upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-07 21:42:16 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

Compare commits

base: upRootNutrition:30593b866e05ddc1294b7c5b3e6a5d5d321de447
Branches Tags
upRootNutrition:main
..
compare: upRootNutrition:d48c3ce4e526a605065e09f3a4ef4d674db6084b
Branches Tags
upRootNutrition:main

No commits in common. "30593b866e05ddc1294b7c5b3e6a5d5d321de447" and "d48c3ce4e526a605065e09f3a4ef4d674db6084b" have entirely different histories.
30593b866e ... d48c3ce4e5

15 changed files with 132 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/nixos/default.nix
View file

@ -17,6 +17,7 @@ in
tuios tuios
wireguard wireguard
microvm microvm
defenseio
; ;
}; };
}; };
@ -31,6 +32,7 @@ in
plymouth plymouth
wireguard wireguard
microvm microvm
defenseio
; ;
}; };
}; };
@ -39,6 +41,7 @@ in
imports = builtins.attrValues { imports = builtins.attrValues {
inherit (modules) inherit (modules)
microvm microvm
defenseio
; ;
}; };
}; };
@ -50,6 +53,7 @@ in
caddy caddy
ceresOpenCloud ceresOpenCloud
comfyui comfyui
defenseio
firefly-iii firefly-iii
forgejo forgejo
jellyfin jellyfin
@ -63,6 +67,7 @@ in
vaultwarden vaultwarden
website website
zookeeper zookeeper
defenseioGpu
; ;
}; };
}; };
@ -76,6 +81,7 @@ in
microvm microvm
sambaEris sambaEris
postgresEris postgresEris
defenseio
; ;
}; };
}; };

16
modules/nixos/guests/firefly-iii/default.nix
View file

@ -1,7 +1,6 @@
{ {
flake, flake,
config, config,
pkgs,
... ...
}: }:
let let
@ -56,20 +55,26 @@ in
SITE_OWNER = email.address2; SITE_OWNER = email.address2;
}; };
}; };
phpfpm.pools.firefly-iii.phpEnv = { phpfpm.pools.firefly-iii.phpEnv = {
TRUSTED_PROXIES = "*"; TRUSTED_PROXIES = "*";
APP_URL = "https://${host}"; APP_URL = "https://${host}";
}; };
firefly-iii-data-importer = { firefly-iii-data-importer = {
enable = true; enable = true;
}; };
caddy = { caddy = {
enable = true; enable = true;
virtualHosts.":80" = { virtualHosts.":80" = {
extraConfig = '' extraConfig = ''
root * ${config.services.firefly-iii.package}/public root * ${config.services.firefly-iii.package}/public
file_server file_server
encode gzip encode gzip
php_fastcgi unix//run/phpfpm/firefly-iii.sock { php_fastcgi unix//run/phpfpm/firefly-iii.sock {
env HTTPS {http.request.header.X-Forwarded-Proto} env HTTPS {http.request.header.X-Forwarded-Proto}
env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto} env HTTP_X_FORWARDED_PROTO {http.request.header.X-Forwarded-Proto}
@ -77,6 +82,7 @@ in
''; '';
}; };
}; };
postgresql = { postgresql = {
enable = true; enable = true;
ensureDatabases = [ "firefly-iii" ]; ensureDatabases = [ "firefly-iii" ];
@ -87,6 +93,7 @@ in
} }
]; ];
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -95,15 +102,18 @@ in
}; };
}; };
}; };
users.users.caddy = { users.users.caddy = {
extraGroups = [ "firefly-iii" ]; extraGroups = [ "firefly-iii" ];
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 22
80 80
serviceCfg.ports.port0 serviceCfg.ports.port0
serviceCfg.ports.port1 serviceCfg.ports.port1
]; ];
systemd = { systemd = {
services = { services = {
caddy = { caddy = {
@ -151,13 +161,15 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
]; ];
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 512; mem = 1024;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

14
modules/nixos/guests/forgejo/default.nix
View file

@ -15,11 +15,13 @@ let
in in
{ {
users.users.caddy.extraGroups = [ "acme" ]; users.users.caddy.extraGroups = [ "acme" ];
security.acme.certs."${host}" = { security.acme.certs."${host}" = {
dnsProvider = dns0; dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path; environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy"; group = "caddy";
}; };
microvm.vms = { microvm.vms = {
${serviceCfg.name} = { ${serviceCfg.name} = {
autostart = true; autostart = true;
@ -62,6 +64,7 @@ in
}; };
}; };
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -70,6 +73,7 @@ in
}; };
}; };
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 # SSH 22 # SSH
25 # SMTP 25 # SMTP
@ -78,6 +82,7 @@ in
2525 # SMTP 2525 # SMTP
serviceCfg.ports.port0 serviceCfg.ports.port0
]; ];
fileSystems."/tmp" = { fileSystems."/tmp" = {
device = "tmpfs"; device = "tmpfs";
fsType = "tmpfs"; fsType = "tmpfs";
@ -86,6 +91,7 @@ in
"mode=1777" "mode=1777"
]; ];
}; };
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -104,12 +110,15 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
# "Z /var/lib/postgresql 0755 postgres postgres -" # "Z /var/lib/postgresql 0755 postgres postgres -"
]; ];
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024; mem = 1024;
@ -157,18 +166,23 @@ in
}; };
}; };
}; };
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
]; ];
services.caddy.virtualHosts."${host}" = { services.caddy.virtualHosts."${host}" = {
extraConfig = '' extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} { reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
header_up X-Real-IP {remote_host} header_up X-Real-IP {remote_host}
} }
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
encode zstd gzip encode zstd gzip
''; '';
}; };
sops.secrets = { sops.secrets = {
"${serviceCfg.name}/smtp" = { "${serviceCfg.name}/smtp" = {
owner = "root"; owner = "root";

23
modules/nixos/guests/jellyfin/default.nix
View file

@ -28,6 +28,7 @@ in
enable = true; enable = true;
openFirewall = true; openFirewall = true;
}; };
openssh = { openssh = {
enable = true; enable = true;
settings = { settings = {
@ -36,20 +37,24 @@ in
}; };
}; };
}; };
users.users.jellyfin = { users.users.jellyfin = {
isSystemUser = true; isSystemUser = true;
group = serviceCfg.name; group = serviceCfg.name;
uid = id; uid = id;
}; };
users.groups.jellyfin = { users.groups.jellyfin = {
gid = id; gid = id;
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 22
serviceCfg.ports.port0 serviceCfg.ports.port0
serviceCfg.ports.port1 serviceCfg.ports.port1
serviceCfg.ports.port2 serviceCfg.ports.port2
]; ];
fileSystems."/tmp" = { fileSystems."/tmp" = {
device = "tmpfs"; device = "tmpfs";
fsType = "tmpfs"; fsType = "tmpfs";
@ -58,6 +63,7 @@ in
"mode=1777" "mode=1777"
]; ];
}; };
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -76,6 +82,7 @@ in
]; ];
}; };
}; };
tmpfiles.rules = [ tmpfiles.rules = [
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"Z ${serviceCfg.varPaths.path2} 0755 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path2} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
@ -83,9 +90,11 @@ in
"Z ${serviceCfg.varPaths.path2} 0775 ${serviceCfg.name} ${serviceCfg.name} -" "Z ${serviceCfg.varPaths.path2} 0775 ${serviceCfg.name} ${serviceCfg.name} -"
]; ];
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 4; vcpu = 2;
mem = 1024 * 3; mem = 1024 * 3;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
@ -134,14 +143,24 @@ in
} }
]; ];
}; };
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
yazi
bottom
trashy
fastfetch
;
};
}; };
}; };
}; };
security.acme.certs."${host}" = { security.acme.certs."${host}" = {
dnsProvider = dns0; dnsProvider = dns0;
environmentFile = config.sops.secrets.${dns0Path}.path; environmentFile = config.sops.secrets.${dns0Path}.path;
group = "caddy"; group = "caddy";
}; };
services = { services = {
caddy = { caddy = {
virtualHosts = { virtualHosts = {
@ -163,6 +182,7 @@ in
gid = id; gid = id;
members = [ user0 ]; members = [ user0 ];
}; };
users = { users = {
jellyfin = { jellyfin = {
isSystemUser = true; isSystemUser = true;
@ -172,6 +192,7 @@ in
caddy.extraGroups = [ "acme" ]; caddy.extraGroups = [ "acme" ];
}; };
}; };
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
"d ${serviceCfg.mntPaths.path0}/data 0755 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/data 0755 microvm wheel - -"

5
modules/nixos/guests/minecraft/world0/default.nix
View file

@ -1,6 +1,5 @@
{ {
flake, flake,
pkgs,
... ...
}: }:
let let
@ -125,8 +124,8 @@ in
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 4; vcpu = 2;
mem = 1024 * 4; mem = 1024 * 3;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

