test restructure
This commit is contained in:
@@ -0,0 +1,123 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = <port>;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {
|
||||
gid = lib.mkForce cfg.ids;
|
||||
};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = ["media"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
dataDir = cfg.data_dir;
|
||||
settings = {
|
||||
server.port = cfg.port;
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = ["${service}.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
#---------------------------------------------------------------------------
|
||||
# # add to glance (public service)
|
||||
# homelab.glance.links.<category> = [{
|
||||
# title = service;
|
||||
# url = "https://${service}.${homelab.public_domain}";
|
||||
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
# icon = "di:${service}"; }];
|
||||
#---------------------------------------------------------------------------
|
||||
# # add to glance (local service)
|
||||
# homelab.glance.links.<category> = [{
|
||||
# title = service;
|
||||
# url = "https://${cfg.url}";
|
||||
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
# icon = "di:${service}"; }];
|
||||
#---------------------------------------------------------------------------
|
||||
#
|
||||
# sops.secrets = {
|
||||
# "${service}_" = {
|
||||
# owner = ;
|
||||
# group = ;
|
||||
# };
|
||||
# };
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [cfg.data_dir];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
|
||||
let
|
||||
cfg = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab = {
|
||||
enable = lib.mkEnableOption "enable homelab services and configuration";
|
||||
media_user = lib.mkOption {
|
||||
default = "media";
|
||||
type = lib.types.str;
|
||||
description = "user for media file permissions";
|
||||
};
|
||||
media_group = lib.mkOption {
|
||||
default = "media";
|
||||
type = lib.types.str;
|
||||
description = "group for media file permissions";
|
||||
};
|
||||
tz = lib.mkOption {
|
||||
default = "America/Chicago";
|
||||
type = lib.types.str;
|
||||
description = "set timezone";
|
||||
};
|
||||
base_domain = lib.mkOption {
|
||||
default = "snowbelle.lan";
|
||||
type = lib.types.str;
|
||||
description = "base domain used for reverse proxy";
|
||||
};
|
||||
public_domain = lib.mkOption {
|
||||
default = "blakedheld.xyz";
|
||||
type = lib.types.str;
|
||||
description = "base domain used for reverse proxy";
|
||||
};
|
||||
host_ip = lib.mkOption {
|
||||
default = "10.10.0.10";
|
||||
type = lib.types.str;
|
||||
description = "base domain used for reverse proxy";
|
||||
};
|
||||
};
|
||||
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./motd
|
||||
./dnsmasq
|
||||
./backups
|
||||
./glance
|
||||
./postfix
|
||||
./caddy
|
||||
./home/zigbee2mqtt
|
||||
./vaultwarden
|
||||
./gitea
|
||||
./home/homeassistant
|
||||
./immich
|
||||
./arr/bazarr
|
||||
./arr/prowlarr
|
||||
./arr/radarr
|
||||
./qbittorrent
|
||||
./arr/sonarr
|
||||
./yacreader
|
||||
./audiobookshelf
|
||||
./jellyfin
|
||||
./arr/flaresolverr
|
||||
./home/mosquitto
|
||||
./home/wyoming
|
||||
./uptime-kuma
|
||||
./tailscale
|
||||
./ddns
|
||||
];
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
users = {
|
||||
groups.${cfg.media_group} = {
|
||||
gid = 700;
|
||||
};
|
||||
users.${cfg.media_user} = {
|
||||
uid = 700;
|
||||
isSystemUser = true;
|
||||
group = cfg.media_group;
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
@@ -41,31 +41,10 @@ in
|
||||
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./motd
|
||||
./dnsmasq
|
||||
./backups
|
||||
./glance
|
||||
./postfix
|
||||
./caddy
|
||||
./home/zigbee2mqtt
|
||||
./vaultwarden
|
||||
./gitea
|
||||
./home/homeassistant
|
||||
./immich
|
||||
./arr/bazarr
|
||||
./arr/prowlarr
|
||||
./arr/radarr
|
||||
./qbittorrent
|
||||
./arr/sonarr
|
||||
./yacreader
|
||||
./audiobookshelf
|
||||
./jellyfin
|
||||
./arr/flaresolverr
|
||||
./home/mosquitto
|
||||
./home/wyoming
|
||||
./uptime-kuma
|
||||
./tailscale
|
||||
./ddns
|
||||
./mediastack
|
||||
./services
|
||||
./system
|
||||
./network
|
||||
];
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
@@ -0,0 +1,105 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "audiobookshelf";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7101;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "abs.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
# home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
# dataDir = cfg.data_dir;
|
||||
host = "0.0.0.0";
|
||||
port = cfg.port;
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "abs.${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance public service
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://abs.${homelab.base_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "bazarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7105;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
listenPort = cfg.port;
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
{
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./bazarr
|
||||
./prowlarr
|
||||
./radarr
|
||||
./qbittorrent
|
||||
./sonarr
|
||||
./yacreader
|
||||
./audiobookshelf
|
||||
./jellyfin
|
||||
./flaresolverr
|
||||
];
|
||||
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "flaresolverr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7120;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
group = service;
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
port = cfg.port;
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
User = service;
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "jellyfin";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7100;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "media.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" "video" "render" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
dataDir = cfg.data_dir;
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
#services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "media.${homelab.public_domain}" ];
|
||||
#tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://media.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "prowlarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7104;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
server.port = cfg.port;
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
User = service;
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "qbittorrent";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7103;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
# torrenting_port = lib.mkOption {
|
||||
# type = lib.types.int;
|
||||
# default = ;
|
||||
# description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
# };
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "qbit.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
vpn_inf = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "enp89s0.69";
|
||||
description = "set the interface qbittorrent will be bound to (used to route through vpn)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# ensure media dirs existence
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /holocron/media/downloads 2775 qbittorrent media -"
|
||||
];
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = "media";
|
||||
};
|
||||
|
||||
# enable the qbittorrent service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = lib.mkForce "media"; # override for permissions
|
||||
profileDir = cfg.data_dir;
|
||||
webuiPort = cfg.port;
|
||||
# torrentingPort = cfg.torrenting_port;
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service} = {
|
||||
serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
};
|
||||
|
||||
# bind to network interface but allow local access to webui
|
||||
networking.firewall.extraCommands = ''
|
||||
iptables -F QBIT 2>/dev/null || true
|
||||
iptables -X QBIT 2>/dev/null || true
|
||||
iptables -N QBIT
|
||||
iptables -A OUTPUT -m owner --uid-owner ${toString cfg.ids} -j QBIT
|
||||
iptables -A QBIT -o ${cfg.vpn_inf} -j ACCEPT
|
||||
iptables -A QBIT -p udp --dport 53 -o ${cfg.vpn_inf} -j ACCEPT
|
||||
iptables -A QBIT -p tcp --dport 53 -o ${cfg.vpn_inf} -j ACCEPT
|
||||
iptables -A QBIT -o lo -j ACCEPT
|
||||
iptables -A QBIT -p tcp -d 127.0.0.1 --dport ${toString cfg.port} -j ACCEPT
|
||||
iptables -A QBIT -p tcp -o enp89s0 -d 10.0.0.0/8 --dport ${toString cfg.port} -j ACCEPT
|
||||
iptables -A QBIT -j DROP
|
||||
'';
|
||||
|
||||
# boilerplate for if you ever want to try to get this working again
|
||||
# ------------------------------------------------------------------------------
|
||||
# # add systemd service to VPN network namespace
|
||||
# vpnConfinement = {
|
||||
# enable = true;
|
||||
# vpnNamespace = "wgmex";
|
||||
# };
|
||||
# ------------------------------------------------------------------------------
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,107 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "radarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7107;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# required
|
||||
environment.systemPackages = with pkgs; [ffmpeg_6-headless];
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
dataDir = cfg.data_dir;
|
||||
settings = {
|
||||
server.port = cfg.port;
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "sonarr";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7106;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service} reverse proxy entry";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# required
|
||||
environment.systemPackages = with pkgs; [ffmpeg_6-headless];
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
dataDir = cfg.data_dir;
|
||||
settings = {
|
||||
server.port = cfg.port;
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
# tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,109 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "yacreader";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7102;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "manga.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# install the binary
|
||||
environment.systemPackages = with pkgs; [ yacreader ];
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
systemd.services.${service} = {
|
||||
description = "${service} library server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
User = service;
|
||||
Group = service;
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.yacreader}/bin/YACReaderLibraryServer start --port ${toString cfg.port}";
|
||||
WorkingDirectory = "/var/lib/yacreader";
|
||||
TimeoutStopSec = "20s";
|
||||
};
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance local service
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:yac-reader"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,129 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "caddy";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
keys = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "host keys directory";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
user = service;
|
||||
group = service;
|
||||
dataDir = cfg.data_dir;
|
||||
email = "me@blakedheld.xyz";
|
||||
globalConfig = ''
|
||||
auto_https ignore_loaded_certs
|
||||
'';
|
||||
|
||||
virtualHosts."keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
|
||||
serverAliases = [ "keys.${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
root /var/www/keys
|
||||
file_server browse
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# enable acme for auto ssl certs with lets encrypt
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "me@blakedheld.xyz";
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
sops.secrets = {
|
||||
"ssl_blakedheld_crt" = {
|
||||
owner = "caddy";
|
||||
group = "caddy";
|
||||
path = "/etc/ssl/blakedheld.xyz.crt";
|
||||
};
|
||||
"ssl_blakedheld_key" = {
|
||||
owner = "caddy";
|
||||
group = "caddy";
|
||||
path = "/etc/ssl/blakedheld.xyz.key";
|
||||
};
|
||||
"klefki_pub.asc" = {
|
||||
owner = "caddy";
|
||||
group = "caddy";
|
||||
path = "/var/www/keys/klefki_pub.asc";
|
||||
};
|
||||
"caddy_root.crt" = {
|
||||
owner = "caddy";
|
||||
group = "caddy";
|
||||
