Merge branch 'cloudnix'

flake.lock

@@ -539,11 +539,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1737899664,
+        "lastModified": 1739387047,
-        "narHash": "sha256-iZpzTSERNQ5UvFfEzrBLuEmcRUGjBSal7ShtXurYq8Q=",
+        "narHash": "sha256-KpogJP00vwuMIKkGJff3zp0YfV9GfOG//UzMK4nWWUw=",
         "ref": "refs/heads/master",
-        "rev": "a9844a78dcbdc8a84679835112970d80822b113c",
+        "rev": "be51e237b5b3d441a194f3e516175f6a543aee35",
-        "revCount": 257,
+        "revCount": 280,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },

home/common/optional/desktop/common/default.nix

@@ -29,5 +29,6 @@
     pkgs.R
     pkgs.gimp
     pkgs.gajim
+    pkgs.vlc
   ];
 }

hosts/cloudnix/default.nix

@@ -30,10 +30,30 @@ in {
     ../common/optional/openssh.nix
 
     ../common/optional/distributed-builds/local-machine.nix
+    ../common/optional/nixos-containers/semitamaps.nix
+    ../common/optional/nixos-containers/vaultwarden.nix
+    ../common/optional/nixos-containers/xmpp.nix
+
+    ../common/optional/fail2ban.nix
+    ../common/optional/restic-backup.nix
+
+    ../common/optional/nginx/vaultwarden.nix
+    ../common/optional/nginx/xmpp.nix
+
 
     outputs.nixosModules.nixosAutoUpgrade
   ];
 
+  services.restic.backups = {
+    daily = {
+      paths = [
+        "/persist/"
+      ];
+      exclude = [
+      ];
+    };
+  };
+
   boot = {
     loader = {
       efi.canTouchEfiVariables = false;
@@ -62,6 +82,16 @@ in {
     user = "admin";
   };
 
+  environment.persistence."/persist" = {
+    directories = [
+      "/var/lib/tailscale"
+    ];
+    files = [ "/etc/machine-id" ];
+  };
+
+  # enable tailscale
+  services.tailscale.enable = true;
+
   networking = {
     hostName = "cloudnix";
     nameservers = ["8.8.8.8"];

hosts/common/optional/arion-containers/jellyfin.nix

@@ -1,32 +0,0 @@
-{
-  virtualisation.arion = {
-    backend = "podman-socket";
-    projects.jellyfin = {
-      settings = {
-        services.jellyfin.service = {
-          ports = [
-            "8096:8096"
-          ];
-          container_name = "jellyfin";
-          image = "lscr.io/linuxserver/jellyfin:latest";
-          restart = "always";
-          volumes = [
-            "/srv/docker/media-server/jellyfin/config:/config"
-            "/media/media/tv:/data/tvshows:ro"
-            "/media/media/movies:/data/movies:ro"
-            "/media/media/music/music_data:/data/music:ro"
-            "/media/media/youtube:/data/youtube:ro"
-            "/media/media/podcasts:/data/podcasts:ro"
-            "/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
-          ];
-          environment = {
-            PUID = "1000";
-            PGID = "1000";
-            DOCKER_MODS="linuxserver/mods:jellyfin-opencl-intel";
-          };
-          devices = ["/dev/dri:/dev/dri"];
-        };
-      };
-    };
-  };
-}

hosts/common/optional/arion-containers/semitamaps-tileserver.nix

@@ -1,31 +0,0 @@
-{
-  virtualisation.arion = {
-    backend = "podman-socket";
-    projects.semitamaps-tileserver = {
-      settings = {
-        services.tileserver-gl.service = {
-          ports = [
-            "8080:8080"
-          ];
-          container_name = "tileserver-gl";
-          image = "maptiler/tileserver-gl";
-          restart = "always";
-          volumes = [
-            "/data/semitamaps-data/tileserver-gl/data:/data"
-          ];
-          command = "-c /data/config.json --public_url https://tiles.semitamaps.com/";
-        };
-
-        services.mbgl-renderer.service = {
-          ports = [
-            "8081:80"
-          ];
-          container_name = "mbgl-renderer";
-          image = "mbgl-renderer";
-          restart = "always";
-        };
-      };
-    };
-  };
-}
-

hosts/common/optional/docker-containers/baikal.nix

@@ -0,0 +1,17 @@
+{
+  config.virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      baikal = {
+        image = "ckulka/baikal:nginx";
+        ports = [
+          "6734:80"
+        ];
+        volumes = [
+          "/srv/docker/baikal/config:/var/www/baikal/config"
+          "/srv/docker/baikal/data:/var/www/baikal/Specific"
+        ];
+      };
+    };
+  };
+}

