moved ssh and tailscale to srv, revamped netwroking modules

1 files changed, 38 insertions, 1 deletions

diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
index 9ea54c3..51b9577 100644
--- a/os/srv/simplex.nix
+++ b/os/srv/simplex.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
 let
   cfg = config.os.srv.simplex;
   internalSmpPort = 5223;
@@ -22,24 +27,48 @@ in
             assertion = config.os.srv.nginx.enable;
             message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
           }
+          {
+            assertion = config.os.srv.sops.enable;
+            message = "SimpleX requires sops for managing container passwords securely.";
+          }
         ];
 
+        sops.secrets."simplex/smp-env" = { };
+        sops.secrets."simplex/xftp-env" = { };
+
         virtualisation.oci-containers.containers = {
           simplex-smp = {
             image = "simplexchat/smp-server:latest";
             ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
+
+            environment = {
+              ADDR = "smp.${masterDomain}";
+              CONFIG_DIR = "/etc/opt/simplex";
+            };
+
+            environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
+
             volumes = [
               "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
               "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
+              "/var/lib/simplex/certs:/certificates:ro"
             ];
           };
 
           simplex-xftp = {
             image = "simplexchat/xftp-server:latest";
             ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
+
+            environment = {
+              ADDR = "xftp.${masterDomain}";
+              QUOTA = "10gb";
+            };
+
+            environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
             volumes = [
               "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
               "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
+              "/var/lib/simplex/xftp/files:/srv/xftp:rw"
             ];
           };
         };
@@ -60,8 +89,16 @@ in
         systemd.tmpfiles.rules = [
           "d /var/lib/simplex/smp/config 0755 root root -"
           "d /var/lib/simplex/smp/logs 0755 root root -"
+          "d /var/lib/simplex/rsa_certs 0755 root root -"
+
           "d /var/lib/simplex/xftp/config 0755 root root -"
           "d /var/lib/simplex/xftp/logs 0755 root root -"
+          "d /var/lib/simplex/xftp/files 0755 root root -"
+        ];
+
+        networking.firewall.allowedTCPPorts = [
+          5223
+          5224
         ];
       }