path = "/var/www/keys/caddy_root.crt";
|
||||
};
|
||||
};
|
||||
|
||||
environment.etc."caddy/browse.html".text = ''
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>{{html .Name}}</title>
|
||||
<style>
|
||||
footer { display: none !important; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
{{template "listing" .}}
|
||||
</body>
|
||||
</html>
|
||||
'';
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
cfg = config.homelab.ddns;
|
||||
token = config.sops.secrets."cloudflare/api_token".path;
|
||||
sec = config.sops.secrets;
|
||||
in {
|
||||
options.homelab.ddns = {
|
||||
enable = lib.mkEnableOption "enables ddns with cloudflare";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.cloudflare-ddns = {
|
||||
enable = true;
|
||||
credentialsFile = token;
|
||||
domains = [
|
||||
# recoil.pro
|
||||
"recoil.pro"
|
||||
"*.recoil.pro"
|
||||
"mc.recoil.pro"
|
||||
"smp.recoil.pro"
|
||||
"superflat.recoil.pro"
|
||||
"skyblock.recoil.pro"
|
||||
"cobblemon.recoil.pro"
|
||||
|
||||
# blakedheld.xyz
|
||||
"blakedheld.xyz"
|
||||
"*.blakedheld.xyz"
|
||||
"git.blakedheld.xyz"
|
||||
"up.blakedheld.xyz"
|
||||
|
||||
];
|
||||
};
|
||||
|
||||
# network config
|
||||
|
||||
# declare authkey secrets
|
||||
sops.secrets = {
|
||||
"cloudflare/api_token" = {
|
||||
owner = "cloudflare-ddns";
|
||||
group = "cloudflare-ddns";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
{
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./dnsmasq
|
||||
./caddy
|
||||
./tailscale
|
||||
./ddns
|
||||
];
|
||||
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "dnsmasq";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 53;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
alwaysKeepRunning = true;
|
||||
settings = {
|
||||
listen-address = "10.10.0.10"; # your LAN IP
|
||||
#interface = "enp89s0";
|
||||
bind-interfaces = true;
|
||||
address = [
|
||||
"/snowbelle.lan/10.10.0.10"
|
||||
"/.snowbelle.lan/10.10.0.10"
|
||||
"/lumiose.lan/10.10.0.11"
|
||||
"/.lumiose.lan/10.10.0.11"
|
||||
"/bebe.lan/10.10.0.1"
|
||||
];
|
||||
server = [ # upstream dns
|
||||
"9.9.9.9"
|
||||
"1.1.1.1"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.dnsmasq.serviceConfig = {
|
||||
RestartSec = "5s";
|
||||
StartLimitIntervalSec = 60;
|
||||
StartLimitBurst = 10;
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
networking.firewall.allowedUDPPorts = [ cfg.port ];
|
||||
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
cfg = config.homelab.tailscale;
|
||||
authkey_file = config.sops.secrets."tailscale_authkey".path;
|
||||
in {
|
||||
options.homelab.tailscale = {
|
||||
enable = lib.mkEnableOption "enables tailscale";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
useRoutingFeatures = "both";
|
||||
authKeyFile = authkey_file;
|
||||
extraSetFlags = [
|
||||
"--advertise-routes=10.10.0.10/32" # advertise self
|
||||
"--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
|
||||
"--accept-dns=true" # explicitly allow resolved
|
||||
];
|
||||
extraUpFlags = [
|
||||
];
|
||||
};
|
||||
|
||||
# network config
|
||||
networking.firewall.trustedInterfaces = ["tailscale0"];
|
||||
networking.firewall.allowedUDPPorts = [config.services.tailscale.port];
|
||||
|
||||
# declare authkey secrets
|
||||
sops.secrets = {
|
||||
"tailscale_authkey" = {
|
||||
owner = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
{
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./glance
|
||||
./home/zigbee2mqtt
|
||||
./vaultwarden
|
||||
./gitea
|
||||
./home/homeassistant
|
||||
./immich
|
||||
./home/mosquitto
|
||||
./home/wyoming
|
||||
];
|
||||
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
{ pkgs, nixpkgs-unstable, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "gitea";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7703;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
ssh_port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7567;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "git.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = lib.mkForce "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
shell = pkgs.bash;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
# if you wanna attempt system ssh again
|
||||
#openssh.authorizedKeys.keyFiles = [
|
||||
# "${cfg.data_dir}/.ssh/authorized_keys"
|
||||
#];
|
||||
};
|
||||
|
||||
# declare the gitea service
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
user = "gitea";
|
||||
group = "gitea";
|
||||
stateDir = cfg.data_dir;
|
||||
appName = "gitea";
|
||||
settings = {
|
||||
server = {
|
||||
# http config
|
||||
ROOT_URL = "https://git.blakedheld.xyz";
|
||||
DOMAIN = "git.blakedheld.xyz";
|
||||
HTTP_PORT = cfg.port;
|
||||
# local network config
|
||||
#LOCAL_ROOT_URL = "https://git.snowbelle.lan";
|
||||
ALLOW_LOCALNETWORKS = true;
|
||||
ALLOWED_DOMAINS = "10.10.0.10";
|
||||
SKIP_TLS_VERIFY = true;
|
||||
# configure for system ssh (trying to use the systms on nix sucks)
|
||||
SSH_PORT = cfg.ssh_port;
|
||||
START_SSH_SERVER = true;
|
||||
# SSH_PORT = 22;
|
||||
# START_SSH_SERVER = false;
|
||||
# SSH_ROOT_PATH = "${cfg.data_dir}/.ssh";
|
||||
# SSH_CREATE_AUTHORIZED_KEYS_FILE = true;
|
||||
# actual git config
|
||||
DEFAULT_BRANCH = "trunk";
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
DEFAULT_PUSH_CREATE_PRIVATE = true;
|
||||
};
|
||||
};
|
||||
database = {
|
||||
passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."git.${homelab.public_domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy localhost:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy localhost:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = service;
|
||||
url = "https://git.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# manage secrets with sops
|
||||
sops.secrets = {
|
||||
"${service}_database_password" = {
|
||||
owner = service;
|
||||
group = service;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,339 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
/*
|
||||
this is a wrapper module for glance that allows you to
|
||||
to pass monitor entries in with nix, all declaratively!
|
||||
|
||||
| <8yy> |
|
||||
V V
|
||||
# add to glance
|
||||
homelab.glance.links.mediastack = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
allow-insecure = true; }];
|
||||
*/
|
||||
|
||||
let
|
||||
service = "glance";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
|
||||
uptimekuma_url = "localhost:7901";
|
||||
uptimekuma_page = "glance";
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7700;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
links = {
|
||||
services = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
default = [ ];
|
||||
description = "list of links for ${service}";
|
||||
};
|
||||
mediastack = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
default = [ ];
|
||||
description = "list of links for ${service}";
|
||||
};
|
||||
system = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
default = [ ];
|
||||
description = "list of links for ${service}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {
|
||||
gid = lib.mkForce cfg.ids;
|
||||
};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ ];
|
||||
};
|
||||
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
server = {
|
||||
host = "0.0.0.0";
|
||||
port = cfg.port;
|
||||
assets-path = "${cfg.data_dir}/assets";
|
||||
};
|
||||
# theme = {custom-css-file = "/assets/user.css";};
|
||||
auth = {
|
||||
secret-key = "+mYVAc1uO85hUUz5Ij6Lpelv1RqiLlneYqZD5Jv45buoF2+LZtIt2okRrbFCppiRQbqXkGoRMtSI0bROg4uFUw==";
|
||||
users = {
|
||||
blake = {
|
||||
password-hash = "$2a$10$RwPCkcto35DCp4vNTDpH6.G3TpecPJ/zUL1jI93uzr.lg6v233Sie";
|
||||
};
|
||||
};
|
||||
};
|
||||
branding = {
|
||||
#logo-url = "/assets/icons/${config.networking.hostName}.png";
|
||||
logo-url = "/assets/icons/snowbelle.png";
|
||||
favicon-url = "/assets/icons/favicon.ico";
|
||||
};
|
||||
pages = [
|
||||
{
|
||||
name = config.networking.hostName;
|
||||
hide-desktop-navigation = true;
|
||||
columns = [
|
||||
{
|
||||
size = "small";
|
||||
widgets = [
|
||||
{
|
||||
type = "calendar";
|
||||
first-day-of-week = "monday";
|
||||
}
|
||||
{
|
||||
type = "server-stats";
|
||||
servers = [
|
||||
{
|
||||
type = "local";
|
||||
name = config.networking.hostName;
|
||||
hide-mountpoints-by-default = true;
|
||||
mountpoints = {
|
||||
"/" = {name = "root"; hide = false;};
|
||||
"/holocron" = {name = "holocron"; hide = false;};
|
||||
"/holocron/media" = {name = "media"; hide = false;};
|
||||
"/holocron/vault" = {name = "vault"; hide = false;};
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
type = "clock";
|
||||
hour-format = "24h";
|
||||
timezones = [
|
||||
{
|
||||
timezone = "America/Chicago";
|
||||
label = "HTX";
|
||||
}
|
||||
{
|
||||
timezone = "America/Denver";
|
||||
label = "AF";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
type = "twitch-channels";
|
||||
channels = [
|
||||
"SaltSSBM"
|
||||
"thewaffle77"
|
||||
"ironmouse"
|
||||
"linustech"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
size = "full";
|
||||
widgets = [
|
||||
{
|
||||
type = "search";
|
||||
autofocus = true;
|
||||
search-engine = "https://duckduckgo.com/?q={QUERY}";
|
||||
new-tab = true;
|
||||
bangs = [
|
||||
{
|
||||
title = "youtube";
|
||||
shortcut = "!y";
|
||||
url = "https://www.youtube.com/results?search_query={QUERY}";
|
||||
}
|
||||
{
|
||||
title = "google";
|
||||
shortcut = "!g";
|
||||
url = "https://www.google.com/search?q={QUERY}";
|
||||
}
|
||||
{
|
||||
title = "github";
|
||||
shortcut = "!gh";
|
||||
url = "https://github.com/search?q={QUERY}&type=repositories";
|
||||
}
|
||||
{
|
||||
title = "nixos options";
|
||||
shortcut = "!no";
|
||||
url = "https://search.nixos.org/options?channel=25.05&query={QUERY}";
|
||||
}
|
||||
{
|
||||
title = "nixos packages";
|
||||
shortcut = "!np";
|
||||
url = "https://search.nixos.org/packages?channel=25.05&query={QUERY}";
|
||||
}
|
||||
{
|
||||
title = "home-manager options";
|
||||
shortcut = "!hm";
|
||||
url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-25.05";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
type = "monitor";
|
||||
cache = "1m";
|
||||
title = "services";
|
||||
sites = cfg.links.services;
|
||||
}
|
||||
{
|
||||
type = "monitor";
|
||||
cache = "1m";
|
||||
title = "mediastack";
|
||||
sites = cfg.links.mediastack;
|
||||
}
|
||||
{
|
||||
type = "monitor";
|
||||
cache = "1m";
|
||||
title = "system";
|
||||
sites = cfg.links.system;
|
||||
}
|
||||
{
|
||||
type = "custom-api";
|
||||
title = "recpro";
|
||||
url = "https://api.mcstatus.io/v2/status/java/mc.recoil.pro";
|
||||
cache = "5s";
|
||||
template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
|
||||
}
|
||||
{
|
||||
type = "custom-api";
|
||||
title = "cobblemon";
|
||||
url = "https://api.mcstatus.io/v2/status/java/cobblemon.recoil.pro";
|
||||
cache = "5s";
|
||||
template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
size = "small";
|
||||
widgets = [
|
||||
{
|
||||
type = "weather";
|
||||
location = "Pearland, Texas, United States";
|
||||
units = "imperial";
|
||||
hour-format = "24h";
|
||||
}
|
||||
{
|
||||
type = "markets";
|
||||
markets = [
|
||||
{
|
||||
symbol = "SPY";
|
||||
name = "S&P 500";
|
||||
}
|
||||
{
|
||||
symbol = "XMR-USD";
|
||||
name = "Monero";
|
||||
}
|
||||
{
|
||||
symbol = "NVDA";
|
||||
name = "NVIDIA";
|
||||
}
|
||||
{
|
||||
symbol = "AAPL";
|
||||
name = "Apple";
|
||||
}
|
||||
{
|
||||
symbol = "MSFT";
|
||||
name = "Microsoft";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
type = "releases";
|
||||
cache = "1d";
|
||||
repositories = [
|
||||
"glanceapp/glance"
|
||||
"go-gitea/gitea"
|
||||
"immich-app/immich"
|
||||
"syncthing/syncthing"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
User = service;
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
# serverAliases = [ "${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [ cfg.data_dir ];
|
||||
};
|
||||
};
|
||||
|
||||
# add to udr to glance
|
||||
homelab.glance.links.system = [{
|
||||
title = "bebe";
|
||||
url = "https://bebe.lan";
|
||||
error-url = "https://10.10.0.1";
|
||||
check-url = "https://10.10.0.1";
|
||||
icon = "di:unifi";
|
||||
allow-insecure = true; }];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,161 @@
|
||||
{ pkgs, config, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
nixservice = "home-assistant";
|
||||
service = "hass";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7704;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "podman-hass";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
};
|
||||
|
||||
# still suss as fuck bro man fuck
|
||||
virtualisation.oci-containers.containers = {
|
||||
hass = {
|
||||
image = "homeassistant/home-assistant:stable";
|
||||
autoStart = true;
|
||||
extraOptions = [
|
||||
"--pull=newer"
|
||||
"--network=host"
|
||||
];
|
||||
volumes = [
|
||||
"${cfg.data_dir}:/config"
|
||||
];
|
||||
# ports = [
|
||||
# "0.0.0.0:7704:8123"
|
||||
# "0.0.0.0:4141:4141"
|
||||
# ];
|
||||
environment = {
|
||||
TZ = homelab.tz;
|
||||
PUID = toString config.users.users.${service}.uid;
|
||||
PGID = toString config.users.groups.${service}.gid;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port 8123 ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "${service}.${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = "home assistant";
|
||||
url = "https://hass.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${nixservice}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
|
||||
# here lies my tough, and I mean fucking tough, swing at
|
||||
# getting this to work bare metal, ggs ill see you again
|
||||
# - didnt take long
|
||||
# --------------------------------------------------------------------------------
|
||||
# # enable the ${service} service
|
||||
# services.${nixservice} = {
|
||||
# enable = true;
|
||||
# package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.home-assistant;
|
||||
# extraComponents = [
|
||||
# # required for onboarding
|
||||
# "analytics"
|
||||
# "google_translate"
|
||||
# "met"
|
||||
# "radio_browser"
|
||||
# "shopping_list"
|
||||
# "isal"
|
||||
# "default_config"
|
||||
# "mqtt"
|
||||
# ];
|
||||
# extraPackages = python3Packages: with python3Packages; [
|
||||
# psycopg2
|
||||
# universal-silabs-flasher
|
||||
# getmac
|
||||
# zha
|
||||
# ha-silabs-firmware-client
|
||||
# paho-mqtt
|
||||
# aiomqtt
|
||||
# aiounifi
|
||||
# ibeacon-ble
|
||||
# ];
|
||||
# # imperative config
|
||||
# config = null;
|
||||
# lovelaceConfig = null;
|
||||
# configDir = cfg.data_dir;
|
||||
# # declartive poggers!
|
||||
## config = {
|
||||
## # Includes dependencies for a basic setup
|
||||
## default_config = {};
|
||||
## };
|
||||
# };
|
||||
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "mosquitto";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 1883;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = lib.mkForce "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.mosquitto.enable = true;
|
||||
services.mosquitto.listeners = [
|
||||
{
|
||||
port = 1883;
|
||||
address = "0.0.0.0";
|
||||
users.zigbee = {
|
||||
acl = [ "readwrite #" ];
|
||||
hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw==";
|
||||
};
|
||||
# use with no auth
|
||||
# settings.allow_anonymous = true;
|
||||
# acl = [ "pattern readwrite #" ];
|
||||
# omitPasswordAuth = true;
|
||||
}
|
||||
];
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
User = service;
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_hashed_passwd" = {
|
||||
owner = service;
|
||||
group = service;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "wyoming";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
faster_whisper_port = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "7706";
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
piper_port = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "7707";
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
faster-whisper = {
|
||||
servers = {
|
||||
vanessa = {
|
||||
enable = true;
|
||||
language = "en";
|
||||
uri = "tcp://0.0.0.0:${cfg.faster_whisper_port}";
|
||||
model = "medium";
|
||||
device = "auto";
|
||||
};
|
||||
};
|
||||
};
|
||||
piper = {
|
||||
servers = {
|
||||
vanessa = {
|
||||
enable = true;
|
||||
uri = "tcp://0.0.0.0:${cfg.piper_port}";
|
||||
voice = "en_US-amy-medium";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
#networking.firewall.allowedTCPPorts = [ cfg.faster_whisper_port cfg.piper_port ];
|
||||
networking.firewall.allowedTCPPorts = [ 7706 7707 ];
|
||||
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,130 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "zigbee2mqtt";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7705;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "z2m.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
dataDir = cfg.data_dir;
|
||||
settings = {
|
||||
mqtt = {
|
||||
base_topic = "zigbee2mqtt";
|
||||
client_id = "zigbee2mqtt";
|
||||
server = "mqtt://localhost:1883";
|
||||
user = "!/run/secrets/mosquitto_passwd.yaml user";
|
||||
password = "!/run/secrets/mosquitto_passwd.yaml password";
|
||||
keepalive = 20;
|
||||
};
|
||||
serial = {
|
||||
port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
|
||||
adapter = "ember";
|
||||
};
|
||||
advanced = {
|
||||
channel = 11;
|
||||
};
|
||||
frontend = {
|
||||
enabled = true;
|
||||
port = cfg.port;
|
||||
};
|
||||
homeassistant = {
|
||||
enabled = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
User = service;
|
||||
Group = service;
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "z2m.${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
sops.secrets = {
|
||||
"mosquitto_passwd.yaml" = {
|
||||
owner = service;
|
||||
group = service;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
unstable_pkgs,
|
||||
...
|
||||
}: let
|
||||
service = "immich";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7702;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "photos.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "immich-server";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = ["video" "render" "blake"];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
#package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.immich;
|
||||
package = unstable_pkgs.x86_64.immich;
|
||||
openFirewall = true;
|
||||
user = service;
|
||||
group = service;
|
||||
mediaLocation = cfg.data_dir;
|
||||
host = "0.0.0.0";
|
||||
port = cfg.port;
|
||||
settings = null;
|
||||
#settings.server.externalDomain = "https://photos.blakedheld.xyz";
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
# systemd.services."${toString service}-server".serviceConfig = {
|
||||
# UMask = lib.mkForce "0007";
|
||||
# };
|
||||
# systemd.services."${toString service}-machine-learning".serviceConfig = {
|
||||
# UMask = lib.mkForce "0007";
|
||||
# };
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = ["photos.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://photos.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
# add postgresql database that is automatically created to the backup list
|
||||
#services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
|
||||
|
||||
services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
{ pkgs, config, lib, unstable_pkgs, ... }:
|
||||
|
||||
let
|
||||
service = "vaultwarden";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
domain = "https://pass.blakedheld.xyz";
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7701;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "pass.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [];
|
||||
};
|
||||
|
||||
# enable the vaultwarden service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
package = unstable_pkgs.x86_64.vaultwarden;
|
||||
config = {
|
||||
DOMAIN = domain;
|
||||
ROCKET_ADDRESS = "0.0.0.0";
|
||||
ROCKET_PORT = cfg.port;
|
||||
SIGNUPS_ALLOWED = true;
|
||||
# ADMIN_TOKEN = "yuh";
|
||||
ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
|
||||
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
|
||||
# The following flags are available:
|
||||
# - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
|
||||
# - "autofill-v2": Use the new autofill implementation.
|
||||
# - "browser-fileless-import": Directly import credentials from other providers without a file.
|
||||
# - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
|
||||
# - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
|
||||
# - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
|
||||
# - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
|
||||
# - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = { UMask = lib.mkForce "0007"; };
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "pass.${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
title = service;
|
||||
url = "https://pass.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_admin_token" = {
|
||||
owner = "${service}";
|
||||
group = "${service}";
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
/*
|
||||
to restore mysql/marinadb database:
|
||||
mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;" # delete old db if still lingering
|
||||
mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;" # create empty db w/ correct name
|
||||
zstd -dc <path_to_backup> | mysql -u root -p <database_name>
|
||||
|
||||
to restore a postgres database:
|
||||
sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;" # delete old db if lingering (prolly wont work)
|
||||
sudo -u postgres psql -c "CREATE DATABASE <database_name>;" # create empty db w/ correct name
|
||||
zstd -dc <path_to_backup> | sudo -u postgres psql -d immich # restore from the dump
|
||||
*/
|
||||
let
|
||||
cfg = config.homelab.backups;
|
||||
sec = config.sops.secrets;
|
||||
in {
|
||||
options.homelab.backups = {
|
||||
enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
|
||||
baks = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
|
||||
default = {};
|
||||
description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
|
||||
};
|
||||
backup_repo = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/holocron/archives/homelab";
|
||||
description = "path to take daily backups to with borg!";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# backups homelab with borg
|
||||
services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
|
||||
archiveBaseName = "homelab";
|
||||
repo = cfg.backup_repo;
|
||||
paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
|
||||
compression = "auto,zstd";
|
||||
startAt = "03:30";
|
||||
group = "archives";
|
||||
encryption.mode = "repokey-blake2";
|
||||
encryption.passCommand = "cat ${sec."borg_passwd".path}";
|
||||
preHook = ''
|
||||
systemctl start mysql-backup.service
|
||||
systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
|
||||
'';
|
||||
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
|
||||
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
|
||||
prune.keep = {
|
||||
within = "1d"; # Keep all archives from the last day
|
||||
daily = 7;
|
||||
weekly = 12;
|
||||
monthly = -1; # Keep at least one archive for each month
|
||||
};
|
||||
};
|
||||
|
||||
# mysql backups currently minecraft_recpro is the only thing using this
|
||||
services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
|
||||
enable = true;
|
||||
location = "/var/backup/mysql";
|
||||
user = "root";
|
||||
calendar = "daily"; # goes fast, included in back up with server dirs at **:00
|
||||
compressionAlg = "zstd";
|
||||
databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
|
||||
};
|
||||
# postgresql backups currently immich is the only user
|
||||
services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
|
||||
enable = true;
|
||||
location = "/var/backup/postgresql";
|
||||
compression = "zstd"; # optional: "xz", "zstd", "none"
|
||||
startAt = "daily"; # the dump is included in a backup taken at 4:00
|
||||
databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
|
||||
};
|
||||
|
||||
# helpful and for scripts
|
||||
environment.systemPackages = with pkgs; [borgbackup tree];
|
||||
|
||||
sops.secrets = {
|
||||
"borg_passwd" = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
{
|
||||
# the order determines the order in glance :3
|
||||
imports = [
|
||||
./motd
|
||||
./backups
|
||||
./uptime-kuma
|
||||
./postfix
|
||||
];
|
||||
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkIf mkOption types filterAttrs mapAttrsToList;
|
||||
cfg = config.homelab.motd;
|
||||
|
||||
# collect services to display
|
||||
motd_list =
|
||||
mapAttrsToList (_: v: v.motd)
|
||||
(filterAttrs (_: v: v ? motd && v.motd != null) config.homelab);
|
||||
in {
|
||||
options.homelab.motd = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "enable motd script";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.etc."motd".text = ''
|
||||
#!/usr/bin/env bash
|
||||
|
||||
active=$'\033[1;34m'
|
||||
inactive=$'\033[1;31m'
|
||||
headings=$'\033[1;35m'
|
||||
bold=$'\e[1m'
|
||||
reset=$'\033[0m'
|
||||
memory=`free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100 / $2 }'`
|
||||
load1=`cat /proc/loadavg | awk {'print $1'}`
|
||||
load5=`cat /proc/loadavg | awk {'print $2'}`
|
||||
load15=`cat /proc/loadavg | awk {'print $3'}`
|
||||
uptime=`cat /proc/uptime | cut -f1 -d.`
|
||||
up_days=$((uptime/60/60/24))
|
||||
up_hours=$((uptime/60/60%24))
|
||||
up_mins=$((uptime/60%60))
|
||||
up_secs=$((uptime%60))
|
||||
nixos_version=$(nixos-version | sed -E 's/^([0-9]{2}\.[0-9]{2}).*\(([^)]+)\)$/\1 (\2)/')
|
||||
cpu_usage=$(top -bn1 | grep "Cpu(s)" | awk '{print 100 - $8 "%"}')
|
||||
mem_total=$(grep MemTotal /proc/meminfo | awk '{print $2}')
|
||||
mem_avail=$(grep MemAvailable /proc/meminfo | awk '{print $2}')
|
||||
mem_used=$((mem_total - mem_avail))
|
||||
mem_percent=$((100 * mem_used / mem_total))
|
||||
uptime_fmt=$(uptime -p 2>/dev/null || cat /proc/uptime | awk '{print int($1/3600)"h "int(($1%3600)/60)"m"}')
|
||||
