xyno/nix-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

meow

Browse source
This commit is contained in:
Lucy Hochkamp 2025-01-31 18:40:25 +01:00
parent 61b4ceedfa
commit c6fad213b4
3 changed files with 105 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

34
hosts/ds9/containers.nix
View file

@ -125,19 +125,31 @@ in
]; ];
}; };
# navidrome # navidrome
virtualisation.oci-containers.containers.navidrome = { virtualisation.oci-containers.containers.lms = {
user = "1000:100"; # don't tell mom
image = "deluan/navidrome:latest"; # user = "1000:100";
image = "epoupon/lms:latest";
cmd = ["/lms.conf"];
extraOptions = [ "--network=podman" ]; extraOptions = [ "--network=podman" ];
volumes = [ volumes =
"navidrome-data:/data" let
"/data/media/music:/music:ro" lmsConfig = pkgs.writeText "lms-config" ''
original-ip-header = "X-Forwarded-For";
behind-reverse-proxy = true;
trusted-proxies =
(
"10.88.0.1"
);
authentication-backend = "http-headers";
http-headers-login-field = "X-Webauth-User";
'';
in
[
"lightweight-music-server-data:/var/lms:rw"
"${lmsConfig}:/lms.conf"
"/data/media/beets/music:/music:ro"
]; ];
environment = { environment = { };
ND_SCANSCHEDULE = "1h";
ND_SESSIONTIMEOUT = "900h";
ND_BASEURL = "https://nd.hailsatan.eu";
};
}; };
# changedetection # changedetection

22
hosts/ds9/default.nix
View file

@ -120,6 +120,8 @@ in
ZED_SCRUB_AFTER_RESILVER = true; ZED_SCRUB_AFTER_RESILVER = true;
}; };
services.tailscaleAuth.enable = true;
services.tailscaleAuth.group = config.services.caddy.group;
systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.desec.path; systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.desec.path;
services.caddy = { services.caddy = {
# ragon.services.caddy is enabled # ragon.services.caddy is enabled
@ -154,9 +156,23 @@ in
} }
} }
} }
@nd host nd.hailsatan.eu @lms host lms.hailsatan.eu
handle @nd { handle @lms {
reverse_proxy http://navidrome:4533 { forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
uri /auth
header_up Remote-Addr {remote_host}
header_up Remote-Port {remote_port}
header_up Original-URI {uri}
copy_headers {
Tailscale-User>X-Webauth-User
Tailscale-Name>X-Webauth-Name
Tailscale-Login>X-Webauth-Login
Tailscale-Tailnet>X-Webauth-Tailnet
Tailscale-Profile-Picture>X-Webauth-Profile-Picture
}
}
reverse_proxy http://lms:5082 {
transport http { transport http {
resolvers 10.88.0.1 # podman dns resolvers 10.88.0.1 # podman dns
} }

2
hosts/theseus/default.nix
View file

@ -306,7 +306,7 @@
location.extraConfig.before_backup = [ "notify-send -u low -a borgmatic borgmatic \"starting backup\" -t 10000" ]; location.extraConfig.before_backup = [ "notify-send -u low -a borgmatic borgmatic \"starting backup\" -t 10000" ];
location.extraConfig.after_backup = [ "notify-send -u low -a borgmatic borgmatic \"finished backup\" -t 10000" ]; location.extraConfig.after_backup = [ "notify-send -u low -a borgmatic borgmatic \"finished backup\" -t 10000" ];
location.extraConfig.on_error = [ "notify-send -u critical -a borgmatic borgmatic \"backup failed\"" ]; location.extraConfig.on_error = [ "notify-send -u critical -a borgmatic borgmatic \"backup failed\"" ];
location.extraConfig.ssh_command = "ssh -i /home/ragon/.ssh/id_ed25519"; # location.extraConfig.ssh_command = "ssh -i /home/ragon/.ssh/id_ed25519";
location.extraConfig.one_file_system = true; location.extraConfig.one_file_system = true;
retention = { retention = {
keepHourly = 24; keepHourly = 24;