mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-15 11:00:53 -06:00
test: setting up nas structure
This commit is contained in:
Nick
parent
312c52d613
commit
e341e5878f
19 changed files with 1106 additions and 196 deletions
243
modules/nixos/nas/guests/firefly-iii/config/default.nix
Normal file
243
modules/nixos/nas/guests/firefly-iii/config/default.nix
Normal file
|
|
@ -0,0 +1,243 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = {
|
||||
name = "firefly-iii";
|
||||
};
|
||||
smtpCfg = instances.smtp;
|
||||
|
||||
in
|
||||
{
|
||||
fireflyVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
host,
|
||||
owner,
|
||||
mnt,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
firefly-iii = {
|
||||
enable = true;
|
||||
enableNginx = false;
|
||||
poolConfig = {
|
||||
"listen.owner" = config.services.caddy.user;
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 4;
|
||||
"pm.max_requests" = 500;
|
||||
};
|
||||
settings = {
|
||||
APP_URL = "https://${host}";
|
||||
APP_KEY_FILE = "/etc/firefly-secrets/pass";
|
||||
DB_PASSWORD_FILE = "/etc/firefly-secrets/data";
|
||||
DB_CONNECTION = "pgsql";
|
||||
DB_HOST = "/run/postgresql";
|
||||
DB_DATABASE = "firefly-iii";
|
||||
DB_USERNAME = "firefly-iii";
|
||||
MAIL_MAILER = smtpCfg.name;
|
||||
MAIL_HOST = smtpCfg.hostname;
|
||||
MAIL_PORT = smtpCfg.ports.port0;
|
||||
MAIL_FROM = smtpCfg.email.address0;
|
||||
MAIL_USERNAME = smtpCfg.email.address0;
|
||||
MAIL_PASSWORD_FILE = "/etc/firefly-secrets/smtp";
|
||||
MAIL_ENCRYPTION = "tls";
|
||||
SITE_OWNER = owner;
|
||||
};
|
||||
};
|
||||
phpfpm.pools.firefly-iii.phpEnv = {
|
||||
TRUSTED_PROXIES = "*";
|
||||
APP_URL = "https://${host}";
|
||||
};
|
||||
firefly-iii-data-importer = {
|
||||
enable = true;
|
||||
};
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts.":80" = {
|
||||
extraConfig = ''
|
||||
root * ${config.services.firefly-iii.package}/public
|
||||
file_server
|
||||
encode gzip
|
||||
php_fastcgi unix//run/phpfpm/firefly-iii.sock {
|
||||
env HTTPS {http.request.header.X-Forwarded-Proto}
|
||||
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "firefly-iii" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "firefly-iii";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
587
|
||||
8084
|
||||
8081
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
caddy = {
|
||||
after = [ "phpfpm-firefly-iii.service" ];
|
||||
requires = [ "phpfpm-firefly-iii.service" ];
|
||||
};
|
||||
fix-secrets-permissions = {
|
||||
description = "Fix secrets permissions for firefly-iii";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [
|
||||
"firefly-iii-setup.service"
|
||||
"phpfpm-firefly-iii.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /etc/firefly-secrets
|
||||
cp /run/secrets/${user}-pass /etc/firefly-secrets/${user}-pass
|
||||
cp /run/secrets/${user}-data /etc/firefly-secrets/${user}-data
|
||||
cp /run/secrets/${user}-smtp /etc/firefly-secrets/${user}-smtp
|
||||
chmod 755 /etc/firefly-secrets
|
||||
chmod 644 /etc/firefly-secrets/*
|
||||
'';
|
||||
};
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-ff-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-firefly";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/config";
|
||||
tag = "${serviceCfg.name}_${user}_config";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/postgresql";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops = {
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${serviceCfg.name}/${user}-${secret}";
|
||||
value = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0644";
|
||||
};
|
||||
})
|
||||
[
|
||||
"pass"
|
||||
"data"
|
||||
"smtp"
|
||||
]
|
||||
);
|
||||
};
|
||||
};
|
||||
}
|
||||
53
modules/nixos/nas/guests/firefly-iii/default.nix
Normal file
53
modules/nixos/nas/guests/firefly-iii/default.nix
