more cleanup

hosts/nixos/default.nix

@@ -24,7 +24,7 @@
     # optimise nix store, dedupe and such
     optimise = {
       automatic = true;
-      dates = [ "daily" ];
+      dates = ["daily"];
     };
     # the goats
     settings = {
@@ -79,7 +79,6 @@
     unstable.siomon
   ];
 
-
   # nice to have passwordless sudo
   security.sudo = {
     extraRules = [
@@ -116,7 +115,7 @@
           }
           {
             command = "/run/current-system/sw/bin/rsync";
-            options = [ "NOPASSWD" ];
+            options = ["NOPASSWD"];
           }
         ];
       }

hosts/nixos/lumiose/hardware-configuration.nix

@@ -1,52 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/mapper/crypted";
-      fsType = "btrfs";
-      options = [ "subvol=@root" ];
-    };
-
-  boot.initrd.luks.devices."crypted".device = "/dev/disk/by-uuid/4c5bef93-c0b8-4f03-8325-6ab1b9b9199a";
-
-  fileSystems."/.swapvol" =
-    { device = "/dev/mapper/crypted";
-      fsType = "btrfs";
-      options = [ "subvol=@swap" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/3E0D-91EE";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/mapper/crypted";
-      fsType = "btrfs";
-      options = [ "subvol=@home" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/mapper/crypted";
-      fsType = "btrfs";
-      options = [ "subvol=@nix" ];
-    };
-
-  swapDevices = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

modules/gameservers/srcds/default.nix

@@ -1,114 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  inputs,
-  ...
-}: let
-  service = "srcds";
-  cfg = config.gameservers.${service};
-in {
-  imports = [inputs.srcds-nix.nixosModules.default];
-
-  options.gameservers.${service} = {
-    enable = lib.mkEnableOption "Counter Strike 2 server";
-    data_dir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/gameservers/cs2";
-    };
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 27015;
-    };
-    tv_port = lib.mkOption {
-      type = lib.types.int;
-      default = 27016;
-    };
-    hostname = lib.mkOption {
-      type = lib.types.str;
-      default = "recoil.pro CS2";
-    };
-    map = lib.mkOption {
-      type = lib.types.str;
-      default = "de_dust2";
-    };
-    max_players = lib.mkOption {
-      type = lib.types.int;
-      default = 10;
-    };
-    backup = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-    };
-    backup_repo = lib.mkOption {
-      type = lib.types.path;
-      default = "/holocron/archives/gameservers/cs2";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.users.cs2 = {
-      isSystemUser = true;
-      group = "cs2";
-      home = cfg.data_dir;
-      createHome = true;
-    };
-
-    users.groups.cs2 = {};
-
-    services.srcds = {
-      enable = true;
-      openFirewall = true;
-      games = {
-        cs2-server = {
-          appId = 730;
-          gamePort = cfg.port;
-          rcon = {
-            enable = true;
-            password = "secretpass";
-          };
-          extraArgs = [];
-          startingMap = cfg.map;
-        };
-      };
-    };
-
-    environment.systemPackages = with pkgs; [
-      rcon
-    ];
-
-    # backups cs2 server with borg!
-    services.borgbackup.jobs.${service} = {
-      archiveBaseName = service;
-      repo = cfg.backup_repo;
-      paths = cfg.data_dir;
-      compression = "auto,zstd";
-      #preHook = "systemctl start mysql-backup.service";
-      startAt = "*-*-* *:00:00";
-      group = "archives";
-      encryption.mode = "repokey-blake2";
-      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
-      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
-      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
-      prune.keep = {
-        within = "1d"; # Keep all archives from the last day
-        hourly = 24;
-        daily = 7;
-        weekly = 12;
-        monthly = -1; # Keep at least one archive for each month
-      };
-    };
-
-    # manage secrets with sops
-    sops.secrets = {
-      "${service}/gslt" = {
-        owner = service;
-        group = service;
-      };
-      "${service}/rcon" = {
-        owner = service;
-        group = service;
-      };
-    };
-  };
-}

modules/homelab/.default.nix.template.nix

@@ -38,6 +38,10 @@ in {
       default = true;
       description = "enable backups for ${service}";
     };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -82,8 +86,10 @@ in {
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["${service}.${homelab.public_domain}"];
+      # use explicitly defined tls cert
+      # tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
       extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };