update forgejo actions runner registration token

Komga does not appear to be picking up the application.yml
configuration file. Maybe it's a permissions issue?

.gitignore

@@ -0,0 +1 @@
+result

agenix-config-module.nix

@@ -1,4 +1,19 @@
 {
-  age.secrets.samsehu_NFSN_API_KEY.file = ./secrets/samsehu_NFSN_API_KEY.age;
-  age.secrets.samsehu_NFSN_LOGIN.file = ./secrets/samsehu_NFSN_LOGIN.age;
+  age.secrets.samsehu_DUCK_DNS_TOKEN = {
+    file = ./secrets/samsehu_DUCK_DNS_TOKEN.age;
+    owner = "dynamicdns";
+    group = "dynamicdns";
+  };
+  age.secrets.LLDAP_ADMIN_PASSWORD = {
+    file = ./secrets/samsehu_LLDAP_ADMIN_PASSWORD.age;
+    owner = "lldap";
+    group = "lldap";
+  };
+  age.secrets.DEX_ENVIRONMENT_FILE.file = ./secrets/samsehu_DEX_ENVIRONMENT_FILE.age;
+  age.secrets.OIDC_APP_SECRET_HEADSCALE = {
+    file = ./secrets/samsehu_OIDC_APP_SECRET_HEADSCALE.age;
+    owner = "headscale";
+    group = "headscale";
+  };
+  age.secrets.FORGEJO_ACTIONS_RUNNER.file = ./secrets/samsehu_FORGEJO_ACTIONS_RUNNER.age;
 }

configuration.nix

@@ -7,12 +7,20 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+      ./hardware/samsehu.nix
+      ./samsehu/matrix-conduit.nix
     ];
 
   # Use the `systemd-boot` boot loader
   boot.loader.systemd-boot.enable = true;
 
+  # Added following instructions of openzfs configuration
+  # randomly generated with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "3e52e44f"; 
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.zfs.forceImportRoot = false;
+  boot.zfs.extraPools = [ "zroot" ];
+
   networking.hostName = "samsehu"; # Define your hostname.
 
   # Pick only one of the below networking options.
@@ -55,23 +63,245 @@
   environment.systemPackages = with pkgs; [
     helix
     wget
+    git
+
+    juanfont-headscale.headscale # install to allow debugging/control of headscale using the CLI
+
+    # Plugins for cockpit
+    cockpit-tailscale
+    cockpit-zfs-manager
   ];
 
+  environment.variables = {
+    EDITOR = "hx";
+    VISUAL = "hx";
+  };
+
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+    settings.PermitRootLogin = "no";
+  };
 
   services.cockpit = {
     enable = true;
     openFirewall = true;
+    settings = {
+      WebService = {
+        Origins = "https://cockpit.samsehu.perli.casa wss://cockpit.samsehu.perli.casa";
+        ProtocolHeader = "X-Forwarded-Proto";
+        LoginTo = false;
+      };
+    };
   };
 
   services.udisks2.enable = true;
 
