added basic configuration for nginx, oci-containers and simplex-chat servers

8 files changed, 217 insertions, 46 deletions

diff --git a/os/srv/default.nix b/os/srv/default.nix
index 7f87cfd..b83e892 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -8,9 +8,12 @@
     ./i2p.nix
     ./kdeconnect.nix
     ./monero.nix
+    ./nginx.nix
     ./nix-helper.nix
-    ./ollama.nix
+    ./oci.nix
     ./omnisearch.nix
+    ./opnsense.nix
+    ./simplex.nix
     ./sops.nix
     ./sunshine.nix
     ./syncthing.nix
@@ -18,7 +21,5 @@
     ./virtualization.nix
     ./vpn.nix
     ./yggdrasil.nix
-
-    ./opnsense.nix
   ];
 }
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 164670f..eb8ca81 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -3,7 +3,6 @@
   lib,
   pkgs,
   username,
-  inputs,
   ...
 }:
 let
@@ -37,11 +36,11 @@ in
         enableRenice = true;
         settings = {
           general.renice = 10;
-          # gpu = {
-          #   apply_gpu_optimisations = "accept-responsibility";
-          #   gpu_device = 0;
-          #   amd_performance_level = "high";
-          # };
+          gpu = {
+            apply_gpu_optimisations = "accept-responsibility";
+            gpu_device = 0;
+            amd_performance_level = "high";
+          };
         };
       };
 
@@ -71,13 +70,6 @@ in
       environment.systemPackages = with pkgs; [
         openttd-jgrpp
         openmw
-        inputs.openmw-nix.packages.x86_64-linux.umo
-        inputs.openmw-nix.packages.x86_64-linux.momw-configurator
-        inputs.openmw-nix.packages.x86_64-linux.delta-plugin
-        inputs.openmw-nix.packages.x86_64-linux.openmw-validator
-        inputs.openmw-nix.packages.x86_64-linux.groundcoverify
-        inputs.openmw-nix.packages.x86_64-linux.plox
-        inputs.openmw-nix.packages.x86_64-linux.s3lightfixes
       ];
     })
 
diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
new file mode 100644
index 0000000..b0c01a7
--- /dev/null
+++ b/os/srv/nginx.nix
@@ -0,0 +1,36 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.os.srv.nginx;
+in
+{
+  options.os.srv.nginx = {
+    enable = lib.mkEnableOption "the NGINX reverse proxy service";
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to open ports 80 and 443 in the firewall.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkOptional cfg.openFirewall [
+      80
+      443
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d /var/log/nginx 0750 nginx adm -"
+    ];
+  };
+}
diff --git a/os/srv/oci.nix b/os/srv/oci.nix
new file mode 100644
index 0000000..0d781a7
--- /dev/null
+++ b/os/srv/oci.nix
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.oci;
+in
+{
+  options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman";
+  config = lib.mkIf cfg.enable {
+    virtualisation.podman = {
+      enable = true;
+      dockerCompat = true;
+      defaultNetwork.settings.dns_enabled = true;
+      autoPrune = {
+        enable = true;
+        dates = "weekly";
+        flags = [ "--all" ];
+      };
+    };
+
+    virtualisation.oci-containers.backend = "podman";
+
+    environment.systemPackages = with pkgs; [
+      podman-tui
+      podman-compose
+    ];
+  };
+}
diff --git a/os/srv/ollama.nix b/os/srv/ollama.nix
deleted file mode 100644
index 3afc684..0000000
--- a/os/srv/ollama.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.ollama;
-in
-{
-  options.os.srv.ollama.enable = lib.mkEnableOption "Ollama AI service";
-  config = lib.mkIf cfg.enable {
-    fileSystems."/models" = {
-      device = "/home/ollama";
-      fsType = "none";
-      options = [ "bind" ];
-    };
-
-    services.ollama = {
-      enable = true;
-      package = pkgs.ollama-rocm;
-      rocmOverrideGfx = "12.0.1";
-      user = "ollama";
-      models = "/models";
-    };
-  };
-}
diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
new file mode 100644
index 0000000..9ea54c3
--- /dev/null
+++ b/os/srv/simplex.nix
@@ -0,0 +1,105 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.simplex;
+  internalSmpPort = 5223;
+  internalXftpPort = 5224;
+in
+{
+  options.os.srv.simplex = {
+    enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman";
+    tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX";
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = config.os.srv.oci.enable;
+            message = "SimpleX requires os.srv.oci to be enabled to run containers.";
+          }
+          {
+            assertion = config.os.srv.nginx.enable;
+            message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
+          }
+        ];
+
+        virtualisation.oci-containers.containers = {
+          simplex-smp = {
+            image = "simplexchat/smp-server:latest";
+            ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
+            volumes = [
+              "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
+              "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
+            ];
+          };
+
+          simplex-xftp = {
+            image = "simplexchat/xftp-server:latest";
+            ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
+            volumes = [
+              "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
+              "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
+            ];
+          };
+        };
+
+        services.nginx = {
+          streamConfig = ''
+            server {
+              listen 5223;
+              proxy_pass 127.0.0.1:${toString internalSmpPort};
+            }
+            server {
+              listen 5224;
+              proxy_pass 127.0.0.1:${toString internalXftpPort};
+            }
+          '';
+        };
+
+        systemd.tmpfiles.rules = [
+          "d /var/lib/simplex/smp/config 0755 root root -"
+          "d /var/lib/simplex/smp/logs 0755 root root -"
+          "d /var/lib/simplex/xftp/config 0755 root root -"
+          "d /var/lib/simplex/xftp/logs 0755 root root -"
+        ];
+      }
+
+      (lib.mkIf cfg.tor.enable {
+        assertions = [
+          {
+            assertion = config.os.srv.tor.enable;
+            message = "SimpleX Tor support requires os.srv.tor to be enabled.";
+          }
+        ];
+
+        services.tor.relay.onionServices = {
+          simplex-smp = {
+            version = 3;
+            map = [
+              {
+                port = 5223;
+                target = {
+                  addr = "127.0.0.1";
+                  port = internalSmpPort;
+                };
+              }
+            ];
+          };
+          simplex-xftp = {
+            version = 3;
+            map = [
+              {
+                port = 5224;
+                target = {
+                  addr = "127.0.0.1";
+                  port = internalXftpPort;
+                };
+              }
+            ];
+          };
+        };
+      })
+    ]
+  );
+}
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index b5bf3af..20e1891 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -24,6 +24,8 @@ in
 
       secrets = {
         "syncthing/gui_password".owner = username;
+        "syncthing/encryption/openmw-config".owner = username;
+        "syncthing/encryption/openmw-mods".owner = username;
         "syncthing/encryption/game-saves".owner = username;
         "syncthing/encryption/keepass".owner = username;
         "syncthing/encryption/sync".owner = username;
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
index 2234b88..28806f1 100644
--- a/os/srv/syncthing.nix
+++ b/os/srv/syncthing.nix
@@ -24,6 +24,40 @@ in
         devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ";
 
         folders = {
+          "openmw-config" = {
+            path = "/home/${username}/.config/openmw";
+            id = "openmw-config";
+            devices = [
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/openmw-config".path;
+              }
+            ];
+            versioning = {
+              type = "simple";
+              params.keep = "3";
+            };
+            ignorePatterns = [
+              "settings.cfg"
+              "*.log"
+            ];
+          };
+
+          "openmw-mods" = {
+            path = "/home/${username}/games/openmw";
+            id = "openmw-mods";
+            devices = [
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/openmw-mods".path;
+              }
+            ];
+            versioning = {
+              type = "trashcan";
+              params.cleanoutDays = "7";
+            };
+          };
+
           "game-saves" = {
             path = "/home/${username}/.saves";
             id = "game-saves";
@@ -31,7 +65,6 @@ in
               {
                 name = "oci";
                 encryptionPasswordFile = config.sops.secrets."syncthing/encryption/game-saves".path;
-                compression = "always";
               }
             ];
             versioning = {
@@ -50,7 +83,6 @@ in
               {
                 name = "oci";
                 encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path;
-                compression = "metadata";
               }
             ];
             versioning = {
@@ -66,7 +98,6 @@ in
               {
                 name = "oci";
                 encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path;
-                compression = "metadata";
               }
             ];
             versioning = {