Compare commits

...

160 Commits

Author SHA1 Message Date
LeRoyce Pearson 43d59acf86 update forgejo actions runner registration token 2024-05-29 20:35:41 -06:00
LeRoyce Pearson 9955194ea6 forgejo-actions-runner: set empty labels list to use default labels 2024-05-29 20:33:09 -06:00
LeRoyce Pearson 559e2158bf fix: set env variable name in secret 2024-05-29 20:10:26 -06:00
LeRoyce Pearson b82f59df6b feat: add forgejo actions runner service 2024-05-29 19:27:18 -06:00
LeRoyce Pearson 42451d315e feat: forgejo: enable actions 2024-05-29 19:02:32 -06:00
LeRoyce Pearson 520c9fe07b set trusted servers to an empty list 2024-05-29 16:01:52 -06:00
LeRoyce Pearson 718be0fa12 update dependencies 2024-05-29 16:01:22 -06:00
LeRoyce Pearson 873faf615a feat: duck dns ipv6 updater 2024-02-04 15:57:53 -07:00
LeRoyce Pearson 3ecebeabcb fix: use serverAliases option 2024-02-04 14:20:09 -07:00
LeRoyce Pearson 96d7fb67ae feat: matrix-conduit: expose /_matrix/ on both ports 2024-02-04 14:02:23 -07:00
LeRoyce Pearson 7700905647 remove remaining references to glauth 2024-02-04 13:41:42 -07:00
LeRoyce Pearson 49df89c466 feat: add matrix-conduit service 2024-02-04 13:39:46 -07:00
Louis Pearson bce2cb54f2 feat: add komga service
Komga does not appear to be picking up the application.yml
configuration file. Maybe it's a permissions issue?
2024-01-30 03:40:56 -07:00
LeRoyce Pearson c53b7adc0f feat: add private_ranges to aria 2024-01-29 23:07:28 -07:00
LeRoyce Pearson 18b58f4891 feat: headscale: override local dns 2024-01-18 14:15:44 -07:00
LeRoyce Pearson e70104d9f1 feat: headscale: allow geemili ssh access to own devices 2024-01-18 14:04:59 -07:00
LeRoyce Pearson 520cf63ce9 feat: caddy: add `/rpc` path to virtualHost aria 2024-01-14 19:16:26 -07:00
LeRoyce Pearson 4abda434ce feat: aria2: load from session file, save session every minute 2024-01-14 19:09:55 -07:00
LeRoyce Pearson b9db4b8d4d feat: aria2: run downloads through vpn
But still allow the rpc to be accessed. This is done by reverse proxying
the rpc socket through a unix domain socket.
2024-01-14 18:50:04 -07:00
Louis Pearson 535d3d2797 feat: add bazarr 2024-01-13 00:48:49 -07:00
LeRoyce Pearson 1b9fe20810 remove Kodi frontend
Doesn't really make sense, and it was running very slowly.
2024-01-12 16:31:12 -07:00
LeRoyce Pearson 2fa3da6397 feat: add kodi service 2024-01-12 02:25:46 -07:00
Louis Pearson 66d067c6db feat: add jellyfin sso to dex 2024-01-12 00:45:48 -07:00
Louis Pearson 26af4b679b fix: remove kavita 2024-01-12 00:26:23 -07:00
LeRoyce Pearson dc837d75e4 fix: remove trailing newline from secret 2024-01-12 00:18:08 -07:00
LeRoyce Pearson 4ff174c931 feat: nextcloud: automatically redirect to dex for login 2024-01-11 23:17:21 -07:00
LeRoyce Pearson 4c1a356491 remove user_oidc package from nextcloud apps 2024-01-11 23:10:29 -07:00
LeRoyce Pearson 64677e8d5c fix: nextcloud: allow user creation from OIDC 2024-01-11 23:10:02 -07:00
LeRoyce Pearson f92a3d0fb9 fix: nextcloud: `secretEnv` -> `secret` 2024-01-11 23:01:31 -07:00
LeRoyce Pearson 17dd4cddd4 feat: nextcloud: user_oidc app 2024-01-11 22:48:07 -07:00
LeRoyce Pearson 389727bb14 fix: dex: change to take advantage of namespacing done by service 2024-01-11 22:22:00 -07:00
LeRoyce Pearson cc10291820 fix: dex: `cn=` -> `uid=` 2024-01-11 21:49:07 -07:00
LeRoyce Pearson fb1e4854ff fix: dex: `ou=apps` -> `ou=people` 2024-01-11 21:47:04 -07:00
LeRoyce Pearson 20aaf73cc3 fix: add missing `serviceConfig 2024-01-11 21:43:13 -07:00
LeRoyce Pearson 04dc7f766f fix: dex: use method similar to lldap for sqlite storage 2024-01-11 21:40:09 -07:00
LeRoyce Pearson b8d11783e8 fix: dex: `sqlite` -> `sqlite3` 2024-01-11 21:29:38 -07:00
LeRoyce Pearson 38468921ad ldap: remove glauth, switch back to only lldap 2024-01-11 21:18:43 -07:00
LeRoyce Pearson 77153bc647 glauth: add baseDN and nameFormat to sqlite datastore 2024-01-11 18:54:36 -07:00
LeRoyce Pearson b9b455c4f2 fix: add `index.php` into redirect URI 2024-01-11 18:54:11 -07:00
LeRoyce Pearson a0f15d7227 fix: nextcloud: overwrite webroot to `/` 2024-01-10 02:08:58 -07:00
LeRoyce Pearson 6fd486eb61 feat: nextcloud: WIP support for OIDC logins 2024-01-10 01:46:06 -07:00
LeRoyce Pearson fcb095a346 feat: nextcloud: install oidc_login app 2024-01-10 01:22:41 -07:00
LeRoyce Pearson 9d6c20d1ba expose oidc server to the world 2024-01-10 00:59:22 -07:00
LeRoyce Pearson df1214e7d2 fix: get headscale and glauth starting up nicely again 2024-01-10 00:48:59 -07:00
LeRoyce Pearson 922165b439 feat: glauth: sqlite backend for runtime users 2024-01-10 00:26:01 -07:00
Louis Pearson 40a83335f8 fix: plain wg0 no namespace blah 2024-01-09 23:48:05 -07:00
Louis Pearson b0f61ff0dc feat: bridge wg namespace to root 2024-01-09 23:32:20 -07:00
Louis Pearson 927e91aae8 feat: wireguard vpn for aria2 2024-01-09 22:38:19 -07:00
Louis Pearson 601cbbfc46 fix: make *arr servers part of aria2 group 2024-01-09 19:32:46 -07:00
LeRoyce Pearson 2192fdf886 feat: Add lldap to magicDNS records 2024-01-09 18:43:41 -07:00
LeRoyce Pearson 2d48308206 remove unnecessary groups from glauth 2024-01-09 18:43:27 -07:00
LeRoyce Pearson be442a16c1 fix: glauth: use `cn` for nameFormat 2024-01-09 18:38:09 -07:00
LeRoyce Pearson 5b07801210 fix: glauth: add ldap scheme to server url 2024-01-09 18:33:14 -07:00
