sam
/
nixos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' of git.bitlab21.com:sam/nixos

This commit is contained in:
Sam 2025-01-24 23:38:22 +00:00
parent 8908eac2f9 84f6501679
commit d5c6d2b8ee
9 changed files with 185 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
flake.lock
View File

@ -539,11 +539,11 @@
},
"nix-secrets": {
"locked": {
"lastModified": 1737643624,
"narHash": "sha256-RAnbZSi2yagPCpNcm3U3wA6FAzbhGUi9ifvnu6Du3Rs=",
"lastModified": 1737745804,
"narHash": "sha256-ix/gu0HJmJISlZM2PjCssg+4fhD1g0CrrpLaKb84dRo=",
"ref": "refs/heads/master",
"rev": "5260822187ce58af680e5aceba8fb01f10415def",
"revCount": 248,
"rev": "3a049490d4853b61e9cf778347ff8fa175488ede",
"revCount": 251,
"type": "git",
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
},

36
home/common/optional/desktop/common/firefox.nix
View File

@ -5,7 +5,6 @@
...
}: let
user = config.home.username;
bitcoinNodeIp = configVars.networking.addresses.bitcoin-node.ip;
dockerContainerIp = configVars.networking.addresses.docker.ip;
in {
programs.firefox = {
@ -22,14 +21,8 @@ in {
{
template = "https://search.nixos.org/packages";
params = [
{
name = "type";
value = "packages";
}
{
name = "query";
value = "{searchTerms}";
}
{ name = "type"; value = "packages"; }
{ name = "query"; value = "{searchTerms}"; }
];
}
];
@ -43,7 +36,7 @@ in {
definedAliases = ["@nw"];
};
"Searx" = {
urls = [{template = "http://${dockerContainerIp}:8855/?q={searchTerms}";}];
urls = [{template = "http://searx.lan/?q={searchTerms}";}];
iconUpdateURL = "https://docs.searxng.org/_static/searxng-wordmark.svg";
updateInterval = 24 * 60 * 60 * 1000; # every day
definedAliases = ["@searx"];
@ -60,11 +53,27 @@ in {
bookmarks = [
{
name = "Jellyfin";
url = "http://${dockerContainerIp}:8096";
url = "http://jellyfin.lan";
}
{
name = "Pihole";
url = "http://dns.lan";
}
{
name = "Searx";
url = "http://searx.lan";
}
{
name = "Mempool";
url = "http://${bitcoinNodeIp}:4080";
url = "http://mempool.lan";
}
{
name = "Grafana";
url = "http://grafana.lan";
}
{
name = "Prometheus";
url = "http://prometheus.lan";
}
{
name = "Nixos Package Search";
@ -80,7 +89,7 @@ in {
"identity.fxaccounts.enabled" = false;
"signon.rememberSignons" = false;
"browser.compactmode.show" = true;
"browser.startup.homepage" = "http://${dockerContainerIp}:8855";
"browser.startup.homepage" = "http://searx.lan";
"browser.search.defaultenginename" = "Searx";
"browser.search.order.1" = "Searx";
};
@ -91,7 +100,6 @@ in {
bitwarden
sponsorblock
darkreader
vimium
privacy-badger
zotero-connector
];

32
hosts/common/optional/arion-containers/searxng.nix Normal file
View File

@ -0,0 +1,32 @@
{configVars, ...}:
let
# configVars = import ../../../../vars {inherit inputs};
piholeIp = configVars.networking.addresses.pihole.ip;
in
{
virtualisation.arion = {
backend = "podman-socket";
projects.searxng = {
settings = {
services.redis.service = {
container_name = "redis";
image = "redis:alpine";
restart = "always";
command = [ "redis-server" "--save" "" "--appendonly" "no" ];
tmpfs = [ "/var/lib/redis" ];
capabilities = { ALL = false; SETGID = true; SETUID = true; DAC_OVERRIDE = true; };
};
services.searxng.service = {
container_name = "searxng";
image = "searxng/searxng:latest";
restart = "always";
ports = [ "8855:8080" ];
dns = [ piholeIp ];
volumes = [ "/srv/docker/searxng-docker/searxng:/etc/searxng:rw" ];
capabilities = { ALL = false; CHOWN = true; SETGID = true; SETUID = true; DAC_OVERRIDE = true; };
};
};
};
};
}

4
hosts/common/optional/nixos-containers/docker.nix
View File

@ -2,9 +2,9 @@
pkgs,
lib,
inputs,
configVars,
config,
outputs,
configVars,
...
}: let
containerName = "docker";
@ -119,7 +119,6 @@ in {
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in {
nixpkgs.overlays = [
outputs.overlays.unstable-packages
];
@ -179,6 +178,7 @@ in {
../arion-containers/jellyfin.nix
../arion-containers/photoprism.nix
../arion-containers/syncthing.nix
(import ../arion-containers/searxng.nix {configVars = configVars;})
];
environment.systemPackages = [

8
hosts/common/optional/nixos-containers/metrics-server.nix
View File

@ -159,10 +159,10 @@ in {
preferred_ip_protocol: ip4
valid_http_versions: ["HTTP/1.1", "HTTP/2"]
method: GET
fail_if_ssl: false
fail_if_not_ssl: true
tls_config:
insecure_skip_verify: true
# fail_if_ssl: false
# fail_if_not_ssl: true
# tls_config:
# insecure_skip_verify: true
tcp_connect:
prober: tcp
tcp:

112
hosts/common/optional/nixos-containers/reverse-proxy.nix Normal file
View File

@ -0,0 +1,112 @@
{
pkgs,
lib,
configVars,
...
}: let
containerName = "reverse-proxy";
containerIp = configVars.networking.addresses.reverse-proxy.ip;
gatewayIp = configVars.networking.addresses.gateway.ip;
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
dockerContainerIp = configVars.networking.addresses.docker.ip;
bdWorker = configVars.networking.addresses.bd-worker.ip;
pihole = configVars.networking.addresses.pihole.ip;
bitcoinNode = configVars.networking.addresses.bitcoin-node.ip;
metricsServer = configVars.networking.addresses.metrics-server.ip;
in {
networking.nat.enable = true;
networking.nat.internalInterfaces = ["ve-+"];
networking.nat.externalInterface = "br0";
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/var/lib/nixos-containers/${containerName}"
];
};
containers."${containerName}" = {
enableTun = true;
autoStart = true;
privateNetwork = true;
hostBridge = "br0";
nixpkgs = pkgs.path;
config = {
pkgs,
lib,
config,
...
}: {
networking = {
defaultGateway = "${gatewayIp}";
interfaces.eth0.ipv4.addresses = [
{
"address" = "${containerIp}";
"prefixLength" = 24;
}
];
firewall = {
enable = true;
allowedTCPPorts = [
80
];
};
useHostResolvConf = lib.mkForce false;
};
services.resolved.enable = true;
imports = [
];
environment.systemPackages = [
pkgs.vim
pkgs.git
pkgs.nginx
];
services.nginx = {
enable = true;
virtualHosts = {
"jellyfin.lan" = {
locations."/".proxyPass = "http://${dockerContainerIp}:8096";
};
"mempool.lan" = {
locations."/".proxyPass = "http://${bitcoinNode}:4080";
};
"grafana.lan" = {
locations."/".proxyPass = "http://${metricsServer}:2342";
};
"metrics.lan" = {
locations."/".proxyPass = "http://${metricsServer}:9001";
};
"searx.lan" = {
locations."/".proxyPass = "http://${dockerContainerIp}:8855";
};
"dns.lan" = {
locations."/".proxyPass = "http://${pihole}:80";
};
"prefect.lan" = {
locations."/".proxyPass = "http://${bdWorker}:4200";
};
};
};
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
};
users.users = {
root = {
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
};
};
system.stateVersion = "24.05";
};
};
}

7
hosts/merlin/default.nix
View File

@ -85,6 +85,13 @@ in {
fsType = "btrfs";
};
services = {
earlyoom = {
enable = true;
freeMemThreshold = 3;
};
};
networking = {
hostName = "merlin";
nameservers = ["${piholeIp}" "${gatewayIp}" "8.8.8.8"];

1
hosts/semita/default.nix
View File

@ -60,6 +60,7 @@ in {
../common/optional/fileserver/nfs-client/personal.nix
../common/optional/distributed-builds/local-machine.nix
../common/optional/nixos-containers/reverse-proxy.nix
outputs.nixosModules.nixosAutoUpgrade
];

2
hosts/sparky/default.nix
View File

@ -29,7 +29,7 @@ in {
../common/optional/openssh.nix
../common/optional/persistence.nix
../common/optional/fileserver/nfs-client/media.nix
# ../common/optional/printing.nix
../common/optional/printing.nix
../common/optional/distributed-builds/local-machine.nix
outputs.nixosModules.nixosAutoUpgrade
];