From 7c8a6a0d091f41ce5b9c7335a12d03ead456849d Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 7 Feb 2025 15:02:21 +0000
Subject: [PATCH 01/14] update flake secrets

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 70e52a9..5726670 100644
--- a/flake.lock
+++ b/flake.lock
@@ -539,11 +539,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1738685297,
-        "narHash": "sha256-JOv3+toYlftzBm47QF5tzaBhTbQIm1IBq1tKeQrQLyM=",
+        "lastModified": 1738864447,
+        "narHash": "sha256-MT8kRKA8s7nNen4mJPuITfQ10kpNmGZSNMD2v3/vdz8=",
         "ref": "refs/heads/master",
-        "rev": "3be1d509f9823292dd9ca6b396743fbf722bd8b9",
-        "revCount": 269,
+        "rev": "b5977aae476314875fed887c9a64fc53b024df84",
+        "revCount": 273,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },

From 27a7b0056525855669caf484fbb9a4de35eccea9 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 7 Feb 2025 15:02:40 +0000
Subject: [PATCH 02/14] setup fail2ban

---
 hosts/common/optional/fail2ban.nix | 34 ++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 hosts/common/optional/fail2ban.nix

diff --git a/hosts/common/optional/fail2ban.nix b/hosts/common/optional/fail2ban.nix
new file mode 100644
index 0000000..5811fcc
--- /dev/null
+++ b/hosts/common/optional/fail2ban.nix
@@ -0,0 +1,34 @@
+{pkgs, ...}: {
+
+  environment.systemPackages = [pkgs.fail2ban];
+
+  environment.etc = {
+    "fail2ban/filter.d/nginx-bruteforce.conf".text = ''
+      [Definition]
+      failregex = ^<HOST>.*(GET|POST).* (404|444|403|400) .*$
+    '';
+  };
+
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+    ];
+    bantime-increment = {
+      enable = true;
+      multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h";
+    };
+    jails = {
+      nginx-spam.settings = {
+        filter = "nginx-bruteforce";
+        action = "iptables-allports";
+        logpath = "/var/log/nginx/access.log";
+        backend = "auto";
+        findtime = 600;
+        bantime = 600;
+        maxretry = 10;
+      };
+    };
+  };
+}

From 53106e91da15cbd1181521f02fedcbfb17f291b9 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 7 Feb 2025 15:03:01 +0000
Subject: [PATCH 03/14] nginx configs for semitamaps and vaultwarden

---
 hosts/common/optional/nginx/semitamaps.nix  |  7 ++++++
 hosts/common/optional/nginx/vaultwarden.nix | 24 +++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 hosts/common/optional/nginx/semitamaps.nix
 create mode 100644 hosts/common/optional/nginx/vaultwarden.nix

diff --git a/hosts/common/optional/nginx/semitamaps.nix b/hosts/common/optional/nginx/semitamaps.nix
new file mode 100644
index 0000000..e9a65aa
--- /dev/null
+++ b/hosts/common/optional/nginx/semitamaps.nix
@@ -0,0 +1,7 @@
+{
+  networking.firewall.allowedTCPPorts = [ 80 ];
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."samchance.xyz" = {
+    root = "/srv/hello/";
+  };
+}
diff --git a/hosts/common/optional/nginx/vaultwarden.nix b/hosts/common/optional/nginx/vaultwarden.nix
new file mode 100644
index 0000000..097912f
--- /dev/null
+++ b/hosts/common/optional/nginx/vaultwarden.nix
@@ -0,0 +1,24 @@
+{configVars, ...}: let
+  email = configVars.email.user;
+  domain = configVars.domains.vaultwarden;
+  vaultwardenIp = configVars.networking.addresses.vaultwarden.localAddress;
+  vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
+in {
+  networking.firewall.allowedTCPPorts = [80 443];
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+  };
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://${vaultwardenIp}:${toString vaultwardenPort}";
+      };
+    };
+  };
+}

From 2e984daca084a9af04632deaf4511795800051a0 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 7 Feb 2025 15:07:25 +0000
Subject: [PATCH 04/14] add vaultwarden and semitamaps containers

---
 .../optional/nixos-containers/semitamaps.nix  |  75 ++++++++++++
 .../optional/nixos-containers/vaultwarden.nix | 110 ++++++++++++++++++
 2 files changed, 185 insertions(+)
 create mode 100644 hosts/common/optional/nixos-containers/semitamaps.nix
 create mode 100644 hosts/common/optional/nixos-containers/vaultwarden.nix

diff --git a/hosts/common/optional/nixos-containers/semitamaps.nix b/hosts/common/optional/nixos-containers/semitamaps.nix
new file mode 100644
index 0000000..993deec
--- /dev/null
+++ b/hosts/common/optional/nixos-containers/semitamaps.nix
@@ -0,0 +1,75 @@
+{
+  pkgs,
+  lib,
+  ...
+}: let
+  containerName = "semitamaps";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.semitamaps.hostAddress;
+  localAddress = configVars.networking.addresses.semitamaps.localAddress;
+in {
+
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+
+      networking = {
+        firewall = {
+          enable = true;
+          rejectPackets = true;
+          allowedTCPPorts = [
+            80 443
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      imports = [
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+      ];
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users = {
+        root = {
+          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}
diff --git a/hosts/common/optional/nixos-containers/vaultwarden.nix b/hosts/common/optional/nixos-containers/vaultwarden.nix
new file mode 100644
index 0000000..0d132d5
--- /dev/null
+++ b/hosts/common/optional/nixos-containers/vaultwarden.nix
@@ -0,0 +1,110 @@
+{
+  pkgs,
+  lib,
+  configVars,
+  inputs,
+  ...
+}: let
+  containerName = "vaultwarden";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.vaultwarden.hostAddress;
+  localAddress = configVars.networking.addresses.vaultwarden.localAddress;
+  vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
+  cloudnixIp = configVars.networking.addresses.cloudnix.ip;
+  sops-nix = inputs.sops-nix;
+in {
+
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      
+      networking = {
+        defaultGateway = cloudnixIp;
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            vaultwardenPort
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+      };
+
+      imports = [
+        sops-nix.nixosModules.sops
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+        pkgs.lsof
+      ];
+
+      services.vaultwarden = {
+        enable = true;
+        dbBackend = "sqlite";
+        config = {
+          ROCKET_ADDRESS = "0.0.0.0";
+          ROCKET_PORT = vaultwardenPort;
+          ROCKET_LOG = "critical";
+        };
+      };
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users = {
+        root = {
+          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

From 27f9052eb8d42d7d156da0c29e13841488c37131 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 7 Feb 2025 15:07:48 +0000
Subject: [PATCH 05/14] update flake secrets

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5726670..f9bbc07 100644
--- a/flake.lock
+++ b/flake.lock
@@ -539,11 +539,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1738864447,
-        "narHash": "sha256-MT8kRKA8s7nNen4mJPuITfQ10kpNmGZSNMD2v3/vdz8=",
+        "lastModified": 1738940734,
+        "narHash": "sha256-7yH/LFyop6RoazqROOpQGlMRqbw80DfzUroTj9rTVro=",
         "ref": "refs/heads/master",
-        "rev": "b5977aae476314875fed887c9a64fc53b024df84",
-        "revCount": 273,
+        "rev": "031ee73ab11dd5f91f56cdcac1483b1d59788178",
+        "revCount": 274,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },

From cfc84545407dd4cf79596adac03016d0ac1ac266 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 7 Feb 2025 15:08:19 +0000
Subject: [PATCH 06/14] add services to cloudnix and domains to vars

---
 hosts/cloudnix/default.nix | 28 ++++++++++++++++++++++++++++
 vars/default.nix           |  1 +
 2 files changed, 29 insertions(+)

diff --git a/hosts/cloudnix/default.nix b/hosts/cloudnix/default.nix
index bddaabd..679c528 100644
--- a/hosts/cloudnix/default.nix
+++ b/hosts/cloudnix/default.nix
@@ -30,10 +30,28 @@ in {
     ../common/optional/openssh.nix
 
     ../common/optional/distributed-builds/local-machine.nix
+    ../common/optional/nixos-containers/semitamaps.nix
+    ../common/optional/nixos-containers/vaultwarden.nix
+    ../common/optional/fail2ban.nix
+    ../common/optional/restic-backup.nix
+
+    ../common/optional/nginx/semitamaps.nix
+    ../common/optional/nginx/vaultwarden.nix
+
 
     outputs.nixosModules.nixosAutoUpgrade
   ];
 
+  services.restic.backups = {
+    daily = {
+      paths = [
+        "/persist/"
+      ];
+      exclude = [
+      ];
+    };
+  };
+
   boot = {
     loader = {
       efi.canTouchEfiVariables = false;
@@ -62,6 +80,16 @@ in {
     user = "admin";
   };
 
+  environment.persistence."/persist" = {
+    directories = [
+      "/var/lib/tailscale"
+    ];
+    files = [ "/etc/machine-id" ];
+  };
+
+  # enable tailscale
+  services.tailscale.enable = true;
+
   networking = {
     hostName = "cloudnix";
     nameservers = ["8.8.8.8"];
diff --git a/vars/default.nix b/vars/default.nix
index 82b6969..77172bf 100644
--- a/vars/default.nix
+++ b/vars/default.nix
@@ -5,6 +5,7 @@
     email
     metrics-server
     xmpp
+    domains
     ;
   locations = {
     mediaDataMountPoint = "/media/media";

From 2d6b274b8aa1266b628e6e0d5cce896484098605 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Sat, 8 Feb 2025 14:15:45 +0000
Subject: [PATCH 07/14] add semitamaps webserver container

---
 .../optional/nixos-containers/semitamaps.nix  | 49 ++++++++++++++++++-
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/hosts/common/optional/nixos-containers/semitamaps.nix b/hosts/common/optional/nixos-containers/semitamaps.nix
index 993deec..fd6dc50 100644
--- a/hosts/common/optional/nixos-containers/semitamaps.nix
+++ b/hosts/common/optional/nixos-containers/semitamaps.nix
@@ -1,6 +1,7 @@
 {
   pkgs,
   lib,
+  configVars,
   ...
 }: let
   containerName = "semitamaps";
@@ -8,6 +9,9 @@
   hostAddress = configVars.networking.addresses.semitamaps.hostAddress;
   localAddress = configVars.networking.addresses.semitamaps.localAddress;
 in {
+  systemd.tmpfiles.rules = [
+    "d /var/run/sockets 0770 root root -"
+  ];
 
   networking = {
     nat = {
@@ -30,19 +34,29 @@ in {
     hostAddress = hostAddress;
     localAddress = localAddress;
     nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+      "/var/run/sockets" = {
+        hostPath = "/var/run/sockets";
+        isReadOnly = false;
+      };
+    };
 
     config = {
       pkgs,
       lib,
       ...
     }: {
-
       networking = {
         firewall = {
           enable = true;
           rejectPackets = true;
           allowedTCPPorts = [
-            80 443
+            80
+            443
           ];
         };
         useHostResolvConf = lib.mkForce false;
@@ -63,6 +77,37 @@ in {
         settings.PasswordAuthentication = false;
       };
 
+      systemd.services.semitamaps-api = {
+        wantedBy = ["multi-user.target"];
+        after = ["network.target"];
+        description = "Deploys and serves semitamaps api";
+        environment = {
+        };
+        serviceConfig = {
+          ExecStartPre = pkgs.writeShellScript "semitamaps-api-prestart" ''
+            set -e
+
+            GITCMD="${pkgs.openssh}/bin/ssh -i /etc/ssh/ssh_host_ed25519_key"
+            if [ ! -d "/srv/semitamaps" ]; then
+              export GIT_SSH_COMMAND=$GITCMD
+              ${pkgs.git}/bin/git clone git@git.bitlab21.com:sam/semitamaps.com.git /srv/semitamaps
+              mkdir /srv/semitamaps/.venv
+            fi
+            cd /srv/semitamaps
+            ${pkgs.poetry}/bin/poetry install
+          '';
+          ExecStart = pkgs.writeShellScript "semitamaps-api-start" ''
+            cd /srv/semitamaps
+            .venv/bin/python .venv/bin/uvicorn --workers 4 --uds /var/run/sockets/baseddata.sock backend.app:app
+          '';
+          Restart = "on-failure";
+        };
+      };
+
+      programs.ssh.knownHosts = {
+        "git.bitlab21.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALNd2BGf64heYjWT9yt0fVmngepiHRIMsL7au/MRteg";
+      };
+
       users.users = {
         root = {
           openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);

From 312eca4835f80c8fa1626cd814b489f214c18667 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Tue, 11 Feb 2025 12:26:58 +0000
Subject: [PATCH 08/14] add prosody xmpp container

---
 flake.lock                                    |   8 +-
 hosts/cloudnix/default.nix                    |   4 +-
 hosts/common/optional/nginx/semitamaps.nix    |  23 +-
 hosts/common/optional/nginx/xmpp.nix          |  92 ++++++++
 .../common/optional/nixos-containers/xmpp.nix | 210 ++++++++++++++++++
 5 files changed, 327 insertions(+), 10 deletions(-)
 create mode 100644 hosts/common/optional/nginx/xmpp.nix
 create mode 100644 hosts/common/optional/nixos-containers/xmpp.nix

diff --git a/flake.lock b/flake.lock
index f9bbc07..30cea79 100644
--- a/flake.lock
+++ b/flake.lock
@@ -539,11 +539,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1738940734,
-        "narHash": "sha256-7yH/LFyop6RoazqROOpQGlMRqbw80DfzUroTj9rTVro=",
+        "lastModified": 1739193599,
+        "narHash": "sha256-oJBav9MiFmhZxQWt6si1T5QQuhxWqGOOQNekeJABaXU=",
         "ref": "refs/heads/master",
-        "rev": "031ee73ab11dd5f91f56cdcac1483b1d59788178",
-        "revCount": 274,
+        "rev": "0d69dc15bea7b1a99fce08ea8517f392cbc253ee",
+        "revCount": 278,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },
diff --git a/hosts/cloudnix/default.nix b/hosts/cloudnix/default.nix
index 679c528..8e7c97f 100644
--- a/hosts/cloudnix/default.nix
+++ b/hosts/cloudnix/default.nix
@@ -32,11 +32,13 @@ in {
     ../common/optional/distributed-builds/local-machine.nix
     ../common/optional/nixos-containers/semitamaps.nix
     ../common/optional/nixos-containers/vaultwarden.nix
+    ../common/optional/nixos-containers/xmpp.nix
+
     ../common/optional/fail2ban.nix
     ../common/optional/restic-backup.nix
 
-    ../common/optional/nginx/semitamaps.nix
     ../common/optional/nginx/vaultwarden.nix
+    ../common/optional/nginx/xmpp.nix
 
