mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-07 21:42:16 -06:00
chore: init
This commit is contained in:
Nick
commit
1b2c1ea359
891 changed files with 37053 additions and 0 deletions
114
modules/nixos/services/acme/default.nix
Executable file
114
modules/nixos/services/acme/default.nix
Executable file
|
|
@ -0,0 +1,114 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.people.users.${user0}) email;
|
||||
inherit (flake.config.services) instances;
|
||||
domain0 = instances.web.domains.url0;
|
||||
domain1 = instances.web.domains.url1;
|
||||
domain3 = instances.web.domains.url3;
|
||||
domain4 = flake.inputs.linkpage.secrets.domains.projectsite;
|
||||
dns0 = instances.web.dns.provider0;
|
||||
dns1 = instances.web.dns.provider1;
|
||||
dns0Path = "dns/${dns0}";
|
||||
dns1Path = "dns/${dns1}";
|
||||
instanceName = service: (instances.${service}.subdomain);
|
||||
dnsConfig = provider: dns: {
|
||||
dnsProvider = dns;
|
||||
directory = instances.acme.paths.path0;
|
||||
environmentFile = config.sops.secrets.${provider}.path;
|
||||
};
|
||||
in
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = email.address0;
|
||||
server = "https://acme-v02.api.letsencrypt.org/directory";
|
||||
};
|
||||
certs = builtins.listToAttrs (
|
||||
(map
|
||||
(service: {
|
||||
name = "${instanceName service}.${domain0}";
|
||||
value = dnsConfig dns0Path dns0;
|
||||
})
|
||||
[
|
||||
"audiobookshelf"
|
||||
"glance"
|
||||
"jellyfin"
|
||||
"minecraft"
|
||||
"nextcloud"
|
||||
"ollama"
|
||||
"searx"
|
||||
"syncthing"
|
||||
"vaultwarden"
|
||||
"opencloud"
|
||||
"prompter"
|
||||
"comfyui"
|
||||
]
|
||||
)
|
||||
++ (map
|
||||
(service: {
|
||||
name = "${instanceName service}.${domain3}";
|
||||
value = dnsConfig dns0Path dns0;
|
||||
})
|
||||
[
|
||||
"forgejo"
|
||||
"mastodon"
|
||||
"peertube"
|
||||
]
|
||||
)
|
||||
++ (map
|
||||
(name: {
|
||||
name = name;
|
||||
value = dnsConfig dns0Path dns0;
|
||||
})
|
||||
[
|
||||
domain0
|
||||
domain1
|
||||
domain3
|
||||
]
|
||||
)
|
||||
++ (map
|
||||
(name: {
|
||||
name = name;
|
||||
value = dnsConfig dns1Path dns1;
|
||||
})
|
||||
[
|
||||
domain4
|
||||
]
|
||||
)
|
||||
);
|
||||
};
|
||||
sops =
|
||||
let
|
||||
dnsList = [
|
||||
dns0
|
||||
dns1
|
||||
];
|
||||
secretList = [
|
||||
"pass"
|
||||
];
|
||||
sopsPath = secret: dns: {
|
||||
path = "/var/lib/secrets/${instances.acme.name}/${dns}-${secret}";
|
||||
owner = "root";
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
builtins.concatLists (
|
||||
map (
|
||||
dns:
|
||||
map (secret: {
|
||||
name = "dns/${dns}";
|
||||
value = sopsPath secret dns;
|
||||
}) secretList
|
||||
) dnsList
|
||||
)
|
||||
);
|
||||
};
|
||||
}
|
||||
58
modules/nixos/services/audiobookshelf/default.nix
Executable file
58
modules/nixos/services/audiobookshelf/default.nix
Executable file
|
|
@ -0,0 +1,58 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances) audiobookshelf web;
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
service = audiobookshelf;
|
||||
host = service.domains.url0;
|
||||
localhost = web.localhost.address0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
audiobookshelf = {
|
||||
enable = true;
|
||||
host = localhost;
|
||||
port = service.ports.port0;
|
||||
dataDir = service.name;
|
||||
openFirewall = true;
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
redir /.well-known/carddav /remote.php/dav/ 301
|
||||
redir /.well-known/caldav /remote.php/dav/ 301
|
||||
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
|
||||
encode gzip zstd
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
39
modules/nixos/services/caddy/default.nix
Executable file
39
modules/nixos/services/caddy/default.nix
Executable file
|
|
@ -0,0 +1,39 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances)
|
||||
caddy
|
||||
web
|
||||
;
|
||||
|
||||
domain0 = web.domains.url0;
|
||||
|
||||
service = caddy;
|
||||
in
|
||||
{
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"${domain0}" = {
|
||||
extraConfig = ''
|
||||
tls /var/lib/acme/${domain0}/fullchain.pem /var/lib/acme/${domain0}/key.pem
|
||||
encode zstd gzip
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"acme"
|
||||
"nextcloud"
|
||||
"mastodon"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
service.ports.port1
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
148
modules/nixos/services/comfyui/default.nix
Executable file
148
modules/nixos/services/comfyui/default.nix
Executable file
|
|
@ -0,0 +1,148 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.services.instances) comfyui web;
|
||||
service = comfyui;
|
||||
localhost = web.localhost.address1;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
# Enable Docker (nvidia-container-toolkit will auto-enable via graphics.nix)
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableNvidia = true;
|
||||
autoPrune = {
|
||||
enable = true;
|
||||
dates = "weekly";
|
||||
};
|
||||
};
|
||||
|
||||
# hardware.nvidia-container-toolkit.enable = true;
|
||||
|
||||
# Create ComfyUI Docker container
|
||||
virtualisation.oci-containers = {
|
||||
backend = "docker";
|
||||
containers.comfyui = {
|
||||
image = "yanwk/comfyui-boot:cu126-slim";
|
||||
autoStart = true;
|
||||
|
||||
ports = [
|
||||
"${localhost}:${toString service.ports.port0}:8188"
|
||||
];
|
||||
|
||||
volumes = [
|
||||
# Main data directory
|
||||
"${service.paths.path0}:/root"
|
||||
# Specific subdirectories for better control
|
||||
"${service.paths.path0}/models:/root/models"
|
||||
"${service.paths.path0}/custom_nodes:/root/custom_nodes"
|
||||
"${service.paths.path0}/output:/root/output"
|
||||
"${service.paths.path0}/input:/root/input"
|
||||
"${service.paths.path0}/user:/root/user"
|
||||
];
|
||||
|
||||
environment = {
|
||||
CLI_ARGS = "--listen 0.0.0.0 --port 8188 --preview-method auto --dont-print-server";
|
||||
NVIDIA_VISIBLE_DEVICES = "0";
|
||||
NVIDIA_DRIVER_CAPABILITIES = "compute,utility,graphics";
|
||||
};
|
||||
|
||||
extraOptions = [
|
||||
"--runtime=nvidia"
|
||||
"--gpus=device=0"
|
||||
# Memory limits to prevent OOM
|
||||
"--memory=32g"
|
||||
"--memory-swap=32g"
|
||||
"--shm-size=16g"
|
||||
# Security
|
||||
"--security-opt=no-new-privileges:true"
|
||||
# Network
|
||||
"--network=bridge"
|
||||
# Health check
|
||||
"--health-cmd=curl -f http://localhost:8188/ || exit 1"
|
||||
"--health-interval=30s"
|
||||
"--health-timeout=10s"
|
||||
"--health-retries=3"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Caddy reverse proxy with WebSocket support
|
||||
services.caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
basicauth {
|
||||
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
|
||||
}
|
||||
|
||||
# Main reverse proxy with WebSocket support
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0} {
|
||||
header_up Host {host}
|
||||
header_up X-Real-IP {remote}
|
||||
header_up X-Forwarded-For {remote}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
|
||||
# WebSocket support - critical for ComfyUI real-time updates
|
||||
header_up Connection {>Connection}
|
||||
header_up Upgrade {>Upgrade}
|
||||
|
||||
# Longer timeouts for generation tasks
|
||||
transport http {
|
||||
read_timeout 300s
|
||||
write_timeout 300s
|
||||
}
|
||||
}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
|
||||
# Security headers
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||
X-Frame-Options "DENY"
|
||||
X-Content-Type-Options "nosniff"
|
||||
X-XSS-Protection "1; mode=block"
|
||||
Referrer-Policy "strict-origin-when-cross-origin"
|
||||
-Server
|
||||
}
|
||||
|
||||
# Logging
|
||||
log {
|
||||
output file /var/log/caddy/comfyui-access.log
|
||||
format json
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Setup directories with proper permissions
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${service.paths.path0} 755 root root -"
|
||||
"Z ${service.sops.path0} 755 caddy caddy -"
|
||||
"d /var/log/caddy 755 caddy caddy -"
|
||||
];
|
||||
|
||||
# Kernel tuning for AI workloads
|
||||
boot.kernel.sysctl = {
|
||||
"kernel.shmmax" = 68719476736;
|
||||
"kernel.shmall" = 4194304;
|
||||
"vm.swappiness" = 1;
|
||||
"vm.dirty_ratio" = 15;
|
||||
"vm.dirty_background_ratio" = 5;
|
||||
};
|
||||
|
||||
# Ensure Docker service waits for network
|
||||
systemd.services.docker-comfyui = {
|
||||
after = [
|
||||
"network-online.target"
|
||||
"docker.service"
|
||||
];
|
||||
wants = [ "network-online.target" ];
|
||||
requires = [ "docker.service" ];
|
||||
};
|
||||
}
|
||||
11
modules/nixos/services/default.nix
Executable file
11
modules/nixos/services/default.nix
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
let
|
||||
importList =
|
||||
let
|
||||
content = builtins.readDir ./.;
|
||||
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
|
||||
in
|
||||
map (name: ./. + "/${name}") dirContent;
|
||||
in
|
||||
{
|
||||
imports = importList;
|
||||
}
|
||||
7
modules/nixos/services/espanso/default.nix
Executable file
7
modules/nixos/services/espanso/default.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
services.espanso = {
|
||||
package = pkgs.espanso-wayland;
|
||||
enable = true;
|
||||
};
|
||||
}
|
||||
3
modules/nixos/services/flatpak/default.nix
Executable file
3
modules/nixos/services/flatpak/default.nix
Executable file
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
services.flatpak.enable = true;
|
||||
}
|
||||
118
modules/nixos/services/forgejo/default.nix
Executable file
118
modules/nixos/services/forgejo/default.nix
Executable file
|
|
@ -0,0 +1,118 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
inherit (flake.config.services.instances) smtp forgejo web;
|
||||
service = forgejo;
|
||||
localhost = web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
forgejo = {
|
||||
enable = true;
|
||||
database.type = "postgres";
|
||||
lfs.enable = true;
|
||||
secrets = {
|
||||
mailer.PASSWD = config.sops.secrets."${service.name}-smtp".path;
|
||||
database.PASSWD = config.sops.secrets."${service.name}-database".path;
|
||||
};
|
||||
dump = {
|
||||
interval = "5:00";
|
||||
type = "zip";
|
||||
file = "forgejo-backup";
|
||||
enable = true;
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = host;
|
||||
ROOT_URL = "https://${host}/";
|
||||
HTTP_PORT = service.ports.port0;
|
||||
};
|
||||
# If you need to start from scratch, don't forget to turn this off again
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
mirror = {
|
||||
ENABLED = true;
|
||||
};
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = smtp.hostname;
|
||||
FROM = service.email.address0;
|
||||
USER = service.email.address0;
|
||||
PROTOCOL = "smtp+starttls";
|
||||
SMTP_PORT = smtp.ports.port0;
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
USE_CLIENT_CERT = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"smtp"
|
||||
"database"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"caddy"
|
||||
"postgres"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
BIN
modules/nixos/services/glance/assets/logo.png
Executable file
BIN
modules/nixos/services/glance/assets/logo.png
Executable file
Binary file not shown.
