test restructure

modules/homelab/network/caddy/default.nix

@@ -0,0 +1,129 @@
+{ pkgs, config, lib, ... }:
+
+let
+  service = "caddy";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in
+{
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    keys = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "host keys directory";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    
+    # declare ${service} group
+    users.groups.${service} = {};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      user = service;
+      group = service;
+      dataDir = cfg.data_dir;
+      email = "me@blakedheld.xyz";
+      globalConfig = ''
+        auto_https ignore_loaded_certs
+      '';
+      
+      virtualHosts."keys.${homelab.base_domain}" =  lib.mkIf cfg.keys {
+        serverAliases = [ "keys.${homelab.public_domain}" ];
+        extraConfig = ''
+            tls internal
+            root /var/www/keys
+            file_server browse
+        '';
+      };
+    };
+
+    # enable acme for auto ssl certs with lets encrypt
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "me@blakedheld.xyz";
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    sops.secrets = {
+      "ssl_blakedheld_crt" = {
+        owner = "caddy";
+        group = "caddy";
+        path = "/etc/ssl/blakedheld.xyz.crt";
+      };
+      "ssl_blakedheld_key" = {
+        owner = "caddy";
+        group = "caddy";
+        path = "/etc/ssl/blakedheld.xyz.key";
+      };
+      "klefki_pub.asc" = {
+        owner = "caddy";
+        group = "caddy";
+        path = "/var/www/keys/klefki_pub.asc";
+      };
+      "caddy_root.crt" = {
+        owner = "caddy";
+        group = "caddy";
+        path = "/var/www/keys/caddy_root.crt";
+      };
+    };
+ 
+  environment.etc."caddy/browse.html".text = ''
+    <!DOCTYPE html>
+    <html>
+      <head>
+        <meta charset="utf-8">
+        <title>{{html .Name}}</title>
+        <style>
+          footer { display: none !important; }
+        </style>
+      </head>
+      <body>
+        {{template "listing" .}}
+      </body>
+    </html>
+  '';
+
+    # add to backups
+   homelab.backups.baks = {
+      ${service} = { paths = [ cfg.data_dir ]; };
+    };
+  };
+}

modules/homelab/network/ddns/default.nix

@@ -0,0 +1,48 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.ddns;
+  token = config.sops.secrets."cloudflare/api_token".path;
+  sec = config.sops.secrets;
+in {
+  options.homelab.ddns = {
+    enable = lib.mkEnableOption "enables ddns with cloudflare";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.cloudflare-ddns = {
+      enable = true;
+      credentialsFile = token;
+      domains = [
+        # recoil.pro
+        "recoil.pro"
+        "*.recoil.pro"
+        "mc.recoil.pro"
+        "smp.recoil.pro"
+        "superflat.recoil.pro"
+        "skyblock.recoil.pro"
+        "cobblemon.recoil.pro"
+
+        # blakedheld.xyz
+        "blakedheld.xyz"
+        "*.blakedheld.xyz"
+        "git.blakedheld.xyz"
+        "up.blakedheld.xyz"
+
+      ];
+    };
+
+    # network config
+
+    # declare authkey secrets
+    sops.secrets = {
+      "cloudflare/api_token" = {
+        owner = "cloudflare-ddns";
+        group = "cloudflare-ddns";
+      };
+    };
+  };
+}

modules/homelab/network/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, config, lib, ... }:
+{
+  # the order determines the order in glance :3
+  imports = [
+    ./dnsmasq
+    ./caddy
+    ./tailscale
+    ./ddns
+  ];
+
+}

modules/homelab/network/dnsmasq/default.nix

@@ -0,0 +1,55 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "dnsmasq";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 53;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      alwaysKeepRunning = true;
+      settings = {
+        listen-address = "10.10.0.10";  # your LAN IP
+        #interface = "enp89s0";
+        bind-interfaces = true;
+        address = [
+          "/snowbelle.lan/10.10.0.10"
+          "/.snowbelle.lan/10.10.0.10"
+          "/lumiose.lan/10.10.0.11"
+          "/.lumiose.lan/10.10.0.11"
+          "/bebe.lan/10.10.0.1"
+        ];
+        server = [ # upstream dns
+          "9.9.9.9"
+          "1.1.1.1"
+        ];
+      };
+    };
+
+    systemd.services.dnsmasq.serviceConfig = {
+      RestartSec = "5s";
+      StartLimitIntervalSec = 60;
+      StartLimitBurst = 10;
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedUDPPorts = [ cfg.port ];
+
+  };
+}

modules/homelab/network/tailscale/default.nix

@@ -0,0 +1,40 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.tailscale;
+  authkey_file = config.sops.secrets."tailscale_authkey".path;
+in {
+  options.homelab.tailscale = {
+    enable = lib.mkEnableOption "enables tailscale";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "both";
+      authKeyFile = authkey_file;
+      extraSetFlags = [
+        "--advertise-routes=10.10.0.10/32" # advertise self
+        "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
+        "--accept-dns=true" # explicitly allow resolved
+      ];
+      extraUpFlags = [
+      ];
+    };
+
+    # network config
+    networking.firewall.trustedInterfaces = ["tailscale0"];
+    networking.firewall.allowedUDPPorts = [config.services.tailscale.port];
+
+    # declare authkey secrets
+    sops.secrets = {
+      "tailscale_authkey" = {
+        owner = "root";
+      };
+    };
+  };
+}