sam/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'development'

Browse source
This commit is contained in:
Sam 2025-02-13 14:42:42 +00:00
commit ac6d5723c1
20 changed files with 312 additions and 141 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
home/common/optional/desktop/common/default.nix
View file

@ -29,5 +29,6 @@
pkgs.R
pkgs.gimp
pkgs.gajim
pkgs.vlc
];
}

32
hosts/common/optional/arion-containers/jellyfin.nix
View file

@ -1,32 +0,0 @@
{
virtualisation.arion = {
backend = "podman-socket";
projects.jellyfin = {
settings = {
services.jellyfin.service = {
ports = [
"8096:8096"
];
container_name = "jellyfin";
image = "lscr.io/linuxserver/jellyfin:latest";
restart = "always";
volumes = [
"/srv/docker/media-server/jellyfin/config:/config"
"/media/media/tv:/data/tvshows:ro"
"/media/media/movies:/data/movies:ro"
"/media/media/music/music_data:/data/music:ro"
"/media/media/youtube:/data/youtube:ro"
"/media/media/podcasts:/data/podcasts:ro"
"/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
];
environment = {
PUID = "1000";
PGID = "1000";
DOCKER_MODS="linuxserver/mods:jellyfin-opencl-intel";
};
devices = ["/dev/dri:/dev/dri"];
};
};
};
};
}

31
hosts/common/optional/arion-containers/semitamaps-tileserver.nix
View file

@ -1,31 +0,0 @@
{
virtualisation.arion = {
backend = "podman-socket";
projects.semitamaps-tileserver = {
settings = {
services.tileserver-gl.service = {
ports = [
"8080:8080"
];
container_name = "tileserver-gl";
image = "maptiler/tileserver-gl";
restart = "always";
volumes = [
"/data/semitamaps-data/tileserver-gl/data:/data"
];
command = "-c /data/config.json --public_url https://tiles.semitamaps.com/";
};
services.mbgl-renderer.service = {
ports = [
"8081:80"
];
container_name = "mbgl-renderer";
image = "mbgl-renderer";
restart = "always";
};
};
};
};
}

0
hosts/common/optional/arion-containers/arrstack.nix → hosts/common/optional/docker-containers/arrstack.nix
View file

17
hosts/common/optional/docker-containers/baikal.nix Normal file
View file

@ -0,0 +1,17 @@
{
config.virtualisation.oci-containers = {
backend = "podman";
containers = {
baikal = {
image = "ckulka/baikal:nginx";
ports = [
"6734:80"
];
volumes = [
"/srv/docker/baikal/config:/var/www/baikal/config"
"/srv/docker/baikal/data:/var/www/baikal/Specific"
];
};
};
};
}

31
hosts/common/optional/docker-containers/jellyfin.nix Normal file
View file

@ -0,0 +1,31 @@
{
config.virtualisation.oci-containers = {
backend = "podman";
containers = {
jellyfin = {
image = "lscr.io/linuxserver/jellyfin:latest";
ports = [
"8096:8096"
];
volumes = [
"/srv/docker/media-server/jellyfin/config:/config"
"/media/media/tv:/data/tvshows:ro"
"/media/media/movies:/data/movies:ro"
"/media/media/music/music_data:/data/music:ro"
"/media/media/youtube:/data/youtube:ro"
"/media/media/podcasts:/data/podcasts:ro"
"/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
];
environment = {
PUID = "1000";
PGID = "1000";
DOCKER_MODS = "linuxserver/mods:jellyfin-opencl-intel";
NVIDIA_VISIBLE_DEVICES = "all";
};
extraOptions = [
"--device=nvidia.com/gpu=all"
];
};
};
};
}

0
hosts/common/optional/arion-containers/photoprism.nix → hosts/common/optional/docker-containers/photoprism.nix
View file

0
hosts/common/optional/arion-containers/pihole.nix → hosts/common/optional/docker-containers/pihole.nix
View file

0
hosts/common/optional/arion-containers/searxng.nix → hosts/common/optional/docker-containers/searxng.nix
View file

25
hosts/common/optional/docker-containers/semitamaps-tileserver.nix Normal file
View file

@ -0,0 +1,25 @@
{
config.virtualisation.oci-containers = {
backend = "podman";
containers = {
tileserver-gl = {
image = "maptiler/tileserver-gl";
ports = [
"8080:8080"
];
volumes = [
"/data/semitamaps-data/tileserver-gl/data:/data"
];
};
mbgl-renderer = {
image = "mbgl-renderer";
ports = [
"8081:80"
];
volumes = [
"/data/semitamaps-data/tileserver-gl/data:/data"
];
};
};
};
}

0
hosts/common/optional/arion-containers/syncthing.nix → hosts/common/optional/docker-containers/syncthing.nix
View file

27
hosts/common/optional/nixos-containers/docker.nix
View file

@ -53,6 +53,10 @@ in {
node = "/dev/nvidiactl";
modifier = "rwm";
}
{
node = "/dev/nvidia-uvm";
modifier = "rwm";
}
{
node = "/dev/fuse";
modifier = "rwm";
@ -174,11 +178,12 @@ in {
imports = [
arion.nixosModules.arion
sops-nix.nixosModules.sops
../arion-containers/arrstack.nix
../arion-containers/jellyfin.nix
../arion-containers/photoprism.nix
../arion-containers/syncthing.nix
(import ../arion-containers/searxng.nix {configVars = configVars;})
../docker-containers/arrstack.nix
../docker-containers/jellyfin.nix
../docker-containers/photoprism.nix
../docker-containers/syncthing.nix
../docker-containers/baikal.nix
(import ../docker-containers/searxng.nix {configVars = configVars;})
];
environment.systemPackages = [
@ -204,18 +209,6 @@ in {
networking.firewall.interfaces."podman+".allowedUDPPorts = [53];
systemd.services.podman-autostart = {
enable = true;
after = ["podman.service"];
wantedBy = ["multi-user.target"];
description = "Automatically start containers with --restart=always tag";
serviceConfig = {
Type = "idle";
ExecStartPre = ''${pkgs.coreutils}/bin/sleep 1'';
ExecStart = ''/run/current-system/sw/bin/podman start --all --filter restart-policy=always'';
};
};
services.prometheus = {
exporters = {
node = {

177
hosts/common/optional/nixos-containers/metrics-server.nix
View file

@ -2,11 +2,15 @@
pkgs,
lib,
configVars,
inputs,
...
}: let
containerName = "metrics-server";
containerIp = configVars.networking.addresses.metrics-server.ip;
notifybotJid = configVars.xmpp.notifybotJid;
receiverJid = configVars.xmpp.personalAccount;
dockerContainerIp = configVars.networking.addresses.docker.ip;
smWorkerIp = configVars.networking.addresses.sm-worker.ip;
merlinIp = configVars.networking.addresses.merlin.ip;
@ -15,6 +19,7 @@
bitcoinNode = configVars.networking.addresses.bitcoin-node.ip;
postres = configVars.networking.addresses.postgres.ip;
backupServer = configVars.networking.addresses.backup-server.ip;
sops-nix = inputs.sops-nix;
http_endpoints = configVars.metrics-server.blackbox.http_endpoints;
@ -52,6 +57,10 @@ in {
hostPath = metricsServerContainerData;
isReadOnly = false;
};
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
};
config = {
@ -59,7 +68,10 @@ in {
lib,
config,
...
}: {
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
networking = {
defaultGateway = "${gatewayIp}";
interfaces.eth0.ipv4.addresses = [
@ -74,14 +86,32 @@ in {
config.services.prometheus.port
config.services.grafana.port
config.services.prometheus.exporters.blackbox.port
9199 #xmpp listen port
];
};
useHostResolvConf = lib.mkForce false;
};
sops = {
defaultSopsFile = "${secretsFile}";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
};
secrets = {
"software/restic-passphrase" = {};
"software/restic-exporter-credentials" = {};
"comms/xmpp/notifybot/password" = {
mode = "0644";
};
};
};
services.resolved.enable = true;
imports = [
sops-nix.nixosModules.sops
];
environment.systemPackages = [
@ -89,9 +119,49 @@ in {
pkgs.git
];
services.grafana = {
enable = true;
settings.server = {
http_port = 2342;
http_addr = "0.0.0.0";
};
};
# main prometheus service
services.prometheus = {
enable = true;
webExternalUrl = "http://${containerIp}:9001";
port = 9001;
alertmanagers = [
{
scheme = "http";
path_prefix = "/";
static_configs = [
{
targets = [
"0.0.0.0:9093"
];
}
];
}
];
ruleFiles = [
"${pkgs.writeText
"alert_rule.yml"
''
groups:
- name: blackbox_alert
rules:
- alert: EndpointDown
expr: probe_success{job="blackbox"} == 0
for: 1m
labels:
severity: critical
annotations:
summary: "Endpoint {{ $labels.instance }} down"
description: "An endpoint has been down for more than 1 minute."
''}"
];
scrapeConfigs = [
{
job_name = "node_exporter";
@ -110,6 +180,16 @@ in {
}
];
}
{
job_name = "restic-exporter";
static_configs = [
{
targets = [
"0.0.0.0:8001"
];
}
];
}
{
job_name = "blackbox";
@ -138,43 +218,74 @@ in {
];
};
services.grafana = {
# setup alertmanager
services.prometheus.xmpp-alerts = {
enable = true;
settings.server = {
http_port = 2342;
http_addr = "0.0.0.0";
settings = {
jid = notifybotJid;
password_command = "cat ${config.sops.secrets."comms/xmpp/notifybot/password".path}";
to_jid = receiverJid;
listen_address = "0.0.0.0";
listen_port = 9199;
};
};
services.prometheus.alertmanager = {
webExternalUrl = "http://${containerIp}:9093";
enable = true;
openFirewall = true;
port = 9093;
configText = ''
global:
resolve_timeout: 1m
services.prometheus = {
exporters = {
blackbox = {
enable = true;
configFile = pkgs.writeText "blackbox-conf.yaml" ''
modules:
http_basic:
prober: http
timeout: 5s
http:
preferred_ip_protocol: ip4
valid_http_versions: ["HTTP/1.1", "HTTP/2"]
method: GET
# fail_if_ssl: false
# fail_if_not_ssl: true
# tls_config:
# insecure_skip_verify: true
tcp_connect:
prober: tcp
tcp:
preferred_ip_protocol: ip4
route:
group_by: ['...']
repeat_interval: 1h
receiver: 'xmpp-alerts'
'';
};
node = {
enable = true;
enabledCollectors = ["systemd"];
port = 9002;
};
receivers:
- name: 'xmpp-alerts'
webhook_configs:
- url: 'http://0.0.0.0:9199/alert'
'';
};
# prometheus exporters
services.prometheus.exporters = {
blackbox = {
enable = true;
configFile = pkgs.writeText "blackbox-conf.yaml" ''
modules:
http_basic:
prober: http
timeout: 5s
http:
preferred_ip_protocol: ip4
valid_http_versions: ["HTTP/1.1", "HTTP/2"]
method: GET
# fail_if_ssl: false
# fail_if_not_ssl: true
# tls_config:
# insecure_skip_verify: true
tcp_connect:
prober: tcp
tcp:
preferred_ip_protocol: ip4
'';
};
node = {
enable = true;
enabledCollectors = ["systemd"];
port = 9002;
};
restic = {
enable = true;
repository = "";
environmentFile = config.sops.secrets."software/restic-exporter-credentials".path;
passwordFile = config.sops.secrets."software/restic-passphrase".path;
refreshInterval = 10800; # refresh every 3 hours
port = 8001;
};
};

47
hosts/common/optional/nixos-containers/nix-bitcoin.nix
View file

@ -62,7 +62,7 @@ in {
}: {
imports = [
inputs.nix-bitcoin.nixosModules.default
inputs.lnbits.nixosModules.default
# inputs.lnbits.nixosModules.default
];
environment.systemPackages = with pkgs; [
vim
@ -80,14 +80,13 @@ in {
firewall = {
enable = true;
allowedTCPPorts = [
80
443
22
# 80
# 443
config.containers.bitcoin-node.config.services.bitcoind.rpc.port
config.containers.bitcoin-node.config.services.mempool.frontend.port
config.containers.bitcoin-node.config.services.electrs.port
config.containers.bitcoin-node.config.services.rtl.port
config.containers.bitcoin-node.config.services.lnd.port
# config.containers.bitcoin-node.config.services.rtl.port
# config.containers.bitcoin-node.config.services.lnd.port
];
};
useHostResolvConf = lib.mkForce false;
@ -144,7 +143,7 @@ in {
};
};
lnd = {
enable = true;
enable = false;
lndconnect = {
enable = true;
onion = true;
@ -156,34 +155,34 @@ in {
'';
};
rtl = {
enable = true;
enable = false;
nodes.lnd.enable = true;
address = "0.0.0.0";
};
lnbits = {
enable = true;
openFirewall = true;
host = "0.0.0.0";
port = 8231;
env = {
LNBITS_ADMIN_UI = "true";
LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
LND_REST_ENDPOINT = "https://127.0.0.1:8080";
LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
AUTH_ALLOWED_METHODS = "user-id-only, username-password";
};
};
# lnbits = {
# enable = false;
# openFirewall = true;
# host = "0.0.0.0";
# port = 8231;
# env = {
# LNBITS_ADMIN_UI = "true";
# LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
# LND_REST_ENDPOINT = "https://127.0.0.1:8080";
# LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
# LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
# AUTH_ALLOWED_METHODS = "user-id-only, username-password";
# };
# };
};
# Add custom systemd overrides for above services
systemd.services.lnbits.after = ["lnd.service"];
# systemd.services.lnbits.after = ["lnd.service"];
nix-bitcoin.onionServices = {
bitcoind.enable = true;
electrs.enable = true;
mempool-frontend.enable = true;
lnd.public = true;
# lnd.public = true;
};
services.prometheus = {

2
hosts/common/optional/nixos-containers/pihole.nix
View file

@ -72,7 +72,7 @@ in {
imports = [
arion.nixosModules.arion
../arion-containers/pihole.nix
../docker-containers/pihole.nix
];
environment.systemPackages = [

57
hosts/common/optional/nixos-containers/reverse-proxy.nix
View file

@ -2,6 +2,7 @@
pkgs,
lib,
configVars,
inputs,
...
}: let
containerName = "reverse-proxy";
@ -10,6 +11,7 @@
gatewayIp = configVars.networking.addresses.gateway.ip;
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
sops-nix = inputs.sops-nix;
dockerContainerIp = configVars.networking.addresses.docker.ip;
bdWorker = configVars.networking.addresses.bd-worker.ip;
pihole = configVars.networking.addresses.pihole.ip;
@ -33,13 +35,40 @@ in {
privateNetwork = true;
hostBridge = "br0";
nixpkgs = pkgs.path;
bindMounts = {
"/etc/ssh/ssh_host_ed25519_key" = {
hostPath = "/etc/ssh/ssh_host_ed25519_key";
isReadOnly = true;
};
};
config = {
pkgs,
lib,
config,
...
}: {
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
sops = {
defaultSopsFile = "${secretsFile}";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
};
};
sops.secrets = {
"ssl_keys/lan-selfsigned.crt" = {
mode = "0644";
};
"ssl_keys/lan-selfsigned.key" = {
mode = "0644";
};
};
networking = {
defaultGateway = "${gatewayIp}";
interfaces.eth0.ipv4.addresses = [
@ -52,6 +81,7 @@ in {
enable = true;
allowedTCPPorts = [
80
443
];
};
useHostResolvConf = lib.mkForce false;
@ -60,6 +90,7 @@ in {
services.resolved.enable = true;
imports = [
sops-nix.nixosModules.sops
];
environment.systemPackages = [
@ -72,27 +103,51 @@ in {
enable = true;
virtualHosts = {
"jellyfin.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${dockerContainerIp}:8096";
};
"mempool.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${bitcoinNode}:4080";
extraConfig = ''
proxy_set_header Host mempool.lan;
'';
};
"grafana.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${metricsServer}:2342";
extraConfig = ''
proxy_set_header Host grafana.lan;
'';
};
"metrics.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${metricsServer}:9001";
};
"searx.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${dockerContainerIp}:8855";
};
"dns.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${pihole}:80";
};
"prefect.lan" = {
forceSSL = true;
sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
locations."/".proxyPass = "http://${bdWorker}:4200";
};
};

2
hosts/common/optional/nixos-containers/semitamaps-worker.nix
View file

@ -101,7 +101,7 @@ in {
imports = [
sops-nix.nixosModules.sops
arion.nixosModules.arion
../arion-containers/semitamaps-tileserver.nix
../docker-containers/semitamaps-tileserver.nix
];
environment.systemPackages = [

1
hosts/common/optional/persistence.nix
View file

@ -12,6 +12,7 @@
files = [
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/machine-id"
];
};
}

2
hosts/iso/default.nix
View file

@ -3,7 +3,7 @@ in {
imports = [(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")];
environment.systemPackages = [
pkgs.openssl
pkgs.nvim
pkgs.ccrypt
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

1
vars/default.nix
View file

@ -4,6 +4,7 @@
networking
email
metrics-server
xmpp
;
locations = {
mediaDataMountPoint = "/media/media";