|
After Width: | Height: | Size: 46 KiB |
7
modules/nixos/services/glance/config/branding.nix
Executable file
7
modules/nixos/services/glance/config/branding.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
hide-footer = true;
|
||||
# logo-url = "/assets/logo.png";
|
||||
# app-name = "My Dashboard";
|
||||
# favicon-url = "/assets/logo.png";
|
||||
# app-icon-url = "/assets/logo.png";
|
||||
}
|
||||
50
modules/nixos/services/glance/config/pages.nix
Executable file
50
modules/nixos/services/glance/config/pages.nix
Executable file
|
|
@ -0,0 +1,50 @@
|
|||
{ config, flake, ... }:
|
||||
let
|
||||
widgetsPath = ./widgets;
|
||||
widgets = {
|
||||
jellyfin = import (widgetsPath + /jelly) { inherit config flake; };
|
||||
steam = import (widgetsPath + /steam);
|
||||
podcasts = import (widgetsPath + /podcasts.nix);
|
||||
calendar = import (widgetsPath + /calendar.nix);
|
||||
clock = import (widgetsPath + /clock.nix);
|
||||
weather = import (widgetsPath + /weather.nix);
|
||||
reddit = import (widgetsPath + /reddit.nix);
|
||||
videos = import (widgetsPath + /videos.nix);
|
||||
repos = import (widgetsPath + /repos.nix);
|
||||
};
|
||||
in
|
||||
[
|
||||
{
|
||||
columns = [
|
||||
{
|
||||
size = "full";
|
||||
widgets = [
|
||||
{
|
||||
type = "group";
|
||||
widgets = [
|
||||
widgets.podcasts
|
||||
widgets.videos
|
||||
];
|
||||
}
|
||||
widgets.reddit
|
||||
];
|
||||
}
|
||||
{
|
||||
size = "small";
|
||||
widgets = [
|
||||
widgets.steam
|
||||
widgets.repos
|
||||
];
|
||||
}
|
||||
{
|
||||
size = "small";
|
||||
widgets = [
|
||||
widgets.calendar
|
||||
widgets.weather
|
||||
widgets.clock
|
||||
];
|
||||
}
|
||||
];
|
||||
name = "Dashboard";
|
||||
}
|
||||
]
|
||||
16
modules/nixos/services/glance/config/server.nix
Executable file
16
modules/nixos/services/glance/config/server.nix
Executable file
|
|
@ -0,0 +1,16 @@
|
|||
{ flake, configHelpers, ... }:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
in
|
||||
{
|
||||
assets-path = "/home/${user0}/Files/Projects/dotfiles/modules/nixos/services/glance/assets";
|
||||
# host = configHelpers.host;
|
||||
# host = configHelpers.localhost;
|
||||
host = ceres.wireguard.ip0;
|
||||
port = configHelpers.service.ports.port0;
|
||||
# auth = {
|
||||
# secret-key = config.sops.secrets."${service.name}-key".path;
|
||||
# users.${user0}.password = config.sops.secrets."${service.name}-${user0}-pass".path;
|
||||
# };
|
||||
}
|
||||
7
modules/nixos/services/glance/config/theme.nix
Executable file
7
modules/nixos/services/glance/config/theme.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
background-color = "232 23 18";
|
||||
contrast-multiplier = 1.2;
|
||||
primary-color = "220 83 75";
|
||||
positive-color = "105 48 72";
|
||||
negative-color = "351 74 73";
|
||||
}
|
||||
5
modules/nixos/services/glance/config/widgets/calendar.nix
Executable file
5
modules/nixos/services/glance/config/widgets/calendar.nix
Executable file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
type = "calendar";
|
||||
title = "Calendar";
|
||||
style = "vertical-cards";
|
||||
}
|
||||
22
modules/nixos/services/glance/config/widgets/clock.nix
Executable file
22
modules/nixos/services/glance/config/widgets/clock.nix
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
type = "clock";
|
||||
hour-format = "12h";
|
||||
timezones = [
|
||||
{
|
||||
timezone = "America/Winnipeg";
|
||||
label = "Winnipeg, MB";
|
||||
}
|
||||
{
|
||||
timezone = "Europe/Berlin";
|
||||
label = "Berlin, DE";
|
||||
}
|
||||
{
|
||||
timezone = "Asia/Kolkata";
|
||||
label = "Kolkata, IN";
|
||||
}
|
||||
{
|
||||
timezone = "Asia/Tokyo";
|
||||
label = "Tokyo, JP";
|
||||
}
|
||||
];
|
||||
}
|
||||
326
modules/nixos/services/glance/config/widgets/jelly/config/default.nix
Executable file
326
modules/nixos/services/glance/config/widgets/jelly/config/default.nix
Executable file
|
|
@ -0,0 +1,326 @@
|
|||
''
|
||||
{{ $mediaServer := .Options.StringOr "media-server" "" }}
|
||||
{{ $baseURL := .Options.StringOr "base-url" "" }}
|
||||
{{ $apiKey := .Options.StringOr "api-key" "" }}
|
||||
{{ $userName := .Options.StringOr "user-name" "" }}
|
||||
|
||||
{{ define "errorMsg" }}
|
||||
<div class="widget-error-header">
|
||||
<div class="color-negative size-h3">ERROR</div>
|
||||
<svg class="widget-error-icon" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126ZM12 15.75h.007v.008H12v-.008Z"></path>
|
||||
</svg>
|
||||
</div>
|
||||
<p class="break-all">{{ . }}</p>
|
||||
{{ end }}
|
||||
|
||||
{{ if or
|
||||
(eq $mediaServer "")
|
||||
(eq $baseURL "")
|
||||
(eq $apiKey "")
|
||||
(and (eq $mediaServer "jellyfin") (eq $userName ""))
|
||||
}}
|
||||
{{ template "errorMsg" "Some required options are not set" }}
|
||||
{{ else }}
|
||||
|
||||
{{ $historyLength := .Options.StringOr "history-length" "10" }}
|
||||
{{ $mediaTypes := .Options.StringOr "media-types" "" }}
|
||||
{{ if eq $mediaServer "tautulli" }}
|
||||
{{ $mediaTypes = .Options.StringOr "media-types" "movie,episode,track" }}
|
||||
{{ else if or (eq $mediaServer "jellyfin") (eq $mediaServer "emby") }}
|
||||
{{ $mediaTypes = .Options.StringOr "media-types" "Movie,Episode,Audio" }}
|
||||
{{ end }}
|
||||
{{ $isSmallColumn := .Options.BoolOr "small-column" false }}
|
||||
{{ $isCompact := .Options.BoolOr "compact" true }}
|
||||
{{ $showThumbnail := .Options.BoolOr "show-thumbnail" false }}
|
||||
{{ $thumbAspectRatio := .Options.StringOr "thumbnail-aspect-ratio" "" }}
|
||||
{{ $showUser := .Options.BoolOr "show-user" true }}
|
||||
{{ $timeAbsolute := .Options.BoolOr "time-absolute" false }}
|
||||
{{ $timeFormat := .Options.StringOr "time-format" "Jan 02 15:04" }}
|
||||
|
||||
{{ $userID := "" }}
|
||||
{{ $historyRequestURL := "" }}
|
||||
{{ $usersRequestURL := "" }}
|
||||
{{ $historyCall := "" }}
|
||||
{{ $usersCall := "" }}
|
||||
{{ $history := "" }}
|
||||
{{ $users := "" }}
|
||||
|
||||
{{ if eq $mediaServer "plex" }}
|
||||
{{ $historyRequestURL = concat $baseURL "/status/sessions/history/all" }}
|
||||
{{ $historyCall = newRequest $historyRequestURL
|
||||
| withParameter "limit" $historyLength
|
||||
| withParameter "sort" "viewedAt:desc"
|
||||
| withHeader "Accept" "application/json"
|
||||
| withHeader "X-Plex-Token" $apiKey
|
||||
| getResponse }}
|
||||
|
||||
{{ if $historyCall.JSON.Exists "MediaContainer" }}
|
||||
{{ $history = $historyCall.JSON.Array "MediaContainer.Metadata" }}
|
||||
{{ else }}
|
||||
{{ template "errorMsg" (concat "Could not fetch " $mediaServer " API.") }}
|
||||
{{ end }}
|
||||
|
||||
{{ $usersRequestURL = concat $baseURL "/accounts" }}
|
||||
{{ $usersCall = newRequest $usersRequestURL
|
||||
| withHeader "Accept" "application/json"
|
||||
| withHeader "X-Plex-Token" $apiKey
|
||||
| getResponse }}
|
||||
{{ $users = $usersCall.JSON.Array "MediaContainer.Account" }}
|
||||
|
||||
{{ else if eq $mediaServer "tautulli" }}
|
||||
{{ $historyRequestURL = concat $baseURL "/api/v2" }}
|
||||
{{ $historyCall = newRequest $historyRequestURL
|
||||
| withParameter "apikey" $apiKey
|
||||
| withParameter "cmd" "get_history"
|
||||
| withParameter "length" $historyLength
|
||||
| withParameter "media_type" $mediaTypes
|
||||
| withHeader "Accept" "application/json"
|
||||
| getResponse }}
|
||||
|
||||
{{ if eq $historyCall.Response.StatusCode 200 }}
|
||||
{{ $history = $historyCall.JSON.Array "response.data.data" }}
|
||||
{{ else }}
|
||||
{{ template "errorMsg" (concat "Could not fetch " $mediaServer " API.") }}
|
||||
{{ end }}
|
||||
|
||||
{{ else if or (eq $mediaServer "jellyfin") (eq $mediaServer "emby") }}
|
||||
{{ $usersRequestURL = concat $baseURL "/Users" }}
|
||||
{{ $usersCall = newRequest $usersRequestURL
|
||||
| withParameter "api_key" $apiKey
|
||||
| withHeader "Accept" "application/json"
|
||||
| getResponse }}
|
||||
|
||||
{{ $usersList := $usersCall.JSON.Array "" }}
|
||||
{{ range $i, $user := $usersList }}
|
||||
{{ if eq ($user.String "Name") $userName }}
|
||||
{{ $userID = $user.String "Id" }}
|
||||
{{ break }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ if eq $userID "" }}
|
||||
{{ template "errorMsg" (concat "User '" $userName "' not found.") }}
|
||||
{{ end }}
|
||||
|
||||
{{ $historyRequestURL = concat $baseURL "/Users/" $userID "/Items" }}
|
||||
{{ $historyCall = newRequest $historyRequestURL
|
||||
| withParameter "api_key" $apiKey
|
||||
| withParameter "Limit" $historyLength
|
||||
| withParameter "IncludeItemTypes" $mediaTypes
|
||||
| withParameter "Recursive" "true"
|
||||
| withParameter "isPlayed" "true"
|
||||
| withParameter "sortBy" "DatePlayed"
|
||||
| withParameter "sortOrder" "Descending"
|
||||
| withParameter "Fields" "UserDataLastPlayedDate"
|
||||
| withHeader "Accept" "application/json"
|
||||
| getResponse }}
|
||||
|
||||
{{ $history = $historyCall.JSON.Array "Items" }}
|
||||
{{ end }}
|
||||
|
||||
{{ if and (eq $historyCall.Response.StatusCode 200) (eq (len $history) 0) }}
|
||||
<p>Nothing has been played. Start streaming something!</p>
|
||||
{{ else }}
|
||||
<div class="carousel-container show-right-cutoff">
|
||||
<div class="cards-horizontal carousel-items-container">
|
||||
{{ range $n, $item := $history }}
|
||||
{{ $mediaType := "" }}
|
||||
{{ $isMovie := false }}
|
||||
{{ $isShows := false }}
|
||||
{{ $isMusic := false }}
|
||||
{{ $title := "" }}
|
||||
{{ $showTitle := "" }}
|
||||
{{ $showSeason := "" }}
|
||||
{{ $showEpisode := "" }}
|
||||
{{ $artist := "" }}
|
||||
{{ $albumTitle := "" }}
|
||||
{{ $thumbURL := "" }}
|
||||
{{ $playedAt := "" }}
|
||||
|
||||
{{ if eq $mediaServer "plex" }}
|
||||
{{ $userID = $item.Int "accountID" }}
|
||||
{{ range $n, $u := $users }}
|
||||
{{ if eq $userID ($u.Int "id") }}
|
||||
{{ $userName = $u.String "name" }}
|
||||
{{ break }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{ $mediaType = $item.String "type" }}
|
||||
{{ $isMovie = eq $mediaType "movie" }}
|
||||
{{ $isShows = eq $mediaType "episode" }}
|
||||
{{ $isMusic = eq $mediaType "track" }}
|
||||
|
||||
{{ $title = $item.String "title" }}
|
||||
{{ if $isShows }}
|
||||
{{ $showTitle = $item.String "grandparentTitle" }}
|
||||
{{ $showSeason = $item.String "parentIndex" }}
|
||||
{{ $showEpisode = $item.String "index" }}
|
||||
{{ else if $isMusic }}
|
||||
{{ $artist = $item.String "grandparentTitle" }}
|
||||
{{ $albumTitle = $item.String "parentTitle" }}
|
||||
{{ end }}
|
||||
|
||||
{{ $thumbID := $item.String "thumb" }}
|
||||
{{ if or $isShows $isMusic}}
|
||||
{{ $thumbID = $item.String "parentThumb" }}
|
||||
{{ end }}
|
||||
{{ $thumbURL = concat $baseURL $thumbID "?X-Plex-Token=" $apiKey }}
|
||||
|
||||
{{ $time := $item.String "viewedAt" }}
|
||||
{{ if $timeAbsolute }}
|
||||
{{ $playedAt = $time | parseLocalTime "unix" | formatTime $timeFormat }}
|
||||
{{ else }}
|
||||
{{ $playedAt = $time | parseRelativeTime "unix" }}
|
||||
{{ end }}
|
||||
|
||||
{{ else if eq $mediaServer "tautulli" }}
|
||||
{{ $userName = $item.String "user" }}
|
||||
{{ $mediaType = $item.String "media_type" }}
|
||||
{{ $isMovie = eq $mediaType "movie" }}
|
||||
{{ $isShows = eq $mediaType "episode" }}
|
||||
{{ $isMusic = eq $mediaType "track" }}
|
||||
|
||||
{{ $title = $item.String "title" }}
|
||||
{{ if $isShows }}
|
||||
{{ $showTitle = $item.String "grandparent_title" }}
|
||||
{{ $showSeason = $item.String "parent_media_index" }}
|
||||
{{ $showEpisode = $item.String "media_index" }}
|
||||
{{ else if $isMusic }}
|
||||
{{ $artist = $item.String "grandparent_title" }}
|
||||
{{ $albumTitle = $item.String "parent_title" }}
|
||||
{{ end }}
|
||||
|
||||
{{ $thumbID := $item.String "thumb" }}
|
||||
{{ $thumbURL = concat $baseURL "/api/v2?apikey=" $apiKey "&cmd=pms_image_proxy&img=" $thumbID }}
|
||||
|
||||
{{ $time := $item.String "date" }}
|
||||
{{ if $timeAbsolute }}
|
||||
{{ $playedAt = $time | parseLocalTime "unix" | formatTime $timeFormat }}
|
||||
{{ else }}
|
||||
{{ $playedAt = $time | parseRelativeTime "unix" }}
|
||||
{{ end }}
|
||||
|
||||
{{ else if or (eq $mediaServer "jellyfin") (eq $mediaServer "emby") }}
|
||||
{{ $mediaType = $item.String "Type" }}
|
||||
{{ $isMovie = eq $mediaType "Movie" }}
|
||||
{{ $isShows = eq $mediaType "Episode" }}
|
||||
{{ $isMusic = eq $mediaType "Audio" }}
|
||||
|
||||
{{ $title = $item.String "Name" }}
|
||||
{{ if $isShows }}
|
||||
{{ $showTitle = $item.String "SeriesName" }}
|
||||
{{ $showSeason = $item.String "ParentIndexNumber" }}
|
||||
{{ $showEpisode = $item.String "IndexNumber" }}
|
||||
{{ else if $isMusic }}
|
||||
{{ $artist = $item.String "AlbumArtist" }}
|
||||
{{ $albumTitle = $item.String "Album" }}
|
||||
{{ end }}
|
||||
|
||||
{{ $thumbID := $item.String "Id" }}
|
||||
{{ if $isShows }}
|
||||
{{ $thumbID = $item.String "SeasonId" }}
|
||||
{{ end }}
|
||||
{{ $thumbURL = concat $baseURL "/Items/" $thumbID "/Images/Primary?api_key=" $apiKey }}
|
||||
|
||||
{{ $time := $item.String "UserData.LastPlayedDate" }}
|
||||
{{ if $timeAbsolute }}
|
||||
{{ $playedAt = $time | parseLocalTime "rfc3339" | formatTime $timeFormat }}
|
||||
{{ else }}
|
||||
{{ $playedAt = $time | parseRelativeTime "rfc3339" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{ $showInfoFormat := concat "Season " $showSeason " Episode " $showEpisode}}
|
||||
{{ if $isCompact }}
|
||||
{{ $showInfoFormat = concat "S" $showSeason "E" $showEpisode}}
|
||||
{{ end }}
|
||||
|
||||
<div class="card widget-content-frame">
|
||||
{{ if $showThumbnail }}
|
||||
<img src="{{ $thumbURL | safeURL }}"
|
||||
alt="{{ $title }} thumbnail"
|
||||
loading="lazy"
|
||||
class="media-server-thumbnail shrink-0"
|
||||
style="
|
||||
object-fit: cover;
|
||||
border-radius: var(--border-radius) var(--border-radius) 0 0;
|
||||
{{ if eq $thumbAspectRatio "square" }}
|
||||
aspect-ratio: 1;
|
||||
{{ else if eq $thumbAspectRatio "portrait" }}
|
||||
aspect-ratio: 3/4;
|
||||
{{ else if eq $thumbAspectRatio "landscape" }}
|
||||
aspect-ratio: 4/3;
|
||||
{{ else }}
|
||||
aspect-ratio: initial;
|
||||
{{ end }}
|
||||
"
|
||||
/>
|
||||
{{ end }}
|
||||
|
||||
<div class="grow padding-inline-widget margin-top-10 margin-bottom-10">
|
||||
<ul class="flex flex-column justify-evenly margin-bottom-3 {{if $isSmallColumn}}size-h6{{end}}" style="height: 100%;">
|
||||
{{ if $isCompact }}
|
||||
<ul class="list-horizontal-text flex-nowrap">
|
||||
{{ if $showUser }}
|
||||
<li class="color-primary text-truncate">{{ $userName }}</li>
|
||||
{{ end }}
|
||||
|
||||
{{ if $timeAbsolute }}
|
||||
<li class="text-truncate">{{ $playedAt }}</li>
|
||||
{{ else }}
|
||||
<li class="shrink-0">
|
||||
<span {{ $playedAt }}></span>
|
||||
{{ if not $showUser }}
|
||||
<span> ago</span>
|
||||
{{ end }}
|
||||
</li>
|
||||
{{ end }}
|
||||
</ul>
|
||||
|
||||
{{ if $isShows }}
|
||||
<ul class="list-horizontal-text flex-nowrap">
|
||||
<li class="text-truncate">{{ $showInfoFormat }}</li>
|
||||
<li class="text-truncate">{{ $showTitle }}</li>
|
||||
</ul>
|
||||
{{ else if $isMusic }}
|
||||
<ul class="list-horizontal-text flex-nowrap">
|
||||
<li class="text-truncate">{{ $artist }}</li>
|
||||
<li class="text-truncate">{{ $albumTitle }}</li>
|
||||
</ul>
|
||||
{{ end }}
|
||||
|
||||
<li class="text-truncate">{{ $title }}</li>
|
||||
{{ else }}
|
||||
{{ if $showUser }}
|
||||
<li class="color-primary text-truncate">{{ $userName }}</li>
|
||||
{{ end }}
|
||||
|
||||
{{ if $timeAbsolute }}
|
||||
<li class="text-truncate">{{ $playedAt }}</li>
|
||||
{{ else }}
|
||||
<li class="text-truncate">
|
||||
<span {{ $playedAt }}></span>
|
||||
<span> ago</span>
|
||||
</li>
|
||||
{{ end }}
|
||||
|
||||
{{ if $isShows }}
|
||||
<li class="text-truncate">{{ $showTitle }}</li>
|
||||
<li class="text-truncate">{{ $showInfoFormat }}</li>
|
||||
{{ else if $isMusic }}
|
||||
<li class="text-truncate">{{ $artist }}</li>
|
||||
<li class="text-truncate">{{ $albumTitle }}</li>
|
||||
{{ end }}
|
||||
|
||||
<li class="text-truncate">{{ $title }}</li>
|
||||
{{ end }}
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
{{ end }}
|
||||
</div>
|
||||
</div>
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
''
|
||||
30
modules/nixos/services/glance/config/widgets/jelly/default.nix
Executable file
30
modules/nixos/services/glance/config/widgets/jelly/default.nix
Executable file
|
|
@ -0,0 +1,30 @@
|
|||
{ config, flake, ... }:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.people.users.${user0}) name;
|
||||
inherit (flake.config.services.instances) glance jellyfin web;
|
||||
service = glance;
|
||||
jellyfinUserName = name;
|
||||
jellyfinHost = "https://${jellyfin.subdomain}.${web.domains.url0}";
|
||||
in
|
||||
{
|
||||
type = "custom-api";
|
||||
title = "Jellyfin History";
|
||||
frameless = true;
|
||||
cache = "5m";
|
||||
options = {
|
||||
media-server = "jellyfin";
|
||||
base-url = jellyfinHost;
|
||||
api-key = config.sops.secrets."${service.name}-${jellyfin.name}".path;
|
||||
user-name = jellyfinUserName;
|
||||
history-length = "10";
|
||||
small-column = true;
|
||||
compact = true;
|
||||
show-thumbnail = false;
|
||||
thumbnail-aspect-ratio = "default";
|
||||
show-user = true;
|
||||
time-absolute = false;
|
||||
time-format = "Jan 02 15:04";
|
||||
};
|
||||
template = import ./config;
|
||||
}
|
||||
6
modules/nixos/services/glance/config/widgets/monitor.nix
Executable file
6
modules/nixos/services/glance/config/widgets/monitor.nix
Executable file
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
type = "monitor";
|
||||
cache = "1m";
|
||||
title = "Services";
|
||||
|
||||
}
|
||||
22
modules/nixos/services/glance/config/widgets/podcasts.nix
Executable file
22
modules/nixos/services/glance/config/widgets/podcasts.nix
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
let
|
||||
podcastHelper = url: title: {
|
||||
url = url;
|
||||
title = title;
|
||||
hide-description = true;
|
||||
hide-categories = true;
|
||||
};
|
||||
podcastData = [
|
||||
(podcastHelper "https://sigmanutrition.libsyn.com/rss/" "Sigma Nutrition Radio")
|
||||
(podcastHelper "https://wakingup.libsyn.com/rss" "Making Sense with Sam Harris")
|
||||
(podcastHelper "https://feeds.simplecast.com/uNKL_XD_" "Docs Who Lift")
|
||||
(podcastHelper "https://feeds.redcircle.com/677da6c9-d33f-49df-95d7-dc8821b797b4" "Mayo Clinic on Nutrition")
|
||||
];
|
||||
podcastEntries = builtins.map (podcast: podcast) podcastData;
|
||||
in
|
||||
{
|
||||
type = "rss";
|
||||
title = "Podcasts";
|
||||
style = "detailed-list";
|
||||
collapse-after = 3;
|
||||
feeds = podcastEntries;
|
||||
}
|
||||
21
modules/nixos/services/glance/config/widgets/reddit.nix
Executable file
21
modules/nixos/services/glance/config/widgets/reddit.nix
Executable file
|
|
@ -0,0 +1,21 @@
|
|||
let
|
||||
subList = [
|
||||
"privacy"
|
||||
"selfhosted"
|
||||
"vegan"
|
||||
];
|
||||
|
||||
subredditEntries = builtins.map (sub: {
|
||||
type = "reddit";
|
||||
subreddit = sub;
|
||||
collapse-after = 5;
|
||||
show-thumbnails = true;
|
||||
sort-by = "top";
|
||||
top-period = "day";
|
||||
}) subList;
|
||||
|
||||
in
|
||||
{
|
||||
type = "group";
|
||||
widgets = subredditEntries;
|
||||
}
|
||||
15
modules/nixos/services/glance/config/widgets/repos.nix
Executable file
15
modules/nixos/services/glance/config/widgets/repos.nix
Executable file
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
type = "releases";
|
||||
show-source-icon = true;
|
||||
collapse-after = 7;
|
||||
repositories = [
|
||||
"jmshrv/finamp"
|
||||
"futo-org/android-keyboard"
|
||||
"hyprwm/Hyprland"
|
||||
"mollyim/mollyim-android"
|
||||
"jarnedemeulemeester/findroid"
|
||||
"brandonp2412/Flexify"
|
||||
"accrescent/accrescent"
|
||||
"ImranR98/Obtainium"
|
||||
];
|
||||
}
|
||||
14
modules/nixos/services/glance/config/widgets/steam/config/default.nix
Executable file
14
modules/nixos/services/glance/config/widgets/steam/config/default.nix
Executable file
|
|
@ -0,0 +1,14 @@
|
|||
''
|
||||
<ul class="list list-gap-10 collapsible-container" data-collapse-after="5">
|
||||
{{ range .JSON.Array "specials.items" }}
|
||||
<li>
|
||||
<a class="size-h4 color-highlight block text-truncate" href="https://store.steampowered.com/app/{{ .Int "id" }}/">{{ .String "name" }}</a>
|
||||
<ul class="list-horizontal-text">
|
||||
<li>{{ .Int "final_price" | toFloat | mul 0.01 | printf "$%.2f" }}</li>
|
||||
{{ $discount := .Int "discount_percent" }}
|
||||
<li{{ if ge $discount 1 }} class="color-positive"{{ end }}>{{ $discount }}% off</li>
|
||||
</ul>
|
||||
</li>
|
||||
{{ end }}
|
||||
</ul>
|
||||
''
|
||||
7
modules/nixos/services/glance/config/widgets/steam/default.nix
Executable file
7
modules/nixos/services/glance/config/widgets/steam/default.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
type = "custom-api";
|
||||
title = "Steam Specials";
|
||||
cache = "12h";
|
||||
url = "https://store.steampowered.com/api/featuredcategories?cc=ca";
|
||||
template = import ./config;
|
||||
}
|
||||
14
modules/nixos/services/glance/config/widgets/videos.nix
Executable file
14
modules/nixos/services/glance/config/widgets/videos.nix
Executable file
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
type = "videos";
|
||||
style = "vertical-list";
|
||||
collapse-after = 6;
|
||||
channels = [
|
||||
"UCfQgsKhHjSyRLOp9mnffqVg"
|
||||
"UCld68syR8Wi-GY_n4CaoJGA"
|
||||
"UChIs72whgZI9w6d6FhwGGHA"
|
||||
"UCes5DW7sk9WU8oqE9HGJdpg"
|
||||
"UCOksmJqNzaYLhplfs7Sl8cA"
|
||||
"UCQNmHyGAKqzOT_JsVEs4eag"
|
||||
"UCd8rTrNRM6DYR4TXgSqNw8g"
|
||||
];
|
||||
}
|
||||
7
modules/nixos/services/glance/config/widgets/weather.nix
Executable file
7
modules/nixos/services/glance/config/widgets/weather.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
type = "weather";
|
||||
title = "Weather";
|
||||
units = "metric";
|
||||
hour-format = "12h";
|
||||
location = "Winnipeg, Manitoba, Canada";
|
||||
}
|
||||
82
modules/nixos/services/glance/default.nix
Executable file
82
modules/nixos/services/glance/default.nix
Executable file
|
|
@ -0,0 +1,82 @@
|
|||
{ config, flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances)
|
||||
glance
|
||||
jellyfin
|
||||
web
|
||||
;
|
||||
inherit (flake.config.machines.devices) ceres mars deimos;
|
||||
configHelpers = {
|
||||
service = glance;
|
||||
hostname = config.networking.hostName;
|
||||
localhost = web.localhost.address1;
|
||||
host = configHelpers.service.domains.url0;
|
||||
};
|
||||
configPath = ./config;
|
||||
configImports = {
|
||||
server = import (configPath + /server.nix) { inherit flake configHelpers; };
|
||||
branding = import (configPath + /branding.nix);
|
||||
theme = import (configPath + /theme.nix);
|
||||
pages = import (configPath + /pages.nix) { inherit config flake; };
|
||||
};
|
||||
in
|
||||
{
|
||||
services = {
|
||||
glance = {
|
||||
enable = true;
|
||||
settings = configImports;
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${configHelpers.host}" = {
|
||||
extraConfig = ''
|
||||
@allowed_ips {
|
||||
remote_ip ${mars.wireguard.ip0} ${deimos.wireguard.ip0}
|
||||
}
|
||||
|
||||
handle @allowed_ips {
|
||||
redir /.well-known/carddav /remote.php/dav/ 301
|
||||
redir /.well-known/caldav /remote.php/dav/ 301
|
||||
reverse_proxy ${ceres.wireguard.ip0}:${toString configHelpers.service.ports.port0}
|
||||
}
|
||||
handle {
|
||||
respond "Access Denied" 403
|
||||
}
|
||||
tls ${configHelpers.service.ssl.cert} ${configHelpers.service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "/run/secrets/${configHelpers.service.name}-${secret}";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "644";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${configHelpers.service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
# "key"
|
||||
# "${user0}-pass"
|
||||
jellyfin.name
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
interfaces.wg0.allowedTCPPorts = [
|
||||
configHelpers.service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
72
modules/nixos/services/jellyfin/default.nix
Executable file
72
modules/nixos/services/jellyfin/default.nix
Executable file
|
|
@ -0,0 +1,72 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
inherit (flake.config.services.instances) jellyfin web;
|
||||
service = jellyfin;
|
||||
localhost = web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = user0;
|
||||
};
|
||||
jellyseerr = {
|
||||
openFirewall = true;
|
||||
enable = true;
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
redir /.well-known/carddav /remote.php/dav/ 301
|
||||
redir /.well-known/caldav /remote.php/dav/ 301
|
||||
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems =
|
||||
let
|
||||
settings = {
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
"/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
} // settings;
|
||||
"/var/cache/${service.name}" = {
|
||||
device = "${service.paths.path1}";
|
||||
} // settings;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 0755 ${user0} ${service.name} -"
|
||||
"Z ${service.paths.path0} 0755 ${user0} ${service.name} -"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
service.ports.port1
|
||||
service.ports.port2
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
3
modules/nixos/services/logrotate/default.nix
Executable file
3
modules/nixos/services/logrotate/default.nix
Executable file
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
services.logrotate.enable = true;
|
||||
}
|
||||
34
modules/nixos/services/mastodon/config/chars.patch
Executable file
34
modules/nixos/services/mastodon/config/chars.patch
Executable file
|
|
@ -0,0 +1,34 @@
|
|||
diff --git a/app/javascript/mastodon/features/compose/components/compose_form.jsx b/app/javascript/mastodon/features/compose/components/compose_form.jsx
|
||||
index 9222b2dc8..962310a28 100644
|
||||
--- a/app/javascript/mastodon/features/compose/components/compose_form.jsx
|
||||
+++ b/app/javascript/mastodon/features/compose/components/compose_form.jsx
|
||||
@@ -100,7 +100,7 @@ class ComposeForm extends ImmutablePureComponent {
|
||||
const fulltext = this.getFulltextForCharacterCounting();
|
||||
const isOnlyWhitespace = fulltext.length !== 0 && fulltext.trim().length === 0;
|
||||
|
||||
- return !(isSubmitting || isUploading || isChangingUpload || length(fulltext) > 500 || (isOnlyWhitespace && !anyMedia));
|
||||
+ return !(isSubmitting || isUploading || isChangingUpload || length(fulltext) > 5000 || (isOnlyWhitespace && !anyMedia));
|
||||
};
|
||||
|
||||
handleSubmit = (e) => {
|
||||
@@ -297,7 +297,7 @@ class ComposeForm extends ImmutablePureComponent {
|
||||
</div>
|
||||
|
||||
<div className='character-counter__wrapper'>
|
||||
- <CharacterCounter max={500} text={this.getFulltextForCharacterCounting()} />
|
||||
+ <CharacterCounter max={5000} text={this.getFulltextForCharacterCounting()} />
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
|
||||
index dc841ded3..9cb1ec94b 100644
|
||||
--- a/app/validators/status_length_validator.rb
|
||||
+++ b/app/validators/status_length_validator.rb
|
||||
@@ -1,7 +1,7 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class StatusLengthValidator < ActiveModel::Validator
|
||||
- MAX_CHARS = 500
|
||||
+ MAX_CHARS = 5000
|
||||
URL_PLACEHOLDER_CHARS = 23
|
||||
URL_PLACEHOLDER = 'x' * 23
|
||||
5500
modules/nixos/services/mastodon/config/twitter.txt
Executable file
5500
modules/nixos/services/mastodon/config/twitter.txt
Executable file
File diff suppressed because one or more lines are too long
214
modules/nixos/services/mastodon/default.nix
Executable file
214
modules/nixos/services/mastodon/default.nix
Executable file
|
|
@ -0,0 +1,214 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices)
|
||||
ceres
|
||||
;
|
||||
inherit (flake.config.services.instances) smtp mastodon web;
|
||||
service = mastodon;
|
||||
host = service.domains.url0;
|
||||
localhost = web.localhost.address0;
|
||||
in
|
||||
{
|
||||
# If you need to start fresh for some reason, run these to create the new Admin account:
|
||||
# sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
|
||||
# sudo -u mastodon mastodon-tootctl accounts approve nick
|
||||
|
||||
# If you fuck up and lose the password, use this:
|
||||
# sudo mastodon-tootctl accounts modify --reset-password nick
|
||||
|
||||
# If you really fuck up and name yourself wrong, use this shit
|
||||
# sudo mastodon-tootctl accounts modify username --remove-role
|
||||
|
||||
# nixpkgs.overlays = [
|
||||
# (
|
||||
# final: prev: {
|
||||
# mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
|
||||
# postPatch =
|
||||
# (oldAttrs.postPatch or "")
|
||||
# + ''
|
||||
# patch -p1 < ${./chars.patch}
|
||||
# '';
|
||||
# });
|
||||
# }
|
||||
# )
|
||||
# ];
|
||||
|
||||
services = {
|
||||
mastodon = {
|
||||
enable = true;
|
||||
localDomain = host;
|
||||
secretKeyBaseFile = "/var/lib/mastodon/secrets/secret-key-base";
|
||||
streamingProcesses = 7;
|
||||
trustedProxy = localhost;
|
||||
automaticMigrations = true;
|
||||
database = {
|
||||
createLocally = true;
|
||||
name = service.name;
|
||||
host = "/run/postgresql";
|
||||
user = service.name;
|
||||
passwordFile = config.sops.secrets.mastodon-database.path;
|
||||
};
|
||||
extraConfig = {
|
||||
SINGLE_USER_MODE = "true";
|
||||
SMTP_AUTH_METHOD = "plain";
|
||||
SMTP_DELIVERY_METHOD = "smtp";
|
||||
SMTP_ENABLE_STARTTLS_AUTO = "true";
|
||||
SMTP_SSL = "false";
|
||||
};
|
||||
mediaAutoRemove = {
|
||||
enable = true;
|
||||
olderThanDays = 14;
|
||||
};
|
||||
redis = {
|
||||
createLocally = true;
|
||||
enableUnixSocket = true;
|
||||
};
|
||||
sidekiqThreads = 25;
|
||||
sidekiqProcesses = {
|
||||
all = {
|
||||
jobClasses = [
|
||||
];
|
||||
threads = null;
|
||||
};
|
||||
default = {
|
||||
jobClasses = [
|
||||
"default"
|
||||
];
|
||||
threads = 5;
|
||||
};
|
||||
ingress = {
|
||||
jobClasses = [
|
||||
"ingress"
|
||||
];
|
||||
threads = 5;
|
||||
};
|
||||
push-pull = {
|
||||
jobClasses = [
|
||||
"push"
|
||||
"pull"
|
||||
];
|
||||
threads = 5;
|
||||
};
|
||||
mailers = {
|
||||
jobClasses = [
|
||||
"mailers"
|
||||
];
|
||||
threads = 5;
|
||||
};
|
||||
};
|
||||
smtp = {
|
||||
authenticate = true;
|
||||
createLocally = false;
|
||||
fromAddress = "upRootNutrition <${service.email.address0}>";
|
||||
host = smtp.hostname;
|
||||
passwordFile = config.sops.secrets.mastodon-smtp.path;
|
||||
port = smtp.ports.port0;
|
||||
user = service.email.address0;
|
||||
};
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
handle_path /system/* {
|
||||
file_server * {
|
||||
root /var/lib/mastodon/public-system
|
||||
}
|
||||
}
|
||||
|
||||
handle /api/v1/streaming/* {
|
||||
reverse_proxy unix//run/mastodon-streaming/streaming.socket
|
||||
}
|
||||
|
||||
route * {
|
||||
file_server * {
|
||||
root ${pkgs.mastodon}/public
|
||||
pass_thru
|
||||
}
|
||||
reverse_proxy * unix//run/mastodon-web/web.socket
|
||||
}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
|
||||
handle_errors {
|
||||
root * ${pkgs.mastodon}/public
|
||||
rewrite 500.html
|
||||
file_server
|
||||
}
|
||||
|
||||
encode gzip
|
||||
|
||||
header /* {
|
||||
Strict-Transport-Security "max-age=31536000;"
|
||||
}
|
||||
header /emoji/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /packs/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.caddy.serviceConfig.ReadWriteDirectories = lib.mkForce [
|
||||
"/var/lib/caddy"
|
||||
"/run/mastodon-web"
|
||||
];
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"smtp"
|
||||
"database"
|
||||
"redis"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 0755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"postgres"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
98
modules/nixos/services/minecraft/default.nix
Executable file
98
modules/nixos/services/minecraft/default.nix
Executable file
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
inherit (flake.config.services.instances) minecraft;
|
||||
service = minecraft;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
"rcon.password" = config.sops.secrets."${service.name}-pass".path;
|
||||
allow-flight = false;
|
||||
allow-nether = true;
|
||||
difficulty = 2;
|
||||
enable-command-block = false;
|
||||
enable-rcon = true;
|
||||
enable-status = true;
|
||||
force-gamemode = true;
|
||||
gamemode = 0;
|
||||
generate-structures = true;
|
||||
hardcore = false;
|
||||
hide-online-players = false;
|
||||
level-name = "Brix on Nix";
|
||||
level-seed = "9064150133272194";
|
||||
max-players = 10;
|
||||
max-world-size = 64000000;
|
||||
motd = "A cool Minecraft server powered by NixOS";
|
||||
online-mode = true;
|
||||
pvp = true;
|
||||
server-port = service.ports.port0;
|
||||
spawn-animals = true;
|
||||
spawn-monsters = true;
|
||||
spawn-npcs = true;
|
||||
spawn-protection = 16;
|
||||
view-dtstance = 32;
|
||||
white-list = true;
|
||||
};
|
||||
whitelist = {
|
||||
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
|
||||
Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
|
||||
EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
|
||||
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
|
||||
};
|
||||
};
|
||||
};
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"pass"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 0755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
6
modules/nixos/services/mullvad/default.nix
Executable file
6
modules/nixos/services/mullvad/default.nix
Executable file
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
services.mullvad-vpn = {
|
||||
enable = true;
|
||||
enableExcludeWrapper = false;
|
||||
};
|
||||
}
|
||||
145
modules/nixos/services/nextcloud/default.nix
Executable file
145
modules/nixos/services/nextcloud/default.nix
Executable file
|
|
@ -0,0 +1,145 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.people.users.${user0}) name;
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
inherit (flake.config.services.instances)
|
||||
nextcloud
|
||||
nginx
|
||||
smtp
|
||||
web
|
||||
;
|
||||
service = nextcloud;
|
||||
localhost = web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
nextcloud = {
|
||||
appstoreEnable = true;
|
||||
autoUpdateApps.enable = true;
|
||||
configureRedis = true;
|
||||
enable = true;
|
||||
hostName = host;
|
||||
https = true;
|
||||
package = pkgs.nextcloud31;
|
||||
phpOptions."opcache.interned_strings_buffer" = "24";
|
||||
extraAppsEnable = true;
|
||||
extraApps = {
|
||||
inherit (pkgs.nextcloud31Packages.apps)
|
||||
contacts
|
||||
calendar
|
||||
deck
|
||||
;
|
||||
};
|
||||
config = {
|
||||
adminpassFile = config.sops.secrets."${service.name}-pass".path;
|
||||
adminuser = name;
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
database = {
|
||||
createLocally = true;
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "CA";
|
||||
log_type = "file";
|
||||
mail_domain = host;
|
||||
mail_from_address = "noreply";
|
||||
mail_sendmailmode = "smtp";
|
||||
mail_smtpmode = "smtp";
|
||||
mail_smtphost = smtp.hostname;
|
||||
mail_smtpport = smtp.ports.port0;
|
||||
mail_smtpsecure = "";
|
||||