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
pkgs,
|
||||
nasHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit config flake pkgs; }) fireflyVM;
|
||||
inherit (nasHelpers) ipAddress guestPath firefly;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.people.users.${user0}) email;
|
||||
inherit (flake.config.services) instances;
|
||||
id0 = builtins.toString firefly.id0;
|
||||
id1 = builtins.toString firefly.id1;
|
||||
id2 = builtins.toString firefly.id2;
|
||||
|
||||
fireflyNick = fireflyVM {
|
||||
user = user0;
|
||||
ip = ipAddress id0;
|
||||
mac = "02:00:00:00:${id0}:${id0}";
|
||||
userMac = "02:00:00:00:00:${id0}";
|
||||
ssh = firefly.ssh0;
|
||||
host = instances.firefly-iii.domains.url0;
|
||||
mnt = guestPath user0;
|
||||
owner = email.address2;
|
||||
};
|
||||
|
||||
# fireflyStacie = fireflyVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress (id1);
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = fireflyEris.ssh1;
|
||||
# host = "";
|
||||
# mnt = guestPath "stacie";
|
||||
# owner = "";
|
||||
# };
|
||||
|
||||
# fireflyGarnet = fireflyVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress (id2);
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = fireflyEris.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# host = "";
|
||||
# owner = "";
|
||||
# };
|
||||
|
||||
in
|
||||
fireflyNick
|
||||
# // fireflyStacie // fireflyGarnet
|
||||
162
modules/nixos/nas/guests/minecraft/config/default.nix
Normal file
162
modules/nixos/nas/guests/minecraft/config/default.nix
Normal file
|
|
@ -0,0 +1,162 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
serviceCfg = {
|
||||
name = "minecraft";
|
||||
};
|
||||
in
|
||||
{
|
||||
minecraftVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
port,
|
||||
mnt,
|
||||
config,
|
||||
whitelist,
|
||||
worldNumber,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
"rcon.password" = "/etc/${serviceCfg.name}-secrets/world${worldNumber}";
|
||||
server-port = port;
|
||||
}
|
||||
// config;
|
||||
whitelist = whitelist;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
port
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
"${serviceCfg.name}-copy-secrets" = {
|
||||
description = "Copy secrets from virtiofs to local filesystem";
|
||||
before = [ "minecraft-server.service" ];
|
||||
requiredBy = [ "minecraft-server.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /etc/${serviceCfg.name}-secrets
|
||||
cp /run/secrets/${user}-world${worldNumber} /etc/${serviceCfg.name}-secrets/${user}-world${worldNumber}
|
||||
chmod 755 /etc/${serviceCfg.name}-secrets
|
||||
chmod 644 /etc/${serviceCfg.name}-secrets/*
|
||||
'';
|
||||
};
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 4;
|
||||
mem = 1024 * 4;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-mc${worldNumber}-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-craft";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/world${worldNumber}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ port ];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-world${worldNumber}" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
96
modules/nixos/nas/guests/minecraft/default.nix
Normal file
96
modules/nixos/nas/guests/minecraft/default.nix
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
{ flake, pkgs, ... }:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) minecraftVM;
|
||||
inherit (import ../../lib.generalHelpers) ipAddress;
|
||||
inherit (import ../../lib.ceresHelpers) mntPath minecraft;
|
||||
inherit (flake.config.people) user0;
|
||||
id0 = builtins.toString minecraft.id0;
|
||||
id1 = builtins.toString minecraft.id1;
|
||||
id2 = builtins.toString minecraft.id2;
|
||||
|
||||
minecraftNick01 = minecraftVM {
|
||||
user = user0;
|
||||
ip = ipAddress id0;
|
||||
