upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-07 05:27:13 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: jellyfin microVM

Browse source
This commit is contained in:
Nick 2025-11-08 23:12:57 -06:00
parent e25c1a2e06
commit 89cb74e4b7
4 changed files with 79 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/config/instances/config/jellyfin.nix
View file

@ -6,12 +6,10 @@ let
varPath varPath
mntPath mntPath
cachePath cachePath
secretPath
; ;
label = "Jellyfin"; label = "Jellyfin";
name = "jellyfin"; name = "jellyfin";
domain = "${name}.${domain0}"; domain = "${name}.${domain0}";
secrets = "${secretPath}/${name}";
ssl = "${sslPath}/${name}.${domain0}"; ssl = "${sslPath}/${name}.${domain0}";
in in
{ {
@ -41,8 +39,8 @@ in
interface = { interface = {
id = "vm-${name}"; id = "vm-${name}";
mac = "02:00:00:00:00:52"; mac = "02:00:00:00:00:52";
idUser = "vmuser-jellyfin"; idUser = "vmuser-${name}";
macUser = "02:00:00:00:00:04"; macUser = "03:00:00:00:00:04";
ip = "192.168.50.152"; ip = "192.168.50.152";
gate = "192.168.50.1"; gate = "192.168.50.1";
ssh = 2202; ssh = 2202;
@ -59,7 +57,4 @@ in
mntPaths = { mntPaths = {
path0 = "${mntPath}/${name}"; path0 = "${mntPath}/${name}";
}; };
secretPaths = {
path0 = secrets;
};
} }

51
modules/nixos/services/jellyfin/default.nix
View file

@ -6,24 +6,15 @@
let let
inherit (flake.config.people) user0; inherit (flake.config.people) user0;
inherit (flake.config.services) instances; inherit (flake.config.services) instances;
serviceCfg = flake.config.services.instances.jellyfin; serviceCfg = instances.jellyfin;
hostCfg = flake.config.services.instances.web; hostCfg = instances.web;
host = serviceCfg.domains.url0;
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
in in
{ {
users.users.caddy.extraGroups = [ "acme" ];
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
microvm.vms.jellyin = { microvm.vms.jellyin = {
autostart = true; autostart = true;
restartIfChanged = true; restartIfChanged = true;
config = { config = {
system.stateVersion = "24.05"; system.stateVersion = "24.05";
@ -33,11 +24,6 @@ in
jellyfin = { jellyfin = {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
user = user0;
};
jellyseerr = {
openFirewall = true;
enable = true;
}; };
openssh = { openssh = {
@ -50,10 +36,12 @@ in
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22
serviceCfg.ports.port0 serviceCfg.ports.port0
serviceCfg.ports.port1 serviceCfg.ports.port1
serviceCfg.ports.port2 serviceCfg.ports.port2
]; ];
systemd.network = { systemd.network = {
enable = true; enable = true;
networks."20-lan" = { networks."20-lan" = {
@ -75,6 +63,7 @@ in
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 4; vcpu = 4;
mem = 4096; mem = 4096;
@ -91,6 +80,7 @@ in
mac = serviceCfg.interface.macUser; mac = serviceCfg.interface.macUser;
} }
]; ];
forwardPorts = [ forwardPorts = [
{ {
from = "host"; from = "host";
@ -110,37 +100,50 @@ in
mountPoint = serviceCfg.varPaths.path0; mountPoint = serviceCfg.varPaths.path0;
proto = "virtiofs"; proto = "virtiofs";
source = serviceCfg.mntPaths.path0; source = serviceCfg.mntPaths.path0;
tag = "service_data"; tag = "${serviceCfg.name}_data";
} }
{ {
mountPoint = serviceCfg.varPaths.path1; mountPoint = serviceCfg.varPaths.path1;
proto = "virtiofs"; proto = "virtiofs";
source = "${serviceCfg.mntPaths.path0}/cache"; source = "${serviceCfg.mntPaths.path0}/cache";
tag = "service_cache"; tag = "${serviceCfg.name}_cache";
} }
]; ];
}; };
}; };
}; };
systemd.tmpfiles.rules = [ security.acme.certs."${host}" = {
"d ${serviceCfg.mntPaths.path0} 0755 root root -" dnsProvider = dns0;
]; environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
services = { services = {
caddy = { caddy = {
virtualHosts = { virtualHosts = {
"${host}" = { "${host}" = {
extraConfig = '' extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
redir /.well-known/carddav /remote.php/dav/ 301 redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301 redir /.well-known/caldav /remote.php/dav/ 301
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip
''; '';
}; };
}; };
}; };
}; };
users.users.caddy.extraGroups = [ "acme" ];
systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 root root -"
"d ${serviceCfg.mntPaths.path0}/cache 0755 root root -"
];
} }

26
modules/nixos/services/vaultwarden/default.nix
View file

@ -6,10 +6,11 @@
let let
inherit (flake.config.people) user0; inherit (flake.config.people) user0;
inherit (flake.config.services) instances; inherit (flake.config.services) instances;
serviceCfg = flake.config.services.instances.vaultwarden; serviceCfg = instances.vaultwarden;
smtpCfg = flake.config.services.instances.smtp; smtpCfg = instances.smtp;
host = serviceCfg.domains.url0; hostCfg = instances.web;
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
in in
{ {
@ -21,7 +22,8 @@ in
system.stateVersion = "24.05"; system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg"; time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services.vaultwarden = { services = {
vaultwarden = {
enable = true; enable = true;
dbBackend = "sqlite"; dbBackend = "sqlite";
config = { config = {
@ -57,14 +59,14 @@ in
# Environment file with secrets (mounted from host) # Environment file with secrets (mounted from host)
environmentFile = "/run/secrets/${serviceCfg.name}/env"; environmentFile = "/run/secrets/${serviceCfg.name}/env";
}; };
openssh = {
services.openssh = {
enable = true; enable = true;
settings = { settings = {
PasswordAuthentication = false; PasswordAuthentication = false;
PermitRootLogin = "prohibit-password"; PermitRootLogin = "prohibit-password";
}; };
}; };
};
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 # SSH 22 # SSH
@ -79,10 +81,12 @@ in
enable = true; enable = true;
networks."20-lan" = { networks."20-lan" = {
matchConfig.Name = "enp0s5"; matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ]; addresses = [
{ Address = "${serviceCfg.interface.ip}/24"; }
];
routes = [ routes = [
{ {
Destination = "0.0.0.0/0"; Destination = "${hostCfg.localhost.address1}/0";
Gateway = serviceCfg.interface.gate; Gateway = serviceCfg.interface.gate;
} }
]; ];
@ -97,7 +101,7 @@ in
microvm = { microvm = {
vcpu = 2; vcpu = 2;
mem = 1024; mem = 3072;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {
@ -111,6 +115,7 @@ in
mac = serviceCfg.interface.macUser; mac = serviceCfg.interface.macUser;
} }
]; ];
forwardPorts = [ forwardPorts = [
{ {
from = "host"; from = "host";
@ -118,6 +123,7 @@ in
guest.port = 22; guest.port = 22;
} }
]; ];
shares = [ shares = [
{ {
mountPoint = "/nix/.ro-store"; mountPoint = "/nix/.ro-store";
@ -154,7 +160,9 @@ in
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} { reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host} header_up X-Real-IP {remote_host}
} }
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip encode zstd gzip
''; '';
}; };

1
systems/ceres/config/networking.nix
View file

@ -1,5 +1,4 @@
{ {
lib,
flake, flake,
... ...
}: }: