From 4a83e1702e1add92e892286ead9176f858403aed Mon Sep 17 00:00:00 2001 From: Nick Date: Tue, 25 Nov 2025 13:01:51 -0600 Subject: [PATCH 1/2] feat: working on sharing server --- modules/config/instances/config/torrent.nix | 3 ++ modules/nixos/default.nix | 10 +--- modules/nixos/guests/torrent/default.nix | 54 ++++++++++++++------- secrets/secrets.yaml | 6 +-- 4 files changed, 45 insertions(+), 28 deletions(-) diff --git a/modules/config/instances/config/torrent.nix b/modules/config/instances/config/torrent.nix index 684774f..ac75a67 100755 --- a/modules/config/instances/config/torrent.nix +++ b/modules/config/instances/config/torrent.nix @@ -28,6 +28,9 @@ in "torrent" "p2p" ]; + ports = { + port0 = 3030; + }; interface = { id = "vm-${name}"; mac = "02:00:00:00:56:07"; diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 282c015..926726c 100755 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -13,14 +13,11 @@ in ivpn network ollamaMars - # plasma plymouth - # sddm tuios wireguard microvm defenseio - # midnight ; }; }; @@ -36,7 +33,6 @@ in wireguard microvm defenseio - # midnight ; }; }; @@ -46,7 +42,6 @@ in inherit (modules) microvm defenseio - # midnight ; }; }; @@ -58,6 +53,7 @@ in caddy ceresOpenCloud comfyui + defenseio firefly-iii forgejo jellyfin @@ -67,10 +63,10 @@ in projectSite restic sambaCeres + torrent vaultwarden website zookeeper - defenseio ; }; }; @@ -82,8 +78,6 @@ in caddy logrotate microvm - # midnight - # opencloud sambaEris postgresEris defenseio diff --git a/modules/nixos/guests/torrent/default.nix b/modules/nixos/guests/torrent/default.nix index a608b35..1663ecb 100755 --- a/modules/nixos/guests/torrent/default.nix +++ b/modules/nixos/guests/torrent/default.nix @@ -1,16 +1,19 @@ { config, flake, - pkgs, ... }: let inherit (flake.config.people) user0; inherit (flake.config.services) instances; serviceCfg = instances.torrent; - host = instances.torrent; + host = instances.torrent.domains.url0; + dns0 = instances.web.dns.provider0; + dns0Path = "dns/${dns0}"; + in { + microvm.vms.${serviceCfg.name} = { autostart = true; config = { @@ -18,7 +21,10 @@ in networking.firewall.allowedTCPPorts = [ 22 - 80 + serviceCfg.ports.port0 + ]; + imports = [ + ./rqbit.nix ]; services = { @@ -42,13 +48,14 @@ in network = { enable = true; networks."10-enp" = { - matchConfig.Name = "enp0s5"; + matchConfig.Name = "enp0s4"; addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ]; gateway = [ serviceCfg.interface.gate ]; }; }; tmpfiles.rules = [ "d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -" + "d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -" ]; }; @@ -62,6 +69,18 @@ in id = serviceCfg.interface.id; mac = serviceCfg.interface.mac; } + { + type = "user"; + id = serviceCfg.interface.idUser; + mac = serviceCfg.interface.macUser; + } + ]; + forwardPorts = [ + { + from = "host"; + host.port = serviceCfg.interface.ssh; + guest.port = 22; + } ]; shares = [ @@ -77,13 +96,12 @@ in source = serviceCfg.mntPaths.path0; tag = "${serviceCfg.name}_data"; } - { - mountPoint = "/run/secrets"; - proto = "virtiofs"; - source = "/run/secrets/${serviceCfg.name}"; - tag = "host_secrets"; - } - + # { + # mountPoint = "/run/secrets"; + # proto = "virtiofs"; + # source = "/run/secrets/${serviceCfg.name}"; + # tag = "host_secrets"; + # } ]; }; environment.systemPackages = [ ]; @@ -99,9 +117,7 @@ in {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH} } - reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} { - header_up X-Real-IP {remote_host} - } + reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} @@ -120,17 +136,21 @@ in }; }; - security.acme.certs.${host} = { - dnsProvider = instances.web.dns.provider1; - environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path; + security.acme.certs."${host}" = { + dnsProvider = dns0; + environmentFile = config.sops.secrets.${dns0Path}.path; + group = "caddy"; }; + users.users.caddy.extraGroups = [ "acme" ]; + systemd = { services.caddy = { serviceConfig = { EnvironmentFile = config.sops.secrets."caddy/${serviceCfg.name}-auth".path; }; }; + tmpfiles.rules = [ "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -" "d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -" diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 2286068..9ca0160 100755 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -47,7 +47,7 @@ glance-jellyfin: ENC[AES256_GCM,data:ozdDKgAWkA88J2j8RtiOP/aQPAt/neUOSlAZF20g510 opencloud: projectenv: ENC[AES256_GCM,data:+XCd3xScfxCN1Zl5L+4RAOjpmMPhVLSBtqH2nkEUpXhssy5EU82qAanNmqwiIJ1VrYXYovuu3XOwRKY3Ub1nsR5h1S0KUCwav2zmFKVopxF/5jVNIk6qR8Ggz/fAa1YQSW+SAnrtRGvP0Q1SERlCgnH4isVxNvWPyWCZKIgiX2Enu7hVwsJXKLYDomRWt47zzXNUzw50aFn7xPtXE/AYbMPBa+FweCrCfkaQ6i6jPvkdc6VBYTqIanD0908wB2SJA+1xvY7bYgRVB17/4a/9DuUN5J4xU84TOW7EFkvC/hWhlhC58GqQrOFyAgTP4YJHKGbLVKPlc4fcNMh5+pENpPG2fRDElCaLoJcYe6sYhaCDSegpDR/U9bgzKirnCu/hmdG+NQ3sGK/C89JL2kZT+tVT1u5JWnKGOGvLGQm73QUmnssDZVd8ubNsnd57W7siqAXY3+DN46yLrGgmTfHTRi4x2DKF8VCD9jXOxWsyoLvKYDyz09H9dI72xlCtSmcrFAt7bY7uEAWutrPCf3Kh/gq6oFUAPBEwfqhgnpgGA1vyA6o4zhxl4Rqye5YZMx2uNkxdA4wmk9KB/e7BVR/P04TSXoAV931OX7bnlw3XjSw5NTPEPnpmwZ3VPRGGkz171RiQQp+CkwUr35+DdwFrGazuv3wlwAhM19h9SRn8jikrw6PPGVehYp8mB/FhpNgqV0nM2DfjaBqE3yMfDzXH5b92t4Q=,iv:6mlHq6yh03x/FbZNu+A9QBoV6ALX1rRWuL13ItJWriI=,tag:tK6Ek2fzgPPWT8WCeU1Frw==,type:str] caddy: - rqbit-auth: ENC[AES256_GCM,data:f1RMi9uGdWP1hGZOzszC87oAhxJ12q55/XFvxQu80nxu1Zn+MfaBVYXi9imtBnaj2tONQ8/zEDsa4xCTRkr5lPCqrCYJ52UM55w+IO9YWQj9BJSF46SloLFJ8tezze4rNBbE0//ptzXGWWCo,iv:Tm7QDocZlPsz+eR48AEhAYCUgw8N0dvhP5n/TvNRVQI=,tag:k9YDt8sSnRksxKScDf11+A==,type:str] + rqbit-auth: ENC[AES256_GCM,data:4fLeeykasmPDtUC5wFRqWEVxRa4ntaiDU2v3AUBdUWxiRQ9EDEk3S1lWpwBtMlan3bU/QsIGVIh/hhWmWD2WdkcaKJxvPGtb9OSJ3wtxCTlI2EsWS1h3BQY4Z1Jf5VVDLR+/dj3mZNv7cu1D,iv:+fIzvbXsE7EoSrfsD1ZzKMmF1BazHre7yXQbjyKdDks=,tag:d/wFZf8szahaU9LqM7lr/g==,type:str] comfyui-auth: ENC[AES256_GCM,data:7VTXoRxnD0NyVCFRAjHaZswEUsFuQd/ZIwVfqGPmNNV87hn6CBYWvxvcPPFwe+uw7BmKMt+I66DyKx5ydYENTWxPocyT/rFdgdtWwNoenj+JwsUzegmMbEiH2HCZdiwKj0h1lo142mtA6zkc,iv:xT5XHCj8D4dyvglstE2oqo92fLdscCkaNMux43hJ7nQ=,tag:HgU9wAmjPvfoDXgnorB5yA==,type:str] wifi-home: ENC[AES256_GCM,data:5NYSCUyalDf7gZF7WaRQJCo=,iv:RkVZKsmVEBg5M28DSkBD41673iLM+dqDAAhSwjqejck=,tag:QQ17VSWOnU0bGglZq6455Q==,type:str] firefly-iii: @@ -70,7 +70,7 @@ sops: bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-24T08:50:25Z" - mac: ENC[AES256_GCM,data:bBYF/In0Wx1YVA39RRwR1sHyLlZTw+AhuSdHTevaqk5s55hyLk5Bk7Z1y/JPQiARezzoRC3tVkLI1Chuhj3IGyo34EoYUesKsvg99Gy1Y3K94VbqoeFub/nOE/Kgm6g2okyfx3jAgQ8HnLTHA4YS/u6reR77U+Engf6ASCuMNnc=,iv:wlsvXcpcgB9zTcZAjkhaIdulSM1ReaNPcQyn1HHAxAU=,tag:8JwOPmMady60wGMpM8mqmQ==,type:str] + lastmodified: "2025-11-25T10:47:46Z" + mac: ENC[AES256_GCM,data:JF264gi1QgOcPk9GVzFeWrPa9T5AuHxuYQTVLbpSoGnqJEwQCvmsYKe1guqlNRlxm11VDGSa3DB1++0fpd4Vn7ngTxQuLCkCbnBo3fU+SDxe3gYt4c21pT3qabbcIuCGTqf6fy32ZWi8BabcFN1hN+LWuSox40PugnuU5SgZdXs=,iv:dbQb4OITPZozKyprRUV9df22zu+XwAr2S28K4A4Ki5I=,tag:alTMCTyKq/Cxn21h06kkGQ==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 From 0d43e3650aae93bd27adc7b731eca6d90a2ee04d Mon Sep 17 00:00:00 2001 From: Nick Date: Tue, 25 Nov 2025 15:34:36 -0600 Subject: [PATCH 2/2] feat: added tshark --- modules/home/cli/utilities/tshark/default.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 modules/home/cli/utilities/tshark/default.nix diff --git a/modules/home/cli/utilities/tshark/default.nix b/modules/home/cli/utilities/tshark/default.nix new file mode 100644 index 0000000..838fd1a --- /dev/null +++ b/modules/home/cli/utilities/tshark/default.nix @@ -0,0 +1,11 @@ +{ + pkgs, + ... +}: +{ + home.packages = builtins.attrValues { + inherit (pkgs) + tshark + ; + }; +}