modify jellyfin & nix-bitcoin containers

flake.lock

@@ -80,6 +80,31 @@
         "type": "github"
       }
     },
+    "extra-container": {
+      "inputs": {
+        "flake-utils": [
+          "nix-bitcoin",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nix-bitcoin",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1722175938,
+        "narHash": "sha256-HKyB4HD+NdX3T233bY31hm76v3/tdQBNeLLvopKbZeY=",
+        "owner": "erikarvstedt",
+        "repo": "extra-container",
+        "rev": "37e7207ac9f857eedb58b208b9dc91cd6b24e651",
+        "type": "github"
+      },
+      "original": {
+        "owner": "erikarvstedt",
+        "repo": "extra-container",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "locked": {
         "lastModified": 1696426674,
@@ -160,11 +185,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722555600,
+        "lastModified": 1727826117,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1",
         "type": "github"
       },
       "original": {
@@ -173,6 +198,24 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "git-hooks": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -187,11 +230,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724857454,
+        "lastModified": 1727854478,
-        "narHash": "sha256-Qyl9Q4QMTLZnnBb/8OuQ9LSkzWjBU1T5l5zIzTxkkhk=",
+        "narHash": "sha256-/odH2nUMAwkMgOS2nG2z0exLQNJS4S2LfMW0teqU7co=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "4509ca64f1084e73bc7a721b20c669a8d4c5ebe6",
+        "rev": "5f58871c9657b5fc0a7f65670fe2ba99c26c1d79",
         "type": "github"
       },
       "original": {
@@ -267,11 +310,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
+        "lastModified": 1726989464,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
@@ -289,11 +332,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
+        "lastModified": 1726989464,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
@@ -305,11 +348,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1724489415,
+        "lastModified": 1727649413,
-        "narHash": "sha256-ey8vhwY/6XCKoh7fyTn3aIQs7WeYSYtLbYEG87VCzX4=",
+        "narHash": "sha256-FA53of86DjFdeQzRDVtvgWF9o52rWK70VHGx0Y8fElQ=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "c7f5b394397398c023000cf843986ee2571a1fd7",
+        "rev": "d0b38e550039a72aff896ee65b0918e975e6d48e",
         "type": "github"
       },
       "original": {
@@ -318,6 +361,30 @@
         "type": "github"
       }
     },
+    "nix-bitcoin": {
+      "inputs": {
+        "extra-container": "extra-container",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgs-unstable": "nixpkgs-unstable"
+      },
+      "locked": {
+        "lastModified": 1727247704,
+        "narHash": "sha256-Jl1CYXNIdJ4Ac0MK15e8+vflFOgPxZZNw24CKfLC6QY=",
+        "owner": "fort-nix",
+        "repo": "nix-bitcoin",
+        "rev": "a0d36d59248ac54f1b42a668326346a77640c7f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "fort-nix",
+        "ref": "nixos-24.05",
+        "repo": "nix-bitcoin",
+        "type": "github"
+      }
+    },
     "nix-colors": {
       "inputs": {
         "base16-schemes": "base16-schemes",
@@ -345,11 +412,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724561770,
+        "lastModified": 1727707210,
-        "narHash": "sha256-zv8C9RNa86CIpyHwPIVO/k+5TfM8ZbjGwOOpTe1grls=",
+        "narHash": "sha256-8XZp5XO2FC6INZEZ2WlwErtvFVpl45ACn8CJ2hfTA0Y=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "ac5694a0b855a981e81b4d9f14052e3ff46ca39e",
+        "rev": "f61d5f2051a387a15817007220e9fb3bbead57b3",
         "type": "github"
       },
       "original": {
@@ -361,11 +428,11 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1726340825,
+        "lastModified": 1728169228,
-        "narHash": "sha256-6gv36ea3aAjJH7osZVzVU0GRoJeVR+iwSP9bSaJC+MI=",
+        "narHash": "sha256-WT6kWWqMQE4KBdziZ/uuJ9sPcVg+6QJoOdBPdKAD0gI=",
         "ref": "refs/heads/master",
-        "rev": "73d4d304a201f7db200ffb5955c8a2f521f635a7",
+        "rev": "e9709bbb9adc91fb6b4dab5b16e15546cc596695",
-        "revCount": 160,
+        "revCount": 165,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },
@@ -407,11 +474,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1721524707,
+        "lastModified": 1725762081,
-        "narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
+        "narHash": "sha256-vNv+aJUW5/YurRy1ocfvs4q/48yVESwlC/yHzjkZSP8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
+        "rev": "dc454045f5b5d814e5862a6d057e7bb5c29edc05",
         "type": "github"
       },
       "original": {
@@ -423,11 +490,27 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1724819573,
+        "lastModified": 1726871744,
-        "narHash": "sha256-GnR7/ibgIH1vhoy8cYdmXE6iyZqKqFxQSVkFgosBh6w=",
+        "narHash": "sha256-V5LpfdHyQkUF7RfOaDPrZDP+oqz88lTJrMT1+stXNwo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a1d92660c6b3b7c26fb883500a80ea9d33321be2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable_2": {
+      "locked": {
+        "lastModified": 1728018373,
+        "narHash": "sha256-NOiTvBbRLIOe5F6RbHaAh6++BNjsb149fGZd1T4+KBg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "71e91c409d1e654808b2621f28a327acfdad8dc2",
+        "rev": "bc947f541ae55e999ffdb4013441347d83b00feb",
         "type": "github"
       },
       "original": {
@@ -439,11 +522,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1724855419,
+        "lastModified": 1728067476,
-        "narHash": "sha256-WXHSyOF4nBX0cvHN3DfmEMcLOVdKH6tnMk9FQ8wTNRc=",
+        "narHash": "sha256-/uJcVXuBt+VFCPQIX+4YnYrHaubJSx4HoNsJVNRgANM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ae2fc9e0e42caaf3f068c1bfdc11c71734125e06",
+        "rev": "6e6b3dd395c3b1eb9be9f2d096383a8d05add030",
         "type": "github"
       },
       "original": {
@@ -467,11 +550,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1724910205,
+        "lastModified": 1728083208,
-        "narHash": "sha256-eH2yPsTkaGp87rtxATx9d2dGBQUXH3kQPEOTKmaEb0s=",
+        "narHash": "sha256-jaoWQm2+oAUDU1ft+RWrxcgc/4lHGE0AkZlIBiVjQiQ=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "d150ce320e4eda99d8865bbd4c74ee8c47a88097",
+        "rev": "e246bd57da2a09b18b0667f7de40dc1c55a94667",
         "type": "github"
       },
       "original": {
@@ -483,11 +566,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1725083573,
+        "lastModified": 1728121595,
-        "narHash": "sha256-F9WeDQi+U1+y6BDGvW8PYyi9LALbpo4DlpzfZONh5a0=",
+        "narHash": "sha256-e9kRLdv2D4Lk6obeLEzm/m2TYcnZuMnVtqtQUKBCMVs=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "83ead973ba76b6ecf2d72dff9b60b56749e29518",
+        "rev": "b638dbc3cd5ecae15140d2de7897dc9395cd128e",
         "type": "github"
       },
       "original": {
@@ -502,10 +585,11 @@
         "disko": "disko",
         "home-manager": "home-manager",
         "impermanence": "impermanence",
+        "nix-bitcoin": "nix-bitcoin",
         "nix-colors": "nix-colors",
         "nix-secrets": "nix-secrets",
         "nixpkgs": "nixpkgs_2",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs-unstable": "nixpkgs-unstable_2",
         "nixvim": "nixvim",
         "nur": "nur",
         "sops-nix": "sops-nix"
@@ -519,11 +603,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1723501126,
+        "lastModified": 1727734513,
-        "narHash": "sha256-N9IcHgj/p1+2Pvk8P4Zc1bfrMwld5PcosVA0nL6IGdE=",
+        "narHash": "sha256-i47LQwoGCVQq4upV2YHV0OudkauHNuFsv306ualB/Sw=",
         "owner": "mic92",
         "repo": "sops-nix",
-        "rev": "be0eec2d27563590194a9206f551a6f73d52fa34",
+        "rev": "3198a242e547939c5e659353551b0668ec150268",
         "type": "github"
       },
       "original": {
@@ -532,6 +616,21 @@
         "type": "github"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -540,11 +639,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724833132,
+        "lastModified": 1727984844,
-        "narHash": "sha256-F4djBvyNRAXGusJiNYInqR6zIMI3rvlp6WiKwsRISos=",
+        "narHash": "sha256-xpRqITAoD8rHlXQafYZOLvUXCF6cnZkPfoq67ThN0Hc=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "3ffd842a5f50f435d3e603312eefa4790db46af5",
+        "rev": "4446c7a6fc0775df028c5a3f6727945ba8400e64",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,6 +26,12 @@
       url = "github:hercules-ci/arion/236f9dd82d6ef6a2d9987c7a7df3e75f1bc8b318";
     };
 