-  services.jellyfin = {
+  # Multimedia group
+  users.groups.multimedia = {};
+  users.users.lidarr.extraGroups = [ "aria2" ];
+  users.users.radarr.extraGroups = [ "aria2" ];
+  users.users.readarr.extraGroups = [ "aria2" ];
+  users.users.sonarr.extraGroups = [ "aria2" ];
+  users.users.bazarr.extraGroups = [ "multimedia" "aria2" ];
+  systemd.tmpfiles.rules = [
+    "d /zroot/media 0770 - multimedia - -"
+  ];
+
+  services.jellyfin = { enable = true; group = "multimedia"; };
+  services.lidarr   = { enable = true; group = "multimedia"; };
+  services.radarr   = { enable = true; group = "multimedia"; };
+  services.readarr  = { enable = true; group = "multimedia"; };
+  services.sonarr   = { enable = true; group = "multimedia"; };
+  services.bazarr   = { enable = true; user = "bazarr"; group = "multimedia"; };
+  services.prowlarr = { enable = true; };
+
+  users.users.komga.extraGroups = [ "multimedia" ];
+  services.komgaCustom = {
     enable = true;
-    openFirewall = true;
+    group = "multimedia";
+    settings = {
+      spring.security.oauth2.client = {
+        registration.dex = {
+          provider = "dex";
+          client-id = "komga";
+          client-secret = "insecure_secret";
+          client-name = "Komga";
+          scope = "openid,email";
+          authorization-grant-type = "authorization_code";
+          redirect-uri = "{baseUrl}/{action}/oauth2/code/{registrationId}";
+        };
+        provider.dex = {
+          user-name-attribute = "sub";
+          issuer-uri = "https://dex.samsehu.perli.casa";
+        };
+      };
+    };
+  };
+
+  systemd.services."netns@" = {
+    description = "%I network namespace";
+    before = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
+      ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
+    };
+  };
+
+  systemd.services.wg = {
+    description = "wg network interface";
+    bindsTo = [ "netns@wg.service" ];
+    requires = [ "network-online.target" ];
+  after = [ "netns@wg.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = with pkgs; writers.writeBash "wg-up" ''
+        set -e
+        # Create wireguard
+        ${iproute}/bin/ip link add wg0 type wireguard
+        # move to wg network namespace
+        ${iproute}/bin/ip link set wg0 netns wg
+        # Connect to vpn
+        ${iproute}/bin/ip -n wg address add 10.65.64.220/32 dev wg0
+        ${iproute}/bin/ip -n wg -6 address add fc00:bbbb:bbbb:bb01::2:40db/128 dev wg0
+        ${iproute}/bin/ip netns exec wg ${wireguard-tools}/bin/wg setconf wg0 /var/wireguard-keys/chief-frog.conf
+        # Open network
+        ${iproute}/bin/ip -n wg link set dev lo up
+        ${iproute}/bin/ip -n wg link set wg0 up
+        ${iproute}/bin/ip -n wg route add default dev wg0
+        ${iproute}/bin/ip -n wg -6 route add default dev wg0
+      '';
+      ExecStop = with pkgs; writers.writeBash "wg-down" ''
+        ${iproute}/bin/ip -n wg route del default dev wg0
+        ${iproute}/bin/ip -n wg -6 route del default dev wg0
+        ${iproute}/bin/ip -n wg link del wg0
+      '';
+    };
+  };
+
+  services.aria2 = {
+    enable = true;
+    extraArguments = "--bt-external-ip=10.65.64.220 --input-file=/var/lib/aria2/aria2.session --save-session-interval=60";
+  };
+  systemd.services."aria2" = {
+    bindsTo = [ "netns@wg.service" ];
+    requires = [ "network-online.target" ];
+    after = [ "wg.service" ];
+    serviceConfig = {
+      NetworkNamespacePath = "/var/run/netns/wg";
+    };
+  };
+
+  # reverse proxy the aria2 rpc from the `wg` network namespace to a unix domain socket
+  systemd.services."aria2-unix-domain-rpc" = {
+    bindsTo = [ "aria2.service" ];
+    after = [ "aria2.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      NetworkNamespacePath = "/var/run/netns/wg";
+      Type = "simple";
+      User = config.services.caddy.user;
+      Group = config.services.caddy.group;
+      RuntimeDirectory = "aria2";
+      ExecStart = with pkgs; writers.writeBash "aria2-unix-domain-rpc-listener" ''
+        set -e
+        ${socat}/bin/socat UNIX-LISTEN:/run/aria2/rpc.sock,reuseaddr,fork TCP:localhost:6800
+      '';
+    };
+  };
+  
+  systemd.services.dex.serviceConfig = {
+    StateDirectory = "dex";
+    WorkingDirectory = "%S/dex";
+  };
+  services.dex = {
+    enable = true;
+    environmentFile = config.age.secrets.DEX_ENVIRONMENT_FILE.path;
+    settings = {
+      issuer = "https://dex.samsehu.perli.casa";
+      web.http = "127.0.0.1:5556";
+
+      storage = {
+        type = "sqlite3";
+        config.file = "./dex.db";
+      };
+
+      # services that can get a token from our dex instance
+      staticClients = [
+        {
+          id = "forgejo";
+          secretEnv = "OIDC_APP_SECRET_FORGEJO";
+          name = "Forgejo";
+          redirectURIs = [ "https://git.samsehu.perli.casa/user/oauth2/dex/callback" ];
+        }
+        {
+          id = "headscale";
+          secretEnv = "OIDC_APP_SECRET_HEADSCALE";
+          name = "Headscale";
+          redirectURIs = [ "https://headscale.samsehu.perli.casa/oidc/callback" ];
+        }
+        {
+          id = "nextcloud";
+          secret = "insecure_secret";
+          name = "Nextcloud";
+          redirectURIs = [ "https://nextcloud.samsehu.perli.casa/apps/oidc_login/oidc"  "https://nextcloud.samsehu.perli.casa/index.php/apps/oidc_login/oidc" ];
+        }
+        {
+          id = "jellyfin";
+          secret = "insecure_secret";
+          name = "Jellyfin";
+          redirectURIs = [ "https://jellyfin.samsehu.perli.casa/sso/OID/redirect/dex" ];
+        }
+        {
+          id = "komga";
+          secret = "insecure_secret";
+          name = "Komga";
+          redirectURIs = [ "https://komga.samsehu.perli.casa/login/oauth2/code/dex" ];
+        }
+      ];
+
+      # authentication sources
+      connectors = [
+        {
+          type = "ldap";
+          id = "lldap";
+          name = "LLDAP";
+          config = {
+            host = "127.0.0.1:3890";
+            insecureNoSSL = true;
+            insecureSkipVerify = true;
+            startTLS = false;
+            bindDN = "uid=Immovable1809,ou=people,dc=samsehu,dc=perli,dc=casa";
+            bindPW = "$LLDAP_ADMIN_PASSWORD";
+
+            userSearch = {
+              baseDN = "ou=people,dc=samsehu,dc=perli,dc=casa";
+              username = "uid";
+              idAttr = "uid";
+              emailAttr = "mail";
+              nameAttr = "displayName";
+              preferredUsernameAttr = "uid";
+            };
+
+            groupSearch = {
+              baseDN = "ou=groups,dc=samsehu,dc=perli,dc=casa";
+              filter = "(objectClass=groupOfUniqueNames)";
+              userMatchers = [
+                { userAttr = "DN"; groupAttr = "member"; }
+              ];
+              nameAttr = "cn";
+            };
+          };
+        }
+      ];
+    };
   };
 
   services.blocky = {
@@ -109,41 +339,377 @@
           default = [ "ads" ];
         };
       };
+      customDNS = {
+        rewrite = {
+          "cockpit.samsehu.perli.casa" = "samsehu.perli.casa";
+          "git.samsehu.perli.casa" = "samsehu.perli.casa";
+          "nextcloud.samsehu.perli.casa" = "samsehu.perli.casa";
+        };
+        mapping = {
+          "samsehu.perli.casa" = "192.168.0.69";
+        };
+      };
     };
   };
 
   services.forgejo = {
     enable = true;
+    lfs.enable = true;
+    settings = {
+      server.ROOT_URL = "https://git.samsehu.perli.casa/";
+      server.HTTP_ADDR = "127.0.0.1";
+      actions.ENABLED = true;
+    };
   };
 
+  virtualisation.docker = {
+    enable = true;
+  };
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+    instances.default = {
+      enable = true;
+      name = "monolith";
+      url = "https://git.samsehu.perli.casa";
+      tokenFile = config.age.secrets.FORGEJO_ACTIONS_RUNNER.path;
+      labels = [ ];
+    };
+  };
+
+  # lldap LDAP authentication server
+  users.users.lldap = {
+    # allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
+    isSystemUser = true;
+    group = "lldap";
+  };
+  users.groups.lldap = {};
   services.lldap = {
     enable = true;
     settings = {
-      ldap_base_dn = "dc=twins,dc=pearson";
+      ldap_base_dn = "dc=samsehu,dc=perli,dc=casa";
       # Sets the root administrator's user name
-      ldap_user_dn = "admin";
-      # Default administrator password
-      ldap_user_pass = "extending pulsate nastily";
+      ldap_user_dn = "Immovable1809";
+      http_host = "127.0.0.1";
+    };
+    environment = {
+      LLDAP_LDAP_USER_PASS_FILE = config.age.secrets.LLDAP_ADMIN_PASSWORD.path;
     };
   };
 
