treewide: format
All checks were successful
Check flake / build-amd64-linux (push) Successful in 2m53s
All checks were successful
Check flake / build-amd64-linux (push) Successful in 2m53s
This commit is contained in:
@ -1,9 +1,15 @@
|
||||
{ config, lib, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.borgmatic;
|
||||
hostname = config.networking.hostName;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.borgmatic = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
@ -12,7 +18,7 @@ in {
|
||||
};
|
||||
directories = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [];
|
||||
default = [ ];
|
||||
example = [
|
||||
"/home/jordan/Documents"
|
||||
];
|
||||
@ -35,9 +41,14 @@ in {
|
||||
settings = {
|
||||
source_directories = cfg.directories;
|
||||
repositories = [
|
||||
{ label = "borgbase"; path = cfg.repoPath; }
|
||||
{
|
||||
label = "borgbase";
|
||||
path = cfg.repoPath;
|
||||
}
|
||||
];
|
||||
encryption_passcommand = "cat ${config.age.secrets."passwords/services/borg/${hostname}-passphrase".path}";
|
||||
encryption_passcommand = "cat ${
|
||||
config.age.secrets."passwords/services/borg/${hostname}-passphrase".path
|
||||
}";
|
||||
ssh_command = "ssh -i /etc/ssh/ssh_host_ed25519_key";
|
||||
keep_daily = 7;
|
||||
keep_weekly = 4;
|
||||
|
||||
@ -1,10 +1,16 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.modules.services.chrony;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.chrony = {
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
|
||||
@ -1,8 +1,14 @@
|
||||
{ config, lib, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.coturn;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.coturn = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
@ -21,24 +27,28 @@ in {
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall = let
|
||||
range = with config.services.coturn; lib.singleton {
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
networking.firewall =
|
||||
let
|
||||
range =
|
||||
with config.services.coturn;
|
||||
lib.singleton {
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
};
|
||||
in
|
||||
{
|
||||
allowedTCPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # STUN TLS
|
||||
5350 # STUN TLS alt
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # TLS
|
||||
5350 # TLS alt
|
||||
];
|
||||
allowedUDPPortRanges = range; # TURN peer relays
|
||||
};
|
||||
in {
|
||||
allowedTCPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # STUN TLS
|
||||
5350 # STUN TLS alt
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # TLS
|
||||
5350 # TLS alt
|
||||
];
|
||||
allowedUDPPortRanges = range; # TURN peer relays
|
||||
};
|
||||
|
||||
security.acme.certs = {
|
||||
"${config.services.coturn.realm}" = {
|
||||
@ -47,19 +57,26 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets = {
|
||||
"passwords/services/coturn/static-auth-secret" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
|
||||
owner = "turnserver";
|
||||
group = "turnserver";
|
||||
};
|
||||
} // (if cfg.matrixIntegration then {
|
||||
"passwords/services/coturn/matrix-turn-config.yml" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
} else {});
|
||||
age.secrets =
|
||||
{
|
||||
"passwords/services/coturn/static-auth-secret" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
|
||||
owner = "turnserver";
|
||||
group = "turnserver";
|
||||
};
|
||||
}
|
||||
// (
|
||||
if cfg.matrixIntegration then
|
||||
{
|
||||
"passwords/services/coturn/matrix-turn-config.yml" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
}
|
||||
else
|
||||
{ }
|
||||
);
|
||||
|
||||
services.coturn = rec {
|
||||
enable = true;
|
||||
|
||||
@ -1,4 +1,10 @@
|
||||
{ pkgs, config, lib, self, ... }:
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
