file cleanup, conditional motd
This commit is contained in:
@@ -1,13 +1,11 @@
|
||||
{
|
||||
pkgs,
|
||||
nixpkgs-unstable,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "ollama";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
@@ -41,7 +39,10 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -59,10 +60,6 @@ in {
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
# if you wanna attempt system ssh again
|
||||
#openssh.authorizedKeys.keyFiles = [
|
||||
# "${cfg.data_dir}/.ssh/authorized_keys"
|
||||
#];
|
||||
};
|
||||
|
||||
# declare the gitea service
|
||||
@@ -94,25 +91,11 @@ in {
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
# homelab.glance.links.services = [{
|
||||
# title = service;
|
||||
# url = "https://git.${homelab.base_domain}";
|
||||
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
# icon = "di:${service}"; }];
|
||||
|
||||
# manage secrets with sops
|
||||
# sops.secrets = {
|
||||
# "${service}_database_password" = {
|
||||
# owner = service;
|
||||
# group = service;
|
||||
# };
|
||||
# };
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
${service} = {
|
||||
paths = [cfg.data_dir "/var/lib/private"];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,13 +1,11 @@
|
||||
{
|
||||
pkgs,
|
||||
nixpkgs-unstable,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "open-webui";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
@@ -41,7 +39,10 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -59,10 +60,6 @@ in {
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
# if you wanna attempt system ssh again
|
||||
#openssh.authorizedKeys.keyFiles = [
|
||||
# "${cfg.data_dir}/.ssh/authorized_keys"
|
||||
#];
|
||||
};
|
||||
|
||||
# declare the gitea service
|
||||
@@ -100,17 +97,11 @@ in {
|
||||
}
|
||||
];
|
||||
|
||||
# manage secrets with sops
|
||||
# sops.secrets = {
|
||||
# "${service}_database_password" = {
|
||||
# owner = service;
|
||||
# group = service;
|
||||
# };
|
||||
# };
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
${service} = {
|
||||
paths = [cfg.data_dir "/var/lib/private"];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -14,7 +14,7 @@ in {
|
||||
description = "set timezone";
|
||||
};
|
||||
base_domain = lib.mkOption {
|
||||
default = "snowbelle.lan";
|
||||
default = "lumiose.blakedheld.xyz";
|
||||
type = lib.types.str;
|
||||
description = "base domain used for reverse proxy";
|
||||
};
|
||||
|
||||
@@ -6,7 +6,6 @@
|
||||
}: let
|
||||
service = "audiobookshelf";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
@@ -76,16 +75,11 @@ in {
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = ["abs.${homelab.public_domain}"];
|
||||
#serverAliases = ["abs.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port} {
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "bazarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,14 +39,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -55,7 +58,7 @@ in
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
extraGroups = ["media"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
@@ -72,9 +75,6 @@ in
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
@@ -84,16 +84,19 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.mediastack = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "flaresolverr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,14 +39,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -68,9 +71,6 @@ in
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "jellyfin";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -43,9 +44,8 @@ in
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -55,7 +55,7 @@ in
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" "video" "render" ];
|
||||
extraGroups = ["media" "video" "render"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
@@ -72,14 +72,9 @@ in
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
#services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "media.${homelab.public_domain}" ];
|
||||
#tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
|
||||
serverAliases = ["media.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
@@ -87,16 +82,19 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://media.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.mediastack = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://media.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "prowlarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,14 +39,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -55,7 +58,7 @@ in
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
extraGroups = ["media"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
@@ -74,9 +77,6 @@ in
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
@@ -86,16 +86,21 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.mediastack = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {
|
||||
paths = [cfg.data_dir "/var/lib/private"];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "qbittorrent";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -16,11 +17,11 @@ in
|
||||
default = 7103;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
# torrenting_port = lib.mkOption {
|
||||
# type = lib.types.int;
|
||||
# default = ;
|
||||
# description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
# };
|
||||
# torrenting_port = lib.mkOption {
|
||||
# type = lib.types.int;
|
||||
# default = ;
|
||||
# description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
# };
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "qbit.${homelab.base_domain}";
|
||||
@@ -48,16 +49,18 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# ensure media dirs existence
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /holocron/media/downloads 2775 qbittorrent media -"
|
||||
];
|
||||
];
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -74,10 +77,10 @@ in
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = lib.mkForce "media"; # override for permissions
|
||||
group = lib.mkForce "media"; # override for permissions
|
||||
profileDir = cfg.data_dir;
|
||||
webuiPort = cfg.port;
|
||||
# torrentingPort = cfg.torrenting_port;
|
||||
# torrentingPort = cfg.torrenting_port;
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
@@ -102,18 +105,6 @@ in
|
||||
iptables -A QBIT -j DROP
|
||||
'';
|
||||
|
||||
# boilerplate for if you ever want to try to get this working again
|
||||
# ------------------------------------------------------------------------------
|
||||
# # add systemd service to VPN network namespace
|
||||
# vpnConfinement = {
|
||||
# enable = true;
|
||||
# vpnNamespace = "wgmex";
|
||||
# };
|
||||
# ------------------------------------------------------------------------------
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
@@ -123,16 +114,19 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.mediastack = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "radarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,17 +40,19 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# required
|
||||
environment.systemPackages = with pkgs; [ffmpeg_6-headless];
|
||||
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -58,7 +62,7 @@ in
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
extraGroups = ["media"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
@@ -76,13 +80,10 @@ in
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
# User = service;
|
||||
# Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
@@ -92,16 +93,19 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.mediastack = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -6,7 +6,6 @@
|
||||
}: let
|
||||
service = "sonarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
@@ -40,7 +39,10 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -79,12 +81,8 @@ in {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
# tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "yacreader";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,17 +39,19 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# install the binary
|
||||
environment.systemPackages = with pkgs; [ yacreader ];
|
||||
environment.systemPackages = with pkgs; [yacreader];
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -58,15 +61,15 @@ in
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
extraGroups = ["media"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
systemd.services.${service} = {
|
||||
description = "${service} library server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network.target"];
|
||||
|
||||
serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
User = service;
|
||||
@@ -81,7 +84,7 @@ in
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
@@ -92,18 +95,20 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance local service
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:yac-reader"; }];
|
||||
# add to glance local service
|
||||
homelab.glance.links.mediastack = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:yac-reader";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "caddy";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -28,12 +30,14 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {};
|
||||
|
||||
@@ -57,13 +61,14 @@ in
|
||||
globalConfig = ''
|
||||
auto_https ignore_loaded_certs
|
||||
'';
|
||||
|
||||
|
||||
# static page for hosting key files
|
||||
virtualHosts."keys.${homelab.base_domain}" = {
|
||||
serverAliases = [ "keys.${homelab.public_domain}" ];
|
||||
serverAliases = ["keys.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
root /var/www/keys
|
||||
file_server browse
|
||||
tls internal
|
||||
root /var/www/keys
|
||||
file_server browse
|
||||
'';
|
||||
};
|
||||
};
|
||||
@@ -80,7 +85,7 @@ in
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
|
||||
sops.secrets = {
|
||||
"ssl_blakedheld_crt" = {
|
||||
@@ -104,26 +109,26 @@ in
|
||||
path = "/var/www/keys/caddy_root.crt";
|
||||
};
|
||||
};
|
||||
|
||||
environment.etc."caddy/browse.html".text = ''
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>{{html .Name}}</title>
|
||||
<style>
|
||||
footer { display: none !important; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
{{template "listing" .}}
|
||||
</body>
|
||||
</html>
|
||||
'';
|
||||
|
||||
environment.etc."caddy/browse.html".text = ''
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>{{html .Name}}</title>
|
||||
<style>
|
||||
footer { display: none !important; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
{{template "listing" .}}
|
||||
</body>
|
||||
</html>
|
||||
'';
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
homelab.backups.baks = {
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,6 @@
|
||||
...
