clean up services/networking config even more

8 files changed, 73 insertions, 56 deletions

diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 3adf620..0d3f15e 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -5,7 +5,10 @@ in {
     user.name = "collin";
 
     secrets = {
-      "williams-psk".file = ./williams-psk.age;
+      "williams-psk" = {
+        file = ./williams-psk.age;
+        owner = "wpa_supplicant";
+      };
       "caddy-env".file = ./caddy-env.age;
       "tsnsrv-authkey".file = ./tsnsrv-authkey.age;
     };
@@ -40,28 +43,26 @@ in {
         };
         sshd = {
           enable = true;
-          bind_host = tailscaleIP;
+          bind_host = "0.0.0.0";
         };
       };
 
       selfhost = {
-        magic_caddy.enable = false;
+        caddy = {
+          enable = true;
+          envFile = config.collinux.secrets."caddy-env".path;
+        };
 
-        # adguard = {
-        #   enable = true;
-        #   bind_host = tailscaleIP;
-        # };
         forgejo = {
           enable = true;
           bind_host = tailscaleIP;
+          root_url = "ganymede.collinux.tailnet:8010";
         };
+
         headscale = {
           enable = true;
-          root_url = "https://headscale.williamsfam.us.com";
-        };
-        caddy = {
-          enable = true;
-          envFile = config.collinux.secrets."caddy-env".path;
+          root_url = "headscale.williamsfam.us.com";
+          caddy.enable = true;
         };
       };
     };
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 62b9146..9fa56da 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -3,23 +3,8 @@
     ./iwd.nix
     ./networkmanager.nix
     ./networkd.nix
+    ./resolved.nix
   ];
 
   networking.firewall.enable = true;
-
-  # DNS
-  services.resolved = {
-    enable = true;
-    dnsovertls = "opportunistic";
-    dnssec = "allow-downgrade";
-    fallbackDns = [
-      "9.9.9.9#dns.quad9.net"
-      "149.112.112.112#dns.quad9.net"
-    ];
-
-    # disable extra stuff
-    llmnr = "false";
-    extraConfig = "MulticastDNS=no";
-  };
-  networking.resolvconf.enable = false;
 }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index 470bcec..920b93f 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -29,6 +29,7 @@ in
       wait-online = {
         enable = true;
         ignoredInterfaces = ["docker0"];
+        anyInterface = true;
       };
 
       networks."11-static-lan" = {
diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix
new file mode 100644
index 0000000..b552095
--- /dev/null
+++ b/modules/services/nixos/networking/resolved.nix
@@ -0,0 +1,17 @@
+{
+  networking.resolvconf.enable = false;
+
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+    fallbackDns = [
+      "9.9.9.9#dns.quad9.net"
+      "149.112.112.112#dns.quad9.net"
+    ];
+
+    # disable extra stuff
+    llmnr = "false";
+    extraConfig = "MulticastDNS=no";
+  };
+}
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index 73c6caf..69fb8a4 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -32,17 +32,16 @@ in
       DNSStubListener=no
     '';
 
-    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable
-      && config.collinux.services.selfhost.magic_caddy.enable) {
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
-          if config.collinux.services.networking.tailscale.enable
-          then "bind tailscale/adguard"
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
           else ""
         }
-        reverse_proxy localhost:${toString cfg.port}
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
       '';
     };
-
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
   }
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index e499e64..4571dca 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -8,7 +8,7 @@ in
   lib.mkIf cfg.enable {
     services.forgejo = {
       enable = true;
-      database.type = "postgres";
+      database.type = "sqlite3";
       settings = {
         server = {
           DOMAIN = "localhost";
@@ -41,14 +41,14 @@ in
       wants = lib.mkAfter ["network-online.target"];
     };
 
-    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable && config.collinux.services.selfhost.magic_caddy.enable) {
+    services.caddy = lib.mkIf cfg.caddy.enable {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
-          if config.collinux.services.networking.tailscale.enable
-          then "bind tailscale/forgejo"
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
           else ""
         }
-        reverse_proxy localhost:${toString cfg.port}
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
       '';
     };
   }
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
index 9989742..2bdcca1 100644
--- a/modules/services/nixos/selfhost/headscale.nix
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -23,7 +23,7 @@ in
       address = cfg.bind_host;
       port = cfg.port;
       settings = {
-        server_url = cfg.root_url;
+        server_url = "https://${cfg.root_url}";
 
         database.type = "sqlite";
 
@@ -60,9 +60,16 @@ in
       description = "Target represents headscale is running. started by headscale.service";
     };
 
-    services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable ''
-      reverse_proxy localhost:8080
-    '';
-
     environment.systemPackages = [pkgs.headscale];
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
+          else ""
+        }
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+      '';
+    };
   }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 8be7c42..df8bc52 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -17,7 +17,7 @@ in {
         networkmanager.enable = mkEnableOption "heavier wifi daemon";
 
         networkd = {
-          enable = mkEnableOption "set static IP (systemd-networkd)";
+          enable = mkEnableOption "use systemd-networkd";
           ssid = mkOption {type = lib.types.str;};
           pskFile = mkOption {type = lib.types.str;};
 
@@ -61,9 +61,13 @@ in {
         selfhostOptions = {
           service_name,
           default_port ? null,
-          ...
         }: {
-          enable = mkEnableOption "";
+          enable = mkEnableOption "${service_name} selfhosted service";
+
+          service_name = mkOption {
+            type = lib.types.str;
+          };
+
           bind_host = mkOption {
             type = ip_addr;
             default = "0.0.0.0";
@@ -72,29 +76,32 @@ in {
             type = lib.types.port;
             default = default_port;
           };
+
           root_url = mkOption {
-            type = lib.types.str;
-            default = with config.collinux.services.networking.tailscale;
-              if enable
-              then "http://${service_name}.${tailnet}"
-              else null;
+            type = lib.types.nullOr lib.types.str;
+          };
+
+          caddy = {
+            enable = mkEnableOption "Automatically create caddy configurations for this service";
+            bind_tailscale = mkEnableOption "Bind the service to {service_name}.{tailnet}";
           };
         };
       in {
-        magic_caddy.enable = mkEnableOption "Automatically create caddy configurations for services";
-
         adguard = selfhostOptions {
           service_name = "adguard";
           default_port = 8001;
         };
+
         forgejo = selfhostOptions {
           service_name = "forgejo";
           default_port = 8010;
         };
+
         headscale = selfhostOptions {
           service_name = "headscale";
           default_port = 8080;
         };
+
         caddy = {
           enable = mkEnableOption "caddy https server";
           envFile = mkOption {
@@ -109,7 +116,7 @@ in {
     assertions = [
       {
         assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable);
-        message = "only one networking method (iwd, networkmanager, static) can be active";
+        message = "only one networking method (iwd, networkmanager, networkd) can be active";
       }
     ];
   };