-  # ACME client service for configuring SSL certificate
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "fresh.car0178@geemili.xyz";
-    certs."samsehu.perli.casa" = {
-      domain = "samsehu.perli.casa";
-      dnsProvider = "nearlyfreespeech";
-      credentialFiles = {
-        "NEARLYFREESPECH_API_KEY" = config.age.secrets.samsehu_NFSN_API_KEY.path;
-        "NEARLYFREESPECH_LOGIN" = config.age.secrets.samsehu_NFSN_LOGIN.path;
+  # Dynamic DNS through duck dns
+  users.users.dynamicdns = {
+    # allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
+    isSystemUser = true;
+    group = "dynamicdns";
+  };
+  users.groups.dynamicdns = {};
+  systemd.services.dynamic-dns-updater = {
+    serviceConfig.User = "dynamicdns";
+    path = [ pkgs.curl ];
+    script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} https://www.duckdns.org/update";
+    startAt = "hourly";
+  };
+  systemd.timers.dynamic-dns-updater = {
+    timerConfig.RandomizedDelaySec = "15m";
+  };
+  systemd.services.dynamic-dns-updater6 = {
+    serviceConfig.User = "dynamicdns";
+    path = [ pkgs.curl ];
+    script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} --url-query ipv6=$(ip -j -6 addr show scope global | jq -r .[0].addr_info.[0].local) https://www.duckdns.org/update";
+    startAt = "hourly";
+  };
+  systemd.timers.dynamic-dns-updater6 = {
+    timerConfig.RandomizedDelaySec = "15m";
+  };
+
+  # Next cloud setup
+  services.nginx.enable = false;
+  services.nextcloud = {
+    enable = true;
+    hostName = "nextcloud.samsehu.perli.casa";
+    config.adminpassFile = "/var/nextcloud-admin-pass";
+    config.trustedProxies = [
+      "100.64.0.3"
+    ];
+    caching.apcu = true;
+
+    # OIDC configuration
+    extraOptions = {
+        overwritewebroot = "/";
+
+        allow_user_to_change_display_name = false;
+        lost_password_link = "disabled";
+        oidc_login_provider_url = "https://dex.samsehu.perli.casa";
+        oidc_login_client_id = "nextcloud";
+        oidc_login_client_secret = "insecure_secret";
+        oidc_login_auto_redirect = true;
+        oidc_login_end_session_redirect = false;
+        oidc_login_button_text = "Log in with Dex";
+        oidc_login_hide_password_form = false;
+        oidc_login_use_id_token = true;
+        config.oidc_login_attributes = {
+          "id" = "preferred_username";
+          "name" = "name";
+          "mail" = "mail";
+          "groups" = "groups";
+        };
+        oidc_login_default_group = "oidc";
+        oidc_login_use_external_storage = true;
+        oidc_login_scope = "openid profile email groups";
+        oidc_login_proxy_ldap = false;
+        oidc_login_disable_registration = false;
+        oidc_login_redir_fallback = false;
+        oidc_login_alt_login_page = "assets/login.php";
+        oidc_login_tls_verify = true;
+        oidc_create_groups = false;
+        oidc_login_webdav_enabled = false;
+        oidc_login_password_authentication = false;
+        oidc_login_public_key_caching_time = 86400;
+        oidc_login_min_time_between_jwks_requests = 10;
+        oidc_login_well_known_caching_time = 86400;
+        oidc_login_update_avatar = false;
+    };
+
+    # Auto update apps
+    autoUpdateApps.enable = true;
+
+    extraApps = {
+      oidc_login = pkgs.fetchNextcloudApp {
+        appName = "OpenID Connect Login";
+        appVersion = "3.0.2";
+        sha256 = "sha256-cN5azlThKPKRVip14yfUNR85of5z+N6NVI7sg6pSGQI=";
+        license = "agpl3Plus";
+        url = "https://github.com/pulsejet/nextcloud-oidc-login/releases/download/v3.0.2/oidc_login.tar.gz";
+      };
+      gpoddersync = pkgs.fetchNextcloudApp { 
+        appName = "Gpodder Sync";
+        appVersion = "3.8.2";
+        sha256 = "sha256-eeBvRZUDVIaym0ngfPD2d7aY3SI/7lPWkrYPnqSh5Kw=";
+        license = "agpl3Plus";
+        url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz";
       };
     };
   };
+  services.phpfpm.pools.nextcloud.settings = {
+    "listen.owner" = config.services.caddy.user;
+    "listen.group" = config.services.caddy.group;
+  };
+
+  # Reverse proxy with Caddy
+  services.caddy = {
+    enable = true;
+    globalConfig = ''
+      email "fresh.car0178@geemili.xyz"
+    '';
+
+    virtualHosts."lldap.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:17170
+      }
+      respond 403
+    '';
+
+    virtualHosts."headscale.samsehu.perli.casa".extraConfig = ''
+      reverse_proxy localhost:64639
+    '';
+
+    virtualHosts."cockpit.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:9090
+      }
+      respond 403
+    '';
+
+    virtualHosts."git.samsehu.perli.casa".extraConfig = ''
+      reverse_proxy localhost:3000
+    '';
+
+    virtualHosts."jellyfin.samsehu.perli.casa".extraConfig = ''
+      reverse_proxy localhost:8096
+    '';
+
+    virtualHosts."nextcloud.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        # https://docs.nextcloud.com/server/27/admin_manual/issues/general_troubleshooting.html#service-discovery
