495 lines
14 KiB
Nix
495 lines
14 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
pubkeys = import ../../data/pubkeys.nix;
|
|
caddy-with-plugins = import ./custom-caddy.nix { inherit pkgs; };
|
|
in
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
|
|
./containers.nix
|
|
./backup.nix
|
|
./grist.nix
|
|
# ./plex.nix
|
|
./samba.nix
|
|
./paperless.nix
|
|
./maubot.nix
|
|
./woodpecker.nix
|
|
./attic.nix
|
|
./ytdl-sub.nix
|
|
./snipe-it.nix
|
|
./radicale.nix
|
|
./lms.nix
|
|
|
|
../../nixos-modules/networking/tailscale.nix
|
|
../../nixos-modules/services/docker.nix
|
|
../../nixos-modules/services/libvirt.nix
|
|
../../nixos-modules/services/msmtp.nix
|
|
# ../../nixos-modules/services/paperless.nix
|
|
# ../../nixos-modules/services/photoprism.nix
|
|
../../nixos-modules/services/samba.nix
|
|
../../nixos-modules/services/ssh.nix
|
|
../../nixos-modules/services/caddy
|
|
../../nixos-modules/system/agenix.nix
|
|
../../nixos-modules/system/fs.nix
|
|
../../nixos-modules/system/persist.nix
|
|
../../nixos-modules/system/security.nix
|
|
../../nixos-modules/user
|
|
];
|
|
|
|
# Don't Use the systemd-boot EFI boot loader.
|
|
boot.loader.systemd-boot.enable = true;
|
|
|
|
# power save stuffzies
|
|
services.udev.path = [ pkgs.hdparm ];
|
|
services.udev.extraRules = ''
|
|
ACTION=="add|change", KERNEL=="sd[a-z]", ATTRS{queue/rotational}=="1", RUN+="${pkgs.hdparm}/bin/hdparm -S 60 -B 100 /dev/%k"
|
|
'';
|
|
|
|
services.syncthing.enable = true;
|
|
services.syncthing.user = "ragon";
|
|
|
|
programs.mosh.enable = true;
|
|
security.sudo.wheelNeedsPassword = false;
|
|
networking.useDHCP = true;
|
|
networking.useNetworkd = true;
|
|
systemd.network.networks."enp1s0f1".ipv6AcceptRAConfig = {
|
|
Token = "prefixstable";
|
|
};
|
|
networking.bridges."br0".interfaces = [ ];
|
|
networking.hostId = "7b4c2932";
|
|
networking.firewall.allowedTCPPorts = [
|
|
9000
|
|
25565
|
|
80
|
|
443
|
|
];
|
|
networking.firewall.allowedUDPPorts = [ 443 ]; # http3 :3
|
|
boot.initrd.network = {
|
|
enable = true;
|
|
postCommands = ''
|
|
zpool import rpool
|
|
zpool import spool
|
|
echo "zfs load-key -a; killall zfs" >> /root/.profile
|
|
'';
|
|
ssh = {
|
|
enable = true;
|
|
port = 2222;
|
|
hostKeys = [
|
|
"/persistent/etc/nixos/secrets/initrd/ssh_host_rsa_key"
|
|
"/persistent/etc/nixos/secrets/initrd/ssh_host_ed25519_key"
|
|
];
|
|
authorizedKeys = pubkeys.ragon.computers;
|
|
|
|
};
|
|
|
|
};
|
|
boot.kernel.sysctl."fs.inotify.max_user_instances" = 512;
|
|
|
|
# Immutable users due to tmpfs
|
|
users.mutableUsers = false;
|
|
|
|
# users.users.nia = {
|
|
# createHome = true;
|
|
# isNormalUser = true;
|
|
# extraGroups = [
|
|
# "docker"
|
|
# "podman"
|
|
# "wheel"
|
|
# ];
|
|
# openssh.authorizedKeys.keys = [
|
|
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDq+jk1Bi8/x0lYDiVi/iVnp9nEleocoQ+xHmlpDt9Qs"
|
|
# ];
|
|
# };
|
|
users.users.bzzt = {
|
|
description = "bzzt server service user";
|
|
home = "/var/lib/bzzt";
|
|
createHome = true;
|
|
isSystemUser = true;
|
|
group = "bzzt";
|
|
};
|
|
users.groups.bzzt = { };
|
|
users.users.minecraft = {
|
|
description = "Minecraft server service user";
|
|
home = "/var/lib/minecraft";
|
|
createHome = true;
|
|
isSystemUser = true;
|
|
group = "minecraft";
|
|
};
|
|
users.groups.minecraft = { };
|
|
environment.systemPackages = [
|
|
pkgs.jdk17
|
|
pkgs.borgbackup
|
|
pkgs.beets
|
|
];
|
|
|
|
services.smartd = {
|
|
enable = true;
|
|
extraOptions = [ "--interval=7200" ];
|
|
notifications.test = true;
|
|
};
|
|
|
|
|
|
services.zfs.zed.enableMail = true;
|
|
services.zfs.zed.settings = {
|
|
ZED_EMAIL_ADDR = [ "root" ];
|
|
ZED_EMAIL_PROG = "${pkgs.msmtp}/bin/msmtp";
|
|
ZED_EMAIL_OPTS = "@ADDRESS@";
|
|
|
|
ZED_NOTIFY_INTERVAL_SECS = 7200;
|
|
ZED_NOTIFY_VERBOSE = true;
|
|
|
|
ZED_USE_ENCLOSURE_LEDS = false;
|
|
ZED_SCRUB_AFTER_RESILVER = true;
|
|
};
|
|
|
|
# dyndns
|
|
|
|
systemd.services."dyndns-refresh" = {
|
|
script = ''
|
|
set -eu
|
|
export PATH=$PATH:${pkgs.curl}/bin:${pkgs.jq}/bin:${pkgs.iproute2}/bin
|
|
${pkgs.bash}/bin/bash ${config.age.secrets.ds9DynDns.path}
|
|
'';
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "root";
|
|
};
|
|
startAt = "*:0/10";
|
|
};
|
|
|
|
# services.tailscaleAuth.enable = true;
|
|
# services.tailscaleAuth.group = config.services.caddy.group;
|
|
systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.desec.path;
|
|
services.caddy = {
|
|
# ragon.services.caddy is enabled
|
|
extraConfig = ''
|
|
(blockBots) {
|
|
@botForbidden header_regexp User-Agent "(?i)AdsBot-Google|Amazonbot|anthropic-ai|Applebot|Applebot-Extended|AwarioRssBot|AwarioSmartBot|Bytespider|CCBot|ChatGPT|ChatGPT-User|Claude-Web|ClaudeBot|cohere-ai|DataForSeoBot|Diffbot|FacebookBot|Google-Extended|GPTBot|ImagesiftBot|magpie-crawler|omgili|Omgilibot|peer39_crawler|PerplexityBot|YouBot"
|
|
|
|
handle @botForbidden {
|
|
redir https://hil-speed.hetzner.com/10GB.bin
|
|
}
|
|
handle /robots.txt {
|
|
respond <<TXT
|
|
User-Agent: *
|
|
Disallow: /
|
|
TXT 200
|
|
}
|
|
}
|
|
(podmanRedir) {
|
|
reverse_proxy {args[:]} {
|
|
transport http {
|
|
resolvers 10.88.0.1 # podman dns
|
|
}
|
|
}
|
|
}
|
|
(podmanRedirWithAuth) {
|
|
route {
|
|
# always forward outpost path to actual outpost
|
|
reverse_proxy /outpost.goauthentik.io/* http://authentik-server:9000 {
|
|
transport http {
|
|
resolvers 10.88.0.1 # podman dns
|
|
}
|
|
}
|
|
forward_auth http://authentik-server:9000 {
|
|
transport http {
|
|
resolvers 10.88.0.1 # podman dns
|
|
}
|
|
uri /outpost.goauthentik.io/auth/caddy
|
|
copy_headers {
|
|
X-Authentik-Username
|
|
X-Copyparty-Group
|
|
X-Authentik-Groups
|
|
X-Authentik-Entitlements
|
|
X-Authentik-Email
|
|
X-Authentik-Name
|
|
X-Authentik-Uid
|
|
X-Authentik-Jwt
|
|
X-Authentik-Meta-Jwks
|
|
X-Authentik-Meta-Outpost
|
|
X-Authentik-Meta-Provider
|
|
X-Authentik-Meta-App
|
|
X-Authentik-Meta-Version
|
|
X-Grafana-Role
|
|
X-Authentik-Username>X-Remote-User
|
|
}
|
|
}
|
|
reverse_proxy {args[:]} {
|
|
transport http {
|
|
resolvers 10.88.0.1 # podman dns
|
|
}
|
|
}
|
|
}
|
|
}
|
|
'';
|
|
globalConfig = ''
|
|
acme_ca https://acme-v02.api.letsencrypt.org/directory # hard coded so zerossl doesn't get used
|
|
acme_dns desec {
|
|
token "{$TOKEN}"
|
|
}
|
|
metrics {
|
|
per_host
|
|
}
|
|
servers {
|
|
trusted_proxies static 100.96.45.2/32 fd7a:115c:a1e0:ab12:4843:cd96:6260:2d02/128
|
|
}
|
|
'';
|
|
virtualHosts."*.hailsatan.eu ".logFormat = ''
|
|
output file ${config.services.caddy.logDir}/access-*hailsatan.eu_internet.log
|
|
'';
|
|
virtualHosts."*.hailsatan.eu ".extraConfig = ''
|
|
import blockBots
|
|
@blog host blog.hailsatan.eu
|
|
handle @blog {
|
|
route {
|
|
# always forward outpost path to actual outpost
|
|
reverse_proxy /outpost.goauthentik.io/* http://authentik-server:9000 {
|
|
transport http {
|
|
resolvers 10.88.0.1 # podman dns
|
|
}
|
|
}
|
|
forward_auth http://authentik-server:9000 {
|
|
transport http {
|
|
resolvers 10.88.0.1 # podman dns
|
|
}
|
|
uri /outpost.goauthentik.io/auth/caddy
|
|
copy_headers X-Authentik-Username X-Copyparty-Group X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version X-Grafana-Role
|
|
}
|
|
root * /srv/www/xynospace
|
|
file_server
|
|
|
|
}
|
|
}
|
|
@jellyfin host j.hailsatan.eu
|
|
handle @jellyfin {
|
|
handle /metrics* {
|
|
abort
|
|
}
|
|
import podmanRedir http://jellyfin:8096
|
|
}
|
|
@mautrix-signal host mautrix-signal.hailsatan.eu
|
|
handle @mautrix-signal {
|
|
import podmanRedir http://mautrix-signal:29328
|
|
}
|
|
@woodpecker host woodpecker.hailsatan.eu
|
|
handle @woodpecker {
|
|
import podmanRedir http://woodpecker-server:8000
|
|
}
|
|
@attic host attic.hailsatan.eu
|
|
handle @attic {
|
|
reverse_proxy http://[::1]:8089
|
|
}
|
|
@auth host auth.hailsatan.eu
|
|
handle @auth {
|
|
import podmanRedir http://authentik-server:9000
|
|
}
|
|
@radicale host radicale.hailsatan.eu
|
|
handle @radicale {
|
|
import podmanRedirWithAuth http://[::1]:5232
|
|
}
|
|
@grafana host grafana.hailsatan.eu
|
|
handle @grafana {
|
|
import podmanRedirWithAuth http://grafana:3000
|
|
}
|
|
@lms host lms.hailsatan.eu
|
|
handle @lms {
|
|
handle /rest* {
|
|
|
|
import podmanRedir http://localhost:5082
|
|
}
|
|
import podmanRedirWithAuth http://localhost:5082
|
|
}
|
|
@immich host immich.hailsatan.eu
|
|
handle @immich {
|
|
import podmanRedir http://immich-server:2283
|
|
}
|
|
@cd host cd.hailsatan.eu
|
|
handle @cd {
|
|
import podmanRedirWithAuth http://changedetection:5000
|
|
}
|
|
@node-red host node-red.hailsatan.eu
|
|
handle @node-red {
|
|
import podmanRedirWithAuth http://node-red:1880
|
|
}
|
|
@labello host labello.hailsatan.eu
|
|
handle @labello {
|
|
import podmanRedirWithAuth http://labello:4242
|
|
}
|
|
@paperless host paperless.hailsatan.eu
|
|
handle @paperless {
|
|
import podmanRedirWithAuth http://paperless-server:8000
|
|
}
|
|
@archivebox host archivebox.hailsatan.eu
|
|
handle @archivebox {
|
|
handle /api/* {
|
|
import podmanRedir http://archivebox:8000
|
|
}
|
|
handle {
|
|
import podmanRedirWithAuth http://archivebox:8000
|
|
}
|
|
}
|
|
@grist host grist.hailsatan.eu
|
|
handle @grist {
|
|
import podmanRedir http://grist:8484
|
|
|
|
}
|
|
@snipe-it host snipe-it.hailsatan.eu
|
|
handle @snipe-it {
|
|
root * ${pkgs.snipe-it}/share/php/snipe-it/public
|
|
php_fastcgi unix//${config.services.phpfpm.pools."snipe-it".socket}
|
|
file_server
|
|
}
|
|
@copyparty host c.hailsatan.eu
|
|
handle @copyparty {
|
|
# @proxy {
|
|
# header_regexp Cookie authentik_proxy_([a-zA-Z0-9])
|
|
# }
|
|
# handle @proxy {
|
|
# import podmanRedirWithAuth http://copyparty:3923
|
|
# }
|
|
handle /shr/* {
|
|
import podmanRedir http://copyparty:3923
|
|
}
|
|
handle /.cpr/* {
|
|
import podmanRedir http://copyparty:3923
|
|
}
|
|
# @noauth {
|
|
# path_regexp ^\/(noauth(\/.*|)|[a-z.]+\.(css|js)|[1-9].png)$
|
|
# }
|
|
# @getoptionshead {
|
|
# method GET OPTIONS HEAD
|
|
# }
|
|
# handle @noauth {
|
|
# handle @getoptionshead {
|
|
# import podmanRedir http://copyparty:3923
|
|
# }
|
|
# }
|
|
handle {
|
|
import podmanRedirWithAuth http://copyparty:3923
|
|
}
|
|
}
|
|
handle {
|
|
import podmanRedirWithAuth http://127.0.0.1:8001
|
|
}
|
|
'';
|
|
};
|
|
|
|
services.prometheus = {
|
|
enable = true;
|
|
exporters.node = {
|
|
enable = true;
|
|
enabledCollectors = [ "systemd" ];
|
|
};
|
|
exporters.postgres = {
|
|
enable = true;
|
|
environmentFile = config.age.secrets.ds9PostgresExporterEnv.path;
|
|
};
|
|
scrapeConfigs = [
|
|
{
|
|
job_name = "postgres";
|
|
static_configs = [
|
|
{
|
|
targets = [
|
|
"localhost:${toString config.services.prometheus.exporters.postgres.port}"
|
|
"picard.kangaroo-galaxy.ts.net:${toString config.services.prometheus.exporters.postgres.port}"
|
|
];
|
|
}
|
|
];
|
|
}
|
|
{
|
|
job_name = "caddy";
|
|
static_configs = [
|
|
{
|
|
targets = [
|
|
"localhost:2019"
|
|
"picard.kangaroo-galaxy.ts.net:2019"
|
|
];
|
|
}
|
|
];
|
|
}
|
|
{
|
|
job_name = "node";
|
|
static_configs = [
|
|
{
|
|
targets = [
|
|
"localhost:${toString config.services.prometheus.exporters.node.port}"
|
|
"picard.kangaroo-galaxy.ts.net:${toString config.services.prometheus.exporters.node.port}"
|
|
];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
};
|
|
|
|
home-manager.users.ragon =
|
|
{
|
|
pkgs,
|
|
lib,
|
|
inputs,
|
|
config,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
# ../../hm-modules/nvim
|
|
../../hm-modules/helix
|
|
# ../../hm-modules/zsh
|
|
../../hm-modules/tmux
|
|
# ../../hm-modules/xonsh
|
|
../../hm-modules/cli.nix
|
|
../../hm-modules/files.nix
|
|
];
|
|
# ragon.xonsh.enable = true;
|
|
|
|
programs.home-manager.enable = true;
|
|
home.stateVersion = "23.11";
|
|
};
|
|
|
|
# begin kube
|
|
# services.k3s = {
|
|
# enable = true;
|
|
# extraFlags = "--disable=traefik --cluster-cidr 10.42.0.0/16,2001:cafe:42::/56 --service-cidr=10.43.0.0/16,2001:cafe:43::/112 --vpn-auth-file=/persistent/tailscale-auth-file";
|
|
#};
|
|
# systemd.services.k3s.path = [pkgs.tailscale pkgs.coreutils pkgs.bash];
|
|
# end kube
|
|
|
|
ragon = {
|
|
agenix.secrets."desec" = { };
|
|
agenix.secrets."ds9DynDns" = { };
|
|
agenix.secrets."ds9PostgresExporterEnv" = { };
|
|
user.enable = true;
|
|
persist.enable = true;
|
|
persist.extraDirectories = [
|
|
"/home/nia"
|
|
"/var/lib/syncthing"
|
|
"/var/lib/minecraft"
|
|
"/var/lib/bzzt"
|
|
"/var/lib/rancher"
|
|
"/etc/rancher"
|
|
"/root/.cache"
|
|
"/srv/www"
|
|
"/var/lib/${config.services.prometheus.stateDir}"
|
|
];
|
|
|
|
services = {
|
|
caddy.enable = true;
|
|
docker.enable = true;
|
|
ssh.enable = true;
|
|
msmtp.enable = true;
|
|
# photoprism.enable = true;
|
|
tailscale.enable = true;
|
|
tailscale.exitNode = true;
|
|
tailscale.extraUpCommands = "--advertise-routes=10.0.0.0/16";
|
|
# libvirt.enable = true;
|
|
# paperless.enable = true;
|
|
};
|
|
|
|
};
|
|
}
|