upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-14 10:30:52 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up nas structure

Browse source
This commit is contained in:
Nick 2025-12-08 03:32:04 -06:00
parent 312c52d613
commit e341e5878f
19 changed files with 1106 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

92
modules/nixos/nas/default.nix
View file

@ -1,18 +1,100 @@
{
flake,
config,
pkgs,
lib,
...
}:
let
syncthing = import ./syncthing { inherit flake; };
photoprism = import ./photoprism { inherit flake lib; };
opencloud = import ./opencloud { inherit flake pkgs; };
inherit (flake.config.people) user0;
nasHelpers = {
ipAddress = ip: "192.168.50.${ip}";
guestPath = user: "/mnt/storage/users/${user}/guests";
docsPath = user: "/mnt/storage/users/${user}/home/docs";
mediaPath = user: "/mnt/storage/users/${user}/home/media";
miscPath = user: "/mnt/storage/users/${user}/home/misc";
firefly = {
id0 = 70;
id1 = 71;
id2 = 72;
ssh0 = 2570;
ssh1 = 2571;
ssh2 = 2572;
};
onlyoffice = {
id0 = 73;
id1 = 74;
id2 = 75;
ssh0 = 2573;
ssh1 = 2574;
ssh2 = 2575;
};
opencloud = {
id0 = 76;
id1 = 77;
id2 = 78;
ssh0 = 2576;
ssh1 = 2577;
ssh2 = 2578;
};
photoprism = {
id0 = 79;
id1 = 80;
id2 = 81;
ssh0 = 2579;
ssh1 = 2580;
ssh2 = 2581;
};
syncthing = {
id0 = 82;
id1 = 83;
id2 = 84;
ssh0 = 2582;
ssh1 = 2583;
ssh2 = 2584;
};
vaultwarden = {
id0 = 85;
id1 = 86;
id2 = 87;
ssh0 = 2585;
ssh1 = 2586;
ssh2 = 2587;
};
};
firefly-iii = import ./guests/firefly-iii {
inherit
nasHelpers
config
flake
pkgs
;
};
opencloud = import ./guests/opencloud { inherit nasHelpers flake pkgs; };
photoprism = import ./guests/photoprism { inherit nasHelpers flake lib; };
syncthing = import ./guests/syncthing { inherit nasHelpers flake; };
vaultwarden = import ./guests/vaultwarden { inherit nasHelpers flake; };
in
{
imports = [
syncthing
photoprism
firefly-iii
opencloud
photoprism
syncthing
vaultwarden
];
systemd.tmpfiles.rules =
let
inherit (nasHelpers) docsPath mediaPath miscPath;
homePaths = user: [
"d ${docsPath user} 0751 microvm wheel - -"
"d ${mediaPath user} 0751 microvm wheel - -"
"d ${miscPath user} 0751 microvm wheel - -"
];
in
homePaths user0;
}

243
modules/nixos/nas/guests/firefly-iii/config/default.nix Normal file
View file

