mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-14 02:20:53 -06:00
test: setting up nas structure
This commit is contained in:
Nick
parent
8cd193ec49
commit
4225970826
747 changed files with 2938 additions and 4347 deletions
12
modules/nixos/homelab/guests/default.nix
Executable file
12
modules/nixos/homelab/guests/default.nix
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
let
|
||||
inherit (import ./helpers.nix) labHelpers;
|
||||
importList =
|
||||
let
|
||||
content = builtins.readDir ./.;
|
||||
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
|
||||
in
|
||||
map (name: ./. + "/${name}" { inherit labHelpers; }) dirContent;
|
||||
in
|
||||
{
|
||||
imports = importList;
|
||||
}
|
||||
240
modules/nixos/homelab/guests/firefly-iii/config/default.nix
Executable file
240
modules/nixos/homelab/guests/firefly-iii/config/default.nix
Executable file
|
|
@ -0,0 +1,240 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.firefly-iii;
|
||||
smtpCfg = instances.smtp;
|
||||
in
|
||||
{
|
||||
fireflyVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
host,
|
||||
owner,
|
||||
mnt,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
firefly-iii = {
|
||||
enable = true;
|
||||
enableNginx = false;
|
||||
poolConfig = {
|
||||
"listen.owner" = config.services.caddy.user;
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 4;
|
||||
"pm.max_requests" = 500;
|
||||
};
|
||||
settings = {
|
||||
APP_URL = "https://${host}";
|
||||
APP_KEY_FILE = "/etc/firefly-secrets/${user}-pass";
|
||||
DB_PASSWORD_FILE = "/etc/firefly-secrets/${user}-data";
|
||||
DB_CONNECTION = "pgsql";
|
||||
DB_HOST = "/run/postgresql";
|
||||
DB_DATABASE = serviceCfg.name;
|
||||
DB_USERNAME = serviceCfg.name;
|
||||
MAIL_MAILER = smtpCfg.name;
|
||||
MAIL_HOST = smtpCfg.interfaces.interface0.domain;
|
||||
MAIL_PORT = smtpCfg.ports.port0;
|
||||
MAIL_FROM = smtpCfg.interfaces.interface0.email;
|
||||
MAIL_USERNAME = smtpCfg.interfaces.interface0.email;
|
||||
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/${user}-smtp";
|
||||
MAIL_ENCRYPTION = "tls";
|
||||
SITE_OWNER = owner;
|
||||
};
|
||||
};
|
||||
phpfpm.pools.firefly-iii.phpEnv = {
|
||||
TRUSTED_PROXIES = "*";
|
||||
APP_URL = "https://${host}";
|
||||
};
|
||||
firefly-iii-data-importer = {
|
||||
enable = true;
|
||||
};
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts.":80" = {
|
||||
extraConfig = ''
|
||||
root * ${config.services.firefly-iii.package}/public
|
||||
file_server
|
||||
encode gzip
|
||||
php_fastcgi unix//run/phpfpm/firefly-iii.sock {
|
||||
env HTTPS {http.request.header.X-Forwarded-Proto}
|
||||
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "firefly-iii" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "firefly-iii";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
smtpCfg.ports.port1
|
||||
serviceCfg.ports.port0
|
||||
serviceCfg.ports.port1
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
caddy = {
|
||||
after = [ "phpfpm-firefly-iii.service" ];
|
||||
requires = [ "phpfpm-firefly-iii.service" ];
|
||||
};
|
||||
fix-secrets-permissions = {
|
||||
description = "Fix secrets permissions for firefly-iii";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [
|
||||
"firefly-iii-setup.service"
|
||||
"phpfpm-firefly-iii.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /etc/firefly-secrets
|
||||
cp /run/secrets/${user}-pass /etc/firefly-secrets/${user}-pass
|
||||
cp /run/secrets/${user}-data /etc/firefly-secrets/${user}-data
|
||||
cp /run/secrets/${user}-smtp /etc/firefly-secrets/${user}-smtp
|
||||
chmod 755 /etc/firefly-secrets
|
||||
chmod 644 /etc/firefly-secrets/*
|
||||
'';
|
||||
};
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-ff-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-firefly";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}config";
|
||||
tag = "${serviceCfg.name}_${user}_config";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/postgresql";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops = {
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${serviceCfg.name}/${user}-${secret}";
|
||||
value = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0644";
|
||||
};
|
||||
})
|
||||
[
|
||||
"pass"
|
||||
"data"
|
||||
"smtp"
|
||||
]
|
||||
);
|
||||
};
|
||||
};
|
||||
}
|
||||
50
modules/nixos/homelab/guests/firefly-iii/default.nix
Executable file
50
modules/nixos/homelab/guests/firefly-iii/default.nix
Executable file
|
|
@ -0,0 +1,50 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit config flake pkgs; }) fireflyVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.people.users.${user0}) email;
|
||||
inherit (flake.config.services.instances) firefly-iii;
|
||||
interface0Cfg = firefly-iii.interfaces.interface0;
|
||||
|
||||
fireflyNick = fireflyVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh0;
|
||||
host = interface0Cfg.domain;
|
||||
mnt = "";
|
||||
owner = email.address2;
|
||||
};
|
||||
|
||||
# fireflyStacie = fireflyVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress (id1);
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = fireflyEris.ssh1;
|
||||
# host = "";
|
||||
# mnt = guestPath "stacie";
|
||||
# owner = "";
|
||||
# };
|
||||
|
||||
# fireflyGarnet = fireflyVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress (id2);
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = fireflyEris.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# host = "";
|
||||
# owner = "";
|
||||
# };
|
||||
|
||||
in
|
||||
fireflyNick
|
||||
# // fireflyStacie // fireflyGarnet
|
||||
170
modules/nixos/homelab/guests/forgejo/config/default.nix
Executable file
170
modules/nixos/homelab/guests/forgejo/config/default.nix
Executable file
|
|
@ -0,0 +1,170 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.forgejo;
|
||||
smtpCfg = instances.smtp;
|
||||
in
|
||||
{
|
||||
forgejoVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
${serviceCfg.name} = {
|
||||
enable = true;
|
||||
lfs.enable = true;
|
||||
secrets = {
|
||||
mailer.PASSWD = "/run/secrets/${user}-smtp";
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = host;
|
||||
ROOT_URL = "https://${host}/";
|
||||
HTTP_PORT = serviceCfg.ports.port0;
|
||||
};
|
||||
# If you need to start from scratch, don't forget to turn this off again
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
mirror = {
|
||||
ENABLED = true;
|
||||
};
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = smtpCfg.interface.interface1.domain;
|
||||
FROM = smtpCfg.interfaces.interface1.email;
|
||||
USER = smtpCfg.interfaces.interface1.email;
|
||||
PROTOCOL = "smtp+starttls";
|
||||
SMTP_PORT = smtpCfg.ports.port1;
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
USE_CLIENT_CERT = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22 # SSH
|
||||
25 # SMTP
|
||||
139 # SMTP
|
||||
2525 # SMTP
|
||||
smtpCfg.ports.port0
|
||||
serviceCfg.ports.port0
|
||||
];
|
||||
fileSystems."/tmp" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"size=4G"
|
||||
"mode=1777"
|
||||
];
|
||||
};
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 1024;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-fg-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-cloud";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-smtp" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
25
modules/nixos/homelab/guests/forgejo/default.nix
Normal file
25
modules/nixos/homelab/guests/forgejo/default.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) forgejoVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interface0Cfg = instances.forgejo.interfaces.interface0;
