upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-08-08 21:04:38 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: wireguard test

Browse source
This commit is contained in:
Nick 2025-07-01 04:11:32 -05:00
parent 30712af182
commit b85ddb710d
23 changed files with 309 additions and 510 deletions
Download patch file Download diff file Expand all files Collapse all files

123
modules/nixos/services/firefly/default.nix
View file

@ -1,123 +0,0 @@
{ flake, config, ... }:
let
inherit (flake.config.people) user0;
inherit (flake.config.people.users.${user0}) email;
inherit (flake.config.services.instances) firefly-iii web;
inherit (flake.config.machines.devices) ceres;
service = firefly-iii;
localhost = web.localhost.address1;
host = service.domains.url0;
in
{
services = {
firefly-iii = {
enable = true;
virtualHost = host;
enableNginx = true;
settings = {
APP_KEY_FILE = config.sops.secrets."${service.name}-key".path;
SITE_OWNER = email.address0;
DB_DATABASE = "firefly";
DB_USERNAME = "firefly";
DB_PASSWORD_FILE = config.sops.secrets."${service.name}-pass".path;
TRUSTED_PROXIES = "**";
};
};
nginx = {
enable = true;
virtualHosts.${config.services.firefly-iii.virtualHost} = {
listen = [
{
addr = "0.0.0.0";
port = 8080;
}
];
};
};
caddy = {
virtualHosts = {
"${host}" = {
extraConfig = ''
encode gzip
reverse_proxy localhost:8080 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Ssl on
header_up Connection ""
timeout 240s
dial_timeout 240s
}
@session_cookie header Cookie *session*
handle @session_cookie {
header Cache-Control "no-cache, no-store, must-revalidate"
}
request_body {
max_size 64MB
}
tls ${service.ssl.cert} ${service.ssl.key}
'';
};
};
};
};
sops =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = service.name;
mode = "600";
};
in
{
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}-${secret}";
value = sopsPath secret;
})
[
"key"
"pass"
]
);
};
# fileSystems."/var/lib/${service.name}" = {
# device = service.paths.path0;
# fsType = "none";
# options = [
# "bind"
# ];
# depends = [
# ceres.storage0.mount
# ];
# };
users.users.${service.name}.extraGroups = [
"caddy"
];
systemd.tmpfiles.rules = [
# "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
];
networking = {
firewall = {
allowedTCPPorts = [
8080
service.ports.port0
];
};
};
}

72
modules/nixos/services/hLedger/default.nix
View file

@ -1,72 +0,0 @@
{
flake,
pkgs,
...
}:
let
inherit (flake.config.machines.devices)
ceres
;
inherit (flake.config.services.instances)
hledger
web
;
service = hledger;
localhost = web.localhost.address0;
in
{
services = {
hledger-web = {
enable = true;
host = localhost;
# baseUrl = "https://${host}";
stateDir = service.paths.path0;
port = service.ports.port0;
journalFiles = [
".hledger.journal"
];
allow = "edit";
};
};
environment = {
systemPackages = builtins.attrValues {
inherit (pkgs)
hledger
hledger-ui
;
};
};
users = {
users.${service.name} = {
isSystemUser = true;
group = service.name;
home = service.paths.path0;
};
groups.${service.name} = { };
};
fileSystems."/var/lib/${service.name}" = {
device = service.paths.path0;
fsType = "none";
options = [
"bind"
];
depends = [
ceres.storage0.mount
];
};
systemd.tmpfiles.rules = [
"Z ${service.paths.path0} 0755 ${service.name} ${service.name} -"
];
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0
];
};
};
}

83
modules/nixos/services/kanboard/default.nix
View file

@ -1,83 +0,0 @@
{ flake, ... }:
let
inherit (flake.config.services.instances) kanboard web;
service = kanboard;
localhost = web.localhost.address0;
host = service.domains.url0;
in
{
services = {
kanboard = {
enable = true;
domain = host;
nginx = null;
# dataDir = "/var/lib/${service.name}";
# settings = {
# MAIL_FROM = service.email.address0;
# # HTTP_PROXY_HOSTNAME = host;
# HTTP_PROXY_PORT = service.ports.port0;
# MAIL_TRANSPORT = "smtp";
# MAIL_SMTP_HOSTNAME = smtp.hostname;
# MAIL_SMTP_PORT = smtp.ports.port0;
# MAIL_SMTP_USERNAME = service.email.address0;
# MAIL_SMTP_PASSWORD = config.sops.secrets."${service.name}-smtp".path;
# MAIL_SMTP_ENCRYPTION = "ssl";
# };
};
caddy = {
virtualHosts = {
"${host}" = {
extraConfig = ''
reverse_proxy ${localhost}:${toString service.ports.port0}
tls ${service.ssl.cert} ${service.ssl.key}
'';
};
};
};
};
sops =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = service.name;
mode = "600";
};
in
{
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}-${secret}";
value = sopsPath secret;
})
[
"smtp"
]
);
};
# fileSystems."/var/lib/${service.name}" = {
# device = service.paths.path0;
# fsType = "none";
# options = [
# "bind"
# ];
# depends = [
# ceres.storage0.mount
# ];
# };
systemd.tmpfiles.rules = [
# "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
];
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0
];
};
};
}

65
modules/nixos/services/searx/config/engines.nix Normal file
View file

@ -0,0 +1,65 @@
{ lib, ... }:
lib.mapAttrsToList (name: value: { inherit name; } // value) {
"duckduckgo".disabled = false;
"brave".disabled = false;
"bing".disabled = false;
"mojeek".disabled = true;
"mwmbl".disabled = false;
"mwmbl".weight = 0.4;
"qwant".disabled = true;
"crowdview".disabled = false;
"crowdview".weight = 0.5;
"curlie".disabled = true;
"ddg definitions".disabled = false;
"ddg definitions".weight = 2;
"wikibooks".disabled = false;
"wikidata".disabled = false;
"wikiquote".disabled = true;
"wikisource".disabled = true;
"wikispecies".disabled = false;
"wikispecies".weight = 0.5;
"wikiversity".disabled = false;
"wikiversity".weight = 0.5;
"wikivoyage".disabled = false;
"wikivoyage".weight = 0.5;
"currency".disabled = true;
"dictzone".disabled = true;
"lingva".disabled = true;
"bing images".disabled = false;
"brave.images".disabled = false;
"duckduckgo images".disabled = false;
"google images".disabled = false;
"qwant images".disabled = true;
"1x".disabled = true;
"artic".disabled = false;
"deviantart".disabled = false;
"flickr".disabled = true;
"imgur".disabled = false;
"library of congress".disabled = false;
"material icons".disabled = true;
"material icons".weight = 0.2;
"openverse".disabled = false;
"pinterest".disabled = true;
"svgrepo".disabled = false;
"unsplash".disabled = false;
"wallhaven".disabled = false;
"wikicommons.images".disabled = false;
"yacy images".disabled = true;
"bing videos".disabled = false;
"brave.videos".disabled = true;
"duckduckgo videos".disabled = true;
"google videos".disabled = false;
"qwant videos".disabled = false;
"dailymotion".disabled = true;
"google play movies".disabled = true;
"invidious".disabled = true;
"odysee".disabled = true;
"peertube".disabled = true;
"piped".disabled = true;
"rumble".disabled = false;
"sepiasearch".disabled = false;
"vimeo".disabled = true;
"youtube".disabled = false;
"brave.news".disabled = true;
"google news".disabled = true;
}

8
modules/nixos/services/searx/config/general.nix Normal file
View file

@ -0,0 +1,8 @@
{
debug = false;
instance_name = "SearXNG Instance";
donation_url = false;
contact_url = false;
privacypolicy_url = false;
enable_metrics = false;
}

7
modules/nixos/services/searx/config/outgoing.nix Normal file
View file

@ -0,0 +1,7 @@
{
request_timeout = 5.0;
max_request_timeout = 15.0;
pool_connections = 100;
pool_maxsize = 15;
enable_http2 = true;
}