@ -0,0 +1,243 @@
{
flake,
config,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = {
name = "firefly-iii";
};
smtpCfg = instances.smtp;
in
{
fireflyVM =
{
user,
ip,
mac,
userMac,
ssh,
host,
owner,
mnt,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
firefly-iii = {
enable = true;
enableNginx = false;
poolConfig = {
"listen.owner" = config.services.caddy.user;
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 4;
"pm.max_requests" = 500;
};
settings = {
APP_URL = "https://${host}";
APP_KEY_FILE = "/etc/firefly-secrets/pass";
DB_PASSWORD_FILE = "/etc/firefly-secrets/data";
DB_CONNECTION = "pgsql";
DB_HOST = "/run/postgresql";
DB_DATABASE = "firefly-iii";
DB_USERNAME = "firefly-iii";
MAIL_MAILER = smtpCfg.name;
MAIL_HOST = smtpCfg.hostname;
MAIL_PORT = smtpCfg.ports.port0;
MAIL_FROM = smtpCfg.email.address0;
MAIL_USERNAME = smtpCfg.email.address0;
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/smtp";
MAIL_ENCRYPTION = "tls";
SITE_OWNER = owner;
};
};
phpfpm.pools.firefly-iii.phpEnv = {
TRUSTED_PROXIES = "*";
APP_URL = "https://${host}";
};
firefly-iii-data-importer = {
enable = true;
};
caddy = {
enable = true;
virtualHosts.":80" = {
extraConfig = ''
root * ${config.services.firefly-iii.package}/public
file_server
encode gzip
php_fastcgi unix//run/phpfpm/firefly-iii.sock {
env HTTPS {http.request.header.X-Forwarded-Proto}
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
}
'';
};
};
postgresql = {
enable = true;
ensureDatabases = [ "firefly-iii" ];
ensureUsers = [
{
name = "firefly-iii";
ensureDBOwnership = true;
}
];
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22
587
8084
8081
];
systemd = {
services = {
caddy = {
after = [ "phpfpm-firefly-iii.service" ];
requires = [ "phpfpm-firefly-iii.service" ];
};
fix-secrets-permissions = {
description = "Fix secrets permissions for firefly-iii";
wantedBy = [ "multi-user.target" ];
before = [
"firefly-iii-setup.service"
"phpfpm-firefly-iii.service"
];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/firefly-secrets
cp /run/secrets/${user}-pass /etc/firefly-secrets/${user}-pass
cp /run/secrets/${user}-data /etc/firefly-secrets/${user}-data
cp /run/secrets/${user}-smtp /etc/firefly-secrets/${user}-smtp
chmod 755 /etc/firefly-secrets
chmod 644 /etc/firefly-secrets/*
'';
};
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${ip}/24"; }
];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-ff-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-firefly";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/config";
tag = "${serviceCfg.name}_${user}_config";
}
{
mountPoint = "/var/lib/postgresql";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
];
sops = {
secrets = builtins.listToAttrs (
map
(secret: {
name = "${serviceCfg.name}/${user}-${secret}";
value = {
owner = "root";
group = "root";
mode = "0644";
};
})
[
"pass"
"data"
"smtp"
]
);
};
};
}

53
modules/nixos/nas/guests/firefly-iii/default.nix Normal file
View file

@ -0,0 +1,53 @@
{
config,
flake,
pkgs,
nasHelpers,
...
}:
let
inherit (import ./config { inherit config flake pkgs; }) fireflyVM;
inherit (nasHelpers) ipAddress guestPath firefly;
inherit (flake.config.people) user0;
inherit (flake.config.people.users.${user0}) email;
inherit (flake.config.services) instances;
id0 = builtins.toString firefly.id0;
id1 = builtins.toString firefly.id1;
id2 = builtins.toString firefly.id2;
fireflyNick = fireflyVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = firefly.ssh0;
host = instances.firefly-iii.domains.url0;
mnt = guestPath user0;
owner = email.address2;
};
# fireflyStacie = fireflyVM {
# user = "stacie";
# ip = ipAddress (id1);
# mac = "02:00:00:00:${id1}:${id1}";
# userMac = "02:00:00:00:00:${id1}";
# ssh = fireflyEris.ssh1;
# host = "";
# mnt = guestPath "stacie";
# owner = "";
# };
# fireflyGarnet = fireflyVM {
# user = "garnet";
# ip = ipAddress (id2);
# mac = "02:00:00:00:${id2}:${id2}";
# userMac = "02:00:00:00:00:${id2}";
# ssh = fireflyEris.ssh2;
# mnt = guestPath "garnet";
# host = "";
# owner = "";
# };
in
fireflyNick
# // fireflyStacie // fireflyGarnet