+    # nix-bitcoin
+    nix-bitcoin = {
+      url = "github:fort-nix/nix-bitcoin/nixos-24.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Nix colors
     nix-colors.url = "github:misterio77/nix-colors";
 

hosts/common/optional/docker/default.nix

@@ -1,10 +1,26 @@
-{pkgs, ...}: {
+{
-  virtualisation = {
+  pkgs,
-    docker = {
+  inputs,
-      enable = true;
+  ...
-    };
+}: {
-  };
+  imports = [inputs.arion.nixosModules.arion];
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = [
-    docker-compose
+    pkgs.arion
+    pkgs.docker-client
   ];
+
+  virtualisation = {
+    podman = {
+      enable = true;
+      dockerSocket.enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/containers"
+    ];
+  };
 }

hosts/common/optional/docker/postgres.nix

@@ -1,145 +0,0 @@
-{
-  pkgs,
-  lib,
-  inputs,
-  config,
-  ...
-}: let
-  admin_dbPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/postgres/admin_db/password".path;
-  initScript = pkgs.writeText "init.sh" ''
-    #!/bin/bash
-    function create_user_and_database() {
-      local database=$1
-      local user=$2
-      local extensions=$3
-      echo "### admin user: $POSTGRES_USER ###"
-      echo "  Creating database '$database'"
-      echo "  Creating user  '$user'"
-      psql -v --username "$POSTGRES_USER" -d "$POSTGRES_DB" <<-EOSQL
-          CREATE USER $user;
-          CREATE DATABASE $database;
-          GRANT ALL PRIVILEGES ON DATABASE $database TO $user;
-    EOSQL
-
-    # Loop through extensions and create them
-    for ext in $(echo "$extensions" | tr ',' ' '); do
-      echo "     - Installing extention $ext"
-      psql -v --username "$POSTGRES_USER" -d "$database" -c "CREATE EXTENSION $ext;"
-    done
-    }
-
-    if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then
-
-      # Parse the JSON string
-      database_names=$(echo "$POSTGRES_MULTIPLE_DATABASES" | jq -r '.[0] | keys[]')
-      echo "Multiple database creation requested: $(echo "$database_names" | tr "\n" " ")"
-
-      # Loop through each database and create it
-      for db_name in $database_names; do
-        user=$(echo "$POSTGRES_MULTIPLE_DATABASES" | jq -r ".[0] | .''${db_name} | .user")
-        extensions=$(echo "$POSTGRES_MULTIPLE_DATABASES" | jq -r ".[0] | .''${db_name} | .extensions | join(\",\")")
-        create_user_and_database "$db_name" "$user" "$extensions"
-      done
-    fi
-  '';
-
-  pg_hbaConfig = pkgs.writeText "pg_hba.conf" ''
-    none
-  '';
-
-  pgsqlConfig = pkgs.writeText "postgresql.conf" ''
-    listen_addresses = '*'
-    port = 5432
-    max_connections = 100
-    shared_buffers = 24GB
-    work_mem = 1GB
-    maintenance_work_mem = 10GB
-    autovacuum_work_mem = 2GB
-    dynamic_shared_memory_type = posix
-    wal_level = minimal
-    checkpoint_timeout = 60min
-    checkpoint_completion_target = 0.9
-    max_wal_size = 10GB
-    min_wal_size = 80MB
-    max_wal_senders = 0
-    random_page_cost = 1.0
-    effective_cache_size = 25GB
-    jit = off
-    log_line_prefix = '%m [%p] %q%u@%d '
-    log_timezone = 'Etc/UTC'
-    cluster_name = 'postgres-docker'
-    datestyle = 'iso, dmy'
-    timezone = 'Etc/UTC'
-    default_text_search_config = 'pg_catalog.english'
-  '';
-in {
-  sops.secrets = {
-    "software/postgres/admin_db/password" = {};
-  };
-  virtualisation.arion = {
-    backend = "docker";
-    projects = {
-      "db".settings.services."db".service = {
-        restart = "unless-stopped";
-        build.context = "/nix/store";
-        build.dockerfile = builtins.baseNameOf "${pkgs.writeText "pgDockerfile" ''
-          FROM postgres:16
-          # install packages
-          RUN apt-get update \
-              && apt-get install -y --no-install-recommends \
-                  postgresql-16-postgis \
-                  jq \
-              && rm -rf /var/lib/apt/lists/*
-        ''}";
-        command = ["postgres" "-c" "config_file=/etc/postgresql/postgresql.conf"];
-        environment = {
-          POSTGRES_PASSWORD_FILE = admin_dbPasswordFile;
-          POSTGRES_USER = "admin";
-          POSTGRES_DB = "admin_db";
-          PGDATA = "/var/lib/postgresql/data/pgdata";
-          POSTGRES_MULTIPLE_DATABASES = ''
-            [
-              {
-                "osm": {
-                  "user": "gis",
-                  "extensions": [
-                    "hstore",
-                    "postgis"
-                  ]
-                },
-                "bitcoin": {
-                  "user": "satoshi",
-                  "extensions": []
-                },
-                "btc_models": {
-                  "user": "dbt",
-                  "extensions": []
-                },
-                "dev_btc_models": {
-                  "user": "dbt",
-                  "extensions": []
-                }
-              }
-            ]
-          '';
-        };
-        ports = ["5432:5432"];
-        volumes = [
-          # Mount pgdata to external zfs volume
-          "/mnt/postgres:/var/lib/postgresql/data"
-
-          # Mount config files
-          # "${pg_hbaConfig}:/var/lib/postgres/data/pgdata/pg_hba.conf"
-          "${pgsqlConfig}:/etc/postgresql/postgresql.conf"
-
-          # Need to mount secret file
-          "${admin_dbPasswordFile}:${admin_dbPasswordFile}"
-
-          # PG init script to parse json specified in POSTGRES_MULTIPLE_DATABASES
-          # creates databases, users and installs extensions for each database.
-          "${initScript}:/docker-entrypoint-initdb.d/init.sh"
-        ];
-      };
-    };
-  };
-}

hosts/common/optional/nixos-containers/jellyfin.nix

@@ -0,0 +1,85 @@
+{
+  lib,
+  pkgs,
+  ...
+}: let
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  container_name = "jellyfin";
+  container_ip = "10.0.10.6";
+in {
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${container_name}"
+    ];
+  };
+
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "br0";
+
+  containers.${container_name} = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/var/lib/jellyfin" = {
+        hostPath = "/media/main-ssd/jellyfin";
+        isReadOnly = false;
+      };
+      "/var/lib/jellyfin/data/media" = {
+        hostPath = "/media/media";
+        isReadOnly = true;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      networking = {
+        defaultGateway = "10.0.10.1";
+        interfaces.eth0.ipv4.addresses = [
+          {
+            "address" = "${container_ip}";
+            "prefixLength" = 24;
+          }
+        ];
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            5432
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      services.jellyfin = {
+        enable = true;
+        openFirewall = true;
+        user="jellyfin";
+      };
+
+      environment.systemPackages = [
+        pkgs.jellyfin
+        pkgs.jellyfin-web
+        pkgs.jellyfin-ffmpeg
+      ];
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/optional/nixos-containers/nix-bitcoin.nix

@@ -0,0 +1,169 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  bitcoin-rpcpassword-privileged = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-rpcpassword-privileged".path;
+  bitcoin-rpcpassword-public = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-rpcpassword-public".path;
+  bitcoin-HMAC-privileged = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-HMAC-privileged".path;
+  bitcoin-HMAC-public = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-HMAC-public".path;
+  container_name = "bitcoin-node";
+  container_ip = "10.0.10.4";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+in {
+  sops.secrets = {
+    "software/bitcoind/bitcoin-rpcpassword-privileged" = {};
+    "software/bitcoind/bitcoin-rpcpassword-public" = {};
+    "software/bitcoind/bitcoin-HMAC-privileged" = {};
+    "software/bitcoind/bitcoin-HMAC-public" = {};
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${container_name}"
+    ];
+  };
+
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "br0";
+
+  containers.${container_name} = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/etc/nix-bitcoin-secrets/bitcoin-rpcpassword-privileged" = {
+        hostPath = "${bitcoin-rpcpassword-privileged}";
+        isReadOnly = false;
+      };
+      "/etc/nix-bitcoin-secrets/bitcoin-rpcpassword-public" = {
+        hostPath = "${bitcoin-rpcpassword-public}";
+        isReadOnly = false;
+      };
+      "/etc/nix-bitcoin-secrets/bitcoin-HMAC-privileged" = {
+        hostPath = "${bitcoin-HMAC-privileged}";
+        isReadOnly = false;
+      };
+      "/etc/nix-bitcoin-secrets/bitcoin-HMAC-public" = {
+        hostPath = "${bitcoin-HMAC-public}";
+        isReadOnly = false;
+      };
+      "/var/lib/bitcoind" = {
+        hostPath = "/media/main-ssd/nix-bitcoin/bitcoind";
+        isReadOnly = false;
+      };
+      "/var/lib/electrs" = {
+        hostPath = "/media/main-ssd/nix-bitcoin/electrs";
+        isReadOnly = false;
+      };
+      "/var/lib/mysql" = {
+        hostPath = "/media/main-ssd/nix-bitcoin/mysql";
+        isReadOnly = false;
+      };
+      "/var/lib/tor" = {
+        hostPath = "/media/main-ssd/nix-bitcoin/tor";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      imports = [
+        inputs.nix-bitcoin.nixosModules.default
+      ];
+      environment.systemPackages = with pkgs; [
+        vim
+        lsof
+        jq
+      ];
+      networking = {
+        defaultGateway = "10.0.10.1";
+        interfaces.eth0.ipv4.addresses = [ { "address" = "${container_ip}"; "prefixLength" = 24; } ];
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            80
+            443
+            22
+            config.containers.bitcoin-node.config.services.bitcoind.rpc.port
+            config.containers.bitcoin-node.config.services.mempool.frontend.port
+            config.containers.bitcoin-node.config.services.electrs.port
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      # node services here
+      nix-bitcoin.generateSecrets = true;
+      services = {
+        tor = {
+          enable = true;
+          client.enable = true;
+        };
+        bitcoind = {
+          tor.proxy = true;
+          tor.enforce = true;
+          enable = true;
+          dataDir = "/var/lib/bitcoind";
+          dbCache = 5000;
+          txindex = true;
+          rpc = {
+            address = "0.0.0.0";
+            threads = 6;
+            allowip = ["10.0.0.0/8"];
+            users = let
+              name = "bitcoin";
+            in {
+              privileged.name = name;
+              public.name = name;
+            };
+          };
+          extraConfig = ''
+            onlynet=onion
+            bind=127.0.0.1
+          '';
+        };
+        electrs = {
+          tor.enforce = true;
+          enable = true;
+          dataDir = "/var/lib/electrs";
+          address = "0.0.0.0";
+        };
+        mempool = {
+          enable = true;
+          electrumServer = "electrs";
+          frontend = {
+            port = 4080;
+            address = "0.0.0.0";
+          };
+        };
+      };
+      nix-bitcoin.onionServices = {
+        bitcoind.enable = true;
+        electrs.enable = true;
+        mempool-frontend.enable = true;
+      };
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/optional/nixos-containers/postgres.nix

@@ -0,0 +1,113 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  postgresPasswordPath = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/postgres/postgres/password".path;
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  container_name = "postgres";
+  container_ip = "10.0.10.5";
+in {
+  sops.secrets = {
+    "software/postgres/postgres/password" = {
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${container_name}"
+    ];
+  };
+
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "br0";
+
+  containers.${container_name} = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/var/lib/postgresql" = {
+        hostPath = "/media/main-ssd/postgresql";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      networking = {
+        defaultGateway = "10.0.10.1";
+        interfaces.eth0.ipv4.addresses = [
+          {
+            "address" = "${container_ip}";
+            "prefixLength" = 24;
+          }
+        ];
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            5432
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      environment.systemPackages = with pkgs; [
+        lsof
+      ];
+
+      services.postgresql = {
+        enable = true;
+        enableJIT = true;
+        package = pkgs.postgresql_16;
+        extraPlugins = with pkgs.postgresql_16.pkgs; [ postgis ];
+        settings = {
+          max_worker_processes = "12";
+          max_parallel_workers = "8";
+          max_parallel_workers_per_gather = "4";
+          max_connections = "100";
+          autovacuum_work_mem = "2GB";
+          shared_buffers = "32GB";
+          work_mem = "0.32GB";
+          maintenance_work_mem = "64MB";
+        };
+        authentication = pkgs.lib.mkOverride 10 ''
+          #type database  DBuser  auth-method
+          local all       all     trust
+        '';
+      };
+
+      systemd.services.postgresql.postStart = ''
+        $PSQL -tA <<'EOF'
+          DO $$
+          DECLARE password TEXT;
+          BEGIN
+            password := trim(both from replace(pg_read_file('${postgresPasswordPath}'), E'\n', '''));
+            EXECUTE format('ALTER ROLE postgres WITH PASSWORD '''%s''';', password);
+          END $$;
+        EOF
+      '';
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/users/keys/laptop@id_rsa.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDgPtDNQEN97mnrq/v9RPMUaSjLpIaF/ga/L41xETB9h0y5jdpPUMbZ6uTV6vW8Vm1YW2tzEs2l1lxb9yTrsK8hdVfz8/vWvDSbsUIJn3gOQSOTNQ+nNFFYlKqNhypK+3Mn8BD7EeJaLNK8Ahr/87PS0c/B5YN+TcntsEZpsXF7U2CCqMh559JXp1byie7DuwTYUdvjdDtCidYNphGoEljuzID+lJFBYsaa5SQFlmrr7HcQfaE/MwyxyPRryRnlO7E9k12BrL56UONYycyTf4dyK9MnhhO0wAkIoHyd46/sAdgvNrloY4I+WLjUOqKY6vys8kxG7xNcmN5XfeDJXrPMhW5N0Kz2dc/Yu8SOG8weCiz7uuDjcxYz9eK5cxKgg37A+drbgddoHTi7GCM5Q6wN2Jlig0++6Xo2CGOUKpNOmGBRGAjlIByXYWu1KFRBVclXZES/g38274gRihVk3WCbtLEUafS7wsl8ruMmecU7rhDL7fITd2hWvBkONpA7RxLlMTBfMAEXuq4hOystGZeZj7KusPG4purJDtT+3rCcl5LZ8cn4G5fvINTbXeix5pOz/TdSGNTSJW7ML2W0W6Q+2kVO0l2N/+6IA/rPa4j+AwTODBxWkWVHEBRncJ5hIh5iFz+dSnmllkwOi41tbDFmdGuDeyQ0dsq4wXrBzXGfxw== samual.shop@protonmail.com :: laptop

hosts/common/users/sam/default.nix

@@ -24,6 +24,7 @@ in {
       "scanner"
       "lp"
       "docker"
+      "podman"
     ];
   };
 

hosts/semita/default.nix

@@ -47,8 +47,16 @@ in {
     ../common/optional/nfs-mounts/homeshare.nix
     ../common/optional/printing.nix
     ../common/optional/docker
+    ../common/optional/nixos-containers/nix-bitcoin.nix
+    ../common/optional/nixos-containers/postgres.nix
+    ../common/optional/nixos-containers/jellyfin.nix
   ];
 
+  fileSystems."/media/main-ssd" = {
+    device = "/dev/disk/by-uuid/ba884006-e813-4b67-9fe6-62aea08b3b59";
+    fsType = "ext4";
+  };
+
   boot = {
     blacklistedKernelModules = ["snd_hda_intel" "snd_soc_skl"];
     kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
@@ -78,21 +86,42 @@ in {
     pkgs.sof-firmware
   ];
 
-  networking = {
+  # Add hardware support for intel gpus as specified here: https://nixos.wiki/wiki/Jellyfin
-    hostName = "semita";
+  nixpkgs.config.packageOverrides = pkgs: {
-    nameservers = ["10.0.10.60" "8.8.8.8"];
+    vaapiIntel = pkgs.vaapiIntel.override {enableHybridCodec = true;};
-    interfaces.eth0 = {
+  };
-      useDHCP = false;
+
-      ipv4.addresses = [
+  hardware.opengl = {
-        {
+    enable = true;
-          address = "10.0.10.3";
+    extraPackages = with pkgs; [
-          prefixLength = 24;
+      intel-media-driver
-        }
+      intel-vaapi-driver
+      vaapiVdpau
+      libvdpau-va-gl
+      intel-compute-runtime
+      # only available on unstable
+      unstable.vpl-gpu-rt
+      intel-media-sdk
     ];
   };
-    defaultGateway = {
+
-      address = "10.0.10.1";
+  networking = {
-      interface = "eth0";
+    hostName = "semita";
+    nameservers = ["10.0.10.60" "10.0.10.1" "8.8.8.8"];
+    defaultGateway = "10.0.10.1";
+    useDHCP = false;
+    bridges = {
+      br0 = {
+        interfaces = ["eth0"];
+      };
+    };
+    interfaces.br0 = {
+      ipv4.addresses = [
+        {
+          "address" = "10.0.10.3";
+          "prefixLength" = 24;
+        }
+      ];
     };
   };
 

justfile

@@ -23,6 +23,7 @@ update-flake:
 edit-sops:
   echo "Editing {{SOPS_FILE}}"
   nix-shell -p sops --run "SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt sops {{SOPS_FILE}}"
+  cd $(dirname {{SOPS_FILE}}) && git add . && git commit -m "autocommit" && git push
 
 # update keys in secrets.yaml and push to remote
 update-sops-secrets: