snapshot

hosts/server/abacus/acme.nix

@@ -0,0 +1,6 @@
+{
+  security.acme = {
+    defaults.email = "lukas@wrz.one";
+    acceptTerms = true;
+  };
+}

hosts/server/abacus/backup.nix

@@ -0,0 +1,24 @@
+{
+  attrName,
+  config,
+  lib,
+  ...
+}: {
+  age.secrets = lib.mkSecrets {"restic-${attrName}" = {};};
+
+  services.restic.backups.${attrName} = {
+    repository = "sftp:u385962@u385962.your-storagebox.de:/restic/${attrName}";
+    initialize = true;
+    paths = [
+      config.services.vaultwarden.backupDir
+      config.services.syncthing.dataDir
+    ];
+    passwordFile = config.age.secrets."restic-${attrName}".path;
+    pruneOpts = ["--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12"];
+    timerConfig = {
+      OnCalendar = "*-*-* 03:00:00";
+      Persistent = true;
+    };
+    extraOptions = ["sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"];
+  };
+}

hosts/server/abacus/fs.nix

@@ -0,0 +1,7 @@
+{config, ...}: {
+  fileSystems.${config.services.navidrome.settings.MusicFolder} = {
+    label = "music";
+    fsType = "ext4";
+    options = ["noatime"];
+  };
+}

hosts/server/abacus/hardware.nix

@@ -0,0 +1,9 @@
+{modulesPath, ...}: {
+  imports = ["${modulesPath}/profiles/qemu-guest.nix"];
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+
+  boot.initrd.availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod"];
+
+  powerManagement.cpuFreqGovernor = "performance";
+}

hosts/server/abacus/microbin.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.networking) domain;
+  virtualHostName = "bin.${domain}";
+in {
+  age.secrets = lib.mkSecrets {microbin = {};};
+
+  services.microbin = {
+    enable = true;
+    passwordFile = config.age.secrets.microbin.path;
+    settings = {
+      MICROBIN_BIND = "127.0.0.1";
+      MICROBIN_PORT = 8020;
+
+      MICROBIN_PUBLIC_PATH = "https://${virtualHostName}/";
+
+      MICROBIN_READONLY = true;
+
+      MICROBIN_EDITABLE = true;
+      MICROBIN_ETERNAL_PASTA = true;
+      MICROBIN_HIGHLIGHTSYNTAX = true;
+      MICROBIN_PRIVATE = true;
+      MICROBIN_ENABLE_BURN_AFTER = true;
+      MICROBIN_QR = true;
+      MICROBIN_NO_FILE_UPLOAD = false;
+      MICROBIN_ENCRYPTION_CLIENT_SIDE = true;
+
+      MICROBIN_MAX_FILE_SIZE_ENCRYPTED_MB = 1024;
+      MICROBIN_MAX_FILE_SIZE_UNENCRYPTED_MB = 4096;
+
+      MICROBIN_DISABLE_UPDATE_CHECKING = true;
+      MICROBIN_DISABLE_TELEMETRY = true;
+      MICROBIN_LIST_SERVER = false;
+    };
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass = "http://${lib.formatHostPort {
+      host = config.services.microbin.settings.MICROBIN_BIND;
+      port = config.services.microbin.settings.MICROBIN_PORT;
+    }}";
+  };
+}

hosts/server/abacus/miniflux.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.networking) domain;
+  virtualHostName = "flux.${domain}";
+in {
+  age.secrets = lib.mkSecrets {miniflux = {};};
+
+  services.miniflux = {
+    enable = true;
+    createDatabaseLocally = true;
+    adminCredentialsFile = config.age.secrets.miniflux.path;
+    config = {
+      LISTEN_ADDR = "localhost:8030";
+      BASE_URL = "https://${virtualHostName}";
+      CREATE_ADMIN = 1;
+      WEBAUTHN = 1;
+    };
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass = "http://${config.services.miniflux.config.LISTEN_ADDR}";
+  };
+}

hosts/server/abacus/navidrome.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.networking) domain;
+  virtualHostName = "navi.${domain}";
+in {
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "localhost";
+      Port = 8050;
+      MusicFolder = "/srv/music";
+    };
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass = "http://${lib.formatHostPort {
+      host = config.services.navidrome.settings.Address;
+      port = config.services.navidrome.settings.Port;
+    }}";
+  };
+}

hosts/server/abacus/networking.nix

@@ -0,0 +1,18 @@
+{
+  networking = let
+    interface = "enp1s0";
+  in {
+    domain = "wrz.one";
+    interfaces.${interface}.ipv6.addresses = [
+      {
+        address = "2a01:4f9:c012:92b5::2";
+        prefixLength = 64;
+      }
+    ];
+    defaultGateway6 = {
+      address = "fe80::1";
+      inherit interface;
+    };
+    firewall.allowedTCPPorts = [80 443];
+  };
+}

hosts/server/abacus/nginx.nix

@@ -0,0 +1,22 @@
+{config, ...}: {
+  services.nginx = {
+    enable = true;
+
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    commonHttpConfig = ''
+      error_log stderr;
+      access_log /var/log/nginx/access.log;
+    '';
+
+    virtualHosts."~.*" = {
+      default = true;
+      rejectSSL = true;
+
+      globalRedirect = config.networking.domain;
+    };
+  };
+}

hosts/server/abacus/static.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.networking) domain;
+  parent = "/var/www";
+  sites = [
+    domain
+    "log.${domain}"
+  ];
+in
+  lib.mkMerge (map (
+      virtualHostName: let
+        root = "${parent}/${virtualHostName}";
+      in {
+        services.nginx.virtualHosts.${virtualHostName} = {
+          enableACME = true;
+          forceSSL = true;
+
+          inherit root;
+        };
+
+        systemd.tmpfiles.settings."10-static-sites".${root}.d = {
+          user = config.users.mainUser;
+          group = "users";
+          mode = "0755";
+        };
+      }
+    )
+    sites)

hosts/server/abacus/syncthing.nix

@@ -0,0 +1,18 @@
+{config, ...}: let
+  inherit (config.networking) domain;
+  virtualHostName = "sync.${domain}";
+in {
+  services.syncthing = {
+    enable = true;
+    systemService = true;
+    openDefaultPorts = true;
+    guiAddress = "localhost:8040";
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass = "http://${config.services.syncthing.guiAddress}";
+  };
+}

hosts/server/abacus/system.nix

@@ -0,0 +1,3 @@
+{
+  system.stateVersion = "24.11";
+}

hosts/server/abacus/vaultwarden.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.networking) domain;
+  virtualHostName = "vault.${domain}";
+  backupDir = "/srv/backup/vaultwarden";
+in {
+  age.secrets = lib.mkSecrets {vaultwarden = {};};
+
+  services.vaultwarden = {
+    enable = true;
+
+    dbBackend = "sqlite";
+
+    inherit backupDir;
+
+    config = {
+      DOMAIN = "https://${virtualHostName}";
+
+      SIGNUPS_ALLOWED = false;
+      INVITATIONS_ALLOWED = false;
+
+      ENABLE_WEBSOCKET = true;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8000;
+    };
+
+    environmentFile = config.age.secrets.vaultwarden.path;
+  };
+
+  systemd.timers.backup-vaultwarden.timerConfig.OnCalendar = "*-*-* 02:00:00";
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://${lib.formatHostPort {
+        host = config.services.vaultwarden.config.ROCKET_ADDRESS;
+        port = config.services.vaultwarden.config.ROCKET_PORT;
+      }}";
+      proxyWebsockets = true;
+    };
+  };
+}