upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-14 02:20:53 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up nas structure

Browse source
This commit is contained in:
Nick 2025-12-08 22:25:13 -06:00
parent 8cd193ec49
commit 4225970826
747 changed files with 2938 additions and 4347 deletions
Download patch file Download diff file Expand all files Collapse all files

34
modules/nixos/homelab/caddy/config/firefly-iii/default.nix Executable file
View file

@ -0,0 +1,34 @@
{
flake,
config,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.firefly-iii;
interfaceCfg = serviceCfg.intefaces.interface0;
host = interfaceCfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host}" = {
extraConfig = ''
reverse_proxy http://${interfaceCfg.microvm.ip}:80 {
header_up X-Forwarded-Proto https
header_up X-Forwarded-Host {host}
}
tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
encode zstd gzip
'';
};
}

26
modules/nixos/homelab/caddy/config/forgejo/default.nix Normal file
View file

@ -0,0 +1,26 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.forgejo;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
}

37
modules/nixos/homelab/caddy/config/jellyfin/default.nix Normal file
View file

@ -0,0 +1,37 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.jellyfin;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
}

31
modules/nixos/homelab/caddy/config/mastodon/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.mastodon;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host0}" = {
extraConfig = ''
reverse_proxy http://${interface0Cfg.microvm.ip}:80 {
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
}

54
modules/nixos/homelab/caddy/config/opencloud/default.nix Executable file
View file

@ -0,0 +1,54 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.opencloud;
interface0Cfg = serviceCfg.interfaces.interface0;
interface1Cfg = serviceCfg.interfaces.interface1;
dns0 = instances.web.dns.provider0;
dns1 = instances.web.dns.provider1;
host0 = interface1Cfg.domain;
host1 = "${interface0Cfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
credPath = "/var/lib/acme/${host0}";
in
{
security.acme.certs = {
"${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets."dns/${dns0}".path;
group = "caddy";
};
"${host1}" = {
dnsProvider = dns1;
environmentFile = config.sops.secrets."dns/${dns1}".path;
group = "caddy";
};
};
services.caddy.virtualHosts = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
'';
};
"${host1}" = {
extraConfig = ''
reverse_proxy ${interface1Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
tls ${credPath}/fullchain.pem ${credPath}/key.pem
'';
};
};
}

31
modules/nixos/homelab/caddy/config/photoprism/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.photoprism;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts."${host0}" = {
extraConfig = ''
reverse_proxy http://${interface0Cfg.microvm.ip}:80 {
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
}

39
modules/nixos/homelab/caddy/config/qbittorrent/default.nix Normal file
View file

@ -0,0 +1,39 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.qbittorrent;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host0}" = {
extraConfig = ''
basic_auth {
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
}
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
sops.secrets = {
"caddy/share-auth" = {
owner = "caddy";
group = "caddy";
mode = "0400";
};
};
}

35
modules/nixos/homelab/caddy/config/syncthing/default.nix Normal file
View file

@ -0,0 +1,35 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.syncthing;
interface0Cfg = serviceCfg.interfaces.interface0;
host0 = interface0Cfg.domain;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = {
caddy = {
virtualHosts = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interface0Cfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
};
};
};
}

34
modules/nixos/homelab/caddy/config/vaultwarden/default.nix Executable file
View file

@ -0,0 +1,34 @@
{
config,
flake,
...
}:
let
inherit (flake.config.services) instances;
serviceCfg = instances.vaultwarden;
interfaceCfg = serviceCfg.interfaces.interface0;
dns0 = instances.web.dns.provider0;
host = interfaceCfg.domain;
dns0Path = "dns/${dns0}";
in
{
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services.caddy.virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${interfaceCfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
encode zstd gzip
'';
};
};
}

38
modules/nixos/homelab/caddy/config/website/default.nix Normal file
View file

@ -0,0 +1,38 @@
{ flake, config, ... }:
let
inherit (flake.config.services) instances;
serviceCfg = instances.website;
interface0Cfg = serviceCfg.interfaces.interface0;
interface1Cfg = serviceCfg.interfaces.interface1;
host0 = interface0Cfg.domain;
host1 = flake.inputs.linkpage.secrets.domains.projectsite;
dns0 = instances.web.dns.provider0;
dns1 = instances.web.dns.provider1;
dns0Path = "dns/${dns0}";
dns1Path = "dns/${dns1}";
in
{
services.caddy = {
virtualHosts = {
${host0}.extraConfig = ''
reverse_proxy ${interface0Cfg.microvm.ip}:80
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
'';
${host1}.extraConfig = ''
reverse_proxy ${interface1Cfg.microvm.ip}:80
tls /var/lib/acme/${host1}/fullchain.pem /var/lib/acme/${host1}/key.pem
'';
};
};
security.acme.certs = {
${host0} = {
dnsProvider = dns0;
environmentFile = config.sops.secrets."${dns0Path}".path;
};
${host1} = {
dnsProvider = dns1;
environmentFile = config.sops.secrets."${dns1Path}".path;
};
};
}

34
modules/nixos/homelab/caddy/default.nix Executable file
View file

@ -0,0 +1,34 @@
{ flake, ... }:
let
inherit (flake.config.services) instances;
service = instances.caddy;
importList =
let
content = builtins.readDir ./.;
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
in
map (name: ./. + "/${name}") dirContent;
in
{
imports = importList;
services.caddy = {
enable = true;
};
tmpfiles.rules = [
"d /run/secrets/caddy 755 caddy caddy -"
"d /var/log/caddy 755 caddy caddy -"
];
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0 # 80
service.ports.port1 # 443
];
};
};
}