diff options
| author | adi <adikro@disroot.org> | 2026-07-29 17:09:58 +0200 |
|---|---|---|
| committer | adi <adikro@disroot.org> | 2026-07-29 17:09:58 +0200 |
| commit | 39a2b09c27bb74c9e59d1772764f901e3c8fb9e4 (patch) | |
| tree | 0ba58e6fbf086a85d875df1c10f6d23bc3bbc7da /os/srv | |
| parent | 8a820cacee1ff07ae7397d053b26e66f7086a4a4 (diff) | |
revamped flake.nix, removed homelab specific modulesstaging
Diffstat (limited to 'os/srv')
46 files changed, 0 insertions, 3245 deletions
diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix deleted file mode 100644 index 2c42b0a..0000000 --- a/os/srv/authelia.nix +++ /dev/null @@ -1,179 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.authelia; - computedBaseDN = lib.concatStringsSep "," ( - map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain) - ); -in -{ - options.os.srv.authelia.enable = - lib.mkEnableOption "enables authelia authentication gateway instance"; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "sops must be enabled for secure cryptographic token storage"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets = { - "authelia/jwt_secret" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/session_secret" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/encryption_key" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - - "authelia/oidc_hmac" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/oidc_private_key" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - - "postgres/authelia_password" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "redis/password" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - }; - - services.authelia.instances.main = { - enable = true; - - secrets = { - jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path; - sessionSecretFile = config.sops.secrets."authelia/session_secret".path; - storageEncryptionKeyFile = config.sops.secrets."authelia/encryption_key".path; - - oidcHmacSecretFile = config.sops.secrets."authelia/oidc_hmac".path; - oidcIssuerPrivateKeyFile = config.sops.secrets."authelia/oidc_private_key".path; - }; - - settings = { - theme = "dark"; - default_2fa_method = "totp"; - - log = { - level = "info"; - format = "json"; - path = "/var/log/authelia/authelia.log"; - keep_stdout = true; - }; - - server.address = "tcp://127.0.0.1:9091"; - - telemetry.metrics = { - enabled = true; - address = "tcp://127.0.0.1:9959"; - }; - - storage = { - postgres = { - host = config.os.core.network.ips.database-vm; - port = 5432; - database = "authelia"; - username = "authelia"; - timeout = "5s"; - schema = "public"; - }; - }; - - session = { - name = "authelia_session"; - expiration = "1h"; - inactivity = "15m"; - remember_me = "1M"; - provider = { - redis = { - host = config.os.core.network.ips.database-vm; - port = 6379; - database = 0; - timeout = "5s"; - }; - }; - }; - - authentication_backend = { - ldap = { - address = "ldap://${config.os.core.network.ips.gateway-vm}:3890"; - implementation = "lldap"; - base_dn = computedBaseDN; - user = "uid=authelia,ou=people,${computedBaseDN}"; - }; - }; - - identity_providers = { - oidc = { - cors.allowed_origins = map (domain: "https://${domain}") ( - builtins.attrNames config.os.cluster.nginxProxies - ); - - clients = config.os.cluster.oidcClients; - }; - }; - - access_control = { - default_policy = "deny"; - rules = [ - { - domain = "auth.${masterDomain}"; - policy = "bypass"; - } - ] - ++ config.os.cluster.autheliaRules; - }; - - session.domain = masterDomain; - }; - - environmentVariables = { - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."lldap/password".path; - AUTHELIA_SESSION_REDIS_PASSWORD_FILE = config.sops.secrets."redis/password".path; - AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."postreg/authelia_password".path; - }; - }; - - os.cluster.nginxProxies."auth.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.gateway-vm}:9091"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - - networking.firewall.extraInputRules = '' - ip saddr ${config.os.core.network.ips.monitor-vm} tcp dport 9959 accept - ''; - }; -} diff --git a/os/srv/avahi.nix b/os/srv/avahi.nix deleted file mode 100644 index f14b33a..0000000 --- a/os/srv/avahi.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.avahi; -in -{ - options.os.srv.avahi.enable = lib.mkEnableOption "enables avahis"; - config = lib.mkIf cfg.enable { - services.avahi = { - enable = true; - ipv4 = true; - - publish = { - enable = true; - addresses = true; - workstation = true; - }; - - nssmdns4 = true; - - extraServiceFiles = { - nfs = '' - <?xml version="1.0" standalone='no'?> - <!DOCTYPE service-group SYSTEM "avahi-service.dtd"> - <service-group> - <name replace-wildcards="yes">NFS Share on %h</name> - <service> - <type>_nfs._tcp</type> - <port>2049</port> - <txt-record>path=/data/vault</txt-record> - </service> - <service> - <type>_nfs._tcp</type> - <port>2049</port> - <txt-record>path=/data/media</txt-record> - </service> - </service-group> - ''; - }; - }; - }; -} diff --git a/os/srv/backup.nix b/os/srv/backup.nix deleted file mode 100644 index e7c07f9..0000000 --- a/os/srv/backup.nix +++ /dev/null @@ -1,97 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.replication; - pgLockScript = pkgs.writeScriptBin "pg-lock" '' - #!/bin/sh - microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_start('sanoid_snap');" - ''; - - pgUnlockScript = pkgs.writeScriptBin "pg-unlock" '' - #!/bin/sh - microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_stop();" - ''; -in -{ - options.os.srv.replication.enable = lib.mkEnableOption "enables replications"; - config = lib.mkIf cfg.enable { - services = { - sanoid = { - enable = true; - templates.production = { - autosnap = true; - autoprune = true; - hourly = 24; - daily = 7; - weekly = 4; - monthly = 3; - }; - datasets = { - "zroot/rpool/appdata/db/postgres" = { - useTemplate = [ "production" ]; - - pre_snapshot_script = "${pgLockScript}/bin/pg-lock"; - post_snapshot_script = "${pgUnlockScript}/bin/pg-unlock"; - no_inconsistent_snapshot = true; - force_post_snapshot_script = true; - script_timeout = 30; - }; - - "zroot/rpool/appdata/db/redis".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/db/couchdb".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/cfg".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/games".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/mail".useTemplate = [ "production" ]; - - "zroot/rpool/containers".useTemplate = [ "production" ]; - }; - }; - - syncoid = { - enable = true; - commonArgs = [ - "-c" - "-p" - "--delete-target-snapshots" - "--use-hold" - "--no-sync-snap" - ]; - commands = { - "sync-databases" = { - source = "zroot/rpool/appdata/db"; - target = "tank/ztank/backup/nvme/db"; - recursive = true; - }; - - "sync-config" = { - source = "zroot/rpool/appdata/cfg"; - target = "tank/ztank/backup/nvme/cfg"; - }; - - "sync-games" = { - source = "zroot/rpool/appdata/games"; - target = "tank/ztank/backup/nvme/games"; - }; - - "sync-mail" = { - source = "zroot/rpool/appdata/mail"; - target = "tank/ztank/backup/nvme/mail"; - }; - - "sync-docker" = { - source = "zroot/rpool/containers"; - target = "tank/ztank/backup/nvme/containers"; - }; - }; - }; - }; - }; -} diff --git a/os/srv/bluetooth.nix b/os/srv/bluetooth.nix deleted file mode 100644 index 1705db6..0000000 --- a/os/srv/bluetooth.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.bluetooth; -in -{ - options.os.srv.bluetooth.enable = lib.mkEnableOption "enables bluetooth support"; - config = lib.mkIf cfg.enable { - hardware.bluetooth = { - enable = true; - powerOnBoot = true; - }; - environment.systemPackages = [ pkgs.bluetui ]; - }; -} diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix deleted file mode 100644 index d2dc49f..0000000 --- a/os/srv/clamav.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.clamav; -in -{ - options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning"; - config = lib.mkIf cfg.enable { - services.clamav = { - daemon = { - enable = true; - settings = { - MaxThreads = 20; - MaxQueue = 100; - }; - }; - scanner.enable = true; - updater.enable = true; - fangfrisch.enable = true; - }; - }; -} diff --git a/os/srv/cluster.nix b/os/srv/cluster.nix deleted file mode 100644 index 6e54ee2..0000000 --- a/os/srv/cluster.