162
modules/nixos/nas/guests/minecraft/config/default.nix Normal file
View file

@ -0,0 +1,162 @@
{
flake,
...
}:
let
inherit (flake.config.people) user0;
serviceCfg = {
name = "minecraft";
};
in
{
minecraftVM =
{
user,
ip,
mac,
userMac,
ssh,
port,
mnt,
config,
whitelist,
worldNumber,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
minecraft-server = {
enable = true;
eula = true;
openFirewall = true;
declarative = true;
serverProperties = {
"rcon.password" = "/etc/${serviceCfg.name}-secrets/world${worldNumber}";
server-port = port;
}
// config;
whitelist = whitelist;
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22
port
];
systemd = {
services = {
"${serviceCfg.name}-copy-secrets" = {
description = "Copy secrets from virtiofs to local filesystem";
before = [ "minecraft-server.service" ];
requiredBy = [ "minecraft-server.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/${serviceCfg.name}-secrets
cp /run/secrets/${user}-world${worldNumber} /etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}
chmod 755 /etc/${serviceCfg.name}-secrets
chmod 644 /etc/${serviceCfg.name}-secrets/*
'';
};
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${ip}/24"; }
];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 4;
mem = 1024 * 4;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-mc${worldNumber}-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-craft";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}/world${worldNumber}";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
networking.firewall.allowedTCPPorts = [ port ];
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
];
sops.secrets = {
"${serviceCfg.name}/${user}-world${worldNumber}" = {
owner = "root";
mode = "0600";
};
};
};
}

96
modules/nixos/nas/guests/minecraft/default.nix Normal file
View file

@ -0,0 +1,96 @@
{ flake, pkgs, ... }:
let
inherit (import ./config { inherit flake pkgs; }) minecraftVM;
inherit (import ../../lib.generalHelpers) ipAddress;
inherit (import ../../lib.ceresHelpers) mntPath minecraft;
inherit (flake.config.people) user0;
id0 = builtins.toString minecraft.id0;
id1 = builtins.toString minecraft.id1;
id2 = builtins.toString minecraft.id2;
minecraftNick01 = minecraftVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = minecraft.ssh0;
port = 43000;
mnt = mntPath user0;
worldNumber = "01";
config = {
allow-flight = false;
allow-nether = true;
difficulty = 2;
enable-command-block = false;
enable-rcon = true;
enable-status = true;
force-gamemode = true;
gamemode = 0;
generate-structures = true;
hardcore = false;
hide-online-players = false;
level-name = "Brix on Nix";
level-seed = "9064150133272194";
max-players = 10;
max-world-size = 64000000;
motd = "A cool Minecraft server powered by NixOS";
online-mode = true;
pvp = true;
spawn-animals = true;
spawn-monsters = true;
spawn-npcs = true;
spawn-protection = 16;
view-distance = 32;
white-list = true;
};
whitelist = {
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
};
};
minecraftNick02 = minecraftVM {
user = user0;
ip = ipAddress id1;
mac = "02:00:00:00:${id1}:${id1}";
userMac = "02:00:00:00:00:${id1}";
ssh = minecraft.ssh1;
port = 43001;
mnt = mntPath user0;
worldNumber = "02";
config = {
allow-flight = false;
allow-nether = true;
difficulty = 2;
enable-command-block = false;
enable-rcon = true;
enable-status = true;
force-gamemode = true;
gamemode = 0;
generate-structures = true;
hardcore = false;
hide-online-players = false;
level-name = "Cuddle Cubes";
level-seed = "-2332803749585407299";
max-players = 10;
max-world-size = 64000000;
motd = "A cool Minecraft server powered by NixOS";
online-mode = true;
pvp = true;
spawn-animals = true;
spawn-monsters = true;
spawn-npcs = true;
spawn-protection = 16;
view-distance = 32;
white-list = true;
};
whitelist = {
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
};
};
in
minecraftNick01 // minecraftNick02

0
modules/nixos/nas/onlyoffice/default.nix → modules/nixos/nas/guests/onlyoffice/config/default.nix
View file

3
modules/nixos/nas/guests/onlyoffice/default.nix Normal file
View file

@ -0,0 +1,3 @@
{
}

11
modules/nixos/nas/opencloud/config/default.nix → modules/nixos/nas/guests/opencloud/config/default.nix
View file

@ -17,6 +17,7 @@ in
mac,
userMac,
ssh,
mnt,
host,
}:
{
@ -145,13 +146,13 @@ in
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/guests/${serviceCfg.name}/data";
source = "${mnt}/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/etc/${serviceCfg.name}";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/guests/${serviceCfg.name}/config";
source = "${mnt}/${serviceCfg.name}/config";
tag = "${serviceCfg.name}_${user}_config";
}
{
@ -172,9 +173,9 @@ in
};
};
systemd.tmpfiles.rules = [
"d /mnt/storage/users/${user}/guests/${serviceCfg.name} 0751 microvm wheel - -"
"d /mnt/storage/users/${user}/guests/${serviceCfg.name}/config 0751 microvm wheel - -"
"d /mnt/storage/users/${user}/guests/${serviceCfg.name}/data 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
];
sops.secrets = {
"${serviceCfg.name}/${user}-env" = {

48
modules/nixos/nas/guests/opencloud/default.nix Normal file
View file

@ -0,0 +1,48 @@
{
flake,
pkgs,
nasHelpers,
...
}:
let
inherit (import ./config { inherit flake pkgs; }) opencloudVM;
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
inherit (nasHelpers) ipAddress guestPath opencloud;
id0 = builtins.toString opencloud.id0;
id1 = builtins.toString opencloud.id1;
id2 = builtins.toString opencloud.id2;
opencloudNick = opencloudVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = opencloud.ssh0;
mnt = guestPath user0;
host = instances.opencloud0.domains.url0;
};
# opencloudStacie = opencloudVM {
# user = "stacie";
# ip = ipAddress id1;
# mac = "02:00:00:00:${id1}:${id1}";
# userMac = "02:00:00:00:00:${id1}";
# ssh = opencloud.ssh1;
# mnt = guestPath "stacie";
# host = "";
# };
# opencloudGarnet = opencloudVM {
# user = "garnet";
# ip = ipAddress id2;
# mac = "02:00:00:00:${id2}:${id2}";
# userMac = "02:00:00:00:00:${id2}";
# ssh = opencloud.ssh2;
# mnt = guestPath "garnet";
# host = "";
# };
in
opencloudNick
# // opencloudStacie // opencloudGarnet

16
modules/nixos/nas/photoprism/config/default.nix → modules/nixos/nas/guests/photoprism/config/default.nix
View file

@ -17,6 +17,8 @@ in
mac,
userMac,
ssh,
mnt,
data,
}:
{
microvm.vms = {
@ -93,12 +95,6 @@ in
];
};
};
# tmpfiles.rules = [
# "d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# "d /var/lib/${serviceCfg.name}-media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# "d /var/lib/${serviceCfg.name}-media/photos 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# ];
};
microvm = {
@ -136,13 +132,13 @@ in
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/guests/${serviceCfg.name}";
source = "${mnt}/${serviceCfg.name}";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/var/lib/${serviceCfg.name}-media";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/home/media";
source = data;
tag = "${serviceCfg.name}_${user}_media";
}
{
@ -158,8 +154,8 @@ in
};
systemd.tmpfiles.rules = [
"d /mnt/storage/users/${user}/guests/${serviceCfg.name} 0751 microvm wheel - -"
"d /mnt/storage/users/${user}/home/media/photos 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
"d ${data}/photos 0751 microvm wheel - -"
];
sops.secrets = {

52
modules/nixos/nas/guests/photoprism/default.nix Normal file
View file

@ -0,0 +1,52 @@
{
flake,
lib,
nasHelpers,
...
}:
let
inherit (import ./config { inherit flake lib; }) photoprismVM;
inherit (nasHelpers)
ipAddress
guestPath
mediaPath
photoprism
;
inherit (flake.config.people) user0;
id0 = builtins.toString photoprism.id0;
id1 = builtins.toString photoprism.id1;
id2 = builtins.toString photoprism.id2;
photoprismNick = photoprismVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = photoprism.ssh0;
mnt = guestPath user0;
data = mediaPath user0;
};
# photoprismStacie = photoprismVM {
# user = "stacie";
# ip = ipAddress id1;
# mac = "02:00:00:00:${id1}:${id1}";
# userMac = "02:00:00:00:00:${id1}";
# ssh = photoprism.ssh1;
# mnt = guestPath "stacie";
# data = mediaPath "stacie";
# };
# photoprismGarnet = photoprismVM {
# user = "garnet";
# ip = ipAddress id2;
# mac = "02:00:00:00:${id2}:${id2}";
# userMac = "02:00:00:00:00:${id2}";
# ssh = photoprism.ssh2;
# mnt = guestPath "garnet";
# data = mediaPath "stacie";
# };
in
photoprismNick
# // photoprismStacie // photoprismGarnet

78
modules/nixos/nas/syncthing/config/default.nix → modules/nixos/nas/guests/syncthing/config/default.nix
View file

@ -15,8 +15,11 @@ in
mac,
userMac,
ssh,
syncID,
deviceIP,
mnt,
folders,
devices,
tmp,
mounts,
}:
{
microvm.vms = {
@ -36,42 +39,8 @@ in
systemService = true;
guiAddress = "0.0.0.0:${toString serviceCfg.ports.port0}";
settings = {
folders = {
docs = {
enable = true;
id = "docs";
path = "/var/lib/${serviceCfg.name}/docs";
devices = [
"${user}Phone"
];
};
media = {
enable = true;
id = "media";
path = "/var/lib/${serviceCfg.name}/media";
devices = [
"${user}Phone"
];
};
misc = {
enable = true;
id = "misc";
path = "/var/lib/${serviceCfg.name}/misc";
devices = [
"${user}Phone"
];
};
};
devices = {
"${user}Phone" = {
autoAcceptFolders = true;
name = "${user}Phone";
addresses = [
"tcp://${deviceIP}:${toString serviceCfg.ports.port2}"
];
id = syncID;
};
};
folders = folders;
devices = devices;
};
};
@ -119,13 +88,9 @@ in
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}/docs 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}/media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}/misc 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
]
++ tmp;
};
microvm = {
vcpu = 1;
mem = 512;
@ -159,41 +124,24 @@ in
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/guests/${serviceCfg.name}";
source = "${mnt}/${serviceCfg.name}";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/docs";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/home/docs";
tag = "${serviceCfg.name}_${user}_docs";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/media";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/home/media";
tag = "${serviceCfg.name}_${user}_media";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/misc";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/home/misc";
tag = "${serviceCfg.name}_${user}_misc";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
]
++ mounts;
};
};
};
};
systemd.tmpfiles.rules = [
"d /mnt/storage/users/${user}/guests/${serviceCfg.name} 0751 microvm wheel - -"
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
];
};
}

123
modules/nixos/nas/guests/syncthing/default.nix Executable file
View file

@ -0,0 +1,123 @@
{ flake, nasHelpers, ... }:
let
inherit (import ./config { inherit flake; }) syncthingVM;
inherit (flake.config.services) instances;
inherit (flake.config.people) user0;
inherit (nasHelpers)
ipAddress
guestPath
docsPath
mediaPath
miscPath
syncthing
;
serviceCfg = instances.syncthing;
id0 = builtins.toString syncthing.id0;
id1 = builtins.toString syncthing.id1;
id2 = builtins.toString syncthing.id2;
foldersHelper = user: {
docs = {
enable = true;
id = "docs";
path = "/var/lib/${serviceCfg.name}/docs";
devices = [
"${user}Phone"
];
};
media = {
enable = true;
id = "media";
path = "/var/lib/${serviceCfg.name}/media";
devices = [
"${user}Phone"
];
};
misc = {
enable = true;
id = "misc";
path = "/var/lib/${serviceCfg.name}/misc";
devices = [
"${user}Phone"
];
};
};
devicesHelper = user: syncID: device: deviceIP: {
"${user}${device}" = {
autoAcceptFolders = true;
name = "${user}${device}";
addresses = [
"tcp://${deviceIP}:${toString serviceCfg.ports.port2}"
];
id = syncID;
};
};
mountsHelper = user: [
{
mountPoint = "/var/lib/${serviceCfg.name}/docs";
proto = "virtiofs";
source = docsPath user;
tag = "${serviceCfg.name}_${user}_docs";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/media";
proto = "virtiofs";
source = mediaPath user;
tag = "${serviceCfg.name}_${user}_media";
}
{
mountPoint = "/var/lib/${serviceCfg.name}/misc";
proto = "virtiofs";
source = miscPath user;
tag = "${serviceCfg.name}_${user}_misc";
}
];
tmpRules = [
"d /var/lib/${serviceCfg.name}/docs 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}/media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"d /var/lib/${serviceCfg.name}/misc 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
syncthingNick =
let
phoneID = "OALKHLZ-OODUWVX-PAC2LI7-UMZMSZO-FELLRCD-RS4DHJS-PVA5YQK-WTFXXQI";
in
syncthingVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = syncthing.ssh0;
mnt = guestPath user0;
folders = foldersHelper user0;
devices = devicesHelper user0 phoneID "Phone" "192.168.50.8";
tmp = tmpRules;
mounts = mountsHelper user0;
};
# syncthingStacie = syncthingVM {
# user = "stacie";
# ip = ipAddress id0;
# mac = "02:00:00:00:${id0}:${id0}";
# userMac = "02:00:00:00:00:${id0}";
# ssh = syncthing.ssh0;
# syncID = "";
# deviceIP = "";
# };
# syncthingGarnet = syncthingVM {
# user = "garnet";
# ip = ipAddress id0;
# mac = "02:00:00:00:${id0}:${id0}";
# userMac = "02:00:00:00:00:${id0}";
# ssh = syncthing.ssh0;
# syncID = "";
# deviceIP = "";
# };
in
syncthingNick
# // syncthingStacie // syncthingGarnet

166
modules/nixos/nas/guests/vaultwarden/config/default.nix Normal file
View file

@ -0,0 +1,166 @@
{
flake,
...
}:
let
inherit (flake.config.people) user0;
inherit (flake.config.services) instances;
serviceCfg = instances.vaultwarden;
smtpCfg = instances.smtp;
in
{
vaultwardenVM =
{
user,
ip,
mac,
userMac,
ssh,
host,
mnt,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
# Domain Configuration
DOMAIN = "https://${host}";
# Email Configuration
SMTP_AUTH_MECHANISM = "Plain";
SMTP_EMBED_IMAGES = true;
SMTP_FROM = serviceCfg.email.address0;
SMTP_FROM_NAME = serviceCfg.label;
SMTP_HOST = smtpCfg.hostname;
SMTP_PORT = smtpCfg.ports.port0;
SMTP_USERNAME = smtpCfg.email.address0;
SMTP_SECURITY = "starttls";
# Security Configuration
DISABLE_ADMIN_TOKEN = false;
# Event and Backup Management
EVENTS_DAYS_RETAIN = 90;
# User Features
SENDS_ALLOWED = true;
SIGNUPS_VERIFY = true;
WEB_VAULT_ENABLED = true;
# Rocket (Web Server) Settings
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = serviceCfg.ports.port0;
};
# Environment file with secrets (mounted from host)
environmentFile = "/run/secrets/${user}-env";
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22
587
];
systemd = {
services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s5";
addresses = [
{ Address = "${ip}/24"; }
];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 1024;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-vw-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-vault";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/bitwarden_rs";
proto = "virtiofs";
source = "${mnt}/${serviceCfg.name}";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
};
};
};
systemd.tmpfiles.rules = [
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
];
sops.secrets = {
"${serviceCfg.name}/${user}-env" = {
owner = "root";
mode = "0600";
};
};
};
}

42
modules/nixos/nas/guests/vaultwarden/default.nix Normal file
View file

@ -0,0 +1,42 @@
{ flake, nasHelpers, ... }:
let
inherit (import ./config { inherit flake; }) vaultwardenVM;
inherit (flake.config.people) user0;
inherit (nasHelpers) ipAddress guestPath vaultwarden;
id0 = builtins.toString vaultwarden.id0;
id1 = builtins.toString vaultwarden.id1;
id2 = builtins.toString vaultwarden.id2;
vaultwardenNick = vaultwardenVM {
user = user0;
ip = ipAddress id0;
mac = "02:00:00:00:${id0}:${id0}";
userMac = "02:00:00:00:00:${id0}";
ssh = vaultwarden.ssh0;
mnt = guestPath user0;
host = "";
};
# vaultwardenStacie = vaultwardenVM {
# user = "stacie";
# ip = ipAddress id1;
# mac = "02:00:00:00:${id1}:${id1}";
# userMac = "02:00:00:00:00:${id1}";
# ssh = vaultwarden.ssh1;
# mnt = guestPath "stacie";
# host = "";
# };
# vaultwardenGarnet = vaultwardenVM {
# user = "garnet";
# ip = ipAddress id2;
# mac = "02:00:00:00:${id2}:${id2}";
# userMac = "02:00:00:00:00:${id2}";
# ssh = vaultwarden.ssh2;
# mnt = guestPath "garnet";
# host = "";
# };
in
vaultwardenNick
# // vaultwardenStacie // vaultwardenGarnet

35
modules/nixos/nas/opencloud/default.nix
View file

@ -1,35 +0,0 @@
{ flake, pkgs, ... }:
let
inherit (import ./config { inherit flake pkgs; }) opencloudVM;
inherit (flake.config.people) user0;
opencloudNick = opencloudVM {
user = user0;
ip = "192.168.50.67";
mac = "02:00:00:00:57:67";
userMac = "02:00:00:00:00:67";
ssh = 2507;
host = "";
};
# opencloudStacie = opencloudVM {
# user = "stacie";
# ip = "192.168.50.68";
# mac = "02:00:00:00:58:68";
# userMac = "02:00:00:00:00:68";
# ssh = 2508;
# host = "";
# };
# opencloudGarnet = opencloudVM {
# user = "garnet";
# ip = "192.168.50.69";
# mac = "02:00:00:00:59:69";
# userMac = "02:00:00:00:00:69";
# ssh = 2509;
# host = "";
# };
in
opencloudNick
# // opencloudStacie // opencloudGarnet

32
modules/nixos/nas/photoprism/default.nix
View file

@ -1,32 +0,0 @@
{ flake, lib, ... }:
let
inherit (import ./config { inherit flake lib; }) photoprismVM;
inherit (flake.config.people) user0;
photoprismNick = photoprismVM {
user = user0;
ip = "192.168.50.64";
mac = "02:00:00:00:54:64";
userMac = "02:00:00:00:00:64";
ssh = 2504;
};
# photoprismStacie = photoprismVM {
# user = "stacie";
# ip = "192.168.50.65";
# mac = "02:00:00:00:55:65";
# userMac = "02:00:00:00:00:65";
# ssh = 2505;
# };
# photoprismGarnet = photoprismVM {
# user = "garnet";
# ip = "192.168.50.66";
# mac = "02:00:00:00:56:66";
# userMac = "02:00:00:00:00:66";
# ssh = 2506;
# };
in
photoprismNick
# // photoprismStacie // photoprismGarnet

38
modules/nixos/nas/syncthing/default.nix
View file

@ -1,38 +0,0 @@
{ flake, ... }:
let
inherit (import ./config { inherit flake; }) syncthingVM;
inherit (flake.config.people) user0;
syncthingNick = syncthingVM {
user = user0;
ip = "192.168.50.61";
mac = "02:00:00:00:51:61";
userMac = "02:00:00:00:00:61";
ssh = 2501;
syncID = "OALKHLZ-OODUWVX-PAC2LI7-UMZMSZO-FELLRCD-RS4DHJS-PVA5YQK-WTFXXQI";
deviceIP = "192.168.50.8";
};
# syncthingStacie = syncthingVM {
# user = "stacie";
# ip = "192.168.50.62";
# mac = "02:00:00:00:52:62";
# userMac = "02:00:00:00:00:62";
# ssh = 2502;
# syncID = "";
# deviceIP = "";
# };
# syncthingGarnet = syncthingVM {
# user = "garnet";
# ip = "192.168.50.63";
# mac = "02:00:00:00:53:63";
# userMac = "02:00:00:00:00:63";
# ssh = 2503;
# syncID = "";
# deviceIP = "";
# };
in
syncthingNick
# // syncthingStacie // syncthingGarnet