5
modules/nixos/guests/minecraft/world1/default.nix
View file

@ -1,6 +1,5 @@
{ {
flake, flake,
pkgs,
... ...
}: }:
let let
@ -123,8 +122,8 @@ in
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 4; vcpu = 2;
mem = 1024 * 4; mem = 1024 * 3;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

28
modules/nixos/guests/opencloud/ceresOpenCloud/default.nix
View file

@ -50,34 +50,9 @@ in
systemd = { systemd = {
services = { services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
opencloud = { opencloud = {
path = [ pkgs.inotify-tools ]; path = [ pkgs.inotify-tools ];
}; };
opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions on file changes";
after = [ "opencloud.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
ExecStart = pkgs.writeShellScript "fix-perms-on-change" ''
${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do
${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
done
'';
Restart = "always";
User = "root";
};
};
};
timers.opencloud-fix-permissions = {
description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "1min";
OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service";
};
}; };
network = { network = {
enable = true; enable = true;
@ -106,6 +81,8 @@ in
}; };
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 1024 * 1; mem = 1024 * 1;
@ -165,6 +142,7 @@ in
opencloud opencloud
; ;
}; };
}; };
}; };
}; };

18
modules/nixos/guests/projectSite/default.nix
View file

@ -15,20 +15,26 @@ in
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -" "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
]; ];
microvm.vms.${serviceCfg.name} = { microvm.vms.${serviceCfg.name} = {
autostart = true; autostart = true;
config = { config = {
system.stateVersion = "25.05"; system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
22 22
80 80
]; ];
services.openssh = { services.openssh = {
enable = true; enable = true;
settings.PasswordAuthentication = false; settings.PasswordAuthentication = false;
}; };
environment.etc."website".source = websitePkg; environment.etc."website".source = websitePkg;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -39,17 +45,21 @@ in
}; };
}; };
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts.":80".extraConfig = '' virtualHosts.":80".extraConfig = ''
root * /etc/website root * /etc/website
file_server file_server
try_files {path} /index.html try_files {path} /index.html
''; '';
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 2;
mem = 512; mem = 1024;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {
@ -58,6 +68,7 @@ in
mac = serviceCfg.interface.mac; mac = serviceCfg.interface.mac;
} }
]; ];
shares = [ shares = [
{ {
source = "/nix/store"; source = "/nix/store";
@ -69,13 +80,16 @@ in
}; };
}; };
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts.${host}.extraConfig = '' virtualHosts.${host}.extraConfig = ''
reverse_proxy ${serviceCfg.interface.ip}:80 reverse_proxy ${serviceCfg.interface.ip}:80
tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem tls /var/lib/acme/${host}/fullchain.pem /var/lib/acme/${host}/key.pem
''; '';
}; };
security.acme.certs.${host} = { security.acme.certs.${host} = {
dnsProvider = instances.web.dns.provider1; dnsProvider = instances.web.dns.provider1;
environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path; environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;

5
modules/nixos/guests/torrent/default.nix
View file

@ -120,7 +120,7 @@ in
uTPEnabled = true; uTPEnabled = true;
AlternativeGlobalDLSpeedLimit = 0; AlternativeGlobalDLSpeedLimit = 0;
AlternativeGlobalUPSpeedLimit = 0; AlternativeGlobalUPSpeedLimit = 0;
GlobalMaxInactiveSeedingMinutes = 10224; GlobalMaxInactiveSeedingMinutes = 10080;
GlobalMaxRatio = -1; GlobalMaxRatio = -1;
}; };
}; };
@ -316,7 +316,7 @@ in
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 4;
mem = 1024 * 1; mem = 1024 * 1;
hypervisor = "qemu"; hypervisor = "qemu";
@ -362,6 +362,7 @@ in
} }
]; ];
}; };
environment.systemPackages = builtins.attrValues { environment.systemPackages = builtins.attrValues {
inherit (pkgs) inherit (pkgs)
bottom bottom

4
modules/nixos/guests/vaultwarden/default.nix
View file

@ -1,7 +1,6 @@
{ {
config, config,
flake, flake,
pkgs,
... ...
}: }:
let let
@ -13,6 +12,7 @@ let
dns0 = instances.web.dns.provider0; dns0 = instances.web.dns.provider0;
host = serviceCfg.domains.url0; host = serviceCfg.domains.url0;
dns0Path = "dns/${dns0}"; dns0Path = "dns/${dns0}";
hostSecrets = "/var/lib/secrets/${serviceCfg.name}";
in in
{ {
microvm.vms = { microvm.vms = {
@ -110,7 +110,7 @@ in
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 512; mem = 1024;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

