diff options
| -rw-r--r-- | hosts/ganymede/caddy.nix | 12 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 12 | ||||
| -rw-r--r-- | hosts/ganymede/minecraft.nix | 32 | ||||
| -rw-r--r-- | hosts/ganymede/nixos.nix | 3 | ||||
| -rw-r--r-- | modules/services/nixos/networking/default.nix | 5 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/adguard.nix | 54 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/caddy.nix | 26 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/default.nix | 8 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/jellyfin.nix | 20 | ||||
| -rw-r--r-- | modules/services/nixos/ssh.nix | 3 | ||||
| -rw-r--r-- | modules/services/nixos/tailscale.nix | 3 | ||||
| -rw-r--r-- | modules/services/options.nix | 2 | ||||
| -rw-r--r-- | secrets/caddy-tailscale-authkey.age | 6 | ||||
| -rw-r--r-- | secrets/default.nix | 4 | ||||
| -rw-r--r-- | secrets/secrets.nix | 3 |
15 files changed, 157 insertions, 36 deletions
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix new file mode 100644 index 0000000..adb07b5 --- /dev/null +++ b/hosts/ganymede/caddy.nix @@ -0,0 +1,12 @@ +{ + services.caddy.virtualHosts."https://web.tail7cca06.ts.net".extraConfig = '' + bind tailscale/web + root * /var/www/williams_web + file_server + + handle_path /papa_stories/* { + root * /var/www/papa_stories + file_server + } + ''; +} diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 6fa3bd1..2a0293c 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -17,16 +17,14 @@ services = { networking = { enable = true; - networkmanager.enable = true; - }; - - audio = { - enable = true; - pulse.enable = true; + iwd.enable = true; + tailscale.enable = true; + sshd.enable = true; }; selfhost = { - navidrome.enable = true; + adguard.enable = true; + caddy.enable = true; }; }; }; diff --git a/hosts/ganymede/minecraft.nix b/hosts/ganymede/minecraft.nix index a42e9a0..cff5de2 100644 --- a/hosts/ganymede/minecraft.nix +++ b/hosts/ganymede/minecraft.nix @@ -1,26 +1,24 @@ {config, ...}: { networking.firewall.allowedUDPPorts = [19132]; - virtualisation.oci-containers.backend = "podman"; - virtualisation.oci-containers.containers = { - "Minecraft" = { - environment = { - EULA = "TRUE"; - EMIT_SERVER_TELEMETRY = "true"; - SERVER_NAME = "YServer"; - TZ = config.time.timeZone; - VERSION = "1.21.81.2"; - CONTENT_LOG_FILE_ENABLED = "true"; + virtualisation.oci-containers.containers."Minecraft" = { + environment = { + EULA = "TRUE"; + EMIT_SERVER_TELEMETRY = "true"; - ALLOW_CHEATS = "false"; - DIFFICULTY = "1"; - }; - image = "itzg/minecraft-bedrock-server"; - ports = ["0.0.0.0:19132:19132/udp"]; - volumes = ["/srv/minecraft/:/data"]; + SERVER_NAME = "YServer"; + TZ = config.time.timeZone; + VERSION = "1.21.81.2"; + CONTENT_LOG_FILE_ENABLED = "true"; - podman.sdnotify = "conmon"; # avoid nasty errors about healthcheck (idk, the service runs fine) + ALLOW_CHEATS = "false"; + DIFFICULTY = "1"; }; + image = "itzg/minecraft-bedrock-server"; + ports = ["0.0.0.0:19132:19132/udp"]; + volumes = ["/srv/minecraft/:/data"]; + + podman.sdnotify = "conmon"; # avoid nasty errors about healthcheck (idk, the service runs fine) }; } diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index e4a72e9..6467059 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -4,8 +4,11 @@ ./disks.nix ./iwlwifi.nix + ./caddy.nix ]; + services.tailscale.extraSetFlags = ["--advertise-exit-node"]; + nixpkgs.hostPlatform = "x86_64-linux"; system.stateVersion = "25.05"; } diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix index de22f8b..929578d 100644 --- a/modules/services/nixos/networking/default.nix +++ b/modules/services/nixos/networking/default.nix @@ -8,11 +8,10 @@ services.resolved = { enable = true; domains = [ - "10.0.0.1" - "10.0.0.10" + "1.1.1.1" + "1.0.0.1" ]; }; - networking.resolvconf.enable = false; systemd.network.wait-online.enable = false; diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix new file mode 100644 index 0000000..196dab5 --- /dev/null +++ b/modules/services/nixos/selfhost/adguard.nix @@ -0,0 +1,54 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.selfhost.adguard; + + # tailscale constants (should be configured elsewhere) + tailscaleIP = "100.69.180.89"; +in + lib.mkIf cfg.enable (lib.mkMerge [ + { + services.adguardhome = { + enable = true; + port = 8001; + mutableSettings = true; + settings = { + http = { + pprof.enabled = false; + address = "localhost:${toString config.services.adguardhome.port}"; + }; + users = []; # disable auth (only accessable over tailscale anyway) + dns = { + bind_hosts = [ + ( + if config.collinux.services.networking.tailscale.enable + then tailscaleIP + else "0.0.0.0" + ) + ]; + upstream_dns = ["1.1.1.1"]; + }; + tls.enabled = false; + dhcp.enabled = false; + }; + }; + + # tailscale stuff + # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse) + services.resolved.extraConfig = lib.mkIf config.services.resolved.enable '' + DNS=127.0.0.1 + DNSStubListener=no + ''; + } + (lib.mkIf config.collinux.services.networking.tailscale.enable { + services.tailscale.extraSetFlags = ["--accept-dns=false"]; # would create an infinite loop of dns lookups + services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable { + virtualHosts."https://adguard.tail7cca06.ts.net".extraConfig = '' + bind tailscale/adguard + reverse_proxy ${config.services.adguardhome.settings.http.address} + ''; + }; + }) + ]) diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix new file mode 100644 index 0000000..903407f --- /dev/null +++ b/modules/services/nixos/selfhost/caddy.nix @@ -0,0 +1,26 @@ +{ + pkgs, + lib, + config, + ... +}: let + cfg = config.collinux.services.selfhost.caddy; +in + lib.mkIf cfg.enable (lib.mkMerge [ + { + services.caddy.enable = true; + networking.firewall.allowedTCPPorts = [80 443]; + environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff + } + (lib.mkIf config.collinux.services.networking.tailscale.enable { + services.caddy = { + package = pkgs.caddy.withPlugins { + plugins = [ + "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61" + ]; + hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; + }; + environmentFile = config.age.secrets."caddy-tailscale-authkey".path; + }; + }) + ]) diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix index d3b884a..a0a9194 100644 --- a/modules/services/nixos/selfhost/default.nix +++ b/modules/services/nixos/selfhost/default.nix @@ -1,11 +1,7 @@ { - lib, - config, - ... -}: { imports = [ ./navidrome.nix + ./adguard.nix + ./caddy.nix ]; - - qt.style = lib.optionalAttrs (config.collinux.theme == "adwaita") {name = "adwaita-dark";}; } diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix new file mode 100644 index 0000000..59ea473 --- /dev/null +++ b/modules/services/nixos/selfhost/jellyfin.nix @@ -0,0 +1,20 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.selfhost.jellyfin; +in + lib.mkIf cfg.enable (lib.mkMerge [ + { + services.jellyfin = { + enable = true; + }; + } + # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) { + # services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = '' + # bind tailscale/jellyfin + # reverse_proxy localhost:${config.services.jellyfin.port} + # ''; + # }) + ]) diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix index bf1aefe..b594a2d 100644 --- a/modules/services/nixos/ssh.nix +++ b/modules/services/nixos/ssh.nix @@ -8,6 +8,7 @@ in lib.mkIf cfg.enable { services.openssh = { enable = true; + openFirewall = true; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; @@ -19,4 +20,6 @@ in PasswordAuthentication = false; }; }; + + services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true"; } diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix index f60e48e..f39fc27 100644 --- a/modules/services/nixos/tailscale.nix +++ b/modules/services/nixos/tailscale.nix @@ -10,12 +10,13 @@ in services.tailscale = { enable = true; useRoutingFeatures = "both"; - extraSetFlags = ["--ssh=true"]; }; + networking.firewall = { checkReversePath = "loose"; trustedInterfaces = ["tailscale0"]; allowedUDPPorts = [config.services.tailscale.port]; }; + environment.systemPackages = [pkgs.tailscale]; } diff --git a/modules/services/options.nix b/modules/services/options.nix index ee85982..681ed99 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -33,6 +33,8 @@ in { default = config.collinux.user.name; }; }; + adguard.enable = mkEnableOption "AdGuardHome network-wide adblocking"; + caddy.enable = mkEnableOption "caddy https server"; }; }; }; diff --git a/secrets/caddy-tailscale-authkey.age b/secrets/caddy-tailscale-authkey.age new file mode 100644 index 0000000..f2a7de6 --- /dev/null +++ b/secrets/caddy-tailscale-authkey.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 Jg4yWQ xYq/DjdgQ3LJhg797pf3LA39bU9akYBLd+RoH7RMPm4 +p9CQSoh2511x7c0WAUPut4hWA3k0AI5b2fQEol5Hqs4 +--- hkbJJSCnoSYIyHtbtuLKz+fN17anXp31b2MAADIpH/4 +Ћs hZ +NZzvnB繯xZ;qY-"`'O͜P`PiTBsWJTv[?3L܌vԻ eh
\ No newline at end of file diff --git a/secrets/default.nix b/secrets/default.nix index 4571e52..2254909 100644 --- a/secrets/default.nix +++ b/secrets/default.nix @@ -1,6 +1,8 @@ { age = { identityPaths = ["/etc/ssh/ssh_host_ed25519_key"]; - secrets = {}; + secrets = { + "caddy-tailscale-authkey".file = ./caddy-tailscale-authkey.age; + }; }; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index aea48e6..b01b609 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -2,6 +2,7 @@ let # host keys mercury = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"; jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"; + ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; in { - # no secrets as of yet + "caddy-tailscale-authkey.age".publicKeys = [ganymede]; } |