LeRoyce Pearson e32e78228e feat: glauth: add lldap as a datastore 2024-01-09 18:31:26 -07:00
LeRoyce Pearson 92d7f6b513 fix: headscale: remove trailing slash from OIDC issuer url 2024-01-09 18:19:39 -07:00
LeRoyce Pearson fc95fa8caa fix: give ownership of headscale oidc secret file to headscale user 2024-01-09 18:14:58 -07:00
LeRoyce Pearson a7d62018d8 feat: headscale: add OIDC authentication for single-sign on 2024-01-09 18:11:18 -07:00
Louis Pearson 78ea01ebec feat: add prowlarr 2024-01-09 17:51:59 -07:00
Louis Pearson 16fdef77d8 feat: add /zroot/media 2024-01-09 17:06:27 -07:00
LeRoyce Pearson 362b227202 fix: put connect_via_tailscale matcher inside block 2024-01-09 16:40:25 -07:00
LeRoyce Pearson f224052eca refactor: use ip filtering instead of address binding 2024-01-09 16:36:16 -07:00
Louis Pearson fecaee1a83 fix: make network interfaces required by caddy with bindsto 2024-01-09 15:45:29 -07:00
LeRoyce Pearson 5c7672e67f fix: `caddy.service.service` -> `caddy.service` 2024-01-09 15:25:49 -07:00
Louis Pearson 7c9f92d7ee feat: import zroot on boot 2024-01-09 15:21:20 -07:00
LeRoyce Pearson fb7fd99294 feat: remove nextcloud from zroot
This should _hopefully_ remove the race condition between `zfs-mount`
and `nextcloud`, meaning `zroot` will get automatically mounted.
2024-01-09 14:35:10 -07:00
LeRoyce Pearson f7ed9dacd1 fix: typo: use all lowercase for "requires" and "after" 2024-01-09 14:32:05 -07:00
LeRoyce Pearson 4eb27ecea6 fix: add missing semicolon 2024-01-09 14:30:14 -07:00
LeRoyce Pearson 00d4f16122 fix: caddy: wait for tailscale0 before starting 2024-01-09 14:26:28 -07:00
LeRoyce Pearson ebd4de710b fix: cockpit-zfs-manager: remove /sbin/ prefixes 2024-01-09 13:35:30 -07:00
LeRoyce Pearson 67c27b2a9c fix: cockpit-zfs-manager: update to non-absolute executable paths 2024-01-09 13:28:28 -07:00
Louis Pearson 912d4a353c feat: give each *arr it's own subdomain 2024-01-09 13:06:40 -07:00
LeRoyce Pearson cacf5d39ab feat: cockpit: add zfs-manager plugin 2024-01-09 12:52:27 -07:00
Louis Pearson dd23078aae fix: simplify arr configuration 2024-01-09 12:42:05 -07:00
LeRoyce Pearson 84be02a122 feat: cockpit: add cockpit-tailscale plugin 2024-01-09 12:23:56 -07:00
Louis Pearson 77d3ea5593 fix: use real path to static files 2024-01-09 03:03:46 -07:00
Louis Pearson 91948a75f9 feat: add static resources for *arr servers 2024-01-09 02:56:06 -07:00
Louis Pearson 62a1d699f4 feat: expose *arr servers on tailnet 2024-01-09 02:43:17 -07:00
Louis Pearson 5558a958db feat: add the *arrs 2024-01-09 02:38:09 -07:00
Louis Pearson dea3419777 fix: aria caddy configuration, don't download to zfs 2024-01-08 22:46:14 -07:00
Louis Pearson 9331b7b809 fix: ariang: handle_path for jsonrpc 2024-01-08 22:00:13 -07:00
Louis Pearson a0f4b191fa fix: ariang: use handle instead of setting file_server root 2024-01-08 21:55:21 -07:00
Louis Pearson 18af100e0c fix: set root on file_server 2024-01-08 21:45:50 -07:00
Louis Pearson 923835a684 fix: ariang path routing 2024-01-08 21:39:58 -07:00
Louis Pearson 1153c3ecd9 fix: redirect loop 2024-01-08 21:37:01 -07:00
Louis Pearson f72d1e8d9c feat: reverse proxy aria, redirect base aria url to query setting 2024-01-08 21:31:41 -07:00
Louis Pearson 63e7d1fa81 fix: prevent matcher error for aria root 2024-01-08 21:09:19 -07:00
Louis Pearson af03f19638 feat: remove deluge, add aria 2024-01-08 21:05:21 -07:00
Louis Pearson 2e1aff7b4f fix: make deluge config declarative, add auth file 2024-01-08 00:32:32 -07:00
Louis Pearson 859c4a1648 feat: add deluge 2024-01-08 00:16:42 -07:00
Louis Pearson bc1a3dad08 feat: add kavita 2024-01-08 00:15:31 -07:00
LeRoyce Pearson af899a7176 feat: add dex SSO service 2024-01-08 00:07:34 -07:00
LeRoyce Pearson 2086636237 feat: add secrets/DEX_ENVIRONMENT_FILE.age for dex 2024-01-07 23:54:17 -07:00
LeRoyce Pearson 920517510e refactor: change baseDN to `samsehu.perli.casa` 2024-01-07 16:27:45 -07:00
Louis Pearson e7109a915c fix: use correct appid for Gpodder Sync 2024-01-07 15:44:24 -07:00
Louis Pearson 4f68122655 feat: add Gpodder Sync to nextcloud 2024-01-07 15:39:41 -07:00
Louis Pearson 7386bb969a feat: add otherGroups to glauth example users 2024-01-07 14:40:23 -07:00
Louis Pearson 5026d3a12c fix: glauth: dn->dc, add example users to config 2024-01-07 14:32:59 -07:00
Louis Pearson daa8de96bb feat: expose glauth api to tailnet 2024-01-07 14:08:19 -07:00
Louis Pearson c76664e9e5 fix: create user and group for glauth service 2024-01-07 13:58:26 -07:00
Louis Pearson 0cb5e1f17e fix: add default target to glauth service 2024-01-07 13:51:33 -07:00
Louis Pearson 320e3e8673 feat: add glauth 2024-01-07 13:43:00 -07:00
LeRoyce Pearson cb2909cf9c fix: DNS: add some subdomains to tailscale DNS 2024-01-07 09:40:42 -07:00
LeRoyce Pearson bd2147b258 nextcloud: remove postgres configuration 2024-01-07 09:21:58 -07:00
LeRoyce Pearson 97af0dfd02 fix: dns: use NAT ip for general DNS, override A record in headscale 2024-01-07 09:18:30 -07:00
Louis Pearson 3fa9d96d42 fix: dbType -> dbtype 2024-01-07 01:32:26 -07:00
Louis Pearson aa92f6afaa fix: autoupdateapps 2024-01-07 01:30:57 -07:00
Louis Pearson 719c7d9149 Use postgres instead of sqlite 2024-01-07 01:27:54 -07:00