9
modules/nixos/services/searx/config/plugins.nix Normal file
View file

@ -0,0 +1,9 @@
[
"Basic Calculator"
"Hash plugin"
"Tor check plugin"
"Open Access DOI rewrite"
"Hostnames plugin"
"Unit converter plugin"
"Tracker URL remover"
]

7
modules/nixos/services/searx/config/search.nix Normal file
View file

@ -0,0 +1,7 @@
{
safe_search = 0;
autocomplete_min = 2;
autocomplete = "duckduckgo";
ban_time_on_fail = 5;
max_ban_time_on_fail = 120;
}

26
modules/nixos/services/searx/config/server.nix Normal file
View file

@ -0,0 +1,26 @@
{
flake,
config,
configHelpers,
...
}:
let
inherit (flake.config.machines.devices) ceres;
in
{
port = configHelpers.service.ports.port0;
bind_address = configHelpers.localhost;
secret_key = config.sops.secrets.searx-key.path;
limiter = false;
public_instance = false;
image_proxy = true;
method = "GET";
}
// (
if configHelpers.hostname == ceres.name then
{
base_url = "https://${configHelpers.host}";
}
else
{ }
)

11
modules/nixos/services/searx/config/ui.nix Normal file
View file

@ -0,0 +1,11 @@
{
static_use_hash = true;
default_locale = "en";
query_in_title = true;
infinite_scroll = true;
center_alignment = true;
default_theme = "simple";
theme_args.simple_style = "auto";
search_on_category_select = true;
hotkeys = "vim";
}