hosts/common/optional/docker-containers/jellyfin.nix

@@ -0,0 +1,31 @@
+{
+  config.virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      jellyfin = {
+        image = "lscr.io/linuxserver/jellyfin:latest";
+        ports = [
+          "8096:8096"
+        ];
+        volumes = [
+          "/srv/docker/media-server/jellyfin/config:/config"
+          "/media/media/tv:/data/tvshows:ro"
+          "/media/media/movies:/data/movies:ro"
+          "/media/media/music/music_data:/data/music:ro"
+          "/media/media/youtube:/data/youtube:ro"
+          "/media/media/podcasts:/data/podcasts:ro"
+          "/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
+        ];
+        environment = {
+          PUID = "1000";
+          PGID = "1000";
+          DOCKER_MODS = "linuxserver/mods:jellyfin-opencl-intel";
+          NVIDIA_VISIBLE_DEVICES = "all";
+        };
+        extraOptions = [
+          "--device=nvidia.com/gpu=all"
+        ];
+      };
+    };
+  };
+}

hosts/common/optional/docker-containers/semitamaps-tileserver.nix

@@ -0,0 +1,25 @@
+{
+  config.virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      tileserver-gl = {
+        image = "maptiler/tileserver-gl";
+        ports = [
+          "8080:8080"
+        ];
+        volumes = [
+          "/data/semitamaps-data/tileserver-gl/data:/data"
+        ];
+      };
+      mbgl-renderer = {
+        image = "mbgl-renderer";
+        ports = [
+          "8081:80"
+        ];
+        volumes = [
+          "/data/semitamaps-data/tileserver-gl/data:/data"
+        ];
+      };
+    };
+  };
+}

hosts/common/optional/fail2ban.nix

@@ -0,0 +1,34 @@
+{pkgs, ...}: {
+
+  environment.systemPackages = [pkgs.fail2ban];
+
+  environment.etc = {
+    "fail2ban/filter.d/nginx-bruteforce.conf".text = ''
+      [Definition]
+      failregex = ^<HOST>.*(GET|POST).* (404|444|403|400) .*$
+    '';
+  };
+
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+    ];
+    bantime-increment = {
+      enable = true;
+      multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h";
+    };
+    jails = {
+      nginx-spam.settings = {
+        filter = "nginx-bruteforce";
+        action = "iptables-allports";
+        logpath = "/var/log/nginx/access.log";
+        backend = "auto";
+        findtime = 600;
+        bantime = 600;
+        maxretry = 10;
+      };
+    };
+  };
+}

hosts/common/optional/nginx/semitamaps.nix

@@ -0,0 +1,20 @@
+{configVars, ...}: let
+  email = configVars.email.user;
+  domain = configVars.domains.xmpp;
+in {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+  };
+  networking.firewall.allowedTCPPorts = [80 443];
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/srv/hello/";
+    };
+  };
+}

hosts/common/optional/nginx/vaultwarden.nix

@@ -0,0 +1,24 @@
+{configVars, ...}: let
+  email = configVars.email.user;
+  domain = configVars.domains.vaultwarden;
+  vaultwardenIp = configVars.networking.addresses.vaultwarden.localAddress;
+  vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
+in {
+  networking.firewall.allowedTCPPorts = [80 443];
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+  };
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://${vaultwardenIp}:${toString vaultwardenPort}";
+      };
+    };
+  };
+}