|
||||
printf "$bold welcome to $(hostname)!$reset\n"
|
||||
printf "\n"
|
||||
printf "$bold * %-20s$reset %s\n" "Release" "$nixos_version"
|
||||
printf "$bold * %-20s$reset %s\n" "Kernel" "$(uname -rs)"
|
||||
printf "\n"
|
||||
printf "$bold * %-20s$reset %s\n" "CPU usage" "$load1, $load5, $load15 (1, 5, 15 min)"
|
||||
printf "$bold * %-20s$reset %s\n" "Memory" "$memory"
|
||||
printf "$bold * %-20s$reset %s\n" "System uptime" "$up_days days $up_hours hours $up_mins minutes $up_secs seconds"
|
||||
|
||||
echo
|
||||
|
||||
# --- services ---
|
||||
echo -e "''${headings}homelab services:''${reset}"
|
||||
|
||||
${lib.concatStringsSep "\n" (map (service: ''
|
||||
if systemctl list-units --type=service --all | grep -q "${service}"; then
|
||||
status=$(systemctl is-active ${service} 2>/dev/null)
|
||||
if [ "$status" = "active" ]; then
|
||||
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "running"
|
||||
else
|
||||
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "not running"
|
||||
fi
|
||||
else
|
||||
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "not found"
|
||||
fi
|
||||
'')
|
||||
motd_list)}
|
||||
|
||||
echo
|
||||
|
||||
# --- gameservers ---
|
||||
echo -e "''${headings}gameservers:''${reset}"
|
||||
for service in velocity smp superflat bento cobblemon; do
|
||||
status=$(systemctl is-active $service 2>/dev/null)
|
||||
if [ "$status" = "active" ]; then
|
||||
printf "%-32s%s\n" " ''${active}[$service]''${reset}" "running"
|
||||
else
|
||||
printf "%-32s%s\n" " ''${active}[$service]''${reset}" "not running"
|
||||
fi
|
||||
done
|
||||
echo
|
||||
'';
|
||||
|
||||
environment.etc."motd".mode = "0755";
|
||||
|
||||
programs.zsh.interactiveShellInit = ''
|
||||
/etc/motd
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "postfix";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 587;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# declare ${service} group
|
||||
# users.groups.${service} = {
|
||||
# gid = lib.mkForce cfg.ids;
|
||||
# };
|
||||
#
|
||||
# # declare ${service} user
|
||||
# users.users.${service} = {
|
||||
# description = "${service} server user";
|
||||
# uid = lib.mkForce cfg.ids;
|
||||
# isSystemUser = true;
|
||||
# home = cfg.data_dir;
|
||||
# createHome = true;
|
||||
# group = service;
|
||||
# extraGroups = [];
|
||||
# };
|
||||
|
||||
# enable the ${service} service
|
||||
services.postfix = {
|
||||
enable = true;
|
||||
settings.main = {
|
||||
relayhost = ["smtp.gmail.com:${toString cfg.port}"];
|
||||
smtp_tls_security_level = "may";
|
||||
smtp_sasl_auth_enable = "yes";
|
||||
smtp_sasl_security_options = "noanonymous";
|
||||
smtp_sasl_password_maps = "texthash:${config.sops.secrets."postfix_passwd".path}";
|
||||
# optional: Forward mails to root (e.g. from cron jobs, smartd)
|
||||
# to me privately and to my work email:
|
||||
virtual_alias_maps = "inline:{ {root=me@blakedheld.xyz, throwedspam@gmail.com} }";
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
# systemd.services.${service}.serviceConfig = {
|
||||
# UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
#};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_passwd" = {
|
||||
owner = config.services.postfix.user;
|
||||
group = config.services.postfix.group;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [cfg.data_dir];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "postfix";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 587;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# declare ${service} group
|
||||
# users.groups.${service} = {
|
||||
# gid = lib.mkForce cfg.ids;
|
||||
# };
|
||||
#
|
||||
# # declare ${service} user
|
||||
# users.users.${service} = {
|
||||
# description = "${service} server user";
|
||||
# uid = lib.mkForce cfg.ids;
|
||||
# isSystemUser = true;
|
||||
# home = cfg.data_dir;
|
||||
# createHome = true;
|
||||
# group = service;
|
||||
# extraGroups = [];
|
||||
# };
|
||||
|
||||
# enable the ${service} service
|
||||
services.postfix = {
|
||||
enable = true;
|
||||
relayHost = "smtp.mail.me.com";
|
||||
relayPort = cfg.port;
|
||||
config = {
|
||||
smtp_tls_security_level = "may";
|
||||
smtp_sasl_auth_enable = "yes";
|
||||
smtp_sasl_security_options = "";
|
||||
smtp_sasl_password_maps = "texthash:${config.sops.secrets."postfix_passwd".path}";
|
||||
# optional: Forward mails to root (e.g. from cron jobs, smartd)
|
||||
# to me privately and to my work email:
|
||||
virtual_alias_maps = "inline:{ {root=me@blakedheld.xyz} }";
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
# systemd.services.${service}.serviceConfig = {
|
||||
# UMask = lib.mkForce "0007";
|
||||
# User = service;
|
||||
# Group = service;
|
||||
#};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_passwd" = {
|
||||
owner = config.services.postfix.user;
|
||||
group = config.services.postfix.group;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [cfg.data_dir];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
service = "uptime-kuma";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7901;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "up.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
motd = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = service;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = "${service}";
|
||||
extraGroups = [];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
settings =
|
||||
{
|
||||
PORT = toString cfg.port;
|
||||
HOST = "0.0.0.0";
|
||||
};
|
||||
};
|
||||
|
||||
# override umask to make permissions work out
|
||||
systemd.services.${service}.serviceConfig = {
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
|
||||
# # open firewall
|
||||
# networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = [ "up.${homelab.public_domain}" ];
|
||||
extraConfig = ''
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.system = [{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}"; }];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ cfg.data_dir ]; };
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user