|
||||
|
||||
forgejoNick = forgejoVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
in
|
||||
forgejoNick
|
||||
# // forgejoStacie // forgejoGarnet
|
||||
8
modules/nixos/homelab/guests/helpers.nix
Normal file
8
modules/nixos/homelab/guests/helpers.nix
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
labHelpers = {
|
||||
guestPath = user: "/mnt/storage/users/${user}/guests";
|
||||
docsPath = user: "/mnt/storage/users/${user}/home/docs";
|
||||
mediaPath = user: "/mnt/storage/users/${user}/home/media";
|
||||
miscPath = user: "/mnt/storage/users/${user}/home/misc";
|
||||
};
|
||||
}
|
||||
169
modules/nixos/homelab/guests/jellyfin/config/default.nix
Executable file
169
modules/nixos/homelab/guests/jellyfin/config/default.nix
Executable file
|
|
@ -0,0 +1,169 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.jellyfin;
|
||||
id = 993;
|
||||
in
|
||||
{
|
||||
forgejoVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
}:
|
||||
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "25.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
users.users.jellyfin = {
|
||||
isSystemUser = true;
|
||||
group = serviceCfg.name;
|
||||
uid = id;
|
||||
};
|
||||
users.groups.jellyfin = {
|
||||
gid = id;
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
serviceCfg.ports.port0
|
||||
serviceCfg.ports.port1
|
||||
serviceCfg.ports.port2
|
||||
];
|
||||
fileSystems."/tmp" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"size=6G"
|
||||
"mode=1777"
|
||||
];
|
||||
};
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s6";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/cache/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d /var/lib/${serviceCfg.name}-media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
microvm = {
|
||||
vcpu = 4;
|
||||
mem = 1024 * 3;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-jf-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-cloud";
|
||||
mac = user;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/cache/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/cache";
|
||||
tag = "${serviceCfg.name}_${user}_cache";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}-media";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/media";
|
||||
tag = "${serviceCfg.name}_${user}_media";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users = {
|
||||
groups.jellyfin = {
|
||||
gid = id;
|
||||
members = [ user0 ];
|
||||
};
|
||||
users = {
|
||||
jellyfin = {
|
||||
isSystemUser = true;
|
||||
group = serviceCfg.name;
|
||||
uid = id;
|
||||
};
|
||||
caddy.extraGroups = [ "acme" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0755 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/cache 0755 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/media 0775 microvm wheel - -"
|
||||
];
|
||||
};
|
||||
}
|
||||
25
modules/nixos/homelab/guests/jellyfin/default.nix
Normal file
25
modules/nixos/homelab/guests/jellyfin/default.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) jellyfinVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interface0Cfg = instances.jellyfin.interfaces.interface0;
|
||||
|
||||
jellyfinNick = jellyfinVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
in
|
||||
jellyfinNick
|
||||
# // forgejoStacie // forgejoGarnet
|
||||
20
modules/nixos/homelab/guests/mastodon/config/config/chars.patch
Executable file
20
modules/nixos/homelab/guests/mastodon/config/config/chars.patch
Executable file
|
|
@ -0,0 +1,20 @@
|
|||
diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
+++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
@@ -32,5 +32,5 @@
|
||||
isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
|
||||
lang: state.getIn(['compose', 'language']),
|
||||
- maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
|
||||
+ maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 5000),
|
||||
});
|
||||
|
||||
diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
|
||||
--- a/app/validators/status_length_validator.rb
|
||||
+++ b/app/validators/status_length_validator.rb
|
||||
@@ -2,6 +2,6 @@
|
||||
|
||||
class StatusLengthValidator < ActiveModel::Validator
|
||||
- MAX_CHARS = 500
|
||||
+ MAX_CHARS = 5000
|
||||
URL_PLACEHOLDER_CHARS = 23
|
||||
URL_PLACEHOLDER = 'x' * 23
|
||||
6075
modules/nixos/homelab/guests/mastodon/config/config/twitter.txt
Executable file
6075
modules/nixos/homelab/guests/mastodon/config/config/twitter.txt
Executable file
File diff suppressed because one or more lines are too long
499
modules/nixos/homelab/guests/mastodon/config/default.nix
Executable file
499
modules/nixos/homelab/guests/mastodon/config/default.nix
Executable file
|
|
@ -0,0 +1,499 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.mastodon;
|
||||
smtpCfg = instances.smtp;
|
||||
|
||||
in
|
||||
{
|
||||
mastodonVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
}:
|
||||
{
|
||||
# If you need to start fresh for some reason, run these to create the new Admin account:
|
||||
# sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
|
||||
# sudo -u mastodon mastodon-tootctl accounts approve nick
|
||||
# If you fuck up and lose the password, use this:
|
||||
# sudo mastodon-tootctl accounts modify --reset-password nick
|
||||
# If you really fuck up and name yourself wrong, use this shit
|
||||
# sudo mastodon-tootctl accounts modify username --remove-role
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
|
||||
patches = (oldAttrs.patches or [ ]) ++ [
|
||||
./config/chars.patch
|
||||
];
|
||||
});
|
||||
})
|
||||
];
|
||||
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
|
||||
services = {
|
||||
${serviceCfg.name} = {
|
||||
enable = true;
|
||||
localDomain = host;
|
||||
secretKeyBaseFile = "/etc/mastodon-secrets/${user}-pass";
|
||||
streamingProcesses = 7;
|
||||
trustedProxy = "127.0.0.1";
|
||||
automaticMigrations = true;
|
||||
database = {
|
||||
createLocally = true;
|
||||
name = serviceCfg.name;
|
||||
host = "/run/postgresql";
|
||||
user = serviceCfg.name;
|
||||
passwordFile = "/etc/mastodon-secrets/${user}-database";
|
||||
};
|
||||
extraConfig = {
|
||||
SINGLE_USER_MODE = "false";
|
||||
SMTP_AUTH_METHOD = "plain";
|
||||
SMTP_DELIVERY_METHOD = "smtp";
|
||||
SMTP_ENABLE_STARTTLS_AUTO = "true";
|
||||
SMTP_SSL = "false";
|
||||
};
|
||||
|
||||
# if you're starting from scratch, you gotta cd into /var/lib/mastodon and run:
|
||||
# sudo -u mastodon mastodon-tootctl search deploy
|
||||
|
||||
elasticsearch = {
|
||||
preset = "single_node_cluster";
|
||||
host = "127.0.0.1";
|
||||
port = 9200;
|
||||
};
|
||||
mediaAutoRemove = {
|
||||
enable = true;
|
||||
olderThanDays = 14;
|
||||
};
|
||||
redis = {
|
||||
createLocally = true;
|
||||
enableUnixSocket = true;
|
||||
};
|
||||
sidekiqThreads = 25;
|
||||
sidekiqProcesses = {
|
||||
all = {
|
||||
jobClasses = [ ];
|
||||
threads = null;
|
||||
};
|
||||
default = {
|
||||
jobClasses = [ "default" ];
|
||||
threads = 5;
|
||||
};
|
||||
ingress = {
|
||||
jobClasses = [ "ingress" ];
|
||||
threads = 5;
|
||||
};
|
||||
push-pull = {
|
||||
jobClasses = [
|
||||
"push"
|
||||
"pull"
|
||||
];
|
||||
threads = 5;
|
||||
};
|
||||
mailers = {
|
||||
jobClasses = [ "mailers" ];
|
||||
threads = 5;
|
||||
};
|
||||
};
|
||||
smtp = {
|
||||
authenticate = true;
|
||||
createLocally = false;
|
||||
fromAddress = "upRootNutrition <${smtpCfg.interfaces.interface1.email}>";
|
||||
host = smtpCfg.interfaces.interface1.domain;
