From 7c8503e8fa77cb20819e2ba5a6a0f1a261cf089f Mon Sep 17 00:00:00 2001 From: adikro Date: Sun, 10 May 2026 23:02:01 +0200 Subject: added basic configuration for nginx, oci-containers and simplex-chat servers --- os/srv/default.nix | 7 ++-- os/srv/gaming.nix | 18 +++------ os/srv/nginx.nix | 36 ++++++++++++++++++ os/srv/oci.nix | 31 +++++++++++++++ os/srv/ollama.nix | 27 ------------- os/srv/simplex.nix | 105 +++++++++++++++++++++++++++++++++++++++++++++++++++ os/srv/sops.nix | 2 + os/srv/syncthing.nix | 37 ++++++++++++++++-- 8 files changed, 217 insertions(+), 46 deletions(-) create mode 100644 os/srv/nginx.nix create mode 100644 os/srv/oci.nix delete mode 100644 os/srv/ollama.nix create mode 100644 os/srv/simplex.nix (limited to 'os') diff --git a/os/srv/default.nix b/os/srv/default.nix index 7f87cfd..b83e892 100644 --- a/os/srv/default.nix +++ b/os/srv/default.nix @@ -8,9 +8,12 @@ ./i2p.nix ./kdeconnect.nix ./monero.nix + ./nginx.nix ./nix-helper.nix - ./ollama.nix + ./oci.nix ./omnisearch.nix + ./opnsense.nix + ./simplex.nix ./sops.nix ./sunshine.nix ./syncthing.nix @@ -18,7 +21,5 @@ ./virtualization.nix ./vpn.nix ./yggdrasil.nix - - ./opnsense.nix ]; } diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix index 164670f..eb8ca81 100644 --- a/os/srv/gaming.nix +++ b/os/srv/gaming.nix @@ -3,7 +3,6 @@ lib, pkgs, username, - inputs, ... }: let @@ -37,11 +36,11 @@ in enableRenice = true; settings = { general.renice = 10; - # gpu = { - # apply_gpu_optimisations = "accept-responsibility"; - # gpu_device = 0; - # amd_performance_level = "high"; - # }; + gpu = { + apply_gpu_optimisations = "accept-responsibility"; + gpu_device = 0; + amd_performance_level = "high"; + }; }; }; @@ -71,13 +70,6 @@ in environment.systemPackages = with pkgs; [ openttd-jgrpp openmw - inputs.openmw-nix.packages.x86_64-linux.umo - inputs.openmw-nix.packages.x86_64-linux.momw-configurator - inputs.openmw-nix.packages.x86_64-linux.delta-plugin - inputs.openmw-nix.packages.x86_64-linux.openmw-validator - inputs.openmw-nix.packages.x86_64-linux.groundcoverify - inputs.openmw-nix.packages.x86_64-linux.plox - inputs.openmw-nix.packages.x86_64-linux.s3lightfixes ]; }) diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix new file mode 100644 index 0000000..b0c01a7 --- /dev/null +++ b/os/srv/nginx.nix @@ -0,0 +1,36 @@ +{ config, lib, ... }: + +let + cfg = config.os.srv.nginx; +in +{ + options.os.srv.nginx = { + enable = lib.mkEnableOption "the NGINX reverse proxy service"; + + openFirewall = lib.mkOption { + type = lib.types.bool; + default = true; + description = "Whether to open ports 80 and 443 in the firewall."; + }; + }; + + config = lib.mkIf cfg.enable { + services.nginx = { + enable = true; + + recommendedProxySettings = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + }; + + networking.firewall.allowedTCPPorts = lib.mkOptional cfg.openFirewall [ + 80 + 443 + ]; + + systemd.tmpfiles.rules = [ + "d /var/log/nginx 0750 nginx adm -" + ]; + }; +} diff --git a/os/srv/oci.nix b/os/srv/oci.nix new file mode 100644 index 0000000..0d781a7 --- /dev/null +++ b/os/srv/oci.nix @@ -0,0 +1,31 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.oci; +in +{ + options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman"; + config = lib.mkIf cfg.enable { + virtualisation.podman = { + enable = true; + dockerCompat = true; + defaultNetwork.settings.dns_enabled = true; + autoPrune = { + enable = true; + dates = "weekly"; + flags = [ "--all" ]; + }; + }; + + virtualisation.oci-containers.backend = "podman"; + + environment.systemPackages = with pkgs; [ + podman-tui + podman-compose + ]; + }; +} diff --git a/os/srv/ollama.nix b/os/srv/ollama.nix deleted file mode 100644 index 3afc684..0000000 --- a/os/srv/ollama.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.ollama; -in -{ - options.os.srv.ollama.enable = lib.mkEnableOption "Ollama AI service"; - config = lib.mkIf cfg.enable { - fileSystems."/models" = { - device = "/home/ollama"; - fsType = "none"; - options = [ "bind" ]; - }; - - services.ollama = { - enable = true; - package = pkgs.ollama-rocm; - rocmOverrideGfx = "12.0.1"; - user = "ollama"; - models = "/models"; - }; - }; -} diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix new file mode 100644 index 0000000..9ea54c3 --- /dev/null +++ b/os/srv/simplex.nix @@ -0,0 +1,105 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.simplex; + internalSmpPort = 5223; + internalXftpPort = 5224; +in +{ + options.os.srv.simplex = { + enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman"; + tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX"; + }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + assertions = [ + { + assertion = config.os.srv.oci.enable; + message = "SimpleX requires os.srv.oci to be enabled to run containers."; + } + { + assertion = config.os.srv.nginx.enable; + message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying."; + } + ]; + + virtualisation.oci-containers.containers = { + simplex-smp = { + image = "simplexchat/smp-server:latest"; + ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ]; + volumes = [ + "/var/lib/simplex/smp/config:/etc/opt/simplex:rw" + "/var/lib/simplex/smp/logs:/var/opt/simplex:rw" + ]; + }; + + simplex-xftp = { + image = "simplexchat/xftp-server:latest"; + ports = [ "127.0.0.1:${toString internalXftpPort}:443" ]; + volumes = [ + "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw" + "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw" + ]; + }; + }; + + services.nginx = { + streamConfig = '' + server { + listen 5223; + proxy_pass 127.0.0.1:${toString internalSmpPort}; + } + server { + listen 5224; + proxy_pass 127.0.0.1:${toString internalXftpPort}; + } + ''; + }; + + systemd.tmpfiles.rules = [ + "d /var/lib/simplex/smp/config 0755 root root -" + "d /var/lib/simplex/smp/logs 0755 root root -" + "d /var/lib/simplex/xftp/config 0755 root root -" + "d /var/lib/simplex/xftp/logs 0755 root root -" + ]; + } + + (lib.mkIf cfg.tor.enable { + assertions = [ + { + assertion = config.os.srv.tor.enable; + message = "SimpleX Tor support requires os.srv.tor to be enabled."; + } + ]; + + services.tor.relay.onionServices = { + simplex-smp = { + version = 3; + map = [ + { + port = 5223; + target = { + addr = "127.0.0.1"; + port = internalSmpPort; + }; + } + ]; + }; + simplex-xftp = { + version = 3; + map = [ + { + port = 5224; + target = { + addr = "127.0.0.1"; + port = internalXftpPort; + }; + } + ]; + }; + }; + }) + ] + ); +} diff --git a/os/srv/sops.nix b/os/srv/sops.nix index b5bf3af..20e1891 100644 --- a/os/srv/sops.nix +++ b/os/srv/sops.nix @@ -24,6 +24,8 @@ in secrets = { "syncthing/gui_password".owner = username; + "syncthing/encryption/openmw-config".owner = username; + "syncthing/encryption/openmw-mods".owner = username; "syncthing/encryption/game-saves".owner = username; "syncthing/encryption/keepass".owner = username; "syncthing/encryption/sync".owner = username; diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix index 2234b88..28806f1 100644 --- a/os/srv/syncthing.nix +++ b/os/srv/syncthing.nix @@ -24,6 +24,40 @@ in devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ"; folders = { + "openmw-config" = { + path = "/home/${username}/.config/openmw"; + id = "openmw-config"; + devices = [ + { + name = "oci"; + encryptionPasswordFile = config.sops.secrets."syncthing/encryption/openmw-config".path; + } + ]; + versioning = { + type = "simple"; + params.keep = "3"; + }; + ignorePatterns = [ + "settings.cfg" + "*.log" + ]; + }; + + "openmw-mods" = { + path = "/home/${username}/games/openmw"; + id = "openmw-mods"; + devices = [ + { + name = "oci"; + encryptionPasswordFile = config.sops.secrets."syncthing/encryption/openmw-mods".path; + } + ]; + versioning = { + type = "trashcan"; + params.cleanoutDays = "7"; + }; + }; + "game-saves" = { path = "/home/${username}/.saves"; id = "game-saves"; @@ -31,7 +65,6 @@ in { name = "oci"; encryptionPasswordFile = config.sops.secrets."syncthing/encryption/game-saves".path; - compression = "always"; } ]; versioning = { @@ -50,7 +83,6 @@ in { name = "oci"; encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path; - compression = "metadata"; } ]; versioning = { @@ -66,7 +98,6 @@ in { name = "oci"; encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path; - compression = "metadata"; } ]; versioning = { -- cgit v1.3