LeRoyce Pearson 6166d5d019 feat: nextcloud: enable caching with apcu 2024-01-07 01:20:10 -07:00
Louis Pearson be61652641 fix: remove onlyoffice 2024-01-07 01:13:23 -07:00
Louis Pearson 68f49492c6 feat: add onlyoffice to extraApps 2024-01-07 00:57:10 -07:00
LeRoyce Pearson 9b6be1ebd6 feat: nextcloud: add tailscale ip as a trusted proxy 2024-01-06 23:59:48 -07:00
LeRoyce Pearson e580eeb25e feat: add forgejo to list of allowed ssh users 2024-01-06 23:42:26 -07:00
LeRoyce Pearson 7245d96672 feat: nextcloud: redir carddav and caldav urls 2024-01-06 23:41:24 -07:00
LeRoyce Pearson 8a4cb72f95 try adding file_server directive to nextcloud reverse proxy 2024-01-06 23:29:03 -07:00
LeRoyce Pearson abad306538 fix: remove header_up Host
The template wasn't working, removing the fixes it.
2024-01-06 22:24:47 -07:00
LeRoyce Pearson 0eb7ee1dbd change trusted proxy address to loopback address 2024-01-06 22:15:08 -07:00
LeRoyce Pearson 01bad7312d remove seafile service 2024-01-06 21:38:21 -07:00
Louis Pearson 1af93b01fc fix: add trusted proxy 2024-01-06 21:37:55 -07:00
Louis Pearson f567578946 fix: upstream_hostport -> upstream.hostport 2024-01-06 21:28:57 -07:00
Louis Pearson d882da8ee8 chore: remove debug logging from caddy/phpfpm 2024-01-06 21:22:34 -07:00
Louis Pearson c875fa2254 feat: use correct root for nextcloud 2024-01-06 21:16:36 -07:00
LeRoyce Pearson d838aa7384 feat: enable seafile service 2024-01-06 20:18:18 -07:00
Louis Pearson 5e38b310bc feat: add debug directive to caddy 2024-01-06 20:13:35 -07:00
Louis Pearson 51bd059485 feat: increase phpfpm log level 2024-01-06 19:56:59 -07:00
Louis Pearson cd1db41963 feat: replace host in nextcloud http headers 2024-01-06 19:36:38 -07:00
LeRoyce Pearson 808d47b0f1 fix: don't bind to wildcard ipv6 address 2024-01-06 19:31:23 -07:00
LeRoyce Pearson 0f09208680 fix: some services were not binding correctly
Some of them still aren't. I've also disabled http/3 because there seems
to be a bug in the QUIC implementation.
2024-01-06 19:19:08 -07:00
Louis Pearson c102645202 fix: use reverse_proxy for nextcloud 2024-01-06 18:05:51 -07:00
Louis Pearson 9c7c4d0220 fix: change nextcloud hostname 2024-01-06 17:49:51 -07:00
Louis Pearson b5c36c6b2d feat: add nextcloud subdomain to blockydns 2024-01-06 17:33:27 -07:00
LeRoyce Pearson a8b9f4b593 feat: blocky: add domain rewrite for forgejo domain 2024-01-06 17:31:29 -07:00
Louis Pearson b968abd805 fix: caddy: use php_fastcgi instead of reverse_proxy for nextcloud 2024-01-06 17:24:21 -07:00
Louis Pearson 78a926be38 fix: remove slash from caddy nextcloud config 2024-01-06 17:17:57 -07:00
Louis Pearson 8e82f4c332 fix: remove https enable in nextcloud 2024-01-06 17:08:19 -07:00
LeRoyce Pearson 9bbd6514ff feat: restrict samsehu.perli.casa DNS queries to magicDNS 2024-01-06 16:51:56 -07:00
LeRoyce Pearson deffbdf8f5 fix: use ts.samsehu.perli.casa for tailnet domains 2024-01-06 16:41:47 -07:00
Louis Pearson 71dee4ccb5 fix: get nextcloud building on dev machine 2024-01-06 16:33:44 -07:00
Louis Pearson 9a20745da6 fix: remove database.createLocally 2024-01-06 16:18:05 -07:00
Louis Pearson 5ec51dbfdb fix: remove unneeded nextcloud conf 2024-01-06 16:15:32 -07:00
LeRoyce Pearson 4ad5130303 feat: set EDITOR environment variable 2024-01-06 16:11:50 -07:00
LeRoyce Pearson 9c1db356b7 Configure base domain for dnsd 2024-01-06 16:02:46 -07:00
Louis Pearson 61c7fbbfe9 fix: nextcloud config 2024-01-06 15:54:49 -07:00
Louis Pearson 66f08c8bbd feat: add nextcloud 2024-01-06 15:45:15 -07:00
LeRoyce Pearson 254f2db23d more stuff 2024-01-06 14:43:02 -07:00
Louis Pearson 6a3d080566 feat: add ZFS 2024-01-06 14:41:24 -07:00
LeRoyce Pearson 6a465666ee no time to explain, lots of changes 2024-01-06 12:30:05 -07:00
LeRoyce Pearson 1d220920e0 feat(headscale): enable magic DNS 2024-01-01 01:57:51 -07:00
LeRoyce Pearson 292ba5e4be fix: add git as a system package and use `git+http` scheme 2023-12-31 22:38:08 -07:00
LeRoyce Pearson 31b1594d67 fix: add http schema to flake uri 2023-12-31 22:34:41 -07:00
LeRoyce Pearson 2b5a0f18d9 fix: use flake for autoUpgrade instead of /etc/nixos 2023-12-31 22:32:44 -07:00
LeRoyce Pearson 5ff437e58c security: disable root login and logging in with passwords 2023-12-31 22:27:25 -07:00
LeRoyce Pearson 5763692afd fix: create lldap user and group to ensure that it can access secrets 2023-12-31 18:27:23 -07:00
LeRoyce Pearson f307e79d38 feat: open mDNS UDP port 2023-12-30 22:14:03 -07:00
LeRoyce Pearson cd4c98a4a8 sec: put lldap default admin password in agenix and update it 2023-12-30 19:39:57 -07:00
LeRoyce Pearson f4029e6197 feat: reverse proxy all services via caddy 2023-12-30 19:14:02 -07:00
LeRoyce Pearson 17ab5f7472 fix: remove secrets from agenix-config-module 2023-12-30 12:07:58 -07:00
LeRoyce Pearson 0e00e52391 refactor: remove DNS-01 ACME challenge and related secrets 2023-12-30 12:04:36 -07:00
LeRoyce Pearson 7073225e85 feat: ddns and caddy server 2023-12-30 12:00:30 -07:00
LeRoyce Pearson da55c99dc9 feat: add `geemili` user as a trusted nix user
This allows me to push configuration updates to the samsehu host
2023-12-29 22:10:30 -07:00
LeRoyce Pearson 7162630e2f fix: some typos 2023-12-29 22:10:20 -07:00
18 changed files with 916 additions and 62 deletions