|
||||
passwordFile = "/etc/mastodon-secrets/${user}-smtp";
|
||||
port = smtpCfg.ports.port1;
|
||||
user = smtpCfg.interfaces.interface1.email;
|
||||
};
|
||||
};
|
||||
opensearch.enable = true;
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
":80" = {
|
||||
extraConfig = ''
|
||||
handle_path /system/* {
|
||||
file_server * {
|
||||
root /var/lib/mastodon/public-system
|
||||
}
|
||||
}
|
||||
|
||||
handle /api/v1/streaming/* {
|
||||
reverse_proxy unix//run/mastodon-streaming/streaming.socket {
|
||||
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
|
||||
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
|
||||
route * {
|
||||
file_server * {
|
||||
root ${pkgs.mastodon}/public
|
||||
pass_thru
|
||||
}
|
||||
reverse_proxy * unix//run/mastodon-web/web.socket {
|
||||
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
|
||||
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
|
||||
handle_errors {
|
||||
root * ${pkgs.mastodon}/public
|
||||
rewrite 500.html
|
||||
file_server
|
||||
}
|
||||
|
||||
encode gzip
|
||||
|
||||
header /* {
|
||||
Strict-Transport-Security "max-age=31536000;"
|
||||
}
|
||||
|
||||
header /emoji/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /packs/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
${serviceCfg.name}.extraGroups = [ "postgres" ];
|
||||
caddy.extraGroups = [ serviceCfg.name ];
|
||||
fedifetcher = {
|
||||
isSystemUser = true;
|
||||
group = "fedifetcher";
|
||||
home = "/var/lib/fedifetcher";
|
||||
createHome = true;
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.fedifetcher = { };
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22 # SSH
|
||||
80 # Caddy
|
||||
25 # SMTP
|
||||
139 # SMTP
|
||||
587 # SMTP
|
||||
2525 # SMTP
|
||||
5432 # Postgres
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
mastodon-init-dirs.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-web.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-1.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-2.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-3.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-4.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-5.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-6.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-7.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-all.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-default.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-ingress.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-mailers.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-push-pull.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
|
||||
mastodon-elastic-search = {
|
||||
description = "Recache elastic search";
|
||||
after = [
|
||||
"network-online.target"
|
||||
"mastodon-web.service"
|
||||
];
|
||||
wants = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
WorkingDirectory = "/var/lib/${serviceCfg.name}";
|
||||
Type = "oneshot";
|
||||
};
|
||||
script = ''
|
||||
/run/current-system/sw/bin/mastodon-tootctl search deploy --only=instances accounts tags statuses public_statuses
|
||||
'';
|
||||
};
|
||||
|
||||
mastodon-copy-secrets = {
|
||||
description = "Copy secrets from virtiofs to local filesystem";
|
||||
before = [ "mastodon-init-dirs.service" ];
|
||||
requiredBy = [ "mastodon-init-dirs.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mkdir -p /etc/mastodon-secrets
|
||||
cp /run/secrets/${user}-pass /etc/mastodon-secrets/${user}-pass
|
||||
cp /run/secrets/${user}-database /etc/mastodon-secrets/${user}-database
|
||||
cp /run/secrets/${user}-redis /etc/mastodon-secrets/${user}-redis
|
||||
cp /run/secrets/${user}-smtp /etc/mastodon-secrets/${user}-smtp
|
||||
cp /run/secrets/${user}-fedifetcher-token /etc/mastodon-secrets/${user}-fedifetcher
|
||||
chmod 755 /etc/mastodon-secrets
|
||||
chmod 644 /etc/mastodon-secrets/*
|
||||
'';
|
||||
};
|
||||
|
||||
fedifetcher = {
|
||||
description = "FediFetcher - Fetch missing posts for Mastodon";
|
||||
after = [
|
||||
"network-online.target"
|
||||
"mastodon-web.service"
|
||||
];
|
||||
wants = [ "network-online.target" ];
|
||||
|
||||
serviceConfig =
|
||||
let
|
||||
fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" (
|
||||
builtins.toJSON {
|
||||
server = "https://${host}";
|
||||
home-timeline-length = 200;
|
||||
max-followings = 80;
|
||||
from-notifications = 1;
|
||||
max-bookmarks = 80;
|
||||
max-favourites = 40;
|
||||
backfill-with-context = 1;
|
||||
backfill-mentioned-users = 1;
|
||||
remember-users-for-hours = 168;
|
||||
remember-hosts-for-days = 30;
|
||||
http-timeout = 5;
|
||||
lock-hours = 24;
|
||||
log-level = "INFO";
|
||||
}
|
||||
);
|
||||
in
|
||||
{
|
||||
Type = "oneshot";
|
||||
User = "fedifetcher";
|
||||
Group = "fedifetcher";
|
||||
WorkingDirectory = "/var/lib/fedifetcher";
|
||||
TimeoutStartSec = "300";
|
||||
PrivateTmp = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = "/var/lib/fedifetcher";
|
||||
ExecStart =
|
||||
let
|
||||
script = pkgs.writeShellScript "fedifetcher-run" ''
|
||||
set -e
|
||||
|
||||
# Wait for Mastodon to be fully ready
|
||||
for i in {1..30}; do
|
||||
if ${pkgs.curl}/bin/curl -sf http://localhost:80/health >/dev/null 2>&1; then
|
||||
echo "Mastodon is ready"
|
||||
break
|
||||
fi
|
||||
echo "Waiting for Mastodon to be ready... ($i/30)"
|
||||
sleep 2
|
||||
done
|
||||
|
||||
export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/${user}-fedifetcher)
|
||||
${pkgs.fedifetcher}/bin/fedifetcher \
|
||||
-c=${fedifetcherConfig} \
|
||||
--access-token="$ACCESS_TOKEN"
|
||||
'';
|
||||
in
|
||||
"${script}";
|
||||
};
|
||||
};
|
||||
|
||||
mastodon-init-db.serviceConfig.EnvironmentFile = "/var/lib/mastodon/.secrets_env";
|
||||
|
||||
systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ];
|
||||
|
||||
opensearch-install-plugins = {
|
||||
description = "Install OpenSearch plugins";
|
||||
before = [ "opensearch.service" ];
|
||||
requiredBy = [ "opensearch.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
PLUGIN_DIR="/var/lib/opensearch/plugins/analysis-icu"
|
||||
if [ ! -d "$PLUGIN_DIR" ]; then
|
||||
# Create the plugins directory if it doesn't exist
|
||||
mkdir -p /var/lib/opensearch/plugins
|
||||
|
||||
# Install using the proper OpenSearch plugin command
|
||||
export OPENSEARCH_JAVA_HOME="${pkgs.jdk17}/lib/openjdk"
|
||||
${pkgs.opensearch}/bin/opensearch-plugin install --batch analysis-icu || {
|
||||
echo "Plugin installation failed, but continuing anyway"
|
||||
exit 0
|
||||
}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
timers = {
|
||||
mastodon-elastic-search = {
|
||||
description = "Timer for Mastodon elastic search recaching";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "10min";
|
||||
OnUnitActiveSec = "60min";
|
||||
Unit = "mastodon-elastic-search.service";
|
||||
};
|
||||
};
|
||||
|
||||
fedifetcher = {
|
||||
description = "Timer for FediFetcher";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "10min";
|
||||
OnUnitActiveSec = "15min";
|
||||
Unit = "fedifetcher.service";
|
||||
Persistent = true;
|
||||
AccuracySec = "1min";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s6";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/mastodon 0755 mastodon mastodon -"
|
||||
"Z /var/lib/mastodon 0755 mastodon mastodon -"
|
||||
"Z /var/lib/postgresql 0755 postgres postgres -"
|
||||
"d /var/cache/mastodon/precompile 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/accounts 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -"
