file cleanup, conditional motd

modules/homelab/ai/ollama/default.nix

@@ -1,13 +1,11 @@
 {
   pkgs,
-  nixpkgs-unstable,
   config,
   lib,
   ...
 }: let
   service = "ollama";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -41,7 +39,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -59,10 +60,6 @@ in {
       createHome = true;
       group = service;
       extraGroups = [];
-      # if you wanna attempt system ssh again
-      #openssh.authorizedKeys.keyFiles = [
-      #  "${cfg.data_dir}/.ssh/authorized_keys"
-      #];
     };
 
     # declare the gitea service
@@ -94,25 +91,11 @@ in {
       '';
     };
 
-    # add to glance
-    #    homelab.glance.links.services = [{
-    #      title = service;
-    #      url = "https://git.${homelab.base_domain}";
-    #      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-    #      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-    #      icon = "di:${service}"; }];
-
-    # manage secrets with sops
-    #    sops.secrets = {
-    #      "${service}_database_password" = {
-    #        owner = service;
-    #        group = service;
-    #      };
-    #    };
-
     # add to backups
     homelab.backups.baks = {
-      ${service} = {paths = [cfg.data_dir];};
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/ai/open-webui/default.nix

@@ -1,13 +1,11 @@
 {
   pkgs,
-  nixpkgs-unstable,
   config,
   lib,
   ...
 }: let
   service = "open-webui";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -41,7 +39,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -59,10 +60,6 @@ in {
       createHome = true;
       group = service;
       extraGroups = [];
-      # if you wanna attempt system ssh again
-      #openssh.authorizedKeys.keyFiles = [
-      #  "${cfg.data_dir}/.ssh/authorized_keys"
-      #];
     };
 
     # declare the gitea service
@@ -100,17 +97,11 @@ in {
       }
     ];
 
-    # manage secrets with sops
-    #    sops.secrets = {
-    #      "${service}_database_password" = {
-    #        owner = service;
-    #        group = service;
-    #      };
-    #    };
-
     # add to backups
     homelab.backups.baks = {
-      ${service} = {paths = [cfg.data_dir];};
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/default.nix

@@ -14,7 +14,7 @@ in {
       description = "set timezone";
     };
     base_domain = lib.mkOption {
-      default = "snowbelle.lan";
+      default = "lumiose.blakedheld.xyz";
       type = lib.types.str;
       description = "base domain used for reverse proxy";
     };

modules/homelab/mediastack/audiobookshelf/default.nix

@@ -6,7 +6,6 @@
 }: let
   service = "audiobookshelf";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -76,16 +75,11 @@ in {
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
-      #      User = service;
-      #      Group = service;
     };
 
-    #    # open firewall
-    #    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["abs.${homelab.public_domain}"];
+      #serverAliases = ["abs.${homelab.public_domain}"];
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port} {

modules/homelab/mediastack/bazarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "bazarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,14 +39,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -55,7 +58,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -72,9 +75,6 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -84,16 +84,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/flaresolverr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "flaresolverr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,14 +39,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -68,9 +71,6 @@ in
       Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''

modules/homelab/mediastack/jellyfin/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "jellyfin";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +44,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -55,7 +55,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" "video" "render" ];
+      extraGroups = ["media" "video" "render"];
     };
 
     # enable the ${service} service
@@ -72,14 +72,9 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-    #services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["media.${homelab.public_domain}"];
-      serverAliases = [ "media.${homelab.public_domain}" ];
-      #tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -87,16 +82,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://media.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/prowlarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "prowlarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,14 +39,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -55,7 +58,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -74,9 +77,6 @@ in
       Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -86,16 +86,21 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/mediastack/qbittorrent/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "qbittorrent";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -16,11 +17,11 @@ in
       default = 7103;
       description = "set port for ${service} (default: ${toString cfg.port}";
     };
-#    torrenting_port = lib.mkOption {
+    #    torrenting_port = lib.mkOption {
-#      type = lib.types.int;
+    #      type = lib.types.int;
-#      default = ;
+    #      default = ;
-#      description = "set port for ${service} (default: ${toString cfg.port}";
+    #      description = "set port for ${service} (default: ${toString cfg.port}";
-#    };
+    #    };
     url = lib.mkOption {
       type = lib.types.str;
       default = "qbit.${homelab.base_domain}";
@@ -48,12 +49,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-
     # ensure media dirs existence
     systemd.tmpfiles.rules = [
       "d /holocron/media/downloads 2775 qbittorrent media -"
@@ -77,7 +80,7 @@ in
       group = lib.mkForce "media"; # override for permissions
       profileDir = cfg.data_dir;
       webuiPort = cfg.port;
-#      torrentingPort = cfg.torrenting_port;
+      #      torrentingPort = cfg.torrenting_port;
     };
 
     # override umask to make permissions work out
@@ -102,18 +105,6 @@ in
       iptables -A QBIT -j DROP
     '';
 
-# boilerplate for if you ever want to try to get this working again
-# ------------------------------------------------------------------------------
-#      # add systemd service to VPN network namespace
-#      vpnConfinement = {
-#        enable = true;
-#        vpnNamespace = "wgmex";
-#      };
-# ------------------------------------------------------------------------------
-
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -123,16 +114,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/radarr/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "radarr";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,17 +40,19 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-
     # required
     environment.systemPackages = with pkgs; [ffmpeg_6-headless];
 
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -58,7 +62,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -76,13 +80,10 @@ in
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
-#      User = service;
+      #      User = service;
-#      Group = service;
+      #      Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -92,16 +93,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/sonarr/default.nix

@@ -6,7 +6,6 @@
 }: let
   service = "sonarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -40,7 +39,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -79,12 +81,8 @@ in {
       UMask = lib.mkForce "0007";
     };
 
-    #    # open firewall
-    #    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      # tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}

modules/homelab/mediastack/yacreader/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "yacreader";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,17 +39,19 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # install the binary
-    environment.systemPackages = with pkgs; [ yacreader ];
+    environment.systemPackages = with pkgs; [yacreader];
 
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -58,14 +61,14 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
     systemd.services.${service} = {
       description = "${service} library server";
-      wantedBy = [ "multi-user.target" ];
+      wantedBy = ["multi-user.target"];
-      after = [ "network.target" ];
+      after = ["network.target"];
 
       serviceConfig = {
         UMask = lib.mkForce "0007";
@@ -81,7 +84,7 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
@@ -93,17 +96,19 @@ in
     };
 
     # add to glance local service
-    homelab.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:yac-reader"; }];
+        icon = "di:yac-reader";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }
-

modules/homelab/network/caddy/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "caddy";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -28,12 +30,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {};
 
@@ -58,8 +62,9 @@ in
         auto_https ignore_loaded_certs
       '';
 
+      # static page for hosting key files
       virtualHosts."keys.${homelab.base_domain}" = {
-        serverAliases = [ "keys.${homelab.public_domain}" ];
+        serverAliases = ["keys.${homelab.public_domain}"];
         extraConfig = ''
           tls internal
           root /var/www/keys
@@ -80,7 +85,7 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedTCPPorts = [80 443];
 
     sops.secrets = {
       "ssl_blakedheld_crt" = {
@@ -123,7 +128,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/network/ddns/default.nix

@@ -5,7 +5,6 @@
   ...
 }: let
   cfg = config.homelab.ddns;
-  token = config.sops.secrets."cloudflare/api_token".path;
   sec = config.sops.secrets;
 in {
   options.homelab.ddns = {
@@ -15,7 +14,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.cloudflare-ddns = {
       enable = true;
-      credentialsFile = token;
+      credentialsFile = sec."cloudflare/api_token".path;
       domains = [
         # recoil.pro
         "recoil.pro"
@@ -31,12 +30,9 @@ in {
         "*.blakedheld.xyz"
         "git.blakedheld.xyz"
         "up.blakedheld.xyz"
-
       ];
     };
 
-    # network config
-
     # declare authkey secrets
     sops.secrets = {
       "cloudflare/api_token" = {

modules/homelab/network/dnsmasq/default.nix

@@ -6,8 +6,6 @@
 }: let
   service = "dnsmasq";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
-  homelab = config.homelab;
 in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
@@ -16,6 +14,11 @@ in {
       default = 53;
       description = "set port for ${service} (default: ${toString cfg.port}";
     };
+    upstream = lib.mkOption {
+      type = lib.types.str;
+      default = "10.10.0.1";
+      description = "set upstream dns server for ${service} (default: $cfg.upstream}";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -25,7 +28,7 @@ in {
       alwaysKeepRunning = true;
       settings = {
         no-resolv = true;
-        listen-address = "10.10.0.11"; # your LAN IP
+        listen-address = config.homelab.host_ip; # your LAN IP
         #interface = "enp89s0";
         bind-interfaces = true;
         #        address = [
@@ -35,7 +38,7 @@ in {
         #        ];
         server = [
           # upstream dns
-          "10.10.0.1"
+          cfg.upstream
         ];
       };
     };

modules/homelab/network/tailscale/default.nix

@@ -5,7 +5,7 @@
   ...
 }: let
   cfg = config.homelab.tailscale;
-  authkey_file = config.sops.secrets."tailscale_authkey".path;
+  sec = config.sops.secrets;
 in {
   options.homelab.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
@@ -16,7 +16,7 @@ in {
       enable = true;
       openFirewall = true;
       useRoutingFeatures = "both";
-      authKeyFile = authkey_file;
+      authKeyFile = sec."tailscale_authkey".path;;
       extraSetFlags = [
         "--advertise-routes=${config.homelab.host_ip}/32" # advertise self
         "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)

modules/homelab/services/gitea/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, nixpkgs-unstable, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "gitea";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,14 +45,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -78,13 +82,13 @@ in
       settings = {
         server = {
           # http config
-          ROOT_URL = "https://git.blakedheld.xyz";
+          ROOT_URL = "https://git.${homelab.public_domain}";
-          DOMAIN = "git.blakedheld.xyz";
+          DOMAIN = "git.${homelab.public_domain}";
           HTTP_PORT = cfg.port;
           # local network config
           #LOCAL_ROOT_URL = "https://git.snowbelle.lan";
           ALLOW_LOCALNETWORKS = true;
-          ALLOWED_DOMAINS = "10.10.0.10";
+          ALLOWED_DOMAINS = homelab.host_ip;
           SKIP_TLS_VERIFY = true;
           # configure for system ssh (trying to use the systms on nix sucks)
           SSH_PORT = cfg.ssh_port;
@@ -100,7 +104,7 @@ in
         };
       };
       database = {
-        passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
+        passwordFile = "${toString sec."gitea_database_password".path}";
       };
     };
 
@@ -110,7 +114,7 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ];
+    networking.firewall.allowedTCPPorts = [cfg.port cfg.ssh_port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."git.${homelab.public_domain}" = {
@@ -127,14 +131,16 @@ in
       '';
     };
 
-
     # add to glance
-    homelab.glance.links.services = [{
+    homelab.glance.links.services = [
+      {
         title = service;
         url = "https://git.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # manage secrets with sops
     sops.secrets = {
@@ -146,7 +152,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/services/glance/default.nix

@@ -59,7 +59,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
     links = {
       services = lib.mkOption {

modules/homelab/services/home/homeassistant/default.nix

@@ -42,7 +42,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = "podman-hass";
+      default =
+        if cfg.enable
+        then "podman-hass"
+        else null;
     };
   };
 
@@ -73,10 +76,6 @@ in {
         volumes = [
           "${cfg.data_dir}:/config"
         ];
-        #        ports = [
-        #          "0.0.0.0:7704:8123"
-        #          "0.0.0.0:4141:4141"
-        #        ];
         environment = {
           TZ = homelab.tz;
           PUID = toString config.users.users.${service}.uid;

modules/homelab/services/home/mosquitto/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "mosquitto";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,14 +40,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -65,15 +69,16 @@ in
         port = 1883;
         address = "0.0.0.0";
         users.zigbee = {
-          acl = [ "readwrite #" ];
+          acl = ["readwrite #"];
           hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw==";
         };
         # use with no auth
-#        settings.allow_anonymous = true;
+        #        settings.allow_anonymous = true;
-#        acl = [ "pattern readwrite #" ];
+        #        acl = [ "pattern readwrite #" ];
-#        omitPasswordAuth = true;
+        #        omitPasswordAuth = true;
       }
     ];
+
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
@@ -82,7 +87,7 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     sops.secrets = {
       "${service}_hashed_passwd" = {
@@ -93,7 +98,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-     ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/services/home/wyoming/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "wyoming";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -24,7 +26,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # enable the ${service} service
     services.${service} = {
       faster-whisper = {
@@ -49,9 +50,7 @@ in
       };
     };
 
-#    # open firewall
+    # open firewall
-    #networking.firewall.allowedTCPPorts = [ cfg.faster_whisper_port cfg.piper_port ];
+    networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
-    networking.firewall.allowedTCPPorts = [ 7706 7707 ];
-
   };
 }

modules/homelab/services/home/zigbee2mqtt/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "zigbee2mqtt";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,14 +40,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -95,12 +99,12 @@ in
       Group = service;
     };
 
-#    # open firewall
+    #    # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "z2m.${homelab.public_domain}" ];
+      serverAliases = ["z2m.${homelab.public_domain}"];
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -108,12 +112,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.services = [{
+    homelab.glance.links.services = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     sops.secrets = {
       "mosquitto_passwd.yaml" = {
@@ -124,7 +131,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-     ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/services/immich/default.nix

@@ -42,7 +42,7 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = "immich-server";
+      default = if cfg.enable then "immich-server" else null;;
     };
     library_sync_dir = lib.mkOption {
       type = lib.types.str;
@@ -78,7 +78,6 @@ in {
       host = "0.0.0.0";
       port = cfg.port;
       settings = null;
-      #settings.server.externalDomain = "https://photos.blakedheld.xyz";
     };
 
     # too lazy to add an option, this is on the storage pool now anyway
@@ -138,8 +137,6 @@ in {
     ];
 
     # add postgresql database that is automatically created to the backup list
-    #services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
-
     services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
 
     # add to backups

modules/homelab/services/searxng/default.nix

@@ -1,6 +1,5 @@
 {
   pkgs,
-  nixpkgs-unstable,
   config,
   lib,
   ...
@@ -41,7 +40,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -59,10 +61,6 @@ in {
       createHome = true;
       group = service;
       extraGroups = [];
-      # if you wanna attempt system ssh again
-      #openssh.authorizedKeys.keyFiles = [
-      #  "${cfg.data_dir}/.ssh/authorized_keys"
-      #];
     };
 
     # declare the gitea service

modules/homelab/services/vaultwarden/default.nix

@@ -1,13 +1,15 @@
-{ pkgs, config, lib, unstable_pkgs, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "vaultwarden";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
   domain = "https://pass.blakedheld.xyz";
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -39,14 +41,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -68,30 +72,20 @@ in
         ROCKET_ADDRESS = "0.0.0.0";
         ROCKET_PORT = cfg.port;
         SIGNUPS_ALLOWED = true;
-#        ADMIN_TOKEN = "yuh";
+        ADMIN_TOKEN = "${toString sec."vaultwarden_admin_token".path}";
-        ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
         EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
-          # The following flags are available:
-          # - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
-          # - "autofill-v2": Use the new autofill implementation.
-          # - "browser-fileless-import": Directly import credentials from other providers without a file.
-          # - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
-          # - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
-          # - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
-          # - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
-          # - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
       };
     };
 
     # override umask to make permissions work out
-    systemd.services.${service}.serviceConfig = { UMask = lib.mkForce "0007"; };
+    systemd.services.${service}.serviceConfig = {UMask = lib.mkForce "0007";};
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "pass.${homelab.public_domain}" ];
+      serverAliases = ["pass.${homelab.public_domain}"];
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -99,12 +93,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.services = [{
+    homelab.glance.links.services = [
+      {
         title = service;
         url = "https://pass.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     sops.secrets = {
       "${service}_admin_token" = {
@@ -115,7 +112,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/system/default.nix

@@ -1,11 +1,14 @@
-{ pkgs, config, lib, ... }:
 {
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
   # the order determines the order in glance :3
   imports = [
     ./motd
     ./backups
     ./uptime-kuma
-    ./postfix
+    #./postfix
   ];
-
 }

modules/homelab/system/uptime-kuma/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "uptime-kuma";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,14 +40,16 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -61,8 +65,7 @@ in
     # enable the ${service} service
     services.${service} = {
       enable = true;
-      settings = 
+      settings = {
-      {
         PORT = toString cfg.port;
         HOST = "0.0.0.0";
       };
@@ -73,12 +76,9 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-        serverAliases = [ "up.${homelab.public_domain}" ];
+      serverAliases = ["up.${homelab.public_domain}"];
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -86,16 +86,21 @@ in
     };
 
     # add to glance
-    homelab.glance.links.system = [{
+    homelab.glance.links.system = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }