diff options
Diffstat (limited to 'modules/services/nixos')
21 files changed, 183 insertions, 432 deletions
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/adguard.nix index 69fb8a4..f59934e 100644 --- a/modules/services/nixos/selfhost/adguard.nix +++ b/modules/services/nixos/adguard.nix @@ -3,9 +3,13 @@ lib, ... }: let - cfg = config.collinux.services.selfhost.adguard; -in - lib.mkIf cfg.enable { + cfg = config.collinux.services.adguard; +in { + imports = [ + (import ./mkCaddyCfg.nix cfg) + ]; + + config = lib.mkIf cfg.enable { services.adguardhome = { enable = true; port = cfg.port; @@ -31,17 +35,6 @@ in DNS=127.0.0.1 DNSStubListener=no ''; - services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups - - services.caddy = lib.mkIf cfg.caddy.enable { - virtualHosts.${cfg.root_url}.extraConfig = '' - ${ - if cfg.caddy.bind_tailscale - then "bind tailscale/${cfg.service_name}" - else "" - } - reverse_proxy ${cfg.bind_host}:${toString cfg.port} - ''; - }; - } + }; +} diff --git a/modules/services/nixos/audio.nix b/modules/services/nixos/audio.nix deleted file mode 100644 index 9de6787..0000000 --- a/modules/services/nixos/audio.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ - pkgs, - config, - lib, - ... -}: let - cfg = config.collinux.services.audio; -in - lib.mkIf cfg.enable { - security.rtkit.enable = true; - services.pipewire = { - enable = true; - wireplumber.enable = true; - alsa.enable = true; - pulse.enable = false; - }; - - boot.blacklistedKernelModules = ["snd_seq_dummy"]; # remove extraneous alsa midi devices - - environment.systemPackages = with pkgs; [pwvucontrol qpwgraph]; - } diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix deleted file mode 100644 index acf628c..0000000 --- a/modules/services/nixos/bluetooth.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - lib, - config, - ... -}: let - cfg = config.collinux.services.bluetooth; -in - lib.mkIf cfg.enable { - hardware.bluetooth = { - enable = true; - powerOnBoot = true; - - settings.General = { - FastConnectable = true; - ControllerMode = "bredr"; - JustWorksRepairing = "always"; - }; - }; - - systemd.user.services."mpris-proxy" = { - unitConfig = { - BindsTo = ["bluetooth.target"]; - After = ["bluetooth.target"]; - }; - - wantedBy = ["bluetooth.target"]; - - # serviceConfig already exists (?) - }; - - # hardening (down to 2.1 OK) - systemd.services."bluetooth".serviceConfig = { - IPAddressDeny = "any"; - ProtectKernelLogs = true; - ProtectKernelModules = lib.mkForce true; - RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"]; - ProtectClock = true; - ProcSubset = "pid"; - }; - } diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix new file mode 100644 index 0000000..06f040c --- /dev/null +++ b/modules/services/nixos/caddy.nix @@ -0,0 +1,23 @@ +{ + pkgs, + lib, + config, + ... +}: let + cfg = config.collinux.services.caddy; +in + lib.mkIf cfg.enable { + services.caddy = { + # just always install this. No harm in installing an extra plugin + package = pkgs.caddy.withPlugins { + plugins = [ + "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61" + ]; + hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; + }; + enable = true; + environmentFile = cfg.envFile; + }; + networking.firewall.allowedTCPPorts = [80 443]; + environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff + } diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index 9c95180..234a712 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -1,10 +1,11 @@ { imports = [ - ./networking - ./audio.nix - ./bluetooth.nix - ./tailscale.nix - ./selfhost - ./ssh.nix + # ./navidrome.nix + ./headscale.nix + ./forgejo.nix + ./openssh.nix + # ./jellyfin.nix + ./caddy.nix + ./adguard.nix ]; } diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/forgejo.nix index 1b02628..5c98633 100644 --- a/modules/services/nixos/selfhost/forgejo.nix +++ b/modules/services/nixos/forgejo.nix @@ -3,9 +3,13 @@ config, ... }: let - cfg = config.collinux.services.selfhost.forgejo; -in - lib.mkIf cfg.enable { + cfg = config.collinux.services.forgejo; +in { + imports = [ + (import ./mkCaddyCfg.nix cfg) + ]; + + config = lib.mkIf cfg.enable { services.forgejo = { enable = true; database.type = "sqlite3"; @@ -18,10 +22,10 @@ in # ssh START_SSH_SERVER = true; # use builtin ssh server BUILTIN_SSH_SERVER_USER = "git"; - SSH_DOMAIN = "ganymede"; - SSH_PORT = 2225; # don't conflict with system ssh + SSH_DOMAIN = cfg.root_url or "ganymede"; + SSH_PORT = cfg.git_ssh_port; # don't conflict with system ssh SSH_LISTEN_HOST = cfg.bind_host; - SSH_LISTEN_PORT = 2225; + SSH_LISTEN_PORT = cfg.git_ssh_port; }; service = { DISABLE_REGISTRATION = false; @@ -40,15 +44,5 @@ in after = lib.mkAfter ["network-online.target"]; wants = lib.mkAfter ["network-online.target"]; }; - - services.caddy = lib.mkIf cfg.caddy.enable { - virtualHosts.