mail_smtptimeout = 30;
|
||||
mail_smtpauth = 1;
|
||||
mail_smtpname = service.email.address0;
|
||||
mail_smtppassword = config.sops.secrets."${service.name}-smtp".path;
|
||||
maintenance_window_start = 4;
|
||||
overwriteprotocol = "https";
|
||||
trusted_proxies = [
|
||||
localhost
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${host}.listen = [
|
||||
{
|
||||
addr = web.localhost.address1;
|
||||
port = nginx.ports.port0;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhost}:${toString nginx.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"pass"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 750 ${service.name} ${service.name} -"
|
||||
"Z ${service.paths.path0}/config 750 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 750 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"caddy"
|
||||
"nginx"
|
||||
"postgres"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
nginx.ports.port0
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
118
modules/nixos/services/ollama/default.nix
Executable file
118
modules/nixos/services/ollama/default.nix
Executable file
|
|
@ -0,0 +1,118 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices)
|
||||
mars
|
||||
ceres
|
||||
;
|
||||
inherit (flake.config.services.instances)
|
||||
ollama
|
||||
web
|
||||
;
|
||||
service = ollama;
|
||||
localhost1 = web.localhost.address0;
|
||||
localhost2 = web.localhost.address1;
|
||||
hostname = config.networking.hostName;
|
||||
host = service.domains.url0;
|
||||
|
||||
localhostLogic = if hostname == mars.name then localhost2 else localhost1;
|
||||
caddyLogic =
|
||||
if hostname == ceres.name then
|
||||
{
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
${host} = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhostLogic}:${toString service.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
else
|
||||
{ };
|
||||
|
||||
mountLogic =
|
||||
if hostname == ceres.name then
|
||||
{
|
||||
"/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
}
|
||||
else
|
||||
{ };
|
||||
in
|
||||
{
|
||||
services = {
|
||||
ollama = {
|
||||
enable = true;
|
||||
group = service.name;
|
||||
host = "http://${localhostLogic}";
|
||||
user = service.name;
|
||||
}
|
||||
// (
|
||||
if hostname == mars.name then
|
||||
{
|
||||
# models = service.paths.path1;
|
||||
acceleration = "rocm";
|
||||
# package = pkgs.ollama.override {
|
||||
# acceleration = "rocm";
|
||||
# };
|
||||
}
|
||||
else
|
||||
{
|
||||
port = service.ports.port1;
|
||||
acceleration = "cuda";
|
||||
models = service.paths.path0;
|
||||
}
|
||||
);
|
||||
open-webui = {
|
||||
enable = true;
|
||||
package = (flake.inputs.nixpkgs-stable.legacyPackages.${pkgs.system}.open-webui);
|
||||
host = localhostLogic;
|
||||
port = service.ports.port0;
|
||||
environment = {
|
||||
ENABLE_OLLAMA_API = "True";
|
||||
ANONYMIZED_TELEMETRY = "False";
|
||||
DO_NOT_TRACK = "True";
|
||||
SCARF_NO_ANALYTICS = "True";
|
||||
OLLAMA_BASE_URL = "http://${localhostLogic}:${toString service.ports.port1}";
|
||||
WEBUI_AUTH = "True";
|
||||
};
|
||||
};
|
||||
}
|
||||
// caddyLogic;
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
(
|
||||
if hostname == mars.name then
|
||||
"Z ${service.paths.path1} 0777 ${service.name} ${service.name} -"
|
||||
else
|
||||
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
|
||||
)
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
# 8080
|
||||
service.ports.port0
|
||||
service.ports.port1
|
||||
];
|
||||
};
|
||||
};
|
||||
fileSystems = mountLogic;
|
||||
}
|
||||
79
modules/nixos/services/opencloud/default.nix
Executable file
79
modules/nixos/services/opencloud/default.nix
Executable file
|
|
@ -0,0 +1,79 @@
|
|||
{ config, flake, ... }:
|
||||
let
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
inherit (flake.config.services.instances) opencloud web;
|
||||
service = opencloud;
|
||||
localhost = web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
opencloud = {
|
||||
enable = true;
|
||||
url = "https://${host}";
|
||||
port = service.ports.port0;
|
||||
address = localhost;
|
||||
stateDir = "/var/lib/${service.name}";
|
||||
environmentFile = config.sops.secrets."${service.name}/env".path;
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy https://${localhost}:${toString service.ports.port0} {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
}
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}/${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"env"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
43
modules/nixos/services/owncast/default.nix
Executable file
43
modules/nixos/services/owncast/default.nix
Executable file
|
|
@ -0,0 +1,43 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances)
|
||||
owncast
|
||||
web
|
||||
;
|
||||
service = owncast;
|
||||
localhost = web.localhost.address1;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
owncast = {
|
||||
enable = true;
|
||||
listen = localhost;
|
||||
port = service.ports.port0;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
service.ports.port1
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# OBS Server rtmp://192.168.50.140:1935/live
|
||||
}
|
||||
151
modules/nixos/services/peertube/default.nix
Executable file
151
modules/nixos/services/peertube/default.nix
Executable file
|
|
@ -0,0 +1,151 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices)
|
||||
ceres
|
||||
;
|
||||
inherit (flake.config.services.instances)
|
||||
caddy
|
||||
peertube
|
||||
smtp
|
||||
web
|
||||
;
|
||||
service = peertube;
|
||||
localhost = web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
peertube = {
|
||||
configureNginx = false;
|
||||
enable = true;
|
||||
enableWebHttps = true;
|
||||
group = service.name;
|
||||
listenWeb = caddy.ports.port1;
|
||||
listenHttp = service.ports.port0;
|
||||
localDomain = host;
|
||||
serviceEnvironmentFile = config.sops.secrets."${service.name}-root".path;
|
||||
user = service.name;
|
||||
plugins = {
|
||||
enable = true;
|
||||
plugins = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
peertube-plugin-livechat
|
||||
peertube-plugin-matomo
|
||||
peertube-plugin-transcoding-custom-quality
|
||||
peertube-theme-dark
|
||||
;
|
||||
};
|
||||
};
|
||||
|
||||
secrets = {
|
||||
secretsFile = config.sops.secrets."${service.name}-secret".path;
|
||||
};
|
||||
settings = {
|
||||
instance = {
|
||||
name = "upRootNutrition";
|
||||
};
|
||||
log = {
|
||||
level = "debug";
|
||||
};
|
||||
smtp = {
|
||||
transport = "smtp";
|
||||
disable_starttls = false;
|
||||
from_address = service.email.address0;
|
||||
hostname = smtp.hostname;
|
||||
port = smtp.ports.port0;
|
||||
username = service.email.address0;
|
||||
tls = false;
|
||||
};
|
||||
};
|
||||
database = {
|
||||
createLocally = true;
|
||||
passwordFile = config.sops.secrets."${service.name}-database".path;
|
||||
};
|
||||
redis = {
|
||||
enableUnixSocket = true;
|
||||
createLocally = true;
|
||||
passwordFile = config.sops.secrets."${service.name}-redis".path;
|
||||
};
|
||||
smtp = {
|
||||
createLocally = true;
|
||||
passwordFile = config.sops.secrets."${service.name}-smtp".path;
|
||||
};
|
||||
};
|
||||
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
${host} = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}-pass";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"smtp"
|
||||
"database"
|
||||
"redis"
|
||||
"root"
|
||||
"secret"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/${service.name}" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"nginx"
|
||||
"caddy"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
service.ports.port1
|
||||
service.ports.port2
|
||||
service.ports.port3
|
||||
service.ports.port4
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
60
modules/nixos/services/postgresql/default.nix
Executable file
60
modules/nixos/services/postgresql/default.nix
Executable file
|
|
@ -0,0 +1,60 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.machines.devices)
|
||||
ceres
|
||||
;
|
||||
inherit (flake.config.services.instances)
|
||||
postgresql
|
||||
;
|
||||
|
||||
service = postgresql;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
location = service.paths.path0;
|
||||
databases = [
|
||||
"mastodon"
|
||||
"nextcloud"
|
||||
"peertube"
|
||||
"forgejo"
|
||||
];
|
||||
};
|
||||
postgresql = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/postgresql" = {
|
||||
device = service.paths.path0;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
];
|
||||
depends = [
|
||||
ceres.storage0.mount
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 700 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
users.users.${service.name}.extraGroups = [
|
||||
"nextcloud"
|
||||
"mastodon"
|
||||
"forgejo"
|
||||
];
|
||||
|
||||
system.activationScripts.postgresCommands = ''
|
||||
chown -R ${service.name}:${service.name} ${service.paths.path0}
|
||||
'';
|
||||
}
|
||||
33
modules/nixos/services/projectSite/default.nix
Executable file
33
modules/nixos/services/projectSite/default.nix
Executable file
|
|
@ -0,0 +1,33 @@
|
|||
{ flake, config, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances)
|
||||
projectSite
|
||||
;
|
||||
service = projectSite;
|
||||
host = flake.inputs.linkpage.secrets.domains.projectsite;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
root * ${service.paths.path0}
|
||||
|
||||
file_server
|
||||
|
||||
encode gzip
|
||||
|
||||
try_files {path} /index.html
|
||||
|
||||
tls ${service.ssl.cert}/${host}/fullchain.pem ${service.ssl.key}/${host}/key.pem
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 755 caddy caddy -"
|
||||
];
|
||||
}
|
||||
48
modules/nixos/services/prompter/default.nix
Executable file
48
modules/nixos/services/prompter/default.nix
Executable file
|
|
@ -0,0 +1,48 @@
|
|||
{ config, flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances)
|
||||
prompter
|
||||
;
|
||||
service = prompter;
|
||||
host = prompter.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
caddy = {
|
||||
environmentFile = config.sops.secrets."caddy/${service.name}-auth".path;
|
||||
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
basicauth {
|
||||
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
|
||||
}
|
||||
root * ${service.paths.path0}
|
||||
file_server
|
||||
encode gzip
|
||||
try_files {path} /index.html
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}.env";
|
||||
owner = "caddy";
|
||||
mode = "0400";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = {
|
||||
"caddy/${service.name}-auth" = sopsPath "auth";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 755 caddy caddy -"
|
||||
"Z ${service.sops.path0} 755 caddy caddy -"
|
||||
];
|
||||
}
|
||||
44
modules/nixos/services/samba/default.nix
Executable file
44
modules/nixos/services/samba/default.nix
Executable file
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
pkgs,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.services)
|
||||
instances
|
||||
;
|
||||
service = instances.samba;
|
||||
in
|
||||
{
|
||||
# If you ever need to start fresh, you need to add yourself to the Samba users database:
|
||||
# sudo smbpasswd -a username
|
||||
services = {
|
||||
samba = {
|
||||
# package = pkgs.samba4Full;
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
${instances.jellyfin.name} = {
|
||||
path = instances.jellyfin.paths.path0;
|
||||
writable = "true";
|
||||
};
|
||||
${instances.audiobookshelf.name} = {
|
||||
path = instances.audiobookshelf.paths.path0;
|
||||
writable = "true";
|
||||
};
|
||||
${instances.comfyui.name} = {
|
||||
path = instances.comfyui.paths.path0;
|
||||
writable = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
65
modules/nixos/services/searx/config/engines.nix
Executable file
65
modules/nixos/services/searx/config/engines.nix
Executable file
|
|
@ -0,0 +1,65 @@
|
|||
{ lib, ... }:
|
||||
lib.mapAttrsToList (name: value: { inherit name; } // value) {
|
||||
"duckduckgo".disabled = false;
|
||||
"brave".disabled = false;
|
||||
"bing".disabled = false;
|
||||
"mojeek".disabled = true;
|
||||
"mwmbl".disabled = false;
|
||||
"mwmbl".weight = 0.4;
|
||||
"qwant".disabled = true;
|
||||
"crowdview".disabled = false;
|
||||
"crowdview".weight = 0.5;
|
||||
"curlie".disabled = true;
|
||||
"ddg definitions".disabled = false;
|
||||
"ddg definitions".weight = 2;
|
||||
"wikibooks".disabled = false;
|
||||
"wikidata".disabled = false;
|
||||
"wikiquote".disabled = true;
|
||||
"wikisource".disabled = true;
|
||||
"wikispecies".disabled = false;
|
||||
"wikispecies".weight = 0.5;
|
||||
"wikiversity".disabled = false;
|
||||
"wikiversity".weight = 0.5;
|
||||
"wikivoyage".disabled = false;
|
||||
"wikivoyage".weight = 0.5;
|
||||
"currency".disabled = true;
|
||||
"dictzone".disabled = true;
|
||||
"lingva".disabled = true;
|
||||
"bing images".disabled = false;
|
||||
"brave.images".disabled = false;
|
||||
"duckduckgo images".disabled = false;
|
||||
"google images".disabled = false;
|
||||
"qwant images".disabled = true;
|
||||
"1x".disabled = true;
|
||||
"artic".disabled = false;
|
||||
"deviantart".disabled = false;
|
||||
"flickr".disabled = true;
|
||||
"imgur".disabled = false;
|
||||
"library of congress".disabled = false;
|
||||
"material icons".disabled = true;
|
||||
"material icons".weight = 0.2;
|
||||
"openverse".disabled = false;
|
||||
"pinterest".disabled = true;
|
||||
"svgrepo".disabled = false;
|
||||
"unsplash".disabled = false;
|
||||
"wallhaven".disabled = false;
|
||||
"wikicommons.images".disabled = false;
|
||||
"yacy images".disabled = true;
|
||||
"bing videos".disabled = false;
|
||||
"brave.videos".disabled = true;
|
||||
"duckduckgo videos".disabled = true;
|
||||
"google videos".disabled = false;
|
||||
"qwant videos".disabled = false;
|
||||
"dailymotion".disabled = true;
|
||||
"google play movies".disabled = true;
|
||||
"invidious".disabled = true;
|
||||
"odysee".disabled = true;
|
||||
"peertube".disabled = true;
|
||||
"piped".disabled = true;
|
||||
"rumble".disabled = false;
|
||||
"sepiasearch".disabled = false;
|
||||
"vimeo".disabled = true;
|
||||
"youtube".disabled = false;
|
||||
"brave.news".disabled = true;
|
||||
"google news".disabled = true;
|
||||
}
|
||||
8
modules/nixos/services/searx/config/general.nix
Executable file
8
modules/nixos/services/searx/config/general.nix
Executable file
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
debug = false;
|
||||
instance_name = "SearXNG Instance";
|
||||
donation_url = false;
|
||||
contact_url = false;
|
||||
privacypolicy_url = false;
|
||||
enable_metrics = false;
|
||||
}
|
||||
7
modules/nixos/services/searx/config/outgoing.nix
Executable file
7
modules/nixos/services/searx/config/outgoing.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
request_timeout = 5.0;
|
||||
max_request_timeout = 15.0;
|
||||
pool_connections = 100;
|
||||
pool_maxsize = 15;
|
||||
enable_http2 = true;
|
||||
}
|
||||
9
modules/nixos/services/searx/config/plugins.nix
Executable file
9
modules/nixos/services/searx/config/plugins.nix
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
[
|
||||
"Basic Calculator"
|
||||
"Hash plugin"
|
||||
"Tor check plugin"
|
||||
"Open Access DOI rewrite"
|
||||
"Hostnames plugin"
|
||||
"Unit converter plugin"
|
||||
"Tracker URL remover"
|
||||
]
|
||||
7
modules/nixos/services/searx/config/search.nix
Executable file
7
modules/nixos/services/searx/config/search.nix
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
safe_search = 0;
|
||||
autocomplete_min = 2;
|
||||
autocomplete = "duckduckgo";
|
||||
ban_time_on_fail = 5;
|
||||
max_ban_time_on_fail = 120;
|
||||
}
|
||||
27
modules/nixos/services/searx/config/server.nix
Executable file
27
modules/nixos/services/searx/config/server.nix
Executable file
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
configHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
in
|
||||
{
|
||||
port = configHelpers.service.ports.port0;
|
||||
bind_address =
|
||||
if configHelpers.hostname == ceres.name then ceres.wireguard.ip0 else configHelpers.localhost;
|
||||
secret_key = config.sops.secrets.searx-key.path;
|
||||
limiter = false;
|
||||
public_instance = false;
|
||||
image_proxy = true;
|
||||
method = "GET";
|
||||
}
|
||||
// (
|
||||
if configHelpers.hostname == ceres.name then
|
||||
{
|
||||
base_url = "https://${configHelpers.host}";
|
||||
}
|
||||
else
|
||||
{ }
|
||||
)
|
||||
11
modules/nixos/services/searx/config/ui.nix
Executable file
11
modules/nixos/services/searx/config/ui.nix
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
static_use_hash = true;
|
||||
default_locale = "en";
|
||||
query_in_title = true;
|
||||
infinite_scroll = true;
|
||||
center_alignment = true;
|
||||
default_theme = "simple";
|
||||
theme_args.simple_style = "auto";
|
||||
search_on_category_select = true;
|
||||
hotkeys = "vim";
|
||||
}
|
||||
102
modules/nixos/services/searx/default.nix
Executable file
102
modules/nixos/services/searx/default.nix
Executable file
|
|
@ -0,0 +1,102 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.machines.devices) ceres mars deimos;
|
||||
inherit (flake.config.services.instances) searx web;
|
||||
configHelpers = {
|
||||
service = searx;
|
||||
hostname = config.networking.hostName;
|
||||
localhost = web.localhost.address0;
|
||||
host = configHelpers.service.domains.url0;
|
||||
};
|
||||
configPath = ./config;
|
||||
configImports = {
|
||||
general = import (configPath + /general.nix);
|
||||
ui = import (configPath + /ui.nix);
