blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

file cleanup, conditional motd

Browse Source
This commit is contained in:
blake
2026-06-14 08:35:44 -05:00
parent fcb8961c69
commit 11d3fcd8ec
27 changed files with 407 additions and 409 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/homelab/ai/ollama/default.nix
+7 -24
View File
@@ -1,13 +1,11 @@
{ {
pkgs, pkgs,
nixpkgs-unstable,
config, config,
lib, lib,
... ...
}: let }: let
service = "ollama"; service = "ollama";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in {
options.homelab.${service} = { options.homelab.${service} = {
@@ -41,7 +39,10 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
@@ -59,10 +60,6 @@ in {
createHome = true; createHome = true;
group = service; group = service;
extraGroups = []; extraGroups = [];
# if you wanna attempt system ssh again
#openssh.authorizedKeys.keyFiles = [
# "${cfg.data_dir}/.ssh/authorized_keys"
#];
}; };
# declare the gitea service # declare the gitea service
@@ -94,25 +91,11 @@ in {
''; '';
}; };
# add to glance
# homelab.glance.links.services = [{
# title = service;
# url = "https://git.${homelab.base_domain}";
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
# icon = "di:${service}"; }];
# manage secrets with sops
# sops.secrets = {
# "${service}_database_password" = {
# owner = service;
# group = service;
# };
# };
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];}; ${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
}; };
}; };
} }
modules/homelab/ai/open-webui/default.nix
+7 -16
View File
@@ -1,13 +1,11 @@
{ {
pkgs, pkgs,
nixpkgs-unstable,
config, config,
lib, lib,
... ...
}: let }: let
service = "open-webui"; service = "open-webui";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in {
options.homelab.${service} = { options.homelab.${service} = {
@@ -41,7 +39,10 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
@@ -59,10 +60,6 @@ in {
createHome = true; createHome = true;
group = service; group = service;
extraGroups = []; extraGroups = [];
# if you wanna attempt system ssh again
#openssh.authorizedKeys.keyFiles = [
# "${cfg.data_dir}/.ssh/authorized_keys"
#];
}; };
# declare the gitea service # declare the gitea service
@@ -100,17 +97,11 @@ in {
} }
]; ];
# manage secrets with sops
# sops.secrets = {
# "${service}_database_password" = {
# owner = service;
# group = service;
# };
# };
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];}; ${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
}; };
}; };
} }
modules/homelab/default.nix
+1 -1
View File
@@ -14,7 +14,7 @@ in {
description = "set timezone"; description = "set timezone";
}; };
base_domain = lib.mkOption { base_domain = lib.mkOption {
default = "snowbelle.lan"; default = "lumiose.blakedheld.xyz";
type = lib.types.str; type = lib.types.str;
description = "base domain used for reverse proxy"; description = "base domain used for reverse proxy";
}; };
modules/homelab/mediastack/audiobookshelf/default.nix
+1 -7
View File
@@ -6,7 +6,6 @@
}: let }: let
service = "audiobookshelf"; service = "audiobookshelf";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in {
options.homelab.${service} = { options.homelab.${service} = {
@@ -76,16 +75,11 @@ in {
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
# User = service;
# Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["abs.${homelab.public_domain}"]; #serverAliases = ["abs.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} { reverse_proxy 127.0.0.1:${toString cfg.port} {
modules/homelab/mediastack/bazarr/default.nix
+23 -20
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "bazarr"; service = "bazarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +39,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -55,7 +58,7 @@ in
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
extraGroups = [ "media" ]; extraGroups = ["media"];
}; };
# enable the ${service} service # enable the ${service} service
@@ -72,9 +75,6 @@ in
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -84,16 +84,19 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [{ homelab.glance.links.mediastack = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/mediastack/flaresolverr/default.nix
+12 -12
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "flaresolverr"; service = "flaresolverr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +39,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -68,9 +71,6 @@ in
Group = service; Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
modules/homelab/mediastack/jellyfin/default.nix
+20 -22
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "jellyfin"; service = "jellyfin";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -43,9 +44,8 @@ in
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -55,7 +55,7 @@ in
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
extraGroups = [ "media" "video" "render" ]; extraGroups = ["media" "video" "render"];
}; };
# enable the ${service} service # enable the ${service} service
@@ -72,14 +72,9 @@ in
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