hosts/common/optional/nginx/xmpp.nix

@@ -0,0 +1,92 @@
+{configVars, ...}: let
+  email = configVars.email.user;
+  xmppDomain = configVars.domains.xmpp;
+  xmppIp = configVars.networking.addresses.xmpp.localAddress;
+  xmppPort = configVars.networking.addresses.xmpp.ports.xmpp-http;
+in {
+  networking.firewall.allowedTCPPorts = [80 443];
+  users.groups.www-data = {
+    gid = 33;
+  };
+
+  users.users.nginx = {
+    isSystemUser = true;
+    uid = 60;
+    extraGroups = ["www-data"];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/www/${xmppDomain} 0777 root root"
+  ];
+
+  services.httpd.virtualHosts."root" = {
+    hostName = "${xmppDomain}";
+    documentRoot = "/var/www/${xmppDomain}";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = email;
+    certs = {
+      "${xmppDomain}" = {
+        webroot = "/var/www/${xmppDomain}";
+        email = email;
+        extraDomainNames = [
+          "chat.${xmppDomain}"
+        ];
+        group = "www-data";
+      };
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."chat.${xmppDomain}" = {
+      # enableACME = true;
+      forceSSL = true;
+      extraConfig = ''
+        client_max_body_size 10G;
+      '';
+      sslCertificate = "/var/lib/acme/${xmppDomain}/fullchain.pem";
+      sslCertificateKey = "/var/lib/acme/${xmppDomain}/key.pem";
+      locations = {
+        "/" = {
+          proxyPass = "http://${xmppIp}:${toString xmppPort}";
+          extraConfig = ''
+            proxy_set_header Host "${xmppDomain}";
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_buffering off;
+            tcp_nodelay on;
+          '';
+        };
+        "/xmpp-websocket" = {
+          proxyPass = "http://${xmppIp}:${toString xmppPort}/xmpp-websocket";
+          extraConfig = ''
+            proxy_http_version 1.1;
+            proxy_set_header Connection "Upgrade";
+            proxy_set_header Upgrade $http_upgrade;
+
+            proxy_set_header Host "${xmppDomain}";
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 900s;
+          '';
+        };
+        "/upload/" = {
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_set_header Host $host;
+                  # pass PUT requests to mod_http_upload for processing
+            if ($request_method = PUT) {
+              proxy_pass http://${xmppIp}:${toString xmppPort};
+            }
+            alias /var/lib/prosody/http_upload;  # storage path of mod_http_upload. NGINX will serve these files to the clients.
+          '';
+        };
+      };
+    };
+  };
+}

hosts/common/optional/nixos-containers/docker.nix

@@ -53,6 +53,10 @@ in {
         node = "/dev/nvidiactl";
         modifier = "rwm";
       }
+      {
+        node = "/dev/nvidia-uvm";
+        modifier = "rwm";
+      }
       {
         node = "/dev/fuse";
         modifier = "rwm";
@@ -174,11 +178,12 @@ in {
       imports = [
         arion.nixosModules.arion
         sops-nix.nixosModules.sops
-        ../arion-containers/arrstack.nix
+        ../docker-containers/arrstack.nix
-        ../arion-containers/jellyfin.nix
+        ../docker-containers/jellyfin.nix
-        ../arion-containers/photoprism.nix
+        ../docker-containers/photoprism.nix
-        ../arion-containers/syncthing.nix
+        ../docker-containers/syncthing.nix
-        (import ../arion-containers/searxng.nix {configVars = configVars;})
+        ../docker-containers/baikal.nix
+        (import ../docker-containers/searxng.nix {configVars = configVars;})
       ];
 
       environment.systemPackages = [
@@ -204,18 +209,6 @@ in {
 
       networking.firewall.interfaces."podman+".allowedUDPPorts = [53];
 
-      systemd.services.podman-autostart = {
-        enable = true;
-        after = ["podman.service"];
-        wantedBy = ["multi-user.target"];
-        description = "Automatically start containers with --restart=always tag";
-        serviceConfig = {
-          Type = "idle";
-          ExecStartPre = ''${pkgs.coreutils}/bin/sleep 1'';
-          ExecStart = ''/run/current-system/sw/bin/podman start --all --filter restart-policy=always'';
-        };
-      };
-
       services.prometheus = {
         exporters = {
           node = {

hosts/common/optional/nixos-containers/metrics-server.nix

@@ -2,11 +2,15 @@
   pkgs,
   lib,
   configVars,
+  inputs,
   ...
 }: let
   containerName = "metrics-server";
   containerIp = configVars.networking.addresses.metrics-server.ip;
 
+  notifybotJid = configVars.xmpp.notifybotJid;
+  receiverJid = configVars.xmpp.personalAccount;
+
   dockerContainerIp = configVars.networking.addresses.docker.ip;
   smWorkerIp = configVars.networking.addresses.sm-worker.ip;
   merlinIp = configVars.networking.addresses.merlin.ip;
@@ -15,6 +19,7 @@
   bitcoinNode = configVars.networking.addresses.bitcoin-node.ip;
   postres = configVars.networking.addresses.postgres.ip;
   backupServer = configVars.networking.addresses.backup-server.ip;
+  sops-nix = inputs.sops-nix;
 
   http_endpoints = configVars.metrics-server.blackbox.http_endpoints;
 