|
||||
}: let
|
||||
cfg = config.homelab.ddns;
|
||||
token = config.sops.secrets."cloudflare/api_token".path;
|
||||
sec = config.sops.secrets;
|
||||
in {
|
||||
options.homelab.ddns = {
|
||||
@@ -15,7 +14,7 @@ in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.cloudflare-ddns = {
|
||||
enable = true;
|
||||
credentialsFile = token;
|
||||
credentialsFile = sec."cloudflare/api_token".path;
|
||||
domains = [
|
||||
# recoil.pro
|
||||
"recoil.pro"
|
||||
@@ -31,12 +30,9 @@ in {
|
||||
"*.blakedheld.xyz"
|
||||
"git.blakedheld.xyz"
|
||||
"up.blakedheld.xyz"
|
||||
|
||||
];
|
||||
};
|
||||
|
||||
# network config
|
||||
|
||||
# declare authkey secrets
|
||||
sops.secrets = {
|
||||
"cloudflare/api_token" = {
|
||||
|
||||
@@ -6,8 +6,6 @@
|
||||
}: let
|
||||
service = "dnsmasq";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
@@ -16,6 +14,11 @@ in {
|
||||
default = 53;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
upstream = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.10.0.1";
|
||||
description = "set upstream dns server for ${service} (default: $cfg.upstream}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
@@ -25,7 +28,7 @@ in {
|
||||
alwaysKeepRunning = true;
|
||||
settings = {
|
||||
no-resolv = true;
|
||||
listen-address = "10.10.0.11"; # your LAN IP
|
||||
listen-address = config.homelab.host_ip; # your LAN IP
|
||||
#interface = "enp89s0";
|
||||
bind-interfaces = true;
|
||||
# address = [
|
||||
@@ -35,7 +38,7 @@ in {
|
||||
# ];
|
||||
server = [
|
||||
# upstream dns
|
||||
"10.10.0.1"
|
||||
cfg.upstream
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
...
|
||||
}: let
|
||||
cfg = config.homelab.tailscale;
|
||||
authkey_file = config.sops.secrets."tailscale_authkey".path;
|
||||
sec = config.sops.secrets;
|
||||
in {
|
||||
options.homelab.tailscale = {
|
||||
enable = lib.mkEnableOption "enables tailscale";
|
||||
@@ -16,7 +16,7 @@ in {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
useRoutingFeatures = "both";
|
||||
authKeyFile = authkey_file;
|
||||
authKeyFile = sec."tailscale_authkey".path;;
|
||||
extraSetFlags = [
|
||||
"--advertise-routes=${config.homelab.host_ip}/32" # advertise self
|
||||
"--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, nixpkgs-unstable, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "gitea";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -43,21 +45,23 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = lib.mkForce "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
shell = pkgs.bash;
|
||||
shell = pkgs.bash;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
@@ -74,17 +78,17 @@ in
|
||||
user = "gitea";
|
||||
group = "gitea";
|
||||
stateDir = cfg.data_dir;
|
||||
appName = "gitea";
|
||||
appName = "gitea";
|
||||
settings = {
|
||||
server = {
|
||||
# http config
|
||||
ROOT_URL = "https://git.blakedheld.xyz";
|
||||
DOMAIN = "git.blakedheld.xyz";
|
||||
ROOT_URL = "https://git.${homelab.public_domain}";
|
||||
DOMAIN = "git.${homelab.public_domain}";
|
||||
HTTP_PORT = cfg.port;
|
||||
# local network config
|
||||
#LOCAL_ROOT_URL = "https://git.snowbelle.lan";
|
||||
ALLOW_LOCALNETWORKS = true;
|
||||
ALLOWED_DOMAINS = "10.10.0.10";
|
||||
ALLOWED_DOMAINS = homelab.host_ip;
|
||||
SKIP_TLS_VERIFY = true;
|
||||
# configure for system ssh (trying to use the systms on nix sucks)
|
||||
SSH_PORT = cfg.ssh_port;
|
||||
@@ -100,7 +104,7 @@ in
|
||||
};
|
||||
};
|
||||
database = {
|
||||
passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
|
||||
passwordFile = "${toString sec."gitea_database_password".path}";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -110,7 +114,7 @@ in
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ];
|
||||
networking.firewall.allowedTCPPorts = [cfg.port cfg.ssh_port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."git.${homelab.public_domain}" = {
|
||||
@@ -127,14 +131,16 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = service;
|
||||
url = "https://git.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.services = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://git.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# manage secrets with sops
|
||||
sops.secrets = {
|
||||
