upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-13 10:00:52 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up nas structure

Browse source
This commit is contained in:
Nick 2025-12-08 22:25:13 -06:00
parent 8cd193ec49
commit 4225970826
747 changed files with 2938 additions and 4347 deletions
Download patch file Download diff file Expand all files Collapse all files

68
modules/config/default.nix
View file

@ -54,41 +54,43 @@ let
};
};
instanceSubmodule = lib.types.submodule {
options = {
subdomain = stringType;
label = stringType;
name = stringType;
short = stringType;
hostname = stringType;
tags = listType;
records = genOptions stringType "record";
domains = genOptions stringType "url";
dns = genOptions stringType "provider";
localhost = genOptions stringType "address";
wireguard = genOptions stringType "interface";
remotehost = genOptions stringType "address";
email = genOptions stringType "address";
sops = genOptions stringType "path";
paths = genOptions stringType "path";
varPaths = genOptions stringType "path";
interfaceConfig = {
domain = stringType;
email = stringType;
ip = stringType;
subdomain = stringType;
wireguard = stringType;
microvm = {
gate = stringType;
id = stringType;
idUser = stringType;
mac = stringType;
macUser = stringType;
num = intType;
ssh = intType;
};
ssl = {
cert = stringType;
key = stringType;
path = stringType;
};
paths = {
mntPaths = genOptions stringType "path";
secretPaths = genOptions stringType "path";
varPaths = genOptions stringType "path";
};
};
instanceSubmodule = lib.types.submodule {
options = {
name = stringType;
label = stringType;
short = stringType;
tags = listType;
dns = genOptions stringType "provider";
ports = genOptions intType "port";
interface = {
id = stringType;
mac = stringType;
idUser = stringType;
macUser = stringType;
ip = stringType;
gate = stringType;
ssh = intType;
};
ssl = {
cert = stringType;
key = stringType;
path = stringType;
};
addresses = genOptions stringType "address";
interfaces = genOptions interfaceConfig "interface";
};
};
@ -284,10 +286,8 @@ in
emailNoReply = "noreply";
servicePath = "/mnt/media/NAS1";
mntPath = "/mnt/storage";
varLib = var;
varPath = var;
sslPath = "${var}/acme";
sopsPath = "${var}/secrets";
secretPath = "/run/secrets";
cachePath = "/var/cache";
dummy = "";

74
modules/config/instances/config/firefly-iii.nix
View file

@ -10,53 +10,59 @@ let
;
label = "Firefly-III";
name = "firefly-iii";
subdomain = "finances";
domain = "${subdomain}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
label = label;
name = name;
short = label;
email = {
address0 = "noreply@${domain0}";
};
domains = {
url0 = domain;
};
tags = [
"firefly-iii"
"finances"
"money"
];
subdomain = subdomain;
ports = {
port0 = 8084;
port1 = 8081;
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:54:04";
idUser = "vmuser-firefly";
macUser = "02:00:00:00:00:04";
ip = "192.168.50.114";
gate = "192.168.50.1";
ssh = 2204;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${cachePath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
interfaces = {
interface0 =
let
subdomain = "finances";
domain = "${subdomain}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
microvm = {
id = "vm-${name}";
mac = "02:00:00:00:54:04";
idUser = "vmuser-firefly";
macUser = "02:00:00:00:00:04";
ip = "192.168.50.114";
gate = "192.168.50.1";
ssh = 2204;
};
email = "noreply@${domain0}";
domain = domain;
subdomain = subdomain;
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${cachePath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

72
modules/config/instances/config/forgejo.nix
View file

@ -11,22 +11,11 @@ let
name = "forgejo";
label = "Forgejo";
subdomain = "source";
domain = "${subdomain}.${domain1}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
name = name;
label = label;
short = label;
email = {
address0 = "${emailNoReply}@${domain1}";
};
domains = {
url0 = domain;
};
subdomain = subdomain;
tags = [
name
"forge"
@ -35,28 +24,43 @@ in
ports = {
port0 = 3033;
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:53:03";
idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:03";
ip = "192.168.50.113";
gate = "192.168.50.1";
ssh = 2203;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
interfaces = {
interface0 =
let
subdomain = "source";
domain = "${subdomain}.${domain1}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
domains = domain;
subdomain = subdomain;
email = "${emailNoReply}@${domain1}";
microvm = {
id = "vm-${name}";
mac = "02:00:00:00:53:03";
idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:03";
ip = "192.168.50.113";
gate = "192.168.50.1";
ssh = 2203;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

62
modules/config/instances/config/jellyfin.nix
View file

@ -9,19 +9,11 @@ let
;
label = "Jellyfin";
name = "jellyfin";
domain = "${name}.${domain0}";
ssl = "${sslPath}/${name}.${domain0}";
in
{
label = label;
name = name;
short = "Jelly";
email = {
address0 = "noreply@${domain0}";
};
domains = {
url0 = domain;
};
tags = [
"jelly"
"video"
@ -30,32 +22,42 @@ in
"shows"
"music"
];
subdomain = name;
ports = {
port0 = 8096; # Jellyfin HTTP
port1 = 5055; # Jellyseer
port2 = 8920; # Jellyfin HTTPS
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:52:02";
idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:02";
ip = "192.168.50.112";
gate = "192.168.50.1";
ssh = 2202;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${cachePath}/${name}";
path2 = "${varPath}/${name}-media";
};
mntPaths = {
path0 = "${mntPath}/${name}";
interfaces = {
interface0 =
let
domain = "${name}.${domain0}";
ssl = "${sslPath}/${name}.${domain0}";
in
{
domain = domain;
subdomain = name;
email = "noreply@${domain0}";
microvm = {
id = "vm-${name}";
mac = "02:00:00:00:52:02";
idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:02";
ip = "192.168.50.112";
gate = "192.168.50.1";
ssh = 2202;
};
paths = {
varPaths = {
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
};
};
}

71
modules/config/instances/config/mastodon.nix
View file

@ -10,22 +10,11 @@ let
;
label = "Mastodon";
name = "mastodon";
subdomain = "social";
domain = "${subdomain}.${domain1}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
label = label;
name = name;
short = "Mast";
email = {
address0 = "noreply@${domain1}";
};
domains = {
url0 = domain;
};
subdomain = subdomain;
tags = [
name
"mast"
@ -35,27 +24,43 @@ in
port0 = 80;
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:55:05";
idUser = "vmuser-mastodon";
macUser = "02:00:00:00:00:05";
ip = "192.168.50.115";
gate = "192.168.50.1";
ssh = 2205;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${cachePath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
interface0 =
let
subdomain = "social";
domain = "${subdomain}.${domain1}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
domains = domain;
subdomain = subdomain;
email = "noreply@${domain1}";
microvm = {
id = "vm-${name}";
mac = "02:00:00:00:55:05";
idUser = "vmuser-mastodon";
macUser = "02:00:00:00:00:05";
ip = "192.168.50.115";
gate = "192.168.50.1";
ssh = 2205;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${cachePath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

73
modules/config/instances/config/minecraft.nix Executable file
View file

@ -0,0 +1,73 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
varPath
mntPath
secretPath
;
label = "Minecraft";
name = "minecraft";
in
{
label = label;
name = name;
ports = {
};
interfaces = {
interface0 =
let
world = "world0";
in
{
microvm = {
id = "vm-${world}";
mac = "02:00:00:00:51:41";
idUser = "vmuser-${world}";
macUser = "02:00:00:00:00:41";
ip = "192.168.50.141";
gate = "192.168.50.1";
ssh = 2401;
port = 43000;
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}/${world}";
};
secretPaths = {
path0 = "${secretPath}/${name}";
};
};
};
interface1 =
let
world = "world1";
in
{
microvm = {
id = "vm-${world}";
mac = "02:00:00:00:51:42";
idUser = "vmuser-${world}";
macUser = "02:00:00:00:00:42";
ip = "192.168.50.142";
gate = "192.168.50.1";
ssh = 2402;
port = 43001;
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path1 = "${mntPath}/${name}/${world}";
};
secretPaths = {
path0 = "${secretPath}/${name}";
};
};
};
};
}

36
modules/config/instances/config/minecraft0.nix
View file

@ -1,36 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
varPath
mntPath
secretPath
;
label = "Minecraft";
name = "minecraft";
world = "world0";
in
{
label = label;
name = name;
ports = {
port0 = 43000;
};
interface = {
id = "vm-${world}";
mac = "02:00:00:00:51:41";
idUser = "vmuser-${world}";
macUser = "02:00:00:00:00:41";
ip = "192.168.50.141";
gate = "192.168.50.1";
ssh = 2401;
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}/${world}";
};
secretPaths = {
path0 = "${secretPath}/${name}";
};
}

36
modules/config/instances/config/minecraft1.nix
View file

@ -1,36 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
varPath
mntPath
secretPath
;
label = "Minecraft";
name = "minecraft";
world = "world1";
in
{
label = label;
name = name;
ports = {
port0 = 43001;
};
interface = {
id = "vm-${world}";
mac = "02:00:00:00:51:42";
idUser = "vmuser-${world}";
macUser = "02:00:00:00:00:42";
ip = "192.168.50.142";
gate = "192.168.50.1";
ssh = 2402;
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}/${world}";
};
secretPaths = {
path0 = "${secretPath}/${name}";
};
}

19
modules/config/instances/config/nginx.nix
View file

@ -1,19 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
sopsPath
;
label = "Nginx";
name = "nginx";
in
{
label = label;
name = name;
sops = {
path0 = "${sopsPath}/${name}";
};
ports = {
port0 = 8080;
};
}

63
modules/config/instances/config/ollama.nix
View file

@ -9,18 +9,11 @@ let
;
label = "Ollama";
name = "ollama";
domain = "${name}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
label = label;
name = name;
short = label;
domains = {
url0 = domain;
};
subdomain = name;
tags = [
name
"chat"
@ -31,26 +24,40 @@ in
port1 = 11434; # Ollama API
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:56:08";
idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:08";
ip = "192.168.50.118";
gate = "192.168.50.1";
ssh = 2208;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
interface0 =
let
domain = "${name}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
domain = domain;
subdomain = name;
microvm = {
id = "vm-${name}";
mac = "02:00:00:00:56:08";
idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:08";
ip = "192.168.50.118";
gate = "192.168.50.1";
ssh = 2208;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

98
modules/config/instances/config/opencloud.nix Executable file
View file

@ -0,0 +1,98 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
sslPath
varPath
mntPath
secretPath
;
label = "OpenCloud";
name = "opencloud";
short = "cloud";
in
{
label = label;
name = name;
short = "Cloud";
tags = [
name
"opencloud"
"cloud"
];
ports = {
port0 = 9200;
};
interface = {
interface0 =
let
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
domain = domain;
subdomain = short;
microvm = {
id = "vm-${short}";
mac = "02:00:00:00:56:09";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:09";
ip = "192.168.50.119";
gate = "192.168.50.1";
ssh = 2209;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
interface1 =
let
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${name}.${domain0}";
in
{
domain = domain;
subdomain = short;
microvm = {
id = "vm-${short}";
mac = "02:00:00:00:56:06";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:06";
ip = "192.168.50.116";
gate = "192.168.50.1";
ssh = 2206;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

56
modules/config/instances/config/opencloud0.nix
View file

@ -1,56 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
sslPath
varPath
mntPath
secretPath
;
label = "OpenCloud";
name = "opencloud";
short = "cloud";
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
label = label;
name = name;
short = "Cloud";
domains = {
url0 = domain;
};
subdomain = short;
tags = [
name
"opencloud"
"cloud"
];
ports = {
port0 = 9200;
};
interface = {
id = "vm-${short}";
mac = "02:00:00:00:56:09";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:09";
ip = "192.168.50.119";
gate = "192.168.50.1";
ssh = 2209;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
}

56
modules/config/instances/config/opencloud1.nix
View file

@ -1,56 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
sslPath
varPath
mntPath
secretPath
;
label = "OpenCloud";
name = "opencloud";
short = "cloud";
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${name}.${domain0}";
in
{
label = label;
name = name;
short = "Cloud";
domains = {
url0 = domain;
};
subdomain = short;
tags = [
name
"opencloud"
"cloud"
];
ports = {
port0 = 9200;
};
interface = {
id = "vm-${short}";
mac = "02:00:00:00:56:06";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:06";
ip = "192.168.50.116";
gate = "192.168.50.1";
ssh = 2206;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
}

63
modules/config/instances/config/photoprism.nix Normal file
View file

@ -0,0 +1,63 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
sslPath
varPath
mntPath
secretPath
;
label = "Photoprism";
name = "photoprism";
short = "prism";
in
{
label = label;
name = name;
short = label;
tags = [
name
"photo"
"images"
];
ports = {
port0 = 3030;
};
interface = {
interface0 =
let
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
domain = domain;
subdomain = short;
microvm = {
id = "vm-${short}";
mac = "02:00:00:00:56:11";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:11";
ip = "192.168.50.121";
gate = "192.168.50.1";
ssh = 2211;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${label}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

23
modules/config/instances/config/postgresql.nix
View file

@ -1,23 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
servicePath
sopsPath
;
label = "PostgreSQL";
name = "postgres";
in
{
label = label;
name = name;
sops = {
path0 = "${sopsPath}/${name}";
};
paths = {
path0 = "${servicePath}/${label}";
};
ports = {
port0 = 5432;
};
}

46
modules/config/instances/config/projectSite.nix
View file

@ -7,40 +7,38 @@ let
;
label = "ProjectSite";
name = "projectsite";
domain = "${name}.${domain0}";
in
{
label = label;
name = name;
short = "Project";
email = {
address0 = "noreply@${domain0}";
};
domains = {
url0 = domain;
};
tags = [
"project"
];
subdomain = name;
ports = {
port0 = 1334;
};
interface = {
id = "vm-project";
mac = "02:00:00:00:52:22";
idUser = "vmuser-project";
macUser = "02:00:00:00:00:22";
ip = "192.168.50.212";
gate = "192.168.50.1";
ssh = 2299;
};
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${varPath}/${name}/dist";
};
mntPaths = {
path0 = "${mntPath}/${name}";
interfaces = {
interface0 = {
email = "noreply@${domain0}";
microvm = {
id = "vm-project";
mac = "02:00:00:00:52:22";
idUser = "vmuser-project";
macUser = "02:00:00:00:00:22";
ip = "192.168.50.212";
gate = "192.168.50.1";
ssh = 2299;
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${varPath}/${name}/dist";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
};
};
};
}

