sam/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'cloudnix'

Browse source
This commit is contained in:
Sam 2025-02-14 19:15:28 +00:00
commit 59bbcecc76
28 changed files with 1028 additions and 145 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
flake.lock generated
View file

@ -539,11 +539,11 @@
},
"nix-secrets": {
"locked": {
"lastModified": 1737899664,
"narHash": "sha256-iZpzTSERNQ5UvFfEzrBLuEmcRUGjBSal7ShtXurYq8Q=",
"lastModified": 1739387047,
"narHash": "sha256-KpogJP00vwuMIKkGJff3zp0YfV9GfOG//UzMK4nWWUw=",
"ref": "refs/heads/master",
"rev": "a9844a78dcbdc8a84679835112970d80822b113c",
"revCount": 257,
"rev": "be51e237b5b3d441a194f3e516175f6a543aee35",
"revCount": 280,
"type": "git",
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
},

1
home/common/optional/desktop/common/default.nix
View file

@ -29,5 +29,6 @@
pkgs.R
pkgs.gimp
pkgs.gajim
pkgs.vlc
];
}

30
hosts/cloudnix/default.nix
View file

@ -30,10 +30,30 @@ in {
../common/optional/openssh.nix
../common/optional/distributed-builds/local-machine.nix
../common/optional/nixos-containers/semitamaps.nix
../common/optional/nixos-containers/vaultwarden.nix
../common/optional/nixos-containers/xmpp.nix
../common/optional/fail2ban.nix
../common/optional/restic-backup.nix
../common/optional/nginx/vaultwarden.nix
../common/optional/nginx/xmpp.nix
outputs.nixosModules.nixosAutoUpgrade
];
services.restic.backups = {
daily = {
paths = [
"/persist/"
];
exclude = [
];
};
};
boot = {
loader = {
efi.canTouchEfiVariables = false;
@ -62,6 +82,16 @@ in {
user = "admin";
};
environment.persistence."/persist" = {
directories = [
"/var/lib/tailscale"
];
files = [ "/etc/machine-id" ];
};
# enable tailscale
services.tailscale.enable = true;
networking = {
hostName = "cloudnix";
nameservers = ["8.8.8.8"];

32
hosts/common/optional/arion-containers/jellyfin.nix
View file

@ -1,32 +0,0 @@
{
virtualisation.arion = {
backend = "podman-socket";
projects.jellyfin = {
settings = {
services.jellyfin.service = {
ports = [
"8096:8096"
];
container_name = "jellyfin";
image = "lscr.io/linuxserver/jellyfin:latest";
restart = "always";
volumes = [
"/srv/docker/media-server/jellyfin/config:/config"
"/media/media/tv:/data/tvshows:ro"
"/media/media/movies:/data/movies:ro"
"/media/media/music/music_data:/data/music:ro"
"/media/media/youtube:/data/youtube:ro"
"/media/media/podcasts:/data/podcasts:ro"
"/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
];
environment = {
PUID = "1000";
PGID = "1000";
DOCKER_MODS="linuxserver/mods:jellyfin-opencl-intel";
};
devices = ["/dev/dri:/dev/dri"];
};
};
};
};
}

31
hosts/common/optional/arion-containers/semitamaps-tileserver.nix
View file

@ -1,31 +0,0 @@
{
virtualisation.arion = {
backend = "podman-socket";
projects.semitamaps-tileserver = {
settings = {
services.tileserver-gl.service = {
ports = [
"8080:8080"
];
container_name = "tileserver-gl";
image = "maptiler/tileserver-gl";
restart = "always";
volumes = [
"/data/semitamaps-data/tileserver-gl/data:/data"
];
command = "-c /data/config.json --public_url https://tiles.semitamaps.com/";
};
services.mbgl-renderer.service = {
ports = [
"8081:80"
];
container_name = "mbgl-renderer";
image = "mbgl-renderer";
restart = "always";
};
};
};
};
}

0
hosts/common/optional/arion-containers/arrstack.nix → hosts/common/optional/docker-containers/arrstack.nix
View file

17
hosts/common/optional/docker-containers/baikal.nix Normal file
View file

@ -0,0 +1,17 @@
{
config.virtualisation.oci-containers = {
backend = "podman";
containers = {
baikal = {
image = "ckulka/baikal:nginx";
ports = [
"6734:80"
];
volumes = [
"/srv/docker/baikal/config:/var/www/baikal/config"
"/srv/docker/baikal/data:/var/www/baikal/Specific"
];
};
};
};
}

31
hosts/common/optional/docker-containers/jellyfin.nix Normal file
View file

@ -0,0 +1,31 @@
{
config.virtualisation.oci-containers = {
backend = "podman";
containers = {
jellyfin = {
image = "lscr.io/linuxserver/jellyfin:latest";
ports = [
"8096:8096"
];
volumes = [
"/srv/docker/media-server/jellyfin/config:/config"
"/media/media/tv:/data/tvshows:ro"
"/media/media/movies:/data/movies:ro"
"/media/media/music/music_data:/data/music:ro"
"/media/media/youtube:/data/youtube:ro"
"/media/media/podcasts:/data/podcasts:ro"
"/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
];
environment = {
PUID = "1000";
PGID = "1000";
DOCKER_MODS = "linuxserver/mods:jellyfin-opencl-intel";
NVIDIA_VISIBLE_DEVICES = "all";
};
extraOptions = [
"--device=nvidia.com/gpu=all"
];
};
};
};
}

0
hosts/common/optional/arion-containers/photoprism.nix → hosts/common/optional/docker-containers/photoprism.nix
View file

0
hosts/common/optional/arion-containers/pihole.nix → hosts/common/optional/docker-containers/pihole.nix
View file

0
hosts/common/optional/arion-containers/searxng.nix → hosts/common/optional/docker-containers/searxng.nix
View file

25
hosts/common/optional/docker-containers/semitamaps-tileserver.nix Normal file
View file

@ -0,0 +1,25 @@
{
config.virtualisation.oci-containers = {
backend = "podman";
containers = {
tileserver-gl = {
image = "maptiler/tileserver-gl";
ports = [
"8080:8080"
];
volumes = [
"/data/semitamaps-data/tileserver-gl/data:/data"
];
};
mbgl-renderer = {
image = "mbgl-renderer";
ports = [
"8081:80"
];
volumes = [
"/data/semitamaps-data/tileserver-gl/data:/data"
];
};
};
};
}

0
hosts/common/optional/arion-containers/syncthing.nix → hosts/common/optional/docker-containers/syncthing.nix
View file

34
hosts/common/optional/fail2ban.nix Normal file
View file

@ -0,0 +1,34 @@
{pkgs, ...}: {
environment.systemPackages = [pkgs.fail2ban];
environment.etc = {
"fail2ban/filter.d/nginx-bruteforce.conf".text = ''
[Definition]
failregex = ^<HOST>.*(GET|POST).* (404|444|403|400) .*$
'';
};
services.fail2ban = {
enable = true;
maxretry = 5;
ignoreIP = [
];
bantime-increment = {
enable = true;
multipliers = "1 2 4 8 16 32 64";
maxtime = "168h";
};
jails = {
nginx-spam.settings = {
filter = "nginx-bruteforce";
action = "iptables-allports";
logpath = "/var/log/nginx/access.log";
backend = "auto";
findtime = 600;
bantime = 600;
maxretry = 10;
};
};
};
}

20
hosts/common/optional/nginx/semitamaps.nix Normal file
View file

@ -0,0 +1,20 @@
{configVars, ...}: let
email = configVars.email.user;
domain = configVars.domains.xmpp;
in {
security.acme = {
acceptTerms = true;
defaults.email = email;
};
networking.firewall.allowedTCPPorts = [80 443];
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."${domain}" = {
enableACME = true;
forceSSL = true;
root = "/srv/hello/";
};
};
}

24
hosts/common/optional/nginx/vaultwarden.nix Normal file
View file

@ -0,0 +1,24 @@
{configVars, ...}: let
email = configVars.email.user;
domain = configVars.domains.vaultwarden;
vaultwardenIp = configVars.networking.addresses.vaultwarden.localAddress;
vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
in {
networking.firewall.allowedTCPPorts = [80 443];
security.acme = {
acceptTerms = true;
defaults.email = email;
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."${domain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://${vaultwardenIp}:${toString vaultwardenPort}";
};
};
};
}

92
hosts/common/optional/nginx/xmpp.nix Normal file
View file

@ -0,0 +1,92 @@
{configVars, ...}: let
email = configVars.email.user;
xmppDomain = configVars.domains.xmpp;
xmppIp = configVars.networking.addresses.xmpp.localAddress;
xmppPort = configVars.networking.addresses.xmpp.ports.xmpp-http;
in {
networking.firewall.allowedTCPPorts = [80 443];
users.groups.www-data = {
gid = 33;
};
users.users.nginx = {
isSystemUser = true;
uid = 60;
extraGroups = ["www-data"];
};
systemd.tmpfiles.rules = [
"d /var/www/${xmppDomain} 0777 root root"
];
services.httpd.virtualHosts."root" = {
hostName = "${xmppDomain}";
documentRoot = "/var/www/${xmppDomain}";
};
security.acme = {
acceptTerms = true;
defaults.email = email;
certs = {
"${xmppDomain}" = {
webroot = "/var/www/${xmppDomain}";
email = email;
extraDomainNames = [
"chat.${xmppDomain}"
];
group = "www-data";
};
};
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."chat.${xmppDomain}" = {
# enableACME = true;
forceSSL = true;
extraConfig = ''
client_max_body_size 10G;
'';
sslCertificate = "/var/lib/acme/${xmppDomain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${xmppDomain}/key.pem";
locations = {
"/" = {
proxyPass = "http://${xmppIp}:${toString xmppPort}";
extraConfig = ''
proxy_set_header Host "${xmppDomain}";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering off;
tcp_nodelay on;
'';
};
"/xmpp-websocket" = {
proxyPass = "http://${xmppIp}:${toString xmppPort}/xmpp-websocket";
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Connection "Upgrade";
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host "${xmppDomain}";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900s;
'';
};
"/upload/" = {
extraConfig = ''
proxy_buffering off;
proxy_set_header Host $host;
# pass PUT requests to mod_http_upload for processing
if ($request_method = PUT) {
proxy_pass http://${xmppIp}:${toString xmppPort};
}
alias /var/lib/prosody/http_upload; # storage path of mod_http_upload. NGINX will serve these files to the clients.
'';
};
};
};
};
}

27
hosts/common/optional/nixos-containers/docker.nix
View file

@ -53,6 +53,10 @@ in {
node = "/dev/nvidiactl";
modifier = "rwm";
}
{
node = "/dev/nvidia-uvm";
modifier = "rwm";
}
{
node = "/dev/fuse";
modifier = "rwm";
@ -174,11 +178,12 @@ in {
imports = [
arion.nixosModules.arion
sops-nix.nixosModules.sops
../arion-containers/arrstack.nix
../arion-containers/jellyfin.nix
../arion-containers/photoprism.nix
../arion-containers/syncthing.nix
(import ../arion-containers/searxng.nix {configVars = configVars;})
../docker-containers/arrstack.nix
../docker-containers/jellyfin.nix
../docker-containers/photoprism.nix
../docker-containers/syncthing.nix
../docker-containers/baikal.nix
(import ../docker-containers/searxng.nix {configVars = configVars;})
];
environment.systemPackages = [
@ -204,18 +209,6 @@ in {
networking.firewall.interfaces."podman+".allowedUDPPorts = [53];
systemd.services.podman-autostart = {
enable = true;
after = ["podman.service"];
wantedBy = ["multi-user.target"];
description = "Automatically start containers with --restart=always tag";
serviceConfig = {
Type = "idle";
ExecStartPre = ''${pkgs.coreutils}/bin/sleep 1'';
ExecStart = ''/run/current-system/sw/bin/podman start --all --filter restart-policy=always'';
};
};
services.prometheus = {
exporters = {
node = {

125
hosts/common/optional/nixos-containers/metrics-server.nix
View file

@ -2,11 +2,15 @@
pkgs,
lib,
configVars,
inputs,
...
}: let
containerName = "metrics-server";
containerIp = configVars.networking.addresses.metrics-server.ip;
notifybotJid = configVars.xmpp.notifybotJid;
receiverJid = configVars.xmpp.personalAccount;
dockerContainerIp = configVars.networking.addresses.docker.ip;
smWorkerIp = configVars.networking.addresses.sm-worker.ip;
merlinIp = configVars.networking.addresses.merlin.ip;
@ -15,6 +19,7 @@
bitcoinNode = configVars.networking.addresses.bitcoin-node.ip;
postres = configVars.networking.addresses.postgres.ip;
backupServer = configVars.networking.addresses.backup-server.ip;
sops-nix = inputs.sops-nix;
http_endpoints = configVars.metrics-server.blackbox.http_endpoints;
@ -52,6 +57,10 @@ in {
hostPath = metricsServerContainerData;
isReadOnly = false;
};
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
};
config = {
@ -59,7 +68,10 @@ in {
lib,
config,
...
}: {
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
networking = {
defaultGateway = "${gatewayIp}";
interfaces.eth0.ipv4.addresses = [
@ -74,14 +86,32 @@ in {
config.services.prometheus.port
config.services.grafana.port
config.services.prometheus.exporters.blackbox.port
9199 #xmpp listen port
];
};
useHostResolvConf = lib.mkForce false;
};
sops = {
defaultSopsFile = "${secretsFile}";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
};
secrets = {
"software/restic-passphrase" = {};
"software/restic-exporter-credentials" = {};
"comms/xmpp/notifybot/password" = {
mode = "0644";
};
};
};
services.resolved.enable = true;
imports = [
sops-nix.nixosModules.sops
];
environment.systemPackages = [
@ -89,9 +119,49 @@ in {
pkgs.git
];
services.grafana = {
enable = true;
settings.server = {
http_port = 2342;
http_addr = "0.0.0.0";
};
};
# main prometheus service
services.prometheus = {
enable = true;
webExternalUrl = "http://${containerIp}:9001";
port = 9001;
alertmanagers = [
{
scheme = "http";
path_prefix = "/";
static_configs = [
{
targets = [
"0.0.0.0:9093"
];
}
];
}
];
ruleFiles = [
"${pkgs.writeText
"alert_rule.yml"
''
groups:
- name: blackbox_alert
rules:
- alert: EndpointDown
expr: probe_success{job="blackbox"} == 0
for: 1m
labels:
severity: critical
annotations:
summary: "Endpoint {{ $labels.instance }} down"
description: "An endpoint has been down for more than 1 minute."
''}"
];
scrapeConfigs = [
{
job_name = "node_exporter";
@ -110,6 +180,16 @@ in {
}
];
}
{
job_name = "restic-exporter";
static_configs = [
{
targets = [
"0.0.0.0:8001"
];
}
];
}
{
job_name = "blackbox";
@ -138,16 +218,40 @@ in {
];
};
services.grafana = {
# setup alertmanager
services.prometheus.xmpp-alerts = {
enable = true;
settings.server = {
http_port = 2342;
http_addr = "0.0.0.0";
settings = {
jid = notifybotJid;
password_command = "cat ${config.sops.secrets."comms/xmpp/notifybot/password".path}";
to_jid = receiverJid;
listen_address = "0.0.0.0";
listen_port = 9199;
};
};
services.prometheus.alertmanager = {
webExternalUrl = "http://${containerIp}:9093";
enable = true;
openFirewall = true;
port = 9093;
configText = ''
global:
resolve_timeout: 1m
route:
group_by: ['...']
repeat_interval: 1h
receiver: 'xmpp-alerts'
receivers:
- name: 'xmpp-alerts'
webhook_configs:
- url: 'http://0.0.0.0:9199/alert'
'';
};
services.prometheus = {
exporters = {
# prometheus exporters
services.prometheus.exporters = {
blackbox = {
enable = true;
configFile = pkgs.writeText "blackbox-conf.yaml" ''
@ -175,6 +279,13 @@ in {
enabledCollectors = ["systemd"];
port = 9002;
};
restic = {
enable = true;
repository = "";
environmentFile = config.sops.secrets."software/restic-exporter-credentials".path;
passwordFile = config.sops.secrets."software/restic-passphrase".path;
refreshInterval = 10800; # refresh every 3 hours
port = 8001;
};
};

47
hosts/common/optional/nixos-containers/nix-bitcoin.nix
View file

@ -62,7 +62,7 @@ in {
}: {
imports = [
inputs.nix-bitcoin.nixosModules.default
inputs.lnbits.nixosModules.default
# inputs.lnbits.nixosModules.default
];
environment.systemPackages = with pkgs; [
vim
@ -80,14 +80,13 @@ in {
firewall = {
enable = true;
allowedTCPPorts = [
80
443
22
# 80
# 443
config.containers.bitcoin-node.config.services.bitcoind.rpc.port
config.containers.bitcoin-node.config.services.mempool.frontend.port
config.containers.bitcoin-node.config.services.electrs.port
config.containers.bitcoin-node.config.services.rtl.port
config.containers.bitcoin-node.config.services.lnd.port
# config.containers.bitcoin-node.config.services.rtl.port
# config.containers.bitcoin-node.config.services.lnd.port
];
};
useHostResolvConf = lib.mkForce false;
@ -144,7 +143,7 @@ in {
};
};
lnd = {
enable = true;
enable = false;
lndconnect = {
enable = true;
onion = true;
@ -156,34 +155,34 @@ in {
'';
};
rtl = {
enable = true;
enable = false;
nodes.lnd.enable = true;
address = "0.0.0.0";
};
lnbits = {
enable = true;
openFirewall = true;
host = "0.0.0.0";
port = 8231;
env = {
LNBITS_ADMIN_UI = "true";
LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
LND_REST_ENDPOINT = "https://127.0.0.1:8080";
LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
AUTH_ALLOWED_METHODS = "user-id-only, username-password";
};
};
# lnbits = {
# enable = false;
# openFirewall = true;
# host = "0.0.0.0";
# port = 8231;
# env = {
# LNBITS_ADMIN_UI = "true";
# LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
# LND_REST_ENDPOINT = "https://127.0.0.1:8080";
# LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
# LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
# AUTH_ALLOWED_METHODS = "user-id-only, username-password";
# };
# };
};
# Add custom systemd overrides for above services
systemd.services.lnbits.after = ["lnd.service"];
# systemd.services.lnbits.after = ["lnd.service"];
nix-bitcoin.onionServices = {
bitcoind.enable = true;
electrs.enable = true;
mempool-frontend.enable = true;
lnd.public = true;
# lnd.public = true;
};
services.prometheus = {

2
hosts/common/optional/nixos-containers/pihole.nix
View file

@ -72,7 +72,7 @@ in {
imports = [
arion.nixosModules.arion
../arion-containers/pihole.nix
../docker-containers/pihole.nix
];
environment.systemPackages = [

57
hosts/common/optional/nixos-containers/reverse-proxy.nix
View file

@ -2,6 +2,7 @@
pkgs,
lib,
configVars,
inputs,
...
}: let
containerName = "reverse-proxy";
@ -10,6 +11,7 @@
gatewayIp = configVars.networking.addresses.gateway.ip;
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
sops-nix = inputs.sops-nix;
dockerContainerIp = configVars.networking.addresses.docker.ip;
bdWorker = configVars.networking.addresses.bd-worker.ip;
pihole = configVars.networking.addresses.pihole.ip;
@ -33,13 +35,40 @@ in {
privateNetwork = true;
hostBridge = "br0";
nixpkgs = pkgs.path;
bindMounts = {
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
};
config = {
pkgs,
lib,
config,
...
}: {
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
sops = {
defaultSopsFile = "${secretsFile}";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
};
};
sops.secrets = {
"ssl_keys/lan-selfsigned.crt" = {
mode = "0644";
};
"ssl_keys/lan-selfsigned.key" = {
mode = "0644";
};
};
networking = {
defaultGateway = "${gatewayIp}";
interfaces.eth0.ipv4.addresses = [
@ -52,6 +81,7 @@ in {
enable = true;
allowedTCPPorts = [
80
443
];
};
useHostResolvConf = lib.mkForce false;
@ -60,6 +90,7 @@ in {
services.resolved.enable = true;
imports = [
sops-nix.nixosModules.sops
];
environment.systemPackages = [
@ -72,27 +103,51 @@ in {
enable = true;
virtualHosts = {
"jellyfin.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${dockerContainerIp}:8096";
};
"mempool.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${bitcoinNode}:4080";
extraConfig = ''
proxy_set_header Host mempool.lan;
'';
};
"grafana.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${metricsServer}:2342";
extraConfig = ''
proxy_set_header Host grafana.lan;
'';
};
"metrics.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${metricsServer}:9001";
};
"searx.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${dockerContainerIp}:8855";
};
"dns.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${pihole}:80";
};
"prefect.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${bdWorker}:4200";
};
};

2
hosts/common/optional/nixos-containers/semitamaps-worker.nix
View file

@ -101,7 +101,7 @@ in {
imports = [
sops-nix.nixosModules.sops
arion.nixosModules.arion
../arion-containers/semitamaps-tileserver.nix
../docker-containers/semitamaps-tileserver.nix
];
environment.systemPackages = [

125
hosts/common/optional/nixos-containers/semitamaps.nix Normal file
View file

@ -0,0 +1,125 @@
{
pkgs,
lib,
configVars,
...
}: let
containerName = "semitamaps";
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
hostAddress = configVars.networking.addresses.semitamaps.hostAddress;
localAddress = configVars.networking.addresses.semitamaps.localAddress;
workingDirectory = "/var/www/semitamaps";
in {
systemd.tmpfiles.rules = [
"d /var/run/sockets 0660 www-data www-data -"
];
networking = {
nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "enp1s0";
};
};
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/var/lib/nixos-containers/${containerName}"
];
};
containers."${containerName}" = {
autoStart = true;
privateNetwork = true;
hostAddress = hostAddress;
localAddress = localAddress;
nixpkgs = pkgs.path;
bindMounts = {
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
"/var/run/sockets" = {
hostPath = "/var/run/sockets";
isReadOnly = false;
};
};
config = {
pkgs,
lib,
...
}: {
networking = {
firewall = {
enable = true;
rejectPackets = true;
allowedTCPPorts = [
80
443
];
};
useHostResolvConf = lib.mkForce false;
};
systemd.tmpfiles.rules = [
"d ${workingDirectory} 0750 www-data www-data"
"d ${workingDirectory}/.venv 0750 www-data www-data"
"d ${workingDirectory}/public/uploads 0775 www-data www-data"
];
services.resolved.enable = true;
imports = [
];
environment.systemPackages = [
pkgs.vim
pkgs.git
];
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
systemd.services.semitamaps = {
wantedBy = ["multi-user.target"];
after = ["network.target"];
description = "Deploys and serves semitamaps";
environment = {
};
serviceConfig = {
WorkingDirectory = "${workingDirectory}";
ExecStartPre = pkgs.writeShellScript "semitamaps-prestart" ''
set -e
GITCMD="${pkgs.openssh}/bin/ssh -i /etc/ssh/ssh_host_ed25519_key"
if [ ! -d ${workingDirectory}/.git ]; then
export GIT_SSH_COMMAND=$GITCMD
${pkgs.git}/bin/git clone git@git.bitlab21.com:sam/semitamaps.com.git ${workingDirectory}
fi
${pkgs.poetry}/bin/poetry install
'';
ExecStart = pkgs.writeShellScript "semitamaps-start" ''
.venv/bin/python .venv/bin/uvicorn --workers 4 --uds /var/run/sockets/semitamaps.sock app:app
'';
Restart = "on-failure";
};
};
programs.ssh.knownHosts = {
"git.bitlab21.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALNd2BGf64heYjWT9yt0fVmngepiHRIMsL7au/MRteg";
};
users.users = {
root = {
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
};
};
system.stateVersion = "24.05";
};
};
}

110
hosts/common/optional/nixos-containers/vaultwarden.nix Normal file
View file

@ -0,0 +1,110 @@
{
pkgs,
lib,
configVars,
inputs,
...
}: let
containerName = "vaultwarden";
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
hostAddress = configVars.networking.addresses.vaultwarden.hostAddress;
localAddress = configVars.networking.addresses.vaultwarden.localAddress;
vaultwardenPort = configVars.networking.addresses.vaultwarden.port;
cloudnixIp = configVars.networking.addresses.cloudnix.ip;
sops-nix = inputs.sops-nix;
in {
networking = {
nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "enp1s0";
};
};
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/var/lib/nixos-containers/${containerName}"
];
};
containers."${containerName}" = {
autoStart = true;
privateNetwork = true;
hostAddress = hostAddress;
localAddress = localAddress;
nixpkgs = pkgs.path;
bindMounts = {
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
};
config = {
pkgs,
lib,
...
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
networking = {
defaultGateway = cloudnixIp;
firewall = {
enable = true;
allowedTCPPorts = [
vaultwardenPort
];
};
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
sops = {
defaultSopsFile = "${secretsFile}";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
};
};
imports = [
sops-nix.nixosModules.sops
];
environment.systemPackages = [
pkgs.vim
pkgs.git
pkgs.lsof
];
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = vaultwardenPort;
ROCKET_LOG = "critical";
};
};
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
users.users = {
root = {
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
};
};
system.stateVersion = "24.05";
};
};
}

277
hosts/common/optional/nixos-containers/xmpp.nix Normal file
View file

@ -0,0 +1,277 @@
{
pkgs,
lib,
configVars,
inputs,
...
}: let
containerName = "xmpp";
xmppDomain = configVars.domains.xmpp;
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
hostAddress = configVars.networking.addresses.xmpp.hostAddress;
externalIp = configVars.networking.addresses.cloudnix.ip;
localAddress = configVars.networking.addresses.xmpp.localAddress;
sops-nix = inputs.sops-nix;
xmppPorts = configVars.networking.addresses.xmpp.ports;
xmppUDPPorts =
[
xmppPorts.coturn
xmppPorts.coturn-tls
]
++ lib.range xmppPorts.coturn-min-udp xmppPorts.coturn-max-udp;
xmppTCPPorts = [
xmppPorts.coturn
xmppPorts.coturn-tls
xmppPorts.xmpp-https
xmppPorts.xmpp-http
xmppPorts.xmpp-s2s
xmppPorts.xmpp-c2s
xmppPorts.xmpp-c2s-legacy-tls
xmppPorts.xmpp-s2s-tls
];
in {
networking = {
nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "enp1s0";
};
firewall = {
enable = true;
allowedTCPPorts = xmppTCPPorts;
allowedUDPPorts = xmppUDPPorts;
};
};
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/var/lib/nixos-containers/${containerName}"
];
};
systemd.tmpfiles.rules = [
"d /var/lib/prosody 0750"
];
containers."${containerName}" = {
autoStart = true;
privateNetwork = true;
hostAddress = hostAddress;
localAddress = localAddress;
nixpkgs = pkgs.path;
bindMounts = {
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
"/var/lib/prosody" = {
hostPath = "/var/lib/prosody";
isReadOnly = false;
};
"/var/lib/acme/${xmppDomain}/" = {
hostPath = "/var/lib/acme/${xmppDomain}/";
isReadOnly = false;
};
};
forwardPorts =
lib.map (port: {
protocol = "tcp";
containerPort = port;
hostPort = port;
})
xmppTCPPorts
++ lib.map (port: {
protocol = "udp";
containerPort = port;
hostPort = port;
})
xmppUDPPorts;
config = {
pkgs,
lib,
config,
...
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
users.groups.www-data = {
gid = 33;
};
users.users.prosody = {
isSystemUser = true;
uid = 149;
extraGroups = ["www-data"];
};
users.users.turnserver = {
isSystemUser = true;
uid = 249;
extraGroups = ["www-data"];
};
networking = {
firewall = {
enable = true;
rejectPackets = true;
allowedTCPPorts = xmppTCPPorts ++ [80 443];
allowedUDPPorts = xmppUDPPorts;
};
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
sops = {
defaultSopsFile = "${secretsFile}";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
};
secrets = {
"software/coturn/static-auth-secret" = {
mode = "0644";
};
};
};
imports = [
sops-nix.nixosModules.sops
];
environment.systemPackages = [
pkgs.vim
pkgs.git
pkgs.prosody
pkgs.coturn
];
sops.templates."prosody_secrets.lua" = {
mode = "444";
content = ''
turn_external_secret = "${config.sops.placeholder."software/coturn/static-auth-secret"}";
'';
};
services.prosody = {
enable = true;
package = pkgs.prosody.override {
withCommunityModules = [
"turn_external"
"conversejs"
"admin_web"
"external_services"
"http_altconnect"
];
};
extraModules = [
"server_contact_info"
"http_file_share"
"external_services"
"turn_external"
"conversejs"
"admin_web"
"http"
"websocket"
"http_altconnect"
];
allowRegistration = true;
extraConfig = ''
Include "${config.sops.templates."prosody_secrets.lua".path}"
registration_invite_only = true;
allow_user_invites = true;
cross_domain_bosh = true;
cross_domain_websocket = true;
turn_external_host = "turn.${xmppDomain}";
turn_external_port = ${toString xmppPorts.coturn};
http_default_host = "${xmppDomain}";
certificates = "certs"
consider_websocket_secure = true
external_services = {
{
port="${toString xmppPorts.coturn}";
transport="tcp";
type="stun";
host="turn.${xmppDomain}"
};
{
port="${toString xmppPorts.coturn}";
transport="udp";
type="turn";
host="turn.${xmppDomain}"
};
}
s2s_direct_tls_ports = { ${toString xmppPorts.xmpp-s2s-tls} }
legacy_ssl_ports = { ${toString xmppPorts.xmpp-c2s-legacy-tls} }
legacy_ssl_ssl = {
certificate = "/var/lib/acme/${xmppDomain}/cert.pem";
key = "/var/lib/acme/${xmppDomain}/key.pem";
}
contact_info = {
admin = { "mailto:admin@${xmppDomain}", "xmpp:admin@${xmppDomain}" };
}
'';
modules.bosh = true;
s2sRequireEncryption = true;
c2sRequireEncryption = true;
s2sSecureAuth = false;
admins = ["root@${xmppDomain}"];
ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
httpFileShare.domain = "upload.${xmppDomain}";
virtualHosts."${xmppDomain}" = {
enabled = true;
ssl.cert = "/var/lib/acme/${xmppDomain}/fullchain.pem";
ssl.key = "/var/lib/acme/${xmppDomain}/key.pem";
extraConfig = ''
http_external_url = "https://chat.${xmppDomain}/"
invites_page = "https://chat.${xmppDomain}/register?t={invite.token}"
http_paths = {
invites_page = "/invite";
invites_register_web = "/register";
}
disco_items = {
{ "upload.${xmppDomain}.com" },
{ "rooms.${xmppDomain}.com" },
{ "turn.${xmppDomain}.com" },
}
'';
domain = "${xmppDomain}";
};
muc = [
{
domain = "conference.${xmppDomain}";
}
];
uploadHttp = {
domain = "https://upload.${xmppDomain}";
uploadFileSizeLimit = "1000000000"; # 1 gb file-size limit
uploadExpireAfter = "31557600"; # files deleted after 1 year
};
};
services.coturn = {
enable = true;
realm = "turn.${xmppDomain}";
use-auth-secret = true;
static-auth-secret-file = config.sops.secrets."software/coturn/static-auth-secret".path;
tls-listening-port = xmppPorts.coturn-tls;
cert = "/var/lib/acme/${xmppDomain}/cert.pem";
pkey = "/var/lib/acme/${xmppDomain}/key.pem";
min-port = xmppPorts.coturn-min-udp;
max-port = xmppPorts.coturn-max-udp;
extraConfig = ''
external-ip = ${externalIp}/${localAddress}
log = /var/log/turnserver.log
verbose
'';
};
system.stateVersion = "24.05";
};
};
}

2
hosts/iso/default.nix
View file

@ -3,7 +3,7 @@ in {
imports = [(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")];
environment.systemPackages = [
pkgs.openssl
pkgs.nvim
pkgs.ccrypt
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

2
vars/default.nix
View file

@ -4,6 +4,8 @@
networking
email
metrics-server
xmpp
domains
;
locations = {
mediaDataMountPoint = "/media/media";