+        redir /.well-known/carddav /remote.php/dav 301
+        redir /.well-known/caldav /remote.php/dav 301
+
+        root * ${config.services.nextcloud.package}
+        php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket} {
+          root ${config.services.nextcloud.package}
+          capture_stderr
+        }
+        file_server
+      }
+      respond 403
+    '';
+
+    virtualHosts."dex.samsehu.perli.casa".extraConfig = ''
+      reverse_proxy localhost:5556
+    '';
+
+    virtualHosts."aria.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48 private_ranges
+      handle @connected_via_tailscale {
+        handle /rpc {
+          reverse_proxy unix//run/aria2/rpc.sock
+        }
+        handle /jsonrpc {
+          reverse_proxy unix//run/aria2/rpc.sock
+        }
+        handle_path /ariang* {
+          root * ${pkgs.ariang}/share/ariang
+          file_server
+        }
+        redir / /ariang/#!/settings/rpc/set?protocol=wss&host=aria.samsehu.perli.casa&port=443&secret=YXJpYTJycGM=&interface=jsonrpc
+      }
+      respond 403
+    '';
+
+    virtualHosts."lid.arr.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:8686
+      }
+      respond 403
+    '';
+    virtualHosts."rad.arr.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:7878
+      }
+      respond 403
+    '';
+    virtualHosts."read.arr.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:8787
+      }
+      respond 403
+    '';
+    virtualHosts."son.arr.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:8989
+      }
+      respond 403
+    '';
+    virtualHosts."baz.arr.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:6767
+      }
+      respond 403
+    '';
+    virtualHosts."prowl.arr.samsehu.perli.casa".extraConfig = ''
+      @connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
+      handle @connected_via_tailscale {
+        reverse_proxy localhost:9696
+      }
+      respond 403
+    '';
+    virtualHosts."komga.samsehu.perli.casa".extraConfig = ''
+      reverse_proxy localhost:25600
+    '';
+  };
+
+  # Headscale for access to the network while away from home
+  users.users.headscale = {
+    isSystemUser = true;
+    group = "headscale";
+  };
+  users.groups.headscale = {};
+  services.headscale = {
+    enable = true;
+    package = pkgs.juanfont-headscale.headscale;
+    settings = {
+      server_url = "https://headscale.samsehu.perli.casa";
+      listen_addr = "127.0.0.1:64639";
+      metrics_listen_addr = "127.0.0.1:64640";
+      tls_cert_path = null;
+      tls_key_path = null;
+
+      dns_config = {
+        override_local_dns = true;
+        nameservers = [ "100.64.0.3" ];
+        magic_dns = true;
+        base_domain = "ts.samsehu.perli.casa";
+        restricted_nameservers = {
+          "samsehu.perli.casa" = [ "100.64.0.3" ];
+        };
+        extra_records = [
+          { name = "samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "cockpit.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "git.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "nextcloud.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "lldap.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "dex.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "jellyfin.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "aria.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "lid.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "rad.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "read.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "son.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "baz.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "prowl.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+          { name = "komga.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
+        ];
+      };
+
+      oidc = {
+        issuer = "https://dex.samsehu.perli.casa";
+        client_id = "headscale";
+        client_secret_path = config.age.secrets.OIDC_APP_SECRET_HEADSCALE.path;
+        scope = [ "openid" "profile" "email" ];
+      };
+
+      acl_policy_path = pkgs.writeText "acl_policy.hujson" ''
+        {
+          "groups": {
+            "group:servers": [
+              "samsehu",
+            ],
+            "group:admin": [
+              "geemili",
+              "desttinghim",
+            ],
+          },
+          "acls": [
+            {
+              "action": "accept",
+              "src": ["group:admin"],
+              "dst": ["*:*"],
+            }
+          ],
+          "ssh": [
+            {
+              "action": "accept",
+              "src": ["group:admin"],
+              "dst": ["group:servers"],
+              "users": ["group:admin", "geemili", "desttinghim", "forgejo"],
+            },
+            {
+              "action": "accept",
+              "src": ["geemili"],
+              "dst": ["geemili"],
+              "users": ["geemili"],
+            },
+          ],
+        }
+      '';
+    };
+  };
+
+  services.tailscale.enable = true;
 
   # Enable automatic upgrades
   system.autoUpgrade.enable = true;
   system.autoUpgrade.allowReboot = true;
+  system.autoUpgrade.flake = "git+http://127.0.0.1:3000/Twins/server-configuration.git";
 
   # Enable automatic garbage collection
   nix.gc = {
@@ -152,6 +718,8 @@
     options = "--delete-older-than 30d";
   };
 
+  nix.settings.trusted-users = [ "geemili" ];
+
   # Open ports in the firewall.
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [
@@ -161,22 +729,28 @@
     # Blocky API
     4000
 
-    # Forgejo web interface
-    3000
-
-    # lldap LDAP
-    3890
-
-    # lldap HTTP; user login and administration
-    17170
+    # Caddy HTTP and HTTPS
+    80
+    443
   ];
   networking.firewall.allowedUDPPorts = [
     # Blocky DNS
     53
+
+    # mDNS
+    5353
+
+    # Headscale UDP port for STUN protocol
+    3478
   ];
 
   # Use systemd-resolved and set networkmanager to allow mdns
-  services.resolved.enable = true;
+  services.resolved = {
+    enable = true;
+    extraConfig = ''
+      DNSStubListener=false
+    '';
+  };
   networking.networkmanager.connectionConfig."connection.mdns" = 2; # 2 == yes
 
   # Copy the NixOS configuration file and link it from the resulting system

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1703433843,
-        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
+        "lastModified": 1716561646,
+        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
+        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
         "type": "github"
       },
       "original": {
@@ -45,6 +45,24 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -66,13 +84,35 @@
         "type": "github"
       }
     },
+    "juanfont-headscale": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1702219574,
+        "narHash": "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=",
+        "owner": "juanfont",
+        "repo": "headscale",
+        "rev": "6049ec758ca46b5c6ee7abba4f3d472fb1e2ffa6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "juanfont",
+        "ref": "v0.23.0-alpha2",
+        "repo": "headscale",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1703467016,
-        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
+        "lastModified": 1716633019,
+        "narHash": "sha256-xim1b5/HZYbWaZKyI7cn9TJCM6ewNVZnesRr00mXeS4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
+        "rev": "9d29cd266cebf80234c98dd0b87256b6be0af44e",
         "type": "github"
       },
       "original": {
@@ -85,6 +125,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "juanfont-headscale": "juanfont-headscale",
         "nixpkgs": "nixpkgs"
       }
     },
@@ -102,6 +143,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -5,14 +5,31 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    juanfont-headscale = {
+      url = "github:juanfont/headscale/v0.23.0-alpha2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, agenix, juanfont-headscale }: {
+      packages.x86_64-linux = let pkgs = import nixpkgs { system = "x86_64-linux"; }; in rec {
+        cockpit-tailscale = pkgs.callPackage ./pkgs/cockpit-tailscale.nix {};
+        cockpit-zfs-manager = pkgs.callPackage ./pkgs/cockpit-zfs-manager.nix {};
       };
 
-  outputs = { self, nixpkgs, agenix }: {
       nixosConfigurations.samsehu = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
+          ({config, pkgs, ...}: {
+            nixpkgs.overlays = [ (final: prev: {
+              juanfont-headscale = juanfont-headscale.packages.${prev.system};
+              cockpit-tailscale = self.packages.${prev.system}.cockpit-tailscale;
+              cockpit-zfs-manager = self.packages.${prev.system}.cockpit-zfs-manager;
+            })];
+          })
           ./agenix-config-module.nix
           ./configuration.nix
+          ./services/komga.nix
           agenix.nixosModules.default
         ];
       };

pkgs/cockpit-tailscale.nix

@@ -0,0 +1,15 @@
+{ lib, stdenv, fetchzip }:
+stdenv.mkDerivation rec {
+  pname = "cockpit-tailscale";
+  version = "0.0.6";
+
+  src = fetchzip {
+    url = "https://github.com/spotsnel/cockpit-tailscale/releases/download/v${version}/cockpit-tailscale-v${version}.tar.gz";
+    sha256 = "sha256-ESUZdt8GVEToyrv6UP8lOff67LsumdJAY1lXvC3fBaI=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/cockpit
+    cp -r ${src} $out/share/cockpit/tailscale
+  '';
+}