# Based on: https://git.clan.lol/clan/clan-infra/src/branch/main/modules/web01/gitea/actions-runner.nix
|
||||
|
||||
@ -52,7 +58,12 @@ in
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "podman.service" ];
|
||||
requires = [ "podman.service" ];
|
||||
path = [ config.virtualisation.podman.package pkgs.gnutar pkgs.shadow pkgs.getent ];
|
||||
path = [
|
||||
config.virtualisation.podman.package
|
||||
pkgs.gnutar
|
||||
pkgs.shadow
|
||||
pkgs.getent
|
||||
];
|
||||
script = ''
|
||||
set -eux -o pipefail
|
||||
mkdir -p etc/nix
|
||||
@ -142,7 +153,12 @@ in
|
||||
"~setdomainname"
|
||||
"~sethostname"
|
||||
];
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
"AF_NETLINK"
|
||||
];
|
||||
|
||||
# Needs network access
|
||||
PrivateNetwork = false;
|
||||
|
||||
@ -1,8 +1,15 @@
|
||||
{ config, lib, pkgs, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.gitea;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.gitea = {
|
||||
enable = lib.mkEnableOption "gitea";
|
||||
domain = lib.mkOption {
|
||||
@ -16,7 +23,7 @@ in {
|
||||
users.git = {
|
||||
isSystemUser = true;
|
||||
useDefaultShell = true;
|
||||
group = "git";
|
||||
group = "git";
|
||||
extraGroups = [ "gitea" ];
|
||||
home = config.services.gitea.stateDir;
|
||||
};
|
||||
|
||||
@ -1,9 +1,15 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.headscale;
|
||||
fqdn = "headscale.vimium.net";
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.headscale = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
||||
@ -1,4 +1,9 @@
|
||||
{ config, lib, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.mail;
|
||||
@ -14,7 +19,8 @@ let
|
||||
"vimium.org"
|
||||
"vimium.xyz"
|
||||
];
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.mail = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
@ -40,7 +46,10 @@ in {
|
||||
|
||||
services.nginx.enable = true;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
|
||||
mailserver = {
|
||||
enable = true;
|
||||
|
||||
@ -1,8 +1,15 @@
|
||||
{ config, lib, pkgs, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.matrix;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.matrix = {
|
||||
enable = lib.mkEnableOption "matrix";
|
||||
element = {
|
||||
@ -31,198 +38,212 @@ in {
|
||||
usePostgresql = lib.mkEnableOption "postgresql";
|
||||
};
|
||||
|
||||
config = let
|
||||
matrixSubdomain = "matrix.${cfg.serverName}";
|
||||
elementSubdomain = "chat.${cfg.serverName}";
|
||||
matrixClientConfig = {
|
||||
"m.homeserver" = {
|
||||
base_url = "https://${matrixSubdomain}";
|
||||
server_name = cfg.serverName;
|
||||
};
|
||||
"m.identity_server" = {
|
||||
"base_url" = "https://vector.im";
|
||||
};
|
||||
};
|
||||
matrixServerConfig."m.server" = "${matrixSubdomain}:443";
|
||||
commonBridgeSettings = bridge: {
|
||||
appservice = {
|
||||
database = lib.mkIf cfg.usePostgresql {
|
||||
type = "postgres";
|
||||
uri = "postgresql:///${bridge}?host=/run/postgresql";
|
||||
config =
|
||||
let
|
||||
matrixSubdomain = "matrix.${cfg.serverName}";
|
||||
elementSubdomain = "chat.${cfg.serverName}";
|
||||
matrixClientConfig = {
|
||||
"m.homeserver" = {
|
||||
base_url = "https://${matrixSubdomain}";
|
||||
server_name = cfg.serverName;
|
||||
};
|
||||
"m.identity_server" = {
|
||||
"base_url" = "https://vector.im";
|
||||
};
|
||||
};
|
||||
bridge = {
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
require = true;
|
||||
};
|
||||
permissions = {
|
||||
"${cfg.serverName}" = "user";
|
||||
"@jordan:${cfg.serverName}" = "admin";
|
||||
};
|
||||
provisioning = {
|
||||
shared_secret = "disable";
|
||||
};
|
||||
};
|
||||
homeserver = {
|
||||
address = "https://${matrixSubdomain}";
|
||||
domain = cfg.serverName;
|
||||
};
|
||||
};
|
||||