41
modules/config/instances/config/prompter.nix
View file

@ -1,41 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
sslPath
sopsPath
;
label = "Prompter";
name = "prompter";
subdomain = "prompter";
domain = "${subdomain}.${domain0}";
in
{
label = label;
name = name;
short = "upRoot";
sops = {
path0 = "${sopsPath}/${name}";
};
domains = {
url0 = domain;
};
subdomain = subdomain;
tags = [
name
"blog"
];
paths = {
path0 = "/var/lib/${name}/dist";
path1 = "";
path2 = "";
};
ports = {
port0 = 1234;
};
ssl = {
cert = "${sslPath}/${domain0}/fullchain.pem";
key = "${sslPath}/${domain0}/key.pem";
};
}

63
modules/config/instances/config/qbittorrent.nix
View file

@ -10,18 +10,11 @@ let
label = "qBittorrent";
name = "qbittorrent";
short = "share";
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
label = label;
name = name;
short = label;
domains = {
url0 = domain;
};
subdomain = short;
tags = [
name
"torrent"
@ -31,26 +24,40 @@ in
port0 = 3030;
};
interface = {
id = "vm-${short}";
mac = "02:00:00:00:56:07";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:07";
ip = "192.168.50.117";
gate = "192.168.50.1";
ssh = 2207;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${label}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
interface0 =
let
domain = "${short}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${domain}";
in
{
domain = domain;
subdomain = short;
microvm = {
id = "vm-${short}";
mac = "02:00:00:00:56:07";
idUser = "vmuser-${short}";
macUser = "02:00:00:00:00:07";
ip = "192.168.50.117";
gate = "192.168.50.1";
ssh = 2207;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${label}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

21
modules/config/instances/config/samba.nix
View file

@ -1,21 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
sopsPath
;
label = "Samba";
name = "samba";
in
{
label = label;
name = name;
sops = {
path0 = "${sopsPath}/${name}";
};
paths = {
};
ports = {
port0 = 445; # Samba
};
}

18
modules/config/instances/config/smtp.nix
View file

@ -6,20 +6,22 @@ let
;
name = "smtp";
domain = "smtp.migadu.com";
in
{
hostname = "smtp.migadu.com";
name = name;
ports = {
port0 = 465; # TLS
port1 = 587; # StartTLS
};
email = {
address0 = "noreply@${domain0}";
address1 = "noreply@${domain1}";
};
records = {
record0 = "tls";
record1 = "starttls";
interfaces = {
interface0 = {
domain = domain;
email = "noreply@${domain0}";
};
interface1 = {
domain = domain;
email = "noreply@${domain1}";
};
};
}

58
modules/config/instances/config/syncthing.nix
View file

@ -2,30 +2,19 @@
let
inherit (moduleFunctions.instancesFunctions)
domain0
varLib
varPath
mntPath
sslPath
sopsPath
secretPath
;
label = "Syncthing";
name = "syncthing";
domain = "${name}.${domain0}";
in
{
label = label;
name = name;
short = "Sync";
sops = {
path0 = "${sopsPath}/${name}";
};
paths = {
path0 = "${varLib}/${name}";
path1 = "${varLib}/${name}/backups";
};
domains = {
url0 = domain;
};
subdomain = name;
tags = [
name
"sync"
@ -36,8 +25,43 @@ in
port1 = 21027; # Syncthing (Discovery)
port2 = 22000; # Syncthing (Transfer)
};
ssl = {
cert = "${sslPath}/${name}.${domain0}/fullchain.pem";
key = "${sslPath}/${name}.${domain0}/key.pem";
interfaces = {
interface0 =
let
domain = "${name}.${domain0}";
ssl = "${sslPath}/${domain}";
id = "sync";
secrets = "${secretPath}/${name}";
in
{
domain = domain;
subdomain = name;
microvm = {
id = "vm-${id}";
mac = "02:00:00:00:56:10";
idUser = "vmuser-${id}";
macUser = "02:00:00:00:00:10";
ip = "192.168.50.120";
gate = "192.168.50.1";
ssh = 2210;
};
ssl = {
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
path = ssl;
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
path1 = "${varPath}/${name}/backups";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

50
modules/config/instances/config/upRootNutrition.nix
View file

@ -1,50 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain1
varPath
mntPath
sslPath
;
label = "upRootNutrition";
name = "uprootnutrition";
ssl = "${sslPath}/${domain1}";
in
{
label = label;
name = name;
short = "upRoot";
email = {
address0 = "nick@${domain1}";
};
domains = {
url0 = domain1;
};
tags = [
name
"blog"
];
interface = {
id = "vm-uproot";
mac = "02:00:00:00:52:21";
idUser = "vmuser-uproot";
macUser = "02:00:00:00:00:21";
ip = "192.168.50.211";
gate = "192.168.50.1";
ssh = 2300;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
}

67
modules/config/instances/config/vaultwarden.nix
View file

@ -9,21 +9,11 @@ let
;
label = "Vaultwarden";
name = "vaultwarden";
domain = "${name}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${name}.${domain0}";
in
{
label = label;
name = name;
short = "Vault";
email = {
address0 = "noreply@${domain0}";
};
domains = {
url0 = domain;
};
subdomain = name;
tags = [
name
"bitwarden"
@ -35,26 +25,41 @@ in
port0 = 8085;
};
interface = {
id = "vm-${name}";
mac = "02:00:00:00:51:01";
idUser = "vmuser-vault";
macUser = "02:00:00:00:00:01";
ip = "192.168.50.111";
gate = "192.168.50.1";
ssh = 2201;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
interface0 =
let
domain = "${name}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${name}.${domain0}";
in
{
domain = domain;
subdomain = name;
email = "noreply@${domain0}";
microvm = {
id = "vm-${name}";
mac = "02:00:00:00:51:01";
idUser = "vmuser-vault";
macUser = "02:00:00:00:00:01";
ip = "192.168.50.111";
gate = "192.168.50.1";
ssh = 2201;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
secretPaths = {
path0 = secrets;
};
};
};
};
}

17
modules/config/instances/config/web.nix
View file

@ -1,19 +1,14 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
domain1
dummy
;
label = "Router";
in
{
label = label;
name = "router";
short = label;
domains = {
url0 = domain0;
url1 = domain1;
};
short = dummy;
dns = {
provider0 = "namecheap";
provider1 = "cloudflare";
@ -22,17 +17,11 @@ in
"router"
"asus"
];
localhost = {
addresses = {
address0 = "127.0.0.1"; # Local
address1 = "0.0.0.0"; # All
address2 = "192.168.50.1"; # Router
address3 = "192.168.50.0"; # Router
address4 = "192.168.1.0"; # Router
};
remotehost = {
address0 = "24.76.173.0";
};
wireguard = {
interface0 = "10.100.0.1";
};
}

54
modules/config/instances/config/website.nix Executable file
View file

@ -0,0 +1,54 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain1
varPath
sslPath
;
label = "upRootNutrition";
name = "uprootnutrition";
in
{
label = label;
name = name;
short = "upRoot";
tags = [
name
"blog"
];
interface = {
interface0 =
let
ssl = "${sslPath}/${domain1}";
in
{
domain = domain1;
email = "nick@${domain1}";
microvm = {
id = "vm-uproot";
mac = "02:00:00:00:52:21";
idUser = "vmuser-uproot";
macUser = "02:00:00:00:00:21";
ip = "192.168.50.211";
gate = "192.168.50.1";
ssh = 2300;
};
ssl = {
path = ssl;
cert = "${ssl}/fullchain.pem";
key = "${ssl}/key.pem";
};
};
interface1 = {
microvm = {
id = "vm-project";
mac = "02:00:00:00:52:22";
idUser = "vmuser-project";
macUser = "02:00:00:00:00:22";
ip = "192.168.50.212";
gate = "192.168.50.1";
ssh = 2299;
};
};
};
}

16
modules/config/instances/config/wireGuard.nix
View file

@ -1,9 +1,8 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
sopsPath
secretPath
;
label = "WireGuard";
name = "wireguard";
in
@ -11,10 +10,21 @@ in
label = label;
name = name;
sops = {
path0 = "${sopsPath}/${name}";
};
ports = {
port0 = 53;
port1 = 51821;
};
addresses = {
address0 = "10.100.0.1";
};
interfaces = {
interface0 = {
paths = {
secretPaths = {
path0 = "${secretPath}/${name}";
};
};
};
};
}

33
modules/config/instances/config/zookeeper.nix
View file

@ -12,19 +12,24 @@ in
label = label;
name = name;
interface = {
id = "vm-boonbot";
mac = "02:00:00:00:53:23";
idUser = "vmuser-boonbot";
macUser = "02:00:00:00:00:23";
ip = "192.168.50.213";
gate = "192.168.50.1";
ssh = 2303;
interface0 = {
microvm = {
id = "vm-boonbot";
mac = "02:00:00:00:53:23";
idUser = "vmuser-boonbot";
macUser = "02:00:00:00:00:23";
ip = "192.168.50.213";
gate = "192.168.50.1";
ssh = 2303;
};
paths = {
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
};
};
};
varPaths = {
path0 = "${varPath}/${name}";
};
mntPaths = {
path0 = "${mntPath}/${name}";
};
}

257
modules/nixos/guests/firefly-iii/default.nix
View file

@ -1,257 +0,0 @@
{
flake,
config,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.people.users.${user0}) email;
inherit (flake.config.services) instances;
serviceCfg = instances.firefly-iii;
smtpCfg = instances.smtp;
hostCfg = instances.web;
host = serviceCfg.domains.url0;
dns = instances.web.dns.provider0;
dnsPath = "dns/${dns}";
in
{
microvm.vms = {
${serviceCfg.name} = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
firefly-iii = {
enable = true;
enableNginx = false;
poolConfig = {
"listen.owner" = config.services.caddy.user;
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 4;
"pm.max_requests" = 500;
};
settings = {
APP_URL = "https://${host}";
APP_KEY_FILE = "/etc/firefly-secrets/${user0}-pass";
DB_PASSWORD_FILE = "/etc/firefly-secrets/${user0}-data";
DB_CONNECTION = "pgsql";
DB_HOST = "/run/postgresql";
DB_DATABASE = "firefly-iii";
DB_USERNAME = "firefly-iii";
MAIL_MAILER = smtpCfg.name;
MAIL_HOST = smtpCfg.hostname;
MAIL_PORT = smtpCfg.ports.port0;
MAIL_FROM = smtpCfg.email.address0;
MAIL_USERNAME = smtpCfg.email.address0;
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/${user0}-smtp";
MAIL_ENCRYPTION = "tls";
SITE_OWNER = email.address2;
};
};
phpfpm.pools.firefly-iii.phpEnv = {
TRUSTED_PROXIES = "*";
APP_URL = "https://${host}";
};
firefly-iii-data-importer = {
enable = true;
};
caddy = {
enable = true;
virtualHosts.":80" = {
extraConfig = ''
root * ${config.services.firefly-iii.package}/public
file_server
encode gzip
php_fastcgi unix//run/phpfpm/firefly-iii.sock {
env HTTPS {http.request.header.X-Forwarded-Proto}
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
}
'';
};
};
postgresql = {
enable = true;
ensureDatabases = [ "firefly-iii" ];
ensureUsers = [
{
name = "firefly-iii";
ensureDBOwnership = true;
}
];
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
users.users.caddy = {
extraGroups = [ "firefly-iii" ];
};
networking.firewall.allowedTCPPorts = [
22
80
serviceCfg.ports.port0
serviceCfg.ports.port1
];
systemd = {
services = {
caddy = {
after = [ "phpfpm-firefly-iii.service" ];
requires = [ "phpfpm-firefly-iii.service" ];
};
fix-secrets-permissions = {
description = "Fix secrets permissions for firefly-iii";
wantedBy = [ "multi-user.target" ];
before = [
"firefly-iii-setup.service"
"phpfpm-firefly-iii.service"
];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/firefly-secrets
cp /run/secrets/${user0}-pass /etc/firefly-secrets/${user0}-pass
cp /run/secrets/${user0}-data /etc/firefly-secrets/${user0}-data
cp /run/secrets/${user0}-smtp /etc/firefly-secrets/${user0}-smtp
chmod 755 /etc/firefly-secrets
chmod 644 /etc/firefly-secrets/*
'';
};
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/var/lib/postgresql";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/database";
tag = "${serviceCfg.name}_database";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/database 0751 microvm wheel - -"
];
sops = {
secrets = builtins.listToAttrs (
map
(secret: {
name = "${serviceCfg.name}/${user0}-${secret}";
value = {
owner = "root";
group = "root";
mode = "0644";
};
})
[
"pass"
"data"
"smtp"
]
);
};
users.users.caddy.extraGroups = [ "acme" ];
security.acme.certs."${host}" = {
dnsProvider = dns;
environmentFile = config.sops.secrets.${dnsPath}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host}" = {
extraConfig = ''
reverse_proxy http://${serviceCfg.interface.ip}:80 {
header_up X-Forwarded-Proto https
header_up X-Forwarded-Host {host}
}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
}

178
modules/nixos/guests/forgejo/default.nix
View file

@ -1,178 +0,0 @@
{
config,
flake,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = flake.config.services.instances.forgejo;
smtpCfg = flake.config.services.instances.smtp;
hostCfg = flake.config.services.instances.web;
host = serviceCfg.domains.url0;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
users.users.caddy.extraGroups = [ "acme" ];
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
microvm.vms = {
${serviceCfg.name} = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
${serviceCfg.name} = {
enable = true;
lfs.enable = true;
secrets = {
mailer.PASSWD = "/run/secrets/smtp";
};
settings = {
server = {
DOMAIN = host;
ROOT_URL = "https://${host}/";
HTTP_PORT = serviceCfg.ports.port0;
};
# If you need to start from scratch, don't forget to turn this off again
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
mirror = {
ENABLED = true;
};
mailer = {
ENABLED = true;
SMTP_ADDR = smtpCfg.hostname;
FROM = smtpCfg.email.address1;
USER = smtpCfg.email.address1;
PROTOCOL = "${smtpCfg.name}+${smtpCfg.records.record1}";
SMTP_PORT = smtpCfg.ports.port1;
SEND_AS_PLAIN_TEXT = true;
USE_CLIENT_CERT = false;
};
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
25 # SMTP
139 # SMTP
587 # SMTP
2525 # SMTP
serviceCfg.ports.port0
];
fileSystems."/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=4G"
"mode=1777"
];
};
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# "Z /var/lib/postgresql 0755 postgres postgres -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 1;
mem = 1024;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
];
services.caddy.virtualHosts."${host}" = {
extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
sops.secrets = {
"${serviceCfg.name}/smtp" = {
owner = "root";
mode = "0600";
};
};
}

