services config; add goaccess and start working on mopidy

7 files changed, 207 insertions, 43 deletions

diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix
index 7e6b40e..12e32d6 100644
--- a/modules/services/nixos/copyparty.nix
+++ b/modules/services/nixos/copyparty.nix
@@ -48,16 +48,28 @@ in {
               path = "/media/public";
               access = {
                 r = "*";
-                A = ["@admin"];
+                A = "@admin";
               };
             };
-          }
-          {
+
+            "/library" = {
+              path = "/media/library";
+              access = {
+                g = "*";
+                r = "@acct";
+                A = "@admin";
+              };
+              flags = {
+                fk = 6;
+                dk = 6;
+              };
+            };
+
             "/incoming" = {
               path = "/media/incoming";
               access = {
                 wG = "*";
-                A = ["@admin"];
+                A = "@admin";
               };
               flags.fk = 6;
             };
@@ -68,7 +80,7 @@ in {
             {
               "/${k}" = {
                 path = "/media/${k}";
-                access.A = [k];
+                access.A = k;
               };
             }
             (lib.optionalAttrs v.hasPublicDir {
@@ -76,7 +88,7 @@ in {
                 path = "/media/${k}/public";
                 access = {
                   r = "*";
-                  A = [k];
+                  A = k;
                 };
               };
             })
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index e9bc46c..48c14b6 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -1,10 +1,11 @@
 {
   imports = [
-    ./navidrome.nix
+    ./mopidy.nix
     ./forgejo.nix
     ./openssh.nix
     # ./jellyfin.nix
     ./caddy.nix
+    ./goaccess.nix
 