|
||||
search = import (configPath + /search.nix);
|
||||
server = import (configPath + /server.nix) { inherit config flake configHelpers; };
|
||||
engines = import (configPath + /engines.nix) { inherit lib; };
|
||||
outgoing = import (configPath + /outgoing.nix);
|
||||
enabled_plugins = import (configPath + /plugins.nix);
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
services =
|
||||
{
|
||||
searx = {
|
||||
enable = true;
|
||||
redisCreateLocally = true;
|
||||
uwsgiConfig = {
|
||||
socket = "/run/searx/searx.sock";
|
||||
http = ":${builtins.toString configHelpers.service.ports.port0}";
|
||||
chmod-socket = "660";
|
||||
};
|
||||
settings = configImports;
|
||||
};
|
||||
}
|
||||
// (
|
||||
if configHelpers.hostname == ceres.name then
|
||||
{
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${configHelpers.host}" = {
|
||||
extraConfig = ''
|
||||
@allowed_ips {
|
||||
remote_ip ${mars.wireguard.ip0} ${deimos.wireguard.ip0}
|
||||
}
|
||||
|
||||
handle @allowed_ips {
|
||||
redir /.well-known/carddav /remote.php/dav/ 301
|
||||
redir /.well-known/caldav /remote.php/dav/ 301
|
||||
reverse_proxy ${ceres.wireguard.ip0}:${toString configHelpers.service.ports.port0}
|
||||
}
|
||||
handle {
|
||||
respond "Access Denied" 403
|
||||
}
|
||||
tls ${configHelpers.service.ssl.cert} ${configHelpers.service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
else
|
||||
{ }
|
||||
);
|
||||
|
||||
users.groups.searx.members = [ "caddy" ];
|
||||
# systemd.services.caddy.serviceConfig.ProtectHome = false;
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${configHelpers.service.sops.path0}/${configHelpers.service.name}-${secret}";
|
||||
owner = configHelpers.service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${configHelpers.service.name}-${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"key"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
interfaces.wg0.allowedTCPPorts = [
|
||||
configHelpers.service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
55
modules/nixos/services/syncthing/default.nix
Executable file
55
modules/nixos/services/syncthing/default.nix
Executable file
|
|
@ -0,0 +1,55 @@
|
|||
{ flake, ... }:
|
||||
let
|
||||
inherit (flake.config.machines.devices)
|
||||
synology
|
||||
phone
|
||||
;
|
||||
inherit (flake.config.services.instances)
|
||||
syncthing
|
||||
web
|
||||
;
|
||||
service = syncthing;
|
||||
localhost = web.localhost.address0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
syncthing = {
|
||||
enable = true;
|
||||
overrideDevices = false;
|
||||
overrideFolders = false;
|
||||
openDefaultPorts = true;
|
||||
systemService = true;
|
||||
guiAddress = "${localhost}:${toString service.ports.port0}";
|
||||
settings = {
|
||||
devices = {
|
||||
${synology.name} = {
|
||||
autoAcceptFolders = true;
|
||||
name = synology.name;
|
||||
addresses = [
|
||||
"tcp://${synology.ip.address0}:${toString service.ports.port2}"
|
||||
];
|
||||
id = synology.sync.address0;
|
||||
};
|
||||
${phone.name} = {
|
||||
autoAcceptFolders = true;
|
||||
name = phone.name;
|
||||
addresses = [
|
||||
"tcp://${phone.ip.address0}:${toString service.ports.port2}"
|
||||
];
|
||||
id = phone.sync.address0;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
service.ports.port1
|
||||
service.ports.port2
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
98
modules/nixos/services/vaultwarden/default.nix
Executable file
98
modules/nixos/services/vaultwarden/default.nix
Executable file
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.services.instances) smtp vaultwarden web;
|
||||
service = vaultwarden;
|
||||
localhost = web.localhost.address0;
|
||||
host = service.domains.url0;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
vaultwarden = {
|
||||
backupDir = service.paths.path0;
|
||||
enable = true;
|
||||
environmentFile = config.sops.secrets."${service.name}/env".path;
|
||||
config = {
|
||||
# Domain Configuration
|
||||
DOMAIN = "https://${host}";
|
||||
|
||||
# Email Configuration
|
||||
SMTP_AUTH_MECHANISM = "Plain";
|
||||
SMTP_EMBED_IMAGES = true;
|
||||
SMTP_FROM = service.email.address0;
|
||||
SMTP_FROM_NAME = service.label;
|
||||
SMTP_HOST = smtp.hostname;
|
||||
SMTP_PORT = smtp.ports.port0;
|
||||
SMTP_SECURITY = "starttls";
|
||||
SMTP_USERNAME = service.email.address0;
|
||||
|
||||
# Security Configuration
|
||||
DISABLE_ADMIN_TOKEN = false;
|
||||
|
||||
# Event and Backup Management
|
||||
EVENTS_DAYS_RETAIN = 90;
|
||||
|
||||
# User Features
|
||||
SENDS_ALLOWED = true;
|
||||
SIGNUPS_VERIFY = true;
|
||||
WEB_VAULT_ENABLED = true;
|
||||
|
||||
# Rocket (Web Server) Settings
|
||||
ROCKET_ADDRESS = localhost;
|
||||
ROCKET_PORT = service.ports.port0;
|
||||
};
|
||||
};
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy ${localhost}:${toString service.ports.port0} {
|
||||
header_up X-Real-IP {remote_host}
|
||||
}
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
|
||||
encode zstd gzip
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = service.name;
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${service.name}/${secret}";
|
||||
value = sopsPath secret;
|
||||
})
|
||||
[
|
||||
"env"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
|
||||
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
|
||||
];
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [
|
||||
service.ports.port0
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
32
modules/nixos/services/website/default.nix
Executable file
32
modules/nixos/services/website/default.nix
Executable file
|
|
@ -0,0 +1,32 @@
|
|||
{ flake, pkgs, ... }:
|
||||
let
|
||||
inherit (flake.config.services.instances)
|
||||
upRootNutrition
|
||||
web
|
||||
;
|
||||
service = upRootNutrition;
|
||||
host = web.domains.url3;
|
||||
|
||||
websitePkg = flake.inputs.upRootNutrition.packages.${pkgs.system}.websiteFrontend;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
root * ${websitePkg}
|
||||
|
||||
file_server
|
||||
|
||||
encode gzip
|
||||
|
||||
try_files {path} /index.html
|
||||
|
||||
tls ${service.ssl.cert} ${service.ssl.key}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
91
modules/nixos/services/wireGuard/default.nix
Executable file
91
modules/nixos/services/wireGuard/default.nix
Executable file
|
|
@ -0,0 +1,91 @@
|
|||
{ config, flake, ... }:
|
||||
let
|
||||
inherit (flake.config.services) instances;
|
||||
inherit (flake.config.machines.devices) ceres;
|
||||
service = instances.wireGuard;
|
||||
wireGuardInterface =
|
||||
{
|
||||
secret,
|
||||
publicKey,
|
||||
endpoint,
|
||||
}:
|
||||
{
|
||||
name = "Proton-${secret}";
|
||||
value = {
|
||||
autostart = false;
|
||||
address = [ "10.2.0.2/32" ];
|
||||
dns = [ "10.2.0.1" ];
|
||||
privateKeyFile = config.sops.secrets."${service.name}-${secret}".path;
|
||||
peers = [
|
||||
{
|
||||
inherit publicKey endpoint;
|
||||
allowedIPs = [ "0.0.0.0/0,::/0" ];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
interfaces = [
|
||||
{
|
||||
secret = "CA363";
|
||||
publicKey = "9mTDh5Tku0gxDdzqxnpnzItHQBm2h2B2hXnUHvhGCFw=";
|
||||
endpoint = "149.88.97.110:51820";
|
||||
}
|
||||
{
|
||||
secret = "CA220";
|
||||
publicKey = "UR8vjVYrrWYadCwLKiAabKTIdxM4yikmCXnvKWm89D8=";
|
||||
endpoint = "139.28.218.130:51820";
|
||||
}
|
||||
{
|
||||
secret = "CA358";
|
||||
publicKey = "9mTDh5Tku0gxDdzqxnpnzItHQBm2h2B2hXnUHvhGCFw=";
|
||||
endpoint = "149.88.97.110:51820";
|
||||
}
|
||||
{
|
||||
secret = "CA627";
|
||||
publicKey = "xLFgU430Tt7PdHJydVbIKvtjXJodoPpGKW7fhF7XE2k=";
|
||||
endpoint = "139.28.218.130:51820";
|
||||
}
|
||||
];
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
hosts = {
|
||||
${ceres.wireguard.ip0} = [
|
||||
instances.searx.domains.url0
|
||||
instances.glance.domains.url0
|
||||
];
|
||||
};
|
||||
wireguard.interfaces = {
|
||||
wg0 = {
|
||||
peers = [
|
||||
{
|
||||
publicKey = "fs58+Kz+eG9qAXvvMB2NkW+wa88yP61uam4HHWaBJVw=";
|
||||
allowedIPs = [
|
||||
"${ceres.wireguard.ip0}/32"
|
||||
"${instances.web.localhost.address4}/24"
|
||||
];
|
||||
endpoint = "${instances.web.remotehost.address0}:${builtins.toString service.ports.port1}";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
wg-quick.interfaces = builtins.listToAttrs (map wireGuardInterface interfaces);
|
||||
};
|
||||
|
||||
sops.secrets =
|
||||
let
|
||||
sopsPath = secret: {
|
||||
path = "${service.sops.path0}/${service.name}-${secret}";
|
||||
owner = "root";
|
||||
mode = "600";
|
||||
};
|
||||
in
|
||||
builtins.listToAttrs (
|
||||
(map (interface: {
|
||||
name = "${service.name}-${interface.secret}";
|
||||
value = sopsPath interface.secret;
|
||||
}) interfaces)
|
||||
);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue