Merge branch 'development'

home/common/optional/desktop/common/default.nix

@@ -29,5 +29,6 @@
     pkgs.R
     pkgs.gimp
     pkgs.gajim
+    pkgs.vlc
   ];
 }

hosts/common/optional/arion-containers/jellyfin.nix

@@ -1,32 +0,0 @@
-{
-  virtualisation.arion = {
-    backend = "podman-socket";
-    projects.jellyfin = {
-      settings = {
-        services.jellyfin.service = {
-          ports = [
-            "8096:8096"
-          ];
-          container_name = "jellyfin";
-          image = "lscr.io/linuxserver/jellyfin:latest";
-          restart = "always";
-          volumes = [
-            "/srv/docker/media-server/jellyfin/config:/config"
-            "/media/media/tv:/data/tvshows:ro"
-            "/media/media/movies:/data/movies:ro"
-            "/media/media/music/music_data:/data/music:ro"
-            "/media/media/youtube:/data/youtube:ro"
-            "/media/media/podcasts:/data/podcasts:ro"
-            "/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
-          ];
-          environment = {
-            PUID = "1000";
-            PGID = "1000";
-            DOCKER_MODS="linuxserver/mods:jellyfin-opencl-intel";
-          };
-          devices = ["/dev/dri:/dev/dri"];
-        };
-      };
-    };
-  };
-}

hosts/common/optional/arion-containers/semitamaps-tileserver.nix

@@ -1,31 +0,0 @@
-{
-  virtualisation.arion = {
-    backend = "podman-socket";
-    projects.semitamaps-tileserver = {
-      settings = {
-        services.tileserver-gl.service = {
-          ports = [
-            "8080:8080"
-          ];
-          container_name = "tileserver-gl";
-          image = "maptiler/tileserver-gl";
-          restart = "always";
-          volumes = [
-            "/data/semitamaps-data/tileserver-gl/data:/data"
-          ];
-          command = "-c /data/config.json --public_url https://tiles.semitamaps.com/";
-        };
-
-        services.mbgl-renderer.service = {
-          ports = [
-            "8081:80"
-          ];
-          container_name = "mbgl-renderer";
-          image = "mbgl-renderer";
-          restart = "always";
-        };
-      };
-    };
-  };
-}
-

hosts/common/optional/docker-containers/baikal.nix

@@ -0,0 +1,17 @@
+{
+  config.virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      baikal = {
+        image = "ckulka/baikal:nginx";
+        ports = [
+          "6734:80"
+        ];
+        volumes = [
+          "/srv/docker/baikal/config:/var/www/baikal/config"
+          "/srv/docker/baikal/data:/var/www/baikal/Specific"
+        ];
+      };
+    };
+  };
+}

hosts/common/optional/docker-containers/jellyfin.nix

@@ -0,0 +1,31 @@
+{
+  config.virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      jellyfin = {
+        image = "lscr.io/linuxserver/jellyfin:latest";
+        ports = [
+          "8096:8096"
+        ];
+        volumes = [
+          "/srv/docker/media-server/jellyfin/config:/config"
+          "/media/media/tv:/data/tvshows:ro"
+          "/media/media/movies:/data/movies:ro"
+          "/media/media/music/music_data:/data/music:ro"
+          "/media/media/youtube:/data/youtube:ro"
+          "/media/media/podcasts:/data/podcasts:ro"
+          "/srv/docker/media-server/jellyfin/config/custom-cont-init.d:/custom-cont-init.d:ro"
+        ];
+        environment = {
+          PUID = "1000";
+          PGID = "1000";
+          DOCKER_MODS = "linuxserver/mods:jellyfin-opencl-intel";
+          NVIDIA_VISIBLE_DEVICES = "all";
+        };
+        extraOptions = [
+          "--device=nvidia.com/gpu=all"
+        ];
+      };
+    };
+  };
+}

hosts/common/optional/docker-containers/semitamaps-tileserver.nix

@@ -0,0 +1,25 @@
+{
+  config.virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      tileserver-gl = {
+        image = "maptiler/tileserver-gl";
+        ports = [
+          "8080:8080"
+        ];
+        volumes = [
+          "/data/semitamaps-data/tileserver-gl/data:/data"
+        ];
+      };
+      mbgl-renderer = {
+        image = "mbgl-renderer";
+        ports = [
+          "8081:80"
+        ];
+        volumes = [
+          "/data/semitamaps-data/tileserver-gl/data:/data"
+        ];
+      };
+    };
+  };
+}

hosts/common/optional/nixos-containers/docker.nix

@@ -53,6 +53,10 @@ in {
         node = "/dev/nvidiactl";
         modifier = "rwm";
       }
+      {
+        node = "/dev/nvidia-uvm";
+        modifier = "rwm";
+      }
       {
         node = "/dev/fuse";
         modifier = "rwm";
@@ -174,11 +178,12 @@ in {
       imports = [
         arion.nixosModules.arion
         sops-nix.nixosModules.sops
-        ../arion-containers/arrstack.nix
+        ../docker-containers/arrstack.nix
-        ../arion-containers/jellyfin.nix
+        ../docker-containers/jellyfin.nix
-        ../arion-containers/photoprism.nix
+        ../docker-containers/photoprism.nix
-        ../arion-containers/syncthing.nix
+        ../docker-containers/syncthing.nix
-        (import ../arion-containers/searxng.nix {configVars = configVars;})
+        ../docker-containers/baikal.nix
+        (import ../docker-containers/searxng.nix {configVars = configVars;})
       ];
 
       environment.systemPackages = [
@@ -204,18 +209,6 @@ in {
 
       networking.firewall.interfaces."podman+".allowedUDPPorts = [53];
 
-      systemd.services.podman-autostart = {
-        enable = true;
-        after = ["podman.service"];
-        wantedBy = ["multi-user.target"];
-        description = "Automatically start containers with --restart=always tag";
-        serviceConfig = {
-          Type = "idle";
-          ExecStartPre = ''${pkgs.coreutils}/bin/sleep 1'';
-          ExecStart = ''/run/current-system/sw/bin/podman start --all --filter restart-policy=always'';
-        };
-      };
-
       services.prometheus = {
         exporters = {
           node = {

hosts/common/optional/nixos-containers/metrics-server.nix

@@ -2,11 +2,15 @@
   pkgs,
   lib,
   configVars,
+  inputs,
   ...
 }: let
   containerName = "metrics-server";
   containerIp = configVars.networking.addresses.metrics-server.ip;
 
+  notifybotJid = configVars.xmpp.notifybotJid;
+  receiverJid = configVars.xmpp.personalAccount;
+
   dockerContainerIp = configVars.networking.addresses.docker.ip;
   smWorkerIp = configVars.networking.addresses.sm-worker.ip;
   merlinIp = configVars.networking.addresses.merlin.ip;
@@ -15,6 +19,7 @@
   bitcoinNode = configVars.networking.addresses.bitcoin-node.ip;
   postres = configVars.networking.addresses.postgres.ip;
   backupServer = configVars.networking.addresses.backup-server.ip;
+  sops-nix = inputs.sops-nix;
 
   http_endpoints = configVars.metrics-server.blackbox.http_endpoints;
 
@@ -52,6 +57,10 @@ in {
         hostPath = metricsServerContainerData;
         isReadOnly = false;
       };
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
     };
 
     config = {
@@ -59,7 +68,10 @@ in {
       lib,
       config,
       ...
-    }: {
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
       networking = {
         defaultGateway = "${gatewayIp}";
         interfaces.eth0.ipv4.addresses = [
@@ -74,14 +86,32 @@ in {
             config.services.prometheus.port
             config.services.grafana.port
             config.services.prometheus.exporters.blackbox.port
+            9199 #xmpp listen port
           ];
         };
         useHostResolvConf = lib.mkForce false;
       };
 
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+        secrets = {
+          "software/restic-passphrase" = {};
+          "software/restic-exporter-credentials" = {};
+          "comms/xmpp/notifybot/password" = {
+            mode = "0644";
+          };
+        };
+      };
+
       services.resolved.enable = true;
 
       imports = [
+        sops-nix.nixosModules.sops
       ];
 
       environment.systemPackages = [
@@ -89,9 +119,49 @@ in {
         pkgs.git
       ];
 
+      services.grafana = {
+        enable = true;
+        settings.server = {
+          http_port = 2342;
+          http_addr = "0.0.0.0";
+        };
+      };
+
+      # main prometheus service
       services.prometheus = {
         enable = true;
+        webExternalUrl = "http://${containerIp}:9001";
         port = 9001;
+        alertmanagers = [
+          {
+            scheme = "http";
+            path_prefix = "/";
+            static_configs = [
+              {
+                targets = [
+                  "0.0.0.0:9093"
+                ];
+              }
+            ];
+          }
+        ];
+        ruleFiles = [
+          "${pkgs.writeText
+            "alert_rule.yml"
+            ''
+              groups:
+              - name: blackbox_alert
+                rules:
+                - alert: EndpointDown
+                  expr: probe_success{job="blackbox"} == 0
+                  for: 1m
+                  labels:
+                    severity: critical
+                  annotations:
+                    summary: "Endpoint {{ $labels.instance }} down"
+                    description: "An endpoint has been down for more than 1 minute."
+            ''}"
+        ];
         scrapeConfigs = [
           {
             job_name = "node_exporter";
@@ -110,6 +180,16 @@ in {
               }
             ];
           }
+          {
+            job_name = "restic-exporter";
+            static_configs = [
+              {
+                targets = [
+                  "0.0.0.0:8001"
+                ];
+              }
+            ];
+          }
 
           {
             job_name = "blackbox";
@@ -138,43 +218,74 @@ in {
         ];
       };
 
-      services.grafana = {
+      # setup alertmanager
+      services.prometheus.xmpp-alerts = {
         enable = true;
-        settings.server = {
+        settings = {
-          http_port = 2342;
+          jid = notifybotJid;
-          http_addr = "0.0.0.0";
+          password_command = "cat ${config.sops.secrets."comms/xmpp/notifybot/password".path}";
+          to_jid = receiverJid;
+          listen_address = "0.0.0.0";
+          listen_port = 9199;
         };
       };
+      services.prometheus.alertmanager = {
+        webExternalUrl = "http://${containerIp}:9093";
+        enable = true;
+        openFirewall = true;
+        port = 9093;
+        configText = ''
+          global:
+            resolve_timeout: 1m
 
-      services.prometheus = {
+          route:
-        exporters = {
+            group_by: ['...']
-          blackbox = {
+            repeat_interval: 1h
-            enable = true;
+            receiver: 'xmpp-alerts'
-            configFile = pkgs.writeText "blackbox-conf.yaml" ''
-              modules:
-                http_basic:
-                  prober: http
-                  timeout: 5s
-                  http:
-                    preferred_ip_protocol: ip4
-                    valid_http_versions: ["HTTP/1.1", "HTTP/2"]
-                    method: GET
-                    # fail_if_ssl: false
-                    # fail_if_not_ssl: true
-                    # tls_config:
-                    #   insecure_skip_verify: true
-                tcp_connect:
-                  prober: tcp
-                  tcp:
-                    preferred_ip_protocol: ip4
 
-            '';
+          receivers:
-          };
+          - name: 'xmpp-alerts'
-          node = {
+            webhook_configs:
-            enable = true;
+            - url: 'http://0.0.0.0:9199/alert'
-            enabledCollectors = ["systemd"];
+        '';
-            port = 9002;
+      };
-          };
+
+      # prometheus exporters
+      services.prometheus.exporters = {
+        blackbox = {
+          enable = true;
+          configFile = pkgs.writeText "blackbox-conf.yaml" ''
+            modules:
+              http_basic:
+                prober: http
+                timeout: 5s
+                http:
+                  preferred_ip_protocol: ip4
+                  valid_http_versions: ["HTTP/1.1", "HTTP/2"]
+                  method: GET
+                  # fail_if_ssl: false
+                  # fail_if_not_ssl: true
+                  # tls_config:
+                  #   insecure_skip_verify: true
+              tcp_connect:
+                prober: tcp
+                tcp:
+                  preferred_ip_protocol: ip4
+
+          '';
+        };
+        node = {
+          enable = true;
+          enabledCollectors = ["systemd"];
+          port = 9002;
+        };
+        restic = {
+          enable = true;
+          repository = "";
+          environmentFile = config.sops.secrets."software/restic-exporter-credentials".path;
+          passwordFile = config.sops.secrets."software/restic-passphrase".path;
+          refreshInterval = 10800; # refresh every 3 hours
+          port = 8001;
         };
       };
 

hosts/common/optional/nixos-containers/nix-bitcoin.nix

@@ -62,7 +62,7 @@ in {
     }: {
       imports = [
         inputs.nix-bitcoin.nixosModules.default
-        inputs.lnbits.nixosModules.default
+        # inputs.lnbits.nixosModules.default
       ];
       environment.systemPackages = with pkgs; [
         vim
@@ -80,14 +80,13 @@ in {
         firewall = {
           enable = true;
           allowedTCPPorts = [
-            80
+            # 80
-            443
+            # 443
-            22
             config.containers.bitcoin-node.config.services.bitcoind.rpc.port
             config.containers.bitcoin-node.config.services.mempool.frontend.port
             config.containers.bitcoin-node.config.services.electrs.port
-            config.containers.bitcoin-node.config.services.rtl.port
+            # config.containers.bitcoin-node.config.services.rtl.port
-            config.containers.bitcoin-node.config.services.lnd.port
+            # config.containers.bitcoin-node.config.services.lnd.port
           ];
         };
         useHostResolvConf = lib.mkForce false;
@@ -144,7 +143,7 @@ in {
           };
         };
         lnd = {
-          enable = true;
+          enable = false;
           lndconnect = {
             enable = true;
             onion = true;
@@ -156,34 +155,34 @@ in {
           '';
         };
         rtl = {
-          enable = true;
+          enable = false;
           nodes.lnd.enable = true;
           address = "0.0.0.0";
         };
-        lnbits = {
+        # lnbits = {
-          enable = true;
+        #   enable = false;
-          openFirewall = true;
+        #   openFirewall = true;
-          host = "0.0.0.0";
+        #   host = "0.0.0.0";
-          port = 8231;
+        #   port = 8231;
-          env = {
+        #   env = {
-            LNBITS_ADMIN_UI = "true";
+        #     LNBITS_ADMIN_UI = "true";
-            LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
+        #     LNBITS_BACKEND_WALLET_CLASS = "LndRestWallet";
-            LND_REST_ENDPOINT = "https://127.0.0.1:8080";
+        #     LND_REST_ENDPOINT = "https://127.0.0.1:8080";
-            LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
+        #     LND_REST_CERT = "/etc/nix-bitcoin-secrets/lnd-cert";
-            LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
+        #     LND_REST_MACAROON = "/var/lib/lnbits/admin.macaroon";
-            AUTH_ALLOWED_METHODS = "user-id-only, username-password";
+        #     AUTH_ALLOWED_METHODS = "user-id-only, username-password";
-          };
+        #   };
-        };
+        # };
       };
 
       # Add custom systemd overrides for above services
-      systemd.services.lnbits.after = ["lnd.service"];
+      # systemd.services.lnbits.after = ["lnd.service"];
 
       nix-bitcoin.onionServices = {
         bitcoind.enable = true;
         electrs.enable = true;
         mempool-frontend.enable = true;
-        lnd.public = true;
+        # lnd.public = true;
       };
 
       services.prometheus = {

hosts/common/optional/nixos-containers/pihole.nix

@@ -72,7 +72,7 @@ in {
 
       imports = [
         arion.nixosModules.arion
-        ../arion-containers/pihole.nix
+        ../docker-containers/pihole.nix
       ];
 
       environment.systemPackages = [

hosts/common/optional/nixos-containers/reverse-proxy.nix

@@ -2,6 +2,7 @@
   pkgs,
   lib,
   configVars,
+  inputs,
   ...
 }: let
   containerName = "reverse-proxy";
@@ -10,6 +11,7 @@
   gatewayIp = configVars.networking.addresses.gateway.ip;
   pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
 
+  sops-nix = inputs.sops-nix;
   dockerContainerIp = configVars.networking.addresses.docker.ip;
   bdWorker = configVars.networking.addresses.bd-worker.ip;
   pihole = configVars.networking.addresses.pihole.ip;
@@ -33,13 +35,40 @@ in {
     privateNetwork = true;
     hostBridge = "br0";
     nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key" = {
+        hostPath = "/etc/ssh/ssh_host_ed25519_key";
+        isReadOnly = true;
+      };
+    };
 
     config = {
       pkgs,
       lib,
       config,
       ...
-    }: {
+    }: let
+      secretsDirectory = builtins.toString inputs.nix-secrets;
+      secretsFile = "${secretsDirectory}/secrets.yaml";
+    in {
+      sops = {
+        defaultSopsFile = "${secretsFile}";
+        validateSopsFiles = false;
+
+        age = {
+          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        };
+      };
+
+      sops.secrets = {
+        "ssl_keys/lan-selfsigned.crt" = {
+           mode = "0644";
+        };
+        "ssl_keys/lan-selfsigned.key" = {
+           mode = "0644";
+        };
+      };
+
       networking = {
         defaultGateway = "${gatewayIp}";
         interfaces.eth0.ipv4.addresses = [
@@ -52,6 +81,7 @@ in {
           enable = true;
           allowedTCPPorts = [
             80
+            443
           ];
         };
         useHostResolvConf = lib.mkForce false;
@@ -60,6 +90,7 @@ in {
       services.resolved.enable = true;
 
       imports = [
+        sops-nix.nixosModules.sops
       ];
 
       environment.systemPackages = [
@@ -72,27 +103,51 @@ in {
         enable = true;
         virtualHosts = {
           "jellyfin.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${dockerContainerIp}:8096";
           };
           "mempool.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${bitcoinNode}:4080";
+            extraConfig = ''
+              proxy_set_header Host mempool.lan;
+            '';
           };
           "grafana.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${metricsServer}:2342";
             extraConfig = ''
               proxy_set_header Host grafana.lan;
             '';
           };
           "metrics.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${metricsServer}:9001";
           };
           "searx.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${dockerContainerIp}:8855";
           };
           "dns.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${pihole}:80";
           };
           "prefect.lan" = {
+            forceSSL = true;
+            sslCertificate = "${config.sops.secrets."ssl_keys/lan-selfsigned.crt".path}";
+            sslCertificateKey = "${config.sops.secrets."ssl_keys/lan-selfsigned.key".path}";
             locations."/".proxyPass = "http://${bdWorker}:4200";
           };
         };

hosts/common/optional/nixos-containers/semitamaps-worker.nix

@@ -101,7 +101,7 @@ in {
       imports = [
         sops-nix.nixosModules.sops
         arion.nixosModules.arion
-        ../arion-containers/semitamaps-tileserver.nix
+        ../docker-containers/semitamaps-tileserver.nix
       ];
 
       environment.systemPackages = [

hosts/common/optional/persistence.nix

@@ -12,6 +12,7 @@
     files = [
       "/etc/ssh/ssh_host_ed25519_key"
       "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/machine-id"
     ];
   };
 }

hosts/iso/default.nix

@@ -3,7 +3,7 @@ in {
   imports = [(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")];
   environment.systemPackages = [ 
     pkgs.openssl 
-    pkgs.nvim
+    pkgs.ccrypt
   ];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

vars/default.nix

@@ -4,6 +4,7 @@
     networking
     email
     metrics-server
+    xmpp
     ;
   locations = {
     mediaDataMountPoint = "/media/media";