clean up networking and selfhosted apps configuration

8 files changed, 116 insertions, 64 deletions

diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index ea4e4af..2667849 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -5,6 +5,8 @@
     ./networkd.nix
   ];
 
+  networking.firewall.enable = true;
+
   # DNS
   services.resolved = {
     enable = true;
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index df14a08..9a11129 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -15,6 +15,8 @@ in
         secretsFile = cfg.pskFile;
       };
 
+      useNetworkd = true;
+
       # Disable default networking stuff
       dhcpcd.enable = false;
       useDHCP = false;
@@ -23,7 +25,7 @@ in
 
     systemd.network = {
       enable = true;
-      networks."10-static-lan" = {
+      networks."11-static-lan" = {
         name = "wl*";
 
         networkConfig =
@@ -35,7 +37,7 @@ in
             else {
               Address = cfg.static.ip;
               Gateway = cfg.static.gateway;
-              # DNS is managed by systemd-resolvd
+              # DNS is managed by systemd-resolvd (not specified here)
               DHCP = "no";
             }
           )
diff --git a/modules/services/nixos/networking/networkmanager.nix b/modules/services/nixos/networking/networkmanager.nix
index 46edf96..1bfe94e 100644
--- a/modules/services/nixos/networking/networkmanager.nix
+++ b/modules/services/nixos/networking/networkmanager.nix
@@ -8,9 +8,9 @@ in
   lib.mkIf cfg.enable {
     networking = {
       networkmanager = {
+        enable = true;
         dns = "systemd-resolved";
         dhcp = "internal";
-        enable = true;
       };
 
       dhcpcd.enable = false;
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index eb77cf6..c5e93ee 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -4,52 +4,44 @@
   ...
 }: let
   cfg = config.collinux.services.selfhost.adguard;
-
-  # tailscale constants (should be configured elsewhere)
-  tailscaleIP = "100.69.180.89";
 in
-  lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      services.adguardhome = {
-        enable = true;
-        port = 8001;
-        mutableSettings = true;
-        settings = {
-          http = {
-            pprof.enabled = false;
-            address = "localhost:${toString config.services.adguardhome.port}";
-          };
-          users = []; # disable auth (only accessable over tailscale anyway)
-          dns = {
-            bind_hosts =
-              [
-                "127.0.0.1"
-              ]
-              ++ lib.optional config.collinux.services.networking.tailscale.enable tailscaleIP;
-            upstream_dns = [
-              "https://dns.quad9.net/dns-query"
-            ];
-            enable_dnssec = true;
-          };
-          tls.enabled = false;
-          dhcp.enabled = false;
+  lib.mkIf cfg.enable {
+    services.adguardhome = {
+      enable = true;
+      port = cfg.port;
+      mutableSettings = true;
+      settings = {
+        http = {
+          pprof.enabled = false;
+          address = "localhost:${toString cfg.port}";
+        };
+        users = []; # disable auth (only accessable over tailscale anyway)
+        dns = {
+          bind_hosts = ["127.0.0.1" cfg.bind_host];
+          upstream_dns = ["https://dns.quad9.net/dns-query"];
+          enable_dnssec = true;
         };
+        tls.enabled = false;
+        dhcp.enabled = false;
       };
+    };
+
+    # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
+    services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
+      DNS=127.0.0.1
+      DNSStubListener=no
+    '';
 
-      # tailscale stuff
-      # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
-      services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
-        DNS=127.0.0.1
-        DNSStubListener=no
+    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if config.collinux.services.networking.tailscale.enable
+          then "bind tailscale/adguard"
+          else ""
+        }
+        reverse_proxy localhost:${toString cfg.port}
       '';
-    }
-    (lib.mkIf config.collinux.services.networking.tailscale.enable {
-      services.tailscale.extraSetFlags = ["--accept-dns=false"]; # would create an infinite loop of dns lookups
-      services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
-        virtualHosts."https://adguard.tail7cca06.ts.net".extraConfig = ''
-          bind tailscale/adguard
-          reverse_proxy ${config.services.adguardhome.settings.http.address}
-        '';
-      };
-    })
-  ])
+    };
+
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+  }
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
index 85a840a..f625f62 100644
--- a/modules/services/nixos/selfhost/caddy.nix
+++ b/modules/services/nixos/selfhost/caddy.nix
@@ -8,7 +8,10 @@
 in
   lib.mkIf cfg.enable (lib.mkMerge [
     {
-      services.caddy.enable = true;
+      services.caddy = {
+        enable = true;
+        environmentFile = cfg.envFile;
+      };
       networking.firewall.allowedTCPPorts = [80 443];
       environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
     }
@@ -20,7 +23,6 @@ in
           ];
           hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
         };
-        environmentFile = cfg.envFile;
       };
     })
   ])
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index 4cd7986..876586d 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -1,6 +1,5 @@
 {
   imports = [
-    ./navidrome.nix
     ./adguard.nix
     ./forgejo.nix
     ./caddy.nix
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index 73fbdaa..b1a6095 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -12,9 +12,38 @@ in
       settings = {
         server = {
           DOMAIN = "localhost";
-          HTTP_PORT = 8010;
+          ROOT_URL = cfg.root_url;
+          HTTP_PORT = cfg.port;
+
+          # ssh
+          START_SSH_SERVER = true; # use builtin ssh server
+          BUILTIN_SSH_SERVER_USER = "git";
+          SSH_DOMAIN = "ganymede";
+          SSH_PORT = 2222; # don't conflict with system ssh
+          SSH_LISTEN_HOST = cfg.bind_host;
+          SSH_LISTEN_PORT = 2222;
+        };
+        service = {
+          DISABLE_REGISTRATION = false;
+          ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
+        };
+        repository = {
+          # disable stuff
+          DISABLE_MIGRATIONS = true;
+          DISABLE_STARS = true;
+          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
         };
-        service.DISABLE_REGISTRATION = false;
       };
     };
+
+    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if config.collinux.services.networking.tailscale.enable
+          then "bind tailscale/forgejo"
+          else ""
+        }
+        reverse_proxy localhost:${toString cfg.port}
+      '';
+    };
   }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 072d970..f42dd12 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -4,13 +4,13 @@
   ...
 }: let
   inherit (lib) mkOption mkEnableOption;
+
+  ip_addr = lib.types.strMatching "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$";
+  ip_addr_cidr = lib.types.strMatching "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])/(3[0-2]|[12]?[0-9])$";
 in {
   options = {
     collinux.services = {
-      networking = let
-        ip_addr = lib.types.strMatching "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$";
-        ip_addr_cidr = lib.types.strMatching "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])/(3[0-2]|[12]?[0-9])$";
-      in {
+      networking = {
         enable = mkEnableOption "wifi";
 
         iwd.enable = mkEnableOption "lightweight wifi daemon";
@@ -45,16 +45,42 @@ in {
         bluetuith.enable = mkEnableOption "terminal bluetooth manager";
       };
 
-      selfhost = {
-        navidrome = {
-          enable = mkEnableOption "navidrome music server";
-          user = mkOption {
-            description = "user to run the service as";
-            default = config.collinux.user.name;
+      selfhost = let
+        selfhostOptions = {
+          service_name,
+          default_port ? null,
+          ...
+        }: {
+          enable = mkEnableOption "";
+          bind_host = mkOption {
+            type = ip_addr;
+            default =
+              if config.collinux.services.networking.tailscale.enable
+              then "100.69.160.89"
+              else "0.0.0.0";
+          };
+          port = mkOption {
+            type = lib.types.port;
+            default = default_port;
           };
+
+          root_url = mkOption {
+            type = lib.types.str;
+            default =
+              if config.collinux.services.networking.tailscale.enable
+              then "https://${service_name}.tail7cca06.ts.net"
+              else null;
+          };
+        };
+      in {
+        adguard = selfhostOptions {
+          service_name = "adguard";
+          default_port = 8001;
+        };
+        forgejo = selfhostOptions {
+          service_name = "forgejo";
+          default_port = 8010;
         };
-        adguard.enable = mkEnableOption "AdGuardHome network-wide adblocking";
-        forgejo.enable = mkEnableOption "Forgejo self-hosted git server";
         caddy = {
           enable = mkEnableOption "caddy https server";
           envFile = mkOption {