181
modules/nixos/guests/jellyfin/default.nix
View file

@ -1,181 +0,0 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.jellyfin;
hostCfg = instances.web;
dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}";
id = 993;
in
{
microvm.vms = {
${serviceCfg.name} = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "25.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
jellyfin = {
enable = true;
openFirewall = true;
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
users.users.jellyfin = {
isSystemUser = true;
group = serviceCfg.name;
uid = id;
};
users.groups.jellyfin = {
gid = id;
};
networking.firewall.allowedTCPPorts = [
22
serviceCfg.ports.port0
serviceCfg.ports.port1
serviceCfg.ports.port2
];
fileSystems."/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=6G"
"mode=1777"
];
};
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"Z ${serviceCfg.varPaths.path2} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d ${serviceCfg.varPaths.path1} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"Z ${serviceCfg.varPaths.path2} 0775 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 4;
mem = 1024 * 3;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = serviceCfg.varPaths.path0;
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = serviceCfg.varPaths.path1;
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/cache";
tag = "${serviceCfg.name}_cache";
}
{
mountPoint = serviceCfg.varPaths.path2;
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/media";
tag = "${serviceCfg.name}_media";
}
];
};
};
};
};
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
users = {
groups.jellyfin = {
gid = id;
members = [ user0 ];
};
users = {
jellyfin = {
isSystemUser = true;
group = serviceCfg.name;
uid = id;
};
caddy.extraGroups = [ "acme" ];
};
};
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0755 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/cache 0755 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/media 0775 microvm wheel - -"
];
}

511
modules/nixos/guests/mastodon/default.nix
View file

@ -1,511 +0,0 @@
{
flake,
config,
pkgs,
lib,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = flake.config.services.instances.mastodon;
smtpCfg = flake.config.services.instances.smtp;
hostCfg = flake.config.services.instances.web;
host = serviceCfg.domains.url0;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" (
builtins.toJSON {
server = "https://${host}";
home-timeline-length = 200;
max-followings = 80;
from-notifications = 1;
max-bookmarks = 80;
max-favourites = 40;
backfill-with-context = 1;
backfill-mentioned-users = 1;
remember-users-for-hours = 168;
remember-hosts-for-days = 30;
http-timeout = 5;
lock-hours = 24;
log-level = "INFO";
}
);
in
{
# If you need to start fresh for some reason, run these to create the new Admin account:
# sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
# sudo -u mastodon mastodon-tootctl accounts approve nick
# If you fuck up and lose the password, use this:
# sudo mastodon-tootctl accounts modify --reset-password nick
# If you really fuck up and name yourself wrong, use this shit
# sudo mastodon-tootctl accounts modify username --remove-role
nixpkgs.overlays = [
(final: prev: {
mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
patches = (oldAttrs.patches or [ ]) ++ [
./config/chars.patch
];
});
})
];
microvm.vms = {
${serviceCfg.name} = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
${serviceCfg.name} = {
enable = true;
localDomain = host;
secretKeyBaseFile = "/etc/mastodon-secrets/pass";
streamingProcesses = 7;
trustedProxy = hostCfg.localhost.address0;
automaticMigrations = true;
database = {
createLocally = true;
name = serviceCfg.name;
host = "/run/postgresql";
user = serviceCfg.name;
passwordFile = "/etc/mastodon-secrets/database";
};
extraConfig = {
SINGLE_USER_MODE = "false";
SMTP_AUTH_METHOD = "plain";
SMTP_DELIVERY_METHOD = "smtp";
SMTP_ENABLE_STARTTLS_AUTO = "true";
SMTP_SSL = "false";
};
# if you're starting from scratch, you gotta cd into /var/lib/mastodon and run:
# sudo -u mastodon mastodon-tootctl search deploy
elasticsearch = {
preset = "single_node_cluster";
host = hostCfg.localhost.address0;
port = 9200;
};
mediaAutoRemove = {
enable = true;
olderThanDays = 14;
};
redis = {
createLocally = true;
enableUnixSocket = true;
};
sidekiqThreads = 25;
sidekiqProcesses = {
all = {
jobClasses = [ ];
threads = null;
};
default = {
jobClasses = [ "default" ];
threads = 5;
};
ingress = {
jobClasses = [ "ingress" ];
threads = 5;
};
push-pull = {
jobClasses = [
"push"
"pull"
];
threads = 5;
};
mailers = {
jobClasses = [ "mailers" ];
threads = 5;
};
};
smtp = {
authenticate = true;
createLocally = false;
fromAddress = "upRootNutrition <${smtpCfg.email.address1}>";
host = smtpCfg.hostname;
passwordFile = "/etc/mastodon-secrets/smtp";
port = smtpCfg.ports.port1;
user = smtpCfg.email.address1;
};
};
opensearch.enable = true;
caddy = {
enable = true;
virtualHosts = {
":80" = {
extraConfig = ''
handle_path /system/* {
file_server * {
root /var/lib/mastodon/public-system
}
}
handle /api/v1/streaming/* {
reverse_proxy unix//run/mastodon-streaming/streaming.socket {
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
}
}
route * {
file_server * {
root ${pkgs.mastodon}/public
pass_thru
}
reverse_proxy * unix//run/mastodon-web/web.socket {
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
}
}
handle_errors {
root * ${pkgs.mastodon}/public
rewrite 500.html
file_server
}
encode gzip
header /* {
Strict-Transport-Security "max-age=31536000;"
}
header /emoji/* Cache-Control "public, max-age=31536000, immutable"
header /packs/* Cache-Control "public, max-age=31536000, immutable"
header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
'';
};
};
};
postgresql = {
enable = true;
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
users.users = {
${serviceCfg.name}.extraGroups = [ "postgres" ];
caddy.extraGroups = [ serviceCfg.name ];
fedifetcher = {
isSystemUser = true;
group = "fedifetcher";
home = "/var/lib/fedifetcher";
createHome = true;
};
};
users.groups.fedifetcher = { };
networking.firewall.allowedTCPPorts = [
22 # SSH
80 # Caddy
25 # SMTP
139 # SMTP
587 # SMTP
2525 # SMTP
5432 # Postgres
];
systemd = {
services = {
mastodon-init-dirs.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-web.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-1.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-2.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-3.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-4.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-5.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-6.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-7.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-all.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-default.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-ingress.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-mailers.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-push-pull.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-elastic-search = {
description = "Recache elastic search";
after = [
"network-online.target"
"mastodon-web.service"
];
wants = [ "network-online.target" ];
serviceConfig = {
WorkingDirectory = "/var/lib/${serviceCfg.name}";
Type = "oneshot";
};
script = ''
/run/current-system/sw/bin/mastodon-tootctl search deploy --only=instances accounts tags statuses public_statuses
'';
};
mastodon-copy-secrets = {
description = "Copy secrets from virtiofs to local filesystem";
before = [ "mastodon-init-dirs.service" ];
requiredBy = [ "mastodon-init-dirs.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/mastodon-secrets
cp /run/secrets/pass /etc/mastodon-secrets/pass
cp /run/secrets/database /etc/mastodon-secrets/database
cp /run/secrets/redis /etc/mastodon-secrets/redis
cp /run/secrets/smtp /etc/mastodon-secrets/smtp
cp /run/secrets/fedifetcher-token /etc/mastodon-secrets/fedifetcher-token
chmod 755 /etc/mastodon-secrets
chmod 644 /etc/mastodon-secrets/*
'';
};
fedifetcher = {
description = "FediFetcher - Fetch missing posts for Mastodon";
after = [
"network-online.target"
"mastodon-web.service"
];
wants = [ "network-online.target" ];
serviceConfig = {
Type = "oneshot";
User = "fedifetcher";
Group = "fedifetcher";
WorkingDirectory = "/var/lib/fedifetcher";
TimeoutStartSec = "300";
PrivateTmp = true;
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
ReadWritePaths = "/var/lib/fedifetcher";
ExecStart =
let
script = pkgs.writeShellScript "fedifetcher-run" ''
set -e
# Wait for Mastodon to be fully ready
for i in {1..30}; do
if ${pkgs.curl}/bin/curl -sf http://localhost:80/health >/dev/null 2>&1; then
echo "Mastodon is ready"
break
fi
echo "Waiting for Mastodon to be ready... ($i/30)"
sleep 2
done
export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/fedifetcher-token)
${pkgs.fedifetcher}/bin/fedifetcher \
-c=${fedifetcherConfig} \
--access-token="$ACCESS_TOKEN"
'';
in
"${script}";
};
};
mastodon-init-db.serviceConfig.EnvironmentFile = "/var/lib/mastodon/.secrets_env";
systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ];
opensearch-install-plugins = {
description = "Install OpenSearch plugins";
before = [ "opensearch.service" ];
requiredBy = [ "opensearch.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
PLUGIN_DIR="/var/lib/opensearch/plugins/analysis-icu"
if [ ! -d "$PLUGIN_DIR" ]; then
# Create the plugins directory if it doesn't exist
mkdir -p /var/lib/opensearch/plugins
# Install using the proper OpenSearch plugin command
export OPENSEARCH_JAVA_HOME="${pkgs.jdk17}/lib/openjdk"
${pkgs.opensearch}/bin/opensearch-plugin install --batch analysis-icu || {
echo "Plugin installation failed, but continuing anyway"
exit 0
}
fi
'';
};
};
timers = {
mastodon-elastic-search = {
description = "Timer for Mastodon elastic search recaching";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "10min";
OnUnitActiveSec = "60min";
Unit = "mastodon-elastic-search.service";
};
};
fedifetcher = {
description = "Timer for FediFetcher";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "10min";
OnUnitActiveSec = "15min";
Unit = "fedifetcher.service";
Persistent = true;
AccuracySec = "1min";
};
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/mastodon 0755 mastodon mastodon -"
"Z /var/lib/mastodon 0755 mastodon mastodon -"
"Z /var/lib/postgresql 0755 postgres postgres -"
"d /var/cache/mastodon/precompile 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/accounts 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -"
"d /var/lib/fedifetcher 0755 fedifetcher fedifetcher -"
];
};
microvm = {
vcpu = 2;
mem = 1024 * 6;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/var/lib/postgresql";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/database";
tag = "${serviceCfg.name}_database";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
sops = {
secrets = builtins.listToAttrs (
map
(secret: {
name = "${serviceCfg.name}/${secret}";
value = {
owner = "root";
group = "root";
mode = "0644";
};
})
[
"smtp"
"database"
"redis"
"pass"
"fedifetcher-token"
]
);
};
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/database 0751 microvm wheel - -"
];
services.caddy.virtualHosts."${host}" = {
extraConfig = ''
reverse_proxy http://${serviceCfg.interface.ip}:80 {
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
users.users.caddy.extraGroups = [ "acme" ];
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
}

190
modules/nixos/guests/minecraft/world0/default.nix
View file

@ -1,190 +0,0 @@
{
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.minecraft0;
hostCfg = instances.web;
world = "world0";
in
{
microvm.vms = {
"${serviceCfg.name}-${world}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
minecraft-server = {
enable = true;
eula = true;
openFirewall = true;
declarative = true;
serverProperties = {
"rcon.password" = "/etc/${serviceCfg.name}-secrets/${world}";
allow-flight = false;
allow-nether = true;
difficulty = 2;
enable-command-block = false;
enable-rcon = true;
enable-status = true;
force-gamemode = true;
gamemode = 0;
generate-structures = true;
hardcore = false;
hide-online-players = false;
level-name = "Brix on Nix";
level-seed = "9064150133272194";
max-players = 10;
max-world-size = 64000000;
motd = "A cool Minecraft server powered by NixOS";
online-mode = true;
pvp = true;
server-ip = hostCfg.localhost.address1;
server-port = serviceCfg.ports.port0;
spawn-animals = true;
spawn-monsters = true;
spawn-npcs = true;
spawn-protection = 16;
view-distance = 32;
white-list = true;
};
whitelist = {
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
serviceCfg.ports.port0
];
systemd = {
services = {
"${serviceCfg.name}-copy-secrets" = {
description = "Copy secrets from virtiofs to local filesystem";
before = [ "minecraft-server.service" ];
requiredBy = [ "minecraft-server.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/${serviceCfg.name}-secrets
cp /run/secrets/${world} /etc/${serviceCfg.name}-secrets/${world}
chmod 755 /etc/${serviceCfg.name}-secrets
chmod 644 /etc/${serviceCfg.name}-secrets/*
'';
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 4;
mem = 1024 * 4;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = serviceCfg.varPaths.path0;
proto = "virtiofs";
source = serviceCfg.mntPaths.path0;
tag = "${serviceCfg.name}-${world}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = serviceCfg.secretPaths.path0;
tag = "host_secrets";
}
];
};
};
};
};
sops.secrets = {
"${serviceCfg.name}/${world}" = {
owner = "root";
mode = "0600";
};
};
networking.firewall.allowedTCPPorts = [ serviceCfg.ports.port0 ];
systemd = {
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
];
};
}

188
modules/nixos/guests/minecraft/world1/default.nix
View file

@ -1,188 +0,0 @@
{
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.minecraft1;
hostCfg = instances.web;
world = "world1";
in
{
microvm.vms = {
"${serviceCfg.name}-${world}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
minecraft-server = {
enable = true;
eula = true;
openFirewall = true;
declarative = true;
serverProperties = {
"rcon.password" = "/etc/${serviceCfg.name}-secrets/${world}";
allow-flight = false;
allow-nether = true;
difficulty = 2;
enable-command-block = false;
enable-rcon = true;
enable-status = true;
force-gamemode = true;
gamemode = 0;
generate-structures = true;
hardcore = false;
hide-online-players = false;
level-name = "Cuddle Cubes";
level-seed = "-2332803749585407299";
max-players = 10;
max-world-size = 64000000;
motd = "A cool Minecraft server powered by NixOS";
online-mode = true;
pvp = true;
server-ip = hostCfg.localhost.address1;
server-port = serviceCfg.ports.port0;
spawn-animals = true;
spawn-monsters = true;
spawn-npcs = true;
spawn-protection = 16;
view-distance = 32;
white-list = true;
};
whitelist = {
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
serviceCfg.ports.port0
];
systemd = {
services = {
"${serviceCfg.name}-copy-secrets" = {
description = "Copy secrets from virtiofs to local filesystem";
before = [ "minecraft-server.service" ];
requiredBy = [ "minecraft-server.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/${serviceCfg.name}-secrets
cp /run/secrets/${world} /etc/${serviceCfg.name}-secrets/${world}
chmod 755 /etc/${serviceCfg.name}-secrets
chmod 644 /etc/${serviceCfg.name}-secrets/*
'';
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 4;
mem = 1024 * 4;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = serviceCfg.varPaths.path0;
proto = "virtiofs";
source = serviceCfg.mntPaths.path0;
tag = "${serviceCfg.name}-${world}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = serviceCfg.secretPaths.path0;
tag = "host_secrets";
}
];
};
};
};
};
sops.secrets = {
"${serviceCfg.name}/${world}" = {
owner = "root";
mode = "0600";
};
};
networking.firewall.allowedTCPPorts = [ serviceCfg.ports.port0 ];
systemd = {
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
];
};
}

