4 files changed, 71 insertions, 49 deletions
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index eb77cf6..c5e93ee 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -4,52 +4,44 @@
   ...
 }: let
   cfg = config.collinux.services.selfhost.adguard;
-
-  # tailscale constants (should be configured elsewhere)
-  tailscaleIP = "100.69.180.89";
 in
-  lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      services.adguardhome = {
-        enable = true;
-        port = 8001;
-        mutableSettings = true;
-        settings = {
-          http = {
-            pprof.enabled = false;
-            address = "localhost:${toString config.services.adguardhome.port}";
-          };
-          users = []; # disable auth (only accessable over tailscale anyway)
-          dns = {
-            bind_hosts =
-              [
-                "127.0.0.1"
-              ]
-              ++ lib.optional config.collinux.services.networking.tailscale.enable tailscaleIP;
-            upstream_dns = [
-              "https://dns.quad9.net/dns-query"
-            ];
-            enable_dnssec = true;
-          };
-          tls.enabled = false;
-          dhcp.enabled = false;
+  lib.mkIf cfg.enable {
+    services.adguardhome = {
+      enable = true;
+      port = cfg.port;
+      mutableSettings = true;
+      settings = {
+        http = {
+          pprof.enabled = false;
+          address = "localhost:${toString cfg.port}";
+        };
+        users = []; # disable auth (only accessable over tailscale anyway)
+        dns = {
+          bind_hosts = ["127.0.0.1" cfg.bind_host];
+          upstream_dns = ["https://dns.quad9.net/dns-query"];
+          enable_dnssec = true;
         };
+        tls.enabled = false;
+        dhcp.enabled = false;
       };
+    };
+
+    # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
+    services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
+      DNS=127.0.0.1
+      DNSStubListener=no
+    '';
 
-      # tailscale stuff
-      # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
-      services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
-        DNS=127.0.0.1
-        DNSStubListener=no
+    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if config.collinux.services.networking.tailscale.enable
+          then "bind tailscale/adguard"
+          else ""
+        }
+        reverse_proxy localhost:${toString cfg.port}
       '';
-    }
-    (lib.mkIf config.collinux.services.networking.tailscale.enable {
-      services.tailscale.extraSetFlags = ["--accept-dns=false"]; # would create an infinite loop of dns lookups
-      services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
-        virtualHosts."https://adguard.tail7cca06.ts.net".extraConfig = ''
-          bind tailscale/adguard
-          reverse_proxy ${config.services.adguardhome.settings.http.address}
-        '';
-      };
-    })
-  ])
+    };
+
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+  }
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
index 85a840a..f625f62 100644
--- a/modules/services/nixos/selfhost/caddy.nix
+++ b/modules/services/nixos/selfhost/caddy.nix
@@ -8,7 +8,10 @@
 in
   lib.mkIf cfg.enable (lib.mkMerge [
     {
-      services.caddy.enable = true;
+      services.caddy = {
+        enable = true;
+        environmentFile = cfg.envFile;
+      };
       networking.firewall.allowedTCPPorts = [80 443];
       environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
     }
@@ -20,7 +23,6 @@ in
           ];
           hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
         };
-        environmentFile = cfg.envFile;
       };
     })
   ])
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index 4cd7986..876586d 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -1,6 +1,5 @@
 {
   imports = [
-    ./navidrome.nix
     ./adguard.nix
     ./forgejo.nix
     ./caddy.nix
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index 73fbdaa..b1a6095 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -12,9 +12,38 @@ in
       settings = {
         server = {
           DOMAIN = "localhost";
-          HTTP_PORT = 8010;
+          ROOT_URL = cfg.root_url;
+          HTTP_PORT = cfg.port;
+
+          # ssh
+          START_SSH_SERVER = true; # use builtin ssh server
+          BUILTIN_SSH_SERVER_USER = "git";
+          SSH_DOMAIN = "ganymede";
+          SSH_PORT = 2222; # don't conflict with system ssh
+          SSH_LISTEN_HOST = cfg.bind_host;
+          SSH_LISTEN_PORT = 2222;
+        };
+        service = {
+          DISABLE_REGISTRATION = false;
+          ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
+        };
+        repository = {
+          # disable stuff
+          DISABLE_MIGRATIONS = true;
+          DISABLE_STARS = true;
+          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
         };
-        service.DISABLE_REGISTRATION = false;
       };
     };
+
+    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if config.collinux.services.networking.tailscale.enable
+          then "bind tailscale/forgejo"
+          else ""
+        }
+        reverse_proxy localhost:${toString cfg.port}
+      '';
+    };
   }