pkgs/cockpit-zfs-manager.nix

@@ -0,0 +1,17 @@
+{ lib, stdenv, fetchFromGitHub }:
+stdenv.mkDerivation rec {
+  pname = "cockpit-zfs-manager";
+  version = "816af25099fccc46a3bff5f831b39d98ef33d514";
+
+  src = fetchFromGitHub {
+    owner = "leroycep";
+    repo = "cockpit-zfs-manager";
+    rev = "${version}";
+    hash = "sha256-aLdsHHVVG6eJrvh3B4grZkDEbCZyDJjX2PuKkON8UcI=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/cockpit
+    cp -r ${src}/zfs $out/share/cockpit/zfs
+  '';
+}

samsehu/matrix-conduit.nix

@@ -0,0 +1,35 @@
+
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, ... }:
+
+let
+  homeserver-url = "samsehu.perli.casa";
+in
+{
+  # configure matrix-conduit as a server to host chat communications with end-to-end encryption
+  services.matrix-conduit = {
+    enable = true;    
+    settings.global = {
+      server_name = "${homeserver-url}";
+      trusted_servers = [];
+    };
+  };
+
+  # Reverse proxy with Caddy
+  services.caddy.virtualHosts."${homeserver-url}" = {
+    serverAliases = [ "${homeserver-url}:8448" ];
+    extraConfig =  ''
+      respond /.well-known/matrix/server `{ "m.server": "${homeserver-url}" }` 200
+      respond /.well-known/matrix/client `{ "m.homeserver": { "base_url": "https://${homeserver-url}" } }` 200
+      reverse_proxy /_matrix/* localhost:${toString config.services.matrix-conduit.settings.global.port}
+    '';
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+}
+

secrets/samsehu_FORGEJO_ACTIONS_RUNNER.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yXNDbw n4kYnQIXz7rkvduE9oJ5XRxJfZJTUILuZ0r9s2+rW2g
+OtBaRY+mIQrPXS0+rg99u2aElUeguwJPk+yoK5jO+Z0
+-> ssh-ed25519 BTX+xA HIqdxxh8HwoDjfznL4caRc7HvkWYwn2S2h3bsHdaIRc
+rOFUTg2u/S83YJpJTAzRfVL3rdot+4Z1orEGYV+4J58
+--- 8BznEX1nb6xDa74lWVT2fgJo7MzFXLhnapbrU1Cqe70
+v\šIµ˜Iì&FÖlŽ¦µg]pƒÁr/s—6±ÍÇck¯ÿm!éTññÔj¿>(5-¦'•`
ªxâ	õ:Ø`<60>{ÁIxðw`“a7`

secrets/samsehu_LLDAP_ADMIN_PASSWORD.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 yXNDbw Juf0JMdCTwIPaPdK2llGdbtWG/4m5sD9iIuuvjM8HgM
+EhOuE1WJjVHcf7UZYxCdT0sa78n5bzh6kH7e08oY6x4
+-> ssh-ed25519 BTX+xA qBEbn6EWkOEO9PDmJCcYIWrEk652RumOCbaqIt4mVgU
+kCFkAXKya+lQctHK+i6f66zemcuqKmI9+cwuJKOpBLg
+--- cGf7Y9c6vyaFzKoZubiC3SelLhhm+r/iWAxqjLZWmRw
+œLÇqáÅÄÞ°
+DCëb‡ÖÐ3ÜßÉß(jÄ„œ&íxWÏn’2ÜŸP› )—z†‘œoK]>B6•yYÒ…õvw•%r«jKÇ7

secrets/samsehu_NFSN_API_KEY.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yXNDbw fIJwXjhuKTVLjQXxRAzkcXQR5sIrfbNYlyDJHeQjDgE
-/zdUzjnkojy5zTynh2dh3YAowIzBc630tsJnsRC9fJA
--> ssh-ed25519 BTX+xA 1xfWcwHEzRm+pAYtjsimUelhjPzX2ftXCqTT8ZC5Ai4
-ev6pWXEMB/5r5lvGIXnwb/5Y+y+KtF+82kXQsW27L8Q
---- TmO1kU6MHMyRRScZ4JFs67Dt8PNeuT900kEZFgB/+hM
-/g`Þ‡”WU±»=#¾©É¬Þ >}ºb™—~xE]Ü´'îï<>…$’¸‹[”‚ÄåÎ