${cfg.root_url}.extraConfig = '' - ${ - if cfg.caddy.bind_tailscale - then "bind tailscale/${cfg.service_name}" - else "" - } - reverse_proxy ${cfg.bind_host}:${toString cfg.port} - ''; - }; - } + }; +} diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/headscale.nix index 2bdcca1..51d3da5 100644 --- a/modules/services/nixos/selfhost/headscale.nix +++ b/modules/services/nixos/headscale.nix @@ -4,7 +4,7 @@ lib, ... }: let - cfg = config.collinux.services.selfhost.headscale; + cfg = config.collinux.services.headscale; acl_file = (pkgs.formats.json {}).generate "acl.json" { ssh = [ @@ -16,8 +16,12 @@ } ]; }; -in - lib.mkIf cfg.enable { +in { + imports = [ + (import ./mkCaddyCfg.nix cfg) + ]; + + config = lib.mkIf cfg.enable { services.headscale = { enable = true; address = cfg.bind_host; @@ -34,7 +38,7 @@ in nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"]; }; - policy.path = "${acl_file}"; + policy.path = acl_file; prefixes = { "v4" = "100.100.0.0/16"; @@ -50,7 +54,7 @@ in }; # make sure headscale can start before tailscale - systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable { + systemd.services."headscale" = lib.mkIf config.collinux.system.networking.tailscale.enable { after = lib.mkForce ["network.target"]; before = lib.mkForce ["headscale.target"]; wants = lib.mkForce ["network.target" "headscale.target"]; @@ -61,15 +65,5 @@ in }; environment.systemPackages = [pkgs.headscale]; - - services.caddy = lib.mkIf cfg.caddy.enable { - virtualHosts.${cfg.root_url}.extraConfig = '' - ${ - if cfg.caddy.bind_tailscale - then "bind tailscale/${cfg.service_name}" - else "" - } - reverse_proxy ${cfg.bind_host}:${toString cfg.port} - ''; - }; - } + }; +} diff --git a/modules/services/nixos/jellyfin.nix b/modules/services/nixos/jellyfin.nix new file mode 100644 index 0000000..65193f2 --- /dev/null +++ b/modules/services/nixos/jellyfin.nix @@ -0,0 +1,10 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.selfhost.jellyfin; +in + lib.mkIf cfg.enable { + services.jellyfin.enable = true; + } diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix new file mode 100644 index 0000000..bb2e06d --- /dev/null +++ b/modules/services/nixos/mkCaddyCfg.nix @@ -0,0 +1,15 @@ +cfg: { + services.caddy = + if cfg.caddy.enable + then { + virtualHosts.${cfg.root_url}.extraConfig = '' + ${ + if cfg.caddy.bind_tailscale + then "bind tailscale/${cfg.service_name}" + else "" + } + reverse_proxy ${cfg.bind_host}:${toString cfg.port} + ''; + } + else {}; +} diff --git a/modules/services/nixos/selfhost/navidrome.nix b/modules/services/nixos/navidrome.nix index 5250b85..5250b85 100644 --- a/modules/services/nixos/selfhost/navidrome.nix +++ b/modules/services/nixos/navidrome.nix diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix deleted file mode 100644 index a042411..0000000 --- a/modules/services/nixos/networking/default.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ - imports = [ - ./iwd.nix - ./networkmanager.nix - ./networkd.nix - ./resolved.nix - ]; - - networking.firewall = { - enable = true; - checkReversePath = "loose"; - }; -} diff --git a/modules/services/nixos/networking/iwd.nix b/modules/services/nixos/networking/iwd.nix deleted file mode 100644 index db5cc2e..0000000 --- a/modules/services/nixos/networking/iwd.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ - lib, - config, - ... -}: let - cfg = config.collinux.services.networking.iwd; -in - lib.mkIf cfg.enable { - networking = { - wireless.iwd = { - enable = true; - settings = { - General = { - EnableNetworkConfiguration = !config.collinux.services.networking.networkd.enable; - AddressRandomization = "once"; - AddressRandomizationRange = "full"; - }; - Network.NameResolvingService = "systemd"; # either systemd or resolvconf - }; - }; - - # Disable default networking stuff - dhcpcd.enable = false; - useDHCP = false; - networkmanager.enable = false; - }; - } diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix deleted file mode 100644 index e84fd2f..0000000 --- a/modules/services/nixos/networking/networkd.nix +++ /dev/null @@ -1,60 +0,0 @@ -{ - lib, - config, - ... -}: let - cfg = config.collinux.services.networking.networkd; - - dhcp_enabled = cfg.static == null; -in - lib.mkIf cfg.enable { - networking = { - wireless = - if !config.collinux.services.networking.iwd.enable - then { - enable = true; - networks.