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
result

View File

@ -1,4 +1,19 @@
{
age.secrets.samsehu_NFSN_API_KEY.file = ./secrets/samsehu_NFSN_API_KEY.age;
age.secrets.samsehu_NFSN_LOGIN.file = ./secrets/samsehu_NFSN_LOGIN.age;
age.secrets.samsehu_DUCK_DNS_TOKEN = {
file = ./secrets/samsehu_DUCK_DNS_TOKEN.age;
owner = "dynamicdns";
group = "dynamicdns";
};
age.secrets.LLDAP_ADMIN_PASSWORD = {
file = ./secrets/samsehu_LLDAP_ADMIN_PASSWORD.age;
owner = "lldap";
group = "lldap";
};
age.secrets.DEX_ENVIRONMENT_FILE.file = ./secrets/samsehu_DEX_ENVIRONMENT_FILE.age;
age.secrets.OIDC_APP_SECRET_HEADSCALE = {
file = ./secrets/samsehu_OIDC_APP_SECRET_HEADSCALE.age;
owner = "headscale";
group = "headscale";
};
age.secrets.FORGEJO_ACTIONS_RUNNER.file = ./secrets/samsehu_FORGEJO_ACTIONS_RUNNER.age;
}

View File

@ -7,12 +7,20 @@
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
./hardware/samsehu.nix
./samsehu/matrix-conduit.nix
];
# Use the `systemd-boot` boot loader
boot.loader.systemd-boot.enable = true;
# Added following instructions of openzfs configuration
# randomly generated with `head -c4 /dev/urandom | od -A none -t x4`
networking.hostId = "3e52e44f";
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.forceImportRoot = false;
boot.zfs.extraPools = [ "zroot" ];
networking.hostName = "samsehu"; # Define your hostname.
# Pick only one of the below networking options.
@ -55,23 +63,245 @@
environment.systemPackages = with pkgs; [
helix
wget
git
juanfont-headscale.headscale # install to allow debugging/control of headscale using the CLI
# Plugins for cockpit
cockpit-tailscale
cockpit-zfs-manager
];
environment.variables = {
EDITOR = "hx";
VISUAL = "hx";
};
# List services that you want to enable:
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "no";
};
services.cockpit = {
enable = true;
openFirewall = true;
settings = {
WebService = {
Origins = "https://cockpit.samsehu.perli.casa wss://cockpit.samsehu.perli.casa";
ProtocolHeader = "X-Forwarded-Proto";
LoginTo = false;
};
};
};
services.udisks2.enable = true;
services.jellyfin = {
# Multimedia group
users.groups.multimedia = {};
users.users.lidarr.extraGroups = [ "aria2" ];
users.users.radarr.extraGroups = [ "aria2" ];
users.users.readarr.extraGroups = [ "aria2" ];
users.users.sonarr.extraGroups = [ "aria2" ];
users.users.bazarr.extraGroups = [ "multimedia" "aria2" ];
systemd.tmpfiles.rules = [
"d /zroot/media 0770 - multimedia - -"
];
services.jellyfin = { enable = true; group = "multimedia"; };
services.lidarr = { enable = true; group = "multimedia"; };
services.radarr = { enable = true; group = "multimedia"; };
services.readarr = { enable = true; group = "multimedia"; };
services.sonarr = { enable = true; group = "multimedia"; };
services.bazarr = { enable = true; user = "bazarr"; group = "multimedia"; };
services.prowlarr = { enable = true; };
users.users.komga.extraGroups = [ "multimedia" ];
services.komgaCustom = {
enable = true;
openFirewall = true;
group = "multimedia";
settings = {
spring.security.oauth2.client = {
registration.dex = {
provider = "dex";
client-id = "komga";
client-secret = "insecure_secret";
client-name = "Komga";
scope = "openid,email";
authorization-grant-type = "authorization_code";
redirect-uri = "{baseUrl}/{action}/oauth2/code/{registrationId}";
};
provider.dex = {
user-name-attribute = "sub";
issuer-uri = "https://dex.samsehu.perli.casa";
};
};
};
};
systemd.services."netns@" = {
description = "%I network namespace";
before = [ "network.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
};
};
systemd.services.wg = {
description = "wg network interface";
bindsTo = [ "netns@wg.service" ];
requires = [ "network-online.target" ];
after = [ "netns@wg.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = with pkgs; writers.writeBash "wg-up" ''
set -e
# Create wireguard
${iproute}/bin/ip link add wg0 type wireguard
# move to wg network namespace
${iproute}/bin/ip link set wg0 netns wg
# Connect to vpn
${iproute}/bin/ip -n wg address add 10.65.64.220/32 dev wg0
${iproute}/bin/ip -n wg -6 address add fc00:bbbb:bbbb:bb01::2:40db/128 dev wg0
${iproute}/bin/ip netns exec wg ${wireguard-tools}/bin/wg setconf wg0 /var/wireguard-keys/chief-frog.conf
# Open network
${iproute}/bin/ip -n wg link set dev lo up
${iproute}/bin/ip -n wg link set wg0 up
${iproute}/bin/ip -n wg route add default dev wg0
${iproute}/bin/ip -n wg -6 route add default dev wg0
'';
ExecStop = with pkgs; writers.writeBash "wg-down" ''
${iproute}/bin/ip -n wg route del default dev wg0
${iproute}/bin/ip -n wg -6 route del default dev wg0
${iproute}/bin/ip -n wg link del wg0
'';
};
};
services.aria2 = {
enable = true;
extraArguments = "--bt-external-ip=10.65.64.220 --input-file=/var/lib/aria2/aria2.session --save-session-interval=60";
};
systemd.services."aria2" = {
bindsTo = [ "netns@wg.service" ];
requires = [ "network-online.target" ];
after = [ "wg.service" ];
serviceConfig = {
NetworkNamespacePath = "/var/run/netns/wg";
};
};
# reverse proxy the aria2 rpc from the `wg` network namespace to a unix domain socket
systemd.services."aria2-unix-domain-rpc" = {
bindsTo = [ "aria2.service" ];
after = [ "aria2.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
NetworkNamespacePath = "/var/run/netns/wg";
Type = "simple";
User = config.services.caddy.user;
Group = config.services.caddy.group;
RuntimeDirectory = "aria2";
ExecStart = with pkgs; writers.writeBash "aria2-unix-domain-rpc-listener" ''
set -e
${socat}/bin/socat UNIX-LISTEN:/run/aria2/rpc.sock,reuseaddr,fork TCP:localhost:6800
'';
};
};
systemd.services.dex.serviceConfig = {
StateDirectory = "dex";
WorkingDirectory = "%S/dex";
};
services.dex = {
enable = true;
environmentFile = config.age.secrets.DEX_ENVIRONMENT_FILE.path;
settings = {
issuer = "https://dex.samsehu.perli.casa";
web.http = "127.0.0.1:5556";
storage = {
type = "sqlite3";
config.file = "./dex.db";
};
# services that can get a token from our dex instance
staticClients = [
{
id = "forgejo";
secretEnv = "OIDC_APP_SECRET_FORGEJO";