@@ -52,6 +57,10 @@ in {
         hostPath = metricsServerContainerData;
         isReadOnly = false;
       };
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
     };
 
     config = {
@@ -59,7 +68,10 @@ in {
       lib,
       config,
       ...
-    }: {
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
       networking = {
         defaultGateway = "${gatewayIp}";
         interfaces.eth0.ipv4.addresses = [
@@ -74,14 +86,32 @@ in {
             config.services.prometheus.port
             config.services.grafana.port
             config.services.prometheus.exporters.blackbox.port
+            9199 #xmpp listen port
           ];
         };
         useHostResolvConf = lib.mkForce false;
       };
 
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+        secrets = {
+          "software/restic-passphrase" = {};
+          "software/restic-exporter-credentials" = {};
+          "comms/xmpp/notifybot/password" = {
+            mode = "0644";
+          };
+        };
+      };
+
       services.resolved.enable = true;
 
       imports = [
+        sops-nix.nixosModules.sops
       ];
 
       environment.systemPackages = [
@@ -89,9 +119,49 @@ in {
         pkgs.git
       ];
 
+      services.grafana = {
+        enable = true;
+        settings.server = {
+          http_port = 2342;
+          http_addr = "0.0.0.0";
+        };
+      };
+
+      # main prometheus service
       services.prometheus = {
         enable = true;
+        webExternalUrl = "http://${containerIp}:9001";
         port = 9001;
+        alertmanagers = [
+          {
+            scheme = "http";
+            path_prefix = "/";
+            static_configs = [
+              {
+                targets = [
+                  "0.0.0.0:9093"
+                ];
+              }
+            ];
+          }
+        ];
+        ruleFiles = [
+          "${pkgs.writeText
+            "alert_rule.yml"
+            ''
+              groups:
+              - name: blackbox_alert
+                rules:
+                - alert: EndpointDown
+                  expr: probe_success{job="blackbox"} == 0
+                  for: 1m
+                  labels:
+                    severity: critical
+                  annotations:
+                    summary: "Endpoint {{ $labels.instance }} down"
+                    description: "An endpoint has been down for more than 1 minute."
+            ''}"
+        ];
         scrapeConfigs = [
           {
             job_name = "node_exporter";
@@ -110,6 +180,16 @@ in {
               }
             ];
           }
+          {
+            job_name = "restic-exporter";
+            static_configs = [
+              {
+                targets = [
+                  "0.0.0.0:8001"
+                ];
+              }
+            ];
+          }
 
           {
             job_name = "blackbox";
@@ -138,43 +218,74 @@ in {
         ];
       };
 
-      services.grafana = {
+      # setup alertmanager
+      services.prometheus.xmpp-alerts = {
         enable = true;
-        settings.server = {
+        settings = {
-          http_port = 2342;
+          jid = notifybotJid;
-          http_addr = "0.0.0.0";
+          password_command = "cat ${config.sops.secrets."comms/xmpp/notifybot/password".path}";
+          to_jid = receiverJid;
+          listen_address = "0.0.0.0";
+          listen_port = 9199;
         };
       };
+      services.prometheus.alertmanager = {
+        webExternalUrl = "http://${containerIp}:9093";
+        enable = true;
+        openFirewall = true;
+        port = 9093;
+        configText = ''
+          global:
+            resolve_timeout: 1m
 
-      services.prometheus = {
+          route:
-        exporters = {
+            group_by: ['...']
-          blackbox = {
+            repeat_interval: 1h
-            enable = true;
+            receiver: 'xmpp-alerts'
-            configFile = pkgs.writeText "blackbox-conf.yaml" ''
-              modules:
-                http_basic:
-                  prober: http
-                  timeout: 5s
-                  http:
-                    preferred_ip_protocol: ip4
-                    valid_http_versions: ["HTTP/1.1", "HTTP/2"]
-                    method: GET
-                    # fail_if_ssl: false
-                    # fail_if_not_ssl: true
-                    # tls_config:
-                    #   insecure_skip_verify: true
-                tcp_connect:
-                  prober: tcp
-                  tcp:
-                    preferred_ip_protocol: ip4
 
