helvetica/puter
1
0
Fork 0
Code Activity

snapshot

Browse source
This commit is contained in:
Lukas Wurzinger 2024-12-01 04:05:16 +01:00
parent 47036cde64
commit 0968b6f955
57 changed files with 426 additions and 86 deletions

6
hosts/abacus/acme.nix
View file

@ -1,6 +0,0 @@
{
security.acme = {
defaults.email = "lukas@wrz.one";
acceptTerms = true;
};
}

23
hosts/abacus/backup.nix
View file

@ -1,23 +0,0 @@
{
attrName,
config,
...
}: {
age.secrets."restic-${attrName}".file = ../../secrets/restic-${attrName}.age;
services.restic.backups.${attrName} = {
repository = "sftp:u385962@u385962.your-storagebox.de:/restic/${attrName}";
initialize = true;
paths = [
config.services.vaultwarden.backupDir
config.services.syncthing.dataDir
];
passwordFile = config.age.secrets."restic-${attrName}".path;
pruneOpts = ["--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12"];
timerConfig = {
OnCalendar = "*-*-* 03:00:00";
Persistent = true;
};
extraOptions = ["sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"];
};
}

7
hosts/abacus/fs.nix
View file

@ -1,7 +0,0 @@
{config, ...}: {
fileSystems.${config.services.navidrome.settings.MusicFolder} = {
label = "music";
fsType = "ext4";
options = ["noatime"];
};
}

28
hosts/abacus/hardware.nix
View file

@ -1,28 +0,0 @@
{modulesPath, ...}: {
imports = ["${modulesPath}/profiles/qemu-guest.nix"];
nixpkgs.hostPlatform = "aarch64-linux";
boot.initrd.availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod"];
system.stateVersion = "24.11";
powerManagement.cpuFreqGovernor = "performance";
networking = let
interface = "enp1s0";
in {
domain = "wrz.one";
interfaces.${interface}.ipv6.addresses = [
{
address = "2a01:4f9:c012:92b5::2";
prefixLength = 64;
}
];
defaultGateway6 = {
address = "fe80::1";
inherit interface;
};
firewall.allowedTCPPorts = [80 443];
};
}

49
hosts/abacus/microbin.nix
View file

@ -1,49 +0,0 @@
{
config,
lib,
...
}: let
inherit (config.networking) domain;
virtualHostName = "bin.${domain}";
in {
age.secrets.microbin.file = ../../secrets/microbin.age;
services.microbin = {
enable = true;
passwordFile = config.age.secrets.microbin.path;
settings = {
MICROBIN_BIND = "127.0.0.1";
MICROBIN_PORT = 8020;
MICROBIN_PUBLIC_PATH = "https://${virtualHostName}/";
MICROBIN_READONLY = true;
MICROBIN_EDITABLE = true;
MICROBIN_ETERNAL_PASTA = true;
MICROBIN_HIGHLIGHTSYNTAX = true;
MICROBIN_PRIVATE = true;
MICROBIN_ENABLE_BURN_AFTER=true;
MICROBIN_QR = true;
MICROBIN_NO_FILE_UPLOAD=false;
MICROBIN_ENCRYPTION_CLIENT_SIDE=true;
MICROBIN_MAX_FILE_SIZE_ENCRYPTED_MB = 1024;
MICROBIN_MAX_FILE_SIZE_UNENCRYPTED_MB = 4096;
MICROBIN_DISABLE_UPDATE_CHECKING = true;
MICROBIN_DISABLE_TELEMETRY = true;
MICROBIN_LIST_SERVER = false;
};
};
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://${lib.formatHostPort {
host = config.services.microbin.settings.MICROBIN_BIND;
port = config.services.microbin.settings.MICROBIN_PORT;
}}";
};
}

25
hosts/abacus/miniflux.nix
View file

@ -1,25 +0,0 @@
{config, ...}: let
inherit (config.networking) domain;
virtualHostName = "flux.${domain}";
in {
age.secrets.miniflux.file = ../../secrets/miniflux.age;
services.miniflux = {
enable = true;
createDatabaseLocally = true;
adminCredentialsFile = config.age.secrets.miniflux.path;
config = {
LISTEN_ADDR = "localhost:8030";
BASE_URL = "https://${virtualHostName}";
CREATE_ADMIN = 1;
WEBAUTHN = 1;
};
};
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://${config.services.miniflux.config.LISTEN_ADDR}";
};
}

27
hosts/abacus/navidrome.nix
View file

@ -1,27 +0,0 @@
{
config,
lib,
...
}: let
inherit (config.networking) domain;
virtualHostName = "navi.${domain}";
in {
services.navidrome = {
enable = true;
settings = {
Address = "localhost";
Port = 8050;
MusicFolder = "/srv/music";
};
};
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://${lib.formatHostPort {
host = config.services.navidrome.settings.Address;
port = config.services.navidrome.settings.Port;
}}";
};
}

22
hosts/abacus/nginx.nix
View file

@ -1,22 +0,0 @@
{config, ...}: {
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
commonHttpConfig = ''
error_log stderr;
access_log /var/log/nginx/access.log;
'';
virtualHosts."~.*" = {
default = true;
rejectSSL = true;
globalRedirect = config.networking.domain;
};
};
}

31
hosts/abacus/static.nix
View file

@ -1,31 +0,0 @@
{
config,
lib,
...
}: let
inherit (config.networking) domain;
parent = "/var/www";
sites = [
domain
"log.${domain}"
];
in
lib.mkMerge (map (
virtualHostName: let
root = "${parent}/${virtualHostName}";
in {
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
inherit root;
};
systemd.tmpfiles.settings."10-static-sites".${root}.d = {
user = "lukas";
group = "users";
mode = "0755";
};
}
)
sites)

18
hosts/abacus/syncthing.nix
View file

@ -1,18 +0,0 @@
{config, ...}: let
inherit (config.networking) domain;
virtualHostName = "sync.${domain}";
in {
services.syncthing = {
enable = true;
systemService = true;
openDefaultPorts = true;
guiAddress = "localhost:8040";
};
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://${config.services.syncthing.guiAddress}";
};
}

48
hosts/abacus/vaultwarden.nix
View file

@ -1,48 +0,0 @@
{
config,
lib,
...
}: let
inherit (config.networking) domain;
virtualHostName = "vault.${domain}";
backupDir = "/srv/backup/vaultwarden";
in {
age.secrets.vaultwarden.file = ../../secrets/vaultwarden.age;
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
inherit backupDir;
config = {
DOMAIN = "https://${virtualHostName}";
SIGNUPS_ALLOWED = false;
INVITATIONS_ALLOWED = false;
ENABLE_WEBSOCKET = true;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8000;
};
environmentFile = config.age.secrets.vaultwarden.path;
};
systemd.timers.backup-vaultwarden.timerConfig.OnCalendar = "*-*-* 02:00:00";
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://${lib.formatHostPort {
host = config.services.vaultwarden.config.ROCKET_ADDRESS;
port = config.services.vaultwarden.config.ROCKET_PORT;
}}";
proxyWebsockets = true;
};
};
}