166
modules/nixos/services/searx/default.nix
View file

@ -7,10 +7,23 @@
let
inherit (flake.config.machines.devices) ceres;
inherit (flake.config.services.instances) searx web;
service = searx;
hostname = config.networking.hostName;
localhost = web.localhost.address0;
host = service.domains.url0;
configHelpers = {
service = searx;
hostname = config.networking.hostName;
localhost = web.localhost.address0;
host = configHelpers.service.domains.url0;
};
configPath = ./config;
configImports = {
general = import (configPath + /general.nix);
ui = import (configPath + /ui.nix);
search = import (configPath + /search.nix);
server = import (configPath + /server.nix) { inherit config flake configHelpers; };
engines = import (configPath + /engines.nix) { inherit lib; };
outgoing = import (configPath + /outgoing.nix);
enabled_plugins = import (configPath + /plugins.nix);
};
in
{
services =
@ -20,150 +33,25 @@ in
redisCreateLocally = true;
uwsgiConfig = {
socket = "/run/searx/searx.sock";
http = ":${builtins.toString service.ports.port0}";
http = ":${builtins.toString configHelpers.service.ports.port0}";
chmod-socket = "660";
};
settings = {
general = {
debug = false;
instance_name = "SearXNG Instance";
donation_url = false;
contact_url = false;
privacypolicy_url = false;
enable_metrics = false;
};
ui = {
static_use_hash = true;
default_locale = "en";
query_in_title = true;
infinite_scroll = true;
center_alignment = true;
default_theme = "simple";
theme_args.simple_style = "auto";
search_on_category_select = true;
hotkeys = "vim";
};
search = {
safe_search = 0;
autocomplete_min = 2;
autocomplete = "duckduckgo";
ban_time_on_fail = 5;
max_ban_time_on_fail = 120;
};
server =
{
port = service.ports.port0;
bind_address = localhost;
secret_key = config.sops.secrets.searx-key.path;
limiter = false;
public_instance = false;
image_proxy = true;
method = "GET";
}
// (
if hostname == ceres.name then
{
base_url = "https://${host}";
}
else
{ }
);
engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
"duckduckgo".disabled = false;
"brave".disabled = false;
"bing".disabled = false;
"mojeek".disabled = true;
"mwmbl".disabled = false;
"mwmbl".weight = 0.4;
"qwant".disabled = true;
"crowdview".disabled = false;
"crowdview".weight = 0.5;
"curlie".disabled = true;
"ddg definitions".disabled = false;
"ddg definitions".weight = 2;
"wikibooks".disabled = false;
"wikidata".disabled = false;
"wikiquote".disabled = true;
"wikisource".disabled = true;
"wikispecies".disabled = false;
"wikispecies".weight = 0.5;
"wikiversity".disabled = false;
"wikiversity".weight = 0.5;
"wikivoyage".disabled = false;
"wikivoyage".weight = 0.5;
"currency".disabled = true;
"dictzone".disabled = true;
"lingva".disabled = true;
"bing images".disabled = false;
"brave.images".disabled = false;
"duckduckgo images".disabled = false;
"google images".disabled = false;
"qwant images".disabled = true;
"1x".disabled = true;
"artic".disabled = false;
"deviantart".disabled = false;
"flickr".disabled = true;
"imgur".disabled = false;
"library of congress".disabled = false;
"material icons".disabled = true;
"material icons".weight = 0.2;
"openverse".disabled = false;
"pinterest".disabled = true;
"svgrepo".disabled = false;
"unsplash".disabled = false;
"wallhaven".disabled = false;
"wikicommons.images".disabled = false;
"yacy images".disabled = true;
"bing videos".disabled = false;
"brave.videos".disabled = true;
"duckduckgo videos".disabled = true;
"google videos".disabled = false;
"qwant videos".disabled = false;
"dailymotion".disabled = true;
"google play movies".disabled = true;
"invidious".disabled = true;
"odysee".disabled = true;
"peertube".disabled = true;
"piped".disabled = true;
"rumble".disabled = false;
"sepiasearch".disabled = false;
"vimeo".disabled = true;
"youtube".disabled = false;
"brave.news".disabled = true;
"google news".disabled = true;
};
outgoing = {
request_timeout = 5.0;
max_request_timeout = 15.0;
pool_connections = 100;
pool_maxsize = 15;
enable_http2 = true;
};
enabled_plugins = [
"Basic Calculator"
"Hash plugin"
"Tor check plugin"
"Open Access DOI rewrite"
"Hostnames plugin"
"Unit converter plugin"
"Tracker URL remover"
];
};
settings = configImports;
};
}
// (
if hostname == ceres.name then
if configHelpers.hostname == ceres.name then
{
caddy = {
virtualHosts = {
"${host}" = {
"${configHelpers.host}" = {
extraConfig = ''
redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301
reverse_proxy ${localhost}:${toString service.ports.port0}
reverse_proxy ${configHelpers.localhost}:${toString configHelpers.service.ports.port0}
tls ${service.ssl.cert} ${service.ssl.key}
tls ${configHelpers.service.ssl.cert} ${configHelpers.service.ssl.key}
'';
};
};
@ -179,8 +67,8 @@ in
sops =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = service.name;
path = "${configHelpers.service.sops.path0}/${configHelpers.service.name}-${secret}";
owner = configHelpers.service.name;
mode = "600";
};
in
@ -188,7 +76,7 @@ in
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}-${secret}";
name = "${configHelpers.service.name}-${secret}";
value = sopsPath secret;
})
[
@ -200,7 +88,7 @@ in
networking = {
firewall = {
allowedTCPPorts = [
service.ports.port0
configHelpers.service.ports.port0
];
};
};

32
modules/nixos/services/wireGuard/default.nix
View file

@ -2,7 +2,6 @@
let
inherit (flake.config.services.instances) wireGuard;
service = wireGuard;
wireGuardInterface =
{
secret,
@ -25,7 +24,6 @@ let
];
};
};
interfaces = [
{
secret = "CA363";
@ -48,20 +46,24 @@ let
endpoint = "139.28.218.130:51820";
}
];
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = "root";
mode = "600";
};
in
{
networking.wg-quick.interfaces = builtins.listToAttrs (map wireGuardInterface interfaces);
networking = {
wg-quick.interfaces = builtins.listToAttrs (map wireGuardInterface interfaces);
};
sops.secrets = builtins.listToAttrs (
map (interface: {
name = "${service.name}-${interface.secret}";
value = sopsPath interface.secret;
}) interfaces
);
sops.secrets =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = "root";
mode = "600";
};
in
builtins.listToAttrs (
(map (interface: {
name = "${service.name}-${interface.secret}";
value = sopsPath interface.secret;
}) interfaces)
);
}