|
||||
"d /var/lib/fedifetcher 0755 fedifetcher fedifetcher -"
|
||||
];
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 1024 * 6;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-md-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-cloud";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/postgresql";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/database";
|
||||
tag = "${serviceCfg.name}_${user}_database";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops = {
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${serviceCfg.name}/${user}-${secret}";
|
||||
value = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0644";
|
||||
};
|
||||
})
|
||||
[
|
||||
"smtp"
|
||||
"database"
|
||||
"redis"
|
||||
"pass"
|
||||
"fedifetcher"
|
||||
]
|
||||
);
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/database 0751 microvm wheel - -"
|
||||
];
|
||||
};
|
||||
}
|
||||
25
modules/nixos/homelab/guests/mastodon/default.nix
Normal file
25
modules/nixos/homelab/guests/mastodon/default.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) mastodonVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interface0Cfg = instances.mastodon.interfaces.interface0;
|
||||
|
||||
mastodonNick = mastodonVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
in
|
||||
mastodonNick
|
||||
# // mastodonStacie // mastodonGarnet
|
||||
162
modules/nixos/homelab/guests/minecraft/config/default.nix
Executable file
162
modules/nixos/homelab/guests/minecraft/config/default.nix
Executable file
|
|
@ -0,0 +1,162 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
serviceCfg = {
|
||||
name = "minecraft";
|
||||
};
|
||||
in
|
||||
{
|
||||
minecraftVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
port,
|
||||
mnt,
|
||||
config,
|
||||
whitelist,
|
||||
worldNumber,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
"rcon.password" = "/etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}";
|
||||
server-port = port;
|
||||
}
|
||||
// config;
|
||||
whitelist = whitelist;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
port
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
"${serviceCfg.name}-copy-secrets" = {
|
||||
description = "Copy secrets from virtiofs to local filesystem";
|
||||
before = [ "minecraft-server.service" ];
|
||||
requiredBy = [ "minecraft-server.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /etc/${serviceCfg.name}-secrets
|
||||
cp /run/secrets/${user}-world${worldNumber} /etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}
|
||||
chmod 755 /etc/${serviceCfg.name}-secrets
|
||||
chmod 644 /etc/${serviceCfg.name}-secrets/*
|
||||
'';
|
||||
};
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 4;
|
||||
mem = 1024 * 4;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-mc${worldNumber}-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-craft";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/world${worldNumber}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ port ];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-world${worldNumber}" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
105
modules/nixos/homelab/guests/minecraft/default.nix
Executable file
105
modules/nixos/homelab/guests/minecraft/default.nix
Executable file
|
|
@ -0,0 +1,105 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) minecraftVM;
|
||||
inherit (flake.config.services) instances;
|
||||
inherit (flake.config.people) user0;
|
||||
|
||||
minecraftNick01 =
|
||||
let
|
||||
interfaceCfg = instances.minecraft.interfaces.interface0;
|
||||
in
|
||||
minecraftVM {
|
||||
user = user0;
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
ssh = interfaceCfg.microvm.ssh;
|
||||
port = interfaceCfg.microvm.port;
|
||||
mnt = "";
|
||||
worldNumber = "01";
|
||||
config = {
|
||||
allow-flight = false;
|
||||
allow-nether = true;
|
||||
difficulty = 2;
|
||||
enable-command-block = false;
|
||||
enable-rcon = true;
|
||||
enable-status = true;
|
||||
force-gamemode = true;
|
||||
gamemode = 0;
|
||||
generate-structures = true;
|
||||
hardcore = false;
|
||||
hide-online-players = false;
|
||||
level-name = "Brix on Nix";
|
||||
level-seed = "9064150133272194";
|
||||
max-players = 10;
|
||||
max-world-size = 64000000;
|
||||
motd = "A cool Minecraft server powered by NixOS";
|
||||
online-mode = true;
|
||||
pvp = true;
|
||||
spawn-animals = true;
|
||||
spawn-monsters = true;
|
||||
spawn-npcs = true;
|
||||
spawn-protection = 16;
|
||||
view-distance = 32;
|
||||
white-list = true;
|
||||
};
|
||||
whitelist = {
|
||||
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
|
||||
Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
|
||||
EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
|
||||
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
|
||||
};
|
||||
};
|
||||
|
||||
minecraftNick02 =
|
||||
let
|
||||
interfaceCfg = instances.minecraft.interfaces.interface1;
|
||||
in
|
||||
minecraftVM {
|
||||
user = user0;
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
ssh = interfaceCfg.microvm.ssh;
|
||||
port = interfaceCfg.microvm.port;
|
||||
mnt = "";
|
||||
worldNumber = "02";
|
||||
config = {
|
||||
allow-flight = false;
|
||||
allow-nether = true;
|
||||
difficulty = 2;
|
||||
enable-command-block = false;
|
||||
enable-rcon = true;
|
||||
enable-status = true;
|
||||
force-gamemode = true;
|
||||
gamemode = 0;
|
||||
generate-structures = true;
|
||||
hardcore = false;
|
||||
hide-online-players = false;
|
||||
level-name = "Cuddle Cubes";
|
||||
level-seed = "-2332803749585407299";
|
||||
max-players = 10;
|
||||
max-world-size = 64000000;
|
||||
motd = "A cool Minecraft server powered by NixOS";
|
||||
online-mode = true;
|
||||
pvp = true;
|
||||
spawn-animals = true;
|
||||
spawn-monsters = true;
|
||||
spawn-npcs = true;
|
||||
spawn-protection = 16;
|
||||
view-distance = 32;
|
||||
white-list = true;
|
||||
};
|
||||
whitelist = {
|
||||
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
|
||||
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
minecraftNick01 // minecraftNick02
|
||||
3
modules/nixos/homelab/guests/onlyoffice/config/default.nix
Executable file
3
modules/nixos/homelab/guests/onlyoffice/config/default.nix
Executable file
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
|
||||
}
|
||||
3
modules/nixos/homelab/guests/onlyoffice/default.nix
Executable file
3
modules/nixos/homelab/guests/onlyoffice/default.nix
Executable file
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
|
||||
}
|
||||
186
modules/nixos/homelab/guests/opencloud/config/default.nix
Executable file
186
modules/nixos/homelab/guests/opencloud/config/default.nix
Executable file
|
|
@ -0,0 +1,186 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) opencloud;
|
||||
serviceCfg = opencloud;
|
||||
in
|
||||
{
|
||||
opencloudVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
opencloud = {
|
||||
enable = true;
|
||||
url = "https://${host}";
|
||||
port = 9200;
|
||||
address = "0.0.0.0";
|
||||
stateDir = "/var/lib/${serviceCfg.name}";
|
||||
environmentFile = "/run/secrets/${user}-env";
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
587
|
||||
9200
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
opencloud = {
|
||||
path = [ pkgs.inotify-tools ];
|
||||
};
|
||||
opencloud-fix-permissions = {
|
||||
description = "Fix OpenCloud storage permissions";
|
||||
after = [ "opencloud.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "fix-perms" ''
|
||||
echo "Starting permission fix..."
|
||||
OPENCLOUD_UID=$(id -u opencloud)
|
||||
echo "OpenCloud UID: $OPENCLOUD_UID"
|
||||
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
|
||||
echo "Fixing file: $file"
|
||||
chown opencloud:opencloud "$file" 2>/dev/null || true
|
||||
done
|
||||
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
|
||||
echo "Fixing dir: $dir"
|
||||
chown opencloud:opencloud "$dir" 2>/dev/null || true
|
||||
done
|
||||
echo "Permission fix complete"
|
||||
'';
|
||||
User = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
timers.opencloud-fix-permissions = {
|
||||
description = "Periodically fix OpenCloud storage permissions";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "30s";
|
||||
OnUnitActiveSec = "2min";
|
||||
Unit = "opencloud-fix-permissions.service";
|
||||
};
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-oc-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-cloud";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/etc/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/config";
|
||||
tag = "${serviceCfg.name}_${user}_config";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
inotify-tools
|
||||
opencloud
|
||||
;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
|
||||
];
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-env" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
46
modules/nixos/homelab/guests/opencloud/default.nix
Executable file
46
modules/nixos/homelab/guests/opencloud/default.nix
Executable file
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) opencloudVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) opencloud;
|
||||
|
||||
interface0Cfg = opencloud.interfaces.interface0;
|
||||
|
||||
opencloudNick = opencloudVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
|
||||
# opencloudStacie = opencloudVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id1;
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = opencloud.ssh1;
|
||||
# mnt = guestPath "stacie";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
# opencloudGarnet = opencloudVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id2;
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = opencloud.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
in
|
||||
opencloudNick
|
||||
# // opencloudStacie // opencloudGarnet
|
||||
167
modules/nixos/homelab/guests/photoprism/config/default.nix
Executable file
167
modules/nixos/homelab/guests/photoprism/config/default.nix
Executable file
|
|
@ -0,0 +1,167 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) photoprism;
|
||||
serviceCfg = photoprism;
|
||||
in
|
||||
{
|
||||
photoprismVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
data,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
${serviceCfg.name} = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PHOTOPRISM_ADMIN_USER = user;
|
||||
PHOTOPRISM_DEFAULT_LOCAL = "en";
|
||||
};
|
||||
passwordFile = "/run/secrets/${user}-pass";
|
||||
storagePath = "/var/lib/${serviceCfg.name}";
|
||||
originalsPath = "/var/lib/${serviceCfg.name}-media";
|
||||
importPath = "photos";
|
||||
address = "0.0.0.0";
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.photoprism = {
|
||||
isSystemUser = true;
|
||||
group = "photoprism";
|
||||
home = "/var/lib/photoprism";
|
||||
};
|
||||
users.groups.photoprism = { };
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
2342
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
photoprism = {
|
||||
serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = serviceCfg.name;
|
||||
Group = serviceCfg.name;
|
||||
};
|
||||
};
|
||||
systemd-networkd.wantedBy = [
|
||||
"multi-user.target"
|
||||
];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-pp-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-photo";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}-media";
|
||||
proto = "virtiofs";
|
||||
source = data;
|
||||
tag = "${serviceCfg.name}_${user}_media";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${data}/photos 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-pass" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
46
modules/nixos/homelab/guests/photoprism/default.nix
Executable file
46
modules/nixos/homelab/guests/photoprism/default.nix
Executable file
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake lib; }) photoprismVM;
|
||||
inherit (flake.config.services.instances) photoprism;
|
||||
inherit (flake.config.people) user0;
|
||||
interface0Cfg = photoprism.interfaces.interface0;
|
||||
|
||||
photoprismNick = photoprismVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
data = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
|
||||
# photoprismStacie = photoprismVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id1;
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = photoprism.ssh1;
|
||||
# mnt = guestPath "stacie";
|
||||
# data = mediaPath "stacie";
|
||||
# };
|
||||
|
||||
# photoprismGarnet = photoprismVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id2;
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = photoprism.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# data = mediaPath "stacie";
|
||||
# };
|
||||
|
||||
in
|
||||
photoprismNick
|
||||
# // photoprismStacie // photoprismGarnet
|
||||
430
modules/nixos/homelab/guests/qbittorrent/config/default.nix
Executable file
430
modules/nixos/homelab/guests/qbittorrent/config/default.nix
Executable file
|
|
@ -0,0 +1,430 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.qbittorrent;
|
||||
dns0 = instances.web.dns.provider0;
|
||||
dns0Path = "dns/${dns0}";
|
||||
in
|
||||
{
|
||||
qbittorrentVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
port,
|
||||
endpoint,
|
||||
address,
|
||||
dns,
|
||||
key,
|
||||
}:
|
||||
{
|
||||
microvm.vms =
|
||||
let
|
||||
torrentPort = port;
|
||||
vpnEndpoint = endpoint;
|
||||
localNet = "192.168.50.0/24";
|
||||
in
|
||||
{
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
config = {
|
||||
system.stateVersion = "25.05";
|
||||
|
||||
# VPN Killswitch - configured BEFORE networking starts
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.ip_forward" = 1;
|
||||
};
|
||||
|
||||
networking = {
|
||||
# Disable default firewall - we're doing it manually
|
||||
firewall.enable = false;
|
||||
|
||||
wg-quick.interfaces = {
|
||||
wg0 = {
|
||||
address = address;
|
||||
dns = dns;
|