162
modules/nixos/guests/ollama/default.nix
View file

@ -1,162 +0,0 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.ollama;
hostCfg = instances.web;
dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0;
localhost = instances.web.localhost.address1;
dns0Path = "dns/${dns0}";
in
{
microvm.vms = {
${serviceCfg.name} = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
ollama = {
enable = true;
group = serviceCfg.name;
host = "http://${localhost}";
user = serviceCfg.name;
port = serviceCfg.ports.port1;
acceleration = "cuda";
models = serviceCfg.varPaths.path0;
};
open-webui = {
enable = true;
host = localhost;
port = serviceCfg.ports.port0;
environment = {
ENABLE_OLLAMA_API = "True";
ANONYMIZED_TELEMETRY = "False";
DO_NOT_TRACK = "True";
SCARF_NO_ANALYTICS = "True";
OLLAMA_BASE_URL = "http://${localhost}:${toString serviceCfg.ports.port1}";
WEBUI_AUTH = "True";
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
serviceCfg.ports.port0
];
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 1;
mem = 1024 * 3;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/private/${serviceCfg.name}";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/var/lib/private/open-webui";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/config";
tag = "${serviceCfg.name}_config";
}
];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
yazi
bottom
ffmpeg
;
};
};
};
};
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
};
users.users.caddy.extraGroups = [ "acme" ];
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -"
];
}

180
modules/nixos/guests/opencloud/opencloud0/default.nix
View file

@ -1,180 +0,0 @@
{
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.opencloud0;
hostCfg = instances.web;
localhost = instances.web.localhost.address1;
host = serviceCfg.domains.url0;
in
{
microvm.vms = {
opencloud = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
opencloud = {
enable = true;
url = "https://${host}";
port = serviceCfg.ports.port0;
address = localhost;
stateDir = "/var/lib/${serviceCfg.name}";
environmentFile = "/run/secrets/env";
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
587 # SMTP
serviceCfg.ports.port0
];
systemd = {
services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
opencloud = {
path = [ pkgs.inotify-tools ];
};
opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions";
after = [ "opencloud.service" ];
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "fix-perms" ''
echo "Starting permission fix..."
OPENCLOUD_UID=$(id -u opencloud)
echo "OpenCloud UID: $OPENCLOUD_UID"
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
echo "Fixing file: $file"
chown opencloud:opencloud "$file" 2>/dev/null || true
done
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
echo "Fixing dir: $dir"
chown opencloud:opencloud "$dir" 2>/dev/null || true
done
echo "Permission fix complete"
'';
User = "root";
};
};
};
timers.opencloud-fix-permissions = {
description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "30s";
OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service";
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 1024 * 1;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/etc/opencloud";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/config";
tag = "${serviceCfg.name}_config";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
inotify-tools
opencloud
;
};
};
};
};
systemd = {
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -"
];
};
sops.secrets = {
"${serviceCfg.name}/env" = {
owner = "root";
mode = "0600";
};
};
}

210
modules/nixos/guests/opencloud/opencloud1/default.nix
View file

@ -1,210 +0,0 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.opencloud1;
hostCfg = instances.web;
dns = instances.web.dns.provider1;
localhost = instances.web.localhost.address1;
host = "${serviceCfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
dnsPath = "dns/${dns}";
in
{
microvm.vms = {
projectcloud = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
opencloud = {
enable = true;
url = "https://${host}";
port = serviceCfg.ports.port0;
address = localhost;
stateDir = "/var/lib/${serviceCfg.name}";
environmentFile = "/run/secrets/projectenv";
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
587 # SMTP
serviceCfg.ports.port0
];
systemd = {
services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
opencloud = {
path = [ pkgs.inotify-tools ];
};
opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions";
after = [ "opencloud.service" ];
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "fix-perms" ''
echo "Starting permission fix..."
OPENCLOUD_UID=$(id -u opencloud)
echo "OpenCloud UID: $OPENCLOUD_UID"
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
echo "Fixing file: $file"
chown opencloud:opencloud "$file" 2>/dev/null || true
done
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
echo "Fixing dir: $dir"
chown opencloud:opencloud "$dir" 2>/dev/null || true
done
echo "Permission fix complete"
'';
User = "root";
};
};
};
timers.opencloud-fix-permissions = {
description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "30s";
OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service";
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 1024 * 1;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/etc/opencloud";
proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/config";
tag = "${serviceCfg.name}_config";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
inotify-tools
opencloud
;
};
};
};
};
security.acme.certs."${host}" = {
dnsProvider = dns;
environmentFile = config.sops.secrets.${dnsPath}.path;
group = "caddy";
};
services.caddy.virtualHosts = {
"${host}" = {
extraConfig =
let
credPath = "/var/lib/acme/${host}";
in
''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
tls ${credPath}/fullchain.pem ${credPath}/key.pem
'';
};
};
users.users.caddy.extraGroups = [ "acme" ];
systemd = {
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -"
];
};
sops.secrets = {
"${serviceCfg.name}/projectenv" = {
owner = "root";
mode = "0600";
};
};
}

83
modules/nixos/guests/projectSite/default.nix
View file

@ -1,83 +0,0 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.projectSite;
host = flake.inputs.linkpage.secrets.domains.projectsite;
websitePkg = flake.inputs.linkpage.packages.${pkgs.stdenv.hostPlatform.system}.websiteFrontend;
in
{
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
];
microvm.vms.${serviceCfg.name} = {
autostart = true;
config = {
system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [
22
80
];
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
environment.etc."website".source = websitePkg;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = {
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s3";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
gateway = [ serviceCfg.interface.gate ];
};
};
};
services.caddy = {
enable = true;
virtualHosts.":80".extraConfig = ''
root * /etc/website
file_server
try_files {path} /index.html
'';
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
];
};
};
};
services.caddy = {
enable = true;
virtualHosts.${host}.extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:80
tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem
'';
};
security.acme.certs.${host} = {
dnsProvider = instances.web.dns.provider1;
environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;
};
}

446
modules/nixos/guests/qbittorrent/default.nix
View file

@ -1,446 +0,0 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.qbittorrent;
host = instances.qbittorrent.domains.url0;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
torrentPort = 51820;
vpnEndpoint = "185.111.110.1";
localNet = "192.168.50.0/24";
in
{
microvm.vms.${serviceCfg.name} = {
autostart = true;
config = {
system.stateVersion = "25.05";
# VPN Killswitch - configured BEFORE networking starts
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
networking = {
# Disable default firewall - we're doing it manually
firewall.enable = false;
wg-quick.interfaces = {
wg0 = {
address = [ "10.2.0.2/32" ];
dns = [ "10.2.0.1" ];
privateKeyFile = "/run/secrets/wireguard-pass";
peers = [
{
publicKey = "QPfiwJQmt5VLEOh1ufLbi1lj6LUnwQY0tgDSh3pWx1k=";
endpoint = "${vpnEndpoint}:${toString torrentPort}";
allowedIPs = [
"0.0.0.0/0"
"::/0"
];
persistentKeepalive = 25;
}
];
# Now we can safely open the VPN tunnel for all traffic
postUp = ''
echo "VPN UP: Opening network for VPN and local traffic"
# Allow ALL traffic through VPN interface
${pkgs.iptables}/bin/iptables -A INPUT -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o wg0 -j ACCEPT
# Allow local network traffic (WebUI, management)
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT
# NAT for VPN
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
# Allow forwarding through VPN (for port forwarding)
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
echo "VPN UP: Network opened for VPN and local traffic"
'';
preDown = ''
echo "VPN DOWN: Removing VPN rules, killswitch remains active"
${pkgs.iptables}/bin/iptables -D INPUT -i wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D OUTPUT -o wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D INPUT -i enp0s5 -s ${localNet} -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
echo "VPN DOWN: Killswitch rules remain - no internet access"
'';
};
};
dhcpcd.enable = false;
useNetworkd = true;
};
services = {
qbittorrent = {
enable = true;
webuiPort = serviceCfg.ports.port0;
torrentingPort = torrentPort;
openFirewall = false; # We're managing firewall manually
serverConfig = {
LegalNotice.Accepted = true;
BitTorrent = {
Session = {
Interface = "wg0";
InterfaceName = "wg0";
Port = torrentPort;
MaxConnections = -1;
MaxConnectionsPerTorrent = -1;
MaxUploads = -1;
MaxUploadsPerTorrent = -1;
QueueingSystemEnabled = false;
uTPRateLimited = false;
uTPEnabled = true;
AlternativeGlobalDLSpeedLimit = 0;
AlternativeGlobalUPSpeedLimit = 0;
GlobalMaxInactiveSeedingMinutes = 10224;
GlobalMaxRatio = -1;
};
};
Preferences = {
WebUI = {
Username = "user";
Password_PBKDF2 = "@ByteArray(1bJKXLVSLU6kgCHbCS2lDg==:BmyrMaod6dbJqEe7Ud/JgKAxRMqzsAuEjHcTvLzIBgc5rc5Z7J2X9mbH0cDEAhXqc+O3gQxrckt8S2Gf+zlO9w==)";
};
General = {
Locale = "en";
};
Downloads = {
SavePath = "${serviceCfg.varPaths.path0}/downloads";
TempPathEnabled = false;
PreAllocation = false;
};
};
};
};
openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
};
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = {
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
gateway = [ serviceCfg.interface.gate ];
};
};
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -"
"d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
];
services = {
# Ensure qBittorrent ONLY starts after VPN is up
qbittorrent = {
after = [
"wg-quick-wg0.service"
"network-online.target"
];
requires = [ "wg-quick-wg0.service" ];
wants = [ "network-online.target" ];
bindsTo = [ "wg-quick-wg0.service" ]; # Stop if VPN stops
serviceConfig = {
Restart = "on-failure";
RestartSec = "10s";
};
};
natpmp-portforward = {
description = "NAT-PMP Port Forwarding for VPN";
after = [
"wg-quick-wg0.service"
"qbittorrent.service"
];
requires = [
"wg-quick-wg0.service"
"qbittorrent.service"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
Restart = "always";
RestartSec = "10s";
};
script = ''
PASSWORD=$(cat /run/secrets/qbittorrent-pass)
echo "Waiting for qBittorrent to start..."
sleep 10
while true; do
echo "Requesting port forwarding from VPN..."
UDP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 udp 60 -g 10.2.0.1 2>&1)
UDP_PORT=$(echo "$UDP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
TCP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 tcp 60 -g 10.2.0.1 2>&1)
TCP_PORT=$(echo "$TCP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
if [ -n "$UDP_PORT" ] && [ -n "$TCP_PORT" ]; then
echo "Port forwarding successful: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Clean up old dynamic rules
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p tcp -j DNAT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p udp -j DNAT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p tcp -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p udp -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o enp0s5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
# DNAT: Forward LAN traffic to qBittorrent on WireGuard interface
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p tcp --dport "$TCP_PORT" -j DNAT --to-destination 10.2.0.2:"$TCP_PORT"
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p udp --dport "$UDP_PORT" -j DNAT --to-destination 10.2.0.2:"$UDP_PORT"
# Allow forwarding for these specific ports
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p tcp --dport "$TCP_PORT" -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p udp --dport "$UDP_PORT" -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o enp0s5 -s 10.2.0.2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
echo "Firewall forwarding rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Update qBittorrent listening port via API
echo "Logging into qBittorrent API..."
COOKIE=$(${pkgs.curl}/bin/curl -s -i \
--header "Referer: http://localhost:${toString serviceCfg.ports.port0}" \
--data "username=user&password=$PASSWORD" \
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/auth/login" | \
${pkgs.gnugrep}/bin/grep -i "set-cookie" | ${pkgs.gawk}/bin/awk -F'SID=|;' '{print $2}')
if [ -n "$COOKIE" ]; then
echo "Authentication successful, updating port..."
${pkgs.curl}/bin/curl -s \
--cookie "SID=$COOKIE" \
--data "json={\"listen_port\":$UDP_PORT}" \
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/app/setPreferences"
echo "Updated qBittorrent listening port to $UDP_PORT"
else
echo "WARNING: Failed to authenticate with qBittorrent API"
fi
else
echo "ERROR: Failed to get forwarded ports"
echo "UDP output: $UDP_OUTPUT"
echo "TCP output: $TCP_OUTPUT"
fi
sleep 45
done
'';
};
killswitch-init = {
description = "Initialize VPN Killswitch Before Network";
wantedBy = [ "network-pre.target" ];
before = [
"network-pre.target"
"network.target"
];
after = [ "systemd-modules-load.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
echo "KILLSWITCH: Setting up firewall rules BEFORE network services"
# Default DROP everything
${pkgs.iptables}/bin/iptables -P INPUT DROP
${pkgs.iptables}/bin/iptables -P OUTPUT DROP
${pkgs.iptables}/bin/iptables -P FORWARD DROP
${pkgs.iptables}/bin/iptables -F
${pkgs.iptables}/bin/iptables -t nat -F
${pkgs.iptables}/bin/iptables -X
# Allow loopback
${pkgs.iptables}/bin/iptables -A INPUT -i lo -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o lo -j ACCEPT
# CRITICAL: Only allow WireGuard endpoint traffic before VPN is up
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -p udp --dport ${toString torrentPort} -d ${vpnEndpoint} -j ACCEPT
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -p udp --sport ${toString torrentPort} -s ${vpnEndpoint} -j ACCEPT
# Allow SSH from local network (for management)
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -p tcp --dport 22 -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Block IPv6 completely
${pkgs.iptables}/bin/ip6tables -P INPUT DROP 2>/dev/null || true
${pkgs.iptables}/bin/ip6tables -P OUTPUT DROP 2>/dev/null || true
${pkgs.iptables}/bin/ip6tables -P FORWARD DROP 2>/dev/null || true
echo "KILLSWITCH: Initialized - Network locked down"
'';
};
};
};
microvm = {
vcpu = 1;
mem = 1024 * 1;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
{
mountPoint = serviceCfg.varPaths.path0;
proto = "virtiofs";
source = serviceCfg.mntPaths.path0;
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/torrent";
tag = "host_secrets";
}
];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
conntrack-tools
gawk
iptables
libnatpmp
speedtest-go
wireguard-tools
;
};
};
};
# Host configuration remains the same
services = {
caddy = {
virtualHosts = {
"${host}" = {
extraConfig = ''
basic_auth {
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
}
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
sops.secrets = {
"caddy/share-auth" = {
owner = "caddy";
group = "caddy";
mode = "0400";
};
"torrent/wireguard-pass" = {
owner = "root";
mode = "0400";
};
"torrent/qbittorrent-pass" = {
owner = "root";
mode = "0400";
};
};
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
users.users.caddy.extraGroups = [ "acme" ];
systemd = {
services.caddy = {
serviceConfig = {
EnvironmentFile = config.sops.secrets."caddy/share-auth".path;
};
};
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
"d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"
"d /var/log/caddy 755 caddy caddy -"
];
};
networking.firewall = {
allowedTCPPorts = [
38834
torrentPort
];
allowedUDPPorts = [
38834
torrentPort
];
};
}

