modules/nixos/default.nix

@@ -17,6 +17,7 @@ in
           tuios
           wireguard
           microvm
+          defenseio
           ;
       };
     };
@@ -31,6 +32,7 @@ in
           plymouth
           wireguard
           microvm
+          defenseio
           ;
       };
     };
@@ -39,6 +41,7 @@ in
       imports = builtins.attrValues {
         inherit (modules)
           microvm
+          defenseio
           ;
       };
     };
@@ -50,6 +53,7 @@ in
           caddy
           ceresOpenCloud
           comfyui
+          defenseio
           firefly-iii
           forgejo
           jellyfin
@@ -63,6 +67,7 @@ in
           vaultwarden
           website
           zookeeper
+          defenseioGpu
           ;
       };
     };
@@ -76,6 +81,7 @@ in
           microvm
           sambaEris
           postgresEris
+          defenseio
           ;
       };
     };

modules/nixos/guests/firefly-iii/default.nix

@@ -1,7 +1,6 @@
 {
   flake,
   config,
-  pkgs,
   ...
 }:
 let
@@ -56,20 +55,26 @@ in
               SITE_OWNER = email.address2;
             };
           };
+
           phpfpm.pools.firefly-iii.phpEnv = {
             TRUSTED_PROXIES = "*";
             APP_URL = "https://${host}";
           };
+
           firefly-iii-data-importer = {
             enable = true;
           };
+
           caddy = {
             enable = true;
             virtualHosts.":80" = {
               extraConfig = ''
                 root * ${config.services.firefly-iii.package}/public
+
                 file_server
+
                 encode gzip
+
                 php_fastcgi unix//run/phpfpm/firefly-iii.sock {
                   env HTTPS {http.request.header.X-Forwarded-Proto}
                   env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
@@ -77,6 +82,7 @@ in
               '';
             };
           };
+
           postgresql = {
             enable = true;
             ensureDatabases = [ "firefly-iii" ];
@@ -87,6 +93,7 @@ in
               }
             ];
           };
+
           openssh = {
             enable = true;
             settings = {
@@ -95,15 +102,18 @@ in
             };
           };
         };
+
         users.users.caddy = {
           extraGroups = [ "firefly-iii" ];
         };
+
         networking.firewall.allowedTCPPorts = [
           22
           80
           serviceCfg.ports.port0
           serviceCfg.ports.port1
         ];
+
         systemd = {
           services = {
             caddy = {
@@ -151,13 +161,15 @@ in
               ];
             };
           };
+
           tmpfiles.rules = [
             "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
           ];
         };
+
         microvm = {
           vcpu = 1;
-          mem = 512;
+          mem = 1024;
           hypervisor = "qemu";
           interfaces = [
             {

modules/nixos/guests/forgejo/default.nix

@@ -15,11 +15,13 @@ let
 in
 {
   users.users.caddy.extraGroups = [ "acme" ];
+
   security.acme.certs."${host}" = {
     dnsProvider = dns0;
     environmentFile = config.sops.secrets.${dns0Path}.path;
     group = "caddy";
   };
+
   microvm.vms = {
     ${serviceCfg.name} = {
       autostart = true;
@@ -62,6 +64,7 @@ in
               };
             };
           };
+
           openssh = {
             enable = true;
             settings = {
@@ -70,6 +73,7 @@ in
             };
           };
         };
+
         networking.firewall.allowedTCPPorts = [
           22 # SSH
           25 # SMTP
@@ -78,6 +82,7 @@ in
           2525 # SMTP
           serviceCfg.ports.port0
         ];
+
         fileSystems."/tmp" = {
           device = "tmpfs";
           fsType = "tmpfs";
@@ -86,6 +91,7 @@ in
             "mode=1777"
           ];
         };
+
         systemd = {
           network = {
             enable = true;
@@ -104,12 +110,15 @@ in
               ];
             };
           };
+
           tmpfiles.rules = [
             "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
             # "Z /var/lib/postgresql 0755 postgres postgres -"
           ];
         };
+
         systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+
         microvm = {
           vcpu = 1;
           mem = 1024;
@@ -157,18 +166,23 @@ in
       };
     };
   };
+
   systemd.tmpfiles.rules = [
     "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
   ];
+
   services.caddy.virtualHosts."${host}" = {
     extraConfig = ''
       reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
         header_up X-Real-IP {remote_host}
       }
+
       tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
+
       encode zstd gzip
     '';
   };
+
   sops.secrets = {
     "${serviceCfg.name}/smtp" = {
       owner = "root";