     ./copyparty.nix
     ./ngircd.nix
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
new file mode 100644
index 0000000..896874a
--- /dev/null
+++ b/modules/services/nixos/goaccess.nix
@@ -0,0 +1,137 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.goaccess;
+
+  geoip = pkgs.fetchurl {
+    url = "https://github.com/P3TERX/GeoLite.mmdb/releases/download/2026.02.13/GeoLite2-City.mmdb";
+    hash = "sha256-FnvfGHH8b0506muEvlDXjgNKruorWeMXEbquGdZoH6Q=";
+  };
+
+  settings = {
+    date-format = "%s";
+    log-format = "CADDY";
+    tz = "America/Chicago";
+
+    ws-url = "wss://stats.ganymede:443/ws"; # url that the html uses to fetch from
+    port = "7890";
+    addr = "127.0.0.1";
+
+    real-time-html = "true";
+    log-file = "/var/log/caddy/access-williamsfam.us.com.log";
+    geoip-database = "${geoip}";
+    output = "/var/www/goaccess/index.html";
+    external-assets = "true";
+    all-static-files = "false";
+
+    html-report-title = "Ganymede Stats";
+    hl-header = "true";
+    agent-list = "false";
+    with-output-resolver = "false";
+    http-method = "yes";
+    http-protocol = "yes";
+    "4xx-to-unique-count" = "false";
+    ignore-crawlers = "false";
+    crawlers-only = "false";
+    unknowns-as-crawlers = "false";
+    real-os = "true";
+  };
+
+  settingsFile = pkgs.writeText "goaccess.conf" (settings |> builtins.mapAttrs (k: v: "${k} ${v}") |> builtins.attrValues |> lib.concatStringsSep "\n");
+in {
+  config = lib.mkIf cfg.enable {
+    users.groups."goaccess" = {};
+    users.users."goaccess" = {
+      isSystemUser = true;
+      group = "goaccess";
+      extraGroups = ["caddy"]; # to read caddy log files
+    };
+
+    systemd.services."goaccess" = {
+      description = "GoAccess Real-Time Log Analyzer";
+      restartIfChanged = true;
+      wants = ["network-online.target" "caddy.service"];
+      after = ["network-online.target" "caddy.service"];
+
+      serviceConfig = {
+        User = "goaccess";
+        Type = "simple";
+
+        WorkingDirectory = "/var/www/goaccess";
+        ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}";
+
+        AmbientCapabilities = [];
+        CapabilityBoundingSet = [
+          "~CAP_RAWIO"
+          "~CAP_MKNOD"
+          "~CAP_AUDIT_CONTROL"
+          "~CAP_AUDIT_READ"
+          "~CAP_AUDIT_WRITE"
+          "~CAP_SYS_BOOT"
+          "~CAP_SYS_TIME"
+          "~CAP_SYS_MODULE"
+          "~CAP_SYS_PACCT"
+          "~CAP_LEASE"
+          "~CAP_LINUX_IMMUTABLE"
+          "~CAP_IPC_LOCK"
+          "~CAP_BLOCK_SUSPEND"
+          "~CAP_WAKE_ALARM"
+          "~CAP_SYS_TTY_CONFIG"
+          "~CAP_MAC_ADMIN"
+          "~CAP_MAC_OVERRIDE"
+          "~CAP_NET_ADMIN"
+          "~CAP_NET_BROADCAST"
+          "~CAP_NET_RAW"
+          "~CAP_SYS_ADMIN"
+          "~CAP_SYS_PTRACE"
+          "~CAP_SYSLOG"
+        ];
+        DevicePolicy = "closed";
+        KeyringMode = "private";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+      };
+
+      wantedBy = ["multi-user.target"];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d /var/www/goaccess/ 755 goaccess goaccess"
+      "Z /var/www/goaccess 755 goaccess goaccess"
+    ];
+
+    networking.extraHosts = ''
+      127.0.0.1 stats.ganymede
+    '';
+
+    services.caddy.virtualHosts."stats.ganymede".extraConfig = ''
+      tls internal
+      root * /var/www/goaccess
+      file_server
+
+      reverse_proxy /ws 127.0.0.1:7890
+    '';
+  };
+}
diff --git a/modules/services/nixos/jellyfin.nix b/modules/services/nixos/jellyfin.nix
deleted file mode 100644
index 65193f2..0000000
--- a/modules/services/nixos/jellyfin.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.jellyfin;
-in
-  lib.mkIf cfg.enable {
-    services.jellyfin.enable = true;
-  }
diff --git a/modules/services/nixos/mopidy.nix b/modules/services/nixos/mopidy.nix
new file mode 100644
index 0000000..844a387
--- /dev/null
+++ b/modules/services/nixos/mopidy.nix
@@ -0,0 +1,41 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.mopidy;
+in {
+  config = lib.mkIf cfg.enable {
+    services.mopidy = {
+      enable = true;
+      extensionPackages = with pkgs; [mopidy-youtube mopidy-mpd mopidy-local];
+      settings = {
+        mpd = {
+          enabled = true;
+          hostname = "0.0.0.0";
+          port = cfg.port;
+        };
+
+        # disable default plugins
+        file.enabled = false;
+        http.enabled = false; # only use mpd
+
+        local = {
+          enabled = true;
+          media_dir = "/media/library/music";
+        };
+
+        youtube = {
+          enabled = true;
+          allow_cache = true;
+          musicapi_enabled = true;
+          youtube_dl_package = "yt_dlp";
+          autoplay_enabled = true;
+          strict_autoplay = false;
+          search_results = 15;
+        };
+      };
+    };
+  };
+}
diff --git a/modules/services/nixos/navidrome.nix b/modules/services/nixos/navidrome.nix
deleted file mode 100644
index 27b369d..0000000
--- a/modules/services/nixos/navidrome.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.navidrome;
-in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
-  config = lib.mkIf cfg.enable {
-    services.navidrome = {
-      enable = true;
-      settings = {
-        Port = cfg.port;
-        Address = cfg.listenAddr;
-        EnableInsightsCollector = false;
-        MusicFolder = "/media/music";
-      };
-    };
-  };
-}
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 174e604..ccc2038 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -70,9 +70,15 @@ in {
         default_port = 8010;
       };
 
-      navidrome = selfhostOptions {
-        service_name = "navidrome";
-        default_port = 8070;
+      goaccess.enable = mkEnableOption "GoAccess Real-Time Analytics";
+
+      mopidy = {
+        enable = mkEnableOption "Mopidy MPD server";
+        port = mkOption {
+          description = "port to run the service on";
+          type = lib.types.port;
+          default = 6600;
+        };
       };
 
       copyparty =