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ lib, ... }: { - options.os.cluster = { - nginxProxies = lib.mkOption { - type = lib.types.attrsOf lib.types.attrs; - default = { }; - }; - autheliaRules = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - }; - oidcClients = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - }; - }; -} diff --git a/os/srv/compat.nix b/os/srv/compat.nix deleted file mode 100644 index 1ea6105..0000000 --- a/os/srv/compat.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.compat; -in -{ - options.os.srv.compat.enable = lib.mkEnableOption "enables compatibility with windows & x11"; - config = lib.mkIf cfg.enable { - programs.xwayland = { - enable = true; - package = pkgs.xwayland-satellite; - }; - - environment.systemPackages = with pkgs; [ - wineWow64Packages.stagingFull - winetricks - ]; - - environment.sessionVariables = { - NIXOS_OZONE_WL = "1"; - ELECTRON_ENABLE_WAYLAND = "1"; - }; - }; -} diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix deleted file mode 100644 index c3df81b..0000000 --- a/os/srv/crowdsec.nix +++ /dev/null @@ -1,181 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.security.crowdsec; -in -{ - options.os.srv.security.crowdsec = { - enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention"; - - aggregator.enable = lib.mkEnableOption "this node acting as a central LAPI aggregator for the network"; - agent.enable = lib.mkEnableOption "local log parsing and threat intelligence generation on this node"; - }; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.networking.nftables.enable; - message = "CrowdSec requires networking.nftables to be enabled for blocking."; - } - { - assertion = cfg.agent.enable || cfg.aggregator.enable; - message = "You must enable at least one CrowdSec role: 'agent.enable' or 'aggregator.enable'."; - } - ]; - - sops = { - secrets."crowdsec/env" = { - owner = "crowdsec"; - group = "crowdsec"; - restartUnits = [ "crowdsec.service" ]; - }; - - templates."local_api_credentials.yaml" = { - owner = "crowdsec"; - group = "crowdsec"; - restartUnits = [ "crowdsec.service" ]; - content = '' - url: http://${config.os.core.network.ips.gateway-vm}:8080 - login: ${config.networking.hostName} - password: ${config.sops.placeholder."crowdsec/client_password"} - ''; - }; - }; - - systemd.services.crowdsec.serviceConfig.EnvironmentFile = config.sops.secrets."crowdsec/env".path; - - services.crowdsec = { - enable = true; - autoUpdateService = true; - - openFirewall = true; - - settings = { - common = { - compress_logs = true; - log_format = "json"; - }; - prometheus = { - enabled = true; - level = "full"; - listen_addr = "0.0.0.0"; - listen_port = 6060; - }; - db_config = { - type = "postgresql"; - host = config.os.core.network.ips.database-vm; - port = 5432; - db_name = "crowdsec"; - user = "crowdsec"; - password = "$CROWDSEC_DB_PASSWORD"; - sslmode = "require"; - }; - - api = { - server = { - enable = cfg.aggregator.enable; - listen_uri = "0.0.0.0:8080"; - trusted_ips = [ - "127.0.0.1" - "10.0.0.0/24" - ]; - - auto_registration = { - enabled = cfg.aggregator.enable; - token = "$CROWDSEC_REGISTER_TOKEN"; - allowed_ranges = [ "10.0.0.0/24" ]; - }; - }; - client.credentials_path = config.sops.templates."local_api_credentials.yaml".path; - }; - lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080"; - }; - - hub = lib.mkIf cfg.agent.enable { - collections = [ - "crowdsecurity/linux" - "crowdsecurity/nginx" - "crowdsecurity/authelia" - "crowdsecurity/sshd" - ]; - }; - - localConfig = { - acquisitions = lib.mkIf cfg.agent.enable [ - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; - labels.type = "syslog"; - } - { - source = "file"; - filenames = [ "/var/log/nginx/*.log" ]; - labels.type = "nginx"; - } - { - source = "file"; - filenames = [ "/var/log/authelia/authelia.log" ]; - labels.type = "authelia"; - } - ]; - - parsers.s02Enrich = lib.mkIf cfg.agent.enable [ - { - name = "myips/whitelist"; - description = "Prevent local address ranges from triggering bans"; - whitelist = { - reason = "Internal private subnets"; - cidr = [ - "10.0.0.0/24" - "10.1.0.0/24" - "10.3.0.0/24" - "10.4.0.0/24" - ]; - }; - } - ]; - - notifications = lib.mkIf cfg.aggregator.enable [ - { - name = "ntfy_alerts"; - type = "http"; - method = "POST"; - url = "https://ntfy.${masterDomain}/crowdsec-alerts"; - headers = { - Title = "CrowdSec Alert on Bibus-Lab"; - Priority = "high"; - Authorization = "$NTFY_AUTH_TOKEN"; - }; - format = '' - {{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}} - ''; - log_level = "info"; - } - ]; - }; - }; - - services.crowdsec-firewall-bouncer = { - enable = true; - - registerBouncer.enable = cfg.aggregator.enable; - - settings = { - mode = "nftables"; - update_frequency = "10s"; - api_url = "http://${config.os.core.network.ips.gateway-vm}:8080"; - api_key = lib.mkIf cfg.aggregator.enable "$CROWDSEC_LOCAL_BOUNCER_KEY"; - }; - }; - - users.users.crowdsec.extraGroups = lib.mkIf cfg.agent.enable [ - "systemd-journal" - "nginx" - "authelia-main" - ]; - }; -} diff --git a/os/srv/default.nix b/os/srv/default.nix deleted file mode 100644 index c89d029..0000000 --- a/os/srv/default.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ ... }: -{ - imports = [ - ./authelia.nix - ./backup.nix - ./bluetooth.nix - ./clamav.nix - ./cluster.nix - ./compat.nix - ./crowdsec.nix - ./dns.nix - ./files.nix - ./gaming.nix - ./grafana.nix - ./headscale.nix - ./i2p.nix - ./kea.nix - ./lldap.nix - ./loki.nix - ./mailserver.nix - ./monero.nix - ./netdata.nix - ./nfs.nix - ./nginx.nix - ./nix-helper.nix - ./ntfy.nix - ./ntopng.nix - ./oci.nix - ./omnisearch.nix - ./postgres.nix - ./prometheus.nix - ./redis.nix - ./scrutiny.nix - ./simplex.nix - ./sops.nix - ./ssh.nix - ./sunshine.nix - ./syncthing.nix - ./tailscale.nix - ./tor.nix - ./ups.nix - ./uptime-kuma.nix - ./vector.nix - ./virtualization.nix - ./wireguard.nix - ./yggdrasil.nix - ]; -} diff --git a/os/srv/dns.nix b/os/srv/dns.nix deleted file mode 100644 index b8a973f..0000000 --- a/os/srv/dns.nix +++ /dev/null @@ -1,286 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.dns; - unboundPort = 5335; -in -{ - options.os.srv.dns = { - enable = lib.mkEnableOption "enables dns scanning"; - adguardProxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.unbound = { - enable = true; - settings = { - server = { - interface = [ "127.0.0.1" ]; - port = unboundPort; - - do-ip4 = true; - do-ip6 = false; - do-udp = true; - do-tcp = true; - - num-threads = 4; - msg-cache-slabs = 4; - rrset-cache-slabs = 4; - infra-cache-slabs = 4; - key-cache-slabs = 4; - - msg-cache-size = "256m"; - rrset-cache-size = "512m"; - infra-cache-numhosts = 20000; - - so-rcvbuf = "8m"; - so-sndbuf = "8m"; - so-reuseport = true; - - qname-minimisation = true; - prefetch = true; - prefetch-key = true; - harden-glue = true; - harden-dnssec-stripped = true; - hide-identity = true; - hide-version = true; - use-caps-for-id = false; # might try this later - edns-buffer-size = 1232; - - access-control = [ - "127.0.0.0/8 allow" - "0.0.0.0/0 deny" - ]; - }; - }; - }; - - services.adguardhome = { - enable = true; - mutableSettings = true; - - settings = { - http.address = "0.0.0.0:3000"; - dns = { - bind_hosts = [ - "127.0.0.1" - config.os.core.network.lan.ip - config.os.core.network.wg.ip - config.os.core.network.hs.ip - ]; - rewrites = [ - { - domain = "router.lan"; - answer = config.os.core.network.ips.opnsense-vm; - } - { - domain = "nas.lan"; - answer = config.os.core.network.ips.bare-metal; - } - { - domain = "ldap.${masterDomain}"; - answer = config.os.core.network.ips.gateway-vm; - } - ]; - port = 53; - upstream_dns = [ "127.0.0.1:${toString unboundPort}" ]; - fallback_dns = [ "9.9.9.9" ]; - bootstrap_dns = [ "9.9.9.9" ]; - cache_size = 536870912; - anonymize_client_ip = true; - }; - - filtering = { - filtering_enabled = true; - interval = 24; - }; - filters = [ - { - enabled = true; - name = "Black Mirror Blocklist"; - url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt"; - } - { - enabled = true; - name = "Scam Blocklist by DurableNapkin"; - url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt"; - } - { - enabled = true; - name = "Neo Dev Host Blocklist"; - url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker"; - } - { - enabled = true; - name = "hBlock Blocklist"; - url = "https://hblock.molinero.dev/hosts_adblock.txt"; - } - { - enabled = true; - name = "OISD Big Blocklist"; - url = "https://big.oisd.nl"; - } - { - enabled = true; - name = "StevenBlack Unified"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; - } - { - enabled = true; - name = "StevenBlack Fakenews"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"; - } - { - enabled = true; - name = "StevenBlack Gambling"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts"; - } - - #----------------------------------------------------------------------------- - - # HaGeZi's Blocklists - - { - enabled = true; - name = "HaGeZi's Ultimate Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt"; - } - { - enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive - name = "HaGeZi's Pro++ DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt"; - } - { - enabled = true; - name = "HaGeZi's Fake DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt"; - } - { - enabled = true; - name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt"; - } - { - enabled = true; - name = "HaGeZi's Dynamic DNS Blocklsit"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt"; - } - { - enabled = true; - name = "HaGeZi's Badware Hoster Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt"; - } - { - enabled = true; - name = "HaGeZi's URL Shortener Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt"; - } - { - enabled = true; - name = "HaGeZi's DNS Rebind Protection"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt"; - } - { - enabled = true; - name = "HaGeZi's Gambling DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt"; - } - - #----------------------------------------------------------------------------- - - # NEWLY REGISTERED DOMAINS / ENTROPY DGAs - - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered High Entropy Domains"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt"; - } - - #----------------------------------------------------------------------------- - - # DNS BYPASS BLOCKLISTS - - { - enabled = true; - name = "HaGeZi's DNS Bypass Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt"; - } - { - enabled = true; - name = "DNS HTTPS Blocklist"; - url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt"; - } - - #----------------------------------------------------------------------------- - - # NSFW DNS BLOCKLISTS - - { - enabled = true; - name = "HaGeZi's NSFW DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt"; - } - { - enabled = true; - name = "oisd NSFW"; - url = "https://nsfw.oisd.nl"; - } - { - enabled = true; - name = "StevenBlack NSFW Blocklist"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts"; - } - ]; - }; - }; - - os.srv.dns.adguardProxyConfig = { - "adguard.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - - networking.firewall = { - allowedUDPPorts = [ 53 ]; - allowedTCPPorts = [ 53 ]; - }; - }; -} diff --git a/os/srv/files.nix b/os/srv/files.nix deleted file mode 100644 index 777a394..0000000 --- a/os/srv/files.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.files; -in -{ - options.os.srv.files = { - enable = lib.mkEnableOption "enables general file management stuff"; - localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally"; - krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh"; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - # programs.thunar = { - # enable = true; - # plugins = with pkgs; [ - # ffmpegthumbnailer - # libgsf - # poppler - # freetype - # webp-pixbuf-loader - # thunar-volman - # thunar-archive-plugin - # ]; - # }; - services = { - tumbler.enable = true; - gvfs.enable = true; - }; - environment.systemPackages = with pkgs; [ - pcmanfm - file-roller - gdu - pxz - ripunzip - ]; - }) - (lib.mkIf cfg.localsend.enable { - programs.localsend = { - enable = true; - openFirewall = true; - }; - }) - (lib.mkIf cfg.krusader.enable { - environment.systemPackages = with pkgs; [ - krusader - kdePackages.kio-extras - ]; - }) - ]; -} diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix deleted file mode 100644 index b9b6766..0000000 --- a/os/srv/gaming.nix +++ /dev/null @@ -1,145 +0,0 @@ -{ - config, - lib, - pkgs, - username, - inputs, - ... -}: -let - cfg = config.os.srv.gaming; -in -{ - options.os.srv.gaming = { - enable = lib.mkEnableOption "enables general gaming support"; - - tools.enable = lib.mkEnableOption "enables performance tools" // { - default = cfg.enable; - }; - launchers.enable = lib.mkEnableOption "enables 3rd party launchers" // { - default = cfg.enable; - }; - games.enable = lib.mkEnableOption "enables specific native games"; - steam = { - enable = lib.mkEnableOption "enables the steam launcher"; - enableSls = lib.mkEnableOption "enables the SLS Steam library modification"; - }; - vr.enable = lib.mkEnableOption "enables vr support"; - }; - - config = lib.mkMerge [ - # --- PERFORMANCE & TOOLING --- - (lib.mkIf cfg.tools.enable { - hardware.xone.enable = true; - programs = { - gamescope = { - enable = true; - capSysNice = true; - }; - - gamemode = { - enable = true; - enableRenice = true; - settings = { - general.renice = 10; - }; - }; - }; - environment = { - sessionVariables = { - OPTISCALER_ShortcutKey = "0x24"; # sets the optiscaler shortcut key to be home by default - }; - - systemPackages = with pkgs; [ - mangohud - theclicker - ludusavi - protonplus - ]; - }; - }) - - # --- EXTERNAL LAUNCHERS --- - (lib.mkIf cfg.launchers.enable { - environment.systemPackages = with pkgs; [ - heroic - (prismlauncher.override { - additionalLibs = with pkgs; [ ocl-icd ]; - jdks = with pkgs; [ javaPackages.compiler.temurin-bin.jdk-26 ]; - }) - ]; - }) - - # --- SPECIFIC GAMES --- - (lib.mkIf cfg.games.enable { - environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [ - (pkgs.openttd-jgrpp) - - # OpenMW Specific - (pkgs.openmw) - (pkgs.tes3cmd) - delta-plugin - groundcoverify - momw-configurator - openmw-validator - s3lightfixes - umo - ]; - }) - - # --- STEAM --- - (lib.mkIf cfg.steam.enable ( - lib.mkMerge [ - { - programs.steam = { - enable = true; - localNetworkGameTransfers.openFirewall = true; - dedicatedServer.openFirewall = true; - remotePlay.openFirewall = false; - extest.enable = true; - protontricks.enable = true; - }; - environment.systemPackages = with pkgs; [ steamtinkerlaunch ]; - } - - (lib.mkIf cfg.steam.enableSls { - environment.systemPackages = [ - inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped - ]; - home-manager.users.${username} = { - xdg.desktopEntries = { - steam = { - name = "Steam"; - comment = "Library modified Steam client"; - exec = "${ - lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam" - } %U"; - icon = "steam"; - terminal = false; - type = "Application"; - categories = [ - "Game" - "Utility" - ]; - mimeType = [ "x-scheme-handler/steamcmd" ]; - }; - }; - }; - }) - ] - )) - - # --- VR SUPPORT --- - (lib.mkIf cfg.vr.enable { - services.wivrn = { - enable = true; - openFirewall = true; - highPriority = true; - steam.importOXRRuntimes = true; - # defaultRuntime = true; - }; - environment.systemPackages = [ pkgs.android-tools ]; - users.users.${username}.extraGroups = [ "adbusers" ]; - }) - ]; -} diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix deleted file mode 100644 index 5428818..0000000 --- a/os/srv/grafana.nix +++ /dev/null @@ -1,109 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.grafana; -in -{ - options.os.srv.grafana = { - enable = lib.mkEnableOption "enables grafana"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.grafana = { - enable = true; - openFirewall = true; - - # Might use later - # declarativePlugins = [ ]; - - settings = { - server = { - protocol = "http"; - http_port = 3000; - http_addr = "0.0.0.0"; - domain = "grafana.${masterDomain}"; - root_url = "https://grafana.${masterDomain}"; - enforceDomain = true; - enable_gzip = true; - }; - database = { - wal = true; - }; - security = { - admin_user = "opc"; - # TODO: Generate password to use in sops-nix - # admin_password = "sops" - admin_email = "adikro@disroot.org"; - # TODO generate secret key and put it in sops-nix - # secret_key = "sops"; - disable_gravatar = true; - cookie_secure = true; - cookie_samesite = "lax"; - # security - allow_embedding = false; - strict_transport_security = true; - - disable_initial_admin_creation = false; - disable_brute_force_login_protection = false; - }; - # TODO setup mailing - # smtp = { enabled = true; }; - analytics.feedback_links_enabled = false; - }; - provision = { - enable = true; - datasources.settings = { - prune = true; - - datasources = [ - { - name = "Prometheus"; - type = "prometheus"; - url = "http://127.0.0.1:9090"; - access = "proxy"; - isDefault = true; - editable = false; - } - { - name = "Loki"; - type = "loki"; - url = "http://127.0.0.1:3100"; - access = "proxy"; - editable = false; - } - ]; - }; - }; - # dashboards.settings = { - # providers = [ - # { - # name = "default"; - # type = "file"; - # options.path = "/var/lib/grafana/dashboards"; - # } - # ]; - # }; - }; - - os.srv.grafana.proxyConfig = { - "grafana.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - proxyWebsockets = true; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix deleted file mode 100644 index 01fc06c..0000000 --- a/os/srv/headscale.nix +++ /dev/null @@ -1,76 +0,0 @@ -{ - config, - lib, - pkgs, - masterDomain, - ... -}: -let - cfg = config.os.srv.headscale; - aclPolicy = pkgs.writeText "headscale-policy.json" ( - builtins.toJSON { - groups = { - "group:admin" = [ "your-device-name" ]; - "group:friends" = [ "friend-device-name" ]; - }; - - hosts = { - "server" = "10.4.0.1"; - }; - - acls = [ - { - action = "accept"; - src = [ "group:admin" ]; - dst = [ "*:*" ]; - } - - { - action = "accept"; - src = [ "group:friends" ]; - dst = [ - "server:18080" - "server:18081" - "server:25565" - ]; - } - ]; - } - ); -in -{ - options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales"; - - config = lib.mkIf cfg.enable { - services.headscale = { - enable = true; - address = "127.0.0.1"; - port = 8080; - - settings = { - server_url = "https://vpn.${masterDomain}"; - - policy.path = "${aclPolicy}"; - - dns = { - magic_dns = true; - base_domain = "vpn"; - nameservers = [ config.os.core.network.ips.vm2-gateway ]; - }; - - ip_prefixes = [ - "10.4.0.0/16" - ]; - }; - }; - - services.nginx.virtualHosts."vpn.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - proxyWebsockets = true; - }; - }; - }; -} diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix deleted file mode 100644 index 5e36c20..0000000 --- a/os/srv/i2p.nix +++ /dev/null @@ -1,81 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.i2p; -in -{ - options.os.srv.i2p = { - enable = lib.mkEnableOption "enables a flexible, polymorphic i2pd deployment profile"; - - mode = lib.mkOption { - type = lib.types.enum [ - "server" - "client" - ]; - default = "client"; - description = ""; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.i2pd = { - enable = true; - enableIPv6 = true; - reseed.verify = true; - - yggdrasil.enable = true; - - proto = { - http.enable = true; - httpProxy.enable = true; - socksProxy = { - enable = true; - outproxyEnable = true; - }; - sam.enable = true; - i2pControl.enable = true; - }; - }; - } - - (lib.mkIf (cfg.mode == "server") { - services.i2pd = { - bandwidth = 4096; - - ntcp2.published = true; - ssu2.published = true; - - #TODO add address - yggdrasil.address = ""; - }; - - os.cluster.nginxProxies."i2p.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.relay-vm}:7070"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }) - - (lib.mkIf (cfg.mode == "client") { - services.i2pd = { - bandwidth = 512; - - ntcp2.published = false; - ssu2.published = false; - - yggdrasil.address = ""; - }; - }) - ] - ); -} diff --git a/os/srv/kea.nix b/os/srv/kea.nix deleted file mode 100644 index 168590e..0000000 --- a/os/srv/kea.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.kea; -in -{ - options.os.srv.kea.enable = lib.mkEnableOption "enables kea dhcp server"; - config = lib.mkIf cfg.enable { - services.kea.dhcp4 = { - enable = true; - settings = { - interfaces-config = { - # To be used in a VM - interfaces = [ "eth0" ]; - dhcp-socket-type = "udp"; - }; - - lease-database = { - type = "memfile"; - persist = true; - name = "/var/lib/kea/dhcp4.leases"; - }; - - subnet4 = [ - { - id = 1; - subnet = "10.1.0.0/24"; - pools = [ { pool = "10.1.0.50 - 10.1.0.250"; } ]; - option-data = [ - { - name = "routers"; - data = "10.1.0.1"; - } - { - name = "domain-name-servers"; - data = "10.0.0.3"; - } - ]; - } - { - id = 2; - subnet = "10.2.0.0/24"; - pools = [ { pool = "10.2.0.50 - 10.2.0.250"; } ]; - option-data = [ - { - name = "routers"; - data = "10.2.0.1"; - } - { - name = "domain-name-servers"; - data = "10.0.0.3"; - } - ]; - } - ]; - }; - }; - }; -} diff --git a/os/srv/lldap.nix b/os/srv/lldap.nix deleted file mode 100644 index 6755dfe..0000000 --- a/os/srv/lldap.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.lldap; - computedBaseDN = lib.concatStringsSep "," ( - map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain) - ); -in -{ - options.os.srv.lldap.enable = lib.mkEnableOption "enables lldap scanning"; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets = { - "lldap/password" = { - owner = "lldap"; - group = "lldap"; - }; - "lldap/env_file" = { - owner = "lldap"; - group = "lldap"; - }; - }; - - services.lldap = { - enable = true; - settings = { - ldap_base_dn = computedBaseDN; - http_host = "127.0.0.1"; - http_url = "https://lldap.${masterDomain}"; - ldap_user_email = "adikro@disroot.org"; - ldap_user_pass_file = config.sops.secrets."lldap/password".path; - silenceForceUserPassResetWarning = true; - }; - environmentFile = config.sops.secrets."lldap/env_file".path; - }; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 3890 accept - ''; - }; -} diff --git a/os/srv/loki.nix b/os/srv/loki.nix deleted file mode 100644 index 84b94d8..0000000 --- a/os/srv/loki.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.loki; -in -{ - options.os.srv.loki.enable = lib.mkEnableOption "enables loki"; - config = lib.mkIf cfg.enable { - services.loki = { - enable = true; - configuration = { - server = { - http_listen_address = "0.0.0.0"; - http_compress_responses = true; - }; - - common = { - instance_addr = "127.0.0.1"; - path_prefix = "/var/lib/loki"; - replication_factor = 1; - - storage.filesystem = { - chunks_directory = "/var/lib/loki/chunks"; - rules_directory = "/var/lib/loki/rules"; - }; - }; - - schema_config.configs = [ - { - from = "2026-01-01"; - store = "tsdb"; - object_store = "filesystem"; - schema = "v13"; - index = { - prefix = "loki_index_"; - period = "24h"; - }; - } - ]; - - ingester.wal.enabled = true; - - limits_config = { - max_entries_limit_per_query = 10000; - reject_old_samples_max_age = "720h"; - retention_period = "90d"; - volume_enabled = true; - }; - - compactor = { - enabled = true; - retention_enabled = true; - retention_delete_delay = "1h"; - compactor_window = "168h"; - }; - - querier.query_timeout = "5m"; - query_range.out_of_order_time_shifting = "5m"; - analytics.reporting_enabled = false; - }; - }; - }; -} diff --git a/os/srv/mailserver.nix b/os/srv/mailserver.nix deleted file mode 100644 index 7bcd008..0000000 --- a/os/srv/mailserver.nix +++ /dev/null @@ -1,59 +0,0 @@ -{ - config, - lib, - inputs, - masterDomain, - ... -}: -let - cfg = config.os.srv.mailserver; -in -{ - options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning"; - imports = [ inputs.nixos-mailserver.nixosModules.mailserver ]; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.srv.lldap.enable; - message = "required for user accounts"; - } - ]; - mailserver = { - enable = true; - fqdn = "mail.