359
modules/nixos/guests/qbittorrent/rqbit.nix
View file

@ -1,359 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib;
let
cfg = config.services.rqbit;
in
{
options.services.rqbit = {
enable = mkEnableOption "rqbit BitTorrent client";
package = mkOption {
type = types.package;
default = pkgs.rqbit;
defaultText = literalExpression "pkgs.rqbit";
description = "The rqbit package to use.";
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/rqbit";
description = "Directory to store downloaded torrents.";
};
# HTTP API Configuration
httpApi = {
listenAddress = mkOption {
type = types.str;
default = "127.0.0.1";
description = "IP address to listen on for the web UI and API.";
};
listenPort = mkOption {
type = types.port;
default = 3030;
description = "Port for the web UI and API.";
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = "Open the firewall for the web UI port.";
};
};
# BitTorrent TCP Configuration
tcp = {
minPort = mkOption {
type = types.port;
default = 4240;
description = "Minimum port for incoming BitTorrent connections.";
};
maxPort = mkOption {
type = types.port;
default = 4260;
description = "Maximum port for incoming BitTorrent connections.";
};
disable = mkOption {
type = types.bool;
default = false;
description = "Disable listening for incoming TCP connections.";
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = "Open firewall ports for incoming BitTorrent connections.";
};
};
# DHT Configuration
dht = {
disable = mkOption {
type = types.bool;
default = false;
description = "Disable DHT (Distributed Hash Table) for peer discovery.";
};
disablePersistence = mkOption {
type = types.bool;
default = false;
description = "Disable DHT state persistence (useful for multiple instances).";
};
};
# UPnP Configuration
upnp = {
disablePortForward = mkOption {
type = types.bool;
default = false;
description = "Disable UPnP port forwarding.";
};
enableServer = mkOption {
type = types.bool;
default = false;
description = "Enable UPnP Media Server to stream torrents.";
};
serverFriendlyName = mkOption {
type = types.nullOr types.str;
default = null;
description = "Friendly name for the UPnP server.";
example = "rqbit Media Server";
};
};
# Rate Limiting
rateLimit = {
download = mkOption {
type = types.nullOr types.int;
default = null;
description = "Download rate limit in bytes per second.";
example = 1048576; # 1 MB/s
};
upload = mkOption {
type = types.nullOr types.int;
default = null;
description = "Upload rate limit in bytes per second.";
example = 524288; # 512 KB/s
};
};
# Logging Configuration
logging = {
level = mkOption {
type = types.nullOr (
types.enum [
"trace"
"debug"
"info"
"warn"
"error"
]
);
default = null;
description = "Console log level.";
};
file = mkOption {
type = types.nullOr types.path;
default = null;
description = "Log file path (in addition to console logging).";
example = "/var/log/rqbit/rqbit.log";
};
fileRustLog = mkOption {
type = types.str;
default = "librqbit=debug,info";
description = "RUST_LOG value for the log file.";
};
};
# Performance Configuration
performance = {
workerThreads = mkOption {
type = types.nullOr types.ints.positive;
default = null;
description = "Number of worker threads for the executor.";
};
maxBlockingThreads = mkOption {
type = types.ints.positive;
default = 8;
description = "Maximum blocking threads for disk I/O operations.";
};
singleThreadRuntime = mkOption {
type = types.bool;
default = false;
description = "Use tokio's single-threaded runtime (for debugging).";
};
concurrentInitLimit = mkOption {
type = types.ints.positive;
default = 5;
description = "Maximum number of torrents that can initialize simultaneously.";
};
};
# Peer Configuration
peer = {
connectTimeout = mkOption {
type = types.str;
default = "2s";
description = "Peer connection timeout.";
example = "1.5s";
};
readWriteTimeout = mkOption {
type = types.str;
default = "10s";
description = "Peer read/write timeout.";
example = "5s";
};
};
# Tracker Configuration
tracker = {
refreshInterval = mkOption {
type = types.nullOr types.str;
default = null;
description = "Force a specific tracker refresh interval.";
example = "30s";
};
trackersFile = mkOption {
type = types.nullOr types.path;
default = null;
description = "File with tracker URLs to use for all torrents.";
};
};
# Advanced Options
socksProxy = mkOption {
type = types.nullOr types.str;
default = null;
description = "SOCKS5 proxy URL.";
example = "socks5://user:pass@localhost:1080";
};
blocklistUrl = mkOption {
type = types.nullOr types.str;
default = null;
description = "URL to download a P2P blocklist from.";
example = "https://example.com/blocklist.txt";
};
umask = mkOption {
type = types.nullOr types.str;
default = null;
description = "Set the process umask for file creation permissions.";
example = "022";
};
# User/Group Configuration
user = mkOption {
type = types.str;
default = "rqbit";
description = "User account under which rqbit runs.";
};
group = mkOption {
type = types.str;
default = "rqbit";
description = "Group under which rqbit runs.";
};
extraArgs = mkOption {
type = types.listOf types.str;
default = [ ];
description = "Extra command-line arguments to pass to rqbit.";
example = literalExpression ''[ "--experimental-mmap-storage" ]'';
};
};
config = mkIf cfg.enable {
systemd.services.rqbit = {
description = "rqbit BitTorrent Client";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
preStart = mkIf (cfg.logging.file != null) ''
mkdir -p $(dirname ${cfg.logging.file})
chown ${cfg.user}:${cfg.group} $(dirname ${cfg.logging.file})
'';
serviceConfig = {
Type = "simple";
User = cfg.user;
Group = cfg.group;
Environment = [
"XDG_CACHE_HOME=${cfg.dataDir}/.cache"
"XDG_DATA_HOME=${cfg.dataDir}/.local/share"
];
ExecStart =
let
args = [
"${cfg.package}/bin/rqbit"
"--http-api-listen-addr ${cfg.httpApi.listenAddress}:${toString cfg.httpApi.listenPort}"
]
++ optional (cfg.logging.level != null) "-v ${cfg.logging.level}"
++ optional (cfg.logging.file != null) "--log-file ${cfg.logging.file}"
++ optional (cfg.logging.file != null) "--log-file-rust-log ${cfg.logging.fileRustLog}"
++ optional (cfg.tracker.refreshInterval != null) "-i ${cfg.tracker.refreshInterval}"
++ optional cfg.performance.singleThreadRuntime "-s"
++ optional cfg.dht.disable "--disable-dht"
++ optional cfg.dht.disablePersistence "--disable-dht-persistence"
++ optional (cfg.peer.connectTimeout != "2s") "--peer-connect-timeout ${cfg.peer.connectTimeout}"
++ optional (
cfg.peer.readWriteTimeout != "10s"
) "--peer-read-write-timeout ${cfg.peer.readWriteTimeout}"
++ optional (cfg.performance.workerThreads != null) "-t ${toString cfg.performance.workerThreads}"
++ optional cfg.tcp.disable "--disable-tcp-listen"
++ optional (cfg.tcp.minPort != 4240) "--tcp-min-port ${toString cfg.tcp.minPort}"
++ optional (cfg.tcp.maxPort != 4260) "--tcp-max-port ${toString cfg.tcp.maxPort}"
++ optional cfg.upnp.disablePortForward "--disable-upnp-port-forward"
++ optional cfg.upnp.enableServer "--enable-upnp-server"
++ optional (
cfg.upnp.serverFriendlyName != null
) "--upnp-server-friendly-name '${cfg.upnp.serverFriendlyName}'"
++ optional (
cfg.performance.maxBlockingThreads != 8
) "--max-blocking-threads ${toString cfg.performance.maxBlockingThreads}"
++ optional (cfg.socksProxy != null) "--socks-url ${cfg.socksProxy}"
++ optional (
cfg.performance.concurrentInitLimit != 5
) "--concurrent-init-limit ${toString cfg.performance.concurrentInitLimit}"
++ optional (cfg.umask != null) "--umask ${cfg.umask}"
++ optional (
cfg.rateLimit.download != null
) "--ratelimit-download ${toString cfg.rateLimit.download}"
++ optional (cfg.rateLimit.upload != null) "--ratelimit-upload ${toString cfg.rateLimit.upload}"
++ optional (cfg.blocklistUrl != null) "--blocklist-url ${cfg.blocklistUrl}"
++ optional (cfg.tracker.trackersFile != null) "--trackers-filename ${cfg.tracker.trackersFile}"
++ cfg.extraArgs
++ [
"server"
"start"
cfg.dataDir
];
in
concatStringsSep " " args;
Restart = "on-failure";
StateDirectory = "rqbit";
NoNewPrivileges = true;
PrivateTmp = true;
ProtectSystem = "strict";
ReadWritePaths = [ cfg.dataDir ] ++ optional (cfg.logging.file != null) (dirOf cfg.logging.file);
};
};
users.users = mkIf (cfg.user == "rqbit") {
rqbit = {
isSystemUser = true;
group = cfg.group;
description = "rqbit BitTorrent client user";
};
};
users.groups = mkIf (cfg.group == "rqbit") {
rqbit = { };
};
networking.firewall = mkIf (cfg.httpApi.openFirewall || cfg.tcp.openFirewall) {
allowedTCPPorts = optional cfg.httpApi.openFirewall cfg.httpApi.listenPort;
allowedTCPPortRanges = optional cfg.tcp.openFirewall {
from = cfg.tcp.minPort;
to = cfg.tcp.maxPort;
};
};
};
}

193
modules/nixos/guests/vaultwarden/default.nix
View file

@ -1,193 +0,0 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.vaultwarden;
smtpCfg = instances.smtp;
hostCfg = instances.web;
dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}";
in
{
microvm.vms = {
vaultwarden = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
# Domain Configuration
DOMAIN = "https://${host}";
# Email Configuration
SMTP_AUTH_MECHANISM = "Plain";
SMTP_EMBED_IMAGES = true;
SMTP_FROM = serviceCfg.email.address0;
SMTP_FROM_NAME = serviceCfg.label;
SMTP_HOST = smtpCfg.hostname;
SMTP_PORT = smtpCfg.ports.port1;
SMTP_SECURITY = smtpCfg.records.record1;
SMTP_USERNAME = smtpCfg.email.address0;
# Security Configuration
DISABLE_ADMIN_TOKEN = false;
# Event and Backup Management
EVENTS_DAYS_RETAIN = 90;
# User Features
SENDS_ALLOWED = true;
SIGNUPS_VERIFY = true;
WEB_VAULT_ENABLED = true;
# Rocket (Web Server) Settings
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = serviceCfg.ports.port0;
};
# Environment file with secrets (mounted from host)
environmentFile = "/run/secrets/${user0}-env";
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
25 # SMTP
139 # SMTP
587 # SMTP
2525 # SMTP
serviceCfg.ports.port0
];
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# "Z ${serviceCfg.secretPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/bitwarden_rs";
proto = "virtiofs";
source = serviceCfg.mntPaths.path0;
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
'';
};
};
users.users.caddy.extraGroups = [ "acme" ];
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
];
sops.secrets = {
"${serviceCfg.name}/${user0}-env" = {
owner = "root";
mode = "0600";
};
};
}

85
modules/nixos/guests/website/default.nix
View file

@ -1,85 +0,0 @@
{
config,
flake,
pkgs,
lib,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.upRootNutrition;
host = serviceCfg.domains.url0;
websitePkg = flake.self.packages.${pkgs.system}.website;
in
{
microvm.vms.${serviceCfg.name} = {
autostart = true;
config = {
system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [
22
80
];
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
environment.etc."website".source = websitePkg;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = {
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s3";
addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
gateway = [ serviceCfg.interface.gate ];
};
};
};
services.caddy = {
enable = true;
virtualHosts.":80".extraConfig = ''
root * /etc/website
file_server
try_files {path} /index.html
'';
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
];
};
};
};
services.caddy = {
virtualHosts.${host}.extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:80
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
'';
};
security.acme.certs.${host} = {
dnsProvider = instances.web.dns.provider0;
environmentFile = config.sops.secrets."dns/${instances.web.dns.provider0}".path;
};
}

93
modules/nixos/guests/zookeeper/default.nix
View file

@ -1,93 +0,0 @@
{
flake,
pkgs,
lib,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.zookeeper;
hostCfg = instances.web;
in
{
microvm.vms = {
zookeeper = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
networking.firewall.allowedTCPPorts = [ 22 ];
systemd = {
services = {
zookeeper = {
serviceConfig = {
ExecStart = lib.getExe flake.self.packages.${pkgs.system}.zookeeper;
Restart = "always";
RestartSec = 2;
EnvironmentFile = "/run/secrets/env";
};
wantedBy = [ "multi-user.target" ];
};
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s3";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
routes = [
{
Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate;
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
sops.secrets = {
"${serviceCfg.name}/env" = {
owner = "root";
mode = "0600";
};
};
}

0
modules/nixos/services/acme/default.nix → modules/nixos/homelab/acme/default.nix
View file

34
modules/nixos/homelab/caddy/config/firefly-iii/default.nix Executable file
View file

@ -0,0 +1,34 @@
{
flake,
config,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.firefly-iii;
interfaceCfg = serviceCfg.intefaces.interface0;
host = interfaceCfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host}" = {
extraConfig = ''
reverse_proxy http://${interfaceCfg.microvm.ip}:80 {
header_up X-Forwarded-Proto https
header_up X-Forwarded-Host {host}
}
tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
encode zstd gzip
'';
};
}

26
modules/nixos/homelab/caddy/config/forgejo/default.nix Normal file
View file

@ -0,0 +1,26 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.forgejo;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
}

37
modules/nixos/homelab/caddy/config/jellyfin/default.nix Normal file
View file

@ -0,0 +1,37 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.jellyfin;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
}

31
modules/nixos/homelab/caddy/config/mastodon/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.mastodon;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host0}" = {
extraConfig = ''
reverse_proxy http://${interface0Cfg.microvm.ip}:80 {
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
}

54
modules/nixos/homelab/caddy/config/opencloud/default.nix Executable file
View file

@ -0,0 +1,54 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.opencloud;
interface0Cfg = serviceCfg.interfaces.interface0;
interface1Cfg = serviceCfg.interfaces.interface1;
dns0 = instances.web.dns.provider0;
dns1 = instances.web.dns.provider1;
host0 = interface1Cfg.domain;
host1 = "${interface0Cfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
credPath = "/var/lib/acme/${host0}";
in
{
security.acme.certs = {
"${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets."dns/${dns0}".path;
group = "caddy";
};
"${host1}" = {
dnsProvider = dns1;
environmentFile = config.sops.secrets."dns/${dns1}".path;
group = "caddy";
};
};
services.caddy.virtualHosts = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
'';
};
"${host1}" = {
extraConfig = ''
reverse_proxy ${interface1Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
tls ${credPath}/fullchain.pem ${credPath}/key.pem
'';
};
};
}

31
modules/nixos/homelab/caddy/config/photoprism/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.photoprism;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host0}" = {
extraConfig = ''
reverse_proxy http://${interface0Cfg.microvm.ip}:80 {
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
}

39
modules/nixos/homelab/caddy/config/qbittorrent/default.nix Normal file
View file

@ -0,0 +1,39 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.qbittorrent;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host0}" = {
extraConfig = ''
basic_auth {
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
}
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
sops.secrets = {
"caddy/share-auth" = {
owner = "caddy";
group = "caddy";
mode = "0400";
};
};
}

35
modules/nixos/homelab/caddy/config/syncthing/default.nix Normal file
View file

@ -0,0 +1,35 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.syncthing;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
}

34
modules/nixos/homelab/caddy/config/vaultwarden/default.nix Executable file
View file

@ -0,0 +1,34 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.vaultwarden;
interfaceCfg = serviceCfg.interfaces.interface0;
dns0 = instances.web.dns.provider0;
host = interfaceCfg.domain;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${interfaceCfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
encode zstd gzip
'';
};
};
}

38
modules/nixos/homelab/caddy/config/website/default.nix Normal file
View file

@ -0,0 +1,38 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.website;
interface0Cfg = serviceCfg.interfaces.interface0;
interface1Cfg = serviceCfg.interfaces.interface1;
host0 = interface0Cfg.domain;
host1 = flake.inputs.linkpage.secrets.domains.projectsite;
dns0 = instances.web.dns.provider0;
dns1 = instances.web.dns.provider1;
dns0Path = "dns/${dns0}";
dns1Path = "dns/${dns1}";
in
{
services.caddy = {
virtualHosts = {
${host0}.extraConfig = ''
reverse_proxy ${interface0Cfg.microvm.ip}:80
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
'';
${host1}.extraConfig = ''
reverse_proxy ${interface1Cfg.microvm.ip}:80
tls /var/lib/acme/${host1}/fullchain.pem /var/lib/acme/${host1}/key.pem
'';
};
};
security.acme.certs = {
${host0} = {
dnsProvider = dns0;
environmentFile = config.sops.secrets."${dns0Path}".path;
};
${host1} = {
dnsProvider = dns1;
environmentFile = config.sops.secrets."${dns1Path}".path;
};
};
}

34
modules/nixos/homelab/caddy/default.nix Executable file
View file

@ -0,0 +1,34 @@
{ flake, ... }:
let
inherit (flake.config.services) instances;
service = instances.caddy;
importList =
let
content = builtins.readDir ./.;
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
in
map (name: ./. + "/${name}") dirContent;
in
{
imports = importList;
services.caddy = {
enable = true;
};
tmpfiles.rules = [
"d /run/secrets/caddy 755 caddy caddy -"
"d /var/log/caddy 755 caddy caddy -"
];
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0 # 80
service.ports.port1 # 443
];
};
};
}

0
modules/nixos/guests/default.nix → modules/nixos/homelab/default.nix
View file

10
modules/nixos/guests/minecraft/default.nix → modules/nixos/homelab/guests/default.nix
View file

@ -1,18 +1,12 @@
let
inherit (import ./helpers.nix) labHelpers;
importList =
let
content = builtins.readDir ./.;
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
in
map (name: ./. + "/${name}") dirContent;
map (name: ./. + "/${name}" { inherit labHelpers; }) dirContent;
in
{
systemd = {
tmpfiles.rules = [
"d /mnt/storage/minecraft 0751 microvm wheel - -"
];
};
imports = importList;
}

29
modules/nixos/nas/guests/firefly-iii/config/default.nix → modules/nixos/homelab/guests/firefly-iii/config/default.nix Normal file → Executable file
View file

@ -6,11 +6,8 @@
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = {
name = "firefly-iii";
};
serviceCfg = instances.firefly-iii;
smtpCfg = instances.smtp;
in
{
fireflyVM =
@ -48,18 +45,18 @@ in
};
settings = {
APP_URL = "https://${host}";
APP_KEY_FILE = "/etc/firefly-secrets/pass";
DB_PASSWORD_FILE = "/etc/firefly-secrets/data";
APP_KEY_FILE = "/etc/firefly-secrets/${user}-pass";
DB_PASSWORD_FILE = "/etc/firefly-secrets/${user}-data";
DB_CONNECTION = "pgsql";
DB_HOST = "/run/postgresql";
DB_DATABASE = "firefly-iii";
DB_USERNAME = "firefly-iii";
DB_DATABASE = serviceCfg.name;
DB_USERNAME = serviceCfg.name;
MAIL_MAILER = smtpCfg.name;
MAIL_HOST = smtpCfg.hostname;
MAIL_HOST = smtpCfg.interfaces.interface0.domain;
MAIL_PORT = smtpCfg.ports.port0;
MAIL_FROM = smtpCfg.email.address0;
MAIL_USERNAME = smtpCfg.email.address0;
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/smtp";
MAIL_FROM = smtpCfg.interfaces.interface0.email;
MAIL_USERNAME = smtpCfg.interfaces.interface0.email;
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/${user}-smtp";
MAIL_ENCRYPTION = "tls";
SITE_OWNER = owner;
};
@ -106,9 +103,9 @@ in
};
networking.firewall.allowedTCPPorts = [
22
587
8084
8081
smtpCfg.ports.port1
serviceCfg.ports.port0
serviceCfg.ports.port1
];
systemd = {
services = {
@ -194,7 +191,7 @@ in
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/config";
source = "${mnt}/${serviceCfg.name}config";
tag = "${serviceCfg.name}_${user}_config";
}
{

21
modules/nixos/nas/guests/firefly-iii/default.nix → modules/nixos/homelab/guests/firefly-iii/default.nix Normal file → Executable file
View file

@ -2,27 +2,24 @@
config,
flake,
pkgs,
nasHelpers,
labHelpers,
...
}:
let
inherit (import ./config { inherit config flake pkgs; }) fireflyVM;
inherit (nasHelpers) ipAddress guestPath firefly;
inherit (flake.config.people) user0;
inherit (flake.config.people.users.${user0}) email;
inherit (flake.config.services) instances;
id0 = builtins.toString firefly.id0;
id1 = builtins.toString firefly.id1;
id2 = builtins.toString firefly.id2;
inherit (flake.config.services.instances) firefly-iii;
interface0Cfg = firefly-iii.interfaces.interface0;
fireflyNick = fireflyVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = firefly.ssh0;
host = instances.firefly-iii.domains.url0;
mnt = guestPath user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh0;
host = interface0Cfg.domain;
mnt = "";
owner = email.address2;
};

170
modules/nixos/homelab/guests/forgejo/config/default.nix Executable file
View file

@ -0,0 +1,170 @@
{
flake,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.forgejo;
smtpCfg = instances.smtp;
in
{
forgejoVM =
{
user,
ip,
mac,
userMac,
ssh,
mnt,
host,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
${serviceCfg.name} = {
enable = true;
lfs.enable = true;
secrets = {
mailer.PASSWD = "/run/secrets/${user}-smtp";
};
settings = {
server = {
DOMAIN = host;
ROOT_URL = "https://${host}/";
HTTP_PORT = serviceCfg.ports.port0;
};
# If you need to start from scratch, don't forget to turn this off again
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
mirror = {
ENABLED = true;
};
mailer = {
ENABLED = true;
SMTP_ADDR = smtpCfg.interface.interface1.domain;
FROM = smtpCfg.interfaces.interface1.email;
USER = smtpCfg.interfaces.interface1.email;
PROTOCOL = "smtp+starttls";
SMTP_PORT = smtpCfg.ports.port1;
SEND_AS_PLAIN_TEXT = true;
USE_CLIENT_CERT = false;
};
};
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
25 # SMTP
139 # SMTP
2525 # SMTP
smtpCfg.ports.port0
serviceCfg.ports.port0
];
fileSystems."/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=4G"
"mode=1777"
];
};
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${ip}/24"; } ];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 1;
mem = 1024;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-fg-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-cloud";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
];
sops.secrets = {
"${serviceCfg.name}/${user}-smtp" = {
owner = "root";
mode = "0600";
};
};
};
}

25
modules/nixos/homelab/guests/forgejo/default.nix Normal file
View file

@ -0,0 +1,25 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) forgejoVM;
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
interface0Cfg = instances.forgejo.interfaces.interface0;
forgejoNick = forgejoVM {
user = user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
};
in
forgejoNick
# // forgejoStacie // forgejoGarnet

8
modules/nixos/homelab/guests/helpers.nix Normal file
View file

@ -0,0 +1,8 @@
{
labHelpers = {
guestPath = user: "/mnt/storage/users/${user}/guests";
docsPath = user: "/mnt/storage/users/${user}/home/docs";
mediaPath = user: "/mnt/storage/users/${user}/home/media";
miscPath = user: "/mnt/storage/users/${user}/home/misc";
};
}

169
modules/nixos/homelab/guests/jellyfin/config/default.nix Executable file
View file

@ -0,0 +1,169 @@
{
config,
flake,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.jellyfin;
id = 993;
in
{
forgejoVM =
{
user,
ip,
mac,
userMac,
ssh,
mnt,
host,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "25.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
jellyfin = {
enable = true;
openFirewall = true;
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
users.users.jellyfin = {
isSystemUser = true;
group = serviceCfg.name;
uid = id;
};
users.groups.jellyfin = {
gid = id;
};
networking.firewall.allowedTCPPorts = [
22
serviceCfg.ports.port0
serviceCfg.ports.port1
serviceCfg.ports.port2
];
fileSystems."/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=6G"
"mode=1777"
];
};
systemd = {
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [ { Address = "${ip}/24"; } ];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/cache/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}-media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = {
vcpu = 4;
mem = 1024 * 3;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-jf-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-cloud";
mac = user;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/var/cache/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/cache";
tag = "${serviceCfg.name}_${user}_cache";
}
{
mountPoint = "/var/lib/${serviceCfg.name}-media";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/media";
tag = "${serviceCfg.name}_${user}_media";
}
];
};
};
};
};
users = {
groups.jellyfin = {
gid = id;
members = [ user0 ];
};
users = {
jellyfin = {
isSystemUser = true;
group = serviceCfg.name;
uid = id;
};
caddy.extraGroups = [ "acme" ];
};
};
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/data 0755 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/cache 0755 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/media 0775 microvm wheel - -"
];
};
}

25
modules/nixos/homelab/guests/jellyfin/default.nix Normal file
View file

@ -0,0 +1,25 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) jellyfinVM;
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
interface0Cfg = instances.jellyfin.interfaces.interface0;
jellyfinNick = jellyfinVM {
user = user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
};
in
jellyfinNick
# // forgejoStacie // forgejoGarnet

0
modules/nixos/guests/mastodon/config/chars.patch → modules/nixos/homelab/guests/mastodon/config/config/chars.patch
View file

0
modules/nixos/guests/mastodon/config/twitter.txt → modules/nixos/homelab/guests/mastodon/config/config/twitter.txt
View file

499
modules/nixos/homelab/guests/mastodon/config/default.nix Executable file
View file

@ -0,0 +1,499 @@
{
flake,
config,
pkgs,
lib,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.mastodon;
smtpCfg = instances.smtp;
in
{
mastodonVM =
{
user,
ip,
mac,
userMac,
ssh,
mnt,
host,
}:
{
# If you need to start fresh for some reason, run these to create the new Admin account:
# sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
# sudo -u mastodon mastodon-tootctl accounts approve nick
# If you fuck up and lose the password, use this:
# sudo mastodon-tootctl accounts modify --reset-password nick
# If you really fuck up and name yourself wrong, use this shit
# sudo mastodon-tootctl accounts modify username --remove-role
nixpkgs.overlays = [
(final: prev: {
mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
patches = (oldAttrs.patches or [ ]) ++ [
./config/chars.patch
];
});
})
];
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
${serviceCfg.name} = {
enable = true;
localDomain = host;
secretKeyBaseFile = "/etc/mastodon-secrets/${user}-pass";
streamingProcesses = 7;
trustedProxy = "127.0.0.1";
automaticMigrations = true;
database = {
createLocally = true;
name = serviceCfg.name;
host = "/run/postgresql";
user = serviceCfg.name;
passwordFile = "/etc/mastodon-secrets/${user}-database";
};
extraConfig = {
SINGLE_USER_MODE = "false";
SMTP_AUTH_METHOD = "plain";
SMTP_DELIVERY_METHOD = "smtp";
SMTP_ENABLE_STARTTLS_AUTO = "true";
SMTP_SSL = "false";
};
# if you're starting from scratch, you gotta cd into /var/lib/mastodon and run:
# sudo -u mastodon mastodon-tootctl search deploy
elasticsearch = {
preset = "single_node_cluster";
host = "127.0.0.1";
port = 9200;
};
mediaAutoRemove = {
enable = true;
olderThanDays = 14;
};
redis = {
createLocally = true;
enableUnixSocket = true;
};
sidekiqThreads = 25;
sidekiqProcesses = {
all = {
jobClasses = [ ];
threads = null;
};
default = {
jobClasses = [ "default" ];
threads = 5;
};
ingress = {
jobClasses = [ "ingress" ];
threads = 5;
};
push-pull = {
jobClasses = [
"push"
"pull"
];
threads = 5;
};
mailers = {
jobClasses = [ "mailers" ];
threads = 5;
};
};
smtp = {
authenticate = true;
createLocally = false;
fromAddress = "upRootNutrition <${smtpCfg.interfaces.interface1.email}>";
host = smtpCfg.interfaces.interface1.domain;
passwordFile = "/etc/mastodon-secrets/${user}-smtp";
port = smtpCfg.ports.port1;
user = smtpCfg.interfaces.interface1.email;
};
};
opensearch.enable = true;
caddy = {
enable = true;
virtualHosts = {
":80" = {
extraConfig = ''
handle_path /system/* {
file_server * {
root /var/lib/mastodon/public-system
}
}
handle /api/v1/streaming/* {
reverse_proxy unix//run/mastodon-streaming/streaming.socket {
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
}
}
route * {
file_server * {
root ${pkgs.mastodon}/public
pass_thru
}
reverse_proxy * unix//run/mastodon-web/web.socket {
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
}
}
handle_errors {
root * ${pkgs.mastodon}/public
rewrite 500.html
file_server
}
encode gzip
header /* {
Strict-Transport-Security "max-age=31536000;"
}
header /emoji/* Cache-Control "public, max-age=31536000, immutable"
header /packs/* Cache-Control "public, max-age=31536000, immutable"
header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
'';
};
};
};
postgresql = {
enable = true;
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
users.users = {
${serviceCfg.name}.extraGroups = [ "postgres" ];
caddy.extraGroups = [ serviceCfg.name ];
fedifetcher = {
isSystemUser = true;
group = "fedifetcher";
home = "/var/lib/fedifetcher";
createHome = true;
};
};
users.groups.fedifetcher = { };
networking.firewall.allowedTCPPorts = [
22 # SSH
80 # Caddy
25 # SMTP
139 # SMTP
587 # SMTP
2525 # SMTP
5432 # Postgres
];
systemd = {
services = {
mastodon-init-dirs.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-web.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-1.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-2.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-3.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-4.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-5.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-6.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-streaming-7.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-all.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-default.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-ingress.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-mailers.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-sidekiq-push-pull.serviceConfig.PrivateMounts = lib.mkForce false;
mastodon-elastic-search = {
description = "Recache elastic search";
after = [
"network-online.target"
"mastodon-web.service"
];
wants = [ "network-online.target" ];
serviceConfig = {
WorkingDirectory = "/var/lib/${serviceCfg.name}";
Type = "oneshot";
};
script = ''
/run/current-system/sw/bin/mastodon-tootctl search deploy --only=instances accounts tags statuses public_statuses
'';
};
mastodon-copy-secrets = {
description = "Copy secrets from virtiofs to local filesystem";
before = [ "mastodon-init-dirs.service" ];
requiredBy = [ "mastodon-init-dirs.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/mastodon-secrets
cp /run/secrets/${user}-pass /etc/mastodon-secrets/${user}-pass
cp /run/secrets/${user}-database /etc/mastodon-secrets/${user}-database
cp /run/secrets/${user}-redis /etc/mastodon-secrets/${user}-redis
cp /run/secrets/${user}-smtp /etc/mastodon-secrets/${user}-smtp
cp /run/secrets/${user}-fedifetcher-token /etc/mastodon-secrets/${user}-fedifetcher
chmod 755 /etc/mastodon-secrets
chmod 644 /etc/mastodon-secrets/*
'';
};
fedifetcher = {
description = "FediFetcher - Fetch missing posts for Mastodon";
after = [
"network-online.target"
"mastodon-web.service"
];
wants = [ "network-online.target" ];
serviceConfig =
let
fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" (
builtins.toJSON {
server = "https://${host}";
home-timeline-length = 200;
max-followings = 80;
from-notifications = 1;
max-bookmarks = 80;
max-favourites = 40;
backfill-with-context = 1;
backfill-mentioned-users = 1;
remember-users-for-hours = 168;
remember-hosts-for-days = 30;
http-timeout = 5;
lock-hours = 24;
log-level = "INFO";
}
);
in
{
Type = "oneshot";
User = "fedifetcher";
Group = "fedifetcher";
WorkingDirectory = "/var/lib/fedifetcher";
TimeoutStartSec = "300";
PrivateTmp = true;
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
ReadWritePaths = "/var/lib/fedifetcher";
ExecStart =
let
script = pkgs.writeShellScript "fedifetcher-run" ''
set -e
# Wait for Mastodon to be fully ready
for i in {1..30}; do
if ${pkgs.curl}/bin/curl -sf http://localhost:80/health >/dev/null 2>&1; then
echo "Mastodon is ready"
break
fi
echo "Waiting for Mastodon to be ready... ($i/30)"
sleep 2
done
export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/${user}-fedifetcher)
${pkgs.fedifetcher}/bin/fedifetcher \
-c=${fedifetcherConfig} \
--access-token="$ACCESS_TOKEN"
'';
in
"${script}";
};
};
mastodon-init-db.serviceConfig.EnvironmentFile = "/var/lib/mastodon/.secrets_env";
systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ];
opensearch-install-plugins = {
description = "Install OpenSearch plugins";
before = [ "opensearch.service" ];
requiredBy = [ "opensearch.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
PLUGIN_DIR="/var/lib/opensearch/plugins/analysis-icu"
if [ ! -d "$PLUGIN_DIR" ]; then
# Create the plugins directory if it doesn't exist
mkdir -p /var/lib/opensearch/plugins
# Install using the proper OpenSearch plugin command
export OPENSEARCH_JAVA_HOME="${pkgs.jdk17}/lib/openjdk"
${pkgs.opensearch}/bin/opensearch-plugin install --batch analysis-icu || {
echo "Plugin installation failed, but continuing anyway"
exit 0
}
fi
'';
};
};
timers = {
mastodon-elastic-search = {
description = "Timer for Mastodon elastic search recaching";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "10min";
OnUnitActiveSec = "60min";
Unit = "mastodon-elastic-search.service";
};
};
fedifetcher = {
description = "Timer for FediFetcher";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "10min";
OnUnitActiveSec = "15min";
Unit = "fedifetcher.service";
Persistent = true;
AccuracySec = "1min";
};
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [ { Address = "${ip}/24"; } ];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/mastodon 0755 mastodon mastodon -"
"Z /var/lib/mastodon 0755 mastodon mastodon -"
"Z /var/lib/postgresql 0755 postgres postgres -"
"d /var/cache/mastodon/precompile 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/accounts 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -"
"d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -"
"d /var/lib/fedifetcher 0755 fedifetcher fedifetcher -"
];
};
microvm = {
vcpu = 2;
mem = 1024 * 6;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-md-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-cloud";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/var/lib/postgresql";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/database";
tag = "${serviceCfg.name}_${user}_database";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
sops = {
secrets = builtins.listToAttrs (
map
(secret: {
name = "${serviceCfg.name}/${user}-${secret}";
value = {
owner = "root";
group = "root";
mode = "0644";
};
})
[
"smtp"
"database"
"redis"
"pass"
"fedifetcher"
]
);
};
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/database 0751 microvm wheel - -"
];
};
}

25
modules/nixos/homelab/guests/mastodon/default.nix Normal file
View file

@ -0,0 +1,25 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) mastodonVM;
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
interface0Cfg = instances.mastodon.interfaces.interface0;
mastodonNick = mastodonVM {
user = user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
};
in
mastodonNick
# // mastodonStacie // mastodonGarnet

2
modules/nixos/nas/guests/minecraft/config/default.nix → modules/nixos/homelab/guests/minecraft/config/default.nix Normal file → Executable file
View file

@ -38,7 +38,7 @@ in
openFirewall = true;
declarative = true;
serverProperties = {
"rcon.password" = "/etc/${serviceCfg.name}-secrets/world${worldNumber}";
"rcon.password" = "/etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}";
server-port = port;
}
// config;

105
modules/nixos/homelab/guests/minecraft/default.nix Executable file
View file

@ -0,0 +1,105 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) minecraftVM;
inherit (flake.config.services) instances;
inherit (flake.config.people) user0;
minecraftNick01 =
let
interfaceCfg = instances.minecraft.interfaces.interface0;
in
minecraftVM {
user = user0;
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
userMac = interfaceCfg.microvm.macUser;
ssh = interfaceCfg.microvm.ssh;
port = interfaceCfg.microvm.port;
mnt = "";
worldNumber = "01";
config = {
allow-flight = false;
allow-nether = true;
difficulty = 2;
enable-command-block = false;
enable-rcon = true;
enable-status = true;
force-gamemode = true;
gamemode = 0;
generate-structures = true;
hardcore = false;
hide-online-players = false;
level-name = "Brix on Nix";
level-seed = "9064150133272194";
max-players = 10;
max-world-size = 64000000;
motd = "A cool Minecraft server powered by NixOS";
online-mode = true;
pvp = true;
spawn-animals = true;
spawn-monsters = true;
spawn-npcs = true;
spawn-protection = 16;
view-distance = 32;
white-list = true;
};
whitelist = {
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
};
};
minecraftNick02 =
let
interfaceCfg = instances.minecraft.interfaces.interface1;
in
minecraftVM {
user = user0;
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
userMac = interfaceCfg.microvm.macUser;
ssh = interfaceCfg.microvm.ssh;
port = interfaceCfg.microvm.port;
mnt = "";
worldNumber = "02";
config = {
allow-flight = false;
allow-nether = true;
difficulty = 2;
enable-command-block = false;
enable-rcon = true;
enable-status = true;
force-gamemode = true;
gamemode = 0;
generate-structures = true;
hardcore = false;
hide-online-players = false;
level-name = "Cuddle Cubes";
level-seed = "-2332803749585407299";
max-players = 10;
max-world-size = 64000000;
motd = "A cool Minecraft server powered by NixOS";
online-mode = true;
pvp = true;
spawn-animals = true;
spawn-monsters = true;
spawn-npcs = true;
spawn-protection = 16;
view-distance = 32;
white-list = true;
};
whitelist = {
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
};
};
in
minecraftNick01 // minecraftNick02

0
modules/nixos/nas/guests/onlyoffice/config/default.nix → modules/nixos/homelab/guests/onlyoffice/config/default.nix Normal file → Executable file
View file

0
modules/nixos/nas/guests/onlyoffice/default.nix → modules/nixos/homelab/guests/onlyoffice/default.nix Normal file → Executable file
View file

5
modules/nixos/nas/guests/opencloud/config/default.nix → modules/nixos/homelab/guests/opencloud/config/default.nix Normal file → Executable file
View file

@ -5,9 +5,8 @@
}:
let
inherit (flake.config.people) user0;
serviceCfg = {
name = "opencloud";
};
inherit (flake.config.services.instances) opencloud;
serviceCfg = opencloud;
in
{
opencloudVM =

22
modules/nixos/nas/guests/opencloud/default.nix → modules/nixos/homelab/guests/opencloud/default.nix Normal file → Executable file
View file

@ -1,26 +1,24 @@
{
flake,
pkgs,
nasHelpers,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) opencloudVM;
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
inherit (nasHelpers) ipAddress guestPath opencloud;
id0 = builtins.toString opencloud.id0;
id1 = builtins.toString opencloud.id1;
id2 = builtins.toString opencloud.id2;
inherit (flake.config.services.instances) opencloud;
interface0Cfg = opencloud.interfaces.interface0;
opencloudNick = opencloudVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = opencloud.ssh0;
mnt = guestPath user0;
host = instances.opencloud0.domains.url0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
};
# opencloudStacie = opencloudVM {

5
modules/nixos/nas/guests/photoprism/config/default.nix → modules/nixos/homelab/guests/photoprism/config/default.nix Normal file → Executable file
View file

@ -5,9 +5,8 @@
}:
let
inherit (flake.config.people) user0;
serviceCfg = {
name = "photoprism";
};
inherit (flake.config.services.instances) photoprism;
serviceCfg = photoprism;
in
{
photoprismVM =

26
modules/nixos/nas/guests/photoprism/default.nix → modules/nixos/homelab/guests/photoprism/default.nix Normal file → Executable file
View file

@ -1,30 +1,24 @@
{
flake,
lib,
nasHelpers,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake lib; }) photoprismVM;
inherit (nasHelpers)
ipAddress
guestPath
mediaPath
photoprism
;
inherit (flake.config.services.instances) photoprism;
inherit (flake.config.people) user0;
id0 = builtins.toString photoprism.id0;
id1 = builtins.toString photoprism.id1;
id2 = builtins.toString photoprism.id2;
interface0Cfg = photoprism.interfaces.interface0;
photoprismNick = photoprismVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = photoprism.ssh0;
mnt = guestPath user0;
data = mediaPath user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
data = "";
host = interface0Cfg.domain;
};
# photoprismStacie = photoprismVM {

430
modules/nixos/homelab/guests/qbittorrent/config/default.nix Executable file
View file

@ -0,0 +1,430 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.qbittorrent;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
qbittorrentVM =
{
user,
ip,
mac,
userMac,
ssh,
mnt,
host,
port,
endpoint,
address,
dns,
key,
}:
{
microvm.vms =
let
torrentPort = port;
vpnEndpoint = endpoint;
localNet = "192.168.50.0/24";
in
{
"${serviceCfg.name}-${user}" = {
autostart = true;
config = {
system.stateVersion = "25.05";
# VPN Killswitch - configured BEFORE networking starts
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
networking = {
# Disable default firewall - we're doing it manually
firewall.enable = false;
wg-quick.interfaces = {
wg0 = {
address = address;
dns = dns;
privateKeyFile = "/run/secrets/${user}-wireguard-pass";
peers = [
{
publicKey = key;
endpoint = "${vpnEndpoint}:${toString torrentPort}";
allowedIPs = [
"0.0.0.0/0"
"::/0"
];
persistentKeepalive = 25;
}
];
# Now we can safely open the VPN tunnel for all traffic
postUp = ''
echo "VPN UP: Opening network for VPN and local traffic"
# Allow ALL traffic through VPN interface
${pkgs.iptables}/bin/iptables -A INPUT -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o wg0 -j ACCEPT
# Allow local network traffic (WebUI, management)
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT
# NAT for VPN
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
# Allow forwarding through VPN (for port forwarding)
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
echo "VPN UP: Network opened for VPN and local traffic"
'';
preDown = ''
echo "VPN DOWN: Removing VPN rules, killswitch remains active"
${pkgs.iptables}/bin/iptables -D INPUT -i wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D OUTPUT -o wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D INPUT -i enp0s5 -s ${localNet} -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
echo "VPN DOWN: Killswitch rules remain - no internet access"
'';
};
};
dhcpcd.enable = false;
useNetworkd = true;
};
services = {
qbittorrent = {
enable = true;
webuiPort = serviceCfg.ports.port0;
torrentingPort = torrentPort;
openFirewall = false; # We're managing firewall manually
serverConfig = {
LegalNotice.Accepted = true;
BitTorrent = {
Session = {
Interface = "wg0";
InterfaceName = "wg0";
Port = torrentPort;
MaxConnections = -1;
MaxConnectionsPerTorrent = -1;
MaxUploads = -1;
MaxUploadsPerTorrent = -1;
QueueingSystemEnabled = false;
uTPRateLimited = false;
uTPEnabled = true;
AlternativeGlobalDLSpeedLimit = 0;
AlternativeGlobalUPSpeedLimit = 0;
GlobalMaxInactiveSeedingMinutes = 10224;
GlobalMaxRatio = -1;
};
};
Preferences = {
WebUI = {
Username = "user";
Password_PBKDF2 = "@ByteArray(1bJKXLVSLU6kgCHbCS2lDg==:BmyrMaod6dbJqEe7Ud/JgKAxRMqzsAuEjHcTvLzIBgc5rc5Z7J2X9mbH0cDEAhXqc+O3gQxrckt8S2Gf+zlO9w==)";
};
General = {
Locale = "en";
};
Downloads = {
SavePath = "${mnt}/${serviceCfg.name}/downloads";
TempPathEnabled = false;
PreAllocation = false;
};
};
};
};
openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
};
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = {
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${ip}/24"; } ];
gateway = [ "192.168.50.1" ];
};
};
tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 755 ${serviceCfg.name} ${serviceCfg.name} -"
"d ${mnt}/${serviceCfg.name}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
];
services = {
# Ensure qBittorrent ONLY starts after VPN is up
qbittorrent = {
after = [
"wg-quick-wg0.service"
"network-online.target"
];
requires = [ "wg-quick-wg0.service" ];
wants = [ "network-online.target" ];
bindsTo = [ "wg-quick-wg0.service" ]; # Stop if VPN stops
serviceConfig = {
Restart = "on-failure";
RestartSec = "10s";
};
};
natpmp-portforward = {
description = "NAT-PMP Port Forwarding for VPN";
after = [
"wg-quick-wg0.service"
"qbittorrent.service"
];
requires = [
"wg-quick-wg0.service"
"qbittorrent.service"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
Restart = "always";
RestartSec = "10s";
};
script = ''
PASSWORD=$(cat /run/secrets/${user}-qbittorrent-pass)
echo "Waiting for qBittorrent to start..."
sleep 10
while true; do
echo "Requesting port forwarding from VPN..."
UDP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 udp 60 -g 10.2.0.1 2>&1)
UDP_PORT=$(echo "$UDP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
TCP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 tcp 60 -g 10.2.0.1 2>&1)
TCP_PORT=$(echo "$TCP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
if [ -n "$UDP_PORT" ] && [ -n "$TCP_PORT" ]; then
echo "Port forwarding successful: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Clean up old dynamic rules
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p tcp -j DNAT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p udp -j DNAT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p tcp -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p udp -j ACCEPT 2>/dev/null || true
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o enp0s5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
# DNAT: Forward LAN traffic to qBittorrent on WireGuard interface
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p tcp --dport "$TCP_PORT" -j DNAT --to-destination 10.2.0.2:"$TCP_PORT"
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p udp --dport "$UDP_PORT" -j DNAT --to-destination 10.2.0.2:"$UDP_PORT"
# Allow forwarding for these specific ports
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p tcp --dport "$TCP_PORT" -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p udp --dport "$UDP_PORT" -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o enp0s5 -s 10.2.0.2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
echo "Firewall forwarding rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Update qBittorrent listening port via API
echo "Logging into qBittorrent API..."
COOKIE=$(${pkgs.curl}/bin/curl -s -i \
--header "Referer: http://localhost:${toString serviceCfg.ports.port0}" \
--data "username=user&password=$PASSWORD" \
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/auth/login" | \
${pkgs.gnugrep}/bin/grep -i "set-cookie" | ${pkgs.gawk}/bin/awk -F'SID=|;' '{print $2}')
if [ -n "$COOKIE" ]; then
echo "Authentication successful, updating port..."
${pkgs.curl}/bin/curl -s \
--cookie "SID=$COOKIE" \
--data "json={\"listen_port\":$UDP_PORT}" \
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/app/setPreferences"
echo "Updated qBittorrent listening port to $UDP_PORT"
else
echo "WARNING: Failed to authenticate with qBittorrent API"
fi
else
echo "ERROR: Failed to get forwarded ports"
echo "UDP output: $UDP_OUTPUT"
echo "TCP output: $TCP_OUTPUT"
fi
sleep 45
done
'';
};
killswitch-init = {
description = "Initialize VPN Killswitch Before Network";
wantedBy = [ "network-pre.target" ];
before = [
"network-pre.target"
"network.target"
];
after = [ "systemd-modules-load.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
echo "KILLSWITCH: Setting up firewall rules BEFORE network services"
# Default DROP everything
${pkgs.iptables}/bin/iptables -P INPUT DROP
${pkgs.iptables}/bin/iptables -P OUTPUT DROP
${pkgs.iptables}/bin/iptables -P FORWARD DROP
${pkgs.iptables}/bin/iptables -F
${pkgs.iptables}/bin/iptables -t nat -F
${pkgs.iptables}/bin/iptables -X
# Allow loopback
${pkgs.iptables}/bin/iptables -A INPUT -i lo -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o lo -j ACCEPT
# CRITICAL: Only allow WireGuard endpoint traffic before VPN is up
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -p udp --dport ${toString torrentPort} -d ${vpnEndpoint} -j ACCEPT
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -p udp --sport ${toString torrentPort} -s ${vpnEndpoint} -j ACCEPT
# Allow SSH from local network (for management)
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -p tcp --dport 22 -j ACCEPT
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Block IPv6 completely
${pkgs.iptables}/bin/ip6tables -P INPUT DROP 2>/dev/null || true
${pkgs.iptables}/bin/ip6tables -P OUTPUT DROP 2>/dev/null || true
${pkgs.iptables}/bin/ip6tables -P FORWARD DROP 2>/dev/null || true
echo "KILLSWITCH: Initialized - Network locked down"
'';
};
};
};
microvm = {
vcpu = 1;
mem = 1024 * 1;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-qb-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-share";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}";
tag = "${serviceCfg.name}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/torrent";
tag = "host_secrets";
}
];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
conntrack-tools
gawk
iptables
libnatpmp
speedtest-go
wireguard-tools
;
};
};
};
sops.secrets = {
"torrent/${user}-wireguard-pass" = {
owner = "root";
mode = "0400";
};
"torrent/${user}-qbittorrent-pass" = {
owner = "root";
mode = "0400";
};
};
systemd = {
services.caddy = {
serviceConfig = {
EnvironmentFile = config.sops.secrets."caddy/share-auth".path;
};
};
tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
];
};
networking.firewall = {
allowedTCPPorts = [
38834
torrentPort
];
allowedUDPPorts = [
38834
torrentPort
];
};
};
};
}

30
modules/nixos/homelab/guests/qbittorrent/default.nix Normal file
View file

@ -0,0 +1,30 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) qbittorrentVM;
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
interface0Cfg = instances.qbittorrent.interfaces.interface0;
qbittorrentNick = qbittorrentVM {
user = user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
port = 51820;
endpoint = "185.111.110.1";
address = [ "10.2.0.2/32" ];
dns = [ "10.2.0.1" ];
key = "QPfiwJQmt5VLEOh1ufLbi1lj6LUnwQY0tgDSh3pWx1k=";
};
in
qbittorrentNick
# // qbittorrentStacie // qbittorrentGarnet

4
modules/nixos/nas/guests/syncthing/config/default.nix → modules/nixos/homelab/guests/syncthing/config/default.nix Normal file → Executable file
View file

@ -4,8 +4,8 @@
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.syncthing;
inherit (flake.config.services.instances) syncthing;
serviceCfg = syncthing;
in
{
syncthingVM =

35
modules/nixos/nas/guests/syncthing/default.nix → modules/nixos/homelab/guests/syncthing/default.nix
View file

@ -1,20 +1,14 @@
{ flake, nasHelpers, ... }:
{
flake,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake; }) syncthingVM;
inherit (flake.config.services) instances;
inherit (flake.config.people) user0;
inherit (nasHelpers)
ipAddress
guestPath
docsPath
mediaPath
miscPath
syncthing
;
serviceCfg = instances.syncthing;
id0 = builtins.toString syncthing.id0;
id1 = builtins.toString syncthing.id1;
id2 = builtins.toString syncthing.id2;
interface0Cfg = serviceCfg.interfaces.interface0;
foldersHelper = user: {
docs = {
@ -58,19 +52,19 @@ let
{
mountPoint = "/var/lib/${serviceCfg.name}/docs";
proto = "virtiofs";
source = docsPath user;
source = "";
tag = "${serviceCfg.name}_${user}_docs";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/media";
proto = "virtiofs";
source = mediaPath user;
source = "";
tag = "${serviceCfg.name}_${user}_media";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/misc";
proto = "virtiofs";
source = miscPath user;
source = "";
tag = "${serviceCfg.name}_${user}_misc";
}
];
@ -87,11 +81,12 @@ let
in
syncthingVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = syncthing.ssh0;
mnt = guestPath user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
folders = foldersHelper user0;
devices = devicesHelper user0 phoneID "Phone" "192.168.50.8";
tmp = tmpRules;

7
modules/nixos/nas/guests/vaultwarden/config/default.nix → modules/nixos/homelab/guests/vaultwarden/config/default.nix Normal file → Executable file
View file

@ -7,7 +7,6 @@ let
inherit (flake.config.services) instances;
serviceCfg = instances.vaultwarden;
smtpCfg = instances.smtp;
in
{
vaultwardenVM =
@ -40,11 +39,11 @@ in
# Email Configuration
SMTP_AUTH_MECHANISM = "Plain";
SMTP_EMBED_IMAGES = true;
SMTP_FROM = serviceCfg.email.address0;
SMTP_FROM = smtpCfg.interfaces.interface0.email;
SMTP_FROM_NAME = serviceCfg.label;
SMTP_HOST = smtpCfg.hostname;
SMTP_HOST = smtpCfg.interfaces.interface0.domain;
SMTP_PORT = smtpCfg.ports.port0;
SMTP_USERNAME = smtpCfg.email.address0;
SMTP_USERNAME = smtpCfg.interfaces.interface0.email;
SMTP_SECURITY = "starttls";
# Security Configuration

25
modules/nixos/nas/guests/vaultwarden/default.nix → modules/nixos/homelab/guests/vaultwarden/default.nix Normal file → Executable file
View file

@ -1,20 +1,23 @@
{ flake, nasHelpers, ... }:
{
flake,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake; }) vaultwardenVM;
inherit (flake.config.people) user0;
inherit (nasHelpers) ipAddress guestPath vaultwarden;
id0 = builtins.toString vaultwarden.id0;
id1 = builtins.toString vaultwarden.id1;
id2 = builtins.toString vaultwarden.id2;
inherit (flake.config.services.instances) vaultwarden;
interface0Cfg = vaultwarden.interfaces.interface0;
vaultwardenNick = vaultwardenVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = vaultwarden.ssh0;
mnt = guestPath user0;
host = "";
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = "";
host = interface0Cfg.domain;
};
# vaultwardenStacie = vaultwardenVM {

82
modules/nixos/homelab/guests/website/config/default.nix Executable file
View file

@ -0,0 +1,82 @@
{
config,
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.website;
in
{
websiteVM =
{
user,
ip,
mac,
userMac,
package,
}:
{
microvm.vms.${serviceCfg.name} = {
autostart = true;
config = {
system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [
22
80
];
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
environment.etc."website".source = package;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = {
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s3";
addresses = [
{ Address = "${ip}/24"; }
];
gateway = [ "192.168.50.1" ];
};
};
};
services.caddy = {
enable = true;
virtualHosts.":80".extraConfig = ''
root * /etc/website
file_server
try_files {path} /index.html
'';
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-ws-${user}";
mac = mac;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
];
};
};
};
};
}

38
modules/nixos/homelab/guests/website/default.nix Normal file
View file

@ -0,0 +1,38 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) websiteVM;
inherit (flake.config.services) instances;
websiteNick =
let
websitePkg = flake.self.packages.${pkgs.system}.website;
interfaceCfg = instances.website.interfaces.interface0;
in
websiteVM {
user = "uproot";
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
userMac = interfaceCfg.microvm.macUser;
package = websitePkg;
};
websiteProject =
let
websitePkg = flake.inputs.linkpage.packages.${pkgs.stdenv.hostPlatform.system}.websiteFrontend;
interfaceCfg = instances.website.interfaces.interface1;
in
websiteVM {
user = "project";
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
userMac = interfaceCfg.microvm.macUser;
package = websitePkg;
};
in
websiteNick // websiteProject

103
modules/nixos/homelab/guests/zookeeper/config/default.nix Executable file
View file

@ -0,0 +1,103 @@
{
flake,
pkgs,
lib,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.zookeeper;
in
{
websiteVM =
{
user,
ip,
mac,
userMac,
package,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
networking.firewall.allowedTCPPorts = [ 22 ];
systemd = {
services = {
zookeeper = {
serviceConfig = {
ExecStart = lib.getExe package;
Restart = "always";
RestartSec = 2;
EnvironmentFile = "/run/secrets/${user}-env";
};
wantedBy = [ "multi-user.target" ];
};
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s3";
addresses = [ { Address = "${ip}/24"; } ];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-qb-${user}";
mac = mac;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
sops.secrets = {
"${serviceCfg.name}/${user}-env" = {
owner = "root";
mode = "0600";
};
};
};
}

25
modules/nixos/homelab/guests/zookeeper/default.nix Normal file
View file

@ -0,0 +1,25 @@
{
flake,
pkgs,
labHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) zookeeperVM;
inherit (flake.config.services) instances;
interfaceCfg = instances.zookeeper.interfaces.interface0;
zookeeperNick =
let
appPackage = flake.self.packages.${pkgs.system}.zookeeper;
in
zookeeperVM {
user = "boon";
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
userMac = interfaceCfg.microvm.macUser;
package = appPackage;
};
in
zookeeperNick

0
modules/nixos/guests/comfyui/default.nix → modules/nixos/homelab/orphans/comfyui/default.nix
View file

0
modules/nixos/guests/opencloud/default.nix → modules/nixos/homelab/orphans/default.nix
View file

0
modules/nixos/guests/defenseio/default.nix → modules/nixos/homelab/orphans/defenseio/default.nix
View file

0
modules/nixos/guests/defenseioGpu/config/default.nix → modules/nixos/homelab/orphans/defenseioGpu/config/default.nix
View file

0
modules/nixos/guests/defenseioGpu/default.nix → modules/nixos/homelab/orphans/defenseioGpu/default.nix
View file

0
modules/nixos/services/glance/assets/logo.png → modules/nixos/homelab/orphans/glance/assets/logo.png
View file

Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 46 KiB

After

Width:  |  Height:  |  Size: 46 KiB

Before After
Before After

0
modules/nixos/services/glance/config/branding.nix → modules/nixos/homelab/orphans/glance/config/branding.nix
View file

0
modules/nixos/services/glance/config/pages.nix → modules/nixos/homelab/orphans/glance/config/pages.nix
View file

0
modules/nixos/services/glance/config/server.nix → modules/nixos/homelab/orphans/glance/config/server.nix
View file

0
modules/nixos/services/glance/config/theme.nix → modules/nixos/homelab/orphans/glance/config/theme.nix
View file

0
modules/nixos/services/glance/config/widgets/calendar.nix → modules/nixos/homelab/orphans/glance/config/widgets/calendar.nix
View file

0
modules/nixos/services/glance/config/widgets/clock.nix → modules/nixos/homelab/orphans/glance/config/widgets/clock.nix
View file

0
modules/nixos/services/glance/config/widgets/jelly/config/default.nix → modules/nixos/homelab/orphans/glance/config/widgets/jelly/config/default.nix
View file

0
modules/nixos/services/glance/config/widgets/jelly/default.nix → modules/nixos/homelab/orphans/glance/config/widgets/jelly/default.nix
View file

0
modules/nixos/services/glance/config/widgets/monitor.nix → modules/nixos/homelab/orphans/glance/config/widgets/monitor.nix
View file

Some files were not shown because too many files have changed in this diff Show more