#services.caddy.virtualHosts."${cfg.url}" = { serverAliases = ["media.${homelab.public_domain}"];
serverAliases = [ "media.${homelab.public_domain}" ];
#tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -87,16 +82,19 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [{ homelab.glance.links.mediastack = [
title = service; {
url = "https://media.${homelab.public_domain}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://media.${homelab.public_domain}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/mediastack/prowlarr/default.nix
+25 -20
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "prowlarr"; service = "prowlarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +39,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -55,7 +58,7 @@ in
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
extraGroups = [ "media" ]; extraGroups = ["media"];
}; };
# enable the ${service} service # enable the ${service} service
@@ -74,9 +77,6 @@ in
Group = service; Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -86,16 +86,21 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [{ homelab.glance.links.mediastack = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
}; };
}; };
} }
modules/homelab/mediastack/qbittorrent/default.nix
+29 -35
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "qbittorrent"; service = "qbittorrent";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -16,11 +17,11 @@ in
default = 7103; default = 7103;
description = "set port for ${service} (default: ${toString cfg.port}"; description = "set port for ${service} (default: ${toString cfg.port}";
}; };
# torrenting_port = lib.mkOption { # torrenting_port = lib.mkOption {
# type = lib.types.int; # type = lib.types.int;
# default = ; # default = ;
# description = "set port for ${service} (default: ${toString cfg.port}"; # description = "set port for ${service} (default: ${toString cfg.port}";
# }; # };
url = lib.mkOption { url = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "qbit.${homelab.base_domain}"; default = "qbit.${homelab.base_domain}";
@@ -48,16 +49,18 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# ensure media dirs existence # ensure media dirs existence
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /holocron/media/downloads 2775 qbittorrent media -" "d /holocron/media/downloads 2775 qbittorrent media -"
]; ];
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -74,10 +77,10 @@ in
enable = true; enable = true;
openFirewall = true; openFirewall = true;
user = service; user = service;
group = lib.mkForce "media"; # override for permissions group = lib.mkForce "media"; # override for permissions
profileDir = cfg.data_dir; profileDir = cfg.data_dir;
webuiPort = cfg.port; webuiPort = cfg.port;
# torrentingPort = cfg.torrenting_port; # torrentingPort = cfg.torrenting_port;
}; };
# override umask to make permissions work out # override umask to make permissions work out
@@ -102,18 +105,6 @@ in
iptables -A QBIT -j DROP iptables -A QBIT -j DROP
''; '';
# boilerplate for if you ever want to try to get this working again
# ------------------------------------------------------------------------------
# # add systemd service to VPN network namespace
# vpnConfinement = {
# enable = true;
# vpnNamespace = "wgmex";
# };
# ------------------------------------------------------------------------------
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -123,16 +114,19 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [{ homelab.glance.links.mediastack = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/mediastack/radarr/default.nix
+26 -22
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "radarr"; service = "radarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,17 +40,19 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# required # required
environment.systemPackages = with pkgs; [ffmpeg_6-headless]; environment.systemPackages = with pkgs; [ffmpeg_6-headless];
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -58,7 +62,7 @@ in
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
extraGroups = [ "media" ]; extraGroups = ["media"];
}; };
# enable the ${service} service # enable the ${service} service
@@ -76,13 +80,10 @@ in
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
# User = service; # User = service;
# Group = service; # Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -92,16 +93,19 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [{ homelab.glance.links.mediastack = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/mediastack/sonarr/default.nix
+4 -6
View File
@@ -6,7 +6,6 @@
}: let }: let
service = "sonarr"; service = "sonarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in {
options.homelab.${service} = { options.homelab.${service} = {
@@ -40,7 +39,10 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
@@ -79,12 +81,8 @@ in {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
# tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
modules/homelab/mediastack/yacreader/default.nix
+29 -24
View File
@@ -1,12 +1,13 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "yacreader"; service = "yacreader";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,17 +39,19 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# install the binary # install the binary
environment.systemPackages = with pkgs; [ yacreader ]; environment.systemPackages = with pkgs; [yacreader];
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -58,15 +61,15 @@ in
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
extraGroups = [ "media" ]; extraGroups = ["media"];
}; };
# enable the ${service} service # enable the ${service} service
systemd.services.${service} = { systemd.services.${service} = {
description = "${service} library server"; description = "${service} library server";
wantedBy = [ "multi-user.target" ]; wantedBy = ["multi-user.target"];
after = [ "network.target" ]; after = ["network.target"];
serviceConfig = { serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
User = service; User = service;
@@ -81,7 +84,7 @@ in
}; };
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ]; networking.firewall.allowedTCPPorts = [cfg.port];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
@@ -92,18 +95,20 @@ in
''; '';
}; };
# add to glance local service # add to glance local service
homelab.glance.links.mediastack = [{ homelab.glance.links.mediastack = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/network/caddy/default.nix
+36 -31
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "caddy"; service = "caddy";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -28,12 +30,14 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = {}; users.groups.${service} = {};
@@ -57,13 +61,14 @@ in
globalConfig = '' globalConfig = ''
auto_https ignore_loaded_certs auto_https ignore_loaded_certs
''; '';
# static page for hosting key files
virtualHosts."keys.${homelab.base_domain}" = { virtualHosts."keys.${homelab.base_domain}" = {
serverAliases = [ "keys.${homelab.public_domain}" ]; serverAliases = ["keys.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls internal
root /var/www/keys root /var/www/keys
file_server browse file_server browse
''; '';
}; };
}; };
@@ -80,7 +85,7 @@ in
}; };
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [80 443];
sops.secrets = { sops.secrets = {
"ssl_blakedheld_crt" = { "ssl_blakedheld_crt" = {
@@ -104,26 +109,26 @@ in
path = "/var/www/keys/caddy_root.crt"; path = "/var/www/keys/caddy_root.crt";
}; };
}; };
environment.etc."caddy/browse.html".text = '' environment.etc."caddy/browse.html".text = ''
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
<head> <head>
<meta charset="utf-8"> <meta charset="utf-8">
<title>{{html .Name}}</title> <title>{{html .Name}}</title>
<style> <style>
footer { display: none !important; } footer { display: none !important; }
</style> </style>
</head> </head>
<body> <body>
{{template "listing" .}} {{template "listing" .}}
</body> </body>
</html> </html>
''; '';
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/network/ddns/default.nix
+1 -5
View File
@@ -5,7 +5,6 @@
... ...
}: let }: let
cfg = config.homelab.ddns; cfg = config.homelab.ddns;
token = config.sops.secrets."cloudflare/api_token".path;
sec = config.sops.secrets; sec = config.sops.secrets;
in { in {
options.homelab.ddns = { options.homelab.ddns = {
@@ -15,7 +14,7 @@ in {
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
services.cloudflare-ddns = { services.cloudflare-ddns = {
enable = true; enable = true;
credentialsFile = token; credentialsFile = sec."cloudflare/api_token".path;
domains = [ domains = [
# recoil.pro # recoil.pro
"recoil.pro" "recoil.pro"
@@ -31,12 +30,9 @@ in {
"*.blakedheld.xyz" "*.blakedheld.xyz"
"git.blakedheld.xyz" "git.blakedheld.xyz"
"up.blakedheld.xyz" "up.blakedheld.xyz"
]; ];
}; };
# network config
# declare authkey secrets # declare authkey secrets
sops.secrets = { sops.secrets = {
"cloudflare/api_token" = { "cloudflare/api_token" = {
modules/homelab/network/dnsmasq/default.nix
+7 -4
View File
@@ -6,8 +6,6 @@
}: let }: let
service = "dnsmasq"; service = "dnsmasq";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in { in {
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -16,6 +14,11 @@ in {
default = 53; default = 53;
description = "set port for ${service} (default: ${toString cfg.port}"; description = "set port for ${service} (default: ${toString cfg.port}";
}; };
upstream = lib.mkOption {
type = lib.types.str;
default = "10.10.0.1";
description = "set upstream dns server for ${service} (default: $cfg.upstream}";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@@ -25,7 +28,7 @@ in {
alwaysKeepRunning = true; alwaysKeepRunning = true;
settings = { settings = {
no-resolv = true; no-resolv = true;
listen-address = "10.10.0.11"; # your LAN IP listen-address = config.homelab.host_ip; # your LAN IP
#interface = "enp89s0"; #interface = "enp89s0";
bind-interfaces = true; bind-interfaces = true;
# address = [ # address = [
@@ -35,7 +38,7 @@ in {
# ]; # ];
server = [ server = [
# upstream dns # upstream dns
"10.10.0.1" cfg.upstream
]; ];
}; };
}; };
modules/homelab/network/tailscale/default.nix
+2 -2
View File
@@ -5,7 +5,7 @@
... ...
}: let }: let
cfg = config.homelab.tailscale; cfg = config.homelab.tailscale;
authkey_file = config.sops.secrets."tailscale_authkey".path; sec = config.sops.secrets;
in { in {
options.homelab.tailscale = { options.homelab.tailscale = {
enable = lib.mkEnableOption "enables tailscale"; enable = lib.mkEnableOption "enables tailscale";
@@ -16,7 +16,7 @@ in {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
useRoutingFeatures = "both"; useRoutingFeatures = "both";
authKeyFile = authkey_file; authKeyFile = sec."tailscale_authkey".path;;
extraSetFlags = [ extraSetFlags = [
"--advertise-routes=${config.homelab.host_ip}/32" # advertise self "--advertise-routes=${config.homelab.host_ip}/32" # advertise self
"--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit) "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
modules/homelab/services/gitea/default.nix
+29 -23
View File
@@ -1,12 +1,14 @@
{ pkgs, nixpkgs-unstable, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "gitea"; service = "gitea";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -43,21 +45,23 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
description = lib.mkForce "${service} server user"; description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids; uid = lib.mkForce cfg.ids;
isSystemUser = true; isSystemUser = true;
shell = pkgs.bash; shell = pkgs.bash;
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
@@ -74,17 +78,17 @@ in
user = "gitea"; user = "gitea";
group = "gitea"; group = "gitea";
stateDir = cfg.data_dir; stateDir = cfg.data_dir;
appName = "gitea"; appName = "gitea";
settings = { settings = {
server = { server = {
# http config # http config
ROOT_URL = "https://git.blakedheld.xyz"; ROOT_URL = "https://git.${homelab.public_domain}";
DOMAIN = "git.blakedheld.xyz"; DOMAIN = "git.${homelab.public_domain}";
HTTP_PORT = cfg.port; HTTP_PORT = cfg.port;
# local network config # local network config
#LOCAL_ROOT_URL = "https://git.snowbelle.lan"; #LOCAL_ROOT_URL = "https://git.snowbelle.lan";
ALLOW_LOCALNETWORKS = true; ALLOW_LOCALNETWORKS = true;
ALLOWED_DOMAINS = "10.10.0.10"; ALLOWED_DOMAINS = homelab.host_ip;
SKIP_TLS_VERIFY = true; SKIP_TLS_VERIFY = true;
# configure for system ssh (trying to use the systms on nix sucks) # configure for system ssh (trying to use the systms on nix sucks)
SSH_PORT = cfg.ssh_port; SSH_PORT = cfg.ssh_port;
@@ -100,7 +104,7 @@ in
}; };
}; };
database = { database = {
passwordFile = "${toString config.sops.secrets."gitea_database_password".path}"; passwordFile = "${toString sec."gitea_database_password".path}";
}; };
}; };
@@ -110,7 +114,7 @@ in
}; };
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ]; networking.firewall.allowedTCPPorts = [cfg.port cfg.ssh_port];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."git.${homelab.public_domain}" = { services.caddy.virtualHosts."git.${homelab.public_domain}" = {
@@ -127,14 +131,16 @@ in
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.services = [{ homelab.glance.links.services = [
title = service; {
url = "https://git.${homelab.public_domain}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://git.${homelab.public_domain}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# manage secrets with sops # manage secrets with sops
sops.secrets = { sops.secrets = {
@@ -146,7 +152,7 @@ in
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/services/glance/default.nix
+4 -1
View File
@@ -59,7 +59,10 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
links = { links = {
services = lib.mkOption { services = lib.mkOption {
modules/homelab/services/home/homeassistant/default.nix
+4 -5
View File
@@ -42,7 +42,10 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = "podman-hass"; default =
if cfg.enable
then "podman-hass"
else null;
}; };
}; };
@@ -73,10 +76,6 @@ in {
volumes = [ volumes = [
"${cfg.data_dir}:/config" "${cfg.data_dir}:/config"
]; ];
# ports = [
# "0.0.0.0:7704:8123"
# "0.0.0.0:4141:4141"
# ];
environment = { environment = {
TZ = homelab.tz; TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid; PUID = toString config.users.users.${service}.uid;
modules/homelab/services/home/mosquitto/default.nix
+19 -14
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "mosquitto"; service = "mosquitto";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +40,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -65,15 +69,16 @@ in
port = 1883; port = 1883;
address = "0.0.0.0"; address = "0.0.0.0";
users.zigbee = { users.zigbee = {
acl = [ "readwrite #" ]; acl = ["readwrite #"];
hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw=="; hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw==";
}; };
# use with no auth # use with no auth
# settings.allow_anonymous = true; # settings.allow_anonymous = true;
# acl = [ "pattern readwrite #" ]; # acl = [ "pattern readwrite #" ];
# omitPasswordAuth = true; # omitPasswordAuth = true;
} }
]; ];
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
@@ -82,7 +87,7 @@ in
}; };
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ]; networking.firewall.allowedTCPPorts = [cfg.port];
sops.secrets = { sops.secrets = {
"${service}_hashed_passwd" = { "${service}_hashed_passwd" = {
@@ -93,7 +98,7 @@ in
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/services/home/wyoming/default.nix
+9 -10
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "wyoming"; service = "wyoming";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -24,7 +26,6 @@ in
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# enable the ${service} service # enable the ${service} service
services.${service} = { services.${service} = {
faster-whisper = { faster-whisper = {
@@ -49,9 +50,7 @@ in
}; };
}; };
# # open firewall # open firewall
#networking.firewall.allowedTCPPorts = [ cfg.faster_whisper_port cfg.piper_port ]; networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
networking.firewall.allowedTCPPorts = [ 7706 7707 ];
}; };
} }
modules/homelab/services/home/zigbee2mqtt/default.nix
+47 -40
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "zigbee2mqtt"; service = "zigbee2mqtt";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +40,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -63,28 +67,28 @@ in
enable = true; enable = true;
dataDir = cfg.data_dir; dataDir = cfg.data_dir;
settings = { settings = {
mqtt = { mqtt = {
base_topic = "zigbee2mqtt"; base_topic = "zigbee2mqtt";
client_id = "zigbee2mqtt"; client_id = "zigbee2mqtt";
server = "mqtt://localhost:1883"; server = "mqtt://localhost:1883";
user = "!/run/secrets/mosquitto_passwd.yaml user"; user = "!/run/secrets/mosquitto_passwd.yaml user";
password = "!/run/secrets/mosquitto_passwd.yaml password"; password = "!/run/secrets/mosquitto_passwd.yaml password";
keepalive = 20; keepalive = 20;
}; };
serial = { serial = {
port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0"; port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
adapter = "ember"; adapter = "ember";
}; };
advanced = { advanced = {
channel = 11; channel = 11;
}; };
frontend = { frontend = {
enabled = true; enabled = true;
port = cfg.port; port = cfg.port;
}; };
homeassistant = { homeassistant = {
enabled = true; enabled = true;
}; };
}; };
}; };
@@ -95,12 +99,12 @@ in
Group = service; Group = service;
}; };
# # open firewall # # open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ]; networking.firewall.allowedTCPPorts = [cfg.port];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "z2m.${homelab.public_domain}" ]; serverAliases = ["z2m.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -108,12 +112,15 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.services = [{ homelab.glance.links.services = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
sops.secrets = { sops.secrets = {
"mosquitto_passwd.yaml" = { "mosquitto_passwd.yaml" = {
@@ -124,7 +131,7 @@ in
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/services/immich/default.nix
+1 -4
View File
@@ -42,7 +42,7 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = "immich-server"; default = if cfg.enable then "immich-server" else null;;
}; };
library_sync_dir = lib.mkOption { library_sync_dir = lib.mkOption {
type = lib.types.str; type = lib.types.str;
@@ -78,7 +78,6 @@ in {
host = "0.0.0.0"; host = "0.0.0.0";
port = cfg.port; port = cfg.port;
settings = null; settings = null;
#settings.server.externalDomain = "https://photos.blakedheld.xyz";
}; };
# too lazy to add an option, this is on the storage pool now anyway # too lazy to add an option, this is on the storage pool now anyway
@@ -138,8 +137,6 @@ in {
]; ];
# add postgresql database that is automatically created to the backup list # add postgresql database that is automatically created to the backup list
#services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
# add to backups # add to backups
modules/homelab/services/searxng/default.nix
+4 -6
View File
@@ -1,6 +1,5 @@
{ {
pkgs, pkgs,
nixpkgs-unstable,
config, config,
lib, lib,
... ...
@@ -41,7 +40,10 @@ in {
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
@@ -59,10 +61,6 @@ in {
createHome = true; createHome = true;
group = service; group = service;
extraGroups = []; extraGroups = [];
# if you wanna attempt system ssh again
#openssh.authorizedKeys.keyFiles = [
# "${cfg.data_dir}/.ssh/authorized_keys"
#];
}; };
# declare the gitea service # declare the gitea service
modules/homelab/services/vaultwarden/default.nix
+27 -30
View File
@@ -1,13 +1,15 @@
{ pkgs, config, lib, unstable_pkgs, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "vaultwarden"; service = "vaultwarden";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
domain = "https://pass.blakedheld.xyz"; domain = "https://pass.blakedheld.xyz";
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -39,14 +41,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -68,30 +72,20 @@ in
ROCKET_ADDRESS = "0.0.0.0"; ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = cfg.port; ROCKET_PORT = cfg.port;
SIGNUPS_ALLOWED = true; SIGNUPS_ALLOWED = true;
# ADMIN_TOKEN = "yuh"; ADMIN_TOKEN = "${toString sec."vaultwarden_admin_token".path}";
ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item"; EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
# The following flags are available:
# - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
# - "autofill-v2": Use the new autofill implementation.
# - "browser-fileless-import": Directly import credentials from other providers without a file.
# - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
# - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
# - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
# - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
# - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
}; };
}; };
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { UMask = lib.mkForce "0007"; }; systemd.services.${service}.serviceConfig = {UMask = lib.mkForce "0007";};
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ]; networking.firewall.allowedTCPPorts = [cfg.port];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "pass.${homelab.public_domain}" ]; serverAliases = ["pass.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -99,12 +93,15 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.services = [{ homelab.glance.links.services = [
title = service; {
url = "https://pass.${homelab.public_domain}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://pass.${homelab.public_domain}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
sops.secrets = { sops.secrets = {
"${service}_admin_token" = { "${service}_admin_token" = {
@@ -113,9 +110,9 @@ in
}; };
}; };
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {paths = [cfg.data_dir];};
}; };
}; };
} }
modules/homelab/system/default.nix
+6 -3
View File
@@ -1,11 +1,14 @@
{ pkgs, config, lib, ... }:
{ {
pkgs,
config,
lib,
...
}: {
# the order determines the order in glance :3 # the order determines the order in glance :3
imports = [ imports = [
./motd ./motd
./backups ./backups
./uptime-kuma ./uptime-kuma
./postfix #./postfix
]; ];
} }
modules/homelab/system/uptime-kuma/default.nix
+27 -22
View File
@@ -1,12 +1,14 @@
{ pkgs, config, lib, ... }: {
pkgs,
let config,
lib,
...
}: let
service = "uptime-kuma"; service = "uptime-kuma";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in in {
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -38,14 +40,16 @@ in
}; };
motd = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = service; default =
if cfg.enable
then service
else null;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.${service} = { users.users.${service} = {
@@ -61,8 +65,7 @@ in
# enable the ${service} service # enable the ${service} service
services.${service} = { services.${service} = {
enable = true; enable = true;
settings = settings = {
{
PORT = toString cfg.port; PORT = toString cfg.port;
HOST = "0.0.0.0"; HOST = "0.0.0.0";
}; };
@@ -73,12 +76,9 @@ in
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "up.${homelab.public_domain}" ]; serverAliases = ["up.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -86,16 +86,21 @@ in
}; };
# add to glance # add to glance
homelab.glance.links.system = [{ homelab.glance.links.system = [
title = service; {
url = "https://${cfg.url}"; title = service;
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; url = "https://${cfg.url}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }]; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; }; ${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
}; };
}; };
} }