Attempt to set up guacamole
This commit is contained in:
parent
7bee8357aa
commit
e924b339c8
SSH key fingerprint:
SHA256:UUF9JT2s8Xfyv76b8ZuVL7XrmimH4o49p4b+iexbVH4
BIN
common/icons/guacamole.png
Normal file
BIN
common/icons/guacamole.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
BIN
common/icons/jupyter.png
Normal file
BIN
common/icons/jupyter.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
|
|
@ -1,26 +0,0 @@
|
||||||
# Ports
|
|
||||||
|
|
||||||
The idea is to always use consecutive ports, but never go back and try to recycle older no longer used ports (for the sake of keeping things clean).
|
|
||||||
|
|
||||||
| Port | Description |
|
|
||||||
| ---- | --------------------------------------------------------------------------- |
|
|
||||||
| 8401 | [whoogle](../hosts/nixos/lapetus/services/whoogle.nix) |
|
|
||||||
| 8402 | [intray api](../hosts/nixos/lapetus/services/intray.nix) |
|
|
||||||
| 8403 | [intray](../hosts/nixos/lapetus/services/intray.nix) |
|
|
||||||
| 8404 | [smos](../hosts/nixos/lapetus/services/smos.nix) |
|
|
||||||
| 8405 | [smos docs](../hosts/nixos/lapetus/services/smos.nix) |
|
|
||||||
| 8406 | [smos api](../hosts/nixos/lapetus/services/smos.nix) |
|
|
||||||
| 8407 | [whoogle](../hosts/nixos/lapetus/services/whoogle.nix) |
|
|
||||||
| 8408 | [vaultwarden](../hosts/nixos/lapetus/services/vaultwarden.nix) |
|
|
||||||
| 8409 | [grafana](../hosts/nixos/lapetus/services/grafana.nix) |
|
|
||||||
| 8410 | [prometheus](../hosts/nixos/lapetus/services/prometheus.nix) |
|
|
||||||
| 8411 | [prometheus node exporter](../hosts/nixos/lapetus/services/prometheus.nix) |
|
|
||||||
| 8412 | [prometheus nginx exporter](../hosts/nixos/lapetus/services/prometheus.nix) |
|
|
||||||
| 8413 | [commafeed](../hosts/nixos/lapetus/services/commafeed.nix) |
|
|
||||||
| 8414 | [invidious](../hosts/nixos/lapetus/services/invidious.nix) |
|
|
||||||
| 8415 | [radicale](../hosts/nixos/lapetus/services/radicale.nix) |
|
|
||||||
| 8416 | [redlib](../hosts/nixos/lapetus/services/redlib.nix) |
|
|
||||||
| 8417 | [qbittorrent](../hosts/nixos/lapetus/services/qbittorrent.nix) |
|
|
||||||
| 8418 | [microbin](../hosts/nixos/lapetus/services/microbin.nix) |
|
|
||||||
| 8419 | [forgejo](../hosts/nixos/lapetus/services/forgejo.nix) |
|
|
||||||
| 8420 | [jupyterjub](../hosts/nixos/lapetus/services/jupyter.nix) |
|
|
||||||
|
|
@ -16,6 +16,7 @@ let
|
||||||
./nix.nix
|
./nix.nix
|
||||||
./locale.nix
|
./locale.nix
|
||||||
./persistence.nix
|
./persistence.nix
|
||||||
|
./ports.nix
|
||||||
./wireless
|
./wireless
|
||||||
|
|
||||||
../../../../common
|
../../../../common
|
||||||
|
|
|
||||||
26
hosts/nixos/common/global/ports.nix
Normal file
26
hosts/nixos/common/global/ports.nix
Normal file
|
|
@ -0,0 +1,26 @@
|
||||||
|
# The idea is to always use consecutive ports, but never go back and try to
|
||||||
|
# recycle older no longer used ports (for the sake of keeping things clean).
|
||||||
|
{
|
||||||
|
satellite.ports = {
|
||||||
|
whoogle = 8401;
|
||||||
|
intray-api = 8402;
|
||||||
|
intray-client = 8403;
|
||||||
|
smos-docs = 8404;
|
||||||
|
smos-api = 8405;
|
||||||
|
smos-client = 8406;
|
||||||
|
vaultwarden = 8407;
|
||||||
|
actual = 8408;
|
||||||
|
grafana = 8409;
|
||||||
|
prometheus = 8410;
|
||||||
|
prometheus-node-exporter = 8411;
|
||||||
|
prometheus-nginx-exporter = 8412;
|
||||||
|
commafeed = 8413;
|
||||||
|
invidious = 8414;
|
||||||
|
radicale = 8415;
|
||||||
|
redlib = 8416;
|
||||||
|
qbittorrent = 8417;
|
||||||
|
microbin = 8418;
|
||||||
|
forgejo = 8419;
|
||||||
|
jupyterhub = 8420;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,5 +1,6 @@
|
||||||
{
|
{
|
||||||
imports = [ ./acme.nix ];
|
imports = [ ./acme.nix ];
|
||||||
|
satellite.nginx.domain = "moonythm.dev"; # Root domain used throughout my config
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
recommendedGzipSettings = true;
|
recommendedGzipSettings = true;
|
||||||
|
|
|
||||||
|
|
@ -2,31 +2,39 @@
|
||||||
imports = [
|
imports = [
|
||||||
../common/global
|
../common/global
|
||||||
../common/users/pilot.nix
|
../common/users/pilot.nix
|
||||||
|
../common/optional/oci.nix
|
||||||
|
../common/optional/services/acme.nix
|
||||||
../common/optional/services/kanata.nix
|
../common/optional/services/kanata.nix
|
||||||
|
../common/optional/services/nginx.nix
|
||||||
|
../common/optional/services/postgres.nix
|
||||||
../common/optional/services/restic
|
../common/optional/services/restic
|
||||||
|
|
||||||
./services/syncthing.nix
|
# ./services/commafeed.nix
|
||||||
./services/whoogle.nix
|
# ./services/ddclient.nix
|
||||||
./services/pounce.nix
|
|
||||||
./services/intray.nix
|
|
||||||
./services/smos.nix
|
|
||||||
./services/vaultwarden.nix
|
|
||||||
./services/actual.nix
|
./services/actual.nix
|
||||||
./services/homer.nix
|
./services/cloudflared.nix
|
||||||
./services/zfs.nix
|
|
||||||
./services/prometheus.nix
|
|
||||||
./services/grafana.nix
|
|
||||||
./services/commafeed.nix
|
|
||||||
./services/invidious.nix
|
|
||||||
./services/diptime.nix
|
./services/diptime.nix
|
||||||
|
./services/forgejo.nix
|
||||||
|
./services/grafana.nix
|
||||||
|
./services/guacamole
|
||||||
|
./services/homer.nix
|
||||||
|
./services/intray.nix
|
||||||
|
./services/invidious.nix
|
||||||
|
./services/jellyfin.nix
|
||||||
|
./services/jupyter.nix
|
||||||
|
./services/microbin.nix
|
||||||
|
./services/pounce.nix
|
||||||
|
./services/prometheus.nix
|
||||||
|
./services/prometheus.nix
|
||||||
|
./services/qbittorrent.nix # turned on/off depending on whether my vpn is paid for
|
||||||
./services/radicale.nix
|
./services/radicale.nix
|
||||||
./services/redlib.nix
|
./services/redlib.nix
|
||||||
./services/jellyfin.nix
|
./services/smos.nix
|
||||||
./services/qbittorrent.nix # turned on/off depending on whether my vpn is paid for
|
./services/syncthing.nix
|
||||||
./services/microbin.nix
|
./services/vaultwarden.nix
|
||||||
./services/forgejo.nix
|
./services/whoogle.nix
|
||||||
./services/jupyter.nix
|
./services/zfs.nix
|
||||||
# ./services/ddclient.nix
|
|
||||||
./filesystems
|
./filesystems
|
||||||
./hardware
|
./hardware
|
||||||
];
|
];
|
||||||
|
|
|
||||||