mac = "02:00:00:00:${id0}:${id0}";
|
||||
userMac = "02:00:00:00:00:${id0}";
|
||||
ssh = minecraft.ssh0;
|
||||
port = 43000;
|
||||
mnt = mntPath user0;
|
||||
worldNumber = "01";
|
||||
config = {
|
||||
allow-flight = false;
|
||||
allow-nether = true;
|
||||
difficulty = 2;
|
||||
enable-command-block = false;
|
||||
enable-rcon = true;
|
||||
enable-status = true;
|
||||
force-gamemode = true;
|
||||
gamemode = 0;
|
||||
generate-structures = true;
|
||||
hardcore = false;
|
||||
hide-online-players = false;
|
||||
level-name = "Brix on Nix";
|
||||
level-seed = "9064150133272194";
|
||||
max-players = 10;
|
||||
max-world-size = 64000000;
|
||||
motd = "A cool Minecraft server powered by NixOS";
|
||||
online-mode = true;
|
||||
pvp = true;
|
||||
spawn-animals = true;
|
||||
spawn-monsters = true;
|
||||
spawn-npcs = true;
|
||||
spawn-protection = 16;
|
||||
view-distance = 32;
|
||||
white-list = true;
|
||||
};
|
||||
whitelist = {
|
||||
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
|
||||
Hefty_Chungus_Jr = "c3bf8cac-e953-4ea4-ae5f-7acb92a51a85";
|
||||
EclipseMoon01 = "adef4af7-d8c6-4627-b492-e990ea1bb993";
|
||||
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
|
||||
};
|
||||
};
|
||||
|
||||
minecraftNick02 = minecraftVM {
|
||||
user = user0;
|
||||
ip = ipAddress id1;
|
||||
mac = "02:00:00:00:${id1}:${id1}";
|
||||
userMac = "02:00:00:00:00:${id1}";
|
||||
ssh = minecraft.ssh1;
|
||||
port = 43001;
|
||||
mnt = mntPath user0;
|
||||
worldNumber = "02";
|
||||
config = {
|
||||
allow-flight = false;
|
||||
allow-nether = true;
|
||||
difficulty = 2;
|
||||
enable-command-block = false;
|
||||
enable-rcon = true;
|
||||
enable-status = true;
|
||||
force-gamemode = true;
|
||||
gamemode = 0;
|
||||
generate-structures = true;
|
||||
hardcore = false;
|
||||
hide-online-players = false;
|
||||
level-name = "Cuddle Cubes";
|
||||
level-seed = "-2332803749585407299";
|
||||
max-players = 10;
|
||||
max-world-size = 64000000;
|
||||
motd = "A cool Minecraft server powered by NixOS";
|
||||
online-mode = true;
|
||||
pvp = true;
|
||||
spawn-animals = true;
|
||||
spawn-monsters = true;
|
||||
spawn-npcs = true;
|
||||
spawn-protection = 16;
|
||||
view-distance = 32;
|
||||
white-list = true;
|
||||
};
|
||||
whitelist = {
|
||||
Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
|
||||
Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
minecraftNick01 // minecraftNick02
|
||||
3
modules/nixos/nas/guests/onlyoffice/config/default.nix
Normal file
3
modules/nixos/nas/guests/onlyoffice/config/default.nix
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
|
||||
}
|
||||
3
modules/nixos/nas/guests/onlyoffice/default.nix
Normal file
3
modules/nixos/nas/guests/onlyoffice/default.nix
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
|
||||
}
|
||||
187
modules/nixos/nas/guests/opencloud/config/default.nix
Normal file
187
modules/nixos/nas/guests/opencloud/config/default.nix
Normal file
|
|
@ -0,0 +1,187 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
serviceCfg = {
|
||||
name = "opencloud";
|
||||
};
|
||||
in
|
||||
{
|
||||
opencloudVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
opencloud = {
|
||||
enable = true;
|
||||
url = "https://${host}";
|
||||
port = 9200;
|
||||
address = "0.0.0.0";
|
||||
stateDir = "/var/lib/${serviceCfg.name}";
|
||||
environmentFile = "/run/secrets/${user}-env";
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
587
|
||||
9200
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
opencloud = {
|
||||
path = [ pkgs.inotify-tools ];
|
||||
};
|
||||
opencloud-fix-permissions = {
|
||||
description = "Fix OpenCloud storage permissions";
|
||||
after = [ "opencloud.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "fix-perms" ''
|
||||
echo "Starting permission fix..."
|
||||
OPENCLOUD_UID=$(id -u opencloud)
|
||||
echo "OpenCloud UID: $OPENCLOUD_UID"
|
||||
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
|
||||
echo "Fixing file: $file"
|
||||
chown opencloud:opencloud "$file" 2>/dev/null || true
|
||||
done
|
||||
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
|
||||
echo "Fixing dir: $dir"
|
||||
chown opencloud:opencloud "$dir" 2>/dev/null || true
|
||||
done
|
||||
echo "Permission fix complete"
|
||||
'';
|
||||
User = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
timers.opencloud-fix-permissions = {
|
||||
description = "Periodically fix OpenCloud storage permissions";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "30s";
|
||||
OnUnitActiveSec = "2min";
|
||||
Unit = "opencloud-fix-permissions.service";
|
||||
};
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-oc-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-cloud";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/etc/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/config";
|
||||
tag = "${serviceCfg.name}_${user}_config";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
inotify-tools
|
||||
opencloud
|
||||
;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/config 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
|
||||
];
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-env" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
48
modules/nixos/nas/guests/opencloud/default.nix
Normal file
48
modules/nixos/nas/guests/opencloud/default.nix
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
nasHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) opencloudVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
inherit (nasHelpers) ipAddress guestPath opencloud;
|
||||
id0 = builtins.toString opencloud.id0;
|
||||
id1 = builtins.toString opencloud.id1;
|
||||
id2 = builtins.toString opencloud.id2;
|
||||
|
||||
opencloudNick = opencloudVM {
|
||||
user = user0;
|
||||
ip = ipAddress id0;
|
||||
mac = "02:00:00:00:${id0}:${id0}";
|
||||
userMac = "02:00:00:00:00:${id0}";
|
||||
ssh = opencloud.ssh0;
|
||||
mnt = guestPath user0;
|
||||
host = instances.opencloud0.domains.url0;
|
||||
};
|
||||
|
||||
# opencloudStacie = opencloudVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id1;
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = opencloud.ssh1;
|
||||
# mnt = guestPath "stacie";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
# opencloudGarnet = opencloudVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id2;
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = opencloud.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
in
|
||||
opencloudNick
|
||||
# // opencloudStacie // opencloudGarnet
|
||||
168
modules/nixos/nas/guests/photoprism/config/default.nix
Normal file
168
modules/nixos/nas/guests/photoprism/config/default.nix
Normal file
|
|
@ -0,0 +1,168 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
serviceCfg = {
|
||||
name = "photoprism";
|
||||
};
|
||||
in
|
||||
{
|
||||
photoprismVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
data,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
${serviceCfg.name} = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PHOTOPRISM_ADMIN_USER = user;
|
||||
PHOTOPRISM_DEFAULT_LOCAL = "en";
|
||||
};
|
||||
passwordFile = "/run/secrets/${user}-pass";
|
||||
storagePath = "/var/lib/${serviceCfg.name}";
|
||||
originalsPath = "/var/lib/${serviceCfg.name}-media";
|
||||
importPath = "photos";
|
||||
address = "0.0.0.0";
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.photoprism = {
|
||||
isSystemUser = true;
|
||||
group = "photoprism";
|
||||
home = "/var/lib/photoprism";
|
||||
};
|
||||
users.groups.photoprism = { };
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
2342
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
photoprism = {
|
||||
serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = serviceCfg.name;
|
||||
Group = serviceCfg.name;
|
||||
};
|
||||
};
|
||||
systemd-networkd.wantedBy = [
|
||||
"multi-user.target"
|
||||
];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-pp-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-photo";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}-media";
|
||||
proto = "virtiofs";
|
||||
source = data;
|
||||
tag = "${serviceCfg.name}_${user}_media";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${data}/photos 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-pass" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
52
modules/nixos/nas/guests/photoprism/default.nix
Normal file
52
modules/nixos/nas/guests/photoprism/default.nix
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
nasHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake lib; }) photoprismVM;
|
||||
inherit (nasHelpers)
|
||||
ipAddress
|
||||
guestPath
|
||||
mediaPath
|
||||
photoprism
|
||||
;
|
||||
inherit (flake.config.people) user0;
|
||||
id0 = builtins.toString photoprism.id0;
|
||||
id1 = builtins.toString photoprism.id1;
|
||||
id2 = builtins.toString photoprism.id2;
|
||||
|
||||
photoprismNick = photoprismVM {
|
||||
user = user0;
|
||||
ip = ipAddress id0;
|
||||
mac = "02:00:00:00:${id0}:${id0}";
|
||||
userMac = "02:00:00:00:00:${id0}";
|
||||
ssh = photoprism.ssh0;
|
||||
mnt = guestPath user0;
|
||||
data = mediaPath user0;
|
||||
};
|
||||
|
||||
# photoprismStacie = photoprismVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id1;
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = photoprism.ssh1;
|
||||
# mnt = guestPath "stacie";
|
||||
# data = mediaPath "stacie";
|
||||
# };
|
||||
|
||||
# photoprismGarnet = photoprismVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id2;
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = photoprism.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# data = mediaPath "stacie";
|
||||
# };
|
||||
|
||||
in
|
||||
photoprismNick
|
||||
# // photoprismStacie // photoprismGarnet
|
||||
147
modules/nixos/nas/guests/syncthing/config/default.nix
Normal file
147
modules/nixos/nas/guests/syncthing/config/default.nix
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.syncthing;
|
||||
in
|
||||
{
|
||||
syncthingVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
folders,
|
||||
devices,
|
||||
tmp,
|
||||
mounts,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
syncthing = {
|
||||
enable = true;
|
||||
overrideDevices = false;
|
||||
overrideFolders = false;
|
||||
openDefaultPorts = true;
|
||||
systemService = true;
|
||||
guiAddress = "0.0.0.0:${toString serviceCfg.ports.port0}";
|
||||
settings = {
|
||||
folders = folders;
|
||||
devices = devices;
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
serviceCfg.ports.port0
|
||||
serviceCfg.ports.port1
|
||||
serviceCfg.ports.port2
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
systemd-networkd.wantedBy = [
|
||||
"multi-user.target"
|
||||
];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
]
|
||||
++ tmp;
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 512;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-st-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vm-sync";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
]
|
||||
++ mounts;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
};
|
||||
}
|
||||
123
modules/nixos/nas/guests/syncthing/default.nix
Executable file
123
modules/nixos/nas/guests/syncthing/default.nix
Executable file
|
|
@ -0,0 +1,123 @@
|
|||
{ flake, nasHelpers, ... }:
|
||||
let
|
||||
inherit (import ./config { inherit flake; }) syncthingVM;
|
||||
inherit (flake.config.services) instances;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (nasHelpers)
|
||||
ipAddress
|
||||
guestPath
|
||||
docsPath
|
||||
mediaPath
|
||||
miscPath
|
||||
syncthing
|
||||
;
|
||||
serviceCfg = instances.syncthing;
|
||||
id0 = builtins.toString syncthing.id0;
|
||||
id1 = builtins.toString syncthing.id1;
|
||||
id2 = builtins.toString syncthing.id2;
|
||||
|
||||
foldersHelper = user: {
|
||||
docs = {
|
||||
enable = true;
|
||||
id = "docs";
|
||||
path = "/var/lib/${serviceCfg.name}/docs";
|
||||
devices = [
|
||||
"${user}Phone"
|
||||
];
|
||||
};
|
||||
media = {
|
||||
enable = true;
|
||||
id = "media";
|
||||
path = "/var/lib/${serviceCfg.name}/media";
|
||||
devices = [
|
||||
"${user}Phone"
|
||||
];
|
||||
};
|
||||
misc = {
|
||||
enable = true;
|
||||
id = "misc";
|
||||
path = "/var/lib/${serviceCfg.name}/misc";
|
||||
devices = [
|
||||
"${user}Phone"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
devicesHelper = user: syncID: device: deviceIP: {
|
||||
"${user}${device}" = {
|
||||
autoAcceptFolders = true;
|
||||
name = "${user}${device}";
|
||||
addresses = [
|
||||
"tcp://${deviceIP}:${toString serviceCfg.ports.port2}"
|
||||
];
|
||||
id = syncID;
|
||||
};
|
||||
};
|
||||
|
||||
mountsHelper = user: [
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}/docs";
|
||||
proto = "virtiofs";
|
||||
source = docsPath user;
|
||||
tag = "${serviceCfg.name}_${user}_docs";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}/media";
|
||||
proto = "virtiofs";
|
||||
source = mediaPath user;
|
||||
tag = "${serviceCfg.name}_${user}_media";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}/misc";
|
||||
proto = "virtiofs";
|
||||
source = miscPath user;
|
||||
tag = "${serviceCfg.name}_${user}_misc";
|
||||
}
|
||||
];
|
||||
|
||||
tmpRules = [
|
||||
"d /var/lib/${serviceCfg.name}/docs 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d /var/lib/${serviceCfg.name}/media 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d /var/lib/${serviceCfg.name}/misc 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
|
||||
syncthingNick =
|
||||
let
|
||||
phoneID = "OALKHLZ-OODUWVX-PAC2LI7-UMZMSZO-FELLRCD-RS4DHJS-PVA5YQK-WTFXXQI";
|
||||
in
|
||||
syncthingVM {
|
||||
user = user0;
|
||||
ip = ipAddress id0;
|
||||
mac = "02:00:00:00:${id0}:${id0}";
|
||||
userMac = "02:00:00:00:00:${id0}";
|
||||
ssh = syncthing.ssh0;
|
||||
mnt = guestPath user0;
|
||||
folders = foldersHelper user0;
|
||||
devices = devicesHelper user0 phoneID "Phone" "192.168.50.8";
|
||||
tmp = tmpRules;
|
||||
mounts = mountsHelper user0;
|
||||
};
|
||||
|
||||
# syncthingStacie = syncthingVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id0;
|
||||
# mac = "02:00:00:00:${id0}:${id0}";
|
||||
# userMac = "02:00:00:00:00:${id0}";
|
||||
# ssh = syncthing.ssh0;
|
||||
# syncID = "";
|
||||
# deviceIP = "";
|
||||
# };
|
||||
|
||||
# syncthingGarnet = syncthingVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id0;
|
||||
# mac = "02:00:00:00:${id0}:${id0}";
|
||||
# userMac = "02:00:00:00:00:${id0}";
|
||||
# ssh = syncthing.ssh0;
|
||||
# syncID = "";
|
||||
# deviceIP = "";
|
||||
# };
|
||||
|
||||
in
|
||||
syncthingNick
|
||||
# // syncthingStacie // syncthingGarnet
|
||||
166
modules/nixos/nas/guests/vaultwarden/config/default.nix
Normal file
166
modules/nixos/nas/guests/vaultwarden/config/default.nix
Normal file
|
|
@ -0,0 +1,166 @@
|
|||
{
|
||||
flake,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.vaultwarden;
|
||||
smtpCfg = instances.smtp;
|
||||
|
||||
in
|
||||
{
|
||||
vaultwardenVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
host,
|
||||
mnt,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
config = {
|
||||
# Domain Configuration
|
||||
DOMAIN = "https://${host}";
|
||||
|
||||
# Email Configuration
|
||||
SMTP_AUTH_MECHANISM = "Plain";
|
||||
SMTP_EMBED_IMAGES = true;
|
||||
SMTP_FROM = serviceCfg.email.address0;
|
||||
SMTP_FROM_NAME = serviceCfg.label;
|
||||
SMTP_HOST = smtpCfg.hostname;
|
||||
SMTP_PORT = smtpCfg.ports.port0;
|
||||
SMTP_USERNAME = smtpCfg.email.address0;
|
||||
SMTP_SECURITY = "starttls";
|
||||
|
||||
# Security Configuration
|
||||
DISABLE_ADMIN_TOKEN = false;
|
||||
|
||||
# Event and Backup Management
|
||||
EVENTS_DAYS_RETAIN = 90;
|
||||
|
||||
# User Features
|
||||
SENDS_ALLOWED = true;
|
||||
SIGNUPS_VERIFY = true;
|
||||
WEB_VAULT_ENABLED = true;
|
||||
|
||||
# Rocket (Web Server) Settings
|
||||
ROCKET_ADDRESS = "0.0.0.0";
|
||||
ROCKET_PORT = serviceCfg.ports.port0;
|
||||
};
|
||||
|
||||
# Environment file with secrets (mounted from host)
|
||||
environmentFile = "/run/secrets/${user}-env";
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
587
|
||||
];
|
||||
systemd = {
|
||||
services = {
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 1024;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-vw-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-vault";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/bitwarden_rs";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
];
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-env" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
42
modules/nixos/nas/guests/vaultwarden/default.nix
Normal file
42
modules/nixos/nas/guests/vaultwarden/default.nix
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
{ flake, nasHelpers, ... }:
|
||||
let
|
||||
inherit (import ./config { inherit flake; }) vaultwardenVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (nasHelpers) ipAddress guestPath vaultwarden;
|
||||
id0 = builtins.toString vaultwarden.id0;
|
||||
id1 = builtins.toString vaultwarden.id1;
|
||||
id2 = builtins.toString vaultwarden.id2;
|
||||
|
||||
vaultwardenNick = vaultwardenVM {
|
||||
user = user0;
|
||||
ip = ipAddress id0;
|
||||
mac = "02:00:00:00:${id0}:${id0}";
|
||||
userMac = "02:00:00:00:00:${id0}";
|
||||
ssh = vaultwarden.ssh0;
|
||||
mnt = guestPath user0;
|
||||
host = "";
|
||||
};
|
||||
|
||||
# vaultwardenStacie = vaultwardenVM {
|
||||
# user = "stacie";
|
||||
# ip = ipAddress id1;
|
||||
# mac = "02:00:00:00:${id1}:${id1}";
|
||||
# userMac = "02:00:00:00:00:${id1}";
|
||||
# ssh = vaultwarden.ssh1;
|
||||
# mnt = guestPath "stacie";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
# vaultwardenGarnet = vaultwardenVM {
|
||||
# user = "garnet";
|
||||
# ip = ipAddress id2;
|
||||
# mac = "02:00:00:00:${id2}:${id2}";
|
||||
# userMac = "02:00:00:00:00:${id2}";
|
||||
# ssh = vaultwarden.ssh2;
|
||||
# mnt = guestPath "garnet";
|
||||
# host = "";
|
||||
# };
|
||||
|
||||
in
|
||||
vaultwardenNick
|
||||
# // vaultwardenStacie // vaultwardenGarnet
|
||||
Loading…
Add table
Add a link
Reference in a new issue