upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-08-09 05:14:41 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: upRootNutrition:88aa4f16ecf8ecbe56036e87a84a369de595caaf
Branches Tags
upRootNutrition:main
..
compare: upRootNutrition:06a684fa32fb1cb7d46e0b3dc4ebbdb38c53c9dc
Branches Tags
upRootNutrition:main

No commits in common. "88aa4f16ecf8ecbe56036e87a84a369de595caaf" and "06a684fa32fb1cb7d46e0b3dc4ebbdb38c53c9dc" have entirely different histories.
88aa4f16ec ... 06a684fa32

5 changed files with 2 additions and 167 deletions
Download patch file Download diff file Expand all files Collapse all files

38
modules/config/instances/config/firefly-iii.nix
View file

@ -1,38 +0,0 @@
{ moduleFunctions }:
let
inherit (moduleFunctions.instancesFunctions)
domain0
servicePath
sslPath
sopsPath
;
label = "Firefly-III";
name = "firefly-iii";
subdomain = "finances";
domain = "${subdomain}.${domain0}";
in
{
label = label;
name = name;
email = {
address0 = "noreply@${name}.${domain0}";
};
sops = {
path0 = "${sopsPath}/${name}";
};
domains = {
url0 = domain;
};
subdomain = subdomain;
paths = {
path0 = "${servicePath}/${label}";
};
ports = {
port0 = 3306;
};
ssl = {
cert = "${sslPath}/${subdomain}.${domain0}/fullchain.pem";
key = "${sslPath}/${subdomain}.${domain0}/key.pem";
};
}

1
modules/nixos/default.nix
View file

@ -66,7 +66,6 @@ in
searx
vaultwarden
forgejo
firefly
;
};
};

1
modules/nixos/services/acme/default.nix
View file

@ -41,7 +41,6 @@ in
"podgrab"
"vaultwarden"
"audiobookshelf"
"firefly-iii"
]
)
++ (map

123
modules/nixos/services/firefly/default.nix
View file

@ -1,123 +0,0 @@
{ flake, config, ... }:
let
inherit (flake.config.people) user0;
inherit (flake.config.people.users.${user0}) email;
inherit (flake.config.services.instances) firefly-iii web;
inherit (flake.config.machines.devices) ceres;
service = firefly-iii;
localhost = web.localhost.address1;
host = service.domains.url0;
in
{
services = {
firefly-iii = {
enable = true;
virtualHost = host;
enableNginx = true;
settings = {
APP_KEY_FILE = config.sops.secrets."${service.name}-key".path;
SITE_OWNER = email.address0;
DB_DATABASE = "firefly";
DB_USERNAME = "firefly";
DB_PASSWORD_FILE = config.sops.secrets."${service.name}-pass".path;
TRUSTED_PROXIES = "**";
};
};
nginx = {
enable = true;
virtualHosts.${config.services.firefly-iii.virtualHost} = {
listen = [
{
addr = "0.0.0.0";
port = 8080;
}
];
};
};
caddy = {
virtualHosts = {
"${host}" = {
extraConfig = ''
encode gzip
reverse_proxy localhost:8080 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Ssl on
header_up Connection ""
timeout 240s
dial_timeout 240s
}
@session_cookie header Cookie *session*
handle @session_cookie {
header Cache-Control "no-cache, no-store, must-revalidate"
}
request_body {
max_size 64MB
}
tls ${service.ssl.cert} ${service.ssl.key}
'';
};
};
};
};
sops =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}";
owner = service.name;
mode = "600";
};
in
{
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}-${secret}";
value = sopsPath secret;
})
[
"key"
"pass"
]
);
};
# fileSystems."/var/lib/${service.name}" = {
# device = service.paths.path0;
# fsType = "none";
# options = [
# "bind"
# ];
# depends = [
# ceres.storage0.mount
# ];
# };
users.users.${service.name}.extraGroups = [
"caddy"
];
systemd.tmpfiles.rules = [
# "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
"Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
];
networking = {
firewall = {
allowedTCPPorts = [
8080
service.ports.port0
];
};
};
}

6
secrets/secrets.yaml
View file

@ -37,8 +37,6 @@ wireguard-CA627: ENC[AES256_GCM,data:chmDsH2nE0nagjFRZWuxX08/Ykt+rIgCHYkMHd+7nIq
glance-jellyfin: ENC[AES256_GCM,data:ozdDKgAWkA88J2j8RtiOP/aQPAt/neUOSlAZF20g510=,iv:x+VhYlnA9F/VPrzVcma4/oPelCc8kjWoTZvOs4L9Uqo=,tag:crdSDjr8Y5GH/JAF6t8Yeg==,type:str]
kanboard-smtp: ENC[AES256_GCM,data:eOIEGwJZlvbJaTfDRU3IFQ==,iv:Jex01WlHG3uxqUnTSF+v1BgnNcIu4cS9OwHBCFl1m28=,tag:3Eld1FkI6AftlCyC3419BA==,type:str]
podgrab-pass: ENC[AES256_GCM,data:DVmJDb4VqcZDKNcedSaRA5dqKOzx1tSzDiK3i23+a6v3nK+4Kh7n8EA=,iv:SiiUjJLHkCOO1VKCmubftKx06laFqNv79tIPnkVYrJU=,tag:kdkT+03DemlNAsuzps8fnw==,type:str]
firefly-iii-key: ENC[AES256_GCM,data:tLJfwB8De1vdGeccr4SxifU7KYAfnasoXISvz5mSR28=,iv:vknG+h2D04lECHE/PPA53aZqWk4ouYcH+WfP7WooPYU=,tag:HKma2cydw58pAnvOFH53fA==,type:str]
firefly-iii-pass: ENC[AES256_GCM,data:eJwIM4YHnXTqTOUfU/0CKMSS534VEZIxkBviI1pd7R4=,iv:pUv8ok5nLDGeCcP2hsTculk+MPPAjkupidQO0Jkc3Wc=,tag:zq7+lFjdOr5ORpthqXW8EA==,type:str]
sops:
age:
- recipient: age19dpncsdphdt2tmknjs99eghk527pvdrw0m29qjn2z2gg3et5tdtqycqhl0
@ -50,7 +48,7 @@ sops:
bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD
aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-06-27T07:07:16Z"
mac: ENC[AES256_GCM,data:yNS+bjiHnrHHmmMkChrF5PmxrYAY9HEEErhScsxTNS2OIpiK3Q+ARiTfmT01vmqFBu63RtYJFPQ3gXM1iNrqjQcnp0btXPo2uvLewbHqfj6UaQsj34GXzf9dIzeHAnXWxtlJxkrCA1ufVwW78bzlDt0x64DhboWk5pqlDUaGR6Y=,iv:oEZzK7RBxIK/DbV3wvbL4UYB59PBygGFV3uktHtjVjg=,tag:Lldass5AJL3Ka1bniaxECg==,type:str]
lastmodified: "2025-06-25T21:19:21Z"
mac: ENC[AES256_GCM,data:bCdXkiK+gEgdz+MG4Npne7s3PjZL135U4H8vWWxtDoOnCXi+gbKzPMKzwpFkAflfAwWttiswb2I4dfiFFIaEezILmCA5dE48WMZFccyMdCrU30FscQ2x1b41AGrQdiZK4ZwVR7iWSNbcmOJMjIXA8c97Q4ldIInYaSleEt1kvuk=,iv:RNH6cRUOKGfuHaWeNhIsibdpX6ULEtw8KuApTdZb4Vg=,tag:p9CzqXZDxk6hVIL/BK/8Rw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2