in lib.mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
8448 # Matrix federation
|
||||
];
|
||||
|
||||
security.acme.certs = {
|
||||
"${matrixSubdomain}" = {
|
||||
reloadServices = [ "matrix-synapse" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"${matrixSubdomain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 80;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::1]";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::1]";
|
||||
port = 80;
|
||||
}
|
||||
{
|
||||
addr = "[::1]";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://localhost:8008";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
'';
|
||||
matrixServerConfig."m.server" = "${matrixSubdomain}:443";
|
||||
commonBridgeSettings = bridge: {
|
||||
appservice = {
|
||||
database = lib.mkIf cfg.usePostgresql {
|
||||
type = "postgres";
|
||||
uri = "postgresql:///${bridge}?host=/run/postgresql";
|
||||
};
|
||||
"/_matrix" = {
|
||||
proxyPass = "http://localhost:8008";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
client_max_body_size 50M;
|
||||
'';
|
||||
};
|
||||
bridge = {
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
require = true;
|
||||
};
|
||||
"/_synapse/client".proxyPass = "http://localhost:8008";
|
||||
permissions = {
|
||||
"${cfg.serverName}" = "user";
|
||||
"@jordan:${cfg.serverName}" = "admin";
|
||||
};
|
||||
provisioning = {
|
||||
shared_secret = "disable";
|
||||
};
|
||||
};
|
||||
homeserver = {
|
||||
address = "https://${matrixSubdomain}";
|
||||
domain = cfg.serverName;
|
||||
};
|
||||
};
|
||||
"${cfg.serverName}" = let
|
||||
mkWellKnown = data: ''
|
||||
more_set_headers 'Content-Type: application/json';
|
||||
return 200 '${builtins.toJSON data}';
|
||||
'';
|
||||
in {
|
||||
locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
|
||||
locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
|
||||
in
|
||||
lib.mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
8448 # Matrix federation
|
||||
];
|
||||
|
||||
security.acme.certs = {
|
||||
"${matrixSubdomain}" = {
|
||||
reloadServices = [ "matrix-synapse" ];
|
||||
};
|
||||
};
|
||||
} // (if cfg.element.enable then {
|
||||
"${elementSubdomain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
root = pkgs.unstable.element-web.override {
|
||||
conf = {
|
||||
default_server_config = matrixClientConfig;
|
||||
brand = "Vimium Chat";
|
||||
branding = {
|
||||
auth_header_logo_url = "https://vimium.com/images/logo.svg";
|
||||
auth_footer_links = [
|
||||
{ "text" = "Vimium.com"; "url" = "https://vimium.com"; }
|
||||
];
|
||||
|
||||
services.nginx.virtualHosts =
|
||||
{
|
||||
"${matrixSubdomain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 80;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::1]";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "[::1]";
|
||||
port = 80;
|
||||
}
|
||||
{
|
||||
addr = "[::1]";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://localhost:8008";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
'';
|
||||
};
|
||||
"/_matrix" = {
|
||||
proxyPass = "http://localhost:8008";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
client_max_body_size 50M;
|
||||
'';
|
||||
};
|
||||
"/_synapse/client".proxyPass = "http://localhost:8008";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
} else {});
|
||||
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"jitsi-meet-1.0.8043"
|
||||
"olm-3.2.16"
|
||||
];
|
||||
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
enableRegistrationScript = true;
|
||||
settings = {
|
||||
database.name = (if cfg.usePostgresql then "psycopg2" else "sqlite3");
|
||||
enable_metrics = false;
|
||||
enable_registration = false;
|
||||
max_upload_size = "100M";
|
||||
report_stats = false;
|
||||
server_name = cfg.serverName;
|
||||
};
|
||||
};
|
||||
systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =
|
||||
(lib.optional cfg.bridges.whatsapp
|
||||
config.systemd.services.mautrix-whatsapp.serviceConfig.Group);
|
||||
|
||||
services.postgresql = lib.mkIf cfg.usePostgresql {
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "matrix-synapse";
|
||||
ensureDBOwnership = true;
|
||||
"${cfg.serverName}" =
|
||||
let
|
||||
mkWellKnown = data: ''
|
||||
more_set_headers 'Content-Type: application/json';
|
||||
return 200 '${builtins.toJSON data}';
|
||||
'';
|
||||
in
|
||||
{
|
||||
locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
|
||||
locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
|
||||
};
|
||||
}
|
||||
] ++ (lib.optional cfg.bridges.signal
|
||||
{
|
||||
name = "mautrix-signal";
|
||||
ensureDBOwnership = true;
|
||||
})
|
||||
++ (lib.optional cfg.bridges.whatsapp
|
||||
{
|
||||
name = "mautrix-whatsapp";
|
||||
ensureDBOwnership = true;
|
||||
});
|
||||
ensureDatabases = [
|
||||
"matrix-synapse"
|
||||
] ++ (lib.optional cfg.bridges.signal
|
||||
"mautrix-signal")
|
||||
++ (lib.optional cfg.bridges.whatsapp
|
||||
"mautrix-whatsapp");
|
||||
};
|
||||
// (
|
||||
if cfg.element.enable then
|
||||
{
|
||||
"${elementSubdomain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
root = pkgs.unstable.element-web.override {
|
||||
conf = {
|
||||
default_server_config = matrixClientConfig;
|
||||
brand = "Vimium Chat";
|
||||
branding = {
|
||||
auth_header_logo_url = "https://vimium.com/images/logo.svg";
|
||||
auth_footer_links = [
|
||||
{
|
||||
"text" = "Vimium.com";
|
||||
"url" = "https://vimium.com";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
else
|
||||
{ }
|
||||
);
|
||||
|
||||
services.mautrix-signal = lib.mkIf cfg.bridges.signal {
|
||||
enable = true;
|
||||
settings = commonBridgeSettings "mautrix-signal";
|
||||
};
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"jitsi-meet-1.0.8043"
|
||||
"olm-3.2.16"
|
||||
];
|
||||
|
||||
services.mautrix-whatsapp = lib.mkIf cfg.bridges.whatsapp {
|
||||
enable = true;
|
||||
settings = {
|
||||
bridge = {
|
||||
history_sync = {
|
||||
backfill = true;
|
||||
max_initial_conversations = -1;
|
||||
message_count = 50;
|
||||
request_full_sync = true;
|
||||
};
|
||||
mute_bridging = true;
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
enableRegistrationScript = true;
|
||||
settings = {
|
||||
database.name = (if cfg.usePostgresql then "psycopg2" else "sqlite3");
|
||||
enable_metrics = false;
|
||||
enable_registration = false;
|
||||
max_upload_size = "100M";
|
||||
report_stats = false;
|
||||
server_name = cfg.serverName;
|
||||
};
|
||||
} // commonBridgeSettings "mautrix-whatsapp";
|
||||
};
|
||||
systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = (
|
||||
lib.optional cfg.bridges.whatsapp config.systemd.services.mautrix-whatsapp.serviceConfig.Group
|
||||
);
|
||||
|
||||
services.postgresql = lib.mkIf cfg.usePostgresql {
|
||||
ensureUsers =
|
||||
[
|
||||
{
|
||||
name = "matrix-synapse";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
]
|
||||
++ (lib.optional cfg.bridges.signal {
|
||||
name = "mautrix-signal";
|
||||
ensureDBOwnership = true;
|
||||
})
|
||||
++ (lib.optional cfg.bridges.whatsapp {
|
||||
name = "mautrix-whatsapp";
|
||||
ensureDBOwnership = true;
|
||||
});
|
||||
ensureDatabases =
|
||||
[
|
||||
"matrix-synapse"
|
||||
]
|
||||
++ (lib.optional cfg.bridges.signal "mautrix-signal")
|
||||
++ (lib.optional cfg.bridges.whatsapp "mautrix-whatsapp");
|
||||
};
|
||||
|
||||
services.mautrix-signal = lib.mkIf cfg.bridges.signal {
|
||||
enable = true;
|
||||
settings = commonBridgeSettings "mautrix-signal";
|
||||
};
|
||||
|
||||
services.mautrix-whatsapp = lib.mkIf cfg.bridges.whatsapp {