modules/nixos/guests/jellyfin/default.nix

@@ -28,6 +28,7 @@ in
             enable = true;
             openFirewall = true;
           };
+
           openssh = {
             enable = true;
             settings = {
@@ -36,20 +37,24 @@ in
             };
           };
         };
+
         users.users.jellyfin = {
           isSystemUser = true;
           group = serviceCfg.name;
           uid = id;
         };
+
         users.groups.jellyfin = {
           gid = id;
         };
+
         networking.firewall.allowedTCPPorts = [
           22
           serviceCfg.ports.port0
           serviceCfg.ports.port1
           serviceCfg.ports.port2
         ];
+
         fileSystems."/tmp" = {
           device = "tmpfs";
           fsType = "tmpfs";
@@ -58,6 +63,7 @@ in
             "mode=1777"
           ];
         };
+
         systemd = {
           network = {
             enable = true;
@@ -76,6 +82,7 @@ in
               ];
             };
           };
+
           tmpfiles.rules = [
             "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
             "Z ${serviceCfg.varPaths.path2} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
@@ -83,9 +90,11 @@ in
             "Z ${serviceCfg.varPaths.path2} 0775 ${serviceCfg.name} ${serviceCfg.name} -"
           ];
         };
+
         systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+
         microvm = {
-          vcpu = 4;
+          vcpu = 2;
           mem = 1024 * 3;
           hypervisor = "qemu";
           interfaces = [
@@ -134,14 +143,24 @@ in
             }
           ];
         };
+        environment.systemPackages = builtins.attrValues {
+          inherit (pkgs)
+            yazi
+            bottom
+            trashy
+            fastfetch
+            ;
+        };
       };
     };
   };
+
   security.acme.certs."${host}" = {
     dnsProvider = dns0;
     environmentFile = config.sops.secrets.${dns0Path}.path;
     group = "caddy";
   };
+
   services = {
     caddy = {
       virtualHosts = {
@@ -163,6 +182,7 @@ in
       gid = id;
       members = [ user0 ];
     };
+
     users = {
       jellyfin = {
         isSystemUser = true;
@@ -172,6 +192,7 @@ in
       caddy.extraGroups = [ "acme" ];
     };
   };
+
   systemd.tmpfiles.rules = [
     "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
     "d ${serviceCfg.mntPaths.path0}/data 0755 microvm wheel - -"

modules/nixos/guests/minecraft/world0/default.nix

@@ -1,6 +1,5 @@
 {
   flake,
-  pkgs,
   ...
 }:
 let
@@ -125,8 +124,8 @@ in
         systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
 
         microvm = {
-          vcpu = 4;
-          mem = 1024 * 4;
+          vcpu = 2;
+          mem = 1024 * 3;
           hypervisor = "qemu";
           interfaces = [
             {

modules/nixos/guests/minecraft/world1/default.nix

@@ -1,6 +1,5 @@
 {
   flake,
-  pkgs,
   ...
 }:
 let
@@ -123,8 +122,8 @@ in
         systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
 
         microvm = {
-          vcpu = 4;
-          mem = 1024 * 4;
+          vcpu = 2;
+          mem = 1024 * 3;
           hypervisor = "qemu";
           interfaces = [
             {