-            '';
+          receivers:
-          };
+          - name: 'xmpp-alerts'
-          node = {
+            webhook_configs:
-            enable = true;
+            - url: 'http://0.0.0.0:9199/alert'
-            enabledCollectors = ["systemd"];
+        '';
-            port = 9002;
+      };
-          };
+
+      # prometheus exporters
+      services.prometheus.exporters = {
+        blackbox = {
+          enable = true;
+          configFile = pkgs.writeText "blackbox-conf.yaml" ''
+            modules:
+              http_basic:
+                prober: http
+                timeout: 5s
+                http:
+                  preferred_ip_protocol: ip4
+                  valid_http_versions: ["HTTP/1.1", "HTTP/2"]
+                  method: GET
+                  # fail_if_ssl: false
+                  # fail_if_not_ssl: true
+                  # tls_config:
+                  #   insecure_skip_verify: true
+              tcp_connect:
+                prober: tcp
+                tcp:
+                  preferred_ip_protocol: ip4
+
+          '';
+        };
+        node = {
+          enable = true;
+          enabledCollectors = ["systemd"];
+          port = 9002;
+        };
+        restic = {
+          enable = true;
+          repository = "";
+          environmentFile = config.sops.secrets."software/restic-exporter-credentials".path;
+          passwordFile = config.sops.secrets."software/restic-passphrase".path;
+          refreshInterval = 10800; # refresh every 3 hours
+          port = 8001;
         };
       };
 

hosts/common/optional/nixos-containers/nix-bitcoin.nix

@@ -62,7 +62,7 @@ in {
     }: {
       imports = [
         inputs.nix-bitcoin.nixosModules.default
-        inputs.lnbits.nixosModules.default
+        # inputs.lnbits.nixosModules.default
       ];
       environment.systemPackages = with pkgs; [
         vim
@@ -80,14 +80,13 @@ in {
         firewall = {
           enable = true;
           allowedTCPPorts = [
-            80
+            # 80
-            443
+            # 443
-            22
             config.containers.bitcoin-node.config.services.bitcoind.rpc.port
             config.containers.bitcoin-node.config.services.mempool.frontend.port
             config.containers.bitcoin-node.config.services.electrs.port
-            config.containers.bitcoin-node.config.services.rtl.port
+            # config.containers.bitcoin-node.config.services.rtl.port
-            config.containers.bitcoin-node.config.services.lnd.port
+            # config.containers.bitcoin-node.config.services.lnd.port
           ];
         };
         useHostResolvConf = lib.mkForce false;
@@ -144,7 +143,7 @@ in {
           };
         };
         lnd = {
-          enable = true;
+          enable = false;
           lndconnect = {
             enable = true;
             onion = true;
@@ -156,34 +155,34 @@ in {
           '';
         };
         rtl = {
-          enable = true;
+          enable = false;
           nodes.lnd.enable = true;
           address = "0.0.0.0";
         };
-        lnbits = {
+        # lnbits = {
-          enable = true;
+        #   enable = false;
-          openFirewall = true;
+        #   openFirewall = true;
-          host = "0.0.0.0";
+        #   host = "0.0.0.0";
-          port = 8231;
+        #   port = 8231;
-          env = {
+        #   env = {
-            LNBITS_ADMIN_UI = "true";
+        #     LNBITS_ADMIN_UI = "true";
-            LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
+        #     LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
-            LND_REST_ENDPOINT = "https://127.0.0.1:8080";
+        #     LND_REST_ENDPOINT = "https://127.0.0.1:8080";
-            LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
+        #     LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
-            LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
+        #     LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
-            AUTH_ALLOWED_METHODS = "user-id-only, username-password";
+        #     AUTH_ALLOWED_METHODS = "user-id-only, username-password";
-          };
+        #   };
-        };
+        # };
       };
 
       # Add custom systemd overrides for above services
-      systemd.services.lnbits.after = ["lnd.service"];
+      # systemd.services.lnbits.after = ["lnd.service"];
 
       nix-bitcoin.onionServices = {
         bitcoind.enable = true;
         electrs.enable = true;
         mempool-frontend.enable = true;
-        lnd.public = true;
+        # lnd.public = true;
       };
 
       services.prometheus = {

hosts/common/optional/nixos-containers/pihole.nix

@@ -72,7 +72,7 @@ in {
 
       imports = [
         arion.nixosModules.arion
-        ../arion-containers/pihole.nix
+        ../docker-containers/pihole.nix
       ];
 
       environment.systemPackages = [

hosts/common/optional/nixos-containers/reverse-proxy.nix

@@ -2,6 +2,7 @@
   pkgs,
   lib,
   configVars,
+  inputs,
   ...
 }: let
   containerName = "reverse-proxy";
@@ -10,6 +11,7 @@
   gatewayIp = configVars.networking.addresses.gateway.ip;
   pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
 
