aboutsummaryrefslogtreecommitdiff
path: root/modules/services/nixos
diff options
context:
space:
mode:
Diffstat (limited to 'modules/services/nixos')
-rw-r--r--modules/services/nixos/copyparty.nix24
-rw-r--r--modules/services/nixos/default.nix3
-rw-r--r--modules/services/nixos/goaccess.nix137
-rw-r--r--modules/services/nixos/jellyfin.nix10
-rw-r--r--modules/services/nixos/mopidy.nix41
-rw-r--r--modules/services/nixos/navidrome.nix23
6 files changed, 198 insertions, 40 deletions
diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix
index 7e6b40e..12e32d6 100644
--- a/modules/services/nixos/copyparty.nix
+++ b/modules/services/nixos/copyparty.nix
@@ -48,16 +48,28 @@ in {
path = "/media/public";
access = {
r = "*";
- A = ["@admin"];
+ A = "@admin";
};
};
- }
- {
+
+ "/library" = {
+ path = "/media/library";
+ access = {
+ g = "*";
+ r = "@acct";
+ A = "@admin";
+ };
+ flags = {
+ fk = 6;
+ dk = 6;
+ };
+ };
+
"/incoming" = {
path = "/media/incoming";
access = {
wG = "*";
- A = ["@admin"];
+ A = "@admin";
};
flags.fk = 6;
};
@@ -68,7 +80,7 @@ in {
{
"/${k}" = {
path = "/media/${k}";
- access.A = [k];
+ access.A = k;
};
}
(lib.optionalAttrs v.hasPublicDir {
@@ -76,7 +88,7 @@ in {
path = "/media/${k}/public";
access = {
r = "*";
- A = [k];
+ A = k;
};
};
})
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index e9bc46c..48c14b6 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -1,10 +1,11 @@
{
imports = [
- ./navidrome.nix
+ ./mopidy.nix
./forgejo.nix
./openssh.nix
# ./jellyfin.nix
./caddy.nix
+ ./goaccess.nix
./copyparty.nix
./ngircd.nix
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
new file mode 100644
index 0000000..896874a
--- /dev/null
+++ b/modules/services/nixos/goaccess.nix
@@ -0,0 +1,137 @@
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}: let
+ cfg = config.collinux.services.goaccess;
+
+ geoip = pkgs.fetchurl {
+ url = "https://github.com/P3TERX/GeoLite.mmdb/releases/download/2026.02.13/GeoLite2-City.mmdb";
+ hash = "sha256-FnvfGHH8b0506muEvlDXjgNKruorWeMXEbquGdZoH6Q=";
+ };
+
+ settings = {
+ date-format = "%s";
+ log-format = "CADDY";
+ tz = "America/Chicago";
+
+ ws-url = "wss://stats.ganymede:443/ws"; # url that the html uses to fetch from
+ port = "7890";
+ addr = "127.0.0.1";
+
+ real-time-html = "true";
+ log-file = "/var/log/caddy/access-williamsfam.us.com.log";
+ geoip-database = "${geoip}";
+ output = "/var/www/goaccess/index.html";
+ external-assets = "true";
+ all-static-files = "false";
+
+ html-report-title = "Ganymede Stats";
+ hl-header = "true";
+ agent-list = "false";
+ with-output-resolver = "false";
+ http-method = "yes";
+ http-protocol = "yes";
+ "4xx-to-unique-count" = "false";
+ ignore-crawlers = "false";
+ crawlers-only = "false";
+ unknowns-as-crawlers = "false";
+ real-os = "true";
+ };
+
+ settingsFile = pkgs.writeText "goaccess.conf" (settings |> builtins.mapAttrs (k: v: "${k} ${v}") |> builtins.attrValues |> lib.concatStringsSep "\n");
+in {
+ config = lib.mkIf cfg.enable {
+ users.groups."goaccess" = {};
+ users.users."goaccess" = {
+ isSystemUser = true;
+ group = "goaccess";
+ extraGroups = ["caddy"]; # to read caddy log files
+ };
+
+ systemd.services."goaccess" = {
+ description = "GoAccess Real-Time Log Analyzer";
+ restartIfChanged = true;
+ wants = ["network-online.target" "caddy.service"];
+ after = ["network-online.target" "caddy.service"];
+
+ serviceConfig = {
+ User = "goaccess";
+ Type = "simple";
+
+ WorkingDirectory = "/var/www/goaccess";
+ ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}";
+
+ AmbientCapabilities = [];
+ CapabilityBoundingSet = [
+ "~CAP_RAWIO"
+ "~CAP_MKNOD"
+ "~CAP_AUDIT_CONTROL"
+ "~CAP_AUDIT_READ"
+ "~CAP_AUDIT_WRITE"
+ "~CAP_SYS_BOOT"
+ "~CAP_SYS_TIME"
+ "~CAP_SYS_MODULE"
+ "~CAP_SYS_PACCT"
+ "~CAP_LEASE"
+ "~CAP_LINUX_IMMUTABLE"
+ "~CAP_IPC_LOCK"
+ "~CAP_BLOCK_SUSPEND"
+ "~CAP_WAKE_ALARM"
+ "~CAP_SYS_TTY_CONFIG"
+ "~CAP_MAC_ADMIN"
+ "~CAP_MAC_OVERRIDE"
+ "~CAP_NET_ADMIN"
+ "~CAP_NET_BROADCAST"
+ "~CAP_NET_RAW"
+ "~CAP_SYS_ADMIN"
+ "~CAP_SYS_PTRACE"
+ "~CAP_SYSLOG"
+ ];
+ DevicePolicy = "closed";
+ KeyringMode = "private";
+ LockPersonality = true;
+ NoNewPrivileges = true;
+ PrivateDevices = true;
+ PrivateMounts = true;
+ PrivateTmp = true;
+ ProtectClock = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ ProtectSystem = "full";
+ RemoveIPC = true;
+ RestrictAddressFamilies = [
+ "AF_UNIX"
+ "AF_INET"
+ "AF_INET6"
+ ];
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ };
+
+ wantedBy = ["multi-user.target"];
+ };
+
+ systemd.tmpfiles.rules = [
+ "d /var/www/goaccess/ 755 goaccess goaccess"
+ "Z /var/www/goaccess 755 goaccess goaccess"
+ ];
+
+ networking.extraHosts = ''
+ 127.0.0.1 stats.ganymede
+ '';
+
+ services.caddy.virtualHosts."stats.ganymede".extraConfig = ''
+ tls internal
+ root * /var/www/goaccess
+ file_server
+
+ reverse_proxy /ws 127.0.0.1:7890
+ '';
+ };
+}
diff --git a/modules/services/nixos/jellyfin.nix b/modules/services/nixos/jellyfin.nix
deleted file mode 100644
index 65193f2..0000000
--- a/modules/services/nixos/jellyfin.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
- config,
- lib,
- ...
-}: let
- cfg = config.collinux.services.selfhost.jellyfin;
-in
- lib.mkIf cfg.enable {
- services.jellyfin.enable = true;
- }
diff --git a/modules/services/nixos/mopidy.nix b/modules/services/nixos/mopidy.nix
new file mode 100644
index 0000000..844a387
--- /dev/null
+++ b/modules/services/nixos/mopidy.nix
@@ -0,0 +1,41 @@
+{
+ pkgs,
+ config,
+ lib,
+ ...
+}: let
+ cfg = config.collinux.services.mopidy;
+in {
+ config = lib.mkIf cfg.enable {
+ services.mopidy = {
+ enable = true;
+ extensionPackages = with pkgs; [mopidy-youtube mopidy-mpd mopidy-local];
+ settings = {
+ mpd = {
+ enabled = true;
+ hostname = "0.0.0.0";
+ port = cfg.port;
+ };
+
+ # disable default plugins
+ file.enabled = false;
+ http.enabled = false; # only use mpd
+
+ local = {
+ enabled = true;
+ media_dir = "/media/library/music";
+ };
+
+ youtube = {
+ enabled = true;
+ allow_cache = true;
+ musicapi_enabled = true;
+ youtube_dl_package = "yt_dlp";
+ autoplay_enabled = true;
+ strict_autoplay = false;
+ search_results = 15;
+ };
+ };
+ };
+ };
+}
diff --git a/modules/services/nixos/navidrome.nix b/modules/services/nixos/navidrome.nix
deleted file mode 100644
index 27b369d..0000000
--- a/modules/services/nixos/navidrome.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
- config,
- lib,
- ...
-}: let
- cfg = config.collinux.services.navidrome;
-in {
- imports = [
- (import ./mkCaddyCfg.nix cfg)
- ];
-
- config = lib.mkIf cfg.enable {
- services.navidrome = {
- enable = true;
- settings = {
- Port = cfg.port;
- Address = cfg.listenAddr;
- EnableInsightsCollector = false;
- MusicFolder = "/media/music";
- };
- };
- };
-}