asdf

4 files changed, 102 insertions, 6 deletions

diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
new file mode 100644
index 0000000..196dab5
--- /dev/null
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.adguard;
+
+  # tailscale constants (should be configured elsewhere)
+  tailscaleIP = "100.69.180.89";
+in
+  lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      services.adguardhome = {
+        enable = true;
+        port = 8001;
+        mutableSettings = true;
+        settings = {
+          http = {
+            pprof.enabled = false;
+            address = "localhost:${toString config.services.adguardhome.port}";
+          };
+          users = []; # disable auth (only accessable over tailscale anyway)
+          dns = {
+            bind_hosts = [
+              (
+                if config.collinux.services.networking.tailscale.enable
+                then tailscaleIP
+                else "0.0.0.0"
+              )
+            ];
+            upstream_dns = ["1.1.1.1"];
+          };
+          tls.enabled = false;
+          dhcp.enabled = false;
+        };
+      };
+
+      # tailscale stuff
+      # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
+      services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
+        DNS=127.0.0.1
+        DNSStubListener=no
+      '';
+    }
+    (lib.mkIf config.collinux.services.networking.tailscale.enable {
+      services.tailscale.extraSetFlags = ["--accept-dns=false"]; # would create an infinite loop of dns lookups
+      services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+        virtualHosts."https://adguard.tail7cca06.ts.net".extraConfig = ''
+          bind tailscale/adguard
+          reverse_proxy ${config.services.adguardhome.settings.http.address}
+        '';
+      };
+    })
+  ])
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
new file mode 100644
index 0000000..903407f
--- /dev/null
+++ b/modules/services/nixos/selfhost/caddy.nix
@@ -0,0 +1,26 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.caddy;
+in
+  lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      services.caddy.enable = true;
+      networking.firewall.allowedTCPPorts = [80 443];
+      environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
+    }
+    (lib.mkIf config.collinux.services.networking.tailscale.enable {
+      services.caddy = {
+        package = pkgs.caddy.withPlugins {
+          plugins = [
+            "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
+          ];
+          hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
+        };
+        environmentFile = config.age.secrets."caddy-tailscale-authkey".path;
+      };
+    })
+  ])
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index d3b884a..a0a9194 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -1,11 +1,7 @@
 {
-  lib,
-  config,
-  ...
-}: {
   imports = [
     ./navidrome.nix
+    ./adguard.nix
+    ./caddy.nix
   ];
-
-  qt.style = lib.optionalAttrs (config.collinux.theme == "adwaita") {name = "adwaita-dark";};
 }
diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix
new file mode 100644
index 0000000..59ea473
--- /dev/null
+++ b/modules/services/nixos/selfhost/jellyfin.nix
@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.jellyfin;
+in
+  lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      services.jellyfin = {
+        enable = true;
+      };
+    }
+    # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) {
+    #   services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = ''
+    #     bind tailscale/jellyfin
+    #     reverse_proxy localhost:${config.services.jellyfin.port}
+    #   '';
+    # })
+  ])