+  sops-nix = inputs.sops-nix;
   dockerContainerIp = configVars.networking.addresses.docker.ip;
   bdWorker = configVars.networking.addresses.bd-worker.ip;
   pihole = configVars.networking.addresses.pihole.ip;
@@ -33,13 +35,40 @@ in {
     privateNetwork = true;
     hostBridge = "br0";
     nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+    };
 
     config = {
       pkgs,
       lib,
       config,
       ...
-    }: {
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+      };
+
+      sops.secrets = {
+        "ssl_keys/lan-selfsigned.crt" = {
+           mode = "0644";
+        };
+        "ssl_keys/lan-selfsigned.key" = {
+           mode = "0644";
+        };
+      };
+
       networking = {
         defaultGateway = "${gatewayIp}";
         interfaces.eth0.ipv4.addresses = [
@@ -52,6 +81,7 @@ in {
           enable = true;
           allowedTCPPorts = [
             80
+            443
           ];
         };
         useHostResolvConf = lib.mkForce false;
@@ -60,6 +90,7 @@ in {
       services.resolved.enable = true;
 
       imports = [
+        sops-nix.nixosModules.sops
       ];
 
       environment.systemPackages = [
@@ -72,27 +103,51 @@ in {
         enable = true;
         virtualHosts = {
           "jellyfin.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${dockerContainerIp}:8096";
           };
           "mempool.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${bitcoinNode}:4080";
+            extraConfig = ''
+              proxy_set_header Host mempool.lan;
+            '';
           };
           "grafana.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${metricsServer}:2342";
             extraConfig = ''
               proxy_set_header Host grafana.lan;
             '';
           };
           "metrics.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${metricsServer}:9001";
           };
           "searx.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${dockerContainerIp}:8855";
           };
           "dns.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${pihole}:80";
           };
           "prefect.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${bdWorker}:4200";
           };
         };

hosts/common/optional/nixos-containers/semitamaps-worker.nix

@@ -101,7 +101,7 @@ in {
       imports = [
         sops-nix.nixosModules.sops
         arion.nixosModules.arion
-        ../arion-containers/semitamaps-tileserver.nix
+        ../docker-containers/semitamaps-tileserver.nix
       ];
 
       environment.systemPackages = [

hosts/common/optional/nixos-containers/semitamaps.nix

@@ -0,0 +1,125 @@
+{
+  pkgs,
+  lib,
+  configVars,
+  ...
+}: let
+  containerName = "semitamaps";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.semitamaps.hostAddress;
+  localAddress = configVars.networking.addresses.semitamaps.localAddress;
+  workingDirectory = "/var/www/semitamaps";
+in {
+  systemd.tmpfiles.rules = [
+    "d /var/run/sockets 0660 www-data www-data -"
+  ];
+
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+      "/var/run/sockets" = {
+        hostPath = "/var/run/sockets";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      networking = {
+        firewall = {
+          enable = true;
+          rejectPackets = true;
+          allowedTCPPorts = [
+            80
+            443
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${workingDirectory} 0750 www-data www-data"
+        "d ${workingDirectory}/.venv 0750 www-data www-data"
+        "d ${workingDirectory}/public/uploads 0775 www-data www-data"
+      ];
+
+      services.resolved.enable = true;
+
+      imports = [
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+      ];
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      systemd.services.semitamaps = {
+        wantedBy = ["multi-user.target"];
+        after = ["network.target"];
+        description = "Deploys and serves semitamaps";
+        environment = {
+        };
+        serviceConfig = {
+          WorkingDirectory = "${workingDirectory}";
+          ExecStartPre = pkgs.writeShellScript "semitamaps-prestart" ''
+            set -e
+
+            GITCMD="${pkgs.openssh}/bin/ssh -i /etc/ssh/ssh_host_ed25519_key"
+            if [ ! -d ${workingDirectory}/.git ]; then
+              export GIT_SSH_COMMAND=$GITCMD
+              ${pkgs.git}/bin/git clone git@git.bitlab21.com:sam/semitamaps.com.git ${workingDirectory}
+            fi
+            ${pkgs.poetry}/bin/poetry install
+          '';
+          ExecStart = pkgs.writeShellScript "semitamaps-start" ''
+            .venv/bin/python .venv/bin/uvicorn --workers 4 --uds /var/run/sockets/semitamaps.sock app:app
+          '';
+          Restart = "on-failure";
+        };
+      };
+
+      programs.ssh.knownHosts = {
+        "git.bitlab21.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALNd2BGf64heYjWT9yt0fVmngepiHRIMsL7au/MRteg";
+      };
+
+      users.users = {
+        root = {
+          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/optional/nixos-containers/vaultwarden.nix

