From 630da5d0639cada53e26a03f579df0a7bac3b17a Mon Sep 17 00:00:00 2001 From: adikro Date: Wed, 17 Jun 2026 00:28:00 +0200 Subject: librewolf manual compilation issue --- os/core/drivers.nix | 1 - os/srv/default.nix | 8 +++++- os/srv/fail2ban.nix | 69 ---------------------------------------------- os/srv/gaming.nix | 20 ++++++++++++++ os/srv/grafana.nix | 54 ++++++++++++++++++++++++++++++++++++ os/srv/loki.nix | 57 ++++++++++++++++++++++++++++++++++++++ os/srv/netdata.nix | 34 +++++++++++++++++++++++ os/srv/ntfy.nix | 59 +++++++++++++++++++++++++++++++++++++++ os/srv/ntopng.nix | 35 +++++++++++++++++++---- os/srv/prometheus.nix | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++ os/srv/scrutiny.nix | 35 +++++++++++++++++++++++ os/srv/uptime-kuma.nix | 41 +++++++++++++++++++++++++++ 12 files changed, 411 insertions(+), 77 deletions(-) delete mode 100644 os/srv/fail2ban.nix create mode 100644 os/srv/grafana.nix create mode 100644 os/srv/loki.nix create mode 100644 os/srv/netdata.nix create mode 100644 os/srv/ntfy.nix create mode 100644 os/srv/prometheus.nix create mode 100644 os/srv/scrutiny.nix create mode 100644 os/srv/uptime-kuma.nix (limited to 'os') diff --git a/os/core/drivers.nix b/os/core/drivers.nix index e6e2814..6e74e98 100644 --- a/os/core/drivers.nix +++ b/os/core/drivers.nix @@ -2,7 +2,6 @@ config, lib, pkgs, - inputs, ... }: let diff --git a/os/srv/default.nix b/os/srv/default.nix index 5729e10..a808328 100644 --- a/os/srv/default.nix +++ b/os/srv/default.nix @@ -8,22 +8,27 @@ ./compat.nix ./crowdsec.nix ./dns.nix - ./fail2ban.nix ./files.nix ./firewall.nix ./gaming.nix + ./grafana.nix ./headscale.nix ./i2p.nix ./kea.nix ./lldap.nix + ./loki.nix ./mailserver.nix ./monero.nix + ./netdata.nix ./nfs.nix ./nginx.nix ./nix-helper.nix + ./ntfy.nix ./ntopng.nix ./oci.nix ./omnisearch.nix + ./prometheus.nix + ./scrutiny.nix ./simplex.nix ./sops.nix ./ssh.nix @@ -32,6 +37,7 @@ ./tailscale.nix ./tor.nix ./ups.nix + ./uptime-kuma.nix ./virtualization.nix ./wireguard.nix ./yggdrasil.nix diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix deleted file mode 100644 index 9b51ceb..0000000 --- a/os/srv/fail2ban.nix +++ /dev/null @@ -1,69 +0,0 @@ -{ config, lib, ... }: - -let - cfg = config.os.srv.fail2ban; -in -{ - options.os.srv.fail2ban = { - enable = lib.mkEnableOption "the NGINX reverse proxy service"; - nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // { - default = true; - }; - }; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.networking.firewall.enable || config.networking.nftables.enable; - message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs."; - } - { - assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable; - message = "Fail2ban Nginx jails require your custom Nginx service to be enabled."; - } - ]; - - services.fail2ban = { - enable = true; - - bantime = "24h"; - # findtime = "10m"; - maxretry = 5; - - banaction = "nftables-multiport"; - - ignoreIP = [ "10.0.0.0/16" ]; - - jails = lib.mkMerge [ - { - sshd = { - enabled = true; - settings = { - maxretry = 3; - }; - }; - } - - (lib.mkIf cfg.nginxJails.enable { - nginx-http-auth = { - enabled = true; - settings = { - port = "http,https"; - filter = "nginx-http-auth"; - maxretry = 5; - }; - }; - - nginx-botsearch = { - enabled = true; - settings = { - port = "http,https"; - filter = "nginx-botsearch"; - maxretry = 3; - }; - }; - }) - ]; - }; - }; -} diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix index 7e9099d..36f2db5 100644 --- a/os/srv/gaming.nix +++ b/os/srv/gaming.nix @@ -106,8 +106,28 @@ in imports = [ inputs.sls-steam.homeModules.sls-steam ]; services.sls-steam.config = { + PlayNotOwnedGames = true; DisableFamilyShareLock = true; SafeMode = false; + AdditionalApps = [ + 2483190 + 4439260 + 4439270 + 4439280 + 4439300 + 4439750 + 4439790 + 4439800 + 4439810 + 4439820 + 4439830 + 4440380 + 4444140 + 4444150 + 4520350 + 4520360 + 4562050 + ]; }; home.packages = [ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped ]; diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix new file mode 100644 index 0000000..3e1333b --- /dev/null +++ b/os/srv/grafana.nix @@ -0,0 +1,54 @@ +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: +let + cfg = config.os.srv.grafana; +in +{ + options.os.srv.grafana = { + enable = lib.mkEnableOption "enables grafana"; + proxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; + config = lib.mkIf cfg.enable { + services.grafana = { + enable = true; + settings.server = { + http_addr = "127.0.0.1"; + http_port = 3000; + }; + provision = { + enable = true; + datasources.settings.datasources = [ + { + name = "Prometheus"; + type = "prometheus"; + url = "http://127.0.0.1:9090"; + } + { + name = "Loki"; + type = "loki"; + url = "http://127.0.0.1:3100"; + } + ]; + }; + }; + os.srv.grafana.proxyConfig = { + "grafana.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }; + }; +} diff --git a/os/srv/loki.nix b/os/srv/loki.nix new file mode 100644 index 0000000..2388432 --- /dev/null +++ b/os/srv/loki.nix @@ -0,0 +1,57 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.loki; +in +{ + options.os.srv.loki.enable = lib.mkEnableOption "enables loki"; + config = lib.mkIf cfg.enable { + services.loki = { + enable = true; + configFile = pkgs.writeText "loki-config.yaml" ( + builtins.toJSON { + auth_enabled = false; + server = { + http_listen_port = 3100; + }; + common = { + ring = { + kvstore = { + store = "inmemory"; + }; + }; + instance_interface_names = [ "lo" ]; + }; + ingester = { + lifecycler = { + address = "127.0.0.1"; + }; + }; + storage_config = { + filesystem = { + directory = "/var/lib/loki/chunks"; + }; + }; + schema_config = { + configs = [ + { + from = "2020-10-24"; + store = "tsdb"; + object_store = "filesystem"; + schema = "v13"; + index = { + prefix = "index_"; + period = "24h"; + }; + } + ]; + }; + } + ); + }; + }; +} diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix new file mode 100644 index 0000000..87854d4 --- /dev/null +++ b/os/srv/netdata.nix @@ -0,0 +1,34 @@ +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: +let + cfg = config.os.srv.netdata; +in +{ + options.os.srv.netdata.enable = lib.mkEnableOption "enables netdata monitoring"; + config = lib.mkIf cfg.enable { + services.netdata = { + enable = true; + config.web."bind to" = "127.0.0.1"; + + python = { + enable = true; + recommendedPythonPackages = true; + }; + }; + + services.nginx.virtualHosts."netdata.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://127.0.0.1:19999"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }; +} diff --git a/os/srv/ntfy.nix b/os/srv/ntfy.nix new file mode 100644 index 0000000..1417c81 --- /dev/null +++ b/os/srv/ntfy.nix @@ -0,0 +1,59 @@ +{ + config, + lib, + masterDomain, + ... +}: +let + cfg = config.os.srv.ntfy; +in +{ + options.os.srv.ntfy = { + enable = lib.mkEnableOption "enables ntfy"; + proxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; + config = lib.mkIf cfg.enable { + services.ntfy-sh = { + enable = true; + settings = { + base-url = "https://ntfy.${masterDomain}"; + + listen-http = "127.0.0.1:2586"; + + cache-file = "/var/lib/ntfy/cache.db"; + cache-duration = "72h"; + + attachment-cache-dir = "/var/lib/ntfy/attachments"; + attachment-total-size-limit = "5G"; + attachment-file-size-limit = "15M"; + attachment-expiry-duration = "3h"; + + behind-proxy = true; + }; + }; + + os.srv.ntfy.proxyConfig = { + "uptime-kuma.