diff options
| -rw-r--r-- | flake.lock | 6 | ||||
| -rw-r--r-- | hosts/ganymede/collin-forgejo-password.age | 7 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 19 | ||||
| -rw-r--r-- | hosts/mercury/hjem.nix | 2 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 20 | ||||
| -rw-r--r-- | modules/desktop/nixos/programs/firefox.nix | 9 | ||||
| -rw-r--r-- | modules/services/nixos/adguard.nix | 40 | ||||
| -rw-r--r-- | modules/services/nixos/forgejo.nix | 16 | ||||
| -rw-r--r-- | modules/services/nixos/headscale.nix | 69 | ||||
| -rw-r--r-- | modules/services/nixos/mkCaddyCfg.nix | 45 | ||||
| -rw-r--r-- | modules/services/nixos/navidrome.nix | 18 | ||||
| -rw-r--r-- | modules/services/nixos/ngircd.nix | 8 | ||||
| -rw-r--r-- | modules/services/options.nix | 9 | ||||
| -rw-r--r-- | secrets.nix | 1 |
14 files changed, 126 insertions, 143 deletions
@@ -586,11 +586,11 @@ "yoshi-lua": { "flake": false, "locked": { - "lastModified": 1769795029, - "narHash": "sha256-15+LQ7yB0k/z/7VTi0KPBjL8M3xsDUl+ERl54lLWslE=", + "lastModified": 1770052758, + "narHash": "sha256-oq1im7UCFcgWJCYPjA/drqfunu905lt3JRxTJWnWI94=", "owner": "bluedragon1221", "repo": "yoshi", - "rev": "f8d055766d44cb8a5dd15f3fe7db8f432114e4d3", + "rev": "e6e2cda0fceb8c30f2662cc961074e7191730bc7", "type": "github" }, "original": { diff --git a/hosts/ganymede/collin-forgejo-password.age b/hosts/ganymede/collin-forgejo-password.age new file mode 100644 index 0000000..76bdc67 --- /dev/null +++ b/hosts/ganymede/collin-forgejo-password.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 azBilg vmw/nKIBoQoNUFX5L/30ll21pT0pC2aj/w2qjTc2nSM +x4udezFrc1+YG2ejgSVL6iIdPUgkiUeYxl0nijurqmE +-> ssh-ed25519 Jg4yWQ X6KPKYcqIzzllcP96/VdMH+SHzvwy5L2Yf8VIjL7GRg +ZREY05ecsxqutY2VEktNqwX8pXvmXnVL8M9FnlIkQy4 +--- MGA/XzVEB308uJE/c/bLe0GKrLDVSxciKxTV54S4oDM +#;brLܐ& ̓] WD5m ЃG`B6b
\ No newline at end of file diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index c31bb16..a2bb930 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -14,6 +14,10 @@ file = ./collin-copyparty-password.age; owner = "copyparty"; }; + "collin-forgejo-password" = { + file = ./collin-forgejo-password.age; + owner = "forgejo"; + }; }; terminal = { @@ -55,12 +59,25 @@ ]; }; + # navidrome = { + # enable = true; + # bind_host = "127.0.0.1"; + # caddy.local.enable = true; + # }; + + forgejo = { + enable = true; + bind_host = "127.0.0.1"; + root_url = "https://forgejo.collinux"; + caddy.local.enable = true; + }; + copyparty = { enable = true; bind_host = "127.0.0.1"; root_url = "up.williamsfam.us.com"; - caddy.enable = true; + caddy.global.enable = true; users.collin = { isAdmin = true; diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix index 35f21b8..ebe88db 100644 --- a/hosts/mercury/hjem.nix +++ b/hosts/mercury/hjem.nix @@ -19,11 +19,13 @@ in { kdePackages.kleopatra anki musescore + libreoffice-qt mpv bluetuith kew # music player + irssi prismlauncher diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index 8dc8fe6..7884f20 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -26,10 +26,26 @@ environment.defaultPackages = lib.mkForce []; # im not a noob + security.pki.certificates = [ + '' + -----BEGIN CERTIFICATE----- + MIIBozCCAUmgAwIBAgIQbfaguvgtbo/JBep9INWMFjAKBggqhkjOPQQDAjAwMS4w + LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI1IEVDQyBSb290MB4X + DTI1MTIyMzIzMTExMFoXDTM1MTEwMTIzMTExMFowMDEuMCwGA1UEAxMlQ2FkZHkg + TG9jYWwgQXV0aG9yaXR5IC0gMjAyNSBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG + SM49AwEHA0IABNWAL+OmSvNI1twW7CjWtVTj9PH86ejV52Tl/VKtTqacbAgS+TdU + aaekC0skEI1BNc76lsD84yRydvci1om1vv2jRTBDMA4GA1UdDwEB/wQEAwIBBjAS + BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBShYvNluMWdF4EwkTWJgcBe8Foe + XzAKBggqhkjOPQQDAgNIADBFAiEAkoloryXWPdw50LtidCzi9lZDScU2Uofpp8ie + uc1PJgQCIBy3BQIcEh9ChGJ1cIrop43zMA4C9O8HwytFX11YpZnF + -----END CERTIFICATE----- + '' + ]; + programs.ssh.extraConfig = '' Host ganymede - HostName williamsfam.us.com - Port 22 + HostName 192.168.50.2 + Port 2222 ''; programs.firefox.policies.ExtensionSettings = { diff --git a/modules/desktop/nixos/programs/firefox.nix b/modules/desktop/nixos/programs/firefox.nix index 21c8e17..7eb7efd 100644 --- a/modules/desktop/nixos/programs/firefox.nix +++ b/modules/desktop/nixos/programs/firefox.nix @@ -85,8 +85,11 @@ in } ''); + # im not disabled "accessibility.force_disabled" = opt 1; "browser.aboutConfig.showWarning" = opt false; + "media.webspeech.synth.enabled" = opt false; + "media.webspeech.synth.dont_notify_on_error" = opt true; "datareporting.policy.dataSubmissionPolicyBypassNotification" = opt true; "browser.startup.homepage" = opt "about:blank"; @@ -94,12 +97,12 @@ in "browser.compactmode.show" = opt true; "browser.uidensity" = opt 1; - "media.webspeech.synth.enabled" = opt false; # im not disabled - "media.webspeech.synth.dont_notify_on_error" = opt true; - # get that AI out of my browser "browser.ml.chat.enabled" = opt false; "browser.ml.enable" = opt false; + + # use system pki certificates + "security.enterprise_roots.enabled" = opt true; }; ExtensionSettings = let diff --git a/modules/services/nixos/adguard.nix b/modules/services/nixos/adguard.nix deleted file mode 100644 index f59934e..0000000 --- a/modules/services/nixos/adguard.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.collinux.services.adguard; -in { - imports = [ - (import ./mkCaddyCfg.nix cfg) - ]; - - config = lib.mkIf cfg.enable { - services.adguardhome = { - enable = true; - port = cfg.port; - mutableSettings = true; - settings = { - http = { - pprof.enabled = false; - address = "localhost:${toString cfg.port}"; - }; - users = []; # disable auth (only accessable over tailscale anyway) - dns = { - bind_hosts = ["127.0.0.1" cfg.bind_host]; - upstream_dns = ["https://dns.quad9.net/dns-query"]; - enable_dnssec = true; - }; - tls.enabled = false; - dhcp.enabled = false; - }; - }; - - # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse) - services.resolved.extraConfig = lib.mkIf config.services.resolved.enable '' - DNS=127.0.0.1 - DNSStubListener=no - ''; - services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups - }; -} diff --git a/modules/services/nixos/forgejo.nix b/modules/services/nixos/forgejo.nix index 5c98633..1854f0f 100644 --- a/modules/services/nixos/forgejo.nix +++ b/modules/services/nixos/forgejo.nix @@ -1,5 +1,6 @@ { lib, + pkgs, config, ... }: let @@ -16,6 +17,7 @@ in { settings = { server = { DOMAIN = "localhost"; + PROTOCOL = "http"; ROOT_URL = cfg.root_url; HTTP_PORT = cfg.port; @@ -28,8 +30,8 @@ in { SSH_LISTEN_PORT = cfg.git_ssh_port; }; service = { - DISABLE_REGISTRATION = false; - ENABLE_REVERSE_PROXY_AUTHENTICATION = true; + DISABLE_REGISTRATION = true; + ENABLE_REVERSE_PROXY_AUTHENTICATION = false; }; repository = { # disable stuff @@ -40,9 +42,17 @@ in { }; }; - systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable { + systemd.services."forgejo" = { after = lib.mkAfter ["network-online.target"]; wants = lib.mkAfter ["network-online.target"]; + + # Ensure users (https://wiki.nixos.org/wiki/Forgejo#Ensure_users) + preStart = let + adminCmd = "${lib.getExe pkgs.forgejo} admin user"; + passwd = config.collinux.secrets."collin-forgejo-password"; + in '' + ${adminCmd} create --admin --email "collin@ganymede" --username collin --password "$(tr -d '\n' < ${passwd.path})" || true + ''; }; }; } diff --git a/modules/services/nixos/headscale.nix b/modules/services/nixos/headscale.nix deleted file mode 100644 index 51d3da5..0000000 --- a/modules/services/nixos/headscale.nix +++ /dev/null @@ -1,69 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: let - cfg = config.collinux.services.headscale; - - acl_file = (pkgs.formats.json {}).generate "acl.json" { - ssh = [ - { - src = ["collin@"]; - dst = ["collin@"]; - users = ["autogroup:nonroot" "root"]; - action = "accept"; - } - ]; - }; -in { - imports = [ - (import ./mkCaddyCfg.nix cfg) - ]; - - config = lib.mkIf cfg.enable { - services.headscale = { - enable = true; - address = cfg.bind_host; - port = cfg.port; - settings = { - server_url = "https://${cfg.root_url}"; - - database.type = "sqlite"; - - dns = { - magic_dns = true; - base_domain = "collinux.tailnet"; - override_local_dns = true; - nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"]; - }; - - policy.path = acl_file; - - prefixes = { - "v4" = "100.100.0.0/16"; - allocation = "random"; - }; - - # leave tls for caddy to worry about - tls_cert_path = null; - tls_key_path = null; - - logtail.enabled = false; - }; - }; - - # make sure headscale can start before tailscale - systemd.services."headscale" = lib.mkIf config.collinux.system.networking.tailscale.enable { - after = lib.mkForce ["network.target"]; - before = lib.mkForce ["headscale.target"]; - wants = lib.mkForce ["network.target" "headscale.target"]; - }; - - systemd.targets."headscale" = { - description = "Target represents headscale is running. started by headscale.service"; - }; - - environment.systemPackages = [pkgs.headscale]; - }; -} diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix index bb2e06d..d7b74c0 100644 --- a/modules/services/nixos/mkCaddyCfg.nix +++ b/modules/services/nixos/mkCaddyCfg.nix @@ -1,15 +1,34 @@ cfg: { - services.caddy = - if cfg.caddy.enable - then { - virtualHosts.${cfg.root_url}.extraConfig = '' - ${ - if cfg.caddy.bind_tailscale - then "bind tailscale/${cfg.service_name}" - else "" - } - reverse_proxy ${cfg.bind_host}:${toString cfg.port} - ''; - } - else {}; + networking.extraHosts = + if cfg.caddy.local.enable + then '' + 127.0.0.1 ${cfg.service_name}.collinux + '' + else ""; + + services.caddy.virtualHosts = + ( + if cfg.caddy.global.enable && (cfg.root_url != null) + then { + ${cfg.root_url}.extraConfig = '' + ${ + if cfg.caddy.bind_tailscale + then "bind tailscale/${cfg.service_name}" + else "" + } + reverse_proxy ${cfg.bind_host}:${toString cfg.port} + ''; + } + else {} + ) + // ( + if cfg.caddy.local.enable + then { + "${cfg.service_name}.collinux".extraConfig = '' + tls internal + reverse_proxy ${cfg.bind_host}:${toString cfg.port} + ''; + } + else {} + ); } diff --git a/modules/services/nixos/navidrome.nix b/modules/services/nixos/navidrome.nix index 5250b85..86fdad6 100644 --- a/modules/services/nixos/navidrome.nix +++ b/modules/services/nixos/navidrome.nix @@ -4,16 +4,20 @@ ... }: let cfg = config.collinux.services.selfhost.navidrome; -in - lib.mkIf cfg.enable { +in { + imports = [ + (import ./mkCaddyCfg.nix cfg) + ]; + + config = lib.mkIf cfg.enable { services.navidrome = { enable = true; - inherit (cfg) user; settings = { - Port = 4533; - Address = "0.0.0.0"; + Port = cfg.port; + Address = cfg.bind_host; EnableInsightsCollector = false; - MusicFolder = "/home/${cfg.user}/Music"; + MusicFolder = "/media/music"; }; }; - } + }; +} diff --git a/modules/services/nixos/ngircd.nix b/modules/services/nixos/ngircd.nix index c40aa11..014dd68 100644 --- a/modules/services/nixos/ngircd.nix +++ b/modules/services/nixos/ngircd.nix @@ -14,7 +14,7 @@ in Info = Ganymede IRC Chat AdminInfo1 = Collin - Listen = 0.0.0.0 + Listen = 127.0.0.1 Ports = ${toString cfg.port} [Options] @@ -27,4 +27,10 @@ in Mask = *@* ''; }; + + users.users.ngircd.extraGroups = ["shadow"]; + + security.pam.services.ngircd = { + unixAuth = true; + }; } diff --git a/modules/services/options.nix b/modules/services/options.nix index 024e2a0..3db8f8a 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -14,6 +14,7 @@ service_name = mkOption { type = lib.types.str; + default = service_name; internal = true; }; @@ -34,7 +35,8 @@ }; caddy = { - enable = mkEnableOption "Automatically create caddy configurations for this service"; + global.enable = mkEnableOption "Automatically create caddy configurations for this service"; + local.enable = mkEnableOption "Automatically make this service accessable on ${service_name}.local"; bind_tailscale = mkEnableOption "Bind the service to ${service_name}.{tailnet}"; }; }; @@ -77,6 +79,11 @@ in { }; }; + navidrome = selfhostOptions { + service_name = "navidrome"; + default_port = 8070; + }; + copyparty = (selfhostOptions { service_name = "copyparty"; diff --git a/secrets.nix b/secrets.nix index 7bcc9b9..f53d1af 100644 --- a/secrets.nix +++ b/secrets.nix @@ -7,4 +7,5 @@ in { "github-ssh-key.age".publicKeys = [mercury.host_pubkey jupiter.host_pubkey]; "collin-copyparty-password.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; + "collin-forgejo-password.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; } |