format all code with alejandra
This commit is contained in:
parent
fa0cda2673
commit
4f0d45e4d5
89 changed files with 1605 additions and 1298 deletions
|
|
@ -1,6 +1,4 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
{...}: {
|
||||
imports = [
|
||||
./vaultwarden.nix
|
||||
./fail2ban.nix
|
||||
|
|
|
|||
|
|
@ -1,10 +1,14 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.fail2ban;
|
||||
in {
|
||||
|
|
|
|||
|
|
@ -1,19 +1,24 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.fava;
|
||||
my = config.my;
|
||||
domain = config.networking.domain;
|
||||
secrets = config.my.secrets;
|
||||
in
|
||||
{
|
||||
options.my.services.fava = let inherit (lib) types; in {
|
||||
in {
|
||||
options.my.services.fava = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Fava";
|
||||
|
||||
home = mkOption {
|
||||
|
|
@ -39,7 +44,7 @@ in
|
|||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.fava = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
serviceConfig = {
|
||||
Environment = [];
|
||||
ExecStart = "${pkgs.fava}/bin/fava -H 127.0.0.1 -p ${toString cfg.port} ${cfg.home}/${cfg.filePath}";
|
||||
|
|
@ -55,7 +60,7 @@ in
|
|||
createHome = true;
|
||||
group = "fava";
|
||||
};
|
||||
users.groups.fava = { };
|
||||
users.groups.fava = {};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"fava.${domain}" = {
|
||||
|
|
|
|||
|
|
@ -1,18 +1,24 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.gitea;
|
||||
my = config.my;
|
||||
|
||||
domain = config.networking.domain;
|
||||
in {
|
||||
options.my.services.gitea = let inherit (lib) types; in {
|
||||
options.my.services.gitea = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Personal Git hosting with Gitea";
|
||||
|
||||
privatePort = mkOption {
|
||||
|
|
@ -33,11 +39,11 @@ in {
|
|||
|
||||
# the systemd service for the gitea module seems to hardcode the group as
|
||||
# gitea, so, uh, just in case?
|
||||
extraGroups = [ "gitea" ];
|
||||
extraGroups = ["gitea"];
|
||||
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.git = { };
|
||||
users.groups.git = {};
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
|
|
@ -88,7 +94,7 @@ in {
|
|||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
databases = [ "gitea" ];
|
||||
databases = ["gitea"];
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
|
|
|
|||
|
|
@ -1,10 +1,14 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.jellyfin;
|
||||
my = config.my;
|
||||
|
|
|
|||
|
|
@ -1,24 +1,28 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.lohr;
|
||||
my = config.my;
|
||||
domain = config.networking.domain;
|
||||
secrets = config.my.secrets;
|
||||
lohrPkg =
|
||||
let
|
||||
flake = builtins.getFlake "github:alarsyo/lohr?rev=58503cc8b95c8b627f6ae7e56740609e91f323cd";
|
||||
in
|
||||
lohrPkg = let
|
||||
flake = builtins.getFlake "github:alarsyo/lohr?rev=58503cc8b95c8b627f6ae7e56740609e91f323cd";
|
||||
in
|
||||
flake.defaultPackage."x86_64-linux"; # FIXME: use correct system
|
||||
in
|
||||
{
|
||||
options.my.services.lohr = let inherit (lib) types; in {
|
||||
in {
|
||||
options.my.services.lohr = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Lohr Mirroring Daemon";
|
||||
|
||||
home = mkOption {
|
||||
|
|
@ -38,7 +42,7 @@ in
|
