upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-14 02:20:53 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

feat: uncucked server

Browse source
This commit is contained in:
Nick 2025-12-10 15:58:39 -06:00
parent 8649008c93
commit d32ece51bf
22 changed files with 273 additions and 112 deletions
Download patch file Download diff file Expand all files Collapse all files

12
modules/nixos/default.nix
View file

@ -56,17 +56,19 @@ in
acme
caddy
comfyui
forgejoCeres
impermanence
jellyfinCeres
lix
mastodonCeres
microvm
restic
# wireguard
forgejoCeres
jellyfinCeres
linkpageCeres
mastodonCeres
minecraftCeres
opencloudCeres
websiteCeres
qbittorrentCeres
restic
websiteCeres
sambaCeres
zookeeperCeres
;

7
modules/nixos/homelab/caddy/config/qbittorrent/default.nix
View file

@ -29,11 +29,4 @@ in
};
};
};
sops.secrets = {
"caddy/share-auth" = {
owner = "caddy";
group = "caddy";
mode = "0400";
};
};
}

42
modules/nixos/homelab/caddy/config/vaultwarden/default.nix
View file

@ -6,29 +6,49 @@
let
inherit (flake.config.services) instances;
serviceCfg = instances.vaultwarden;
interfaceCfg = serviceCfg.interfaces.interface0;
interface0Cfg = serviceCfg.interfaces.interface0;
interface1Cfg = serviceCfg.interfaces.interface1;
host0 = interface0Cfg.domain;
host1 = "${interface1Cfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
dns0 = instances.web.dns.provider0;
host = interfaceCfg.domain;
dns0Path = "dns/${dns0}";
dns1 = instances.web.dns.provider1;
dns1Path = "dns/${dns1}";
in
{
security.acme.certs."${host}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
security.acme.certs = {
"${host0}" = {
dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy";
};
"${host1}" = {
dnsProvider = dns1;
environmentFile = config.sops.secrets.${dns1Path}.path;
group = "caddy";
};
};
services.caddy.virtualHosts = {
"${host}" = {
"${host0}" = {
extraConfig = ''
reverse_proxy ${interfaceCfg.microvm.ip}:${toString serviceCfg.ports.port0} {
reverse_proxy ${interface0Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls ${interfaceCfg.ssl.cert} ${interfaceCfg.ssl.key}
tls ${interface0Cfg.ssl.cert} ${interface0Cfg.ssl.key}
encode zstd gzip
'';
};
"${host1}" = {
extraConfig = ''
reverse_proxy ${interface1Cfg.microvm.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host}
}
tls /var/lib/acme/${host1}/fullchain.pem /var/lib/acme/${host1}/key.pem
encode zstd gzip
'';
};
};
}

5
modules/nixos/homelab/caddy/default.nix
View file

@ -18,11 +18,6 @@ in
enable = true;
};
systemd.tmpfiles.rules = [
"d /run/secrets/caddy 755 caddy caddy -"
"d /var/log/caddy 755 caddy caddy -"
];
networking = {
firewall = {
allowedTCPPorts = [

2
modules/nixos/homelab/guests/jellyfin/config/default.nix
View file

@ -103,7 +103,7 @@ in
{
type = "user";
id = "vmuser-cloud";
mac = user;
mac = userMac;
}
];
forwardPorts = [

91
modules/nixos/homelab/guests/linkpage/config/default.nix Executable file
View file

@ -0,0 +1,91 @@
{
flake,
...
}:
let
inherit (flake.config.people) user0;
in
{
websiteVM =
{
user,
ip,
mac,
ssh,
userMac,
package,
}:
{
microvm.vms."${user}-website" = {
autostart = true;
config = {
system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [
22
80
];
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
environment.etc."website".source = package;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = {
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s3";
addresses = [
{ Address = "${ip}/24"; }
];
gateway = [ "192.168.50.1" ];
};
};
};
services.caddy = {
enable = true;
virtualHosts.":80".extraConfig = ''
root * /etc/website
file_server
try_files {path} /index.html
'';
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-ws-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-web";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}
];
};
};
};
};
}

11
modules/nixos/homelab/guests/linkpage/default.nix Executable file
View file

@ -0,0 +1,11 @@
let
importList =
let
content = builtins.readDir ./.;
dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
in
map (name: ./. + "/${name}") dirContent;
in
{
imports = importList;
}

25
modules/nixos/homelab/guests/linkpage/linkpageCeres/default.nix Normal file
View file

@ -0,0 +1,25 @@
{
flake,
config,
pkgs,
...
}:
let
inherit (import ../config { inherit flake; }) websiteVM;
inherit (flake.config.services) instances;
websiteProject =
let
websitePkg = flake.inputs.linkpage.packages.${pkgs.stdenv.hostPlatform.system}.websiteFrontend;
interfaceCfg = instances.website.interfaces.interface1;
in
websiteVM {
user = "link";
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
ssh = interfaceCfg.microvm.ssh;
userMac = interfaceCfg.microvm.macUser;
package = websitePkg;
};
in
websiteProject

