whatever

hosts/abacus/acme.nix

@@ -0,0 +1,6 @@
+{
+  security.acme = {
+    defaults.email = "lukas@wrz.one";
+    acceptTerms = true;
+  };
+}

hosts/abacus/authorized-keys.nix

@@ -0,0 +1,6 @@
+{ config, ... }:
+{
+  users.users.root.openssh.authorizedKeys.keys = [
+    config.pubkeys.hosts.vessel
+  ];
+}

hosts/abacus/filesystems.nix

@@ -0,0 +1,15 @@
+{ config, ... }:
+{
+  fileSystems = {
+    "/" = {
+      fsType = "ext4";
+      label = "main";
+      options = [ "noatime" ];
+    };
+    ${config.services.navidrome.settings.MusicFolder} = {
+      label = "music";
+      fsType = "ext4";
+      options = [ "noatime" ];
+    };
+  };
+}

hosts/abacus/forgejo.nix

@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  virtualHostName = "forgejo.helveticanonstandard.net";
+in
+{
+  age.secrets = lib.mkSecrets {
+    forgejo-mailer = {
+      mode = "400";
+      owner = "forgejo";
+    };
+    forgejo-admin = {
+      mode = "400";
+      owner = "forgejo";
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = virtualHostName;
+        ROOT_URL = "https://${virtualHostName}/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 8060;
+      };
+
+      service = {
+        DISABLE_REGISTRATION = true;
+        ENABLE_NOTIFY_MAIL = true;
+      };
+
+      # TODO: Enable
+      federation = {
+        ENABLED = false;
+        SHARE_USER_STATISTICS = false;
+      };
+
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "smtp.fastmail.com";
+        FROM = "tea@wrz.one";
+        USER = "lukas@wrz.one";
+      };
+    };
+
+    secrets.mailer.PASSWD = config.age.secrets.forgejo-mailer.path;
+  };
+
+  # TODO what
+  systemd.services.forgejo.preStart = lib.getExe pkgs.writeShellApplication {
+    name = "forgejo-init-admin";
+    runtimeInputs = [
+      config.services.forgejo.package
+    ];
+    text =
+      let
+        passwordFile = config.age.secrets.forgejo-admin.path;
+      in
+      ''
+        admins=$(admin user list --admin)
+        admins=$((admins - 1))
+
+        if ((admins < 1)); then
+          gitea admin user create \
+            --admin \
+            --email helvetica@helveticanonstandard.net \
+            --username helvetica \
+            --password "$(cat -- ${passwordFile})"
+        fi
+      '';
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    extraConfig = ''
+      client_max_body_size 512M;
+    '';
+
+    locations."/".proxyPass =
+      let
+        host = config.services.forgejo.settings.server.HTTP_ADDR;
+        port = builtins.toString config.services.forgejo.settings.server.HTTP_PORT;
+      in
+      "http://${host}:${port}";
+  };
+}

hosts/abacus/hardware.nix

@@ -0,0 +1,18 @@
+{ modulesPath, ... }:
+{
+  imports = [
+    "${modulesPath}/profiles/qemu-guest.nix"
+  ];
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "usbhid"
+    "sr_mod"
+  ];
+
+  powerManagement.cpuFreqGovernor = "performance";
+}

hosts/abacus/headscale.nix

@@ -0,0 +1,30 @@
+{ config, ... }:
+let
+  virtualHostName = "headscale.helveticanonstandard.net";
+in
+{
+  services.headscale = {
+    enable = true;
+    address = "127.0.0.1";
+    port = 8010;
+    settings = {
+      server_url = "https://${virtualHostName}";
+      dns.base_domain = "tailnet.helveticanonstandard.net";
+      logtail.enabled = false;
+    };
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass =
+        let
+          host = config.services.headscale.address;
+          port = builtins.toString config.services.headscale.port;
+        in
+        "http://${host}:${port}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/abacus/mealie.nix

@@ -0,0 +1,27 @@
+{ config, ... }:
+let
+  virtualHostName = "mealie.helveticanonstandard.net";
+in
+{
+  services.mealie = {
+    enable = true;
+    settings = {
+      BASE_URL = "https://${virtualHostName}";
+      ALLOW_SIGNUP = false;
+    };
+    listenAddress = "127.0.0.1";
+    port = 8040;
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass =
+      let
+        host = config.services.mealie.listenAddress;
+        port = builtins.toString config.services.mealie.port;
+      in
+      "http://${host}:${port}";
+  };
+}

hosts/abacus/navidrome.nix

@@ -0,0 +1,27 @@
+{ config, ... }:
+let
+  virtualHostName = "navidrome.helveticanonstandard.net";
+in
+{
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "localhost";
+      Port = 8050;
+      MusicFolder = "/srv/music";
+      EnableSharing = true;
+    };
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass =
+      let
+        host = config.services.navidrome.settings.Address;
+        port = builtins.toString config.services.navidrome.settings.Port;
+      in
+      "http://${host}:${port}";
+  };
+}

hosts/abacus/networking.nix

@@ -0,0 +1,23 @@
+{
+  networking =
+    let
+      interface = "enp1s0";
+    in
+    {
+      domain = "wrz.one";
+      interfaces.${interface}.ipv6.addresses = [
+        {
+          address = "2a01:4f9:c012:92b5::2";
+          prefixLength = 64;
+        }
+      ];
+      defaultGateway6 = {
+        address = "fe80::1";
+        inherit interface;
+      };
+      firewall.allowedTCPPorts = [
+        80
+        443
+      ];
+    };
+}

hosts/abacus/nginx.nix

@@ -0,0 +1,32 @@
+{
+  services.nginx = {
+    enable = true;
+
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    commonHttpConfig = ''
+      error_log stderr;
+      access_log /var/log/nginx/access.log;
+    '';
+
+    virtualHosts =
+      let
+        matchAll = ''~.*'';
+        matchWww = ''~^www\.(?<domain>.+)$'';
+      in
+      {
+        # Redirect anything that doesn't match any server name to networking.domain
+        ${matchAll} = {
+          default = true;
+          rejectSSL = true;
+
+          globalRedirect = "wrz.one";
+        };
+        # Redirect www to non-www
+        ${matchWww}.globalRedirect = "$domain";
+      };
+  };
+}

hosts/abacus/postgresql.nix

@@ -0,0 +1,8 @@
+{
+  services.postgresqlBackup = {
+    enable = true;
+    startAt = "*-*-* 02:00:00";
+    location = "/srv/backup/postgresql";
+    backupAll = true;
+  };
+}

hosts/abacus/restic.nix

@@ -0,0 +1,41 @@
+{
+  attrName,
+  config,
+  lib,
+  ...
+}:
+let
+  secretName = "restic-${attrName}";
+  secret = config.age.secrets.${secretName};
+in
+{
+  age.secrets = lib.mkSecrets { ${secretName} = { }; };
+
+  services.restic.backups.remote = {
+    repository = "sftp:u459482@u459482.your-storagebox.de:/${attrName}";
+    initialize = true;
+    paths = [
+      config.services.vaultwarden.backupDir
+      config.services.syncthing.dataDir
+      config.services.forgejo.stateDir
+      config.services.postgresqlBackup.location
+      config.services.postgresqlBackup.location
+      # TODO: Add stateDir options for these
+      "/var/lib/headscale"
+      "/var/lib/navidrome"
+    ];
+    passwordFile = secret.path;
+    pruneOpts = [
+      "--keep-daily 7"
+      "--keep-weekly 5"
+      "--keep-monthly 12"
+    ];
+    timerConfig = {
+      OnCalendar = "*-*-* 03:00:00";
+      Persistent = true;
+    };
+    extraOptions = [
+      "sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"
+    ];
+  };
+}

hosts/abacus/static-sites.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  parent = "/var/www";
+  sites = [
+    "wrz.one"
+    "helveticanonstandard.net"
+  ];
+in
+lib.mkMerge (
+  map (
+    virtualHostName:
+    let
+      root = "${parent}/${virtualHostName}";
+    in
+    {
+      services.nginx.virtualHosts.${virtualHostName} = {
+        enableACME = true;
+        forceSSL = true;
+
+        inherit root;
+      };
+
+      systemd.tmpfiles.settings."10-static-sites".${root}.d = {
+        user = config.users.mainUser;
+        group = "users";
+        mode = "0755";
+      };
+    }
+  ) sites
+)

hosts/abacus/system.nix

@@ -0,0 +1,3 @@
+{
+  system.stateVersion = "24.11";
+}

hosts/abacus/vaultwarden.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  virtualHostName = "vault.wrz.one";
+  backupDir = "/srv/backup/vaultwarden";
+in
+{
+  age.secrets = lib.mkSecrets { vaultwarden = { }; };
+
+  services.vaultwarden = {
+    enable = true;
+
+    dbBackend = "sqlite";
+
+    inherit backupDir;
+
+    config = {
+      DOMAIN = "https://${virtualHostName}";
+
+      SIGNUPS_ALLOWED = false;
+      INVITATIONS_ALLOWED = false;
+
+      ENABLE_WEBSOCKET = true;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8000;
+    };
+
+    environmentFile = config.age.secrets.vaultwarden.path;
+  };
+
+  systemd.timers.backup-vaultwarden.timerConfig.OnCalendar = "*-*-* 02:00:00";
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass =
+        let
+          host = config.services.vaultwarden.config.ROCKET_ADDRESS;
+          port = builtins.toString config.services.vaultwarden.config.ROCKET_PORT;
+        in
+        "http://${host}:${port}";
+      proxyWebsockets = true;
+    };
+  };
+}