|||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.lohr = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
serviceConfig = {
|
||||
Environment = [
|
||||
"ROCKET_PORT=${toString cfg.port}"
|
||||
|
|
@ -52,7 +56,7 @@ in
|
|||
User = "lohr";
|
||||
Group = "lohr";
|
||||
};
|
||||
path = [ pkgs.git ];
|
||||
path = [pkgs.git];
|
||||
};
|
||||
|
||||
users.users.lohr = {
|
||||
|
|
@ -61,7 +65,7 @@ in
|
|||
createHome = true;
|
||||
group = "lohr";
|
||||
};
|
||||
users.groups.lohr = { };
|
||||
users.groups.lohr = {};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"lohr.${domain}" = {
|
||||
|
|
|
|||
|
|
@ -7,24 +7,36 @@
|
|||
# - https://github.com/delroth/infra.delroth.net/blob/master/roles/matrix-synapse.nix
|
||||
# - https://nixos.org/manual/nixos/stable/index.html#module-services-matrix
|
||||
#
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
optionals
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.matrix;
|
||||
my = config.my;
|
||||
|
||||
federationPort = { public = 8448; private = 11338; };
|
||||
clientPort = { public = 443; private = 11339; };
|
||||
federationPort = {
|
||||
public = 8448;
|
||||
private = 11338;
|
||||
};
|
||||
clientPort = {
|
||||
public = 443;
|
||||
private = 11339;
|
||||
};
|
||||
domain = config.networking.domain;
|
||||
in {
|
||||
options.my.services.matrix = let inherit (lib) types; in {
|
||||
options.my.services.matrix = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Matrix Synapse";
|
||||
|
||||
secretConfigFile = mkOption {
|
||||
|
|
@ -41,7 +53,7 @@ in {
|
|||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
databases = [ "matrix-synapse" ];
|
||||
databases = ["matrix-synapse"];
|
||||
};
|
||||
|
||||
services.matrix-synapse = {
|
||||
|
|
@ -90,20 +102,30 @@ in {
|
|||
listeners = [
|
||||
# Federation
|
||||
{
|
||||
bind_addresses = [ "::1" ];
|
||||
bind_addresses = ["::1"];
|
||||
port = federationPort.private;
|
||||
tls = false; # Terminated by nginx.
|
||||
tls = false; # Terminated by nginx.
|
||||
x_forwarded = true;
|
||||
resources = [ { names = [ "federation" ]; compress = false; } ];
|
||||
resources = [
|
||||
{
|
||||
names = ["federation"];
|
||||
compress = false;
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
# Client
|
||||
{
|
||||
bind_addresses = [ "::1" ];
|
||||
bind_addresses = ["::1"];
|
||||
port = clientPort.private;
|
||||
tls = false; # Terminated by nginx.
|
||||
tls = false; # Terminated by nginx.
|
||||
x_forwarded = true;
|
||||
resources = [ { names = [ "client" ]; compress = false; } ];
|
||||
resources = [
|
||||
{
|
||||
names = ["client"];
|
||||
compress = false;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
|
|
@ -127,26 +149,32 @@ in {
|
|||
onlySSL = true;
|
||||
useACMEHost = domain;
|
||||
|
||||
locations =
|
||||
let
|
||||
proxyToClientPort = {
|
||||
proxyPass = "http://[::1]:${toString clientPort.private}";
|
||||
};
|
||||
in {
|
||||
# Or do a redirect instead of the 404, or whatever is appropriate
|
||||
# for you. But do not put a Matrix Web client here! See the
|
||||
# Element web section below.
|
||||
"/".return = "404";
|
||||
|
||||
"/_matrix" = proxyToClientPort;
|
||||
"/_synapse/client" = proxyToClientPort;
|
||||
locations = let
|
||||
proxyToClientPort = {
|
||||
proxyPass = "http://[::1]:${toString clientPort.private}";
|
||||
};