3
modules/nixos/guests/website/default.nix
View file

@ -29,7 +29,6 @@ in
environment.etc."website".source = websitePkg; environment.etc."website".source = websitePkg;
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
systemd = { systemd = {
network = { network = {
enable = true; enable = true;
@ -52,7 +51,7 @@ in
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 512; mem = 1024;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {

14
modules/nixos/guests/zookeeper/default.nix
View file

@ -57,7 +57,7 @@ in
}; };
microvm = { microvm = {
vcpu = 1; vcpu = 1;
mem = 512; mem = 1024;
hypervisor = "qemu"; hypervisor = "qemu";
interfaces = [ interfaces = [
{ {
@ -65,6 +65,18 @@ in
id = serviceCfg.interface.id; id = serviceCfg.interface.id;
mac = serviceCfg.interface.mac; mac = serviceCfg.interface.mac;
} }
{
type = "user";
id = serviceCfg.interface.idUser;
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
host.port = serviceCfg.interface.ssh;
guest.port = 22;
}
]; ];
shares = [ shares = [
{ {

7
modules/nixos/services/samba/sambaEris/default.nix
View file

@ -17,7 +17,7 @@ in
openFirewall = true; openFirewall = true;
settings = { settings = {
"raid0" = { "raid0" = {
path = "/mnt/storage"; path = "/mnt/raid0";
writable = "yes"; writable = "yes";
"valid users" = user0; "valid users" = user0;
"force user" = user0; "force user" = user0;
@ -29,6 +29,11 @@ in
}; };
}; };
systemd.tmpfiles.rules = [
"d /mnt/raid0 0755 ${user0} users -"
"Z /mnt/raid0 0755 ${user0} users -"
];
networking = { networking = {
firewall = { firewall = {
allowedTCPPorts = [ allowedTCPPorts = [

26
systems/ceres/config/filesystem.nix
View file

@ -6,10 +6,31 @@
}: }:
let let
inherit (flake.config.people) user0; inherit (flake.config.people) user0;
inherit (flake.config.machines.devices) eris;
erisSecrets = config.sops.secrets."network/server".path;
rootDevice = "/dev/disk/by-label/root"; rootDevice = "/dev/disk/by-label/root";
bootDevice = "/dev/disk/by-label/BOOT"; bootDevice = "/dev/disk/by-label/BOOT";
sambaDrives = [
"samba0"
];
sambaFolders = [
"raid0"
];
sambaMounts = sambaDrive: folder: {
name = "${eris.${sambaDrive}.mount}/${folder}";
value = {
device = "${eris.${sambaDrive}.device}/${folder}";
fsType = "cifs";
options = eris.${sambaDrive}.options ++ [
"credentials=${erisSecrets}"
];
};
};
in in
{ {
fileSystems = { fileSystems = {
@ -56,7 +77,10 @@ in
neededForBoot = true; neededForBoot = true;
}; };
}; }
// (builtins.listToAttrs (
builtins.concatMap (drive: map (folder: sambaMounts drive folder) sambaFolders) sambaDrives
));
boot.initrd.postResumeCommands = lib.mkAfter '' boot.initrd.postResumeCommands = lib.mkAfter ''
mkdir /btrfs_tmp mkdir /btrfs_tmp

11
systems/eris/config/filesystem.nix
View file

@ -38,13 +38,12 @@ in
device = "/dev/disk/by-uuid/B645-7527"; device = "/dev/disk/by-uuid/B645-7527";
fsType = "vfat"; fsType = "vfat";
}; };
"/mnt/storage" = { "/mnt/raid0" = {
device = "/dev/md0"; device = "/dev/md127";
fsType = "ext4"; fsType = "ext4";
options = [ options = [
"defaults" "defaults"
"nofail" "nofail"
"x-systemd.device-timeout=10"
]; ];
}; };
} }
@ -58,12 +57,8 @@ in
boot.swraid.enable = true; boot.swraid.enable = true;
boot.swraid.mdadmConf = '' boot.swraid.mdadmConf = ''
ARRAY /dev/md0 metadata=1.2 name=eris:storage UUID=64659038:a939a18d:8cdc0f3f:97171a50 ARRAY /dev/md0 level=raid0 num-devices=2 metadata=1.2
''; '';
systemd.tmpfiles.rules = [
"d /mnt/storage 2775 root root -"
];
services.udisks2.enable = true; services.udisks2.enable = true;
} }