|
||||
enable = true;
|
||||
settings = {
|
||||
bridge = {
|
||||
history_sync = {
|
||||
backfill = true;
|
||||
max_initial_conversations = -1;
|
||||
message_count = 50;
|
||||
request_full_sync = true;
|
||||
};
|
||||
mute_bridging = true;
|
||||
};
|
||||
} // commonBridgeSettings "mautrix-whatsapp";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,9 +1,15 @@
|
||||
{ config, lib, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.netbird;
|
||||
hostname = config.networking.hostName;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.netbird = {
|
||||
enable = lib.mkEnableOption "netbird";
|
||||
coordinatorDomain = lib.mkOption {
|
||||
@ -43,7 +49,9 @@ in {
|
||||
HttpConfig = {
|
||||
AuthAudience = "netbird";
|
||||
};
|
||||
StoreConfig = { Engine = "sqlite"; };
|
||||
StoreConfig = {
|
||||
Engine = "sqlite";
|
||||
};
|
||||
TURNConfig = {
|
||||
Secret._secret = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
|
||||
TimeBasedCredentials = true;
|
||||
|
||||
@ -1,4 +1,9 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
@ -34,7 +39,8 @@ let
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
|
||||
};
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.nginx = {
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
@ -44,8 +50,8 @@ in {
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80 # HTTP
|
||||
443 # HTTPS
|
||||
80 # HTTP
|
||||
443 # HTTPS
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
@ -89,94 +95,99 @@ in {
|
||||
maxSize = "100m";
|
||||
};
|
||||
};
|
||||
virtualHosts = {
|
||||
## Static sites
|
||||
"jellyfin.vimium.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8000";
|
||||
virtualHosts =
|
||||
{
|
||||
## Static sites
|
||||
"jellyfin.vimium.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8000";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header Range $http_range;
|
||||
proxy_set_header If-Range $http_if_range;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
'';
|
||||
};
|
||||
};
|
||||
"jdholt.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "www.jdholt.com" ];
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
|
||||
locations."/skycam/snapshot.jpg" = {
|
||||
extraConfig = ''
|
||||
set $backend "skycam.mesh.vimium.net:8080";
|
||||
|
||||
resolver 100.100.100.100;
|
||||
|
||||
proxy_pass http://$backend/snapshot;
|
||||
proxy_cache skycam_cache;
|
||||
proxy_cache_valid any 10s;
|
||||
proxy_ignore_headers Cache-Control Expires Set-Cookie;
|
||||
'';
|
||||
};
|
||||
locations."/".return = "301 https://vimium.com$request_uri";
|
||||
};
|
||||
"pki.vimium.com" = {
|
||||
addSSL = true;
|
||||
forceSSL = false;
|
||||
enableACME = true;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header Range $http_range;
|
||||
proxy_set_header If-Range $http_if_range;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
${nginxErrorPages}
|
||||
more_set_headers 'Server: Vimium';
|
||||
'';
|
||||
locations."/" = {
|
||||
root = "/var/www/pki.vimium.com";
|
||||
};
|
||||
};
|
||||
};
|
||||
"jdholt.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "www.jdholt.com" ];
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
|
||||
locations."/skycam/snapshot.jpg" = {
|
||||
extraConfig = ''
|
||||
set $backend "skycam.mesh.vimium.net:8080";
|
||||
|
||||
resolver 100.100.100.100;
|
||||
|
||||
proxy_pass http://$backend/snapshot;
|
||||
proxy_cache skycam_cache;
|
||||
proxy_cache_valid any 10s;
|
||||
proxy_ignore_headers Cache-Control Expires Set-Cookie;
|
||||
'';
|
||||
"suhailhussain.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "www.suhailhussain.com" ];
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
|
||||
locations."/" = {
|
||||
root = "/var/www/suhailhussain.com";
|
||||
};
|
||||
};
|
||||
locations."/".return = "301 https://vimium.com$request_uri";
|
||||
};
|
||||
"pki.vimium.com" = {
|
||||
addSSL = true;
|
||||
forceSSL = false;
|
||||
enableACME = true;
|
||||
extraConfig = ''
|
||||
${nginxErrorPages}
|
||||
more_set_headers 'Server: Vimium';
|
||||
'';
|
||||
locations."/" = {
|
||||
root = "/var/www/pki.vimium.com";
|
||||
"vimium.com" = {
|
||||
default = true;
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "www.vimium.com" ];
|
||||
extraConfig =
|
||||
nginxErrorPages
|
||||
+ nginxEdgeHeaders
|
||||
+ nginxStrictHeaders
|
||||
+ ''
|
||||
add_header Content-Security-Policy "default-src 'self' https://vimium.com https://www.vimium.com; style-src 'unsafe-inline'; object-src 'none'; upgrade-insecure-requests" always;
|
||||
'';
|
||||
locations."/" = {
|
||||
root = "/var/www/vimium.com";
|
||||
};
|
||||
};
|
||||
};
|
||||
"suhailhussain.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "www.suhailhussain.com" ];
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
|
||||
locations."/" = {
|
||||
root = "/var/www/suhailhussain.com";
|
||||
};
|
||||
};
|
||||
"vimium.com" = {
|
||||
default = true;
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = [ "www.vimium.com" ];
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders + ''
|
||||
add_header Content-Security-Policy "default-src 'self' https://vimium.com https://www.vimium.com; style-src 'unsafe-inline'; object-src 'none'; upgrade-insecure-requests" always;
|
||||
'';
|
||||
locations."/" = {
|
||||
root = "/var/www/vimium.com";
|
||||
};
|
||||
};
|
||||
}
|
||||
## Redirects
|
||||
// (mkRedirect "h0lt.com" "jdholt.com")
|
||||
// (mkRedirect "jordanholt.xyz" "jdholt.com")
|
||||
// (mkRedirect "omnimagic.com" "vimium.com")
|
||||
// (mkRedirect "omnimagic.net" "vimium.com")
|
||||
// (mkRedirect "thelostlegend.com" "suhailhussain.com")
|
||||
// (mkRedirect "vimium.co" "vimium.com")
|
||||
// (mkRedirect "vimium.co.uk" "vimium.com")
|
||||
// (mkRedirect "vimium.info" "vimium.com")
|
||||
// (mkRedirect "vimium.net" "vimium.com")
|
||||
// (mkRedirect "vimium.org" "vimium.com")
|
||||
// (mkRedirect "vimium.xyz" "vimium.com");
|
||||
}
|
||||
## Redirects
|
||||
// (mkRedirect "h0lt.com" "jdholt.com")
|
||||
// (mkRedirect "jordanholt.xyz" "jdholt.com")
|
||||
// (mkRedirect "omnimagic.com" "vimium.com")
|
||||
// (mkRedirect "omnimagic.net" "vimium.com")
|
||||
// (mkRedirect "thelostlegend.com" "suhailhussain.com")
|
||||
// (mkRedirect "vimium.co" "vimium.com")
|
||||
// (mkRedirect "vimium.co.uk" "vimium.com")
|
||||
// (mkRedirect "vimium.info" "vimium.com")
|
||||
// (mkRedirect "vimium.net" "vimium.com")
|
||||
// (mkRedirect "vimium.org" "vimium.com")
|
||||
// (mkRedirect "vimium.xyz" "vimium.com");
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,9 +1,17 @@
|
||||
{ config, lib, pkgs, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
let cfg = config.modules.services.photoprism;
|
||||
in {
|
||||
let
|
||||
cfg = config.modules.services.photoprism;
|
||||
in
|
||||
{
|
||||
options.modules.services.photoprism = {
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
|
||||
@ -6,7 +6,8 @@
|
||||
|
||||
let
|
||||
cfg = config.modules.services.postgresql;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.postgresql = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
||||
@ -1,10 +1,17 @@
|
||||
{ config, lib, pkgs, self, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.tailscale;
|
||||
headscale = "https://headscale.vimium.net";
|
||||
hostname = config.networking.hostName;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.modules.services.tailscale = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
||||
Reference in New Issue
Block a user