modules/nixos/guests/opencloud/ceresOpenCloud/default.nix

@@ -50,34 +50,9 @@ in
 
         systemd = {
           services = {
-            systemd-networkd.wantedBy = [ "multi-user.target" ];
             opencloud = {
               path = [ pkgs.inotify-tools ];
             };
-            opencloud-fix-permissions = {
-              description = "Fix OpenCloud storage permissions on file changes";
-              after = [ "opencloud.service" ];
-              wantedBy = [ "multi-user.target" ];
-              serviceConfig = {
-                Type = "simple";
-                ExecStart = pkgs.writeShellScript "fix-perms-on-change" ''
-                  ${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do
-                    ${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
-                  done
-                '';
-                Restart = "always";
-                User = "root";
-              };
-            };
-          };
-          timers.opencloud-fix-permissions = {
-            description = "Periodically fix OpenCloud storage permissions";
-            wantedBy = [ "timers.target" ];
-            timerConfig = {
-              OnBootSec = "1min";
-              OnUnitActiveSec = "1min";
-              Unit = "opencloud-fix-permissions.service";
-            };
           };
           network = {
             enable = true;
@@ -106,6 +81,8 @@ in
 
         };
 
+        systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+
         microvm = {
           vcpu = 1;
           mem = 1024 * 1;
@@ -165,6 +142,7 @@ in
             opencloud
             ;
         };
+
       };
     };
   };

modules/nixos/guests/projectSite/default.nix

@@ -15,20 +15,26 @@ in
   systemd.tmpfiles.rules = [
     "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
   ];
+
   microvm.vms.${serviceCfg.name} = {
     autostart = true;
     config = {
       system.stateVersion = "25.05";
+
       networking.firewall.allowedTCPPorts = [
         22
         80
       ];
+
       services.openssh = {
         enable = true;
         settings.PasswordAuthentication = false;
       };
+
       environment.etc."website".source = websitePkg;
+
       users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
       systemd = {
         network = {
           enable = true;
@@ -39,17 +45,21 @@ in
           };
         };
       };
+
       services.caddy = {
         enable = true;
         virtualHosts.":80".extraConfig = ''
           root * /etc/website
+
           file_server
+
           try_files {path} /index.html
         '';
       };
+
       microvm = {
-        vcpu = 1;
-        mem = 512;
+        vcpu = 2;
+        mem = 1024;
         hypervisor = "qemu";
         interfaces = [
           {
@@ -58,6 +68,7 @@ in
             mac = serviceCfg.interface.mac;
           }
         ];
+
         shares = [
           {
             source = "/nix/store";
@@ -69,13 +80,16 @@ in
       };
     };
   };
+
   services.caddy = {
     enable = true;
     virtualHosts.${host}.extraConfig = ''
       reverse_proxy ${serviceCfg.interface.ip}:80
+
       tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem
     '';
   };
+
   security.acme.certs.${host} = {
     dnsProvider = instances.web.dns.provider1;
     environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;

modules/nixos/guests/torrent/default.nix

@@ -120,7 +120,7 @@ in
                 uTPEnabled = true;
                 AlternativeGlobalDLSpeedLimit = 0;
                 AlternativeGlobalUPSpeedLimit = 0;
-                GlobalMaxInactiveSeedingMinutes = 10224;
+                GlobalMaxInactiveSeedingMinutes = 10080;
                 GlobalMaxRatio = -1;
               };
             };
@@ -316,7 +316,7 @@ in
       };
 
       microvm = {
-        vcpu = 1;
+        vcpu = 4;
         mem = 1024 * 1;
         hypervisor = "qemu";
 
@@ -362,6 +362,7 @@ in
           }
         ];
       };
+
       environment.systemPackages = builtins.attrValues {
         inherit (pkgs)
           bottom

modules/nixos/guests/vaultwarden/default.nix

@@ -1,7 +1,6 @@
 {
   config,
   flake,
-  pkgs,
   ...
 }:
 let
@@ -13,6 +12,7 @@ let
   dns0 = instances.web.dns.provider0;
   host = serviceCfg.domains.url0;
   dns0Path = "dns/${dns0}";
+  hostSecrets = "/var/lib/secrets/${serviceCfg.name}";
 in
 {
   microvm.vms = {
@@ -110,7 +110,7 @@ in
 