${masterDomain}"; - domains = [ masterDomain ]; - - # TODO setup ldap - ldap = { - enable = true; - uris = [ "ldap://127.0.0.1:3890" ]; - base = "ou=people,dc=yourdomain,dc=com"; - - bind = { - dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com"; - passwordFile = "/var/src/secrets/ldap-mail-password"; - }; - - attributes = { - username = "uid"; - mail = "mail"; - password = "userPassword"; - uuid = "entryUUID"; - }; - - dovecot = { - userFilter = "(|(mail=%{user})(uid=%{user}))"; - passFilter = "(uid=%{user})"; - }; - - postfix = { - filter = "(mail=%s)"; - }; - }; - }; - }; -} diff --git a/os/srv/monero.nix b/os/srv/monero.nix deleted file mode 100644 index eb21abc..0000000 --- a/os/srv/monero.nix +++ /dev/null @@ -1,124 +0,0 @@ -{ - config, - lib, - pkgs, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.monero; - banlist1 = pkgs.fetchurl { - url = "https://gui.xmr.pm/files/block.txt"; - hash = "sha256-0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw"; - }; - banlist2 = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/Boog900/monero-ban-list/refs/heads/main/ban_list.txt"; - hash = "sh256-01z4wm2mp4z1wq2wdkrm66j50gwk3r82m2ml4n0pwjcbajxkdc87"; - }; - - combinedBanlist = pkgs.writeText "combined-monero-banlist.txt" '' - ${builtins.readFile banlist1} - ${builtins.readFile banlist2} - ''; -in -{ - options.os.srv.monero = { - wallet.enable = lib.mkEnableOption "enables the monero wallet"; - service = { - enable = lib.mkEnableOption "enables hosting a monero node"; - public = lib.mkEnableOption "makes the RPC node public (disables authentication for general wallet syncing)"; - tor.enable = lib.mkEnableOption "exposes monero RPC via Tor Onion Service"; - i2p.enable = lib.mkEnableOption "exposes monero RPC via I2P Tunnel"; - }; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.wallet.enable { - environment.systemPackages = [ pkgs.monero-cli ]; - }) - (lib.mkIf cfg.service.enable { - assertions = [ - { - assertion = if (!cfg.service.public) then config.os.srv.sops.enable else true; - message = "sops must be enabled"; - } - { - assertion = if cfg.service.tor.enable then config.os.srv.tor.enable else true; - message = "tor must be enabled"; - } - { - assertion = if cfg.service.i2p.enable then config.os.srv.i2p.enable else true; - message = "i2p must be enabled"; - } - ]; - - sops.secrets."monero/rpc-password" = { - owner = "monero"; - restartUnits = [ "monero.service" ]; - }; - - services.monero = { - enable = true; - prune = true; - banlist = combinedBanlist; - - limits = { - upload = 1250; - download = 12500; - threads = 8; - }; - - rpc = { - address = "0.0.0.0"; - } - // lib.optionalAttrs (!cfg.service.public) { - restricted = true; - user = "admin"; - password = config.sops.secrets."monero/rpc-password".path; - }; - - }; - - services.tor = lib.mkIf cfg.service.tor.enable { - # onionServices."xmr-rpc" = { - # to = [ - # { - # port = 18081; - # address = config.os.core.network.ips.relay-vm; - # } - # ]; - # }; - }; - - services.i2pd = lib.mkIf cfg.service.i2p.enable { - # tunnels.server."xmr-rpc" = { - # port = 18081; - # address = config.os.core.network.ips.relay-vm; - # keys = "xmr-rpc-key.dat"; - # inbound.length = 3; - # outbound.length = 3; - # }; - }; - - os.cluster.nginxProxies."xmr.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.relay-vm}:18081"; - extraConfig = '' - proxy_read_timeout 600s; - proxy_send_timeout 600s; - client_max_body_size 50m; - - ${securityTemplates.restrictToInternal} - ''; - }; - }; - - # Left open for P2P syncing - networking.firewall.allowedTCPPorts = [ 18080 ]; - }) - ]; -} diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix deleted file mode 100644 index a7b4300..0000000 --- a/os/srv/netdata.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.netdata; -in -{ - options.os.srv.netdata = { - enable = lib.mkEnableOption "enables netdata monitoring"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - - config = lib.mkIf cfg.enable { - services.netdata = { - enable = true; - config.web."bind to" = "127.0.0.1"; - - python = { - enable = true; - recommendedPythonPackages = true; - }; - }; - - os.srv.netdata.proxyConfig = { - "netdata.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.host}:19999"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix deleted file mode 100644 index 07f331e..0000000 --- a/os/srv/nfs.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.nfs; -in -{ - options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing"; - config = lib.mkIf cfg.enable { - services.nfs.server = { - enable = true; - nproc = 4; # Lowered due to low traffic for a home server - createMountPoints = true; - - exports = '' - /data/media 10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) - - /data/vault 10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) - ''; - }; - - networking.firewall.allowedTCPPorts = [ 2049 ]; - }; -} diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix deleted file mode 100644 index 2194ecb..0000000 --- a/os/srv/nginx.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: - -let - cfg = config.os.srv.nginx; -in -{ - options.os.srv.nginx = { - enable = lib.mkEnableOption "the NGINX reverse proxy service"; - - openFirewall = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Whether to open ports 80 and 443 in the firewall."; - }; - }; - - config = lib.mkMerge [ - { - _module.args.securityTemplates.restrictToInternal = '' - allow 127.0.0.1; - allow ::1; - - allow ${config.os.core.network.lan.range}; - allow 10.1.0.0/24; - allow ${config.os.core.network.wg.range}; - allow ${config.os.core.network.hs.range}; - - deny all; - ''; - } - - (lib.mkIf cfg.enable { - services.nginx = { - enable = true; - package = pkgs.nginx.override { openssl = pkgs.libressl; }; - - recommendedProxySettings = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - virtualHosts = lib.mkMerge [ - { - "_" = { - default = true; - rejectSSL = true; - locations."/".return = "444"; - }; - } - config.os.cluster.nginxProxies - ]; - }; - - security.acme = { - acceptTerms = true; - defaults.email = "adikro@disroot.org"; - }; - - users.users.nginx.extraGroups = [ "acme" ]; - - networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ - 80 - 443 - ]; - - systemd.tmpfiles.rules = [ - "d /var/log/nginx 0750 nginx adm -" - ]; - }) - ]; -} diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix deleted file mode 100644 index 5e5e133..0000000 --- a/os/srv/nix-helper.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.srv.nix-helper; -in -{ - options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper"; - config = lib.mkIf cfg.enable { - nix.settings = { - trusted-users = [ - "root" - "${username}" - ]; - experimental-features = [ - "nix-command" - "flakes" - ]; - }; - - programs.nh = { - enable = true; - flake = "/etc/nixos"; - clean.extraArgs = "--keep 5"; - }; - - environment.sessionVariables = { - NH_OS_FLAKE = "/etc/nixos"; - }; - - environment.systemPackages = with pkgs; [ - nix-output-monitor - nvd - ]; - }; -} diff --git a/os/srv/ntfy.nix b/os/srv/ntfy.nix deleted file mode 100644 index 1417c81..0000000 --- a/os/srv/ntfy.nix +++ /dev/null @@ -1,59 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.ntfy; -in -{ - options.os.srv.ntfy = { - enable = lib.mkEnableOption "enables ntfy"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.ntfy-sh = { - enable = true; - settings = { - base-url = "https://ntfy.${masterDomain}"; - - listen-http = "127.0.0.1:2586"; - - cache-file = "/var/lib/ntfy/cache.db"; - cache-duration = "72h"; - - attachment-cache-dir = "/var/lib/ntfy/attachments"; - attachment-total-size-limit = "5G"; - attachment-file-size-limit = "15M"; - attachment-expiry-duration = "3h"; - - behind-proxy = true; - }; - }; - - os.srv.ntfy.proxyConfig = { - "uptime-kuma.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; - extraConfig = '' - proxy_set_header Connection ""; - proxy_connect_timeout 1m; - proxy_send_timeout 1m; - proxy_read_timeout 24h; - - proxy_buffering off; - proxy_request_buffering off; - chunked_transfer_encoding on; - ''; - }; - }; - }; - }; -} diff --git a/os/srv/ntopng.nix b/os/srv/ntopng.nix deleted file mode 100644 index 692fe2c..0000000 --- a/os/srv/ntopng.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.ntopng; -in -{ - options.os.srv.ntopng = { - enable = lib.mkEnableOption "enables ntopng monitoring"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.ntopng = { - enable = true; - extraConfig = "--packet-fanout 'cluster' -g 2 -m '192.168.0.0/16,10.0.0.0/8' -X 50000 --community"; - - # TODO fill interfaces - interfaces = [ - "" # WAN Interface - "" # LAN Interface - "" # Virtual Bridge - ]; - }; - os.srv.ntopng.proxyConfig = { - "ntopng.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/oci.nix b/os/srv/oci.nix deleted file mode 100644 index ea680fd..0000000 --- a/os/srv/oci.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.oci; -in -{ - options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman"; - config = lib.mkIf cfg.enable { - virtualisation = { - containers = { - enable = true; - storage.settings.driver = "zfs"; - }; - podman = { - enable = true; - dockerCompat = true; - defaultNetwork.settings.dns_enabled = true; - autoPrune = { - enable = true; - dates = "weekly"; - flags = [ "--all" ]; - }; - }; - oci-containers.backend = "podman"; - }; - - environment.systemPackages = with pkgs; [ - podman-tui - podman-compose - ]; - }; -} diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix deleted file mode 100644 index ac36184..0000000 --- a/os/srv/omnisearch.nix +++ /dev/null @@ -1,73 +0,0 @@ -{ - config, - lib, - inputs, - masterDomain, - templates, - ... -}: -let - cfg = config.os.srv.omnisearch; -in -{ - imports = [ inputs.omnisearch.nixosModules.default ]; - - options.os.srv.omnisearch = { - enable = lib.mkEnableOption "enables omnisearch tracking infrastructure"; - - role = lib.mkOption { - type = lib.types.enum [ - "server" - "standalone" - ]; - default = "standalone"; - description = "Designates the deployment method"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.omnisearch = { - enable = true; - settings = { - server = { - host = "127.0.0.1"; - port = 8087; - locale = "en"; - domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087"; - }; - proxy = { - max_retries = 3; - randomize_username = true; - randomize_password = true; - }; - cache = { - dir = "/var/cache/omnisearch"; - ttl_search = 1800; - ttl_infobox = 86400; - }; - }; - }; - } - - (lib.mkIf (cfg.role == "server") { - assertions = [ - { - assertion = config.os.srv.nginx.enable; - message = "Required for proxying"; - } - ]; - services.nginx.virtualHosts."search.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8087"; - proxyWebsockets = true; - extraConfig = templates.restrictToInternal; - }; - }; - }) - ] - ); -} diff --git a/os/srv/postgres.nix b/os/srv/postgres.nix deleted file mode 100644 index f669f63..0000000 --- a/os/srv/postgres.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.postgres; -in -{ - options.os.srv.postgres.enable = lib.mkEnableOption ""; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets."postgres/authelia_password" = { - owner = "postgres"; - group = "postgres"; - restartUnits = [ "postgresql.service" ]; - }; - - services.postgresql = { - enable = true; - package = pkgs.postgresql_18; - - extraPlugins = [ config.services.postgresql.package.pkgs.pgvector ]; - - settings = { - listen_addresses = config.os.core.network.ips.database-vm; - - max_connections = 100; - shared_buffers = "256MB"; - work_mem = "4MB"; - }; - - ensureDatabases = [ "authelia" ]; - ensureUsers = [ - { - name = "authelia"; - ensureDBOwnership = true; - } - ]; - - initialScript = pkgs.writeText "init-postgres-passwords.sql" '' - CREATE USER authelia; - ALTER USER authelia WITH PASSWORD 'scram-sha-256'; - ''; - - authentication = pkgs.lib.mkForce '' - local all all trust - host all all 10.0.0.0/24 scram-sha-256 - ''; - }; - - systemd.services.postgresql.postStart = lib.mkAfter '' - PASS=$(cat ${config.sops.secrets."postgres/authelia_password".path}) - ${config.services.postgresql.package}/bin/psql -tAc "ALTER USER authelia WITH PASSWORD '$PASS';" - ''; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 5432 accept - ''; - }; -} diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix deleted file mode 100644 index 5b133be..0000000 --- a/os/srv/prometheus.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.prometheus; -in -{ - options.os.srv.prometheus.enable = lib.mkEnableOption "enables prometheus"; - config = lib.mkIf cfg.enable { - services.prometheus = { - enable = true; - port = 9090; - - scrapeConfigs = [ - { - job_name = "prometheus"; - static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ]; - } - { - job_name = "node-hardware"; - static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; - } - { - job_name = "node_exporter"; - static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; - } - { - job_name = "bare_metal_host_netdata"; - scheme = "https"; - metrics_path = "/api/v1/allmetrics"; - params = { - format = [ "prometheus" ]; - }; - static_configs = [ - { targets = [ "netdata.${masterDomain}" ]; } - ]; - } - { - job_name = "uptime_kuma"; - metrics_path = "/metrics"; - static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ]; - } - { - job_name = "network-latency"; - static_configs = [ { targets = [ "127.0.0.1:9374" ]; } ]; - } - ]; - exporters = { - node = { - enable = true; - enableCollectors = [ "systemd" ]; - port = 9100; - }; - - smokeping = { - enable = true; - listenAddress = "127.0.0.1"; - - hosts = [ - "10.0.0.1" # Personal Router - "192.168.0.1" # ISP Modem Box - "84.116.254.69" # First ISP Hop - "185.182.244.39" # Regional Katowice Hub - "1.1.1.1" # Cloudflare DNS - "8.8.8.8" # Google DNS - "130.162.223.123" # OCI Instance - ]; - }; - }; - }; - }; -} diff --git a/os/srv/redis.nix b/os/srv/redis.nix deleted file mode 100644 index a51f9db..0000000 --- a/os/srv/redis.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.redis; -in -{ - options.os.srv.redis.enable = lib.mkEnableOption ""; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets."redis/password" = { - owner = "redis-main"; - restartUnits = [ "redis-servers-main.service" ]; - }; - - services.redis.servers."main" = { - enable = true; - bind = config.os.core.network.ips.database-vm; - port = 6379; - - requirePassFile = config.sops.secrets."redis/password".path; - }; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 6379 accept - ''; - - }; -} diff --git a/os/srv/restic.nix b/os/srv/restic.nix deleted file mode 100644 index fb2bd19..0000000 --- a/os/srv/restic.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.restic; -in -{ - options.os.srv.restic.enable = lib.mkEnableOption "enables restic backups"; - - config = lib.mkIf cfg.enable { - assertions = [ - ]; - }; -} diff --git a/os/srv/scrutiny.nix b/os/srv/scrutiny.nix deleted file mode 100644 index ffe8c39..0000000 --- a/os/srv/scrutiny.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.scrutiny; -in -{ - options.os.srv.scrutiny.enable = lib.mkEnableOption "enables scrutiny monitoring"; - config = lib.mkIf cfg.enable { - services.scrutiny = { - enable = true; - settings.web.listen.host = "127.0.0.1"; - - collector = { - enable = true; - schedule = "hourly"; - settings.host.id = "bibus-lab"; - }; - }; - - services.nginx.virtualHosts."scrutiny.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; -} diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix deleted file mode 100644 index ca22192..0000000 --- a/os/srv/simplex.nix +++ /dev/null @@ -1,129 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.simplex; - internalSmpPort = 5223; - internalXftpPort = 5224; -in -{ - options.os.srv.simplex = { - enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman"; - tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX"; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - assertions = [ - { - assertion = config.os.srv.oci.enable; - message = "SimpleX requires os.srv.oci to be enabled to run containers."; - } - { - assertion = config.os.srv.nginx.enable; - message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying."; - } - { - assertion = config.os.srv.sops.enable; - message = "SimpleX requires sops for managing container passwords securely."; - } - ]; - - sops.secrets."simplex/smp-env" = { }; - sops.secrets."simplex/xftp-env" = { }; - - virtualisation.oci-containers.containers = { - simplex-smp = { - image = "simplexchat/smp-server:latest"; - ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ]; - - environment = { - ADDR = "smp.${masterDomain}"; - CONFIG_DIR = "/etc/opt/simplex"; - }; - - environmentFiles = [ config.sops.secrets."simplex/smp-env".path ]; - - volumes = [ - "/var/lib/simplex/smp/config:/etc/opt/simplex:rw" - "/var/lib/simplex/smp/logs:/var/opt/simplex:rw" - "/var/lib/simplex/certs:/certificates:ro" - ]; - }; - - simplex-xftp = { - image = "simplexchat/xftp-server:latest"; - ports = [ "127.0.0.1:${toString internalXftpPort}:443" ]; - - environment = { - ADDR = "xftp.${masterDomain}"; - QUOTA = "10gb"; - }; - - environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ]; - volumes = [ - "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw" - "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw" - "/var/lib/simplex/xftp/files:/srv/xftp:rw" - ]; - }; - }; - - systemd.tmpfiles.rules = [ - "d /var/lib/simplex/smp/config 0755 root root -" - "d /var/lib/simplex/smp/logs 0755 root root -" - "d /var/lib/simplex/rsa_certs 0755 root root -" - - "d /var/lib/simplex/xftp/config 0755 root root -" - "d /var/lib/simplex/xftp/logs 0755 root root -" - "d /var/lib/simplex/xftp/files 0755 root root -" - ]; - - networking.firewall.allowedTCPPorts = [ - 5223 - 5224 - ]; - } - - (lib.mkIf cfg.tor.enable { - assertions = [ - { - assertion = config.os.srv.tor.enable; - message = "SimpleX Tor support requires os.srv.tor to be enabled."; - } - ]; - - services.tor.relay.onionServices = { - simplex-smp = { - version = 3; - map = [ - { - port = 5223; - target = { - addr = "127.0.0.1"; - port = internalSmpPort; - }; - } - ]; - }; - simplex-xftp = { - version = 3; - map = [ - { - port = 5224; - target = { - addr = "127.0.0.1"; - port = internalXftpPort; - }; - } - ]; - }; - }; - }) - ] - ); -} diff --git a/os/srv/sops.nix b/os/srv/sops.nix deleted file mode 100644 index 3ca2d16..0000000 --- a/os/srv/sops.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - config, - lib, - pkgs, - inputs, - username, - ... -}: -let - cfg = config.os.srv.sops; -in -{ - imports = [ inputs.sops-nix.nixosModules.sops ]; - - options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix"; - config = lib.mkIf cfg.enable { - sops = { - defaultSopsFile = ../../secrets/common.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - secrets = { - # "syncthing/gui_password".owner = username; - "syncthing/encryption/keepass".owner = username; - "syncthing/encryption/sync".owner = username; - "obs/websocket_password".owner = username; - }; - }; - - environment.systemPackages = with pkgs; [ - sops - age - ssh-to-age - ]; - }; -} diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix deleted file mode 100644 index 63b2034..0000000 --- a/os/srv/ssh.nix +++ /dev/null @@ -1,95 +0,0 @@ -{ - config, - lib, - username, - ... -}: -let - cfg = config.os.srv.ssh; - keys.main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4"; -in -{ - options.os.srv.ssh = { - server.enable = lib.mkEnableOption "enables the ssh server module"; - client = { - enable = lib.mkEnableOption "enables the ssh client module"; - createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts"; - }; - enableSigning = lib.mkEnableOption "enables signing git commits with ssh keys"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.server.enable { - services.openssh = { - enable = true; - - listenAddresses = [ - { - addr = "127.0.0.1"; - port = 22; - } - ] - ++ lib.optional (config.os.core.network ? lan.ip) { - addr = config.os.core.network.lan.ip; - port = 22; - } - ++ lib.optional (config.os.core.network ? wg.ip) { - addr = config.os.core.network.wg.ip; - port = 22; - } - ++ lib.optional (config.os.core.network ? hs.ip) { - addr = config.os.core.network.hs.ip; - port = 22; - }; - hostKeys = [ - { - path = "/etc/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - } - ]; - settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - PermitRootLogin = "no"; - - PubkeyAcceptedAlgorithms = "ssh-ed25519"; - }; - }; - - users.users = ( - lib.optionalAttrs (username != "" && username != null) { - ${username}.openssh.authorizedKeys.keys = [ - "${keys.main} adikro@disroot.org" - ]; - } - ); - }) - - (lib.mkIf cfg.client.enable { - programs.ssh.startAgent = true; - services.gnome.gcr-ssh-agent.enable = false; - }) - - (lib.mkIf (cfg.client.enable && cfg.client.createAliases) { - # TODO use hjem - programs.ssh.extraConfig = '' - Host github.com codeberg.org - IdentityFile /home/${username}/.ssh/main_id_ed25519.pub - IdentitiesOnly yes - User git - - Host oci - HostName 130.162.223.123 - User opc - ''; - systemd.tmpfiles.rules = [ - "d /home/${username}/.ssh 0700 ${username} users - -" - "f /home/${username}/.ssh/main_id_ed25519.pub 0644 ${username} users - ${keys.main}" - ]; - }) - - (lib.mkIf cfg.enableSigning { - environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}"; - }) - ]; -} diff --git a/os/srv/sunshine.nix b/os/srv/sunshine.nix deleted file mode 100644 index a347568..0000000 --- a/os/srv/sunshine.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfgSunshine = config.os.srv.sunshine; - cfgMoonlight = config.os.srv.moonlight; -in -{ - options.os.srv = { - sunshine.enable = lib.mkEnableOption "enables sunshine streaming server"; - moonlight.enable = lib.mkEnableOption "enables moonlight streaming client"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfgSunshine.enable { - services.sunshine = { - enable = true; - capSysAdmin = true; - openFirewall = true; - autoStart = false; - }; - - hardware.uinput.enable = true; - - users.users.${username}.extraGroups = [ - "video" - "input" - "render" - ]; - }) - - (lib.mkIf cfgMoonlight.enable { - environment.systemPackages = [ - pkgs.moonlight-qt - ]; - }) - ]; -} diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix deleted file mode 100644 index 0c5e53e..0000000 --- a/os/srv/syncthing.nix +++ /dev/null @@ -1,136 +0,0 @@ -{ - config, - lib, - username, - ... -}: -let - cfg = config.os.srv.syncthing; - allFolders = { - "openmw-config" = { - path = "/home/${username}/.config/openmw"; - id = "openmw-config"; - devices = [ "oci" ]; - versioning = { - type = "simple"; - params.keep = "3"; - }; - ignorePatterns = [ - "settings.cfg" - "*.log" - ]; - }; - - "openmw-mods" = { - path = "/home/${username}/games/openmw"; - id = "openmw-mods"; - devices = [ "oci" ]; - versioning = { - type = "trashcan"; - params.cleanoutDays = "7"; - }; - }; - - "game-saves" = { - path = "/home/${username}/.saves"; - id = "game-saves"; - devices = [ "oci" ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "2592000"; - }; - }; - }; - - "keepass" = { - path = "/home/${username}/.keepass"; - id = "keepass"; - devices = [ - { - name = "oci"; - encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path; - } - ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "31536000"; - }; - }; - }; - - "sync" = { - path = "/home/${username}/sync"; - id = "sync"; - devices = [ - { - name = "oci"; - encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path; - } - ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "15552000"; - }; - }; - }; - - "music" = { - path = "/storage/music"; - id = "music"; - devices = [ "oci" ]; - versioning = { - type = "trashcan"; - params.cleanoutDays = "14"; - }; - }; - }; - activeFoldersSet = lib.filterAttrs (name: _: builtins.elem name cfg.activeFolders) allFolders; - - syncDirs = lib.mapAttrsToList (_: folder: folder.path) activeFoldersSet; -in -{ - options.os.srv.syncthing = { - enable = lib.mkEnableOption "enables syncthing syncing"; - - activeFolders = lib.mkOption { - type = lib.types.listOf ( - lib.types.enum [ - "openmw-config" - "openmw-mods" - "game-saves" - "keepass" - "sync" - "music" - ] - ); - default = [ - "keepass" - "sync" - ]; - description = "List of Syncthing folders to enable and sync on this specific machine."; - }; - }; - config = lib.mkIf cfg.enable { - systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs; - - services.syncthing = { - enable = true; - user = username; - dataDir = "/home/${username}/.local/share/syncthing"; - configDir = "/home/${username}/.config/syncthing"; - # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path; - - settings = { - devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ"; - - folders = activeFoldersSet; - }; - }; - }; -} diff --git a/os/srv/tailscale.nix b/os/srv/tailscale.nix deleted file mode 100644 index 5c8d72e..0000000 --- a/os/srv/tailscale.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.tailscale; -in -{ - options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn"; - - config = lib.mkIf cfg.enable { - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "client"; - }; - networking.firewall = { - trustedInterfaces = [ "tailscale0" ]; - checkReversePath = "loose"; - }; - }; -} diff --git a/os/srv/tor.nix b/os/srv/tor.nix deleted file mode 100644 index 8777fba..0000000 --- a/os/srv/tor.nix +++ /dev/null @@ -1,31 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.tor; -in -{ - options.os.srv.tor = { - enable = lib.mkEnableOption "enables tor services"; - enableBrowser = lib.mkEnableOption "enables the tor browser"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - services.tor = { - enable = true; - client = { - enable = true; - dns.enable = true; - transparentProxy.enable = true; - }; - }; - }) - (lib.mkIf cfg.enableBrowser { - environment.systemPackages = [ pkgs.tor-browser ]; - }) - ]; -} diff --git a/os/srv/ups.nix b/os/srv/ups.nix deleted file mode 100644 index 260f346..0000000 --- a/os/srv/ups.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.ups; -in -{ - options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss"; - config = lib.mkIf cfg.enable { - power.ups = { - enable = true; - mode = "standalone"; - - ups.main = { - driver = "usbhid-ups"; - port = "auto"; - description = "Main Server UPS"; - }; - users.upsmon = { - # TODO make password - passwordFile = "sops"; - upsmon = "master"; - }; - upsmon.monitor.main = { - system = "main@localhost"; - user = "upsmon"; - # TODO password - passwordFile = "sops"; - type = "master"; - }; - # settings = { - # MINSUPPLIES = 1; - # POWERDOWNFLAG = "/run/killpower"; - # }; - }; - }; -} diff --git a/os/srv/uptime-kuma.nix b/os/srv/uptime-kuma.nix deleted file mode 100644 index 7bf8dd0..0000000 --- a/os/srv/uptime-kuma.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.uptime-kuma; -in -{ - options.os.srv.uptime-kuma = { - enable = lib.mkEnableOption "enables uptime-kuma"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.uptime-kuma = { - enable = true; - appriseSupport = true; - settings = { - HOST = "127.0.0.1"; - UPTIME_KUMA_DB_TYPE = "sqlite"; - }; - }; - - os.srv.uptime-kuma.proxyConfig = { - "uptime-kuma.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/vector.nix b/os/srv/vector.nix deleted file mode 100644 index a216a19..0000000 --- a/os/srv/vector.nix +++ /dev/null @@ -1,79 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.vector; -in -{ - options.os.srv.vector = { - enable = lib.mkEnableOption "Vector observability data framework"; - agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream"; - aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki"; - }; - - config = lib.mkIf cfg.enable { - services.vector = { - enable = true; - journaldAccess = lib.mkIf cfg.agent.enable true; - validateConfig = true; - - settings = lib.mkMerge [ - (lib.mkIf cfg.agent.enable { - sources.systemd_journal = { - type = "journald"; - exclude_units = [ "vector.service" ]; - }; - - transforms.filter_logs = { - type = "filter"; - inputs = [ "systemd_journal" ]; - condition = ''.status != "debug" && .status != "trace"''; - }; - - sinks.to_aggregator = { - type = "vector"; - inputs = [ "filter_logs" ]; - address = "${config.os.core.network.ips.vm3-monitor}:9000"; - }; - }) - - (lib.mkIf cfg.aggregator.enable { - sources.upstream_agents = { - type = "vector"; - address = "0.0.0.0:9000"; - version = "2"; - }; - - sources.opnsense_syslog = { - type = "syslog"; - address = "${cfg.aggregator.listenAddress}:5140"; - mode = "udp"; - }; - - sinks.loki_backend = { - type = "loki"; - inputs = [ - "upstream_agents" - "opnsense_syslog" - ]; - endpoint = "http://127.0.0.1:3100"; - labels = { - host = "{{ host }}"; - unit = "{{`{{_SYSTEMD_UNIT}}`}}"; - source_type = "{{ type }}"; - }; - buffer = { - type = "disk"; - max_size = 5 * (1024 * 1024 * 1024); - when_full = "block"; - }; - }; - encoding.codec = "json"; - }) - ]; - }; - - networking.firewall = lib.mkIf cfg.aggregator.enable { - allowedTCPPorts = [ 9000 ]; - allowedUDPPorts = [ 5140 ]; - }; - }; -} diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix deleted file mode 100644 index 8ff9f3f..0000000 --- a/os/srv/virtualization.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.virtualization; -in -{ - options.os.srv.virtualization = { - kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager"; - waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization"; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.kvm.enable { - virtualisation.libvirtd = { - enable = true; - qemu.package = pkgs.qemu_kvm; - qemu.swtpm.enable = true; - }; - systemd.services.libvirt-guests.enable = false; - programs.virt-manager.enable = true; - - boot.initrd.kernelModules = - (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd") - ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel"); - }) - (lib.mkIf cfg.waydroid.enable { - virtualisation.waydroid = { - enable = true; - package = pkgs.waydroid-nftables; - }; - - environment.systemPackages = with pkgs; [ - waydroid-helper - ]; - }) - ]; -} diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix deleted file mode 100644 index c758174..0000000 --- a/os/srv/wireguard.nix +++ /dev/null @@ -1,152 +0,0 @@ -{ - config, - lib, - hostname, - masterDomain, - ... -}: -let - cfg = config.os.srv.wireguard; -in -{ - options.os.srv.wireguard = { - enable = lib.mkEnableOption "enables wireguard vpn"; - - role = lib.mkOption { - type = lib.types.enum [ - "server" - "client" - ]; - default = "client"; - description = "where the machine is accepting connections or connecting"; - }; - - server = { - externalInterface = lib.mkOption { - type = lib.types.str; - default = "eth0"; - description = "The public WAN interface of the server"; - }; - publicKey = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = null; - description = "The public key of your primary WireGuard server node."; - }; - - peers = lib.mkOption { - type = lib.types.listOf ( - lib.types.submodule { - options = { - name = lib.mkOption { type = lib.types.str; }; - publicKey = lib.mkOption { type = lib.types.str; }; - }; - } - ); - default = [ ]; - description = "List of client peers authorized to connect to this server"; - }; - }; - - client = { - index = lib.mkOption { - type = lib.types.nullOr lib.types.int; - default = null; - description = "The assigned host index number for the client IP address"; - }; - - routeAllTraffic = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Routes 100% of your internet traffic through the server when active"; - }; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "required for wg private key"; - } - ]; - - sops.secrets."wg_private_key/${hostname}" = { - owner = "root"; - group = "root"; - mode = "0600"; - }; - } - - (lib.mkIf (cfg.role == "server") { - assertions = [ - { - assertion = config.os.srv.firewall.enable; - message = "required for opening ports and passthrough"; - } - ]; - boot.kernel.sysctl."net.ipv4.ip_forward" = 1; - networking.firewall.allowedUDPPorts = [ 51280 ]; - - networking.nftables = { - tables.wg-nat = { - family = "inet"; - content = '' - chain forward { - type filter hook forward priority 0; policy accept; - iifname "wg0" accept - oifname "wg0" accept - } - chain postrouting { - type nat hook postrouting priority 100; policy accept; - oifname "${cfg.server.externalInterface}" masquerade - } - ''; - }; - }; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.3.0.1/24" ]; - listenPort = 51280; - privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; - - peers = lib.imap1 (i: peer: { - publicKey = peer.publicKey; - allowedIPs = [ "10.3.0.${toString (i + 1)}/32" ]; - persistentKeepalive = 25; - }) cfg.server.peers; - }; - }) - - (lib.mkIf (cfg.role == "client") { - assertions = [ - { - assertion = cfg.client.index != null; - message = "WireGuard client role requires a valid 'client.index' integer designation."; - } - ]; - - networking.nameservers = [ - config.os.core.network.ips.vm2-gateway - "9.9.9.9" - ]; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.3.0.${toString cfg.client.index + 1}/24" ]; - privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; - - peers = [ - { - publicKey = cfg.server.publicKey; - endpoint = "${masterDomain}:51280"; - persistentKeepalive = 25; - - allowedIPs = if cfg.client.routeAllTraffic then [ "0.0.0.0/0" ] else [ "10.255.0.0/16" ]; - } - ]; - }; - }) - ] - ); -} diff --git a/os/srv/yggdrasil.nix b/os/srv/yggdrasil.nix deleted file mode 100644 index 6fe91af..0000000 --- a/os/srv/yggdrasil.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.srv.yggdrasil; -in -{ - options.os.srv.yggdrasil.enable = lib.mkEnableOption "enables yggdrasil"; - - config = lib.mkIf cfg.enable { - services = { - yggdrasil = { - enable = true; - openMulticastPort = true; - - settings = { - # PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path; - IfName = "ygg0"; - NodeInfoPrivacy = true; - Peers = [ - "tcp://ip6.fvm.mywire.org:8080?key=000000000143db657d1d6f80b5066dd109a4cb31f7dc6cb5d56050fffb014217" - "tcp://ygg1.mk16.de:1337?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "tcp://62.210.85.80:39565" - - "tls://ygg1.mk16.de:1338?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "tls://103.109.234.106:443?key=000000035621c71b5610434589df051aed2688510f904ae79860668dc0fbf182" - "tls://s2.i2pd.xyz:39575" - - "quic://ygg1.mk16.de:1339?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "quic://ygg6.mk16.de:1339?key=0000005e5ced06fd4d465bc651c5deb6d70cbe82d36efb68c0450268eaaa5384" - "quic://[2a0b:4142:e9e::2]:65535" - ]; - Listen = [ - "tls://0.0.0.0:0" - "tcp://[::]:9001" - ]; - }; - }; - yggdrasil-jumper.enable = true; - }; - }; -} |