secrets/samsehu_NFSN_LOGIN.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yXNDbw 62eQ1z2NUFkXLhNo7Cu++sLJC544LuGO9pF78eDqyBA
-FDhNUIerQRbCAK4YWjRw7pws2m7ohalSy08BuWDQhUM
--> ssh-ed25519 BTX+xA lzBif7+dwdtGCHugVucaPNIxXnPkeJt0NbXwggs4UAg
-eReSeftMwXfV3hKmgpdNP1uI/sCJqe8ReYZCnkvd1zc
---- u61FruBB1mBYUUpjsvOgZVfdMC8QnX6Mm7QXUGMjWt8
-Þè²bБ戛ó^?‹ ?%0ZÒ81àx•ÀÙݽ04@›5vöŽ<C3B6>

secrets/samsehu_OIDC_APP_SECRET_FORGEJO.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 yXNDbw rq3zM6yBAOw27casxuak0MTrhHXXfQranR8pL0osS3A
+6aDqYlDmYLLvxdorIxs4WB24mouWUHqbT5s3qgIx/lA
+-> ssh-ed25519 BTX+xA 1zd7nxWxmVfu1yMI4K5McNSV0ULLcZ0fVCGNNXIBw3k
+n1clgjKA4UjBRnokQm99x+q9OBi4muPdD70l1XMak4o
+--- URplj0eiKdqp222NxhGDYUmz+bho1zxam1hsf7trJ/g
+‡
+g(ÒÚÅàÑÁÑÕÔ«Ì1{ëï¡.YÌIqQ³úÓ”<%½-£6¼CEKüv9#Aóö³%@Vì·çˆKWŸ”‹ï

secrets/secrets.nix

@@ -5,6 +5,10 @@ let
   samsehu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRkyyUcmLsnX0oo1QzGeyPEqIc/i4ExcZClVoERggl9";
 in
 {
-  "samsehu_NFSN_API_KEY.age".publicKeys = geemili ++ [ samsehu ];
-  "samsehu_NFSN_LOGIN.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_DUCK_DNS_TOKEN.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_DEX_ENVIRONMENT_FILE.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_OIDC_APP_SECRET_HEADSCALE.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_OIDC_APP_SECRET_FORGEJO.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_LLDAP_ADMIN_PASSWORD.age".publicKeys = geemili ++ [ samsehu ];
+  "samsehu_FORGEJO_ACTIONS_RUNNER.age".publicKeys = geemili ++ [ samsehu ];
 }

services/komga.nix

@@ -0,0 +1,111 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.komgaCustom;
+  settingsFormat = pkgs.formats.yaml {};
+in  
+{
+  options = {
+    services.komgaCustom = {
+      enable = mkEnableOption (lib.mdDoc "Komga, a free and open source comics/mangas media server");
+
+      port = mkOption {
+        type = types.port;
+        default = 25600;
+        description = lib.mdDoc ''
+          The port that Komga will listen on.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "komga";
+        description = lib.mdDoc ''
+          User account under which Komga runs.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "komga";
+        description = lib.mdDoc ''
+          Group under which Komga runs.
+        '';
+      };
+
+      stateDir = mkOption {
+        type = types.str;
+        default = "/var/lib/komga";
+        description = lib.mdDoc ''
+          State and configuration directory Komga will use.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Whether to open the firewall for the port in {option}`services.komga.port`.
+        '';
+      };
+
+      settings = mkOption {
+        type = settingsFormat.type;
+        default = {};
+        description = lib.mdDoc ''
+          Configuration for application.yaml, see
+          <link xlink:href="https://komga.org/docs/installation/configuration"
+          for supported settings.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+    users.groups = mkIf (cfg.group == "komga") {
+      komga = {};
+    };
+
+    users.users = mkIf (cfg.user == "komga") {
+      komga = {
+        group = cfg.group;
+        home = cfg.stateDir;
+        description = "Komga Daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.komgaCustom = {
+      environment = {
+        SERVER_PORT = builtins.toString cfg.port;
+        KOMGA_CONFIGDIR = cfg.stateDir;
+      };
+
+      description = "Komga is a free and open source comics/mangas media server";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+
+        Type = "simple";
+        Restart = "on-failure";
+        ExecStartPre = pkgs.writeShellScript "komga-config-setup" ''
+          ln -sf ${settingsFormat.generate "application.yml" cfg.settings} ${cfg.stateDir}/application.yml
+        '';
+        ExecStart = "${pkgs.komga}/bin/komga";
+
+        StateDirectory = mkIf (cfg.stateDir == "/var/lib/komga") "komga";
+      };
+
+    };
+  };
+}