asdf

8 files changed, 111 insertions, 10 deletions

diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index de22f8b..929578d 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -8,11 +8,10 @@
     services.resolved = {
       enable = true;
       domains = [
-        "10.0.0.1"
-        "10.0.0.10"
+        "1.1.1.1"
+        "1.0.0.1"
       ];
     };
-
     networking.resolvconf.enable = false;
 
     systemd.network.wait-online.enable = false;
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
new file mode 100644
index 0000000..196dab5
--- /dev/null
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.adguard;
+
+  # tailscale constants (should be configured elsewhere)
+  tailscaleIP = "100.69.180.89";
+in
+  lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      services.adguardhome = {
+        enable = true;
+        port = 8001;
+        mutableSettings = true;
+        settings = {
+          http = {
+            pprof.enabled = false;
+            address = "localhost:${toString config.services.adguardhome.port}";
+          };
+          users = []; # disable auth (only accessable over tailscale anyway)
+          dns = {
+            bind_hosts = [
+              (
+                if config.collinux.services.networking.tailscale.enable
+                then tailscaleIP
+                else "0.0.0.0"
+              )
+            ];
+            upstream_dns = ["1.1.1.1"];
+          };
+          tls.enabled = false;
+          dhcp.enabled = false;
+        };
+      };
+
+      # tailscale stuff
+      # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
+      services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
+        DNS=127.0.0.1
+        DNSStubListener=no
+      '';
+    }
+    (lib.mkIf config.collinux.services.networking.tailscale.enable {
+      services.tailscale.extraSetFlags = ["--accept-dns=false"]; # would create an infinite loop of dns lookups
+      services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+        virtualHosts."https://adguard.tail7cca06.ts.net".extraConfig = ''
+          bind tailscale/adguard
+          reverse_proxy ${config.services.adguardhome.settings.http.address}
+        '';
+      };
+    })
+  ])
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
new file mode 100644
index 0000000..903407f
--- /dev/null
+++ b/modules/services/nixos/selfhost/caddy.nix
@@ -0,0 +1,26 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.caddy;
+in
+  lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      services.caddy.enable = true;
+      networking.firewall.allowedTCPPorts = [80 443];
+      environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
+    }
+    (lib.mkIf config.collinux.services.networking.tailscale.enable {
+      services.caddy = {
+        package = pkgs.caddy.withPlugins {
+          plugins = [
+            "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
+          ];
+          hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
+        };
+        environmentFile = config.age.secrets."caddy-tailscale-authkey".path;
+      };
+    })
+  ])
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index d3b884a..a0a9194 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -1,11 +1,7 @@
 {
-  lib,
-  config,
-  ...
-}: {
   imports = [
     ./navidrome.nix
+    ./adguard.nix
+    ./caddy.nix
   ];
-
-  qt.style = lib.optionalAttrs (config.collinux.theme == "adwaita") {name = "adwaita-dark";};
 }
diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix
new file mode 100644
index 0000000..59ea473
--- /dev/null
+++ b/modules/services/nixos/selfhost/jellyfin.nix
@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.jellyfin;
+in
+  lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      services.jellyfin = {
+        enable = true;
+      };
+    }
+    # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) {
+    #   services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = ''
+    #     bind tailscale/jellyfin
+    #     reverse_proxy localhost:${config.services.jellyfin.port}
+    #   '';
+    # })
+  ])
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index bf1aefe..b594a2d 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,6 +8,7 @@ in
   lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
+      openFirewall = true;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
@@ -19,4 +20,6 @@ in
         PasswordAuthentication = false;
       };
     };
+
+    services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
   }
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
index f60e48e..f39fc27 100644
--- a/modules/services/nixos/tailscale.nix
+++ b/modules/services/nixos/tailscale.nix
@@ -10,12 +10,13 @@ in
     services.tailscale = {
       enable = true;
       useRoutingFeatures = "both";
-      extraSetFlags = ["--ssh=true"];
     };
+
     networking.firewall = {
       checkReversePath = "loose";
       trustedInterfaces = ["tailscale0"];
       allowedUDPPorts = [config.services.tailscale.port];
     };
+
     environment.systemPackages = [pkgs.tailscale];
   }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index ee85982..681ed99 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -33,6 +33,8 @@ in {
             default = config.collinux.user.name;
           };
         };
+        adguard.enable = mkEnableOption "AdGuardHome network-wide adblocking";
+        caddy.enable = mkEnableOption "caddy https server";
       };
     };
   };