aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--hosts/ganymede/config.nix19
-rw-r--r--modules/services/nixos/default.nix4
-rw-r--r--modules/services/nixos/forgejo.nix23
-rw-r--r--modules/services/nixos/mkCaddyCfg.nix16
-rw-r--r--modules/services/nixos/navidrome.nix4
-rw-r--r--modules/services/nixos/openssh.nix2
-rw-r--r--modules/services/options.nix60
7 files changed, 57 insertions, 71 deletions
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index a2bb930..90ca639 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -50,6 +50,7 @@
portConfig = [
{
port = 2222;
+ listenAddr = "0.0.0.0";
rootLogin = true;
}
{
@@ -59,25 +60,19 @@
];
};
- # navidrome = {
- # enable = true;
- # bind_host = "127.0.0.1";
- # caddy.local.enable = true;
- # };
+ navidrome = {
+ enable = true;
+ privateURL = "navidrome.collinux";
+ };
forgejo = {
enable = true;
- bind_host = "127.0.0.1";
- root_url = "https://forgejo.collinux";
- caddy.local.enable = true;
+ privateURL = "forgejo.collinux";
};
copyparty = {
enable = true;
- bind_host = "127.0.0.1";
-
- root_url = "up.williamsfam.us.com";
- caddy.global.enable = true;
+ publicURL = "up.williamsfam.us.com";
users.collin = {
isAdmin = true;
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 1ad53bf..e9bc46c 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -1,12 +1,10 @@
{
imports = [
- # ./navidrome.nix
- ./headscale.nix
+ ./navidrome.nix
./forgejo.nix
./openssh.nix
# ./jellyfin.nix
./caddy.nix
- ./adguard.nix
./copyparty.nix
./ngircd.nix
diff --git a/modules/services/nixos/forgejo.nix b/modules/services/nixos/forgejo.nix
index 1854f0f..91db5a6 100644
--- a/modules/services/nixos/forgejo.nix
+++ b/modules/services/nixos/forgejo.nix
@@ -16,18 +16,25 @@ in {
database.type = "sqlite3";
settings = {
server = {
- DOMAIN = "localhost";
PROTOCOL = "http";
- ROOT_URL = cfg.root_url;
+ ROOT_URL = "https://${
+ if cfg.publicURL
+ then cfg.publicURL
+ else if cfg.privateURL
+ then cfg.privateURL
+ else ""
+ }";
+
+ HTTP_ADDR = cfg.listenAddr;
HTTP_PORT = cfg.port;
+ OFFLINE_MODE = true; # don't use cdns or gravatar
+
# ssh
- START_SSH_SERVER = true; # use builtin ssh server
- BUILTIN_SSH_SERVER_USER = "git";
- SSH_DOMAIN = cfg.root_url or "ganymede";
- SSH_PORT = cfg.git_ssh_port; # don't conflict with system ssh
- SSH_LISTEN_HOST = cfg.bind_host;
- SSH_LISTEN_PORT = cfg.git_ssh_port;
+ START_SSH_SERVER = false; # use system ssh server
+ SSH_USER = "forgejo";
+ SSH_DOMAIN = "williamsfam.us.com";
+ SSH_PORT = 22;
};
service = {
DISABLE_REGISTRATION = true;
diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix
index d7b74c0..f13e40a 100644
--- a/modules/services/nixos/mkCaddyCfg.nix
+++ b/modules/services/nixos/mkCaddyCfg.nix
@@ -1,32 +1,32 @@
cfg: {
networking.extraHosts =
- if cfg.caddy.local.enable
+ if cfg.privateURL
then ''
- 127.0.0.1 ${cfg.service_name}.collinux
+ 127.0.0.1 ${cfg.privateURL}
''
else "";
services.caddy.virtualHosts =
(
- if cfg.caddy.global.enable && (cfg.root_url != null)
+ if cfg.publicURL
then {
- ${cfg.root_url}.extraConfig = ''
+ ${cfg.publicURL}.extraConfig = ''
${
if cfg.caddy.bind_tailscale
then "bind tailscale/${cfg.service_name}"
else ""
}
- reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+ reverse_proxy ${cfg.listenAddr}:${toString cfg.port}
'';
}
else {}
)
// (
- if cfg.caddy.local.enable
+ if cfg.caddy.privateURL
then {
- "${cfg.service_name}.collinux".extraConfig = ''
+ "${cfg.privateURL}.collinux".extraConfig = ''
tls internal
- reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+ reverse_proxy ${cfg.listenAddr}:${toString cfg.port}
'';
}
else {}
diff --git a/modules/services/nixos/navidrome.nix b/modules/services/nixos/navidrome.nix
index 86fdad6..27b369d 100644
--- a/modules/services/nixos/navidrome.nix
+++ b/modules/services/nixos/navidrome.nix
@@ -3,7 +3,7 @@
lib,
...
}: let
- cfg = config.collinux.services.selfhost.navidrome;
+ cfg = config.collinux.services.navidrome;
in {
imports = [
(import ./mkCaddyCfg.nix cfg)
@@ -14,7 +14,7 @@ in {
enable = true;
settings = {
Port = cfg.port;
- Address = cfg.bind_host;
+ Address = cfg.listenAddr;
EnableInsightsCollector = false;
MusicFolder = "/media/music";
};
diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
index c0c8c30..be2b51c 100644
--- a/modules/services/nixos/openssh.nix
+++ b/modules/services/nixos/openssh.nix
@@ -33,7 +33,7 @@ in {
listenAddresses =
cfg.portConfig
|> builtins.map (x: {
- addr = "0.0.0.0";
+ addr = x.listenAddr;
port = x.port;
});
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 3db8f8a..174e604 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -11,33 +11,30 @@
default_port ? null,
}: {
enable = mkEnableOption "${service_name} selfhosted service";
-
- service_name = mkOption {
+ serviceName = mkOption {
+ internal = true;
type = lib.types.str;
default = service_name;
- internal = true;
- };
-
- bind_host = mkOption {
- description = "The IP address on which ${service_name} will listen for incoming connections. The default, `0.0.0.0`, means 'all interfaces'";
- type = ipAddr;
- default = "0.0.0.0";
};
port = mkOption {
description = "The port on which ${service_name} will listen for incomming connections";
type = lib.types.port;
default = default_port;
};
-
- root_url = mkOption {
- description = "The final url that this service will be hosted on. Required for caddy, otherwise optional";
+ listenAddr = mkOption {
+ description = "The IP address on which ${service_name} will listen for incoming connections";
+ type = ipAddr;
+ default = "127.0.0.1";
+ };
+ privateUrl = mkOption {
+ description = "Internal .local name for the service. Don't put the protocol (https://) in the string";
type = lib.types.nullOr lib.types.str;
+ default = null;
};
-
- caddy = {
- global.enable = mkEnableOption "Automatically create caddy configurations for this service";
- local.enable = mkEnableOption "Automatically make this service accessable on ${service_name}.local";
- bind_tailscale = mkEnableOption "Bind the service to ${service_name}.{tailnet}";
+ publicUrl = mkOption {
+ description = "Public website on which the service will be hosted. Don't put the protocol (https://) in the string";
+ type = lib.types.nullOr lib.types.str;
+ default = null;
};
};
in {
@@ -55,6 +52,12 @@ in {
type = lib.types.port;
};
+ listenAddr = mkOption {
+ description = "Address to listen on";
+ type = lib.types.str;
+ default = "127.0.0.1";
+ };
+
otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes for this port";
rootLogin = mkEnableOption "Whether to allow root login for this port";
};
@@ -62,23 +65,11 @@ in {
};
};
- adguard = selfhostOptions {
- service_name = "adguard";
- default_port = 8001;
+ forgejo = selfhostOptions {
+ service_name = "forgejo";
+ default_port = 8010;
};
- forgejo =
- (selfhostOptions {
- service_name = "forgejo";
- default_port = 8010;
- })
- // {
- git_ssh_port = mkOption {
- type = lib.types.port;
- default = 2225;
- };
- };
-
navidrome = selfhostOptions {
service_name = "navidrome";
default_port = 8070;
@@ -118,11 +109,6 @@ in {
};
};
- headscale = selfhostOptions {
- service_name = "headscale";
- default_port = 8080;
- };
-
caddy = {
enable = mkEnableOption "caddy https server";
envFile = mkOption {