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; + extraConfig = '' + proxy_set_header Connection ""; + proxy_connect_timeout 1m; + proxy_send_timeout 1m; + proxy_read_timeout 24h; + + proxy_buffering off; + proxy_request_buffering off; + chunked_transfer_encoding on; + ''; + }; + }; + }; + }; +} diff --git a/os/srv/ntopng.nix b/os/srv/ntopng.nix index 3c11534..692fe2c 100644 --- a/os/srv/ntopng.nix +++ b/os/srv/ntopng.nix @@ -1,20 +1,43 @@ -{ config, lib, ... }: +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: let cfg = config.os.srv.ntopng; in { - options.os.srv.ntopng.enable = lib.mkEnableOption "enables ntopng monitoring"; + options.os.srv.ntopng = { + enable = lib.mkEnableOption "enables ntopng monitoring"; + proxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; config = lib.mkIf cfg.enable { services.ntopng = { enable = true; - httpPort = 3000; - extraConfig = "--packet-fanout"; + extraConfig = "--packet-fanout 'cluster' -g 2 -m '192.168.0.0/16,10.0.0.0/8' -X 50000 --community"; # TODO fill interfaces interfaces = [ - "" - "" + "" # WAN Interface + "" # LAN Interface + "" # Virtual Bridge ]; }; + os.srv.ntopng.proxyConfig = { + "ntopng.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }; }; } diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix new file mode 100644 index 0000000..afccef4 --- /dev/null +++ b/os/srv/prometheus.nix @@ -0,0 +1,75 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.prometheus; +in +{ + options.os.srv.prometheus.enable = lib.mkEnableOption "enables prometheus"; + config = lib.mkIf cfg.enable { + services.prometheus = { + enable = true; + port = 9090; + + alertmanagers = [ + { + static_configs = [ { targets = [ "127.0.0.1:9093" ]; } ]; + } + ]; + + scrapeConfigs = [ + { + job_name = "prometheus"; + static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ]; + } + { + job_name = "node_exporter"; + static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; + } + { + job_name = "uptime_kuma"; + metrics_path = "/metrics"; + static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ]; + } + ]; + exporters = { + node = { + enable = true; + enableCollectors = [ "systemd" ]; + port = 9100; + }; + + alertmanager = { + enable = true; + port = 9093; + configuration = { + route = { + receiver = "default-receiver"; + group_by = [ "alertname" ]; + }; + receivers = [ + { + name = "default-receiver"; + } + ]; + }; + }; + + smokeping = { + enable = true; + listenAddress = "127.0.0.1"; + + pingInterval = "1s"; + + hosts = [ + "10.0.0.1" # Personal Router + "192.168.0.1" # ISP Modem Box + "84.116.254.69" # First ISP Hop + "185.182.244.39" # Regional Katowice Hub + "1.1.1.1" # Cloudflare DNS + "8.8.8.8" # Google DNS + "130.162.223.123" # OCI Instance + ]; + }; + }; + }; + }; +} diff --git a/os/srv/scrutiny.nix b/os/srv/scrutiny.nix new file mode 100644 index 0000000..ffe8c39 --- /dev/null +++ b/os/srv/scrutiny.nix @@ -0,0 +1,35 @@ +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: +let + cfg = config.os.srv.scrutiny; +in +{ + options.os.srv.scrutiny.enable = lib.mkEnableOption "enables scrutiny monitoring"; + config = lib.mkIf cfg.enable { + services.scrutiny = { + enable = true; + settings.web.listen.host = "127.0.0.1"; + + collector = { + enable = true; + schedule = "hourly"; + settings.host.id = "bibus-lab"; + }; + }; + + services.nginx.virtualHosts."scrutiny.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://127.0.0.1:8080"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }; +} diff --git a/os/srv/uptime-kuma.nix b/os/srv/uptime-kuma.nix new file mode 100644 index 0000000..7bf8dd0 --- /dev/null +++ b/os/srv/uptime-kuma.nix @@ -0,0 +1,41 @@ +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: +let + cfg = config.os.srv.uptime-kuma; +in +{ + options.os.srv.uptime-kuma = { + enable = lib.mkEnableOption "enables uptime-kuma"; + proxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; + config = lib.mkIf cfg.enable { + services.uptime-kuma = { + enable = true; + appriseSupport = true; + settings = { + HOST = "127.0.0.1"; + UPTIME_KUMA_DB_TYPE = "sqlite"; + }; + }; + + os.srv.uptime-kuma.proxyConfig = { + "uptime-kuma.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }; + }; +} -- cgit v1.3