everything is working now

7 files changed, 92 insertions, 83 deletions

diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix
index 75498a9..9c78295 100644
--- a/modules/services/nixos/btopweb.nix
+++ b/modules/services/nixos/btopweb.nix
@@ -21,6 +21,7 @@ in {
       isSystemUser = true;
       group = "btopweb";
     };
+    users.users.caddy.extraGroups = ["btopweb"];
 
     systemd.services."btopweb" = {
       description = "Host btop on a website";
@@ -31,15 +32,27 @@ in {
 
       serviceConfig = {
         User = "btopweb";
+        Group = "btopweb";
         Type = "simple";
 
-        ExecStart = ''${lib.getExe pkgs.ttyd} -W -i 127.0.0.1 -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
+        RuntimeDirectory = "btopweb";
+        RuntimeDirectoryMode = "0770";
+        UMask = "0007";
+
+        ExecStart = ''
+          ${lib.getExe pkgs.ttyd} \
+            -W \
+            -i /run/btopweb/ttyd.sock \
+            -t renderType=canvas \
+            -t fontSize=16 \
+            ${pkgs.btop}/bin/btop -c ${btopSettings}
+        '';
       };
     };
 
     services.caddy.virtualHosts."btop.ganymede".extraConfig = ''
       tls internal
-      reverse_proxy 127.0.0.1:${toString cfg.port}
+      reverse_proxy unix//run/btopweb/ttyd.sock
     '';
 
     collinux.services.glance.homelabServices."btop" = {
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
index 4b41c76..02aeca3 100644
--- a/modules/services/nixos/caddy.nix
+++ b/modules/services/nixos/caddy.nix
@@ -7,7 +7,6 @@
   cfg = config.collinux.services.caddy;
 in
   lib.mkIf cfg.enable {
-    users.users."caddy".extraGroups = ["fileserver"];
     networking.firewall.allowedTCPPorts = [80 443];
     environment.systemPackages = [pkgs.nss.tools]; # required for caddy https stuff
 
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index fa74cf6..9aea299 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -15,4 +15,6 @@
     ./ngircd.nix
     ./qbittorrent.nix
   ];
+
+  users.groups."fileserver" = {};
 }
diff --git a/modules/services/nixos/filebrowser.nix b/modules/services/nixos/filebrowser.nix
index df0d536..9791f8d 100644
--- a/modules/services/nixos/filebrowser.nix
+++ b/modules/services/nixos/filebrowser.nix
@@ -13,6 +13,7 @@ in
       group = "dufs";
       extraGroups = ["fileserver"];
     };
+    users.users.caddy.extraGroups = ["dufs"];
 
     systemd.services."dufs" = {
       description = "dufs file server";
@@ -22,15 +23,14 @@ in
       wantedBy = ["multi-user.target"];
 
       serviceConfig = {
-        # ExecStart = "${pkgs.dufs}/bin/dufs /media --port ${toString cfg.port}";
         ExecStart = "${lib.getExe pkgs.dufs} /media --bind /run/dufs/dufs.sock";
 
-        RuntimeDirectory = "dufs"; # /run/dufs
+        RuntimeDirectory = "dufs";
 
         User = "dufs";
         Group = "dufs";
+        UMask = "0007";
 
-        # Hardening
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;
@@ -47,6 +47,6 @@ in
 
     collinux.services.glance.homelabServices."files" = {
       url = "https://files.ganymede";
-      icon = "si:folder";
+      icon = "mdi:folder";
     };
   }
diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix
index 38e5e1d..8d305a5 100644
--- a/modules/services/nixos/glance.nix
+++ b/modules/services/nixos/glance.nix
@@ -6,8 +6,6 @@
 }: let
   cfg = config.collinux.services.glance;
 
-  pure = x: [x];
-
   servicesLinks = builtins.attrValues cfg.homelabServices;
 
   settings = {
@@ -19,76 +17,73 @@
     };
 
     branding.hide-footer = true;
-    pages = pure {
-      name = "Dashboard";
-      width = "slim";
-      hide-desktop-navigation = true;
-      center-vertically = true;
-      columns = pure {
-        size = "full";
-        widgets = [
+    pages = [
+      {
+        name = "Dashboard";
+        width = "slim";
+        hide-desktop-navigation = true;
+        center-vertically = true;
+        columns = [
           {
-            type = "search";
-            autofocus = true;
-            search-engine = "duckduckgo";
-            bangs = [
-              {
-                title = "GitHub";
-                shortcut = "gh";
-                url = "https://github.com/search?q={QUERY}&type=repositories";
-              }
+            size = "full";
+            widgets = [
               {
-                title = "I'm Feeling Lucky";
-                shortcut = "!";
-                url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1";
+                type = "search";
+                autofocus = true;
+                search-engine = "duckduckgo";
+                bangs = [
+                  {
+                    title = "GitHub";
+                    shortcut = "gh";
+                    url = "https://github.com/search?q={QUERY}&type=repositories";
+                  }
+                  {
+                    title = "I'm Feeling Lucky";
+                    shortcut = "!";
+                    url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1";
+                  }
+                  {
+                    title = "YouTube Music";
+                    shortcut = "ytm";
+                    url = "https://music.youtube.com/search?q={QUERY}";
+                  }
+                  {
+                    title = "Google AI Mode";
+                    shortcut = "ai";
+                    url = "https://www.google.com/search?udm=50&q={QUERY}";
+                  }
+                ];
               }
               {
-                title = "YouTube Music";
-                shortcut = "ytm";
-                url = "https://music.youtube.com/search?q={QUERY}";
+                type = "server-stats";
+                servers = [
+                  {
+                    type = "local";
+                    name = "ganymede";
+                    hide-mountpoints-by-default = true;
+                    mountpoints = {
+                      "/".hide = false;
+                      "/media".hide = false;
+                    };
+                  }
+                ];
               }
               {
-                title = "Google AI Mode";
-                shortcut = "ai";
-                url = "https://www.google.com/search?udm=50&q={QUERY}";
+                type = "monitor";
+                cache = "1m";
+                title = "Services";
+                sites = servicesLinks;
               }
             ];
           }
-          {
-            type = "server-stats";
-            servers = pure {
-              type = "local";
-              name = "Ganymede";
-              hide-mountpoints-by-default = true;
-              mountpoints = {
-                "/".hide = false;
-                "/media".hide = false;
-              };
-            };
-          }
-          {
-            type = "monitor";
-            cache = "1m";
-            title = "Services";
-            sites = servicesLinks;
-          }
         ];
-      };
-    };
+      }
+    ];
   };
 
   settingsFile = (pkgs.formats.yaml {}).generate "config.yml" settings;
 in {
   config = lib.mkIf cfg.enable {
-    users.groups."glance" = {};
-    users.users."glance" = {
-      isSystemUser = true;
-      group = "glance";
-
-      home = "/var/lib/glance";
-      createHome = true;
-    };
-
     systemd.services."glance" = {
       restartIfChanged = true;
       wants = ["network-online.target"];
@@ -96,12 +91,12 @@ in {
       wantedBy = ["multi-user.target"];
 
       serviceConfig = {
-        User = "glance";
         Type = "simple";
 
-        ReadWritePaths = "/var/lib/glance";
-        WorkingDirectory = "/var/lib/glance";
-        ExecStart = "${pkgs.glance}/bin/glance -config ${settingsFile}";
+        DynamicUser = true;
+        StateDirectory = "glance";
+
+        ExecStart = "${lib.getExe pkgs.glance} -config ${settingsFile}";
 
         NoNewPrivileges = true;
         PrivateTmp = true;
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
index 288428d..f0b6c34 100644
--- a/modules/services/nixos/goaccess.nix
+++ b/modules/services/nixos/goaccess.nix
@@ -14,12 +14,11 @@
     log-file = "/var/log/caddy/access-williamsfam.us.com.log";
     geoip-database = inputs.geolite-db;
 
-    ws-url = "wss://stats.ganymede:443/ws";
-    port = cfg.port;
-    addr = "127.0.0.1";
+    ws-url = "wss://stats.ganymede:443/ws"; # url that the frontend uses to fetch data
+    unix-socket = "/run/goaccess/goaccess.sock";
 
     real-time-html = "true";
-    output = "/var/www/goaccess/index.html";
+    output = "/var/lib/goaccess/index.html";
     external-assets = "true";
     all-static-files = "false";
     html-report-title = "stats@ganymede";
@@ -44,6 +43,7 @@ in {
       group = "goaccess";
       extraGroups = ["caddy"]; # to read caddy log files
     };
+    users.users.caddy.extraGroups = ["goaccess"];
 
     systemd.services."goaccess" = {
       description = "GoAccess Real-Time Log Analyzer";
@@ -56,9 +56,14 @@ in {
         User = "goaccess";
         Type = "simple";
 
-        ReadWritePaths = "/var/www/goaccess";
-        WorkingDirectory = "/var/www/goaccess";
-        ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}";
+        RuntimeDirectory = "goaccess";
+        RuntimeDirectoryMode = "0770";
+        UMask = "0007";
+
+        StateDirectory = "goaccess";
+        StateDirectoryMode = "0750"; # caddy must read this dir
+
+        ExecStart = "${lib.getExe pkgs.goaccess} -p ${settingsFile}";
 
         NoNewPrivileges = true;
         PrivateTmp = true;
@@ -70,15 +75,13 @@ in {
       };
     };
 
-    systemd.tmpfiles.rules = ["d /var/www/goaccess/ 755 goaccess goaccess"];
-
     services.caddy.virtualHosts."stats.ganymede".extraConfig = ''
       tls internal
 
-      root * /var/www/goaccess
+      root * /var/lib/goaccess
       file_server
 
-      reverse_proxy /ws 127.0.0.1:${toString cfg.port}
+      reverse_proxy /ws unix//run/goaccess/goaccess.sock
     '';
 
     collinux.services.glance.homelabServices."stats" = {
diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix
index fe2831a..c7bfe95 100644
--- a/modules/services/nixos/qbittorrent.nix
+++ b/modules/services/nixos/qbittorrent.nix
@@ -6,10 +6,7 @@
   cfg = config.collinux.services.qbittorrent;
 in {
   config = lib.mkIf cfg.enable {
-    users.users."qbittorrent" = {
-      uid = 985;
-      extraGroups = ["fileserver"]; # torrent files go to /media/library
-    };
+    users.users."qbittorrent" = {};
 
     networking.firewall = {
       allowedTCPPorts = [49252];