@@ -0,0 +1,110 @@
+{
+  pkgs,
+  lib,
+  configVars,
+  inputs,
+  ...
+}: let
+  containerName = "vaultwarden";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.vaultwarden.hostAddress;
+  localAddress = configVars.networking.addresses.vaultwarden.localAddress;
+  vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
+  cloudnixIp = configVars.networking.addresses.cloudnix.ip;
+  sops-nix = inputs.sops-nix;
+in {
+
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      
+      networking = {
+        defaultGateway = cloudnixIp;
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            vaultwardenPort
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+      };
+
+      imports = [
+        sops-nix.nixosModules.sops
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+        pkgs.lsof
+      ];
+
+      services.vaultwarden = {
+        enable = true;
+        dbBackend = "sqlite";
+        config = {
+          ROCKET_ADDRESS = "0.0.0.0";
+          ROCKET_PORT = vaultwardenPort;
+          ROCKET_LOG = "critical";
+        };
+      };
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users = {
+        root = {
+          openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/optional/nixos-containers/xmpp.nix

@@ -0,0 +1,277 @@
+{
+  pkgs,
+  lib,
+  configVars,
+  inputs,
+  ...
+}: let
+  containerName = "xmpp";
+  xmppDomain = configVars.domains.xmpp;
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  hostAddress = configVars.networking.addresses.xmpp.hostAddress;
+  externalIp = configVars.networking.addresses.cloudnix.ip;
+  localAddress = configVars.networking.addresses.xmpp.localAddress;
+  sops-nix = inputs.sops-nix;
+  xmppPorts = configVars.networking.addresses.xmpp.ports;
+  xmppUDPPorts =
+    [
+      xmppPorts.coturn
+      xmppPorts.coturn-tls
+    ]
+    ++ lib.range xmppPorts.coturn-min-udp xmppPorts.coturn-max-udp;
+  xmppTCPPorts = [
+    xmppPorts.coturn
+    xmppPorts.coturn-tls
+    xmppPorts.xmpp-https
+    xmppPorts.xmpp-http
+    xmppPorts.xmpp-s2s
+    xmppPorts.xmpp-c2s
+    xmppPorts.xmpp-c2s-legacy-tls
+    xmppPorts.xmpp-s2s-tls
+  ];
+in {
+  networking = {
+    nat = {
+      enable = true;
+      internalInterfaces = ["ve-+"];
+      externalInterface = "enp1s0";
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = xmppTCPPorts;
+      allowedUDPPorts = xmppUDPPorts;
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/prosody 0750"
+  ];
+
+  containers."${containerName}" = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = localAddress;
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+      "/var/lib/prosody" = {
+        hostPath = "/var/lib/prosody";
+        isReadOnly = false;
+      };
+      "/var/lib/acme/${xmppDomain}/" = {
+        hostPath = "/var/lib/acme/${xmppDomain}/";
+        isReadOnly = false;
+      };
+    };
+    forwardPorts =
+      lib.map (port: {
+        protocol = "tcp";
+        containerPort = port;
+        hostPort = port;
+      })
+      xmppTCPPorts
+      ++ lib.map (port: {
+        protocol = "udp";
+        containerPort = port;
+        hostPort = port;
+      })
+      xmppUDPPorts;
+    config = {
+      pkgs,
+      lib,
+      config,
+      ...
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      users.groups.www-data = {
+        gid = 33;
+      };
+
+      users.users.prosody = {
+        isSystemUser = true;
+        uid = 149;
+        extraGroups = ["www-data"];
+      };
+
+      users.users.turnserver = {
+        isSystemUser = true;
+        uid = 249;
+        extraGroups = ["www-data"];
+      };
+
+      networking = {
+        firewall = {
+          enable = true;
+          rejectPackets = true;
+          allowedTCPPorts = xmppTCPPorts ++ [80 443];
+          allowedUDPPorts = xmppUDPPorts;
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+        secrets = {
+          "software/coturn/static-auth-secret" = {
+            mode = "0644";
+          };
+        };
+      };
+
+      imports = [
+        sops-nix.nixosModules.sops
+      ];
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+        pkgs.prosody
+        pkgs.coturn
+      ];
+
+      sops.templates."prosody_secrets.lua" = {
+        mode = "444";
+        content = ''
+          turn_external_secret = "${config.sops.placeholder."software/coturn/static-auth-secret"}";
+        '';
+      };
+
+      services.prosody = {
+        enable = true;
+        package = pkgs.prosody.override {
+          withCommunityModules = [
+            "turn_external"
+            "conversejs"
+            "admin_web"
+            "external_services"
+            "http_altconnect"
+          ];
+        };
+        extraModules = [
+          "server_contact_info"
+          "http_file_share"
+          "external_services"
+          "turn_external"
+          "conversejs"
+          "admin_web"
+          "http"
+          "websocket"
+          "http_altconnect"
+        ];
+        allowRegistration = true;
+        extraConfig = ''
+          Include "${config.sops.templates."prosody_secrets.lua".path}"
+          registration_invite_only = true;
+          allow_user_invites = true;
+          cross_domain_bosh = true;
+          cross_domain_websocket = true;
+          turn_external_host = "turn.${xmppDomain}";
+          turn_external_port = ${toString xmppPorts.coturn};
+          http_default_host = "${xmppDomain}";
+          certificates = "certs"
+          consider_websocket_secure = true
+          external_services = {
+                {
+                  port="${toString xmppPorts.coturn}";
+                  transport="tcp";
+                  type="stun";
+                  host="turn.${xmppDomain}"
+                };
+                {
+                  port="${toString xmppPorts.coturn}";
+                  transport="udp";
+                  type="turn";
+                  host="turn.${xmppDomain}"
+                };
+          }
+          s2s_direct_tls_ports = { ${toString xmppPorts.xmpp-s2s-tls} }
+          legacy_ssl_ports = { ${toString xmppPorts.xmpp-c2s-legacy-tls} }
+          legacy_ssl_ssl = {
+            certificate = "/var/lib/acme/${xmppDomain}/cert.pem";
+            key = "/var/lib/acme/${xmppDomain}/key.pem";
+          }
+          contact_info = {
+            admin = { "mailto:admin@${xmppDomain}", "xmpp:admin@${xmppDomain}" };
+          }
+        '';
+        modules.bosh = true;
+        s2sRequireEncryption = true;
+        c2sRequireEncryption = true;
+        s2sSecureAuth = false;
+        admins = ["root@${xmppDomain}"];
+        ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
+        ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
+        httpFileShare.domain = "upload.${xmppDomain}";
+        virtualHosts."${xmppDomain}" = {
+          enabled = true;
+          ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
+          ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
+          extraConfig = ''
+            http_external_url = "https://chat.${xmppDomain}/"
+            invites_page = "https://chat.${xmppDomain}/register?t={invite.token}"
+            http_paths = {
+              invites_page = "/invite";
+              invites_register_web = "/register";
+            }
+            disco_items = {
+              { "upload.${xmppDomain}.com" },
+              { "rooms.${xmppDomain}.com" },
+              { "turn.${xmppDomain}.com" },
+            }
+
+          '';
+          domain = "${xmppDomain}";
+        };
+        muc = [
+          {
+            domain = "conference.${xmppDomain}";
+          }
+        ];
+        uploadHttp = {
+          domain = "https://upload.${xmppDomain}";
+          uploadFileSizeLimit = "1000000000"; # 1 gb file-size limit
+          uploadExpireAfter = "31557600"; # files deleted after 1 year
+        };
+      };
+
+      services.coturn = {
+        enable = true;
+        realm = "turn.${xmppDomain}";
+        use-auth-secret = true;
+        static-auth-secret-file = config.sops.secrets."software/coturn/static-auth-secret".path;
+        tls-listening-port = xmppPorts.coturn-tls;
+        cert = "/var/lib/acme/${xmppDomain}/cert.pem";
+        pkey = "/var/lib/acme/${xmppDomain}/key.pem";
+        min-port = xmppPorts.coturn-min-udp;
+        max-port = xmppPorts.coturn-max-udp;
+        extraConfig = ''
+          external-ip = ${externalIp}/${localAddress}
+          log = /var/log/turnserver.log
+          verbose
+        '';
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/iso/default.nix

@@ -3,7 +3,7 @@ in {
   imports = [(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")];
   environment.systemPackages = [ 
     pkgs.openssl 
-    pkgs.nvim
+    pkgs.ccrypt
   ];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

vars/default.nix

@@ -4,6 +4,8 @@
     networking
     email
     metrics-server
+    xmpp
+    domains
     ;
   locations = {
     mediaDataMountPoint = "/media/media";