         microvm = {
           vcpu = 1;
-          mem = 512;
+          mem = 1024;
           hypervisor = "qemu";
           interfaces = [
             {

modules/nixos/guests/website/default.nix

@@ -29,7 +29,6 @@ in
       environment.etc."website".source = websitePkg;
 
       users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
-
       systemd = {
         network = {
           enable = true;
@@ -52,7 +51,7 @@ in
       };
       microvm = {
         vcpu = 1;
-        mem = 512;
+        mem = 1024;
         hypervisor = "qemu";
         interfaces = [
           {

modules/nixos/guests/zookeeper/default.nix

@@ -57,7 +57,7 @@ in
         };
         microvm = {
           vcpu = 1;
-          mem = 512;
+          mem = 1024;
           hypervisor = "qemu";
           interfaces = [
             {
@@ -65,6 +65,18 @@ in
               id = serviceCfg.interface.id;
               mac = serviceCfg.interface.mac;
             }
+            {
+              type = "user";
+              id = serviceCfg.interface.idUser;
+              mac = serviceCfg.interface.macUser;
+            }
+          ];
+          forwardPorts = [
+            {
+              from = "host";
+              host.port = serviceCfg.interface.ssh;
+              guest.port = 22;
+            }
           ];
           shares = [
             {

modules/nixos/services/samba/sambaEris/default.nix

@@ -17,7 +17,7 @@ in
       openFirewall = true;
       settings = {
         "raid0" = {
-          path = "/mnt/storage";
+          path = "/mnt/raid0";
           writable = "yes";
           "valid users" = user0;
           "force user" = user0;
@@ -29,6 +29,11 @@ in
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d /mnt/raid0 0755 ${user0} users -"
+    "Z /mnt/raid0 0755 ${user0} users -"
+  ];
+
   networking = {
     firewall = {
       allowedTCPPorts = [

systems/ceres/config/filesystem.nix

@@ -6,10 +6,31 @@
 }:
 let
   inherit (flake.config.people) user0;
+  inherit (flake.config.machines.devices) eris;
+  erisSecrets = config.sops.secrets."network/server".path;
 
   rootDevice = "/dev/disk/by-label/root";
   bootDevice = "/dev/disk/by-label/BOOT";
 
+  sambaDrives = [
+    "samba0"
+  ];
+
+  sambaFolders = [
+    "raid0"
+  ];
+
+  sambaMounts = sambaDrive: folder: {
+    name = "${eris.${sambaDrive}.mount}/${folder}";
+    value = {
+      device = "${eris.${sambaDrive}.device}/${folder}";
+      fsType = "cifs";
+      options = eris.${sambaDrive}.options ++ [
+        "credentials=${erisSecrets}"
+      ];
+    };
+  };
+
 in
 {
   fileSystems = {
@@ -56,7 +77,10 @@ in
       neededForBoot = true;
     };
 
-  };
+  }
+  // (builtins.listToAttrs (
+    builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
+  ));
 
   boot.initrd.postResumeCommands = lib.mkAfter ''
     mkdir /btrfs_tmp

systems/eris/config/filesystem.nix

@@ -38,13 +38,12 @@ in
       device = "/dev/disk/by-uuid/B645-7527";
       fsType = "vfat";
     };
-    "/mnt/storage" = {
-      device = "/dev/md0";
+    "/mnt/raid0" = {
+      device = "/dev/md127";
       fsType = "ext4";
       options = [
         "defaults"
         "nofail"
-        "x-systemd.device-timeout=10"
       ];
     };
   }
@@ -58,12 +57,8 @@ in
 
   boot.swraid.enable = true;
   boot.swraid.mdadmConf = ''
-    ARRAY /dev/md0 metadata=1.2 name=eris:storage UUID=64659038:a939a18d:8cdc0f3f:97171a50
+    ARRAY /dev/md0 level=raid0 num-devices=2 metadata=1.2
   '';
 
-  systemd.tmpfiles.rules = [
-    "d /mnt/storage 2775 root root -"
-  ];
-
   services.udisks2.enable = true;
 }