librewolf manual compilation issue

11 files changed, 411 insertions, 76 deletions

diff --git a/os/srv/default.nix b/os/srv/default.nix
index 5729e10..a808328 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -8,22 +8,27 @@
     ./compat.nix
     ./crowdsec.nix
     ./dns.nix
-    ./fail2ban.nix
     ./files.nix
     ./firewall.nix
     ./gaming.nix
+    ./grafana.nix
     ./headscale.nix
     ./i2p.nix
     ./kea.nix
     ./lldap.nix
+    ./loki.nix
     ./mailserver.nix
     ./monero.nix
+    ./netdata.nix
     ./nfs.nix
     ./nginx.nix
     ./nix-helper.nix
+    ./ntfy.nix
     ./ntopng.nix
     ./oci.nix
     ./omnisearch.nix
+    ./prometheus.nix
+    ./scrutiny.nix
     ./simplex.nix
     ./sops.nix
     ./ssh.nix
@@ -32,6 +37,7 @@
     ./tailscale.nix
     ./tor.nix
     ./ups.nix
+    ./uptime-kuma.nix
     ./virtualization.nix
     ./wireguard.nix
     ./yggdrasil.nix
diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix
deleted file mode 100644
index 9b51ceb..0000000
--- a/os/srv/fail2ban.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ config, lib, ... }:
-
-let
-  cfg = config.os.srv.fail2ban;
-in
-{
-  options.os.srv.fail2ban = {
-    enable = lib.mkEnableOption "the NGINX reverse proxy service";
-    nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // {
-      default = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.networking.firewall.enable || config.networking.nftables.enable;
-        message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs.";
-      }
-      {
-        assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable;
-        message = "Fail2ban Nginx jails require your custom Nginx service to be enabled.";
-      }
-    ];
-
-    services.fail2ban = {
-      enable = true;
-
-      bantime = "24h";
-      # findtime = "10m";
-      maxretry = 5;
-
-      banaction = "nftables-multiport";
-
-      ignoreIP = [ "10.0.0.0/16" ];
-
-      jails = lib.mkMerge [
-        {
-          sshd = {
-            enabled = true;
-            settings = {
-              maxretry = 3;
-            };
-          };
-        }
-
-        (lib.mkIf cfg.nginxJails.enable {
-          nginx-http-auth = {
-            enabled = true;
-            settings = {
-              port = "http,https";
-              filter = "nginx-http-auth";
-              maxretry = 5;
-            };
-          };
-
-          nginx-botsearch = {
-            enabled = true;
-            settings = {
-              port = "http,https";
-              filter = "nginx-botsearch";
-              maxretry = 3;
-            };
-          };
-        })
-      ];
-    };
-  };
-}
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 7e9099d..36f2db5 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -106,8 +106,28 @@ in
             imports = [ inputs.sls-steam.homeModules.sls-steam ];
 
             services.sls-steam.config = {
+              PlayNotOwnedGames = true;
               DisableFamilyShareLock = true;
               SafeMode = false;
+              AdditionalApps = [
+                2483190
+                4439260
+                4439270
+                4439280
+                4439300
+                4439750
+                4439790
+                4439800
+                4439810
+                4439820
+                4439830
+                4440380
+                4444140
+                4444150
+                4520350
+                4520360
+                4562050
+              ];
             };
             home.packages = [ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped ];
 
diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix
new file mode 100644
index 0000000..3e1333b
--- /dev/null
+++ b/os/srv/grafana.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
+let
+  cfg = config.os.srv.grafana;
+in
+{
+  options.os.srv.grafana = {
+    enable = lib.mkEnableOption "enables grafana";
+    proxyConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.grafana = {
+      enable = true;
+      settings.server = {
+        http_addr = "127.0.0.1";
+        http_port = 3000;
+      };
+      provision = {
+        enable = true;
+        datasources.settings.datasources = [
+          {
+            name = "Prometheus";
+            type = "prometheus";
+            url = "http://127.0.0.1:9090";
+          }
+          {
+            name = "Loki";
+            type = "loki";
+            url = "http://127.0.0.1:3100";
+          }
+        ];
+      };
+    };
+    os.srv.grafana.proxyConfig = {
+      "grafana.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
+          extraConfig = securityTemplates.restrictToInternal;
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/loki.nix b/os/srv/loki.nix
new file mode 100644
index 0000000..2388432
--- /dev/null
+++ b/os/srv/loki.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.loki;
+in
+{
+  options.os.srv.loki.enable = lib.mkEnableOption "enables loki";
+  config = lib.mkIf cfg.enable {
+    services.loki = {
+      enable = true;
+      configFile = pkgs.writeText "loki-config.yaml" (
+        builtins.toJSON {
+          auth_enabled = false;
+          server = {
+            http_listen_port = 3100;
+          };
+          common = {
+            ring = {
+              kvstore = {
+                store = "inmemory";
+              };
+            };
+            instance_interface_names = [ "lo" ];
+          };
+          ingester = {
+            lifecycler = {
+              address = "127.0.0.1";
+            };
+          };
+          storage_config = {
+            filesystem = {
+              directory = "/var/lib/loki/chunks";
+            };
+          };
+          schema_config = {
+            configs = [
+              {
+                from = "2020-10-24";
+                store = "tsdb";
+                object_store = "filesystem";
+                schema = "v13";
+                index = {
+                  prefix = "index_";
+                  period = "24h";
+                };
+              }
+            ];
+          };
+        }
+      );
+    };
+  };
+}
diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix
new file mode 100644
index 0000000..87854d4
--- /dev/null
+++ b/os/srv/netdata.nix
@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
+let
+  cfg = config.os.srv.netdata;
+in
+{
+  options.os.srv.netdata.enable = lib.mkEnableOption "enables netdata monitoring";
+  config = lib.mkIf cfg.enable {
+    services.netdata = {
+      enable = true;
+      config.web."bind to" = "127.0.0.1";
+
+      python = {
+        enable = true;
+        recommendedPythonPackages = true;
+      };
+    };
+
+    services.nginx.virtualHosts."netdata.${masterDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:19999";
+        extraConfig = securityTemplates.restrictToInternal;
+      };
+    };
+  };
+}
diff --git a/os/srv/ntfy.nix b/os/srv/ntfy.nix
new file mode 100644
index 0000000..1417c81
--- /dev/null
+++ b/os/srv/ntfy.nix
@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
+let
+  cfg = config.os.srv.ntfy;
+in
+{
+  options.os.srv.ntfy = {
+    enable = lib.mkEnableOption "enables ntfy";
+    proxyConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        base-url = "https://ntfy.${masterDomain}";
+
+        listen-http = "127.0.0.1:2586";
+
+        cache-file = "/var/lib/ntfy/cache.db";
+        cache-duration = "72h";
+
+        attachment-cache-dir = "/var/lib/ntfy/attachments";
+        attachment-total-size-limit = "5G";
+        attachment-file-size-limit = "15M";
+        attachment-expiry-duration = "3h";
+
+        behind-proxy = true;
+      };
+    };
+
+    os.srv.ntfy.proxyConfig = {
+      "uptime-kuma.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001";
+          extraConfig = ''
+            proxy_set_header Connection "";
+            proxy_connect_timeout 1m;
+            proxy_send_timeout 1m;
+            proxy_read_timeout 24h;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+            chunked_transfer_encoding on;
+          '';
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/ntopng.nix b/os/srv/ntopng.nix
index 3c11534..692fe2c 100644
--- a/os/srv/ntopng.nix
+++ b/os/srv/ntopng.nix
@@ -1,20 +1,43 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
 let
   cfg = config.os.srv.ntopng;
 in
 {
-  options.os.srv.ntopng.enable = lib.mkEnableOption "enables ntopng monitoring";
+  options.os.srv.ntopng = {
+    enable = lib.mkEnableOption "enables ntopng monitoring";
+    proxyConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+    };
+  };
   config = lib.mkIf cfg.enable {
     services.ntopng = {
       enable = true;
-      httpPort = 3000;
-      extraConfig = "--packet-fanout";
+      extraConfig = "--packet-fanout 'cluster' -g 2 -m '192.168.0.0/16,10.0.0.0/8' -X 50000 --community";
 
       # TODO fill interfaces
       interfaces = [
-        ""
-        ""
+        "" # WAN Interface
+        "" # LAN Interface
+        "" # Virtual Bridge
       ];
     };
+    os.srv.ntopng.proxyConfig = {
+      "ntopng.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
+          extraConfig = securityTemplates.restrictToInternal;
+        };
+      };
+    };
   };
 }
diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix
new file mode 100644
index 0000000..afccef4
--- /dev/null
+++ b/os/srv/prometheus.nix
@@ -0,0 +1,75 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.prometheus;
+in
+{
+  options.os.srv.prometheus.enable = lib.mkEnableOption "enables prometheus";
+  config = lib.mkIf cfg.enable {
+    services.prometheus = {
+      enable = true;
+      port = 9090;
+
+      alertmanagers = [
+        {
+          static_configs = [ { targets = [ "127.0.0.1:9093" ]; } ];
+        }
+      ];
+
+      scrapeConfigs = [
+        {
+          job_name = "prometheus";
+          static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ];
+        }
+        {
+          job_name = "node_exporter";
+          static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
+        }
+        {
+          job_name = "uptime_kuma";
+          metrics_path = "/metrics";
+          static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ];
+        }
+      ];
+      exporters = {
+        node = {
+          enable = true;
+          enableCollectors = [ "systemd" ];
+          port = 9100;
+        };
+
+        alertmanager = {
+          enable = true;
+          port = 9093;
+          configuration = {
+            route = {
+              receiver = "default-receiver";
+              group_by = [ "alertname" ];
+            };
+            receivers = [
+              {
+                name = "default-receiver";
+              }
+            ];
+          };
+        };
+
+        smokeping = {
+          enable = true;
+          listenAddress = "127.0.0.1";
+
+          pingInterval = "1s";
+
+          hosts = [
+            "10.0.0.1" # Personal Router
+            "192.168.0.1" # ISP Modem Box
+            "84.116.254.69" # First ISP Hop
+            "185.182.244.39" # Regional Katowice Hub
+            "1.1.1.1" # Cloudflare DNS
+            "8.8.8.8" # Google DNS
+            "130.162.223.123" # OCI Instance
+          ];
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/scrutiny.nix b/os/srv/scrutiny.nix
new file mode 100644
index 0000000..ffe8c39
--- /dev/null
+++ b/os/srv/scrutiny.nix
@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
+let
+  cfg = config.os.srv.scrutiny;
+in
+{
+  options.os.srv.scrutiny.enable = lib.mkEnableOption "enables scrutiny monitoring";
+  config = lib.mkIf cfg.enable {
+    services.scrutiny = {
+      enable = true;
+      settings.web.listen.host = "127.0.0.1";
+
+      collector = {
+        enable = true;
+        schedule = "hourly";
+        settings.host.id = "bibus-lab";
+      };
+    };
+
+    services.nginx.virtualHosts."scrutiny.${masterDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8080";
+        extraConfig = securityTemplates.restrictToInternal;
+      };
+    };
+  };
+}
diff --git a/os/srv/uptime-kuma.nix b/os/srv/uptime-kuma.nix
new file mode 100644
index 0000000..7bf8dd0
--- /dev/null
+++ b/os/srv/uptime-kuma.nix
@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
+let
+  cfg = config.os.srv.uptime-kuma;
+in
+{
+  options.os.srv.uptime-kuma = {
+    enable = lib.mkEnableOption "enables uptime-kuma";
+    proxyConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.uptime-kuma = {
+      enable = true;
+      appriseSupport = true;
+      settings = {
+        HOST = "127.0.0.1";
+        UPTIME_KUMA_DB_TYPE = "sqlite";
+      };
+    };
+
+    os.srv.uptime-kuma.proxyConfig = {
+      "uptime-kuma.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001";
+          extraConfig = securityTemplates.restrictToInternal;
+        };
+      };
+    };
+  };
+}