|
|
@ -8,6 +8,7 @@ microbin_env: ENC[AES256_GCM,data:nxiE9GIvEb0xgqomDdMyy2UtG25pt7h+6JUZkAgIejZbJf
|
||||||
forgejo_mail_password: ENC[AES256_GCM,data:linrpmA8b+8e1+tWNl0=,iv:Mk7suPq0Jt960Zl9s2jj3SSAKt4t8Lv4eKdIo0o8JbE=,tag:TZ0qGJIVSFSUt/0cqamvdw==,type:str]
|
forgejo_mail_password: ENC[AES256_GCM,data:linrpmA8b+8e1+tWNl0=,iv:Mk7suPq0Jt960Zl9s2jj3SSAKt4t8Lv4eKdIo0o8JbE=,tag:TZ0qGJIVSFSUt/0cqamvdw==,type:str]
|
||||||
javi_password: ENC[AES256_GCM,data:5Ifh/DclUz0/AL69Th/GckolrjerLOnDW77SOf+/L3v39T+EOYgK2GDNKtWGGWYX5sdxZ9JwLS3ZVsIOnN4zjFhgV+GChJWkkzjdpJEtpHlmmBKlyS31Fw7SixVkL3y3VJhw72aVv3bMKQ==,iv:FzAmvIlrhna5InsQCRrWVdrKZGmHMb0njWdvgBurdYs=,tag:/Iguu2FbdV/4RSGTnFdyYA==,type:str]
|
javi_password: ENC[AES256_GCM,data:5Ifh/DclUz0/AL69Th/GckolrjerLOnDW77SOf+/L3v39T+EOYgK2GDNKtWGGWYX5sdxZ9JwLS3ZVsIOnN4zjFhgV+GChJWkkzjdpJEtpHlmmBKlyS31Fw7SixVkL3y3VJhw72aVv3bMKQ==,iv:FzAmvIlrhna5InsQCRrWVdrKZGmHMb0njWdvgBurdYs=,tag:/Iguu2FbdV/4RSGTnFdyYA==,type:str]
|
||||||
vpn_env: ENC[AES256_GCM,data:+61Ft1xj1WnaGH6SdUj3sQunDeTWTQ/G2GVQr1KxXVmLehAdO3W2qwqPRsq0qaad3E6eXd7kMU78w1/9fXM34mJXArmXNPW1X+0549+NX4t3QVP83cIRw6B5vwlWMIA8ixEk46a+t7/C6A10hqpyhqHmeyQEOwJvG+Pou61lBmhSkMQy5gjH4ZNsHHZV0/6ZxSk0yAPQq76cPz4dFvyDzdonLnb+2s1KhHC3D7P6SfuWnfJ1EglrDT8R+A==,iv:mw26zTyFnq9CjN06eRmBTWNjh6SRDY7WOCyhBCmyglg=,tag:cPJvzgtruQNLSg7B+br6xQ==,type:str]
|
vpn_env: ENC[AES256_GCM,data:+61Ft1xj1WnaGH6SdUj3sQunDeTWTQ/G2GVQr1KxXVmLehAdO3W2qwqPRsq0qaad3E6eXd7kMU78w1/9fXM34mJXArmXNPW1X+0549+NX4t3QVP83cIRw6B5vwlWMIA8ixEk46a+t7/C6A10hqpyhqHmeyQEOwJvG+Pou61lBmhSkMQy5gjH4ZNsHHZV0/6ZxSk0yAPQq76cPz4dFvyDzdonLnb+2s1KhHC3D7P6SfuWnfJ1EglrDT8R+A==,iv:mw26zTyFnq9CjN06eRmBTWNjh6SRDY7WOCyhBCmyglg=,tag:cPJvzgtruQNLSg7B+br6xQ==,type:str]
|
||||||
|
guacamole_users: ENC[AES256_GCM,data:owqflMMpGLUWPcab8JDlQ12zOuCrfkohxims8we9gKuFX28hrjN1wCmgFDGgX5VqWp07SOKdQVI05xMMO2e9pYgUpeKx5FIa/S/4Q/RNelwWPLmhxqGyEt59L5IBgTfgW5qQMvsl1Q7Xgf8X5bFFUSRmzAx0RFamMPqr71vwPphT7XNnPT8QWQo/2bEUqH0Tb5ITkb1FRSMQzIempuKe4K+awISIDAMwLf87esnoHx+dzQQQObSkKGNDpZ39+IUmeyvTIgN7uWQ349jIzkjNTVMzMUWdpDM6Mn9NwQA8m9BXns9vAe03Ama5cQ0ei64eZSb5uYki0BIV2pYccmIBn4Y/QgfMi5F/L9khr94iiVfH6EWtrDIpVwFt9TNZA/gHbOkQVPyHUMGOpCn2tK5ifFDK0URH5E7WM66BiL3yKd7B9SvQuEN8bnFn64QgiYxSp5NxxGx1ZLE7pzSCEtXkWkCYDHe0xDpOUd+zEfOIeQo7Cdn7y5QaXFyrcwryprYb5Hx/5TtTkCm/+r9nl7BbMKnPLblJvsA77/7pws8xcLgNSAR0ROWqB88vauI1uvwdWN5U5VxsEJmoNQXQKOLOtiQ2mFfIY3DYdHtw1L26ISIYOU6XR7jI/MwOBPO94izEW/j1SwGNgMN5Aydu0RRUhyK9RojjR5CEYjyuqclcD0asJ4faYQn8GvnXJPKF/+U7C6O1g6/ejl3fjwyWRb4kreIATdRfZH+m3nVHgSMvPNk8aPlIs51+SIYMtzf32lKp/AVn2hFKF5g+r2rhWH13Lt9poUg2l//l3jPDY1hpc6dm/5H9ZIGKIqcBlYxqnQngUu51lGO0r6z7u/EsIbInnd5TLK5JrTfnuLuwbyo1yetT2J0MNumy9FcrTsDK4+7DEdAJUxPBRrzllgi+hrnDlVLgLH+7y/gc8lB0cE53GBBXp1N7SfJ1,iv:RFuPux63nSefW3+F08jb94q/NwIKE9g/DGjN++oMdXc=,tag:tCCUIttbK5wfbNpjzY0Bgw==,type:str]
|
||||||
sops:
|
sops:
|
||||||
kms: []
|
kms: []
|
||||||
gcp_kms: []
|
gcp_kms: []
|
||||||
|
|
@ -32,8 +33,8 @@ sops:
|
||||||
RHZ6alYrUU5BZ2xlMkdGR1dWRG5aeGMKJdsdtVZ6Mk9Vo3a+tS+rzAgaF2wpH+8U
|
RHZ6alYrUU5BZ2xlMkdGR1dWRG5aeGMKJdsdtVZ6Mk9Vo3a+tS+rzAgaF2wpH+8U
|
||||||
lWhA+c0Kbe8EJT8hm7Vr8PqBmElz4V9AnXSCTp7D+Cu4pfWsHopLUQ==
|
lWhA+c0Kbe8EJT8hm7Vr8PqBmElz4V9AnXSCTp7D+Cu4pfWsHopLUQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2024-05-31T23:18:45Z"
|
lastmodified: "2024-06-13T13:36:09Z"
|
||||||
mac: ENC[AES256_GCM,data:IUiFsu7+ANxUSr5hR6L3lwK+hP2LpGQFPliGOC3XyhxjLsEkbdCi/CqkaJH7tWZTSUoxMPtdn8JC8mGsnW0puhB6YWA26dbXjlvKGWO+02wcMONy3+prW8v7KLXWe513wsLx1fHOjHMchZj/p8gagOGw19aoGdsTNXnQczwPumo=,iv:hH5R9KFTWvps0JC8iKOkDJMeOfdatFHkz6LedeyY9WE=,tag:2pLvEplrGHpBHbtVfFxCfQ==,type:str]
|
mac: ENC[AES256_GCM,data:3YUMJJaAeU6S7BwB5FzUuke3SKMZ0naRtRQoAnSRMMj39dQmg20rQy8F5cWsPvQAbDhOnY/1t3IxGbc8LGQkapcJJhbLiWuQmnPylZuMIgXhsnEzSyZ195FJcTGP5JTfmUb0GZ29MSBAlqRcZb0IDZjbOpVigp5BbD+s64HpdFE=,iv:p1pg4A1JEX3YlvoG6ncaavbJvURPlkAQM/jKbE+9sgE=,tag:WvULhegnyz/HXRfCEP6DiQ==,type:str]
|
||||||
pgp: []
|
pgp: []
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.8.1
|
version: 3.8.1
|
||||||
|
|
|
||||||
|
|
@ -1,23 +1,15 @@
|
||||||
{ config, ... }:
|
{ config, ... }:
|
||||||
let
|
let dataDir = "/persist/state/var/lib/actual";
|
||||||
port = 8408;
|
|
||||||
host = "actual.moonythm.dev";
|
|
||||||
dataDir = "/persist/state/var/lib/actual";
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
satellite.nginx.at.actual.port = config.satellite.ports.actual;
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
../../common/optional/oci.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts.${host} = config.satellite.proxy port { };
|
|
||||||
systemd.tmpfiles.rules = [ "d ${dataDir}" ];
|
systemd.tmpfiles.rules = [ "d ${dataDir}" ];
|
||||||
|
|
||||||
virtualisation.oci-containers.containers.actual = {
|
virtualisation.oci-containers.containers.actual = {
|
||||||
image = "actualbudget/actual-server:latest";
|
image = "actualbudget/actual-server:latest";
|
||||||
autoStart = true;
|
autoStart = true;
|
||||||
|
|
||||||
ports = [ "${toString port}:5006" ]; # server:docker
|
ports = [ "${toString config.satellite.nginx.at.actual.port}:5006" ]; # server:docker
|
||||||
volumes = [ "${dataDir}:/data" ]; # server:docker
|
volumes = [ "${dataDir}:/data" ]; # server:docker
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,18 +1,11 @@
|
||||||
{ config, ... }:
|
{ config, ... }:
|
||||||
let
|
let
|
||||||
port = 8413;
|
port = config.satellite.ports.commafeed;
|
||||||
host = "rss.moonythm.dev";
|
|
||||||
dataDir = "/persist/state/var/lib/commafeed";
|
dataDir = "/persist/state/var/lib/commafeed";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
../../common/optional/oci.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [ "d ${dataDir}" ];
|
systemd.tmpfiles.rules = [ "d ${dataDir}" ];
|
||||||
services.nginx.virtualHosts.${host} = config.satellite.proxy port
|
satellite.nginx.at.rss.port = port;
|
||||||
{ proxyWebsockets = true; };
|
|
||||||
|
|
||||||
virtualisation.oci-containers.containers.commafeed = {
|
virtualisation.oci-containers.containers.commafeed = {
|
||||||
image = "athou/commafeed:latest";
|
image = "athou/commafeed:latest";
|
||||||
|
|
@ -27,7 +20,7 @@ in
|
||||||
|
|
||||||
# https://github.com/Athou/commafeed/blob/master/commafeed-server/config.yml.example
|
# https://github.com/Athou/commafeed/blob/master/commafeed-server/config.yml.example
|
||||||
environment = {
|
environment = {
|
||||||
CF_APP_PUBLICURL = "https://${host}";
|
CF_APP_PUBLICURL = "https://${config.satellite.nginx.at.rss.host}";
|
||||||
CF_APP_ALLOWREGISTRATIONS = "false"; # I already made an account
|
CF_APP_ALLOWREGISTRATIONS = "false"; # I already made an account
|
||||||
CF_APP_MAXENTRIESAGEDAYS = "0"; # Fetch old entries
|
CF_APP_MAXENTRIESAGEDAYS = "0"; # Fetch old entries
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,6 @@
|
||||||
# DDClient is a dynamic dns service
|
# DDClient is a dynamic dns service
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
imports = [ ../../common/optional/services/acme.nix ];
|
|
||||||
|
|
||||||
services.ddclient = {
|
services.ddclient = {
|
||||||
enable = true;
|
enable = true;
|
||||||
interval = "1m";
|
interval = "1m";
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,9 @@
|
||||||
# I couldn't find a hosted version of this
|
# I couldn't find a hosted version of this
|
||||||
{ pkgs, config, ... }: {
|
{ pkgs, config, ... }: {
|
||||||
imports = [ ../../common/optional/services/nginx.nix ];
|
satellite.nginx.at.diptime.files = pkgs.fetchFromGitHub {
|
||||||
|
owner = "bhickey";
|
||||||
services.nginx.virtualHosts."diptime.moonythm.dev" =
|
repo = "diplomatic-timekeeper";
|
||||||
config.satellite.static (pkgs.fetchFromGitHub {
|
rev = "d6ea7b9d9e94ee6d2db8e4e7cff5f8f1c3f04464";
|
||||||
owner = "bhickey";
|
sha256 = "09s6awz5m6hzpc6jp96c118i372430c7b41acm5m62bllcvrj9vk";
|
||||||
repo = "diplomatic-timekeeper";
|
};
|
||||||
rev = "d6ea7b9d9e94ee6d2db8e4e7cff5f8f1c3f04464";
|
|
||||||
sha256 = "09s6awz5m6hzpc6jp96c118i372430c7b41acm5m62bllcvrj9vk";
|
|
||||||
});
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
{ lib, config, ... }:
|
{ lib, config, ... }:
|
||||||
let
|
let
|
||||||
port = 8419;
|
port = config.satellite.ports.forgejo;
|
||||||
host = "git.moonythm.dev";
|
host = "git.moonythm.dev";
|
||||||
cfg = config.services.forgejo;
|
cfg = config.services.forgejo;
|
||||||
in
|
in
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,6 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
let
|
let
|
||||||
|
port = config.satellite.ports.grafana;
|
||||||
secret = name: "$__file{${config.sops.secrets.${name}.path}}";
|
secret = name: "$__file{${config.sops.secrets.${name}.path}}";
|
||||||
sopsSettings = {
|
sopsSettings = {
|
||||||
sopsFile = ../secrets.yaml;
|
sopsFile = ../secrets.yaml;
|
||||||
|
|
@ -7,11 +8,6 @@ let
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
./prometheus.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.secrets.grafana_smtp_pass = sopsSettings;
|
sops.secrets.grafana_smtp_pass = sopsSettings;
|
||||||
sops.secrets.grafana_discord_webhook = sopsSettings;
|
sops.secrets.grafana_discord_webhook = sopsSettings;
|
||||||
|
|
||||||
|
|
@ -21,9 +17,9 @@ in
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
server = rec {
|
server = rec {
|
||||||
domain = "grafana.moonythm.dev";
|
domain = config.satellite.nginx.at.grafana.host;
|
||||||
root_url = "https://${domain}";
|
root_url = "https://${domain}";
|
||||||
http_port = 8409;
|
http_port = port;
|
||||||
};
|
};
|
||||||
|
|
||||||
# {{{ Smtp
|
# {{{ Smtp
|
||||||
|
|
@ -90,8 +86,7 @@ in
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
# {{{ Networking & storage
|
# {{{ Networking & storage
|
||||||
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} =
|
satellite.nginx.at.grafana.port = port;
|
||||||
config.satellite.proxy config.services.grafana.settings.server.http_port { };
|
|
||||||
|
|
||||||
environment.persistence."/persist/state".directories = [{
|
environment.persistence."/persist/state".directories = [{
|
||||||
directory = config.services.grafana.dataDir;
|
directory = config.services.grafana.dataDir;
|
||||||
|
|
|
||||||
14
hosts/nixos/lapetus/services/guacamole/default.nix
Normal file
14
hosts/nixos/lapetus/services/guacamole/default.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
sops.secrets.guacamoleUsers.sopsFile = ../../secrets.yaml;
|
||||||
|
satellite.nginx.at.guacamole.port = 8443; # default tomcat port
|
||||||
|
|
||||||
|
services.guacamole-server = {
|
||||||
|
enable = true;
|
||||||
|
services.guacamole-server.userMappingXml = config.sops.secrets.guacamoleUsers.path;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.guacamole-client = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
}
|
||||||
1
hosts/nixos/lapetus/services/guacamole/ed25519.pub
Normal file
1
hosts/nixos/lapetus/services/guacamole/ed25519.pub
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4xXKQ07lTMuCIg9Grejp2+o50Fo1ptxyK1oGnWt8jA adrielus@tethys
|
||||||
|
|
@ -20,184 +20,193 @@ let
|
||||||
icon = file: "assets/${iconPath}/${file}";
|
icon = file: "assets/${iconPath}/${file}";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [ ../../common/optional/services/nginx.nix ];
|
satellite.nginx.at.lab.files = pkgs.homer.withAssets {
|
||||||
|
extraAssets = [ iconPath ];
|
||||||
|
config = {
|
||||||
|
title = "✨ The celestial citadel ✨";
|
||||||
|
|
||||||
services.nginx.virtualHosts."lab.moonythm.dev" =
|
header = false;
|
||||||
config.satellite.static (pkgs.homer.withAssets {
|
footer = false;
|
||||||
extraAssets = [ iconPath ];
|
connectivityCheck = true;
|
||||||
config = {
|
|
||||||
title = "✨ The celestial citadel ✨";
|
|
||||||
|
|
||||||
header = false;
|
colors.light = colors;
|
||||||
footer = false;
|
colors.dark = colors;
|
||||||
connectivityCheck = true;
|
|
||||||
|
|
||||||
colors.light = colors;
|
services = [
|
||||||
colors.dark = colors;
|
# {{{ Infrastructure
|
||||||
|
{
|
||||||
services = [
|
name = "Infrastructure";
|
||||||
# {{{ Infrastructure
|
icon = fa "code";
|
||||||
{
|
items = [
|
||||||
name = "Infrastructure";
|
{
|
||||||
icon = fa "code";
|
name = "Prometheus";
|
||||||
items = [
|
type = "Prometheus";
|
||||||
{
|
subtitle = "Monitoring system";
|
||||||
name = "Prometheus";
|
logo = icon "prometheus.png";
|
||||||
type = "Prometheus";
|
url = "https://prometheus.moonythm.dev";
|
||||||
subtitle = "Monitoring system";
|
}
|
||||||
logo = icon "prometheus.png";
|
{
|
||||||
url = "https://prometheus.moonythm.dev";
|
name = "Grafana";
|
||||||
}
|
subtitle = "Pretty dashboards :3";
|
||||||
{
|
logo = icon "grafana.png";
|
||||||
name = "Grafana";
|
url = "https://grafana.moonythm.dev";
|
||||||
subtitle = "Pretty dashboards :3";
|
}
|
||||||
logo = icon "grafana.png";
|
{
|
||||||
url = "https://grafana.moonythm.dev";
|
name = "Syncthing";
|
||||||
}
|
subtitle = "File synchronization";
|
||||||
{
|
logo = icon "syncthing.png";
|
||||||
name = "Syncthing";
|
url = "https://lapetus.syncthing.moonythm.dev";
|
||||||
subtitle = "File synchronization";
|
}
|
||||||
logo = icon "syncthing.png";
|
{
|
||||||
url = "https://lapetus.syncthing.moonythm.dev";
|
name = "Guacamole";
|
||||||
}
|
subtitle = "Server remote access";
|
||||||
];
|
logo = icon "guacamole.png";
|
||||||
}
|
url = "https://guacamole.moonythm.dev";
|
||||||
# }}}
|
}
|
||||||
# {{{ External
|
];
|
||||||
{
|
}
|
||||||
name = "External";
|
# }}}
|
||||||
icon = fa "arrow-up-right-from-square";
|
# {{{ External
|
||||||
items = [
|
{
|
||||||
{
|
name = "External";
|
||||||
name = "Tailscale";
|
icon = fa "arrow-up-right-from-square";
|
||||||
subtitle = "Access this homelab from anywhere";
|
items = [
|
||||||
logo = icon "tailscale.png";
|
{
|
||||||
url = "https://tailscale.com/";
|
name = "Tailscale";
|
||||||
}
|
subtitle = "Access this homelab from anywhere";
|
||||||
{
|
logo = icon "tailscale.png";
|
||||||
name = "Dotfiles";
|
url = "https://tailscale.com/";
|
||||||
subtitle = "Configuration for all my machines";
|
}
|
||||||
logo = icon "github.png";
|
{
|
||||||
url = "https://github.com/prescientmoon/everything-nix";
|
name = "Dotfiles";
|
||||||
}
|
subtitle = "Configuration for all my machines";
|
||||||
{
|
logo = icon "github.png";
|
||||||
name = "Cloudflare";
|
url = "https://github.com/prescientmoon/everything-nix";
|
||||||
subtitle = "Domain management";
|
}
|
||||||
logo = icon "cloudflare.png";
|
{
|
||||||
url = "https://dash.cloudflare.com/761d3e81b3e42551e33c4b73274ecc82/moonythm.dev/";
|
name = "Cloudflare";
|
||||||
}
|
subtitle = "Domain management";
|
||||||
];
|
logo = icon "cloudflare.png";
|
||||||
}
|
url = "https://dash.cloudflare.com/761d3e81b3e42551e33c4b73274ecc82/moonythm.dev/";
|
||||||
# }}}
|
}
|
||||||
# {{{ Productivity
|
];
|
||||||
{
|
}
|
||||||
name = "Productivity";
|
# }}}
|
||||||
icon = fa "rocket";
|
# {{{ Productivity
|
||||||
items = [
|
{
|
||||||
{
|
name = "Productivity";
|
||||||
name = "Intray";
|
icon = fa "rocket";
|
||||||
subtitle = "GTD capture tool";
|
items = [
|
||||||
icon = fa "inbox";
|
{
|
||||||
url = "https://intray.moonythm.dev";
|
name = "Intray";
|
||||||
}
|
subtitle = "GTD capture tool";
|
||||||
{
|
icon = fa "inbox";
|
||||||
name = "Smos";
|
url = "https://intray.moonythm.dev";
|
||||||
subtitle = "A comprehensive self-management system.";
|
}
|
||||||
icon = fa "cubes-stacked";
|
{
|
||||||
url = "https://smos.moonythm.dev";
|
name = "Smos";
|
||||||
}
|
subtitle = "A comprehensive self-management system.";
|
||||||
{
|
icon = fa "cubes-stacked";
|
||||||
name = "Actual";
|
url = "https://smos.moonythm.dev";
|
||||||
subtitle = "Budgeting tool";
|
}
|
||||||
logo = icon "actual.png";
|
{
|
||||||
url = "https://actual.moonythm.dev";
|
name = "Actual";
|
||||||
}
|
subtitle = "Budgeting tool";
|
||||||
];
|
logo = icon "actual.png";
|
||||||
}
|
url = "https://actual.moonythm.dev";
|
||||||
# }}}
|
}
|
||||||
# {{{ Pillars
|
];
|
||||||
{
|
}
|
||||||
name = "Tooling";
|
# }}}
|
||||||
icon = fa "toolbox";
|
# {{{ Tooling
|
||||||
items = [
|
{
|
||||||
{
|
name = "Tooling";
|
||||||
name = "Vaultwarden";
|
icon = fa "toolbox";
|
||||||
subtitle = "Password manager";
|
items = [
|
||||||
logo = icon "bitwarden.png";
|
{
|
||||||
url = "https://warden.moonythm.dev";
|
name = "Vaultwarden";
|
||||||
}
|
subtitle = "Password manager";
|
||||||
{
|
logo = icon "bitwarden.png";
|
||||||
name = "Whoogle";
|
url = "https://warden.moonythm.dev";
|
||||||
subtitle = "Search engine";
|
}
|
||||||
logo = icon "whoogle.webp";
|
{
|
||||||
url = "https://search.moonythm.dev";
|
name = "Whoogle";
|
||||||
}
|
subtitle = "Search engine";
|
||||||
{
|
logo = icon "whoogle.webp";
|
||||||
name = "Radicale";
|
url = "https://search.moonythm.dev";
|
||||||
subtitle = "Calendar server";
|
}
|
||||||
logo = icon "radicale.svg";
|
{
|
||||||
url = "https://cal.moonythm.dev";
|
name = "Radicale";
|
||||||
}
|
subtitle = "Calendar server";
|
||||||
{
|
logo = icon "radicale.svg";
|
||||||
name = "Microbin";
|
url = "https://cal.moonythm.dev";
|
||||||
subtitle = "Code & file sharing";
|
}
|
||||||
logo = icon "microbin.png";
|
{
|
||||||
url = "https://cal.moonythm.dev";
|
name = "Microbin";
|
||||||
}
|
subtitle = "Code & file sharing";
|
||||||
{
|
logo = icon "microbin.png";
|
||||||
name = "Forgejo";
|
url = "https://bin.moonythm.dev";
|
||||||
subtitle = "Git forge";
|
}
|
||||||
logo = icon "forgejo.svg";
|
{
|
||||||
url = "https://git.moonythm.dev";
|
name = "Forgejo";
|
||||||
}
|
subtitle = "Git forge";
|
||||||
];
|
logo = icon "forgejo.svg";
|
||||||
}
|
url = "https://git.moonythm.dev";
|
||||||
# }}}
|
}
|
||||||
# {{{ Entertainment
|
{
|
||||||
{
|
name = "Jupyterhub";
|
||||||
name = "Entertainment";
|
subtitle = "Notebook collaboration suite";
|
||||||
icon = fa "gamepad";
|
logo = icon "jupyter.png";
|
||||||
items = [
|
url = "https://jupyter.moonythm.dev";
|
||||||
{
|
}
|
||||||
name = "Invidious";
|
];
|
||||||
subtitle = "Youtube client";
|
}
|
||||||
logo = icon "invidious.png";
|
# }}}
|
||||||
url = "https://yt.moonythm.dev";
|
# {{{ Entertainment
|
||||||
}
|
{
|
||||||
{
|
name = "Entertainment";
|
||||||
name = "Redlib";
|
icon = fa "gamepad";
|
||||||
subtitle = "Reddit client";
|
items = [
|
||||||
logo = icon "libreddit.png";
|
{
|
||||||
url = "https://redlib.moonythm.dev";
|
name = "Invidious";
|
||||||
}
|
subtitle = "Youtube client";
|
||||||
{
|
logo = icon "invidious.png";
|
||||||
name = "Diptime";
|
url = "https://yt.moonythm.dev";
|
||||||
subtitle = "Diplomacy timer";
|
}
|
||||||
icon = fa "globe";
|
{
|
||||||
url = "https://diptime.moonythm.dev";
|
name = "Redlib";
|
||||||
}
|
subtitle = "Reddit client";
|
||||||
{
|
logo = icon "libreddit.png";
|
||||||
name = "Commafeed";
|
url = "https://redlib.moonythm.dev";
|
||||||
subtitle = "RSS reader";
|
}
|
||||||
logo = icon "commafeed.png";
|
{
|
||||||
url = "https://rss.moonythm.dev";
|
name = "Diptime";
|
||||||
}
|
subtitle = "Diplomacy timer";
|
||||||
{
|
icon = fa "globe";
|
||||||
name = "Qbittorrent";
|
url = "https://diptime.moonythm.dev";
|
||||||
subtitle = "Torrent client";
|
}
|
||||||
logo = icon "qbittorrent.png";
|
{
|
||||||
url = "https://qbit.moonythm.dev";
|
name = "Commafeed";
|
||||||
}
|
subtitle = "RSS reader";
|
||||||
{
|
logo = icon "commafeed.png";
|
||||||
name = "Jellyfin";
|
url = "https://rss.moonythm.dev";
|
||||||
subtitle = "Media server";
|
}
|
||||||
logo = icon "jellyfin.png";
|
{
|
||||||
url = "https://media.moonythm.dev";
|
name = "Qbittorrent";
|
||||||
}
|
subtitle = "Torrent client";
|
||||||
];
|
logo = icon "qbittorrent.png";
|
||||||
}
|
url = "https://qbit.moonythm.dev";
|
||||||
# }}}
|
}
|
||||||
];
|
{
|
||||||
};
|
name = "Jellyfin";
|
||||||
});
|
subtitle = "Media server";
|
||||||
|
logo = icon "jellyfin.png";
|
||||||
|
url = "https://media.moonythm.dev";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
}
|
||||||
|
# }}}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,11 @@
|
||||||
{ inputs, config, ... }:
|
{ inputs, config, ... }:
|
||||||
let
|
let
|
||||||
username = "prescientmoon";
|
username = "prescientmoon";
|
||||||
apiHost = "api.intray.moonythm.dev";
|
apiPort = config.satellite.ports.intray-api;
|
||||||
apiPort = 8402;
|
webPort = config.satellite.ports.intray-client;
|
||||||
webPort = 8403;
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [ inputs.intray.nixosModules.x86_64-linux.default ];
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
inputs.intray.nixosModules.x86_64-linux.default
|
|
||||||
];
|
|
||||||
|
|
||||||
# {{{ Configure intray
|
# {{{ Configure intray
|
||||||
services.intray.production = {
|
services.intray.production = {
|
||||||
|
|
@ -22,13 +18,13 @@ in
|
||||||
web-server = {
|
web-server = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = webPort;
|
port = webPort;
|
||||||
api-url = "https://${apiHost}";
|
api-url = config.satellite.nginx.at."api.intray".url;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
# {{{ Networking & storage
|
# {{{ Networking & storage
|
||||||
services.nginx.virtualHosts.${apiHost} = config.satellite.proxy apiPort { };
|
satellite.nginx.at."intray".port = webPort;
|
||||||
services.nginx.virtualHosts."intray.moonythm.dev" = config.satellite.proxy webPort { };
|
satellite.nginx.at."api.intray".port = apiPort;
|
||||||
|
|
||||||
environment.persistence."/persist/state".directories = [
|
environment.persistence."/persist/state".directories = [
|
||||||
"/www/intray/production/data"
|
"/www/intray/production/data"
|
||||||
|
|
|
||||||
|
|
@ -1,22 +1,16 @@
|
||||||
{ config, pkgs, ... }: {
|
{ config, pkgs, ... }: {
|
||||||
imports = [
|
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
../../common/optional/services/postgres.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.secrets.invidious_hmac_key.sopsFile = ../secrets.yaml;
|
sops.secrets.invidious_hmac_key.sopsFile = ../secrets.yaml;
|
||||||
sops.templates."invidious_hmac_key.json" = {
|
sops.templates."invidious_hmac_key.json" = {
|
||||||
content = ''{ "hmac_key": "${config.sops.placeholder.invidious_hmac_key}" }'';
|
content = ''{ "hmac_key": "${config.sops.placeholder.invidious_hmac_key}" }'';
|
||||||
mode = "0444"; # I don't care about this key that much, as I'm the only user of this instance
|
mode = "0444"; # I don't care about this key that much, as I'm the only user of this instance
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts.${config.services.invidious.domain} =
|
satellite.nginx.at.yt.port = config.satellite.ports.invidious;
|
||||||
config.satellite.proxy config.services.invidious.port { };
|
|
||||||
|
|
||||||
services.invidious = {
|
services.invidious = {
|
||||||
enable = true;
|
enable = true;
|
||||||
domain = "yt.moonythm.dev";
|
domain = config.satellite.nginx.at.yt.host;
|
||||||
port = 8414;
|
port = config.satellite.nginx.at.yt.port;
|
||||||
hmacKeyFile = config.sops.templates."invidious_hmac_key.json".path;
|
hmacKeyFile = config.sops.templates."invidious_hmac_key.json".path;
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,6 @@
|
||||||
{ config, pkgs, ... }: {
|
{ config, pkgs, ... }: {
|
||||||
imports = [ ../../common/optional/services/nginx.nix ];
|
# This is the default port, and can only be changed via the GUI
|
||||||
|
satellite.nginx.at.media.port = 8096;
|
||||||
services.nginx.virtualHosts."media.moonythm.dev" =
|
|
||||||
config.satellite.proxy 8096 { }; # This is the default port, and can only be changed via the GUI
|
|
||||||
|
|
||||||
services.jellyfin.enable = true;
|
services.jellyfin.enable = true;
|
||||||
|
|
||||||
# {{{ Storage
|
# {{{ Storage
|
||||||
|
|
|
||||||
|
|
@ -18,7 +18,7 @@ in
|
||||||
|
|
||||||
services.jupyterhub = {
|
services.jupyterhub = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 8420;
|
port = config.satellite.ports.jupyterhub;
|
||||||
|
|
||||||
jupyterhubEnv = appEnv;
|
jupyterhubEnv = appEnv;
|
||||||
jupyterlabEnv = appEnv;
|
jupyterlabEnv = appEnv;
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,9 @@
|
||||||
{ config, lib, ... }:
|
{ config, lib, ... }:
|
||||||
let
|
let
|
||||||
port = 8418;
|
port = config.satellite.ports.microbin;
|
||||||
host = "bin.moonythm.dev";
|
host = "bin.moonythm.dev";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [ ./cloudflared.nix ];
|
|
||||||
|
|
||||||
sops.secrets.microbin_env.sopsFile = ../secrets.yaml;
|
sops.secrets.microbin_env.sopsFile = ../secrets.yaml;
|
||||||
satellite.cloudflared.targets.${host}.port = port;
|
satellite.cloudflared.targets.${host}.port = port;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,10 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
let host = "prometheus.moonythm.dev";
|
|
||||||
in
|
|
||||||
{
|
{
|
||||||
imports = [ ../../common/optional/services/nginx.nix ];
|
|
||||||
|
|
||||||
# {{{ Main config
|
# {{{ Main config
|
||||||
services.prometheus = {
|
services.prometheus = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 8410;
|
port = config.satellite.ports.prometheus;
|
||||||
webExternalUrl = "https://${host}";
|
webExternalUrl = config.satellite.nginx.at.prometheus.url;
|
||||||
|
|
||||||
# {{{ Base exporters
|
# {{{ Base exporters
|
||||||
exporters = {
|
exporters = {
|
||||||
|
|
@ -16,12 +12,12 @@ in
|
||||||
node = {
|
node = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enabledCollectors = [ "systemd" ];
|
enabledCollectors = [ "systemd" ];
|
||||||
port = 8411;
|
port = config.satellite.ports.prometheus-node-exporter;
|
||||||
};
|
};
|
||||||
|
|
||||||
nginx = {
|
nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 8412;
|
port = config.satellite.ports.prometheus-nginx-exporter;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -38,9 +34,7 @@ in
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
# {{{ Networking & storage
|
# {{{ Networking & storage
|
||||||
services.nginx.virtualHosts.${host} =
|
satellite.nginx.at.prometheus.port = config.services.prometheus.port;
|
||||||
config.satellite.proxy config.services.prometheus.port
|
|
||||||
{ proxyWebsockets = true; };
|
|
||||||
|
|
||||||
environment.persistence."/persist/state".directories = [{
|
environment.persistence."/persist/state".directories = [{
|
||||||
directory = "/var/lib/prometheus2";
|
directory = "/var/lib/prometheus2";
|
||||||
|
|
|
||||||
|
|
@ -3,27 +3,20 @@
|
||||||
# https://www.reddit.com/r/HomeServer/comments/xapl93/a_minimal_configuration_stepbystep_guide_to_media/
|
# https://www.reddit.com/r/HomeServer/comments/xapl93/a_minimal_configuration_stepbystep_guide_to_media/
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
let
|
let
|
||||||
port = 8417;
|
port = config.satellite.ports.qbittorrent;
|
||||||
dataDir = "/persist/data/media";
|
dataDir = "/persist/data/media";
|
||||||
configDir = "/persist/state/var/lib/qbittorrent";
|
configDir = "/persist/state/var/lib/qbittorrent";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
# {{{ Networking & storage
|
||||||
../../common/optional/services/nginx.nix
|
satellite.nginx.at.qbit.port = port;
|
||||||
../../common/optional/oci.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.secrets.vpn_env.sopsFile = ../secrets.yaml;
|
sops.secrets.vpn_env.sopsFile = ../secrets.yaml;
|
||||||
|
|
||||||
services.nginx.virtualHosts."qbit.moonythm.dev" =
|
|
||||||
config.satellite.proxy port { proxyWebsockets = true; };
|
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [
|
systemd.tmpfiles.rules = [
|
||||||
"d ${dataDir} 777 ${config.users.users.pilot.name} users"
|
"d ${dataDir} 777 ${config.users.users.pilot.name} users"
|
||||||
"d ${configDir}"
|
"d ${configDir}"
|
||||||
];
|
];
|
||||||
|
# }}}
|
||||||
# {{{ qbit
|
# {{{ Qbit
|
||||||
virtualisation.oci-containers.containers.qbittorrent = {
|
virtualisation.oci-containers.containers.qbittorrent = {
|
||||||
image = "linuxserver/qbittorrent:latest";
|
image = "linuxserver/qbittorrent:latest";
|
||||||
extraOptions = [ "--network=container:gluetun" ];
|
extraOptions = [ "--network=container:gluetun" ];
|
||||||
|
|
@ -37,7 +30,7 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
# {{{ vpn
|
# {{{ Vpn
|
||||||
virtualisation.oci-containers.containers.gluetun = {
|
virtualisation.oci-containers.containers.gluetun = {
|
||||||
image = "qmcgaw/gluetun";
|
image = "qmcgaw/gluetun";
|
||||||
extraOptions = [
|
extraOptions = [
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
{ config, ... }:
|
{ config, ... }:
|
||||||
let
|
let
|
||||||
port = 8415;
|
port = config.satellite.ports.radicale;
|
||||||
dataDir = "/persist/data/radicale";
|
dataDir = "/persist/data/radicale";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
|
@ -14,7 +14,5 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [ "d ${dataDir} 0700 radicale radicale" ];
|
systemd.tmpfiles.rules = [ "d ${dataDir} 0700 radicale radicale" ];
|
||||||
|
satellite.nginx.at.cal.port = port;
|
||||||
services.nginx.virtualHosts."cal.moonythm.dev" =
|
|
||||||
config.satellite.proxy port { };
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,9 @@
|
||||||
{ config, lib, upkgs, ... }:
|
{ config, lib, upkgs, ... }:
|
||||||
let port = 8416;
|
let port = config.satellite.ports.redlib;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [ ../../common/optional/services/nginx.nix ];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."redlib.moonythm.dev" =
|
|
||||||
config.satellite.proxy port { };
|
|
||||||
|
|
||||||
services.libreddit.enable = true;
|
services.libreddit.enable = true;
|
||||||
|
satellite.nginx.at.redlib.port = port;
|
||||||
systemd.services.libreddit.serviceConfig.ExecStart =
|
systemd.services.libreddit.serviceConfig.ExecStart =
|
||||||
lib.mkForce "${upkgs.redlib}/bin/redlib --port ${toString port}";
|
lib.mkForce "${upkgs.redlib}/bin/redlib --port ${toString port}";
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,20 +1,8 @@
|
||||||
{ inputs, config, ... }:
|
{ inputs, config, ... }:
|
||||||
let
|
let username = "prescientmoon";
|
||||||
username = "prescientmoon";
|
|
||||||
docsHost = "docs.smos.moonythm.dev";
|
|
||||||
apiHost = "api.smos.moonythm.dev";
|
|
||||||
webHost = "smos.moonythm.dev";
|
|
||||||
docsPort = 8404;
|
|
||||||
apiPort = 8405;
|
|
||||||
webPort = 8406;
|
|
||||||
|
|
||||||
https = host: "https://${host}";
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [ inputs.smos.nixosModules.x86_64-linux.default ];
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
inputs.smos.nixosModules.x86_64-linux.default
|
|
||||||
];
|
|
||||||
|
|
||||||
# {{{ Configure smos
|
# {{{ Configure smos
|
||||||
services.smos.production = {
|
services.smos.production = {
|
||||||
|
|
@ -24,16 +12,16 @@ in
|
||||||
docs-site = {
|
docs-site = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = false;
|
openFirewall = false;
|
||||||
port = docsPort;
|
port = config.satellite.nginx.at."docs.smos".port;
|
||||||
api-url = https apiHost;
|
api-url = config.satellite.nginx.at."api.smos".url;
|
||||||
web-url = https webHost;
|
web-url = config.satellite.nginx.at."smos".url;
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
# {{{ Api server
|
# {{{ Api server
|
||||||
api-server = {
|
api-server = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = false;
|
openFirewall = false;
|
||||||
port = apiPort;
|
port = config.satellite.nginx.at."api.smos".port;
|
||||||
admin = username;
|
admin = username;
|
||||||
|
|
||||||
max-backups-per-user = 5;
|
max-backups-per-user = 5;
|
||||||
|
|
@ -45,25 +33,18 @@ in
|
||||||
web-server = {
|
web-server = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = false;
|
openFirewall = false;
|
||||||
port = webPort;
|
port = config.satellite.nginx.at."smos".port;
|
||||||
docs-url = https docsHost;
|
docs-url = config.satellite.nginx.at."docs.smos".url;
|
||||||
api-url = https apiHost;
|
api-url = config.satellite.nginx.at."api.smos".url;
|
||||||
web-url = https webHost;
|
web-url = config.satellite.nginx.at."smos".url;
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
};
|
};
|
||||||
# }}}
|
# }}}
|
||||||
# {{{ Networking & storage
|
# {{{ Networking & storage
|
||||||
services.nginx.virtualHosts.${docsHost} = config.satellite.proxy docsPort { };
|
satellite.nginx.at."docs.smos".port = config.satellite.ports.smos-docs;
|
||||||
services.nginx.virtualHosts.${apiHost} = config.satellite.proxy apiPort { };
|
satellite.nginx.at."api.smos".port = config.satellite.ports.smos-api;
|
||||||
services.nginx.virtualHosts.${webHost} = config.satellite.proxy webPort {
|
satellite.nginx.at."smos".port = config.satellite.ports.smos-client;
|
||||||
proxyWebsockets = true;
|
|
||||||
|
|
||||||
# Just to make sure we don't run into 413 errors on big syncs
|
|
||||||
extraConfig = ''
|
|
||||||
client_max_body_size 0;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.persistence."/persist/state".directories = [
|
environment.persistence."/persist/state".directories = [
|
||||||
"/www/smos/production"
|
"/www/smos/production"
|
||||||
|
|
|
||||||
|
|
@ -2,16 +2,11 @@
|
||||||
let port = 8384;
|
let port = 8384;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
|
||||||
../../common/optional/services/syncthing.nix
|
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
services.syncthing = {
|
services.syncthing = {
|
||||||
settings.folders = { };
|
settings.folders = { };
|
||||||
guiAddress = "127.0.0.1:${toString port}";
|
guiAddress = "127.0.0.1:${toString port}";
|
||||||
settings.gui.insecureSkipHostcheck = true;
|
settings.gui.insecureSkipHostcheck = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."lapetus.syncthing.moonythm.dev" = config.satellite.proxy port { };
|
satellite.nginx.at."lapetus.syncthing".port = port;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,6 @@
|
||||||
{ config, ... }:
|
{ config, ... }:
|
||||||
let
|
|
||||||
port = 8407;
|
|
||||||
host = "warden.moonythm.dev";
|
|
||||||
in
|
|
||||||
{
|
{
|
||||||
imports = [ ../../common/optional/services/nginx.nix ];
|
satellite.nginx.at.warden.port = config.satellite.ports.vaultwarden;
|
||||||
|
|
||||||
services.nginx.virtualHosts.${host} =
|
|
||||||
config.satellite.proxy port { proxyWebsockets = true; };
|
|
||||||
|
|
||||||
# {{{ Secrets
|
# {{{ Secrets
|
||||||
sops.secrets.vaultwarden_env = {
|
sops.secrets.vaultwarden_env = {
|
||||||
|
|
@ -21,11 +14,11 @@ in
|
||||||
enable = true;
|
enable = true;
|
||||||
environmentFile = config.sops.secrets.vaultwarden_env.path;
|
environmentFile = config.sops.secrets.vaultwarden_env.path;
|
||||||
config = {
|
config = {
|
||||||
DOMAIN = "https://${host}";
|
DOMAIN = "https://${config.satellite.nginx.at.warden.host}";
|
||||||
|
ROCKET_PORT = config.satellite.nginx.at.warden.port;
|
||||||
ROCKET_ADDRESS = "127.0.0.1";
|
ROCKET_ADDRESS = "127.0.0.1";
|
||||||
ROCKET_PORT = port;
|
|
||||||
|
|
||||||
SIGNUPS_ALLOWED = true;
|
SIGNUPS_ALLOWED = false;
|
||||||
SHOW_PASSWORD_HINT = false;
|
SHOW_PASSWORD_HINT = false;
|
||||||
|
|
||||||
SMTP_SECURITY = "force_tls";
|
SMTP_SECURITY = "force_tls";
|
||||||
|
|
|
||||||
|
|
@ -1,39 +1,32 @@
|
||||||
{ lib, config, ... }:
|
{ lib, config, ... }:
|
||||||
let
|
let websiteBlocklist = [
|
||||||
port = 8401;
|
"www.saashub.com"
|
||||||
websiteBlocklist = [
|
"slant.co"
|
||||||
"www.saashub.com"
|
"nix-united.com"
|
||||||
"slant.co"
|
"libhunt.com"
|
||||||
"nix-united.com"
|
"www.devopsschool.com"
|
||||||
"libhunt.com"
|
"medevel.com"
|
||||||
"www.devopsschool.com"
|
"alternativeto.net"
|
||||||
"medevel.com"
|
"linuxiac.com"
|
||||||
"alternativeto.net"
|
"www.linuxlinks.com"
|
||||||
"linuxiac.com"
|
"sourceforge.net"
|
||||||
"www.linuxlinks.com"
|
];
|
||||||
"sourceforge.net"
|
|
||||||
];
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
|
||||||
../../common/optional/services/nginx.nix
|
|
||||||
../../common/optional/oci.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
virtualisation.oci-containers.containers.whoogle-search = {
|
virtualisation.oci-containers.containers.whoogle-search = {
|
||||||
image = "benbusby/whoogle-search";
|
image = "benbusby/whoogle-search";
|
||||||
autoStart = true;
|
autoStart = true;
|
||||||
ports = [ "${toString port}:5000" ]; # server:docker
|
ports = [ "${toString config.satellite.nginx.at.search.port}:5000" ]; # server:docker
|
||||||
environment = {
|
environment = {
|
||||||
WHOOGLE_UPDATE_CHECK = "0";
|
WHOOGLE_UPDATE_CHECK = "0";
|
||||||
WHOOGLE_CONFIG_DISABLE = "0";
|
WHOOGLE_CONFIG_DISABLE = "0";
|
||||||
WHOOGLE_CONFIG_BLOCK = lib.concatStringsSep "," websiteBlocklist;
|
WHOOGLE_CONFIG_BLOCK = lib.concatStringsSep "," websiteBlocklist;
|
||||||
WHOOGLE_CONFIG_THEME = "system";
|
WHOOGLE_CONFIG_THEME = "system";
|
||||||
WHOOGLE_ALT_WIKI = ""; # disable redirecting wikipedia links
|
WHOOGLE_ALT_WIKI = ""; # disable redirecting wikipedia links
|
||||||
WHOOGLE_ALT_RD = "redlib.moonythm.dev";
|
WHOOGLE_ALT_RD = config.satellite.nginx.at.redlib.host;
|
||||||
WHOOGLE_ALT_YT = "yt.moonythm.dev";
|
WHOOGLE_ALT_YT = config.satellite.nginx.at.yt.host;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."search.moonythm.dev" = config.satellite.proxy port { };
|
satellite.nginx.at.search.port = config.satellite.ports.whoogle;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -26,7 +26,8 @@ This directory contains custom module definitions used throughout my config.
|
||||||
| Name | Attribute | Description |
|
| Name | Attribute | Description |
|
||||||
| -------------------------------------- | ----------------------- | ------------------------------------------- |
|
| -------------------------------------- | ----------------------- | ------------------------------------------- |
|
||||||
| [pounce](./nixos/pounce.nix) | `services.pounce` | Module for pounce & calico configuration |
|
| [pounce](./nixos/pounce.nix) | `services.pounce` | Module for pounce & calico configuration |
|
||||||
| [nginx](./nixos/nginx.nix) | `satellite.proxy` | Helpers for nginx configuration |
|
| [nginx](./nixos/nginx.nix) | `satellite.nginx` | Helpers for nginx configuration |
|
||||||
|
| [ports](./nixos/ports.nix) | `satellite.ports` | Global port specification |
|
||||||
| [cloudflared](./nixos/cloudflared.nix) | `satellite.cloudflared` | Helpers for cloudflare tunnel configuration |
|
| [cloudflared](./nixos/cloudflared.nix) | `satellite.cloudflared` | Helpers for cloudflare tunnel configuration |
|
||||||
| [pilot](./nixos/pilot.nix) | `satellite.pilot` | Defined the concept of a "main user" |
|
| [pilot](./nixos/pilot.nix) | `satellite.pilot` | Defined the concept of a "main user" |
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -3,6 +3,7 @@
|
||||||
{
|
{
|
||||||
# example = import ./example.nix;
|
# example = import ./example.nix;
|
||||||
cloudflared = import ./cloudflared.nix;
|
cloudflared = import ./cloudflared.nix;
|
||||||
|
ports = import ./ports.nix;
|
||||||
nginx = import ./nginx.nix;
|
nginx = import ./nginx.nix;
|
||||||
pilot = import ./pilot.nix;
|
pilot = import ./pilot.nix;
|
||||||
pounce = import ./pounce.nix;
|
pounce = import ./pounce.nix;
|
||||||
|
|
|
||||||
|
|
@ -1,25 +1,85 @@
|
||||||
{ lib, ... }: {
|
{ config, lib, ... }:
|
||||||
options.satellite.proxy = lib.mkOption {
|
let cfg = config.satellite.nginx;
|
||||||
type = lib.types.functionTo (lib.types.functionTo lib.types.anything);
|
in
|
||||||
description = "Helper function for generating a quick proxy config";
|
{
|
||||||
|
options.satellite.nginx = {
|
||||||
|
domain = lib.mkOption {
|
||||||
|
description = "Root domain to use as a default for configurations.";
|
||||||
|
type = lib.types.str;
|
||||||
|
};
|
||||||
|
|
||||||
|
at = lib.mkOption {
|
||||||
|
description = "Per-subdomain nginx configuration";
|
||||||
|
type = lib.types.attrsOf (lib.types.submodule ({ name, config, ... }: {
|
||||||
|
options.name = lib.mkOption {
|
||||||
|
description = "Attribute name leading to this submodule";
|
||||||
|
type = lib.types.str;
|
||||||
|
};
|
||||||
|
|
||||||
|
config.name = name;
|
||||||
|
|
||||||
|
options.host = lib.mkOption {
|
||||||
|
description = "Host to route requests from";
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "${name}.${cfg.domain}";
|
||||||
|
};
|
||||||
|
|
||||||
|
options.url = lib.mkOption {
|
||||||
|
description = "External https url used to access this host";
|
||||||
|
type = lib.types.str;
|
||||||
|
};
|
||||||
|
|
||||||
|
config.url = "https://${config.host}";
|
||||||
|
|
||||||
|
options.port = lib.mkOption {
|
||||||
|
description = "Port to proxy requests to";
|
||||||
|
type = lib.types.nullOr lib.types.port;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
|
||||||
|
options.files = lib.mkOption {
|
||||||
|
description = "Path to serve files from";
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
}));
|
||||||
|
default = { };
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
options.satellite.static = lib.mkOption {
|
config = {
|
||||||
type = lib.types.functionTo lib.types.anything;
|
assertions =
|
||||||
description = "Helper function for generating a quick file serving config";
|
let assertSingleTarget = config:
|
||||||
};
|
{
|
||||||
|
assertion = (config.port == null) == (config.files != null);
|
||||||
|
message = ''
|
||||||
|
Precisely one of the options 'satellite.nginx.at.${config.name}.port'
|
||||||
|
and 'satellite.nginx.at.${config.name}.files' must be specified.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
in lib.mapAttrsToList (_: assertSingleTarget) cfg.at;
|
||||||
|
|
||||||
config.satellite.proxy = port: extra: {
|
services.nginx.virtualHosts =
|
||||||
enableACME = true;
|
let mkNginxConfig = { host, port, files }: {
|
||||||
acmeRoot = null;
|
name = host;
|
||||||
forceSSL = true;
|
value =
|
||||||
locations."/" = { proxyPass = "http://localhost:${toString port}"; } // extra;
|
let extra =
|
||||||
};
|
if port != null then {
|
||||||
|
locations."/" = {
|
||||||
config.satellite.static = root: {
|
proxyPass = "http://localhost:${toString port}";
|
||||||
inherit root;
|
proxyWebsockets = true;
|
||||||
enableACME = true;
|
};
|
||||||
acmeRoot = null;
|
}
|
||||||
forceSSL = true;
|
else {
|
||||||
|
root = files;
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
enableACME = true;
|
||||||
|
acmeRoot = null;
|
||||||
|
forceSSL = true;
|
||||||
|
} // extra;
|
||||||
|
};
|
||||||
|
in lib.attrsets.mapAttrs' (_: mkNginxConfig) cfg.at;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
9
modules/nixos/ports.nix
Normal file
9
modules/nixos/ports.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
# Generic interface for working specifying a single-source of truth for ports!
|
||||||
|
{ lib, ... }:
|
||||||
|
{
|
||||||
|
options.satellite.ports = lib.mkOption {
|
||||||
|
description = "Record of custom app-port mappings to use throughput the config";
|
||||||
|
type = lib.types.lazyAttrsOf lib.types.port;
|
||||||
|
default = { };
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -16,6 +16,7 @@ cal IN CNAME lapetus
|
||||||
diptime IN CNAME lapetus
|
diptime IN CNAME lapetus
|
||||||
docs.smos IN CNAME lapetus
|
docs.smos IN CNAME lapetus
|
||||||
grafana IN CNAME lapetus
|
grafana IN CNAME lapetus
|
||||||
|
guacamole IN CNAME lapetus
|
||||||
intray IN CNAME lapetus
|
intray IN CNAME lapetus
|
||||||
irc IN CNAME lapetus
|
irc IN CNAME lapetus
|
||||||
jupyter IN CNAME lapetus
|
jupyter IN CNAME lapetus
|
||||||
|
|
@ -37,8 +38,8 @@ tunnel.lapetus IN CNAME 347d9ead-a523-4f8b-bca7-3066e31e2952.cfargotunnel.c
|
||||||
|
|
||||||
; lapetus services using cloudflare tunnels
|
; lapetus services using cloudflare tunnels
|
||||||
bin IN CNAME tunnel.lapetus
|
bin IN CNAME tunnel.lapetus
|
||||||
jupyter IN CNAME tunnel.lapetus
|
|
||||||
git IN CNAME tunnel.lapetus
|
git IN CNAME tunnel.lapetus
|
||||||
|
jupyter IN CNAME tunnel.lapetus
|
||||||
|
|
||||||
; github pages
|
; github pages
|
||||||
doffycup IN CNAME prescientmoon.github.io.
|
doffycup IN CNAME prescientmoon.github.io.
|
||||||
|
|
|
||||||
|
|
@ -1,2 +1,2 @@
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
sudo nixos-rebuild switch --flake .#$hostname --show-trace --fast
|
sudo nixos-rebuild switch --flake .#$HOSTNAME --show-trace --fast
|
||||||
|
|
|
||||||
2
scripts/repl.sh
Executable file
2
scripts/repl.sh
Executable file
|
|
@ -0,0 +1,2 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
nix repl ".#nixosConfigurations.$1.config"
|
||||||
Loading…
Reference in a new issue