@@ -146,7 +152,7 @@ in
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -59,7 +59,10 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
links = {
|
||||
services = lib.mkOption {
|
||||
|
||||
@@ -42,7 +42,10 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "podman-hass";
|
||||
default =
|
||||
if cfg.enable
|
||||
then "podman-hass"
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -73,10 +76,6 @@ in {
|
||||
volumes = [
|
||||
"${cfg.data_dir}:/config"
|
||||
];
|
||||
# ports = [
|
||||
# "0.0.0.0:7704:8123"
|
||||
# "0.0.0.0:4141:4141"
|
||||
# ];
|
||||
environment = {
|
||||
TZ = homelab.tz;
|
||||
PUID = toString config.users.users.${service}.uid;
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "mosquitto";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,14 +40,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -65,15 +69,16 @@ in
|
||||
port = 1883;
|
||||
address = "0.0.0.0";
|
||||
users.zigbee = {
|
||||
acl = [ "readwrite #" ];
|
||||
acl = ["readwrite #"];
|
||||
hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw==";
|
||||
};
|
||||
# use with no auth
|
||||
# settings.allow_anonymous = true;
|
||||
# acl = [ "pattern readwrite #" ];
|
||||
# omitPasswordAuth = true;
|
||||
# settings.allow_anonymous = true;
|
||||
# acl = [ "pattern readwrite #" ];
|
||||
# omitPasswordAuth = true;
|
||||
}
|
||||
];
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
@@ -82,7 +87,7 @@ in
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_hashed_passwd" = {
|
||||
@@ -93,7 +98,7 @@ in
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "wyoming";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -24,7 +26,6 @@ in
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
faster-whisper = {
|
||||
@@ -49,9 +50,7 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
#networking.firewall.allowedTCPPorts = [ cfg.faster_whisper_port cfg.piper_port ];
|
||||
networking.firewall.allowedTCPPorts = [ 7706 7707 ];
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "zigbee2mqtt";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,14 +40,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -63,28 +67,28 @@ in
|
||||
enable = true;
|
||||
dataDir = cfg.data_dir;
|
||||
settings = {
|
||||
mqtt = {
|
||||
base_topic = "zigbee2mqtt";
|
||||
client_id = "zigbee2mqtt";
|
||||
server = "mqtt://localhost:1883";
|
||||
user = "!/run/secrets/mosquitto_passwd.yaml user";
|
||||
password = "!/run/secrets/mosquitto_passwd.yaml password";
|
||||
keepalive = 20;
|
||||
};
|
||||
serial = {
|
||||
port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
|
||||
adapter = "ember";
|
||||
};
|
||||
advanced = {
|
||||
channel = 11;
|
||||
};
|
||||
frontend = {
|
||||
enabled = true;
|
||||
port = cfg.port;
|
||||
};
|
||||
homeassistant = {
|
||||
enabled = true;
|
||||
};
|
||||
mqtt = {
|
||||
base_topic = "zigbee2mqtt";
|
||||
client_id = "zigbee2mqtt";
|
||||
server = "mqtt://localhost:1883";
|
||||
user = "!/run/secrets/mosquitto_passwd.yaml user";
|
||||
password = "!/run/secrets/mosquitto_passwd.yaml password";
|
||||
keepalive = 20;
|
||||
};
|
||||
serial = {
|
||||
port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
|
||||
adapter = "ember";
|
||||
};
|
||||
advanced = {
|
||||
channel = 11;
|
||||
};
|
||||
frontend = {
|
||||
enabled = true;
|
||||
port = cfg.port;
|
||||
};
|
||||
homeassistant = {
|
||||
enabled = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -95,12 +99,12 @@ in
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
# # open firewall
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "z2m.${homelab.public_domain}" ];
|
||||
serverAliases = ["z2m.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
@@ -108,12 +112,15 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.services = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"mosquitto_passwd.yaml" = {
|
||||
@@ -124,7 +131,7 @@ in
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -42,7 +42,7 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "immich-server";
|
||||
default = if cfg.enable then "immich-server" else null;;
|
||||
};
|
||||
library_sync_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
@@ -78,7 +78,6 @@ in {
|
||||
host = "0.0.0.0";
|
||||
port = cfg.port;
|
||||
settings = null;
|
||||
#settings.server.externalDomain = "https://photos.blakedheld.xyz";
|
||||
};
|
||||
|
||||
# too lazy to add an option, this is on the storage pool now anyway
|
||||
@@ -138,8 +137,6 @@ in {
|
||||
];
|
||||
|
||||
# add postgresql database that is automatically created to the backup list
|
||||
#services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
|
||||
|
||||
services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
|
||||
|
||||
# add to backups
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
{
|
||||
pkgs,
|
||||
nixpkgs-unstable,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
@@ -41,7 +40,10 @@ in {
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -59,10 +61,6 @@ in {
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
# if you wanna attempt system ssh again
|
||||
#openssh.authorizedKeys.keyFiles = [
|
||||
# "${cfg.data_dir}/.ssh/authorized_keys"
|
||||
#];
|
||||
};
|
||||
|
||||
# declare the gitea service
|
||||
|
||||
@@ -1,13 +1,15 @@
|
||||
{ pkgs, config, lib, unstable_pkgs, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "vaultwarden";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
domain = "https://pass.blakedheld.xyz";
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -39,14 +41,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -68,30 +72,20 @@ in
|
||||
ROCKET_ADDRESS = "0.0.0.0";
|
||||
ROCKET_PORT = cfg.port;
|
||||
SIGNUPS_ALLOWED = true;
|
||||
# ADMIN_TOKEN = "yuh";
|
||||
ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
|
||||
ADMIN_TOKEN = "${toString sec."vaultwarden_admin_token".path}";
|
||||
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
|
||||
# The following flags are available:
|
||||
# - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
|
||||
# - "autofill-v2": Use the new autofill implementation.
|
||||
# - "browser-fileless-import": Directly import credentials from other providers without a file.
|
||||
# - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
|
||||
# - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
|
||||
# - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
|
||||
# - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
|
||||
# - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = { UMask = lib.mkForce "0007"; };
|
||||
systemd.services.${service}.serviceConfig = {UMask = lib.mkForce "0007";};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "pass.${homelab.public_domain}" ];
|
||||
serverAliases = ["pass.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
@@ -99,12 +93,15 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = service;
|
||||
url = "https://pass.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.services = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://pass.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_admin_token" = {
|
||||
@@ -113,9 +110,9 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {paths = [cfg.data_dir];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,11 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./motd
|
||||
./backups
|
||||
./uptime-kuma
|
||||
./postfix
|
||||
#./postfix
|
||||
];
|
||||
|
||||
}
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "uptime-kuma";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -38,14 +40,16 @@ in
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
default =
|
||||
if cfg.enable
|
||||
then service
|
||||
else null;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
@@ -61,8 +65,7 @@ in
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
settings =
|
||||
{
|
||||
settings = {
|
||||
PORT = toString cfg.port;
|
||||
HOST = "0.0.0.0";
|
||||
};
|
||||
@@ -73,12 +76,9 @@ in
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "up.${homelab.public_domain}" ];
|
||||
serverAliases = ["up.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
@@ -86,16 +86,21 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.system = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
homelab.glance.links.system = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
${service} = {
|
||||
paths = [cfg.data_dir "/var/lib/private"];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user