4
modules/nixos/homelab/guests/mastodon/config/default.nix
View file

@ -262,7 +262,7 @@ in
cp /run/secrets/${user}-database /etc/mastodon-secrets/${user}-database
cp /run/secrets/${user}-redis /etc/mastodon-secrets/${user}-redis
cp /run/secrets/${user}-smtp /etc/mastodon-secrets/${user}-smtp
cp /run/secrets/${user}-fedifetcher-token /etc/mastodon-secrets/${user}-fedifetcher
cp /run/secrets/${user}-fedifetcher /etc/mastodon-secrets/${user}-fedifetcher
chmod 755 /etc/mastodon-secrets
chmod 644 /etc/mastodon-secrets/*
'';
@ -450,7 +450,7 @@ in
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/var/lib/postgresql";

2
modules/nixos/homelab/guests/minecraft/config/default.nix
View file

@ -24,7 +24,7 @@ in
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
"${serviceCfg.name}-world${worldNumber}" = {
autostart = true;
restartIfChanged = true;
config = {

23
modules/nixos/homelab/guests/qbittorrent/config/default.nix
View file

@ -152,7 +152,7 @@ in
};
Downloads = {
SavePath = "${mnt}/${serviceCfg.name}/downloads";
SavePath = "/var/lib/${serviceCfg.name}-downloads";
TempPathEnabled = false;
PreAllocation = false;
};
@ -172,15 +172,14 @@ in
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s5";
matchConfig.Name = "enp0s6";
addresses = [ { Address = "${ip}/24"; } ];
gateway = [ "192.168.50.1" ];
};
};
tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 755 ${serviceCfg.name} ${serviceCfg.name} -"
"d ${mnt}/${serviceCfg.name}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}-downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
];
services = {
@ -366,7 +365,13 @@ in
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}";
tag = "${serviceCfg.name}_data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/var/lib/${serviceCfg.name}-downloads";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/downloads";
tag = "${serviceCfg.name}_${user}_downloads";
}
{
mountPoint = "/run/secrets";
@ -391,6 +396,11 @@ in
};
sops.secrets = {
"caddy/share-auth" = {
owner = "caddy";
group = "caddy";
mode = "0400";
};
"torrent/${user}-wireguard-pass" = {
owner = "root";
mode = "0400";
@ -410,6 +420,9 @@ in
tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0755 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/downloads 0755 microvm wheel - -"
# "d /run/secrets/qbittorrent/caddy 755 caddy caddy -"
# "d /var/log/caddy 755 caddy caddy -"
];
};

25
modules/nixos/homelab/guests/vaultwarden/vaultwardenCeres/default.nix Normal file
View file

@ -0,0 +1,25 @@
{
flake,
labHelpers,
...
}:
let
inherit (import ../../../helpers.nix { inherit flake; }) labHelpers;
inherit (labHelpers) mntPath;
inherit (import ../config { inherit flake; }) vaultwardenVM;
inherit (flake.config.people) user0;
inherit (flake.config.services.instances) vaultwarden;
interface0Cfg = vaultwarden.interfaces.interface1;
vaultwardenNick = vaultwardenVM {
user = user0;
ip = interface0Cfg.microvm.ip;
mac = interface0Cfg.microvm.mac;
userMac = interface0Cfg.microvm.macUser;
ssh = interface0Cfg.microvm.ssh;
mnt = mntPath;
host = "${interface0Cfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
};
in
vaultwardenNick

17
modules/nixos/homelab/guests/website/config/default.nix
View file

@ -1,7 +1,5 @@
{
config,
flake,
pkgs,
...
}:
let
@ -15,11 +13,12 @@ in
user,
ip,
mac,
ssh,
userMac,
package,
}:
{
microvm.vms.${serviceCfg.name} = {
microvm.vms."${serviceCfg.name}" = {
autostart = true;
config = {
system.stateVersion = "25.05";
@ -66,6 +65,18 @@ in
id = "vm-ws-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-web";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{

17
modules/nixos/homelab/guests/website/websiteCeres/default.nix
View file

@ -5,7 +5,7 @@
...
}:
let
inherit (import ../config { inherit flake config pkgs; }) websiteVM;
inherit (import ../config { inherit flake; }) websiteVM;
inherit (flake.config.services) instances;
websiteUpRoot =
@ -17,21 +17,10 @@ let
user = "uproot";
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
ssh = interfaceCfg.microvm.ssh;
userMac = interfaceCfg.microvm.macUser;
package = websitePkg;
};
websiteProject =
let
websitePkg = flake.inputs.linkpage.packages.${pkgs.stdenv.hostPlatform.system}.websiteFrontend;
interfaceCfg = instances.website.interfaces.interface1;
in
websiteVM {
user = "project";
ip = interfaceCfg.microvm.ip;
mac = interfaceCfg.microvm.mac;
userMac = interfaceCfg.microvm.macUser;
package = websitePkg;
};
in
websiteProject // websiteUpRoot
websiteUpRoot

4
modules/nixos/services/wireguard/default.nix
View file

@ -17,9 +17,9 @@ in
publicKey = "fs58+Kz+eG9qAXvvMB2NkW+wa88yP61uam4HHWaBJVw=";
allowedIPs = [
"${ceres.wireguard.ip0}/32"
"${instances.web.localhost.address4}/24"
"${instances.web.addresses.address4}/24"
];
endpoint = "${instances.web.remotehost.address0}:${builtins.toString service.ports.port1}";
endpoint = "${instances.web.addresses.address0}:${builtins.toString service.ports.port1}";
persistentKeepalive = 25;
}
];