
||||
networking.networkmanager.connectionConfig."connection.mdns" = 2; # 2 == yes
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
|
|
|
|||
68
flake.lock
68
flake.lock
|
|
@ -10,11 +10,11 @@
|
|||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1716561646,
|
||||
"narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
|
||||
"lastModified": 1703433843,
|
||||
"narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
|
||||
"rev": "417caa847f9383e111d1397039c9d4337d024bf0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -45,24 +45,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1701680307,
|
||||
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -84,35 +66,13 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"juanfont-headscale": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1702219574,
|
||||
"narHash": "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=",
|
||||
"owner": "juanfont",
|
||||
"repo": "headscale",
|
||||
"rev": "6049ec758ca46b5c6ee7abba4f3d472fb1e2ffa6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "juanfont",
|
||||
"ref": "v0.23.0-alpha2",
|
||||
"repo": "headscale",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1716633019,
|
||||
"narHash": "sha256-xim1b5/HZYbWaZKyI7cn9TJCM6ewNVZnesRr00mXeS4=",
|
||||
"lastModified": 1703467016,
|
||||
"narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9d29cd266cebf80234c98dd0b87256b6be0af44e",
|
||||
"rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -125,7 +85,6 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"juanfont-headscale": "juanfont-headscale",
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
},
|
||||
|
|
@ -143,21 +102,6 @@
|
|||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
|
|
|||
19
flake.nix
19
flake.nix
|
|
@ -5,31 +5,14 @@
|
|||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
juanfont-headscale = {
|
||||
url = "github:juanfont/headscale/v0.23.0-alpha2";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, agenix, juanfont-headscale }: {
|
||||
packages.x86_64-linux = let pkgs = import nixpkgs { system = "x86_64-linux"; }; in rec {
|
||||
cockpit-tailscale = pkgs.callPackage ./pkgs/cockpit-tailscale.nix {};
|
||||
cockpit-zfs-manager = pkgs.callPackage ./pkgs/cockpit-zfs-manager.nix {};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, agenix }: {
|
||||
nixosConfigurations.samsehu = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
({config, pkgs, ...}: {
|
||||
nixpkgs.overlays = [ (final: prev: {
|
||||
juanfont-headscale = juanfont-headscale.packages.${prev.system};
|
||||
cockpit-tailscale = self.packages.${prev.system}.cockpit-tailscale;
|
||||
cockpit-zfs-manager = self.packages.${prev.system}.cockpit-zfs-manager;
|
||||
})];
|
||||
})
|
||||
./agenix-config-module.nix
|
||||
./configuration.nix
|
||||
./services/komga.nix
|
||||
agenix.nixosModules.default
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
{ lib, stdenv, fetchzip }:
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "cockpit-tailscale";
|
||||
version = "0.0.6";
|
||||
|
||||
src = fetchzip {
|
||||
url = "https://github.com/spotsnel/cockpit-tailscale/releases/download/v${version}/cockpit-tailscale-v${version}.tar.gz";
|
||||
sha256 = "sha256-ESUZdt8GVEToyrv6UP8lOff67LsumdJAY1lXvC3fBaI=";
|
||||
};
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/share/cockpit
|
||||
cp -r ${src} $out/share/cockpit/tailscale
|
||||
'';
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
{ lib, stdenv, fetchFromGitHub }:
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "cockpit-zfs-manager";
|
||||
version = "816af25099fccc46a3bff5f831b39d98ef33d514";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "leroycep";
|
||||
repo = "cockpit-zfs-manager";
|
||||
rev = "${version}";
|
||||
hash = "sha256-aLdsHHVVG6eJrvh3B4grZkDEbCZyDJjX2PuKkON8UcI=";
|
||||
};
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/share/cockpit
|
||||
cp -r ${src}/zfs $out/share/cockpit/zfs
|
||||
'';
|
||||
}
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
homeserver-url = "samsehu.perli.casa";
|
||||
in
|
||||
{
|
||||
# configure matrix-conduit as a server to host chat communications with end-to-end encryption
|
||||
services.matrix-conduit = {
|
||||
enable = true;
|
||||
settings.global = {
|
||||
server_name = "${homeserver-url}";
|
||||
trusted_servers = [];
|
||||
};
|
||||
};
|
||||
|
||||
# Reverse proxy with Caddy
|
||||
services.caddy.virtualHosts."${homeserver-url}" = {
|
||||
serverAliases = [ "${homeserver-url}:8448" ];
|
||||
extraConfig = ''
|
||||
respond /.well-known/matrix/server `{ "m.server": "${homeserver-url}" }` 200
|
||||
respond /.well-known/matrix/client `{ "m.homeserver": { "base_url": "https://${homeserver-url}" } }` 200
|
||||
reverse_proxy /_matrix/* localhost:${toString config.services.matrix-conduit.settings.global.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
|
||||
networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
|
||||
}
|
||||
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -1,7 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 yXNDbw n4kYnQIXz7rkvduE9oJ5XRxJfZJTUILuZ0r9s2+rW2g
|
||||
OtBaRY+mIQrPXS0+rg99u2aElUeguwJPk+yoK5jO+Z0
|
||||
-> ssh-ed25519 BTX+xA HIqdxxh8HwoDjfznL4caRc7HvkWYwn2S2h3bsHdaIRc
|
||||
rOFUTg2u/S83YJpJTAzRfVL3rdot+4Z1orEGYV+4J58
|
||||
--- 8BznEX1nb6xDa74lWVT2fgJo7MzFXLhnapbrU1Cqe70
|
||||
v\š Iµ˜ Iì&FÖlŽ ¦µg]pƒÁr/s—6±ÍÇck¯ÿm!éTññÔj¿ >(5-¦'•`
ªx â õ:Ø`<60>{ÁIxðw`“a7`
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 yXNDbw Juf0JMdCTwIPaPdK2llGdbtWG/4m5sD9iIuuvjM8HgM
|
||||
EhOuE1WJjVHcf7UZYxCdT0sa78n5bzh6kH7e08oY6x4
|
||||
-> ssh-ed25519 BTX+xA qBEbn6EWkOEO9PDmJCcYIWrEk652RumOCbaqIt4mVgU
|
||||
kCFkAXKya+lQctHK+i6f66zemcuqKmI9+cwuJKOpBLg
|
||||
--- cGf7Y9c6vyaFzKoZubiC3SelLhhm+r/iWAxqjLZWmRw
|
||||
œLÇqáÅÄÞ°
|
||||
DCëb‡ÖÐ3ÜßÉß(jÄ„œ&íxWÏn’2ÜŸP› )—z†‘œoK]>B6•yYÒ…õvw•%r«jKÇ7
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 yXNDbw fIJwXjhuKTVLjQXxRAzkcXQR5sIrfbNYlyDJHeQjDgE
|
||||
/zdUzjnkojy5zTynh2dh3YAowIzBc630tsJnsRC9fJA
|
||||
-> ssh-ed25519 BTX+xA 1xfWcwHEzRm+pAYtjsimUelhjPzX2ftXCqTT8ZC5Ai4
|
||||
ev6pWXEMB/5r5lvGIXnwb/5Y+y+KtF+82kXQsW27L8Q
|
||||
--- TmO1kU6MHMyRRScZ4JFs67Dt8PNeuT900kEZFgB/+hM
|
||||
/g`Þ‡”WU±»=#¾©É¬Þ >}ºb™—~xE]Ü´'î ï<>…$’¸‹[”‚ÄåÎ
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 yXNDbw 62eQ1z2NUFkXLhNo7Cu++sLJC544LuGO9pF78eDqyBA
|
||||
FDhNUIerQRbCAK4YWjRw7pws2m7ohalSy08BuWDQhUM
|
||||
-> ssh-ed25519 BTX+xA lzBif7+dwdtGCHugVucaPNIxXnPkeJt0NbXwggs4UAg
|
||||
eReSeftMwXfV3hKmgpdNP1uI/sCJqe8ReYZCnkvd1zc
|
||||
--- u61FruBB1mBYUUpjsvOgZVfdMC8QnX6Mm7QXUGMjWt8
|
||||
Þè²bБ戛ó^ ?‹ ?%0ZÒ81àx•ÀÙÝ ½04@›5vöŽ<C3B6>
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 yXNDbw rq3zM6yBAOw27casxuak0MTrhHXXfQranR8pL0osS3A
|
||||
6aDqYlDmYLLvxdorIxs4WB24mouWUHqbT5s3qgIx/lA
|
||||
-> ssh-ed25519 BTX+xA 1zd7nxWxmVfu1yMI4K5McNSV0ULLcZ0fVCGNNXIBw3k
|
||||
n1clgjKA4UjBRnokQm99x+q9OBi4muPdD70l1XMak4o
|
||||
--- URplj0eiKdqp222NxhGDYUmz+bho1zxam1hsf7trJ/g
|
||||
‡
|
||||
g(ÒÚÅàÑÁÑÕÔ«Ì1{ëï ¡.YÌIq Q³úÓ”<%½-£6¼CEKüv9#Aóö³%@Vì·çˆKWŸ” ‹ï
|
||||
Binary file not shown.
|
|
@ -5,10 +5,6 @@ let
|
|||
samsehu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRkyyUcmLsnX0oo1QzGeyPEqIc/i4ExcZClVoERggl9";
|
||||
in
|
||||
{
|
||||
"samsehu_DUCK_DNS_TOKEN.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_DEX_ENVIRONMENT_FILE.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_OIDC_APP_SECRET_HEADSCALE.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_OIDC_APP_SECRET_FORGEJO.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_LLDAP_ADMIN_PASSWORD.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_FORGEJO_ACTIONS_RUNNER.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_NFSN_API_KEY.age".publicKeys = geemili ++ [ samsehu ];
|
||||
"samsehu_NFSN_LOGIN.age".publicKeys = geemili ++ [ samsehu ];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,111 +0,0 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.komgaCustom;
|
||||
settingsFormat = pkgs.formats.yaml {};
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.komgaCustom = {
|
||||
enable = mkEnableOption (lib.mdDoc "Komga, a free and open source comics/mangas media server");
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 25600;
|
||||
description = lib.mdDoc ''
|
||||
The port that Komga will listen on.
|
||||
'';
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "komga";
|
||||
description = lib.mdDoc ''
|
||||
User account under which Komga runs.
|
||||
'';
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "komga";
|
||||
description = lib.mdDoc ''
|
||||
Group under which Komga runs.
|
||||
'';
|
||||
};
|
||||
|
||||
stateDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/komga";
|
||||
description = lib.mdDoc ''
|
||||
State and configuration directory Komga will use.
|
||||
'';
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc ''
|
||||
Whether to open the firewall for the port in {option}`services.komga.port`.
|
||||
'';
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = settingsFormat.type;
|
||||
default = {};
|
||||
description = lib.mdDoc ''
|
||||
Configuration for application.yaml, see
|
||||
<link xlink:href="https://komga.org/docs/installation/configuration"
|
||||
for supported settings.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
|
||||
|
||||
users.groups = mkIf (cfg.group == "komga") {
|
||||
komga = {};
|
||||
};
|
||||
|
||||
users.users = mkIf (cfg.user == "komga") {
|
||||
komga = {
|
||||
group = cfg.group;
|
||||
home = cfg.stateDir;
|
||||
description = "Komga Daemon user";
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.komgaCustom = {
|
||||
environment = {
|
||||
SERVER_PORT = builtins.toString cfg.port;
|
||||
KOMGA_CONFIGDIR = cfg.stateDir;
|
||||
};
|
||||
|
||||
description = "Komga is a free and open source comics/mangas media server";
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
|
||||
Type = "simple";
|
||||
Restart = "on-failure";
|
||||
ExecStartPre = pkgs.writeShellScript "komga-config-setup" ''
|
||||
ln -sf ${settingsFormat.generate "application.yml" cfg.settings} ${cfg.stateDir}/application.yml
|
||||
'';
|
||||
ExecStart = "${pkgs.komga}/bin/komga";
|
||||
|
||||
StateDirectory = mkIf (cfg.stateDir == "/var/lib/komga") "komga";
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue