deprecate unmaintained services

6 files changed, 63 insertions, 133 deletions

diff --git a/modules/services/nixos/adguard.nix b/modules/services/nixos/adguard.nix
deleted file mode 100644
index f59934e..0000000
--- a/modules/services/nixos/adguard.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.adguard;
-in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
-  config = lib.mkIf cfg.enable {
-    services.adguardhome = {
-      enable = true;
-      port = cfg.port;
-      mutableSettings = true;
-      settings = {
-        http = {
-          pprof.enabled = false;
-          address = "localhost:${toString cfg.port}";
-        };
-        users = []; # disable auth (only accessable over tailscale anyway)
-        dns = {
-          bind_hosts = ["127.0.0.1" cfg.bind_host];
-          upstream_dns = ["https://dns.quad9.net/dns-query"];
-          enable_dnssec = true;
-        };
-        tls.enabled = false;
-        dhcp.enabled = false;
-      };
-    };
-
-    # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
-    services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
-      DNS=127.0.0.1
-      DNSStubListener=no
-    '';
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
-  };
-}
diff --git a/modules/services/nixos/forgejo.nix b/modules/services/nixos/forgejo.nix
index 5c98633..1854f0f 100644
--- a/modules/services/nixos/forgejo.nix
+++ b/modules/services/nixos/forgejo.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  pkgs,
   config,
   ...
 }: let
@@ -16,6 +17,7 @@ in {
       settings = {
         server = {
           DOMAIN = "localhost";
+          PROTOCOL = "http";
           ROOT_URL = cfg.root_url;
           HTTP_PORT = cfg.port;
 
@@ -28,8 +30,8 @@ in {
           SSH_LISTEN_PORT = cfg.git_ssh_port;
         };
         service = {
-          DISABLE_REGISTRATION = false;
-          ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
+          DISABLE_REGISTRATION = true;
+          ENABLE_REVERSE_PROXY_AUTHENTICATION = false;
         };
         repository = {
           # disable stuff
@@ -40,9 +42,17 @@ in {
       };
     };
 
-    systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
+    systemd.services."forgejo" = {
       after = lib.mkAfter ["network-online.target"];
       wants = lib.mkAfter ["network-online.target"];
+
+      # Ensure users (https://wiki.nixos.org/wiki/Forgejo#Ensure_users)
+      preStart = let
+        adminCmd = "${lib.getExe pkgs.forgejo} admin user";
+        passwd = config.collinux.secrets."collin-forgejo-password";
+      in ''
+        ${adminCmd} create --admin --email "collin@ganymede" --username collin --password "$(tr -d '\n' < ${passwd.path})" || true
+      '';
     };
   };
 }
diff --git a/modules/services/nixos/headscale.nix b/modules/services/nixos/headscale.nix
deleted file mode 100644
index 51d3da5..0000000
--- a/modules/services/nixos/headscale.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.headscale;
-
-  acl_file = (pkgs.formats.json {}).generate "acl.json" {
-    ssh = [
-      {
-        src = ["collin@"];
-        dst = ["collin@"];
-        users = ["autogroup:nonroot" "root"];
-        action = "accept";
-      }
-    ];
-  };
-in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
-  config = lib.mkIf cfg.enable {
-    services.headscale = {
-      enable = true;
-      address = cfg.bind_host;
-      port = cfg.port;
-      settings = {
-        server_url = "https://${cfg.root_url}";
-
-        database.type = "sqlite";
-
-        dns = {
-          magic_dns = true;
-          base_domain = "collinux.tailnet";
-          override_local_dns = true;
-          nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
-        };
-
-        policy.path = acl_file;
-
-        prefixes = {
-          "v4" = "100.100.0.0/16";
-          allocation = "random";
-        };
-
-        # leave tls for caddy to worry about
-        tls_cert_path = null;
-        tls_key_path = null;
-
-        logtail.enabled = false;
-      };
-    };
-
-    # make sure headscale can start before tailscale
-    systemd.services."headscale" = lib.mkIf config.collinux.system.networking.tailscale.enable {
-      after = lib.mkForce ["network.target"];
-      before = lib.mkForce ["headscale.target"];
-      wants = lib.mkForce ["network.target" "headscale.target"];
-    };
-
-    systemd.targets."headscale" = {
-      description = "Target represents headscale is running. started by headscale.service";
-    };
-
-    environment.systemPackages = [pkgs.headscale];
-  };
-}
diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix
index bb2e06d..d7b74c0 100644
--- a/modules/services/nixos/mkCaddyCfg.nix
+++ b/modules/services/nixos/mkCaddyCfg.nix
@@ -1,15 +1,34 @@
 cfg: {
-  services.caddy =
-    if cfg.caddy.enable
-    then {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    }
-    else {};
+  networking.extraHosts =
+    if cfg.caddy.local.enable
+    then ''
+      127.0.0.1 ${cfg.service_name}.collinux
+    ''
+    else "";
+
+  services.caddy.virtualHosts =
+    (
+      if cfg.caddy.global.enable && (cfg.root_url != null)
+      then {
+        ${cfg.root_url}.extraConfig = ''
+          ${
+            if cfg.caddy.bind_tailscale
+            then "bind tailscale/${cfg.service_name}"
+            else ""
+          }
+          reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+        '';
+      }
+      else {}
+    )
+    // (
+      if cfg.caddy.local.enable
+      then {
+        "${cfg.service_name}.collinux".extraConfig = ''
+          tls internal
+          reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+        '';
+      }
+      else {}
+    );
 }
diff --git a/modules/services/nixos/navidrome.nix b/modules/services/nixos/navidrome.nix
index 5250b85..86fdad6 100644
--- a/modules/services/nixos/navidrome.nix
+++ b/modules/services/nixos/navidrome.nix
@@ -4,16 +4,20 @@
   ...
 }: let
   cfg = config.collinux.services.selfhost.navidrome;
-in
-  lib.mkIf cfg.enable {
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
     services.navidrome = {
       enable = true;
-      inherit (cfg) user;
       settings = {
-        Port = 4533;
-        Address = "0.0.0.0";
+        Port = cfg.port;
+        Address = cfg.bind_host;
         EnableInsightsCollector = false;
-        MusicFolder = "/home/${cfg.user}/Music";
+        MusicFolder = "/media/music";
       };
     };
-  }
+  };
+}
diff --git a/modules/services/nixos/ngircd.nix b/modules/services/nixos/ngircd.nix
index c40aa11..014dd68 100644
--- a/modules/services/nixos/ngircd.nix
+++ b/modules/services/nixos/ngircd.nix
@@ -14,7 +14,7 @@ in
           Info = Ganymede IRC Chat
           AdminInfo1 = Collin
 
-          Listen = 0.0.0.0
+          Listen = 127.0.0.1
           Ports = ${toString cfg.port}
 
         [Options]
@@ -27,4 +27,10 @@ in
           Mask = *@*
       '';
     };
+
+    users.users.ngircd.extraGroups = ["shadow"];
+
+    security.pam.services.ngircd = {
+      unixAuth = true;
+    };
   }