 
     outputs.nixosModules.nixosAutoUpgrade
diff --git a/hosts/common/optional/nginx/semitamaps.nix b/hosts/common/optional/nginx/semitamaps.nix
index e9a65aa..9e1deef 100644
--- a/hosts/common/optional/nginx/semitamaps.nix
+++ b/hosts/common/optional/nginx/semitamaps.nix
@@ -1,7 +1,20 @@
-{
-  networking.firewall.allowedTCPPorts = [ 80 ];
-  services.nginx.enable = true;
-  services.nginx.virtualHosts."samchance.xyz" = {
-    root = "/srv/hello/";
+{configVars, ...}: let
+  email = configVars.email.user;
+  domain = configVars.domains.xmpp;
+in {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+  };
+  networking.firewall.allowedTCPPorts = [80 443];
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/srv/hello/";
+    };
   };
 }
diff --git a/hosts/common/optional/nginx/xmpp.nix b/hosts/common/optional/nginx/xmpp.nix
new file mode 100644
index 0000000..dc4d7a8
--- /dev/null
+++ b/hosts/common/optional/nginx/xmpp.nix
@@ -0,0 +1,92 @@
+{configVars, ...}: let
+  email = configVars.email.user;
+  xmppDomain = configVars.domains.xmpp;
+  xmppIp = configVars.networking.addresses.xmpp.localAddress;
+  xmppPort = configVars.networking.addresses.xmpp.port;
+in {
+  networking.firewall.allowedTCPPorts = [80 443];
+  users.groups.www-data = {
+    gid = 33;
+  };
+
+  users.users.nginx = {
+    isSystemUser = true;
+    uid = 60;
+    extraGroups = ["www-data"];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/www/${xmppDomain} 0777 root root"
+  ];
+
+  services.httpd.virtualHosts."root" = {
+    hostName = "${xmppDomain}";
+    documentRoot = "/var/www/${xmppDomain}";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+    certs = {
+      "${xmppDomain}" = {
+        webroot = "/var/www/${xmppDomain}";
+        email = email;
+        extraDomainNames = [
+          "chat.${xmppDomain}"
+        ];
+        group = "www-data";
+      };
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."chat.${xmppDomain}" = {
+      # enableACME = true;
+      forceSSL = true;
+      extraConfig = ''
+        client_max_body_size 10G;
+      '';
+      sslCertificate = "/var/lib/acme/${xmppDomain}/fullchain.pem";
+      sslCertificateKey = "/var/lib/acme/${xmppDomain}/key.pem";
+      locations = {
+        "/" = {
+          proxyPass = "http://${xmppIp}:${toString xmppPort}";
+          extraConfig = ''
+            proxy_set_header Host "${xmppDomain}";
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_buffering off;
+            tcp_nodelay on;
+          '';
+        };
+        "/xmpp-websocket" = {
+          proxyPass = "http://${xmppIp}:${toString xmppPort}/xmpp-websocket";
+          extraConfig = ''
+            proxy_http_version 1.1;
+            proxy_set_header Connection "Upgrade";
+            proxy_set_header Upgrade $http_upgrade;
+
+            proxy_set_header Host "${xmppDomain}";
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 900s;
+          '';
+        };
+        "/upload/" = {
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_set_header Host $host;
+                  # pass PUT requests to mod_http_upload for processing
+            if ($request_method = PUT) {
+              proxy_pass http://${xmppIp}:${toString xmppPort};
+            }
+            alias /var/lib/prosody/http_upload;  # storage path of mod_http_upload. NGINX will serve these files to the clients.
+          '';
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/common/optional/nixos-containers/xmpp.nix b/hosts/common/optional/nixos-containers/xmpp.nix
new file mode 100644
index 0000000..72743f0
--- /dev/null
+++ b/hosts/common/optional/nixos-containers/xmpp.nix
@@ -0,0 +1,210 @@
+{
+  pkgs,
+  lib,
+  configVars,
+  inputs,
+  ...
+}: let
+  containerName = "xmpp";
+  xmppDomain = configVars.domains.xmpp;
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.xmpp.hostAddress;
+  localAddress = configVars.networking.addresses.xmpp.localAddress;
+  sops-nix = inputs.sops-nix;
+  xmppPorts = [3478 5281 5280 5269 5222 5223];
+in {
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = xmppPorts;
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/prosody 0750"
+  ];
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+      "/var/lib/prosody" = {
+        hostPath = "/var/lib/prosody";
+        isReadOnly = false;
+      };
+      "/var/lib/acme/${xmppDomain}/" = {
+        hostPath = "/var/lib/acme/${xmppDomain}/";
+        isReadOnly = false;
+      };
+    };
+    forwardPorts =
+      lib.map (port: {
+        containerPort = port;
+        hostPort = port;
+      })
+      xmppPorts;
+    config = {
+      pkgs,
+      lib,
+      config,
+      ...
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      users.groups.www-data = {
+        gid = 33;
+      };
+
+      users.users.prosody = {
+        isSystemUser = true;
+        uid = 149;
+        extraGroups = ["www-data"];
+      };
+
+      networking = {
+        firewall = {
+          enable = true;
+          rejectPackets = true;
+          allowedTCPPorts = xmppPorts ++ [80 443];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+        secrets = {
+          "software/coturn/static-auth-secret" = {
+            mode = "0644";
+          };
+        };
+      };
+
+      imports = [
+        sops-nix.nixosModules.sops
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+        pkgs.prosody
+      ];
+
+      sops.templates."prosody_secrets.lua" = {
+        mode = "644";
+        content = ''
+          turn_external_secret = ${config.sops.placeholder."software/coturn/static-auth-secret"};
+        '';
+      };
+
+      services.prosody = {
+        enable = true;
+        package = pkgs.prosody.override {
+          withCommunityModules = [
+            "turn_external"
+            "conversejs"
+            "admin_web"
+          ];
+        };
+        extraModules = ["turn_external" "conversejs" "admin_web" "http" "websocket"];
+        allowRegistration = true;
+        extraConfig = ''
+          include "${config.sops.templates."prosody_secrets.lua".path}"
+          registration_invite_only = true;
+          allow_user_invites = true;
+          cross_domain_bosh = true;
+          turn_external_host = "turn.${xmppDomain}";
+          turn_external_port = 3478;
+          http_default_host = "${xmppDomain}";
+          certificates = "certs"
+          cross_domain_websocket = { "https://${xmppDomain}" }
+          consider_websocket_secure = true
+          
+          legacy_ssl_ports = { 5223 }
+          legacy_ssl_ssl = {
+            certificate = "/var/lib/acme/${xmppDomain}/cert.pem";
+            key = "/var/lib/acme/${xmppDomain}/key.pem";
+          }
+
+        '';
+        modules.bosh = true;
+        s2sRequireEncryption = true;
+        c2sRequireEncryption = true;
+        s2sSecureAuth = false;
+        admins = ["root@${xmppDomain}"];
+        ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
+        ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
+        virtualHosts."${xmppDomain}" = {
+          enabled = true;
+          ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
+          ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
+          extraConfig = ''
+            http_external_url = "https://chat.${xmppDomain}/"
+            invites_page = "https://chat.${xmppDomain}/register?t={invite.token}"
+            http_paths = {
+              invites_page = "/invite";
+              invites_register_web = "/register";
+            }
+          '';
+          domain = "${xmppDomain}";
+        };
+        muc = [
+          {
+            domain = "conference.${xmppDomain}";
+          }
+        ];
+        uploadHttp = {
+          domain = "https://upload.${xmppDomain}";
+          uploadFileSizeLimit = "1000000000"; # 1 gb file-size limit
+          uploadExpireAfter = "31557600"; # files deleted after 1 year
+        };
+      };
+
+      services.coturn = {
+        enable = true;
+        realm = "turn.${xmppDomain}";
+        use-auth-secret = true;
+        static-auth-secret-file = config.sops.secrets."software/coturn/static-auth-secret".path;
+      };
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users = {
+        root = {
+          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

From eeb4639bdbc22bf443c797d0d04866b5866fc584 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Wed, 12 Feb 2025 20:10:27 +0000
Subject: [PATCH 09/14] fix coturn and modularise ports

---
 flake.lock                                    |   8 +-
 hosts/common/optional/nginx/xmpp.nix          |   2 +-
 .../common/optional/nixos-containers/xmpp.nix | 115 ++++++++++++++----
 3 files changed, 96 insertions(+), 29 deletions(-)

diff --git a/flake.lock b/flake.lock
index 30cea79..97665ed 100644
--- a/flake.lock
+++ b/flake.lock
@@ -539,11 +539,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1739193599,
-        "narHash": "sha256-oJBav9MiFmhZxQWt6si1T5QQuhxWqGOOQNekeJABaXU=",
+        "lastModified": 1739387047,
+        "narHash": "sha256-KpogJP00vwuMIKkGJff3zp0YfV9GfOG//UzMK4nWWUw=",
         "ref": "refs/heads/master",
-        "rev": "0d69dc15bea7b1a99fce08ea8517f392cbc253ee",
-        "revCount": 278,
+        "rev": "be51e237b5b3d441a194f3e516175f6a543aee35",
+        "revCount": 280,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },
diff --git a/hosts/common/optional/nginx/xmpp.nix b/hosts/common/optional/nginx/xmpp.nix
index dc4d7a8..568a5ff 100644
--- a/hosts/common/optional/nginx/xmpp.nix
+++ b/hosts/common/optional/nginx/xmpp.nix
@@ -2,7 +2,7 @@
   email = configVars.email.user;
   xmppDomain = configVars.domains.xmpp;
   xmppIp = configVars.networking.addresses.xmpp.localAddress;
-  xmppPort = configVars.networking.addresses.xmpp.port;
+  xmppPort = configVars.networking.addresses.xmpp.ports.xmpp-c2s;
 in {
   networking.firewall.allowedTCPPorts = [80 443];
   users.groups.www-data = {
diff --git a/hosts/common/optional/nixos-containers/xmpp.nix b/hosts/common/optional/nixos-containers/xmpp.nix
index 72743f0..ce1719d 100644
--- a/hosts/common/optional/nixos-containers/xmpp.nix
+++ b/hosts/common/optional/nixos-containers/xmpp.nix
@@ -9,9 +9,26 @@
   xmppDomain = configVars.domains.xmpp;
   pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
   hostAddress = configVars.networking.addresses.xmpp.hostAddress;
+  externalIp = configVars.networking.addresses.cloudnix.ip;
   localAddress = configVars.networking.addresses.xmpp.localAddress;
   sops-nix = inputs.sops-nix;
-  xmppPorts = [3478 5281 5280 5269 5222 5223];
+  xmppPorts = configVars.networking.addresses.xmpp.ports;
+  xmppUDPPorts =
+    [
+      xmppPorts.coturn
+      xmppPorts.coturn-tls
+    ]
+    ++ lib.range xmppPorts.coturn-min-udp xmppPorts.coturn-max-udp;
+  xmppTCPPorts = [
+    xmppPorts.coturn
+    xmppPorts.coturn-tls
+    xmppPorts.xmpp-https
+    xmppPorts.xmpp-http
+    xmppPorts.xmpp-s2s
+    xmppPorts.xmpp-c2s
+    xmppPorts.xmpp-c2s-legacy-tls
+    xmppPorts.xmpp-s2s-tls
+  ];
 in {
   networking = {
     nat = {
@@ -21,7 +38,8 @@ in {
     };
     firewall = {
       enable = true;
-      allowedTCPPorts = xmppPorts;
+      allowedTCPPorts = xmppTCPPorts;
+      allowedUDPPorts = xmppUDPPorts;
     };
   };
 
@@ -58,10 +76,17 @@ in {
     };
     forwardPorts =
       lib.map (port: {
+        protocol = "tcp";
         containerPort = port;
         hostPort = port;
       })
-      xmppPorts;
+      xmppTCPPorts
+      ++ lib.map (port: {
+        protocol = "udp";
+        containerPort = port;
+        hostPort = port;
+      })
+      xmppUDPPorts;
     config = {
       pkgs,
       lib,
@@ -81,11 +106,18 @@ in {
         extraGroups = ["www-data"];
       };
 
+      users.users.turnserver = {
+        isSystemUser = true;
+        uid = 249;
+        extraGroups = ["www-data"];
+      };
+
       networking = {
         firewall = {
           enable = true;
           rejectPackets = true;
-          allowedTCPPorts = xmppPorts ++ [80 443];
+          allowedTCPPorts = xmppTCPPorts ++ [80 443];
+          allowedUDPPorts = xmppUDPPorts;
         };
         useHostResolvConf = lib.mkForce false;
       };
@@ -114,12 +146,13 @@ in {
         pkgs.vim
         pkgs.git
         pkgs.prosody
+        pkgs.coturn
       ];
 
       sops.templates."prosody_secrets.lua" = {
-        mode = "644";
+        mode = "444";
         content = ''
-          turn_external_secret = ${config.sops.placeholder."software/coturn/static-auth-secret"};
+          turn_external_secret = "${config.sops.placeholder."software/coturn/static-auth-secret"}";
         '';
       };
 
@@ -130,28 +163,56 @@ in {
             "turn_external"
             "conversejs"
             "admin_web"
+            "external_services"
+            "http_altconnect"
           ];
         };
-        extraModules = ["turn_external" "conversejs" "admin_web" "http" "websocket"];
+        extraModules = [
+          "server_contact_info"
+          "http_file_share"
+          "external_services"
+          "turn_external"
+          "conversejs"
+          "admin_web"
+          "http"
+          "websocket"
+          "http_altconnect"
+        ];
         allowRegistration = true;
         extraConfig = ''
-          include "${config.sops.templates."prosody_secrets.lua".path}"
+          Include "${config.sops.templates."prosody_secrets.lua".path}"
           registration_invite_only = true;
           allow_user_invites = true;
           cross_domain_bosh = true;
+          cross_domain_websocket = true;
           turn_external_host = "turn.${xmppDomain}";
-          turn_external_port = 3478;
+          turn_external_port = ${toString xmppPorts.coturn};
           http_default_host = "${xmppDomain}";
           certificates = "certs"
-          cross_domain_websocket = { "https://${xmppDomain}" }
           consider_websocket_secure = true
-          
-          legacy_ssl_ports = { 5223 }
+          external_services = {
+                {
+                  port="${toString xmppPorts.coturn}";
+                  transport="tcp";
+                  type="stun";
+                  host="turn.${xmppDomain}"
+                };
+                {
+                  port="${toString xmppPorts.coturn}";
+                  transport="udp";
+                  type="turn";
+                  host="turn.${xmppDomain}"
+                };
+          }
+          s2s_direct_tls_ports = { ${toString xmppPorts.xmpp-s2s-tls} }
+          legacy_ssl_ports = { ${toString xmppPorts.xmpp-c2s-legacy-tls} }
           legacy_ssl_ssl = {
             certificate = "/var/lib/acme/${xmppDomain}/cert.pem";
             key = "/var/lib/acme/${xmppDomain}/key.pem";
           }
-
+          contact_info = {
+            admin = { "mailto:admin@${xmppDomain}", "xmpp:admin@${xmppDomain}" };
+          }
         '';
         modules.bosh = true;
         s2sRequireEncryption = true;
@@ -160,6 +221,7 @@ in {
         admins = ["root@${xmppDomain}"];
         ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
         ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
+        httpFileShare.domain = "upload.${xmppDomain}";
         virtualHosts."${xmppDomain}" = {
           enabled = true;
           ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
@@ -171,6 +233,12 @@ in {
               invites_page = "/invite";
               invites_register_web = "/register";
             }
+            disco_items = {
+              { "upload.${xmppDomain}.com" },
+              { "rooms.${xmppDomain}.com" },
+              { "turn.${xmppDomain}.com" },
+            }
+
           '';
           domain = "${xmppDomain}";
         };
@@ -191,17 +259,16 @@ in {
         realm = "turn.${xmppDomain}";
         use-auth-secret = true;
         static-auth-secret-file = config.sops.secrets."software/coturn/static-auth-secret".path;
-      };
-
-      services.openssh = {
-        enable = true;
-        settings.PasswordAuthentication = false;
-      };
-
-      users.users = {
-        root = {
-          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
-        };
+        tls-listening-port = xmppPorts.coturn-tls;
+        cert = "/var/lib/acme/${xmppDomain}/cert.pem";
+        pkey = "/var/lib/acme/${xmppDomain}/key.pem";
+        min-port = xmppPorts.coturn-min-udp;
+        max-port = xmppPorts.coturn-max-udp;
+        extraConfig = ''
+          external-ip = ${externalIp}/${localAddress}
+          log = /var/log/turnserver.log
+          verbose
+        '';
       };
 
       system.stateVersion = "24.05";

From c2b13f6908144373b6c6312f31c2fba383b331ca Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Thu, 13 Feb 2025 11:59:52 +0000
Subject: [PATCH 10/14] correct xmpp port

---
 hosts/common/optional/nginx/xmpp.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/common/optional/nginx/xmpp.nix b/hosts/common/optional/nginx/xmpp.nix
index 568a5ff..beefc8f 100644
--- a/hosts/common/optional/nginx/xmpp.nix
+++ b/hosts/common/optional/nginx/xmpp.nix
@@ -2,7 +2,7 @@
   email = configVars.email.user;
   xmppDomain = configVars.domains.xmpp;
   xmppIp = configVars.networking.addresses.xmpp.localAddress;
-  xmppPort = configVars.networking.addresses.xmpp.ports.xmpp-c2s;
+  xmppPort = configVars.networking.addresses.xmpp.ports.xmpp-http;
 in {
   networking.firewall.allowedTCPPorts = [80 443];
   users.groups.www-data = {

From 4552297c29fe2b8f96ab127c0c6ba813861247a7 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 14 Feb 2025 19:14:32 +0000
Subject: [PATCH 11/14] make changes to semitamaps container

---
 .../optional/nixos-containers/semitamaps.nix  | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/hosts/common/optional/nixos-containers/semitamaps.nix b/hosts/common/optional/nixos-containers/semitamaps.nix
index fd6dc50..7113dfe 100644
--- a/hosts/common/optional/nixos-containers/semitamaps.nix
+++ b/hosts/common/optional/nixos-containers/semitamaps.nix
@@ -8,9 +8,10 @@
   pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
   hostAddress = configVars.networking.addresses.semitamaps.hostAddress;
   localAddress = configVars.networking.addresses.semitamaps.localAddress;
+  workingDirectory = "/var/www/semitamaps";
 in {
   systemd.tmpfiles.rules = [
-    "d /var/run/sockets 0770 root root -"
+    "d /var/run/sockets 0660 www-data www-data -"
   ];
 
   networking = {
@@ -62,6 +63,12 @@ in {
         useHostResolvConf = lib.mkForce false;
       };
 
+      systemd.tmpfiles.rules = [
+        "d ${workingDirectory} 0750 www-data www-data"
+        "d ${workingDirectory}/.venv 0750 www-data www-data"
+        "d ${workingDirectory}/public/uploads 0775 www-data www-data"
+      ];
+
       services.resolved.enable = true;
 
       imports = [
@@ -77,28 +84,26 @@ in {
         settings.PasswordAuthentication = false;
       };
 
-      systemd.services.semitamaps-api = {
+      systemd.services.semitamaps = {
         wantedBy = ["multi-user.target"];
         after = ["network.target"];
-        description = "Deploys and serves semitamaps api";
+        description = "Deploys and serves semitamaps";
         environment = {
         };
         serviceConfig = {
-          ExecStartPre = pkgs.writeShellScript "semitamaps-api-prestart" ''
+          WorkingDirectory = "${workingDirectory}";
+          ExecStartPre = pkgs.writeShellScript "semitamaps-prestart" ''
             set -e
 
             GITCMD="${pkgs.openssh}/bin/ssh -i /etc/ssh/ssh_host_ed25519_key"
-            if [ ! -d "/srv/semitamaps" ]; then
+            if [ ! -d ${workingDirectory}/.git ]; then
               export GIT_SSH_COMMAND=$GITCMD
-              ${pkgs.git}/bin/git clone git@git.bitlab21.com:sam/semitamaps.com.git /srv/semitamaps
-              mkdir /srv/semitamaps/.venv
+              ${pkgs.git}/bin/git clone git@git.bitlab21.com:sam/semitamaps.com.git ${workingDirectory}
             fi
-            cd /srv/semitamaps
             ${pkgs.poetry}/bin/poetry install
           '';
-          ExecStart = pkgs.writeShellScript "semitamaps-api-start" ''
-            cd /srv/semitamaps
-            .venv/bin/python .venv/bin/uvicorn --workers 4 --uds /var/run/sockets/baseddata.sock backend.app:app
+          ExecStart = pkgs.writeShellScript "semitamaps-start" ''
+            .venv/bin/python .venv/bin/uvicorn --workers 4 --uds /var/run/sockets/semitamaps.sock app:app
           '';
           Restart = "on-failure";
         };

From 520a063d3f7d50a2ef4e36337d040be6357efff6 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Fri, 21 Feb 2025 08:05:59 +0000
Subject: [PATCH 12/14] remove machineid from cloudnix

---
 hosts/cloudnix/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hosts/cloudnix/default.nix b/hosts/cloudnix/default.nix
index 8e7c97f..cdde410 100644
--- a/hosts/cloudnix/default.nix
+++ b/hosts/cloudnix/default.nix
@@ -86,7 +86,6 @@ in {
     directories = [
       "/var/lib/tailscale"
     ];
-    files = [ "/etc/machine-id" ];
   };
 
   # enable tailscale

From ba0ab222b82b4b38ab1656bf42bfbbad271e3a60 Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Sat, 22 Feb 2025 08:32:20 +0000
Subject: [PATCH 13/14] move forgejo out of container

---
 flake.lock                                    |   8 +-
 hosts/cloudnix/default.nix                    |  11 +-
 hosts/common/optional/forgejo.nix             |  37 ++++++
 hosts/common/optional/nginx/forgejo.nix       |  27 ++++
 .../optional/nixos-containers/forgejo.nix     | 119 ++++++++++++++++++
 .../optional/nixos-containers/semitamaps.nix  |   7 +-
 .../optional/nixos-containers/vaultwarden.nix |   4 +-
 .../common/optional/nixos-containers/xmpp.nix |   4 +
 8 files changed, 201 insertions(+), 16 deletions(-)
 create mode 100644 hosts/common/optional/forgejo.nix
 create mode 100644 hosts/common/optional/nginx/forgejo.nix
 create mode 100644 hosts/common/optional/nixos-containers/forgejo.nix

diff --git a/flake.lock b/flake.lock
index bc1100e..daed992 100644
--- a/flake.lock
+++ b/flake.lock
@@ -559,11 +559,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1739387047,
-        "narHash": "sha256-KpogJP00vwuMIKkGJff3zp0YfV9GfOG//UzMK4nWWUw=",
+        "lastModified": 1740164526,
+        "narHash": "sha256-lpKNY9qLoIT1XbLzeY+tmkV1DjQQ3mWYWjko+necYhM=",
         "ref": "refs/heads/master",
-        "rev": "be51e237b5b3d441a194f3e516175f6a543aee35",
-        "revCount": 280,
+        "rev": "ddf31a3a72504f36577ec341fbc84aa8f3dd3318",
+        "revCount": 283,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },
diff --git a/hosts/cloudnix/default.nix b/hosts/cloudnix/default.nix
index cdde410..3772ec0 100644
--- a/hosts/cloudnix/default.nix
+++ b/hosts/cloudnix/default.nix
@@ -30,16 +30,13 @@ in {
     ../common/optional/openssh.nix
 
     ../common/optional/distributed-builds/local-machine.nix
-    ../common/optional/nixos-containers/semitamaps.nix
-    ../common/optional/nixos-containers/vaultwarden.nix
-    ../common/optional/nixos-containers/xmpp.nix
+    # ../common/optional/nixos-containers/semitamaps.nix
+    # ../common/optional/nixos-containers/vaultwarden.nix
+    # ../common/optional/nixos-containers/xmpp.nix
 
     ../common/optional/fail2ban.nix
     ../common/optional/restic-backup.nix
-
-    ../common/optional/nginx/vaultwarden.nix
-    ../common/optional/nginx/xmpp.nix
-
+    ../common/optional/forgejo.nix
 
     outputs.nixosModules.nixosAutoUpgrade
   ];
diff --git a/hosts/common/optional/forgejo.nix b/hosts/common/optional/forgejo.nix
new file mode 100644
index 0000000..13245f2
--- /dev/null
+++ b/hosts/common/optional/forgejo.nix
@@ -0,0 +1,37 @@
+{
+  pkgs,
+  configVars,
+  ...
+}: let
+  forgejoDomain = configVars.domains.forgejo;
+  forgejoPort = configVars.networking.addresses.forgejo.port;
+in {
+
+  imports = [./nginx/forgejo.nix];
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/forgejo"
+    ];
+  };
+
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+    database.type = "sqlite3";
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = "git.${forgejoDomain}";
+        ROOT_URL = "https://git.${forgejoDomain}/";
+        HTTP_PORT = forgejoPort;
+      };
+      service.DISABLE_REGISTRATION = false;
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "github";
+      };
+    };
+  };
+}
diff --git a/hosts/common/optional/nginx/forgejo.nix b/hosts/common/optional/nginx/forgejo.nix
new file mode 100644
index 0000000..694eb8d
--- /dev/null
+++ b/hosts/common/optional/nginx/forgejo.nix
@@ -0,0 +1,27 @@
+{configVars, ...}: let
+  email = configVars.email.user;
+  domain = configVars.domains.forgejo;
+  forgejoIp = configVars.networking.addresses.forgejo.localAddress;
+  forgejoPort = configVars.networking.addresses.forgejo.port;
+in {
+  networking.firewall.allowedTCPPorts = [80 443];
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+  };
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."git.${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      extraConfig = ''
+        client_max_body_size 1024M;
+      '';
+      locations."/" = {
+        proxyPass = "http://${forgejoIp}:${toString forgejoPort}";
+      };
+    };
+  };
+}
diff --git a/hosts/common/optional/nixos-containers/forgejo.nix b/hosts/common/optional/nixos-containers/forgejo.nix
new file mode 100644
index 0000000..3875a2c
--- /dev/null
+++ b/hosts/common/optional/nixos-containers/forgejo.nix
@@ -0,0 +1,119 @@
+{
+  pkgs,
+  lib,
+  configVars,
+  inputs,
+  ...
+}: let
+  containerName = "forgejo";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.forgejo.hostAddress;
+  localAddress = configVars.networking.addresses.forgejo.localAddress;
+  forgejoPort = configVars.networking.addresses.forgejo.port;
+  forgejoDomain = configVars.domains.forgejo;
+  cloudnixIp = configVars.networking.addresses.cloudnix.ip;
+  sops-nix = inputs.sops-nix;
+in {
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+   imports = [../nginx/forgejo.nix];
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      networking = {
+        defaultGateway = cloudnixIp;
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            forgejoPort
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+      };
+
+      imports = [
+        sops-nix.nixosModules.sops
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+        pkgs.lsof
+      ];
+
+      services.forgejo = {
+        enable = true;
+        package = pkgs.forgejo;
+        database.type = "sqlite3";
+        lfs.enable = true;
+        settings = {
+          server = {
+            DOMAIN = "git.${forgejoDomain}";
+            ROOT_URL = "https://git.${forgejoDomain}/";
+            HTTP_PORT = forgejoPort;
+          };
+          service.DISABLE_REGISTRATION = false;
+          actions = {
+            ENABLED = true;
+            DEFAULT_ACTIONS_URL = "github";
+          };
+        };
+      };
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users = {
+        root = {
+          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}
diff --git a/hosts/common/optional/nixos-containers/semitamaps.nix b/hosts/common/optional/nixos-containers/semitamaps.nix
index 7113dfe..419602d 100644
--- a/hosts/common/optional/nixos-containers/semitamaps.nix
+++ b/hosts/common/optional/nixos-containers/semitamaps.nix
@@ -29,6 +29,10 @@ in {
     ];
   };
 
+  imports = [
+    ../nginx/semitamaps.nix
+  ];
+
   containers."${containerName}" = {
     autoStart = true;
     privateNetwork = true;
@@ -71,9 +75,6 @@ in {
 
       services.resolved.enable = true;
 
-      imports = [
-      ];
-
       environment.systemPackages = [
         pkgs.vim
         pkgs.git
diff --git a/hosts/common/optional/nixos-containers/vaultwarden.nix b/hosts/common/optional/nixos-containers/vaultwarden.nix
index 0d132d5..1e8478f 100644
--- a/hosts/common/optional/nixos-containers/vaultwarden.nix
+++ b/hosts/common/optional/nixos-containers/vaultwarden.nix
@@ -13,7 +13,6 @@
   cloudnixIp = configVars.networking.addresses.cloudnix.ip;
   sops-nix = inputs.sops-nix;
 in {
-
   networking = {
     nat = {
       enable = true;
@@ -29,6 +28,8 @@ in {
     ];
   };
 
+  imports = [../nginx/vaultwarden.nix];
+
   containers."${containerName}" = {
     autoStart = true;
     privateNetwork = true;
@@ -50,7 +51,6 @@ in {
       secretsDirectory = builtins.toString inputs.nix-secrets;
       secretsFile = "${secretsDirectory}/secrets.yaml";
     in {
-      
       networking = {
         defaultGateway = cloudnixIp;
         firewall = {
diff --git a/hosts/common/optional/nixos-containers/xmpp.nix b/hosts/common/optional/nixos-containers/xmpp.nix
index ce1719d..3c450d6 100644
--- a/hosts/common/optional/nixos-containers/xmpp.nix
+++ b/hosts/common/optional/nixos-containers/xmpp.nix
@@ -43,6 +43,10 @@ in {
     };
   };
 
+  imports = [
+    ../nginx/xmpp.nix
+  ];
+
   environment.persistence."/persist" = {
     hideMounts = true;
     directories = [

From 2eb3817bce43efe0dc93a2d418af97e0ead4fc0b Mon Sep 17 00:00:00 2001
From: Sam <samual.shop@proton.me>
Date: Sat, 22 Feb 2025 12:25:33 +0000
Subject: [PATCH 14/14] finalise migrate of git server to forgejo

---
 hosts/common/optional/forgejo.nix           | 20 ++++++++++++++++++++
 hosts/common/optional/nginx/vaultwarden.nix |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/hosts/common/optional/forgejo.nix b/hosts/common/optional/forgejo.nix
index 13245f2..77e60f5 100644
--- a/hosts/common/optional/forgejo.nix
+++ b/hosts/common/optional/forgejo.nix
@@ -1,6 +1,7 @@
 {
   pkgs,
   configVars,
+  lib,
   ...
 }: let
   forgejoDomain = configVars.domains.forgejo;
@@ -16,16 +17,35 @@ in {
     ];
   };
 
+  users.groups.git = {
+    gid = 1009;
+  };
+
+  users.users.git = {
+    isNormalUser = true;
+    home = "/var/lib/forgejo";
+    uid = 1009;
+    extraGroups = ["git"];
+  };
+
+  services.openssh = {
+    authorizedKeysFiles = lib.mkForce [ "/var/lib/forgejo/.ssh/authorized_keys" ];
+  };
+
   services.forgejo = {
     enable = true;
     package = pkgs.forgejo;
     database.type = "sqlite3";
     lfs.enable = true;
+    user = "git";
+    group = "git";
     settings = {
       server = {
+        RUN_USER = "git";
         DOMAIN = "git.${forgejoDomain}";
         ROOT_URL = "https://git.${forgejoDomain}/";
         HTTP_PORT = forgejoPort;
+        SSH_USER = "git";
       };
       service.DISABLE_REGISTRATION = false;
       actions = {
diff --git a/hosts/common/optional/nginx/vaultwarden.nix b/hosts/common/optional/nginx/vaultwarden.nix
index 097912f..a4f7dd3 100644
--- a/hosts/common/optional/nginx/vaultwarden.nix
+++ b/hosts/common/optional/nginx/vaultwarden.nix
@@ -13,7 +13,7 @@ in {
     enable = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-    virtualHosts."${domain}" = {
+    virtualHosts."password.${domain}" = {
       enableACME = true;
       forceSSL = true;
       locations."/" = {