name = "Forgejo";
redirectURIs = [ "https://git.samsehu.perli.casa/user/oauth2/dex/callback" ];
}
{
id = "headscale";
secretEnv = "OIDC_APP_SECRET_HEADSCALE";
name = "Headscale";
redirectURIs = [ "https://headscale.samsehu.perli.casa/oidc/callback" ];
}
{
id = "nextcloud";
secret = "insecure_secret";
name = "Nextcloud";
redirectURIs = [ "https://nextcloud.samsehu.perli.casa/apps/oidc_login/oidc" "https://nextcloud.samsehu.perli.casa/index.php/apps/oidc_login/oidc" ];
}
{
id = "jellyfin";
secret = "insecure_secret";
name = "Jellyfin";
redirectURIs = [ "https://jellyfin.samsehu.perli.casa/sso/OID/redirect/dex" ];
}
{
id = "komga";
secret = "insecure_secret";
name = "Komga";
redirectURIs = [ "https://komga.samsehu.perli.casa/login/oauth2/code/dex" ];
}
];
# authentication sources
connectors = [
{
type = "ldap";
id = "lldap";
name = "LLDAP";
config = {
host = "127.0.0.1:3890";
insecureNoSSL = true;
insecureSkipVerify = true;
startTLS = false;
bindDN = "uid=Immovable1809,ou=people,dc=samsehu,dc=perli,dc=casa";
bindPW = "$LLDAP_ADMIN_PASSWORD";
userSearch = {
baseDN = "ou=people,dc=samsehu,dc=perli,dc=casa";
username = "uid";
idAttr = "uid";
emailAttr = "mail";
nameAttr = "displayName";
preferredUsernameAttr = "uid";
};
groupSearch = {
baseDN = "ou=groups,dc=samsehu,dc=perli,dc=casa";
filter = "(objectClass=groupOfUniqueNames)";
userMatchers = [
{ userAttr = "DN"; groupAttr = "member"; }
];
nameAttr = "cn";
};
};
}
];
};
};
services.blocky = {
@ -109,41 +339,377 @@
default = [ "ads" ];
};
};
customDNS = {
rewrite = {
"cockpit.samsehu.perli.casa" = "samsehu.perli.casa";
"git.samsehu.perli.casa" = "samsehu.perli.casa";
"nextcloud.samsehu.perli.casa" = "samsehu.perli.casa";
};
mapping = {
"samsehu.perli.casa" = "192.168.0.69";
};
};
};
};
services.forgejo = {
enable = true;
lfs.enable = true;
settings = {
server.ROOT_URL = "https://git.samsehu.perli.casa/";
server.HTTP_ADDR = "127.0.0.1";
actions.ENABLED = true;
};
};
virtualisation.docker = {
enable = true;
};
services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = "monolith";
url = "https://git.samsehu.perli.casa";
tokenFile = config.age.secrets.FORGEJO_ACTIONS_RUNNER.path;
labels = [ ];
};
};
# lldap LDAP authentication server
users.users.lldap = {
# allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
isSystemUser = true;
group = "lldap";
};
users.groups.lldap = {};
services.lldap = {
enable = true;
settings = {
ldap_base_dn = "dc=twins,dc=pearson";
ldap_base_dn = "dc=samsehu,dc=perli,dc=casa";
# Sets the root administrator's user name
ldap_user_dn = "admin";
# Default administrator password
ldap_user_pass = "extending pulsate nastily";
ldap_user_dn = "Immovable1809";
http_host = "127.0.0.1";
};
environment = {
LLDAP_LDAP_USER_PASS_FILE = config.age.secrets.LLDAP_ADMIN_PASSWORD.path;
};
};
# ACME client service for configuring SSL certificate
security.acme = {
acceptTerms = true;
defaults.email = "fresh.car0178@geemili.xyz";
certs."samsehu.perli.casa" = {
domain = "samsehu.perli.casa";
dnsProvider = "nearlyfreespeech";
credentialFiles = {
"NEARLYFREESPECH_API_KEY" = config.age.secrets.samsehu_NFSN_API_KEY.path;
"NEARLYFREESPECH_LOGIN" = config.age.secrets.samsehu_NFSN_LOGIN.path;
# Dynamic DNS through duck dns
users.users.dynamicdns = {
# allocates the `uid` in the range 100-999, which indicates to software like login managers that it should not be displayed to the user.
isSystemUser = true;
group = "dynamicdns";
};
users.groups.dynamicdns = {};
systemd.services.dynamic-dns-updater = {
serviceConfig.User = "dynamicdns";
path = [ pkgs.curl ];
script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} https://www.duckdns.org/update";
startAt = "hourly";
};
systemd.timers.dynamic-dns-updater = {
timerConfig.RandomizedDelaySec = "15m";
};
systemd.services.dynamic-dns-updater6 = {
serviceConfig.User = "dynamicdns";
path = [ pkgs.curl ];
script = "curl --silent --url-query domains=samsehuperli --url-query token@${config.age.secrets.samsehu_DUCK_DNS_TOKEN.path} --url-query ipv6=$(ip -j -6 addr show scope global | jq -r .[0].addr_info.[0].local) https://www.duckdns.org/update";
startAt = "hourly";
};
systemd.timers.dynamic-dns-updater6 = {
timerConfig.RandomizedDelaySec = "15m";
};
# Next cloud setup
services.nginx.enable = false;
services.nextcloud = {
enable = true;
hostName = "nextcloud.samsehu.perli.casa";
config.adminpassFile = "/var/nextcloud-admin-pass";
config.trustedProxies = [
"100.64.0.3"
];
caching.apcu = true;
# OIDC configuration
extraOptions = {
overwritewebroot = "/";
allow_user_to_change_display_name = false;
lost_password_link = "disabled";
oidc_login_provider_url = "https://dex.samsehu.perli.casa";
oidc_login_client_id = "nextcloud";
oidc_login_client_secret = "insecure_secret";
oidc_login_auto_redirect = true;
oidc_login_end_session_redirect = false;
oidc_login_button_text = "Log in with Dex";
oidc_login_hide_password_form = false;
oidc_login_use_id_token = true;
config.oidc_login_attributes = {
"id" = "preferred_username";
"name" = "name";
"mail" = "mail";
"groups" = "groups";
};
oidc_login_default_group = "oidc";
oidc_login_use_external_storage = true;
oidc_login_scope = "openid profile email groups";
oidc_login_proxy_ldap = false;
oidc_login_disable_registration = false;
oidc_login_redir_fallback = false;
oidc_login_alt_login_page = "assets/login.php";
oidc_login_tls_verify = true;
oidc_create_groups = false;
oidc_login_webdav_enabled = false;
oidc_login_password_authentication = false;
oidc_login_public_key_caching_time = 86400;
oidc_login_min_time_between_jwks_requests = 10;
oidc_login_well_known_caching_time = 86400;
oidc_login_update_avatar = false;
};
# Auto update apps
autoUpdateApps.enable = true;
extraApps = {
oidc_login = pkgs.fetchNextcloudApp {
appName = "OpenID Connect Login";
appVersion = "3.0.2";
sha256 = "sha256-cN5azlThKPKRVip14yfUNR85of5z+N6NVI7sg6pSGQI=";
license = "agpl3Plus";
url = "https://github.com/pulsejet/nextcloud-oidc-login/releases/download/v3.0.2/oidc_login.tar.gz";
};
gpoddersync = pkgs.fetchNextcloudApp {
