config/hosts/vno1-oh2/configuration.nix

740 lines
22 KiB
Nix
Raw Normal View History

2023-07-22 16:05:44 +03:00
{
config,
2023-12-28 23:29:36 +02:00
lib,
2023-07-22 16:05:44 +03:00
pkgs,
myData,
...
2024-02-12 22:46:27 +02:00
}: {
2023-07-22 16:05:44 +03:00
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P"];
immutable = false;
2023-09-12 09:59:55 +03:00
availableKernelModules = [
"ahci"
"xhci_pci"
"nvme"
"usbhid"
"sdhci_pci"
"r8169" # builtin non working
"r8152" # startech usb-ethernet adapter
];
2023-07-22 16:05:44 +03:00
removableEfi = true;
kernelParams = [
2023-09-12 09:59:55 +03:00
"ip=192.168.189.1::192.168.189.4:255.255.255.0:vno1-oh2.jakstys.lt:enp0s21f0u2:off"
2023-07-22 16:05:44 +03:00
];
sshUnlock = {
enable = true;
2023-07-23 15:23:09 +03:00
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
2023-08-27 15:16:52 +03:00
++ [myData.hosts."fra1-a.servers.jakst".publicKey];
2023-07-22 16:05:44 +03:00
};
};
};
boot.binfmt.emulatedSystems = ["aarch64-linux"];
2023-07-22 16:05:44 +03:00
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
2023-07-22 16:05:44 +03:00
base = {
zfs.enable = true;
2023-08-18 16:39:03 +03:00
users = {
2024-02-04 16:18:47 +02:00
enable = true;
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
2023-07-22 16:05:44 +03:00
};
2023-07-26 13:09:40 +03:00
snapshot = {
enable = true;
2023-08-25 19:41:26 +03:00
mountpoints = ["/home" "/var/lib" "/var/log"];
2023-07-26 13:09:40 +03:00
};
2023-07-26 14:23:12 +03:00
zfsborg = {
enable = true;
passwordPath = config.age.secrets.borgbackup-password.path;
2023-07-26 14:39:34 +03:00
sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
dirs = [
2023-09-11 17:50:35 +03:00
# TODO merge
{
mountpoint = "/var/lib";
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-var_lib";
paths = [
"bitwarden_rs"
"caddy"
"gitea"
"grafana"
2023-11-22 22:19:20 +02:00
"hass"
"headscale"
"matrix-synapse"
"nsd-acme"
"tailscale"
"private/soju"
];
patterns = [
"- gitea/data/repo-archive/"
];
backup_at = "*-*-* 01:00:00 UTC";
2024-05-02 17:41:13 +03:00
prune.keep = {
within = "1d";
daily = 1;
weekly = 0;
monthly = 0;
};
}
2023-09-11 17:50:35 +03:00
{
mountpoint = "/var/lib";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_lib";
2023-09-11 17:50:35 +03:00
paths = [
"bitwarden_rs"
"caddy"
"gitea"
"grafana"
2023-11-22 22:19:20 +02:00
"hass"
"headscale"
"matrix-synapse"
"nsd-acme"
"tailscale"
"private/soju"
2023-09-11 17:50:35 +03:00
];
patterns = [
"- gitea/data/repo-archive/"
];
backup_at = "*-*-* 01:00:00 UTC";
2023-09-11 17:50:35 +03:00
}
2023-09-11 17:40:47 +03:00
2023-09-11 17:50:35 +03:00
# TODO: merge
{
mountpoint = "/var/log";
2023-08-25 19:41:26 +03:00
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = ["caddy"];
2023-08-25 19:41:26 +03:00
patterns = [
"+ caddy/access-jakstys.lt.log-*.zst"
2023-08-25 19:41:26 +03:00
"- *"
];
backup_at = "*-*-* 01:30:00 UTC";
}
2023-09-11 17:40:47 +03:00
{
mountpoint = "/var/log";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = ["caddy"];
2023-09-11 17:40:47 +03:00
patterns = [
"+ caddy/access-jakstys.lt.log-*.zst"
2023-09-11 17:40:47 +03:00
"- *"
];
backup_at = "*-*-* 01:30:00 UTC";
2023-09-11 17:40:47 +03:00
}
2023-09-11 17:50:35 +03:00
# TODO merge
{
mountpoint = "/home";
2023-07-26 14:23:12 +03:00
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
paths = [
"motiejus/annex2"
"motiejus/.config/syncthing"
2023-09-11 17:50:35 +03:00
];
backup_at = "*-*-* 02:00:00 UTC";
2023-09-11 17:50:35 +03:00
}
{
mountpoint = "/home";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
2023-09-11 17:50:35 +03:00
paths = [
"motiejus/annex2"
"motiejus/.config/syncthing"
2023-07-26 14:23:12 +03:00
];
backup_at = "*-*-* 02:00:00 UTC";
}
];
2023-07-26 14:23:12 +03:00
};
unitstatus = {
enable = true;
email = "motiejus+alerts@jakstys.lt";
};
2023-07-22 16:05:44 +03:00
};
2023-07-24 09:23:20 +03:00
2023-07-26 13:26:11 +03:00
services = {
2023-09-12 15:46:44 +03:00
friendlyport.ports = [
{
2023-09-12 16:08:08 +03:00
subnets = [myData.subnets.tailscale.cidr];
2023-10-22 09:10:09 +03:00
tcp = with myData.ports; [
2023-09-12 15:46:44 +03:00
80
443
2023-10-22 09:10:09 +03:00
grafana
prometheus
soju
2024-02-12 15:50:52 +02:00
soju-ws
2023-09-12 15:46:44 +03:00
];
}
2023-08-06 00:15:13 +03:00
];
tailscale.enable = true;
2023-08-18 09:31:19 +03:00
node_exporter.enable = true;
2023-08-25 09:27:24 +03:00
gitea.enable = true;
2023-09-14 06:41:16 +03:00
sshguard.enable = true;
2023-11-14 09:01:02 +02:00
hass.enable = true;
2023-09-05 14:41:52 +03:00
headscale = {
enable = true;
clientOidcPath = config.age.secrets.headscale-client-oidc.path;
2023-09-12 16:08:08 +03:00
subnetCIDR = myData.subnets.tailscale.cidr;
};
2023-09-07 08:29:14 +03:00
nsd-acme = let
accountKey = config.age.secrets.letsencrypt-account-key.path;
in {
2023-08-09 14:24:43 +03:00
enable = true;
2023-11-27 18:17:27 +02:00
zones = {
"irc.jakstys.lt".accountKey = accountKey;
"hdd.jakstys.lt".accountKey = accountKey;
"hass.jakstys.lt".accountKey = accountKey;
"grafana.jakstys.lt".accountKey = accountKey;
"bitwarden.jakstys.lt".accountKey = accountKey;
};
2023-08-09 14:24:43 +03:00
};
2023-07-30 05:49:54 +03:00
deployerbot = {
main = {
enable = true;
uidgid = myData.uidgid.updaterbot-deployer;
repo = "git@git.jakstys.lt:motiejus/config";
2023-08-27 01:04:09 +03:00
deployDerivations = [
".#vno1-oh2"
".#fra1-a"
];
2023-09-18 19:50:24 +03:00
deployIfPresent = [
{
derivationTarget = ".#fwminex";
2024-03-25 09:55:11 +02:00
pingTarget = myData.hosts."fwminex.motiejus.jakst".jakstIP;
2023-09-18 19:50:24 +03:00
}
2024-03-27 09:53:53 +02:00
{
derivationTarget = ".#mtworx";
pingTarget = myData.hosts."mtworx.motiejus.jakst".jakstIP;
}
{
derivationTarget = ".#vno3-rp3b";
pingTarget = myData.hosts."vno3-rp3b.servers.jakst".jakstIP;
}
2023-09-18 19:50:24 +03:00
];
2023-07-30 05:49:54 +03:00
};
follower = {
inherit (myData.hosts."vno1-oh2.servers.jakst") publicKey;
2023-07-30 05:49:54 +03:00
enable = true;
2023-09-18 20:49:17 +03:00
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
2023-07-30 05:49:54 +03:00
uidgid = myData.uidgid.updaterbot-deployee;
};
2023-07-28 14:20:50 +03:00
};
2023-07-26 13:26:11 +03:00
postfix = {
enable = true;
saslPasswdPath = config.age.secrets.sasl-passwd.path;
};
2023-07-26 11:36:54 +03:00
2023-07-26 13:26:11 +03:00
syncthing = {
enable = true;
dataDir = "/home/motiejus/";
user = "motiejus";
group = "users";
};
2023-08-25 15:55:06 +03:00
matrix-synapse = {
enable = true;
signingKeyPath = config.age.secrets.synapse-jakstys-signing-key.path;
registrationSharedSecretPath = config.age.secrets.synapse-registration-shared-secret.path;
macaroonSecretKeyPath = config.age.secrets.synapse-macaroon-secret-key.path;
};
2023-07-26 13:26:11 +03:00
zfsunlock = {
enable = true;
2023-08-26 23:45:03 +03:00
targets."fra1-a.servers.jakst" = let
host = myData.hosts."fra1-a.servers.jakst";
in {
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
startAt = "*-*-* *:00/5:00";
};
2023-07-24 09:23:20 +03:00
};
2024-02-27 22:56:09 +02:00
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
2023-07-24 09:23:20 +03:00
};
2023-07-22 16:05:44 +03:00
};
services = {
caddy = {
enable = true;
2023-08-25 10:14:10 +03:00
email = "motiejus+acme@jakstys.lt";
2023-09-06 17:44:30 +03:00
globalConfig = ''
servers {
metrics
}
'';
2023-11-27 18:17:27 +02:00
virtualHosts = {
2024-07-01 01:19:10 +03:00
"www.11sync.net".extraConfig = "redir https://jakstys.lt/2024/11sync-shutdown/";
"11sync.net".extraConfig = "redir https://jakstys.lt/2024/11sync-shutdown/";
2023-11-27 18:17:27 +02:00
"hass.jakstys.lt".extraConfig = ''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
reverse_proxy 127.0.0.1:8123
tls {$CREDENTIALS_DIRECTORY}/hass.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/hass.jakstys.lt-key.pem
'';
"grafana.jakstys.lt".extraConfig = ''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
reverse_proxy 127.0.0.1:3000
tls {$CREDENTIALS_DIRECTORY}/grafana.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/grafana.jakstys.lt-key.pem
'';
"bitwarden.jakstys.lt".extraConfig = ''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
tls {$CREDENTIALS_DIRECTORY}/bitwarden.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/bitwarden.jakstys.lt-key.pem
2023-09-07 08:29:14 +03:00
2023-11-27 18:17:27 +02:00
# from https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples
encode gzip
header {
# Enable HTTP Strict Transport Security (HSTS)
Strict-Transport-Security "max-age=31536000;"
# Enable cross-site filter (XSS) and tell browser to block detected attacks
X-XSS-Protection "1; mode=block"
# Disallow the site to be rendered within a frame (clickjacking protection)
X-Frame-Options "SAMEORIGIN"
}
2023-09-07 08:29:14 +03:00
2023-11-27 18:17:27 +02:00
# deprecated from vaultwarden 1.29.0
reverse_proxy /notifications/hub 127.0.0.1:${toString myData.ports.vaultwarden_ws}
2023-09-07 08:29:14 +03:00
2023-11-27 18:17:27 +02:00
reverse_proxy 127.0.0.1:${toString myData.ports.vaultwarden} {
header_up X-Real-IP {remote_host}
}
'';
"www.jakstys.lt".extraConfig = ''
redir https://jakstys.lt
'';
2024-02-12 22:46:27 +02:00
"irc.jakstys.lt".extraConfig = let
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
gamjaConfig = {
server = {
url = "irc.jakstys.lt:6698";
nick = "motiejus";
};
};
2024-02-13 21:01:38 +02:00
}) {};
2024-02-12 22:46:27 +02:00
in ''
2024-02-12 15:57:41 +02:00
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
2024-02-12 16:01:29 +02:00
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
2024-02-12 15:57:41 +02:00
2024-02-13 21:01:38 +02:00
root * ${gamja}
2024-02-12 15:57:41 +02:00
file_server browse {
precompressed br gzip
}
'';
2023-11-27 18:17:27 +02:00
"dl.jakstys.lt".extraConfig = ''
root * /var/www/dl
file_server browse {
hide .stfolder
2023-08-25 16:44:41 +03:00
}
2023-11-27 18:17:27 +02:00
encode gzip
2023-08-25 16:44:41 +03:00
'';
2023-11-27 18:17:27 +02:00
"jakstys.lt" = {
logFormat = ''
output file ${config.services.caddy.logDir}/access-jakstys.lt.log {
roll_disabled
}
'';
extraConfig = ''
header Strict-Transport-Security "max-age=31536000"
2023-08-25 16:44:41 +03:00
2023-11-27 18:17:27 +02:00
header /_/* Cache-Control "public, max-age=31536000, immutable"
2023-08-25 16:44:41 +03:00
2023-11-27 18:17:27 +02:00
root * /var/www/jakstys.lt
file_server {
precompressed br gzip
}
2023-08-25 16:44:41 +03:00
2023-12-26 11:09:17 +02:00
handle /.well-known/carddav {
redir https://cdav.migadu.com/
}
handle /.well-known/caldav {
redir https://cdav.migadu.com/
}
2023-11-27 18:17:27 +02:00
@matrixMatch {
path /.well-known/matrix/client
path /.well-known/matrix/server
}
header @matrixMatch Content-Type application/json
header @matrixMatch Access-Control-Allow-Origin *
header @matrixMatch Cache-Control "public, max-age=3600, immutable"
2023-08-25 16:44:41 +03:00
2023-11-27 18:17:27 +02:00
handle /.well-known/matrix/client {
respond "{\"m.homeserver\": {\"base_url\": \"https://jakstys.lt\"}}" 200
}
handle /.well-known/matrix/server {
respond "{\"m.server\": \"jakstys.lt:443\"}" 200
}
2023-08-25 16:44:41 +03:00
2023-11-27 18:17:27 +02:00
handle /_matrix/* {
reverse_proxy http://127.0.0.1:${toString myData.ports.matrix-synapse}
}
'';
};
};
};
2023-12-27 23:41:00 +02:00
photoprism = {
2023-12-28 23:29:36 +02:00
enable = true;
originalsPath = "/data";
2023-12-28 23:33:47 +02:00
passwordFile = config.age.secrets.photoprism-admin-passwd.path;
2023-12-27 23:41:00 +02:00
};
logrotate = {
settings = {
"/var/log/caddy/access-jakstys.lt.log" = {
rotate = -1;
frequency = "daily";
dateext = true;
dateyesterday = true;
compress = true;
compresscmd = "${pkgs.zstd}/bin/zstd";
compressext = ".zst";
compressoptions = "--long -19";
uncompresscmd = "${pkgs.zstd}/bin/unzstd";
postrotate = "${pkgs.systemd}/bin/systemctl restart caddy";
};
};
};
2023-08-05 18:28:59 +03:00
grafana = {
enable = true;
2023-08-06 00:11:16 +03:00
provision = {
enable = true;
datasources.settings = {
apiVersion = 1;
2023-08-06 00:47:32 +03:00
datasources = [
{
name = "Prometheus";
type = "prometheus";
access = "proxy";
url = "http://127.0.0.1:${toString config.services.prometheus.port}";
2023-09-06 22:59:48 +03:00
isDefault = true;
jsonData.timeInterval = "10s";
2023-08-06 00:47:32 +03:00
}
];
2023-08-06 00:11:16 +03:00
};
};
2023-08-05 18:28:59 +03:00
settings = {
2023-09-08 07:42:22 +03:00
paths.logs = "/var/log/grafana";
2023-08-05 18:28:59 +03:00
server = {
2023-08-14 15:27:55 +03:00
domain = "grafana.jakstys.lt";
root_url = "https://grafana.jakstys.lt";
enable_gzip = true;
2023-08-06 20:39:48 +03:00
http_addr = "0.0.0.0";
2023-08-05 18:28:59 +03:00
http_port = myData.ports.grafana;
};
2023-08-14 17:00:03 +03:00
users.auto_assign_org = true;
2023-12-07 22:29:11 +02:00
users.auto_assign_org_role = "Editor";
2023-08-14 17:05:44 +03:00
# https://github.com/grafana/grafana/issues/70203#issuecomment-1612823390
auth.oauth_allow_insecure_email_lookup = true;
2023-08-14 17:05:44 +03:00
"auth.generic_oauth" = {
enabled = true;
2023-08-14 17:10:11 +03:00
auto_login = true;
client_id = "5349c113-467d-4b95-a61b-264f2d844da8";
client_secret = "$__file{/run/grafana/oidc-secret}";
auth_url = "https://git.jakstys.lt/login/oauth/authorize";
api_url = "https://git.jakstys.lt/login/oauth/userinfo";
token_url = "https://git.jakstys.lt/login/oauth/access_token";
};
feature_toggles.accessTokenExpirationCheck = true;
2023-08-05 18:28:59 +03:00
};
};
prometheus = {
enable = true;
port = myData.ports.prometheus;
2023-09-06 16:31:48 +03:00
retentionTime = "1y";
2023-08-05 18:28:59 +03:00
globalConfig = {
scrape_interval = "10s";
evaluation_interval = "1m";
};
2023-08-06 00:47:32 +03:00
scrapeConfigs = let
port = builtins.toString myData.ports.exporters.node;
in [
2023-09-06 16:38:21 +03:00
{
job_name = "prometheus";
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.prometheus}"];}];
}
2023-09-06 17:44:30 +03:00
{
job_name = "caddy";
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.exporters.caddy}"];}];
}
2023-08-05 18:28:59 +03:00
{
job_name = "${config.networking.hostName}.${config.networking.domain}";
2023-08-06 00:47:32 +03:00
static_configs = [{targets = ["127.0.0.1:${port}"];}];
}
2023-08-27 00:55:33 +03:00
{
job_name = "fra1-a.servers.jakst";
static_configs = [{targets = ["${myData.hosts."fra1-a.servers.jakst".jakstIP}:${port}"];}];
2023-10-16 14:52:06 +03:00
}
2023-08-16 16:54:17 +03:00
{
job_name = "vno3-rp3b.servers.jakst";
static_configs = [{targets = ["${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${port}"];}];
2023-08-16 16:54:17 +03:00
}
2023-09-18 19:31:45 +03:00
{
job_name = "fwminex.motiejus.jakst";
2024-03-25 09:55:11 +02:00
static_configs = [{targets = ["${myData.hosts."fwminex.motiejus.jakst".jakstIP}:${port}"];}];
2023-09-18 19:31:45 +03:00
}
2024-03-14 15:27:34 +02:00
{
job_name = "mtworx.motiejus.jakst";
2024-03-14 20:31:50 +02:00
static_configs = [{targets = ["${myData.hosts."mtworx.motiejus.jakst".jakstIP}:${port}"];}];
2024-03-14 15:27:34 +02:00
}
2024-03-06 12:36:26 +02:00
{
job_name = "vno1-vinc.vincentas.jakst";
2024-03-06 12:41:23 +02:00
static_configs = [{targets = ["${myData.hosts."vno1-vinc.vincentas.jakst".jakstIP}:9100"];}];
2024-03-06 12:36:26 +02:00
}
2023-08-05 18:28:59 +03:00
];
};
2023-08-05 18:00:43 +03:00
2023-07-22 16:05:44 +03:00
nsd = {
enable = true;
interfaces = ["0.0.0.0" "::"];
zones = {
"jakstys.lt.".data = myData.jakstysLTZone;
2024-01-15 15:08:04 +02:00
"11sync.net.".data = myData.e11syncZone;
2023-07-22 16:05:44 +03:00
};
2023-08-07 01:23:41 +03:00
};
2023-08-22 14:28:59 +03:00
soju = {
enable = true;
2024-02-12 15:50:52 +02:00
listen = [
2024-06-05 23:18:40 +03:00
#"unix+admin://"
2024-02-12 15:50:52 +02:00
":${toString myData.ports.soju}"
2024-02-12 16:03:32 +02:00
"wss://:${toString myData.ports.soju-ws}"
2024-02-12 15:50:52 +02:00
];
2023-08-22 14:28:59 +03:00
tlsCertificate = "/run/soju/cert.pem";
tlsCertificateKey = "/run/soju/key.pem";
hostName = "irc.jakstys.lt";
2024-02-12 16:09:41 +02:00
httpOrigins = ["*"];
2023-08-22 14:28:59 +03:00
extraConfig = ''
2023-08-22 15:13:33 +03:00
message-store fs /var/lib/soju
2023-08-22 14:28:59 +03:00
'';
};
2023-09-07 08:29:14 +03:00
vaultwarden = {
enable = true;
2023-09-07 10:51:27 +03:00
2023-09-07 08:29:14 +03:00
config = {
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = myData.ports.vaultwarden;
2023-09-07 14:26:00 +03:00
LOG_LEVEL = "warn";
2023-09-07 10:51:27 +03:00
DOMAIN = "https://bitwarden.jakstys.lt";
2023-09-07 14:26:00 +03:00
SIGNUPS_ALLOWED = false;
2023-09-07 13:04:38 +03:00
INVITATION_ORG_NAME = "jakstys";
PUSH_ENABLED = true;
2023-09-07 08:29:14 +03:00
# TODO remove after 1.29.0
WEBSOCKET_ENABLED = true;
WEBSOCKET_ADDRESS = "127.0.0.1";
WEBSOCKET_PORT = myData.ports.vaultwarden_ws;
2023-09-07 13:51:43 +03:00
SMTP_HOST = "localhost";
2023-09-07 08:29:14 +03:00
SMTP_PORT = 25;
SMTP_SECURITY = "off";
2023-09-07 13:51:43 +03:00
SMTP_FROM = "admin@jakstys.lt";
SMTP_FROM_NAME = "Bitwarden at jakstys.lt";
2023-09-07 08:29:14 +03:00
};
};
2023-08-07 01:23:41 +03:00
2023-09-07 22:24:00 +03:00
minidlna = {
enable = true;
openFirewall = true;
settings = {
media_dir = ["/home/motiejus/video"];
friendly_name = "vno1-oh2";
inotify = "yes";
};
};
2024-01-25 12:15:59 +02:00
syncthing.relay = {
enable = true;
providedBy = "11sync.net";
};
2023-09-07 22:24:00 +03:00
};
2023-09-07 13:04:38 +03:00
systemd.services = {
caddy = let
2024-02-12 16:01:29 +02:00
irc = config.mj.services.nsd-acme.zones."irc.jakstys.lt";
2023-11-14 09:01:02 +02:00
hass = config.mj.services.nsd-acme.zones."hass.jakstys.lt";
2023-09-07 08:29:14 +03:00
grafana = config.mj.services.nsd-acme.zones."grafana.jakstys.lt";
bitwarden = config.mj.services.nsd-acme.zones."bitwarden.jakstys.lt";
in {
serviceConfig.LoadCredential = [
2024-02-12 16:01:29 +02:00
"irc.jakstys.lt-cert.pem:${irc.certFile}"
"irc.jakstys.lt-key.pem:${irc.keyFile}"
2023-11-14 09:01:02 +02:00
"hass.jakstys.lt-cert.pem:${hass.certFile}"
"hass.jakstys.lt-key.pem:${hass.keyFile}"
2023-09-07 08:29:14 +03:00
"grafana.jakstys.lt-cert.pem:${grafana.certFile}"
"grafana.jakstys.lt-key.pem:${grafana.keyFile}"
"bitwarden.jakstys.lt-cert.pem:${bitwarden.certFile}"
"bitwarden.jakstys.lt-key.pem:${bitwarden.keyFile}"
];
after = [
2024-02-12 16:01:29 +02:00
"nsd-acme-irc.jakstys.lt.service"
2023-11-14 09:01:02 +02:00
"nsd-acme-hass.jakstys.lt.service"
2023-09-07 08:29:14 +03:00
"nsd-acme-grafana.jakstys.lt.service"
"nsd-acme-bitwarden.jakstys.lt.service"
];
requires = [
2024-02-12 16:01:29 +02:00
"nsd-acme-irc.jakstys.lt.service"
2023-11-14 09:01:02 +02:00
"nsd-acme-hass.jakstys.lt.service"
2023-09-07 08:29:14 +03:00
"nsd-acme-grafana.jakstys.lt.service"
"nsd-acme-bitwarden.jakstys.lt.service"
];
};
2023-08-22 14:28:59 +03:00
soju = let
acme = config.mj.services.nsd-acme.zones."irc.jakstys.lt";
in {
serviceConfig = {
RuntimeDirectory = "soju";
LoadCredential = [
"irc.jakstys.lt-cert.pem:${acme.certFile}"
"irc.jakstys.lt-key.pem:${acme.keyFile}"
];
};
preStart = ''
ln -sf $CREDENTIALS_DIRECTORY/irc.jakstys.lt-cert.pem /run/soju/cert.pem
ln -sf $CREDENTIALS_DIRECTORY/irc.jakstys.lt-key.pem /run/soju/key.pem
'';
after = ["nsd-acme-irc.jakstys.lt.service"];
requires = ["nsd-acme-irc.jakstys.lt.service"];
2023-08-22 14:28:59 +03:00
};
2023-09-07 10:51:27 +03:00
vaultwarden = {
2023-09-07 13:04:38 +03:00
preStart = "ln -sf $CREDENTIALS_DIRECTORY/secrets.env /run/vaultwarden/secrets.env";
2023-09-07 10:51:27 +03:00
serviceConfig = {
2023-09-07 13:04:38 +03:00
EnvironmentFile = ["-/run/vaultwarden/secrets.env"];
RuntimeDirectory = "vaultwarden";
2023-09-07 10:51:27 +03:00
LoadCredential = [
2023-09-07 13:04:38 +03:00
"secrets.env:${config.age.secrets.vaultwarden-secrets-env.path}"
2023-09-07 10:51:27 +03:00
];
};
};
grafana = {
preStart = "ln -sf $CREDENTIALS_DIRECTORY/oidc /run/grafana/oidc-secret";
serviceConfig = {
2023-09-08 07:42:22 +03:00
LogsDirectory = "grafana";
RuntimeDirectory = "grafana";
LoadCredential = ["oidc:${config.age.secrets.grafana-oidc.path}"];
};
};
cert-watcher = {
description = "Restart caddy when tls keys/certs change";
wantedBy = ["multi-user.target"];
unitConfig = {
StartLimitIntervalSec = 10;
StartLimitBurst = 5;
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl restart caddy.service";
};
};
2023-09-07 22:31:02 +03:00
minidlna = {
serviceConfig = {
ProtectSystem = "strict";
ProtectHome = "tmpfs";
BindReadOnlyPaths = ["/home/motiejus/video"];
};
};
2023-12-27 23:41:00 +02:00
2024-02-22 10:08:19 +02:00
syncthing-relay.restartIfChanged = false;
2023-12-27 23:41:00 +02:00
photoprism.serviceConfig = {
2023-12-28 23:29:36 +02:00
ProtectHome = lib.mkForce "tmpfs";
2024-01-24 16:07:05 +02:00
BindPaths = [
"/home/motiejus/annex2/M-Active:/data/M-Camera"
"/home/motiejus/annex2/Pictures:/data/Pictures"
];
2023-12-27 23:41:00 +02:00
};
};
systemd.paths = {
cert-watcher = {
wantedBy = ["multi-user.target"];
pathConfig = {
PathChanged = [
2024-02-12 16:01:29 +02:00
config.mj.services.nsd-acme.zones."irc.jakstys.lt".certFile
2023-11-14 09:01:02 +02:00
config.mj.services.nsd-acme.zones."hass.jakstys.lt".certFile
config.mj.services.nsd-acme.zones."grafana.jakstys.lt".certFile
2023-09-07 08:29:14 +03:00
config.mj.services.nsd-acme.zones."bitwarden.jakstys.lt".certFile
];
Unit = "cert-watcher.service";
};
};
};
2023-12-27 23:58:51 +02:00
users = let
uidgid = myData.uidgid.photoprism;
in {
groups.photoprism.gid = uidgid;
users.photoprism = {
group = "photoprism";
uid = uidgid;
};
};
2023-12-16 00:20:17 +02:00
environment.systemPackages = with pkgs; [
2024-01-14 18:23:17 +02:00
yt-dlp
2024-06-16 15:45:23 +03:00
ffmpeg
2023-12-16 00:20:17 +02:00
imapsync
geoipWithDatabase
];
2023-12-07 22:56:16 +02:00
2023-07-22 16:05:44 +03:00
networking = {
hostId = "f9117e1b";
hostName = "vno1-oh2";
2023-07-26 11:36:54 +03:00
domain = "servers.jakst";
2023-07-22 16:05:44 +03:00
defaultGateway = "192.168.189.4";
nameservers = ["192.168.189.4"];
2023-09-12 09:59:55 +03:00
interfaces.enp0s21f0u2.ipv4.addresses = [
2023-07-22 16:05:44 +03:00
{
address = "192.168.189.1";
prefixLength = 24;
}
];
2023-08-07 00:33:37 +03:00
firewall = {
allowedUDPPorts = [53 80 443];
2024-01-25 12:15:59 +02:00
allowedTCPPorts = [
53
80
443
config.services.syncthing.relay.port
config.services.syncthing.relay.statusPort
];
2023-09-21 15:08:26 +03:00
rejectPackets = true;
2023-08-07 00:33:37 +03:00
};
2023-07-22 16:05:44 +03:00
};
}