|
||||
in {
|
||||
# Or do a redirect instead of the 404, or whatever is appropriate
|
||||
# for you. But do not put a Matrix Web client here! See the
|
||||
# Element web section below.
|
||||
"/".return = "404";
|
||||
|
||||
"/_matrix" = proxyToClientPort;
|
||||
"/_synapse/client" = proxyToClientPort;
|
||||
};
|
||||
|
||||
listen = [
|
||||
{ addr = "0.0.0.0"; port = clientPort.public; ssl = true; }
|
||||
{ addr = "[::]"; port = clientPort.public; ssl = true; }
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = clientPort.public;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = clientPort.public;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
# same as above, but listening on the federation port
|
||||
|
|
@ -162,32 +190,37 @@ in {
|
|||
};
|
||||
|
||||
listen = [
|
||||
{ addr = "0.0.0.0"; port = federationPort.public; ssl = true; }
|
||||
{ addr = "[::]"; port = federationPort.public; ssl = true; }
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = federationPort.public;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = federationPort.public;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
"${domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = domain;
|
||||
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = { "m.server" = "matrix.${domain}:${toString federationPort.public}"; };
|
||||
in ''
|
||||
locations."= /.well-known/matrix/server".extraConfig = let
|
||||
server = {"m.server" = "matrix.${domain}:${toString federationPort.public}";};
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = { "base_url" = "https://matrix.${domain}"; };
|
||||
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
||||
};
|
||||
# ACAO required to allow element-web on any URL to request this json file
|
||||
in ''
|
||||
locations."= /.well-known/matrix/client".extraConfig = let
|
||||
client = {
|
||||
"m.homeserver" = {"base_url" = "https://matrix.${domain}";};
|
||||
"m.identity_server" = {"base_url" = "https://vector.im";};
|
||||
};
|
||||
# ACAO required to allow element-web on any URL to request this json file
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
|
|
@ -227,7 +260,7 @@ in {
|
|||
};
|
||||
|
||||
# For administration tools.
|
||||
environment.systemPackages = [ pkgs.matrix-synapse ];
|
||||
environment.systemPackages = [pkgs.matrix-synapse];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
clientPort.public
|
||||
|
|
@ -236,10 +269,11 @@ in {
|
|||
|
||||
my.services.restic-backup = let
|
||||
dataDir = config.services.matrix-synapse.dataDir;
|
||||
in mkIf cfg.enable {
|
||||
paths = [ dataDir ];
|
||||
# this is just caching for other servers media, doesn't need backup
|
||||
exclude = [ "${dataDir}/media/remote_*" ];
|
||||
};
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
paths = [dataDir];
|
||||
# this is just caching for other servers media, doesn't need backup
|
||||
exclude = ["${dataDir}/media/remote_*"];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,17 +1,21 @@
|
|||
{ config, lib, ... }:
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
mediaServices = builtins.attrValues {
|
||||
inherit (config.my.services)
|
||||
inherit
|
||||
(config.my.services)
|
||||
jellyfin
|
||||
transmission
|
||||
;
|
||||
;
|
||||
};
|
||||
needed = builtins.any (service: service.enable) mediaServices;
|
||||
in
|
||||
{
|
||||
config.users.groups.media = mkIf needed { };
|
||||
in {
|
||||
config.users.groups.media = mkIf needed {};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,24 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.miniflux;
|
||||
my = config.my;
|
||||
|
||||
domain = config.networking.domain;
|
||||
in {
|
||||
options.my.services.miniflux = let inherit (lib) types; in {
|
||||
options.my.services.miniflux = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Serve a Miniflux instance";
|
||||
|
||||
adminCredentialsFile = mkOption {
|
||||
|
|
@ -34,7 +40,7 @@ in {
|
|||
# services.postgresql is automatically enabled by services.miniflux, let's
|
||||
# back it up
|
||||
services.postgresqlBackup = {
|
||||
databases = [ "miniflux" ];
|
||||
databases = ["miniflux"];
|
||||
};
|
||||
|
||||
services.miniflux = {
|
||||
|
|
|
|||
|
|