appName = "Gpodder Sync";
appVersion = "3.8.2";
sha256 = "sha256-eeBvRZUDVIaym0ngfPD2d7aY3SI/7lPWkrYPnqSh5Kw=";
license = "agpl3Plus";
url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz";
};
};
};
services.phpfpm.pools.nextcloud.settings = {
"listen.owner" = config.services.caddy.user;
"listen.group" = config.services.caddy.group;
};
# Reverse proxy with Caddy
services.caddy = {
enable = true;
globalConfig = ''
email "fresh.car0178@geemili.xyz"
'';
virtualHosts."lldap.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:17170
}
respond 403
'';
virtualHosts."headscale.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:64639
'';
virtualHosts."cockpit.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:9090
}
respond 403
'';
virtualHosts."git.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:3000
'';
virtualHosts."jellyfin.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:8096
'';
virtualHosts."nextcloud.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
# https://docs.nextcloud.com/server/27/admin_manual/issues/general_troubleshooting.html#service-discovery
redir /.well-known/carddav /remote.php/dav 301
redir /.well-known/caldav /remote.php/dav 301
root * ${config.services.nextcloud.package}
php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket} {
root ${config.services.nextcloud.package}
capture_stderr
}
file_server
}
respond 403
'';
virtualHosts."dex.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:5556
'';
virtualHosts."aria.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48 private_ranges
handle @connected_via_tailscale {
handle /rpc {
reverse_proxy unix//run/aria2/rpc.sock
}
handle /jsonrpc {
reverse_proxy unix//run/aria2/rpc.sock
}
handle_path /ariang* {
root * ${pkgs.ariang}/share/ariang
file_server
}
redir / /ariang/#!/settings/rpc/set?protocol=wss&host=aria.samsehu.perli.casa&port=443&secret=YXJpYTJycGM=&interface=jsonrpc
}
respond 403
'';
virtualHosts."lid.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:8686
}
respond 403
'';
virtualHosts."rad.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:7878
}
respond 403
'';
virtualHosts."read.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:8787
}
respond 403
'';
virtualHosts."son.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:8989
}
respond 403
'';
virtualHosts."baz.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:6767
}
respond 403
'';
virtualHosts."prowl.arr.samsehu.perli.casa".extraConfig = ''
@connected_via_tailscale remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
handle @connected_via_tailscale {
reverse_proxy localhost:9696
}
respond 403
'';
virtualHosts."komga.samsehu.perli.casa".extraConfig = ''
reverse_proxy localhost:25600
'';
};
# Headscale for access to the network while away from home
users.users.headscale = {
isSystemUser = true;
group = "headscale";
};
users.groups.headscale = {};
services.headscale = {
enable = true;
package = pkgs.juanfont-headscale.headscale;
settings = {
server_url = "https://headscale.samsehu.perli.casa";
listen_addr = "127.0.0.1:64639";
metrics_listen_addr = "127.0.0.1:64640";
tls_cert_path = null;
tls_key_path = null;
dns_config = {
override_local_dns = true;
nameservers = [ "100.64.0.3" ];
magic_dns = true;
base_domain = "ts.samsehu.perli.casa";
restricted_nameservers = {
"samsehu.perli.casa" = [ "100.64.0.3" ];
};
extra_records = [
{ name = "samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "cockpit.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "git.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "nextcloud.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "lldap.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "dex.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "jellyfin.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "aria.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "lid.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "rad.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "read.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "son.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "baz.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "prowl.arr.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
{ name = "komga.samsehu.perli.casa"; type = "A"; value = "100.64.0.3"; }
];
};
oidc = {
issuer = "https://dex.samsehu.perli.casa";
client_id = "headscale";
client_secret_path = config.age.secrets.OIDC_APP_SECRET_HEADSCALE.path;
scope = [ "openid" "profile" "email" ];
};
acl_policy_path = pkgs.writeText "acl_policy.hujson" ''
{
"groups": {
"group:servers": [
"samsehu",
],
"group:admin": [
"geemili",
"desttinghim",
],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["*:*"],
}
],
"ssh": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["group:servers"],
"users": ["group:admin", "geemili", "desttinghim", "forgejo"],
},
{
"action": "accept",
"src": ["geemili"],
"dst": ["geemili"],
"users": ["geemili"],
},
],
}
'';
};
};
services.tailscale.enable = true;
# Enable automatic upgrades
system.autoUpgrade.enable = true;
system.autoUpgrade.allowReboot = true;
system.autoUpgrade.flake = "git+http://127.0.0.1:3000/Twins/server-configuration.git";
# Enable automatic garbage collection
nix.gc = {
@ -152,6 +718,8 @@
options = "--delete-older-than 30d";
};
nix.settings.trusted-users = [ "geemili" ];
# Open ports in the firewall.
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [
@ -161,22 +729,28 @@
# Blocky API
4000
# Forgejo web interface
3000
# lldap LDAP
3890
# lldap HTTP; user login and administration
17170
# Caddy HTTP and HTTPS
80
443
];
networking.firewall.allowedUDPPorts = [
# Blocky DNS
53
# mDNS
5353
# Headscale UDP port for STUN protocol
3478
];
# Use systemd-resolved and set networkmanager to allow mdns
services.resolved.enable = true;
services.resolved = {
enable = true;
extraConfig = ''
DNSStubListener=false
'';
};
networking.networkmanager.connectionConfig."connection.mdns" = 2; # 2 == yes
# Copy the NixOS configuration file and link it from the resulting system

View File

@ -10,11 +10,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1703433843,
"narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
"lastModified": 1716561646,
"narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
"owner": "ryantm",
"repo": "agenix",
"rev": "417caa847f9383e111d1397039c9d4337d024bf0",
"rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
"type": "github"
},
"original": {
@ -45,6 +45,24 @@
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1701680307,
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@ -66,13 +84,35 @@
"type": "github"
}
},
"juanfont-headscale": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1702219574,
"narHash": "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=",
"owner": "juanfont",
"repo": "headscale",
"rev": "6049ec758ca46b5c6ee7abba4f3d472fb1e2ffa6",
"type": "github"
},
"original": {
"owner": "juanfont",
"ref": "v0.23.0-alpha2",
"repo": "headscale",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1703467016,
"narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
"lastModified": 1716633019,
"narHash": "sha256-xim1b5/HZYbWaZKyI7cn9TJCM6ewNVZnesRr00mXeS4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
"rev": "9d29cd266cebf80234c98dd0b87256b6be0af44e",
"type": "github"
},
"original": {
@ -85,6 +125,7 @@
"root": {
"inputs": {
"agenix": "agenix",
"juanfont-headscale": "juanfont-headscale",
"nixpkgs": "nixpkgs"
}
},
@ -102,6 +143,21 @@
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",

View File

@ -5,14 +5,31 @@
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixpkgs";
};
juanfont-headscale = {
url = "github:juanfont/headscale/v0.23.0-alpha2";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, agenix, juanfont-headscale }: {
packages.x86_64-linux = let pkgs = import nixpkgs { system = "x86_64-linux"; }; in rec {
cockpit-tailscale = pkgs.callPackage ./pkgs/cockpit-tailscale.nix {};
cockpit-zfs-manager = pkgs.callPackage ./pkgs/cockpit-zfs-manager.nix {};
};
outputs = { self, nixpkgs, agenix }: {
nixosConfigurations.samsehu = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
({config, pkgs, ...}: {
nixpkgs.overlays = [ (final: prev: {
juanfont-headscale = juanfont-headscale.packages.${prev.system};
cockpit-tailscale = self.packages.${prev.system}.cockpit-tailscale;
cockpit-zfs-manager = self.packages.${prev.system}.cockpit-zfs-manager;
})];
})
./agenix-config-module.nix
./configuration.nix
./services/komga.nix
agenix.nixosModules.default
];
};

View File

@ -0,0 +1,15 @@
{ lib, stdenv, fetchzip }:
stdenv.mkDerivation rec {
pname = "cockpit-tailscale";
version = "0.0.6";
src = fetchzip {
url = "https://github.com/spotsnel/cockpit-tailscale/releases/download/v${version}/cockpit-tailscale-v${version}.tar.gz";
sha256 = "sha256-ESUZdt8GVEToyrv6UP8lOff67LsumdJAY1lXvC3fBaI=";
};
installPhase = ''
mkdir -p $out/share/cockpit
cp -r ${src} $out/share/cockpit/tailscale
'';
}

View File

@ -0,0 +1,17 @@
{ lib, stdenv, fetchFromGitHub }:
stdenv.mkDerivation rec {
pname = "cockpit-zfs-manager";
version = "816af25099fccc46a3bff5f831b39d98ef33d514";
src = fetchFromGitHub {
owner = "leroycep";
repo = "cockpit-zfs-manager";
rev = "${version}";
hash = "sha256-aLdsHHVVG6eJrvh3B4grZkDEbCZyDJjX2PuKkON8UcI=";
};
installPhase = ''
mkdir -p $out/share/cockpit
cp -r ${src}/zfs $out/share/cockpit/zfs
'';
}

View File

@ -0,0 +1,35 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{ config, lib, pkgs, ... }:
let
homeserver-url = "samsehu.perli.casa";
in
{
# configure matrix-conduit as a server to host chat communications with end-to-end encryption
services.matrix-conduit = {
enable = true;
settings.global = {
server_name = "${homeserver-url}";
trusted_servers = [];
};
};
# Reverse proxy with Caddy
services.caddy.virtualHosts."${homeserver-url}" = {
serverAliases = [ "${homeserver-url}:8448" ];
extraConfig = ''
respond /.well-known/matrix/server `{ "m.server": "${homeserver-url}" }` 200
respond /.well-known/matrix/client `{ "m.homeserver": { "base_url": "https://${homeserver-url}" } }` 200
reverse_proxy /_matrix/* localhost:${toString config.services.matrix-conduit.settings.global.port}
'';
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
}

Binary file not shown.

Binary file not shown.

View File

@ -0,0 +1,7 @@
age-encryption.org/v1
-> ssh-ed25519 yXNDbw n4kYnQIXz7rkvduE9oJ5XRxJfZJTUILuZ0r9s2+rW2g
OtBaRY+mIQrPXS0+rg99u2aElUeguwJPk+yoK5jO+Z0
-> ssh-ed25519 BTX+xA HIqdxxh8HwoDjfznL4caRc7HvkWYwn2S2h3bsHdaIRc
rOFUTg2u/S83YJpJTAzRfVL3rdot+4Z1orEGYV+4J58
--- 8BznEX1nb6xDa74lWVT2fgJo7MzFXLhnapbrU1Cqe70
v\šIµ˜Iì&FÖlŽ¦µg]pƒÁr/s—6±ÍÇck¯ÿm!éTññÔj¿ >(5-¦'•` ªxâ õ:Ø`<60>{ÁIxðw`“a7`

View File

@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 yXNDbw Juf0JMdCTwIPaPdK2llGdbtWG/4m5sD9iIuuvjM8HgM
EhOuE1WJjVHcf7UZYxCdT0sa78n5bzh6kH7e08oY6x4
-> ssh-ed25519 BTX+xA qBEbn6EWkOEO9PDmJCcYIWrEk652RumOCbaqIt4mVgU
kCFkAXKya+lQctHK+i6f66zemcuqKmI9+cwuJKOpBLg
--- cGf7Y9c6vyaFzKoZubiC3SelLhhm+r/iWAxqjLZWmRw
œLÇqáÅÄÞ°
DCëb‡ÖÐ3ÜßÉß(jÄ„œ&íxWÏn2ÜŸP )—z†œoK]>B6•yYÒ…õvw•%r«jKÇ7

View File

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 yXNDbw fIJwXjhuKTVLjQXxRAzkcXQR5sIrfbNYlyDJHeQjDgE
/zdUzjnkojy5zTynh2dh3YAowIzBc630tsJnsRC9fJA
-> ssh-ed25519 BTX+xA 1xfWcwHEzRm+pAYtjsimUelhjPzX2ftXCqTT8ZC5Ai4
ev6pWXEMB/5r5lvGIXnwb/5Y+y+KtF+82kXQsW27L8Q
--- TmO1kU6MHMyRRScZ4JFs67Dt8PNeuT900kEZFgB/+hM
/g`Þ‡”WU±»=#¾©É¬Þ >}ºb™—~xE]Ü´'î ï<>…$¸[”‚ÄåÎ

View File

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 yXNDbw 62eQ1z2NUFkXLhNo7Cu++sLJC544LuGO9pF78eDqyBA
FDhNUIerQRbCAK4YWjRw7pws2m7ohalSy08BuWDQhUM
-> ssh-ed25519 BTX+xA lzBif7+dwdtGCHugVucaPNIxXnPkeJt0NbXwggs4UAg
eReSeftMwXfV3hKmgpdNP1uI/sCJqe8ReYZCnkvd1zc
--- u61FruBB1mBYUUpjsvOgZVfdMC8QnX6Mm7QXUGMjWt8
Þè²bÐæˆó^ ? ?%0ZÒ81àx•ÀÙݽ04@5vöŽ<C3B6>

View File

@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 yXNDbw rq3zM6yBAOw27casxuak0MTrhHXXfQranR8pL0osS3A
6aDqYlDmYLLvxdorIxs4WB24mouWUHqbT5s3qgIx/lA
-> ssh-ed25519 BTX+xA 1zd7nxWxmVfu1yMI4K5McNSV0ULLcZ0fVCGNNXIBw3k
n1clgjKA4UjBRnokQm99x+q9OBi4muPdD70l1XMak4o
--- URplj0eiKdqp222NxhGDYUmz+bho1zxam1hsf7trJ/g
g(ÒÚÅàÑÁÑÕÔ«Ì1ï¡.YÌIqQ³úÓ”<%½-£6¼CEKüv9#Aóö³%@Vì·çˆKWŸ” ‹ï

Binary file not shown.

View File

@ -5,6 +5,10 @@ let
samsehu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRkyyUcmLsnX0oo1QzGeyPEqIc/i4ExcZClVoERggl9";
in
{
"samsehu_NFSN_API_KEY.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_NFSN_LOGIN.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_DUCK_DNS_TOKEN.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_DEX_ENVIRONMENT_FILE.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_OIDC_APP_SECRET_HEADSCALE.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_OIDC_APP_SECRET_FORGEJO.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_LLDAP_ADMIN_PASSWORD.age".publicKeys = geemili ++ [ samsehu ];
"samsehu_FORGEJO_ACTIONS_RUNNER.age".publicKeys = geemili ++ [ samsehu ];
}

111
services/komga.nix Normal file
View File

@ -0,0 +1,111 @@
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.services.komgaCustom;
settingsFormat = pkgs.formats.yaml {};
in
{
options = {
services.komgaCustom = {
enable = mkEnableOption (lib.mdDoc "Komga, a free and open source comics/mangas media server");
port = mkOption {
type = types.port;
default = 25600;
description = lib.mdDoc ''
The port that Komga will listen on.
'';
};
user = mkOption {
type = types.str;
default = "komga";
description = lib.mdDoc ''
User account under which Komga runs.
'';
};
group = mkOption {
type = types.str;
default = "komga";
description = lib.mdDoc ''
Group under which Komga runs.
'';
};
stateDir = mkOption {
type = types.str;
default = "/var/lib/komga";
description = lib.mdDoc ''
State and configuration directory Komga will use.
'';
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
Whether to open the firewall for the port in {option}`services.komga.port`.
'';
};
settings = mkOption {
type = settingsFormat.type;
default = {};
description = lib.mdDoc ''
Configuration for application.yaml, see
<link xlink:href="https://komga.org/docs/installation/configuration"
for supported settings.
'';
};
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
users.groups = mkIf (cfg.group == "komga") {
komga = {};
};
users.users = mkIf (cfg.user == "komga") {
komga = {
group = cfg.group;
home = cfg.stateDir;
description = "Komga Daemon user";
isSystemUser = true;
};
};
systemd.services.komgaCustom = {
environment = {
SERVER_PORT = builtins.toString cfg.port;
KOMGA_CONFIGDIR = cfg.stateDir;
};
description = "Komga is a free and open source comics/mangas media server";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
serviceConfig = {
User = cfg.user;
Group = cfg.group;
Type = "simple";
Restart = "on-failure";
ExecStartPre = pkgs.writeShellScript "komga-config-setup" ''
ln -sf ${settingsFormat.generate "application.yml" cfg.settings} ${cfg.stateDir}/application.yml
'';
ExecStart = "${pkgs.komga}/bin/komga";
StateDirectory = mkIf (cfg.stateDir == "/var/lib/komga") "komga";
};
};
};
}