||||
privateKeyFile = "/run/secrets/${user}-wireguard-pass";
|
||||
|
||||
peers = [
|
||||
{
|
||||
publicKey = key;
|
||||
endpoint = "${vpnEndpoint}:${toString torrentPort}";
|
||||
allowedIPs = [
|
||||
"0.0.0.0/0"
|
||||
"::/0"
|
||||
];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
|
||||
# Now we can safely open the VPN tunnel for all traffic
|
||||
postUp = ''
|
||||
echo "VPN UP: Opening network for VPN and local traffic"
|
||||
|
||||
# Allow ALL traffic through VPN interface
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o wg0 -j ACCEPT
|
||||
|
||||
# Allow local network traffic (WebUI, management)
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT
|
||||
|
||||
# NAT for VPN
|
||||
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
|
||||
|
||||
# Allow forwarding through VPN (for port forwarding)
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
echo "VPN UP: Network opened for VPN and local traffic"
|
||||
'';
|
||||
|
||||
preDown = ''
|
||||
echo "VPN DOWN: Removing VPN rules, killswitch remains active"
|
||||
${pkgs.iptables}/bin/iptables -D INPUT -i wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D OUTPUT -o wg0 -j ACCEPT 2>/dev/null || true
|
||||
|
||||
${pkgs.iptables}/bin/iptables -D INPUT -i enp0s5 -s ${localNet} -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT 2>/dev/null || true
|
||||
|
||||
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || true
|
||||
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
|
||||
|
||||
echo "VPN DOWN: Killswitch rules remain - no internet access"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
dhcpcd.enable = false;
|
||||
useNetworkd = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
qbittorrent = {
|
||||
enable = true;
|
||||
webuiPort = serviceCfg.ports.port0;
|
||||
torrentingPort = torrentPort;
|
||||
openFirewall = false; # We're managing firewall manually
|
||||
|
||||
serverConfig = {
|
||||
LegalNotice.Accepted = true;
|
||||
|
||||
BitTorrent = {
|
||||
Session = {
|
||||
Interface = "wg0";
|
||||
InterfaceName = "wg0";
|
||||
Port = torrentPort;
|
||||
MaxConnections = -1;
|
||||
MaxConnectionsPerTorrent = -1;
|
||||
MaxUploads = -1;
|
||||
MaxUploadsPerTorrent = -1;
|
||||
QueueingSystemEnabled = false;
|
||||
uTPRateLimited = false;
|
||||
uTPEnabled = true;
|
||||
AlternativeGlobalDLSpeedLimit = 0;
|
||||
AlternativeGlobalUPSpeedLimit = 0;
|
||||
GlobalMaxInactiveSeedingMinutes = 10224;
|
||||
GlobalMaxRatio = -1;
|
||||
};
|
||||
};
|
||||
|
||||
Preferences = {
|
||||
WebUI = {
|
||||
Username = "user";
|
||||
Password_PBKDF2 = "@ByteArray(1bJKXLVSLU6kgCHbCS2lDg==:BmyrMaod6dbJqEe7Ud/JgKAxRMqzsAuEjHcTvLzIBgc5rc5Z7J2X9mbH0cDEAhXqc+O3gQxrckt8S2Gf+zlO9w==)";
|
||||
};
|
||||
|
||||
General = {
|
||||
Locale = "en";
|
||||
};
|
||||
|
||||
Downloads = {
|
||||
SavePath = "${mnt}/${serviceCfg.name}/downloads";
|
||||
TempPathEnabled = false;
|
||||
PreAllocation = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."10-enp" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
gateway = [ "192.168.50.1" ];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d ${mnt}/${serviceCfg.name}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
|
||||
services = {
|
||||
# Ensure qBittorrent ONLY starts after VPN is up
|
||||
qbittorrent = {
|
||||
after = [
|
||||
"wg-quick-wg0.service"
|
||||
"network-online.target"
|
||||
];
|
||||
requires = [ "wg-quick-wg0.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
bindsTo = [ "wg-quick-wg0.service" ]; # Stop if VPN stops
|
||||
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
};
|
||||
|
||||
natpmp-portforward = {
|
||||
description = "NAT-PMP Port Forwarding for VPN";
|
||||
after = [
|
||||
"wg-quick-wg0.service"
|
||||
"qbittorrent.service"
|
||||
];
|
||||
requires = [
|
||||
"wg-quick-wg0.service"
|
||||
"qbittorrent.service"
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
|
||||
script = ''
|
||||
PASSWORD=$(cat /run/secrets/${user}-qbittorrent-pass)
|
||||
echo "Waiting for qBittorrent to start..."
|
||||
sleep 10
|
||||
|
||||
while true; do
|
||||
echo "Requesting port forwarding from VPN..."
|
||||
|
||||
UDP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 udp 60 -g 10.2.0.1 2>&1)
|
||||
UDP_PORT=$(echo "$UDP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
|
||||
|
||||
TCP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 tcp 60 -g 10.2.0.1 2>&1)
|
||||
TCP_PORT=$(echo "$TCP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
|
||||
|
||||
if [ -n "$UDP_PORT" ] && [ -n "$TCP_PORT" ]; then
|
||||
echo "Port forwarding successful: UDP=$UDP_PORT, TCP=$TCP_PORT"
|
||||
|
||||
# Clean up old dynamic rules
|
||||
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p tcp -j DNAT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p udp -j DNAT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p tcp -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p udp -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o enp0s5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
|
||||
|
||||
# DNAT: Forward LAN traffic to qBittorrent on WireGuard interface
|
||||
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p tcp --dport "$TCP_PORT" -j DNAT --to-destination 10.2.0.2:"$TCP_PORT"
|
||||
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p udp --dport "$UDP_PORT" -j DNAT --to-destination 10.2.0.2:"$UDP_PORT"
|
||||
|
||||
# Allow forwarding for these specific ports
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p tcp --dport "$TCP_PORT" -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p udp --dport "$UDP_PORT" -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o enp0s5 -s 10.2.0.2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
echo "Firewall forwarding rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
|
||||
|
||||
# Update qBittorrent listening port via API
|
||||
echo "Logging into qBittorrent API..."
|
||||
COOKIE=$(${pkgs.curl}/bin/curl -s -i \
|
||||
--header "Referer: http://localhost:${toString serviceCfg.ports.port0}" \
|
||||
--data "username=user&password=$PASSWORD" \
|
||||
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/auth/login" | \
|
||||
${pkgs.gnugrep}/bin/grep -i "set-cookie" | ${pkgs.gawk}/bin/awk -F'SID=|;' '{print $2}')
|
||||
|
||||
if [ -n "$COOKIE" ]; then
|
||||
echo "Authentication successful, updating port..."