@ -1,16 +1,22 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.monitoring;
|
||||
domain = config.networking.domain;
|
||||
in {
|
||||
options.my.services.monitoring = let inherit (lib) types; in {
|
||||
options.my.services.monitoring = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Enable monitoring";
|
||||
|
||||
domain = mkOption {
|
||||
|
|
@ -74,7 +80,7 @@ in {
|
|||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
enabledCollectors = ["systemd"];
|
||||
port = 9100;
|
||||
listenAddress = "127.0.0.1";
|
||||
};
|
||||
|
|
@ -87,9 +93,11 @@ in {
|
|||
scrapeConfigs = [
|
||||
{
|
||||
job_name = config.networking.hostName;
|
||||
static_configs = [{
|
||||
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
static_configs = [
|
||||
{
|
||||
targets = ["127.0.0.1:${toString config.services.prometheus.exporters.node.port}"];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,17 +1,23 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
optional
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.navidrome;
|
||||
domain = config.networking.domain;
|
||||
in {
|
||||
options.my.services.navidrome = let inherit (lib) types; in {
|
||||
options.my.services.navidrome = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Navidrome";
|
||||
musicFolder = {
|
||||
path = mkOption {
|
||||
|
|
@ -34,8 +40,8 @@ in {
|
|||
};
|
||||
|
||||
my.services.restic-backup = {
|
||||
paths = [ "/var/lib/navidrome" ] ++ optional cfg.musicFolder.backup cfg.musicFolder.path;
|
||||
exclude = [ "/var/lib/navidrome/cache" ];
|
||||
paths = ["/var/lib/navidrome"] ++ optional cfg.musicFolder.backup cfg.musicFolder.path;
|
||||
exclude = ["/var/lib/navidrome/cache"];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."music.${domain}" = {
|
||||
|
|
|
|||
|
|
@ -1,21 +1,26 @@
|
|||
{ lib, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
# TODO: setup prometheus exporter
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.nextcloud;
|
||||
my = config.my;
|
||||
domain = config.networking.domain;
|
||||
dbName = "nextcloud";
|
||||
in
|
||||
{
|
||||
options.my.services.nextcloud = let inherit (lib) types; in {
|
||||
in {
|
||||
options.my.services.nextcloud = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "NextCloud";
|
||||
|
||||
adminpassFile = mkOption {
|
||||
|
|
@ -31,7 +36,7 @@ in
|
|||
services.postgresql = {
|
||||
enable = true;
|
||||
|
||||
ensureDatabases = [ dbName ];
|
||||
ensureDatabases = [dbName];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
|
|
@ -43,13 +48,13 @@ in
|
|||
};
|
||||
|
||||
# not handled by module
|
||||
systemd.services.nextcloud-setup= {
|
||||
requires = [ "postgresql.service" ];
|
||||
after = [ "postgresql.service" ];
|
||||
systemd.services.nextcloud-setup = {
|
||||
requires = ["postgresql.service"];
|
||||
after = ["postgresql.service"];
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
databases = [ dbName ];
|
||||
databases = [dbName];
|
||||
};
|
||||
|
||||
services.nextcloud = {
|
||||
|
|
@ -87,16 +92,17 @@ in
|
|||
|
||||
my.services.restic-backup = let
|
||||
nextcloudHome = config.services.nextcloud.home;
|
||||
in mkIf cfg.enable {
|
||||
paths = [ nextcloudHome ];
|
||||
exclude = [
|
||||
# borg can fail if *.part files disappear during backup
|
||||
"${nextcloudHome}/data/*/uploads"
|
||||
# image previews can take up a lot of space
|
||||
"${nextcloudHome}/data/appdata_*/preview"
|
||||
# specific account for huge files I don't care about losing
|
||||
"${nextcloudHome}/data/misc"
|
||||
];
|
||||
};
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
paths = [nextcloudHome];
|
||||
exclude = [
|
||||
# borg can fail if *.part files disappear during backup
|
||||
"${nextcloudHome}/data/*/uploads"
|
||||
# image previews can take up a lot of space
|
||||
"${nextcloudHome}/data/appdata_*/preview"
|
||||
# specific account for huge files I don't care about losing
|
||||
"${nextcloudHome}/data/misc"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,20 @@
|
|||
# Part of config shamelessly stolen from:
|
||||
#
|
||||
# https://github.com/delroth/infra.delroth.net
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib)
|
||||
mkIf
|
||||
;
|
||||
in
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkIf
|
||||
;
|
||||
in {
|
||||
# Whenever something defines an nginx vhost, ensure that nginx defaults are
|
||||
# properly set.
|
||||
config = mkIf ((builtins.attrNames config.services.nginx.virtualHosts) != [ "localhost" ]) {
|
||||
config = mkIf ((builtins.attrNames config.services.nginx.virtualHosts) != ["localhost"]) {
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
statusPage = true; # For monitoring scraping.
|
||||
|
|
@ -21,7 +25,7 @@ in
|
|||
recommendedProxySettings = true;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
|
||||
services.prometheus = {
|
||||
exporters.nginx = {
|
||||
|
|
@ -32,12 +36,14 @@ in
|
|||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "nginx";
|
||||
static_configs = [{
|
||||
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}" ];
|
||||
labels = {
|
||||
instance = config.networking.hostName;
|
||||
};
|
||||
}];
|
||||
static_configs = [
|
||||
{
|
||||
targets = ["127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}"];
|
||||
labels = {
|
||||
instance = config.networking.hostName;
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
@ -46,18 +52,17 @@ in
|
|||
acceptTerms = true;
|
||||
defaults.email = "antoine97.martin@gmail.com";
|
||||
|
||||
certs =
|
||||
let
|
||||
domain = config.networking.domain;
|
||||
gandiKey = config.my.secrets.gandiKey;
|
||||
in {
|
||||
"${domain}" = {
|
||||
extraDomainNames = [ "*.${domain}" ];
|
||||
dnsProvider = "gandiv5";
|
||||
credentialsFile = config.age.secrets."gandi/api-key".path;
|
||||
group = "nginx";
|
||||
};
|
||||
certs = let
|
||||
domain = config.networking.domain;
|
||||
gandiKey = config.my.secrets.gandiKey;
|
||||
in {
|
||||
"${domain}" = {
|
||||
extraDomainNames = ["*.${domain}"];
|
||||
dnsProvider = "gandiv5";
|
||||
credentialsFile = config.age.secrets."gandi/api-key".path;
|
||||
group = "nginx";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,15 +1,17 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.nuage;
|
||||
my = config.my;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.my.services.nuage = {
|
||||
enable = mkEnableOption "Nuage redirect";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,19 +1,24 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.paperless;
|
||||
my = config.my;
|
||||
domain = config.networking.domain;
|
||||
paperlessDomain = "paperless.${domain}";
|
||||
in
|
||||
{
|
||||
options.my.services.paperless = let inherit (lib) types; in {
|
||||
in {
|
||||
options.my.services.paperless = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Paperless";
|
||||
|
||||
port = mkOption {
|
||||
|
|
@ -77,7 +82,7 @@ in
|
|||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "paperless" ];
|
||||
ensureDatabases = ["paperless"];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "paperless";
|
||||
|
|
@ -88,7 +93,7 @@ in
|
|||
|
||||
systemd.services.paperless-ng-server = {
|
||||
# Make sure the DB is available
|
||||
after = [ "postgresql.service" ];
|
||||
after = ["postgresql.service"];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
|
|
|
|||
|
|
@ -1,16 +1,20 @@
|
|||
{ config, lib, pkgs, options, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
options,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
optionalAttrs
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.pipewire;
|
||||
my = config.my;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.my.services.pipewire = {
|
||||
enable = mkEnableOption "Pipewire sound backend";
|
||||
};
|
||||
|
|
@ -37,6 +41,6 @@ in
|
|||
|
||||
# FIXME: a shame pactl isn't available by itself, eventually this should be
|
||||
# replaced by pw-cli or a wrapper, I guess?
|
||||
environment.systemPackages = [ pkgs.pulseaudio ];
|
||||
environment.systemPackages = [pkgs.pulseaudio];
|
||||
});
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,10 +1,14 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.postgresql-backup;
|
||||
in {
|
||||
|
|
@ -20,12 +24,11 @@ in {
|
|||
};
|
||||
|
||||
my.services.restic-backup = mkIf cfg.enable {
|
||||
paths = [ "/var/backup/postgresql" ];
|
||||
paths = ["/var/backup/postgresql"];
|
||||
|
||||
# no need to store previously backed up files, as borg does the snapshoting
|
||||
# for us
|
||||
exclude = [ "/var/backup/postgresql/*.prev.sql.gz" ];
|
||||
exclude = ["/var/backup/postgresql/*.prev.sql.gz"];
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
# set postgresql version so we don't get any bad surprise
|
||||
config.services.postgresql = {
|
||||
package = pkgs.postgresql_13;
|
||||
|
|
|
|||
|
|
@ -1,21 +1,27 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
attrsets
|
||||
concatStringsSep
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
optional
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.restic-backup;
|
||||
excludeArg = "--exclude-file=" + (pkgs.writeText "excludes.txt" (concatStringsSep "\n" cfg.exclude));
|
||||
makePruneOpts = pruneOpts:
|
||||
attrsets.mapAttrsToList (name: value: "--keep-${name} ${toString value}") pruneOpts;
|
||||
in {
|
||||
options.my.services.restic-backup = let inherit (lib) types; in {
|
||||
options.my.services.restic-backup = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Enable Restic backups for this host";
|
||||
|
||||
repo = mkOption {
|
||||
|
|
@ -23,12 +29,11 @@ in {
|
|||
default = null;
|
||||
example = "/mnt/hdd";
|
||||
description = "Restic backup repo";
|
||||
|
||||
};
|
||||
|
||||
paths = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
default = [];
|
||||
example = [
|
||||
"/var/lib"
|
||||
"/home"
|
||||
|
|
@ -38,7 +43,7 @@ in {
|
|||
|
||||
exclude = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
default = [];
|
||||
example = [
|
||||
# very large paths
|
||||
"/var/lib/docker"
|
||||
|
|
@ -81,7 +86,7 @@ in {
|
|||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [ pkgs.restic ];
|
||||
environment.systemPackages = [pkgs.restic];
|
||||
|
||||
services.restic.backups.backblaze = {
|
||||
initialize = true;
|
||||
|
|
@ -92,8 +97,9 @@ in {
|
|||
passwordFile = cfg.passwordFile;
|
||||
environmentFile = cfg.environmentFile;
|
||||
|
||||
extraBackupArgs = [ "--verbose=2" ]
|
||||
++ optional (builtins.length cfg.exclude != 0) excludeArg;
|
||||
extraBackupArgs =
|
||||
["--verbose=2"]
|
||||
++ optional (builtins.length cfg.exclude != 0) excludeArg;
|
||||
|
||||
timerConfig = cfg.timerConfig;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,14 +1,17 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.tailscale;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.my.services.tailscale = {
|
||||
enable = mkEnableOption "Tailscale";
|
||||
|
||||
|
|
@ -23,8 +26,8 @@ in
|
|||
};
|
||||
|
||||
networking.firewall = {
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
allowedUDPPorts = [ config.services.tailscale.port ];
|
||||
trustedInterfaces = ["tailscale0"];
|
||||
allowedUDPPorts = [config.services.tailscale.port];
|
||||
};
|
||||
|
||||
# enable IP forwarding to use as exit node
|
||||
|
|
|
|||
|
|
@ -1,15 +1,17 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.tgv;
|
||||
my = config.my;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.my.services.tgv = {
|
||||
enable = mkEnableOption "TGV redirect";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,11 +1,15 @@
|
|||
{ config, lib, ... }:
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
optionalAttrs
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.transmission;
|
||||
|
||||
|
|
@ -16,9 +20,10 @@ let
|
|||
transmissionPeerPort = 30251;
|
||||
|
||||
downloadBase = "/media/torrents/";
|
||||
in
|
||||
{
|
||||
options.my.services.transmission = let inherit (lib) types; in {
|
||||
in {
|
||||
options.my.services.transmission = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Transmission torrent client";
|
||||
|
||||
username = mkOption {
|
||||
|
|
@ -37,32 +42,34 @@ in
|
|||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.transmission = {
|
||||
enable = true;
|
||||
group = "media";
|
||||
services.transmission =
|
||||
{
|
||||
enable = true;
|
||||
group = "media";
|
||||
|
||||
settings = {
|
||||
download-dir = "${downloadBase}/complete";
|
||||
incomplete-dir = "${downloadBase}/incomplete";
|
||||
settings = {
|
||||
download-dir = "${downloadBase}/complete";
|
||||
incomplete-dir = "${downloadBase}/incomplete";
|
||||
|
||||
peer-port = transmissionPeerPort;
|
||||
peer-port = transmissionPeerPort;
|
||||
|
||||
rpc-enabled = true;
|
||||
rpc-port = transmissionRpcPort;
|
||||
rpc-authentication-required = false;
|
||||
rpc-enabled = true;
|
||||
rpc-port = transmissionRpcPort;
|
||||
rpc-authentication-required = false;
|
||||
|
||||
rpc-whitelist-enabled = true;
|
||||
rpc-whitelist = "127.0.0.1";
|
||||
rpc-whitelist-enabled = true;
|
||||
rpc-whitelist = "127.0.0.1";
|
||||
|
||||
rpc-host-whitelist-enabled = true;
|
||||
rpc-host-whitelist = webuiDomain;
|
||||
};
|
||||
rpc-host-whitelist-enabled = true;
|
||||
rpc-host-whitelist = webuiDomain;
|
||||
};
|
||||
|
||||
# automatically allow transmission.settings.peer-port
|
||||
openFirewall = true;
|
||||
} // (optionalAttrs (cfg.secretConfigFile != null) {
|
||||
credentialsFile = cfg.secretConfigFile;
|
||||
});
|
||||
# automatically allow transmission.settings.peer-port
|
||||
openFirewall = true;
|
||||
}
|
||||
// (optionalAttrs (cfg.secretConfigFile != null) {
|
||||
credentialsFile = cfg.secretConfigFile;
|
||||
});
|
||||
|
||||
services.nginx.virtualHosts."${webuiDomain}" = {
|
||||
forceSSL = true;
|
||||
|
|
|
|||
|
|
@ -1,18 +1,24 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
;
|
||||
|
||||
cfg = config.my.services.vaultwarden;
|
||||
my = config.my;
|
||||
|
||||
domain = config.networking.domain;
|
||||
in {
|
||||
options.my.services.vaultwarden = let inherit (lib) types; in {
|
||||
options.my.services.vaultwarden = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Vaultwarden";
|
||||
|
||||
privatePort = mkOption {
|
||||
|
|
@ -36,7 +42,7 @@ in {
|
|||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
databases = [ "vaultwarden" ];
|
||||
databases = ["vaultwarden"];
|
||||
};
|
||||
|
||||
services.vaultwarden = {
|
||||
|
|
@ -82,8 +88,8 @@ in {
|
|||
|
||||
# FIXME: should be renamed to vaultwarden eventually
|
||||
my.services.restic-backup = mkIf cfg.enable {
|
||||
paths = [ "/var/lib/bitwarden_rs" ];
|
||||
exclude = [ "/var/lib/bitwarden_rs/icon_cache" ];
|
||||
paths = ["/var/lib/bitwarden_rs"];
|
||||
exclude = ["/var/lib/bitwarden_rs/icon_cache"];
|
||||
};
|
||||
|
||||
services.fail2ban.jails = {
|
||||
|
|
@ -119,5 +125,4 @@ in {
|
|||
'';
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue