alarsyo/nixos-config
alarsyo/nixos-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Compare commits

base: alarsyo:e635fec1f97e276d491a7bdd9e9826f3368f7850
Branches Tags
alarsyo:main
alarsyo:framework
alarsyo:matrix-synapse-auto-compress
alarsyo:tmux-thumbs
..
compare: alarsyo:baa239dc72559b4bb1e002e30a501eae6bfaf8e1
Branches Tags
alarsyo:main
alarsyo:framework
alarsyo:matrix-synapse-auto-compress
alarsyo:tmux-thumbs

No commits in common. "e635fec1f97e276d491a7bdd9e9826f3368f7850" and "baa239dc72559b4bb1e002e30a501eae6bfaf8e1" have entirely different histories.
e635fec1f9 ... baa239dc72

14 changed files with 24 additions and 79 deletions
Show stats Expand all files Collapse all files

12
flake.lock
View file

@ -109,11 +109,11 @@
},
"nixpkgs-unstable-small": {
"locked": {
"lastModified": 1655000332,
"narHash": "sha256-G4rs6nRox0146D6uI+zLxl8PwKXEO4PngyNXtY82DJI=",
"lastModified": 1654819923,
"narHash": "sha256-s3m3dbCVWw7XAFbkIJyPKtlqgbcDD+2BrBOGTRn0fIw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d64abb978cc2fa4b88b074a64d1b456183c8db17",
"rev": "a58de450c514aa1bc5a4999f92656ab6b600dc59",
"type": "github"
},
"original": {
@ -125,11 +125,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1654953433,
"narHash": "sha256-TwEeh4r50NdWHFAHQSyjCk2cZxgwUfcCCAJOhPdXB28=",
"lastModified": 1654682581,
"narHash": "sha256-Jb1PQCwKgwdNAp907eR5zPzuxV+kRroA3UIxUxCMJ9s=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "90cd5459a1fd707819b9a3fb9c852beaaac3b79a",
"rev": "e0169d7a9d324afebf5679551407756c77af8930",
"type": "github"
},
"original": {

8
services/fava.nix
View file

@ -13,11 +13,7 @@
cfg = config.my.services.fava;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
secrets = config.my.secrets;
in {
options.my.services.fava = let
@ -69,7 +65,7 @@ in {
services.nginx.virtualHosts = {
"fava.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
listen = [
# FIXME: hardcoded tailscale IP
@ -90,7 +86,5 @@ in {
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["fava.${domain}"];
};
}

6
services/gitea/default.nix
View file

@ -15,8 +15,6 @@
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
options.my.services.gitea = let
inherit (lib) types;
@ -103,7 +101,7 @@ in {
virtualHosts = {
"git.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
@ -112,8 +110,6 @@ in {
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
systemd.services.gitea.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.gitea.stateDir}/custom/templates";
};
}

6
services/jellyfin.nix
View file

@ -14,8 +14,6 @@
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
# hardcoded in NixOS module :(
jellyfinPort = 8096;
@ -33,14 +31,12 @@ in {
# Proxy to Jellyfin
services.nginx.virtualHosts."jellyfin.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."/" = {
proxyPass = "http://localhost:${toString jellyfinPort}/";
proxyWebsockets = true;
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["jellyfin.${domain}"];
};
}

8
services/lohr.nix
View file

@ -13,11 +13,7 @@
cfg = config.my.services.lohr;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
secrets = config.my.secrets;
lohrPkg = let
flake = builtins.getFlake "github:alarsyo/lohr?rev=58503cc8b95c8b627f6ae7e56740609e91f323cd";
@ -77,14 +73,12 @@ in {
services.nginx.virtualHosts = {
"lohr.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.port}";
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["lohr.${domain}"];
};
}

13
services/matrix.nix
View file

@ -32,10 +32,7 @@
public = 443;
private = 11339;
};
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
options.my.services.matrix = let
inherit (lib) types;
@ -150,7 +147,7 @@ in {
virtualHosts = {
"matrix.${domain}" = {
onlySSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations = let
proxyToClientPort = {
@ -184,7 +181,7 @@ in {
"matrix.${domain}_federation" = rec {
onlySSL = true;
serverName = "matrix.${domain}";
useACMEHost = fqdn;
useACMEHost = domain;
locations."/".return = "404";
@ -208,7 +205,7 @@ in {
"${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."= /.well-known/matrix/server".extraConfig = let
server = {"m.server" = "matrix.${domain}:${toString federationPort.public}";};
@ -233,7 +230,7 @@ in {
# Element Web app deployment
#
"chat.${domain}" = {
useACMEHost = fqdn;
useACMEHost = domain;
forceSSL = true;
root = pkgs.element-web.override {
@ -262,8 +259,6 @@ in {
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["chat.${domain}" "matrix.${domain}" domain];
# For administration tools.
environment.systemPackages = [pkgs.matrix-synapse];

6
services/miniflux.nix
View file

@ -15,8 +15,6 @@
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
options.my.services.miniflux = let
inherit (lib) types;
@ -62,7 +60,7 @@ in {
virtualHosts = {
"reader.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
@ -70,7 +68,5 @@ in {
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["reader.${domain}"];
};
}

8
services/monitoring.nix
View file

@ -13,8 +13,6 @@
cfg = config.my.services.monitoring;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
options.my.services.monitoring = let
inherit (lib) types;
@ -105,17 +103,15 @@ in {
};
services.nginx = {
virtualHosts.${cfg.domain} = {
virtualHosts.${config.services.grafana.domain} = {
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
proxyWebsockets = true;
};
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
};
};
security.acme.certs.${fqdn}.extraDomainNames = [cfg.domain];
};
}

6
services/navidrome.nix
View file

@ -14,8 +14,6 @@
cfg = config.my.services.navidrome;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
options.my.services.navidrome = let
inherit (lib) types;
@ -48,7 +46,7 @@ in {
services.nginx.virtualHosts."music.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
listen = [
# FIXME: hardcoded tailscale IP
@ -69,7 +67,5 @@ in {
proxyWebsockets = true;
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["music.${domain}"];
};
}

6
services/nextcloud.nix
View file

@ -16,8 +16,6 @@ let
cfg = config.my.services.nextcloud;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
dbName = "nextcloud";
in {
options.my.services.nextcloud = let
@ -87,13 +85,11 @@ in {
virtualHosts = {
"cloud.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["cloud.${domain}"];
my.services.restic-backup = let
nextcloudHome = config.services.nextcloud.home;
in

5
services/nginx.nix
View file

@ -54,11 +54,10 @@ in {
certs = let
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
gandiKey = config.my.secrets.gandiKey;
in {
"${fqdn}" = {
"${domain}" = {
extraDomainNames = ["*.${domain}"];
dnsProvider = "gandiv5";
credentialsFile = config.age.secrets."gandi/api-key".path;
group = "nginx";

6
services/paperless.nix
View file

@ -14,8 +14,6 @@
cfg = config.my.services.paperless;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
paperlessDomain = "paperless.${domain}";
in {
options.my.services.paperless = let
@ -101,7 +99,7 @@ in {
services.nginx.virtualHosts = {
"${paperlessDomain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
listen = [
# FIXME: hardcoded tailscale IP
@ -124,8 +122,6 @@ in {
};
};
security.acme.certs.${fqdn}.extraDomainNames = [paperlessDomain];
my.services.restic-backup = mkIf cfg.enable {
paths = [
config.services.paperless.dataDir

7
services/transmission.nix
View file

@ -14,8 +14,6 @@
cfg = config.my.services.transmission;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
webuiDomain = "transmission.${domain}";
transmissionRpcPort = 9091;
@ -75,7 +73,7 @@ in {
services.nginx.virtualHosts."${webuiDomain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."/".proxyPass = "http://127.0.0.1:${toString transmissionRpcPort}";
@ -93,8 +91,5 @@ in {
}
];
};
security.acme.certs.${fqdn}.extraDomainNames = [webuiDomain];
};
}

6
services/vaultwarden.nix
View file

@ -15,8 +15,6 @@
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
options.my.services.vaultwarden = let
inherit (lib) types;
@ -70,7 +68,7 @@ in {
virtualHosts = {
"pass.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
useACMEHost = domain;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
@ -88,8 +86,6 @@ in {
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["pass.${domain}"];
# FIXME: should be renamed to vaultwarden eventually
my.services.restic-backup = mkIf cfg.enable {
paths = ["/var/lib/bitwarden_rs"];