${cfg.ssid}.pskRaw = "ext:psk"; - secretsFile = cfg.pskFile; - } - else {}; - - useNetworkd = true; - - # Disable default networking stuff - dhcpcd.enable = false; - useDHCP = false; - networkmanager.enable = false; - }; - - systemd.network = { - enable = true; - - wait-online = { - enable = true; - ignoredInterfaces = ["docker0"]; - anyInterface = true; - }; - - networks."11-lan" = { - name = "wl*"; - - networkConfig = - ( - if dhcp_enabled - then {DHCP = "yes";} - else { - Address = cfg.static.ip; - Gateway = cfg.static.gateway; - DHCP = "no"; - # DNS is managed by systemd-resolved (not specified here) - } - ) - // { - LinkLocalAddressing = "no"; - }; - - dhcpV4Config.UseDNS = "no"; - dhcpV6Config.UseDNS = "no"; - }; - }; - } diff --git a/modules/services/nixos/networking/networkmanager.nix b/modules/services/nixos/networking/networkmanager.nix deleted file mode 100644 index e032bd0..0000000 --- a/modules/services/nixos/networking/networkmanager.nix +++ /dev/null @@ -1,20 +0,0 @@ -{ - lib, - config, - ... -}: let - cfg = config.collinux.services.networking.networkmanager; -in - lib.mkIf cfg.enable { - networking = { - networkmanager = { - enable = true; - dns = "systemd-resolved"; - dhcp = "internal"; - }; - - dhcpcd.enable = false; - }; - - services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=true"; - } diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix deleted file mode 100644 index 03333b1..0000000 --- a/modules/services/nixos/networking/resolved.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - networking.resolvconf.enable = false; - - networking.nameservers = [ - "9.9.9.9#dns.quad9.net" - "149.112.112.112#dns.quad9.net" - ]; - - services.resolved = { - enable = true; - dnsovertls = "opportunistic"; - dnssec = "allow-downgrade"; - - # disable extra stuff - llmnr = "false"; - extraConfig = "MulticastDNS=no"; - }; -} diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix new file mode 100644 index 0000000..c0c8c30 --- /dev/null +++ b/modules/services/nixos/openssh.nix @@ -0,0 +1,96 @@ +{ + config, + lib, + pkgs, + hosts, + ... +}: let + cfg = config.collinux.services.sshd; + + anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x); + anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x); + + authorizedKeys = + hosts + |> builtins.mapAttrs (_: data: data.user_pubkey or null) + |> builtins.attrValues + |> builtins.filter (x: x != null); +in { + config = lib.mkIf cfg.enable { + networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port); + + services.openssh = { + enable = true; + allowSFTP = false; + + hostKeys = [ + { + path = "/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + } + ]; + + listenAddresses = + cfg.portConfig + |> builtins.map (x: { + addr = "0.0.0.0"; + port = x.port; + }); + + # Lock down everything by default + settings = { + PermitRootLogin = "no"; + PasswordAuthentication = false; + PubkeyAuthentication = false; + KbdInteractiveAuthentication = false; + AllowAgentForwarding = false; + }; + + extraConfig = + cfg.portConfig + |> builtins.map (x: + lib.concatStringsSep "\n" [ + "Match LocalPort ${toString x.port}" + ( + if x.otp + then '' + ChallengeResponseAuthentication yes + PubkeyAuthentication yes + KbdInteractiveAuthentication yes + AuthenticationMethods publickey,keyboard-interactive:pam + '' + else '' + PubkeyAuthentication yes + AuthenticationMethods publickey + '' + ) + (lib.optionalString x.rootLogin "PermitRootLogin yes") + ]) + |> lib.concatStringsSep "\n\n"; + }; + + security.pam.services = lib.optionalAttrs anyOTP { + login.googleAuthenticator.enable = true; + + sshd.text = '' + account required pam_unix.so + + auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp + auth sufficient pam_permit.so + + session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required pam_unix.so + session required pam_loginuid.so + session optional ${pkgs.systemd}/lib/security/pam_systemd.so + ''; + }; + + users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys; + users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys; + + systemd.services."openssh" = { + after = lib.mkAfter ["network-online.target"]; + wants = lib.mkAfter ["network-online.target"]; + }; + }; +} diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix deleted file mode 100644 index f625f62..0000000 --- a/modules/services/nixos/selfhost/caddy.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ - pkgs, - lib, - config, - ... -}: let - cfg = config.collinux.services.selfhost.caddy; -in - lib.mkIf cfg.enable (lib.mkMerge [ - { - services.caddy = { - enable = true; - environmentFile = cfg.envFile; - }; - networking.firewall.allowedTCPPorts = [80 443]; - environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff - } - (lib.mkIf config.collinux.services.networking.tailscale.enable { - services.caddy = { - package = pkgs.caddy.withPlugins { - plugins = [ - "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61" - ]; - hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; - }; - }; - }) - ]) diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix deleted file mode 100644 index de1078b..0000000 --- a/modules/services/nixos/selfhost/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ - imports = [ - ./adguard.nix - ./forgejo.nix - ./headscale.nix - ./caddy.nix - ]; -} diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix deleted file mode 100644 index 59ea473..0000000 --- a/modules/services/nixos/selfhost/jellyfin.nix +++ /dev/null @@ -1,20 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.collinux.services.selfhost.jellyfin; -in - lib.mkIf cfg.enable (lib.mkMerge [ - { - services.jellyfin = { - enable = true; - }; - } - # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) { - # services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = '' - # bind tailscale/jellyfin - # reverse_proxy localhost:${config.services.jellyfin.port} - # ''; - # }) - ]) diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix deleted file mode 100644 index fa8b2ef..0000000 --- a/modules/services/nixos/ssh.nix +++ /dev/null @@ -1,86 +0,0 @@ -{ - config, - lib, - pkgs, - hosts, - ... -}: let - cfg = config.collinux.services.networking.sshd; -in { - config = lib.mkIf cfg.enable { - networking.firewall.allowedTCPPorts = [2222]; # only on local network - - services.openssh = { - enable = true; - - allowSFTP = false; - - hostKeys = [ - { - path = "/etc/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - } - ]; - - listenAddresses = [ - { - addr = cfg.bind_host; - port = 22; - } - { - addr = cfg.bind_host; - port = 2222; - } - ]; - - settings = { - PermitRootLogin = "no"; - PasswordAuthentication = false; - PubkeyAuthentication = true; - KbdInteractiveAuthentication = true; # for google authenticator totp codes - AuthenticationMethods = "publickey,keyboard-interactive:pam"; - }; - - extraConfig = '' - Match LocalPort 2222 - AuthenticationMethods publickey - PermitRootLogin prohibit-password - ''; - }; - - security.pam.services = { - login.googleAuthenticator.enable = true; - - sshd.text = '' - account required pam_unix.so # unix (order 10900) - - auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp # google_authenticator (order 12500) - auth sufficient pam_permit.so - - session required pam_env.so conffile=/etc/pam/environment readenv=0 # env (order 10100) - session required pam_unix.so # unix (order 10200) - session required pam_loginuid.so # loginuid (order 10300) - session optional ${pkgs.systemd}/lib/security/pam_systemd.so # systemd (order 12000) - ''; - }; - - users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = - hosts - |> (builtins.mapAttrs (_: data: data.user_pubkey or null)) - |> builtins.attrValues - |> (builtins.filter (x: x != null)); - - users.users."root".openssh.authorizedKeys.keys = - hosts - |> (builtins.mapAttrs (_: data: data.user_pubkey or null)) - |> builtins.attrValues - |> (builtins.filter (x: x != null)); # only possible over home network (:2222) - - systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable { - after = lib.mkAfter ["network-online.target"]; - wants = lib.mkAfter ["network-online.target"]; - }; - - services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true"; - }; -} diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix deleted file mode 100644 index 50e35d3..0000000 --- a/modules/services/nixos/tailscale.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: let - cfg = config.collinux.services.networking.tailscale; -in - lib.mkIf cfg.enable { - services.tailscale = { - enable = true; - useRoutingFeatures = "both"; - }; - - networking.firewall = { - checkReversePath = "loose"; - trustedInterfaces = ["tailscale0"]; - allowedUDPPorts = [config.services.tailscale.port]; - }; - - # don't start tailscale until after headscale starts - systemd.services."tailscaled" = - if config.collinux.services.selfhost.headscale.enable - then { - wants = lib.mkForce ["network.target" "headscale.target"]; - after = lib.mkForce ["network.target" "headscale.target"]; - } - else { - wants = lib.mkForce ["network.target"]; - after = lib.mkForce ["network.target"]; - }; - - environment.systemPackages = [pkgs.tailscale]; - } |