|
||||
${pkgs.curl}/bin/curl -s \
|
||||
--cookie "SID=$COOKIE" \
|
||||
--data "json={\"listen_port\":$UDP_PORT}" \
|
||||
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/app/setPreferences"
|
||||
|
||||
echo "Updated qBittorrent listening port to $UDP_PORT"
|
||||
else
|
||||
echo "WARNING: Failed to authenticate with qBittorrent API"
|
||||
fi
|
||||
else
|
||||
echo "ERROR: Failed to get forwarded ports"
|
||||
echo "UDP output: $UDP_OUTPUT"
|
||||
echo "TCP output: $TCP_OUTPUT"
|
||||
fi
|
||||
|
||||
sleep 45
|
||||
done
|
||||
'';
|
||||
};
|
||||
killswitch-init = {
|
||||
description = "Initialize VPN Killswitch Before Network";
|
||||
wantedBy = [ "network-pre.target" ];
|
||||
before = [
|
||||
"network-pre.target"
|
||||
"network.target"
|
||||
];
|
||||
after = [ "systemd-modules-load.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
echo "KILLSWITCH: Setting up firewall rules BEFORE network services"
|
||||
|
||||
# Default DROP everything
|
||||
${pkgs.iptables}/bin/iptables -P INPUT DROP
|
||||
${pkgs.iptables}/bin/iptables -P OUTPUT DROP
|
||||
${pkgs.iptables}/bin/iptables -P FORWARD DROP
|
||||
|
||||
${pkgs.iptables}/bin/iptables -F
|
||||
${pkgs.iptables}/bin/iptables -t nat -F
|
||||
${pkgs.iptables}/bin/iptables -X
|
||||
|
||||
# Allow loopback
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i lo -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
# CRITICAL: Only allow WireGuard endpoint traffic before VPN is up
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -p udp --dport ${toString torrentPort} -d ${vpnEndpoint} -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -p udp --sport ${toString torrentPort} -s ${vpnEndpoint} -j ACCEPT
|
||||
|
||||
# Allow SSH from local network (for management)
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -p tcp --dport 22 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Block IPv6 completely
|
||||
${pkgs.iptables}/bin/ip6tables -P INPUT DROP 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/ip6tables -P OUTPUT DROP 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/ip6tables -P FORWARD DROP 2>/dev/null || true
|
||||
|
||||
echo "KILLSWITCH: Initialized - Network locked down"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 1024 * 1;
|
||||
hypervisor = "qemu";
|
||||
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-qb-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-share";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/torrent";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
conntrack-tools
|
||||
gawk
|
||||
iptables
|
||||
libnatpmp
|
||||
speedtest-go
|
||||
wireguard-tools
|
||||
;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
"torrent/${user}-wireguard-pass" = {
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
"torrent/${user}-qbittorrent-pass" = {
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
|
||||
systemd = {
|
||||
services.caddy = {
|
||||
serviceConfig = {
|
||||
EnvironmentFile = config.sops.secrets."caddy/share-auth".path;
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [
|
||||
38834
|
||||
torrentPort
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
38834
|
||||
torrentPort
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
30
modules/nixos/homelab/guests/qbittorrent/default.nix
Normal file
30
modules/nixos/homelab/guests/qbittorrent/default.nix
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) qbittorrentVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interface0Cfg = instances.qbittorrent.interfaces.interface0;
|
||||
|
||||
qbittorrentNick = qbittorrentVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
port = 51820;
|
||||
endpoint = "185.111.110.1";
|
||||
address = [ "10.2.0.2/32" ];
|
||||
dns = [ "10.2.0.1" ];
|
||||
key = "QPfiwJQmt5VLEOh1ufLbi1lj6LUnwQY0tgDSh3pWx1k=";
|
||||
};
|
||||
in
|
||||
qbittorrentNick
|
||||
# // qbittorrentStacie // qbittorrentGarnet
|
||||
147
modules/nixos/homelab/guests/syncthing/config/default.nix
Executable file
147
modules/nixos/homelab/guests/syncthing/config/default.nix
Executable file
|
|
@ -0,0 +1,147 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) syncthing;
|
||||
serviceCfg = syncthing;
|
||||
in
|
||||
{
|
||||
syncthingVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
folders,
|
||||
devices,
|
||||
tmp,
|
||||
mounts,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
syncthing = {
|
||||
enable = true;
|
||||
overrideDevices = false;
|
||||
overrideFolders = false;
|
||||
openDefaultPorts = true;
|
||||
systemService = true;
|
||||
guiAddress = "0.0.0.0:${toString serviceCfg.ports.port0}";
|
||||
settings = {
|
||||
folders = folders;
|
||||
devices = devices;
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
serviceCfg.ports.port0
|
||||
serviceCfg.ports.port1
|
||||
serviceCfg.ports.port2
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
systemd-networkd.wantedBy = [
|
||||
"multi-user.target"
|
||||
];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
]
|
||||
++ tmp;
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-st-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vm-sync";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
]
|
||||
++ mounts;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
};
|
||||
}
|
||||
118
modules/nixos/homelab/guests/syncthing/default.nix
Executable file
118
modules/nixos/homelab/guests/syncthing/default.nix
Executable file
|
|
@ -0,0 +1,118 @@
|
|||
{
|
||||
flake,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake; }) syncthingVM;
|
||||
inherit (flake.config.services) instances;
|
||||
inherit (flake.config.people) user0;
|
||||
serviceCfg = instances.syncthing;
|
||||
interface0Cfg = serviceCfg.interfaces.interface0;
|
||||
|
||||
foldersHelper = user: {
|
||||
docs = {
|
||||
enable = true;
|
||||
id = "docs";
|
||||
path = "/var/lib/${serviceCfg.name}/docs";
|
||||
devices = [
|
||||
"${user}Phone"
|
||||
];
|
||||
};
|
||||
media = {
|
||||
enable = true;
|
||||
id = "media";
|
||||
path = "/var/lib/${serviceCfg.name}/media";
|
||||
devices = [
|
||||
"${user}Phone"
|
||||
];
|
||||
};
|
||||
misc = {
|
||||
enable = true;
|
||||
id = "misc";
|
||||
path = "/var/lib/${serviceCfg.name}/misc";
|
||||
devices = [
|
||||
"${user}Phone"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
devicesHelper = user: syncID: device: deviceIP: {
|
||||
"${user}${device}" = {
|
||||
autoAcceptFolders = true;
|
||||
name = "${user}${device}";
|
||||
addresses = [
|
||||
"tcp://${deviceIP}:${toString serviceCfg.ports.port2}"
|
||||
];
|
||||
id = syncID;
|
||||
};
|
||||
};
|
||||
|
||||
mountsHelper = user: [
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}/docs";
|
||||
proto = "virtiofs";
|
||||
source = "";
|
||||
tag = "${serviceCfg.name}_${user}_docs";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}/media";
|
||||
proto = "virtiofs";
|
||||
source = "";
|
||||
tag = "${serviceCfg.name}_${user}_media";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}/misc";
|
||||
proto = "virtiofs";
|
||||
source = "";
|
||||
tag = "${serviceCfg.name}_${user}_misc";
|
||||
}
|
||||
];
|
||||
|
||||
tmpRules = [
|
||||
"d /var/lib/${serviceCfg.name}/docs 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d /var/lib/${serviceCfg.name}/media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d /var/lib/${serviceCfg.name}/misc 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
|
||||
syncthingNick =
|
||||
let
|
||||
phoneID = "OALKHLZ-OODUWVX-PAC2LI7-UMZMSZO-FELLRCD-RS4DHJS-PVA5YQK-WTFXXQI";
|
||||
in
|
||||
syncthingVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
folders = foldersHelper user0;
|
||||
devices = devicesHelper user0 phoneID "Phone" "192.168.50.8";
|
||||
tmp = tmpRules;
|
||||
mounts = mountsHelper user0;
|
||||
};
|
||||
|
||||
# syncthingStacie = syncthingVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id0;
|
||||
# mac = "02:00:00:00:${id0}:${id0}";
|
||||
# userMac = "02:00:00:00:00:${id0}";
|
||||
# ssh = syncthing.ssh0;
|
||||
# syncID = "";
|
||||
# deviceIP = "";
|
||||
# };
|
||||
|
||||
# syncthingGarnet = syncthingVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id0;
|
||||
# mac = "02:00:00:00:${id0}:${id0}";
|
||||
# userMac = "02:00:00:00:00:${id0}";
|
||||
# ssh = syncthing.ssh0;
|
||||
# syncID = "";
|
||||
# deviceIP = "";
|
||||
# };
|
||||
|
||||
in
|
||||
syncthingNick
|
||||
# // syncthingStacie // syncthingGarnet
|
||||
165
modules/nixos/homelab/guests/vaultwarden/config/default.nix
Executable file
165
modules/nixos/homelab/guests/vaultwarden/config/default.nix
Executable file
|
|
@ -0,0 +1,165 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.vaultwarden;
|
||||
smtpCfg = instances.smtp;
|
||||
in
|
||||
{
|
||||
vaultwardenVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
host,
|
||||
mnt,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
config = {
|
||||
# Domain Configuration
|
||||
DOMAIN = "https://${host}";
|
||||
|
||||
# Email Configuration
|
||||
SMTP_AUTH_MECHANISM = "Plain";
|
||||
SMTP_EMBED_IMAGES = true;
|
||||
SMTP_FROM = smtpCfg.interfaces.interface0.email;
|
||||
SMTP_FROM_NAME = serviceCfg.label;
|
||||
SMTP_HOST = smtpCfg.interfaces.interface0.domain;
|
||||
SMTP_PORT = smtpCfg.ports.port0;
|
||||
SMTP_USERNAME = smtpCfg.interfaces.interface0.email;
|
||||
SMTP_SECURITY = "starttls";
|
||||
|
||||
# Security Configuration
|
||||
DISABLE_ADMIN_TOKEN = false;
|
||||
|
||||
# Event and Backup Management
|
||||
EVENTS_DAYS_RETAIN = 90;
|
||||
|
||||
# User Features
|
||||
SENDS_ALLOWED = true;
|
||||
SIGNUPS_VERIFY = true;
|
||||
WEB_VAULT_ENABLED = true;
|
||||
|
||||
# Rocket (Web Server) Settings
|
||||
ROCKET_ADDRESS = "0.0.0.0";
|
||||
ROCKET_PORT = serviceCfg.ports.port0;
|
||||
};
|
||||
|
||||
# Environment file with secrets (mounted from host)
|
||||
environmentFile = "/run/secrets/${user}-env";
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
587
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 1024;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-vw-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-vault";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/bitwarden_rs";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-env" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
45
modules/nixos/homelab/guests/vaultwarden/default.nix
Executable file
45
modules/nixos/homelab/guests/vaultwarden/default.nix
Executable file
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
flake,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake; }) vaultwardenVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) vaultwarden;
|
||||
|
||||
interface0Cfg = vaultwarden.interfaces.interface0;
|
||||
|
||||
vaultwardenNick = vaultwardenVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
|
||||
# vaultwardenStacie = vaultwardenVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id1;
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = vaultwarden.ssh1;
|
||||
# mnt = guestPath "stacie";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
# vaultwardenGarnet = vaultwardenVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id2;
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = vaultwarden.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
in
|
||||
vaultwardenNick
|
||||
# // vaultwardenStacie // vaultwardenGarnet
|
||||
82
modules/nixos/homelab/guests/website/config/default.nix
Executable file
82
modules/nixos/homelab/guests/website/config/default.nix
Executable file
|
|
@ -0,0 +1,82 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.website;
|
||||
in
|
||||
{
|
||||
websiteVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
package,
|
||||
}:
|
||||
{
|
||||
microvm.vms.${serviceCfg.name} = {
|
||||
autostart = true;
|
||||
config = {
|
||||
system.stateVersion = "25.05";
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
80
|
||||
];
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
environment.etc."website".source = package;
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."10-enp" = {
|
||||
matchConfig.Name = "enp0s3";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
gateway = [ "192.168.50.1" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts.":80".extraConfig = ''
|
||||
root * /etc/website
|
||||
file_server
|
||||
try_files {path} /index.html
|
||||
'';
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-ws-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
38
modules/nixos/homelab/guests/website/default.nix
Normal file
38
modules/nixos/homelab/guests/website/default.nix
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) websiteVM;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
websiteNick =
|
||||
let
|
||||
websitePkg = flake.self.packages.${pkgs.system}.website;
|
||||
interfaceCfg = instances.website.interfaces.interface0;
|
||||
in
|
||||
websiteVM {
|
||||
user = "uproot";
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
package = websitePkg;
|
||||
};
|
||||
|
||||
websiteProject =
|
||||
let
|
||||
websitePkg = flake.inputs.linkpage.packages.${pkgs.stdenv.hostPlatform.system}.websiteFrontend;
|
||||
interfaceCfg = instances.website.interfaces.interface1;
|
||||
in
|
||||
websiteVM {
|
||||
user = "project";
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
package = websitePkg;
|
||||
};
|
||||
|
||||
in
|
||||
websiteNick // websiteProject
|
||||
103
modules/nixos/homelab/guests/zookeeper/config/default.nix
Executable file
103
modules/nixos/homelab/guests/zookeeper/config/default.nix
Executable file
|
|
@ -0,0 +1,103 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.zookeeper;
|
||||
in
|
||||
{
|
||||
websiteVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
package,
|
||||
}:
|
||||
{
|
||||
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
systemd = {
|
||||
services = {
|
||||
zookeeper = {
|
||||
serviceConfig = {
|
||||
ExecStart = lib.getExe package;
|
||||
Restart = "always";
|
||||
RestartSec = 2;
|
||||
EnvironmentFile = "/run/secrets/${user}-env";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s3";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-qb-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-env" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
25
modules/nixos/homelab/guests/zookeeper/default.nix
Normal file
25
modules/nixos/homelab/guests/zookeeper/default.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) zookeeperVM;
|
||||
inherit (flake.config.services) instances;
|
||||
interfaceCfg = instances.zookeeper.interfaces.interface0;
|
||||
|
||||
zookeeperNick =
|
||||
let
|
||||
appPackage = flake.self.packages.${pkgs.system}.zookeeper;
|
||||
in
|
||||
zookeeperVM {
|
||||
user = "boon";
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
package = appPackage;
|
||||
};
|
||||
|
||||
in
|
||||
zookeeperNick
|
||||
Loading…
Add table
Add a link
Reference in a new issue