aboutsummaryrefslogtreecommitdiff
path: root/modules/services/nixos
diff options
context:
space:
mode:
Diffstat (limited to 'modules/services/nixos')
-rw-r--r--modules/services/nixos/btopweb.nix7
-rw-r--r--modules/services/nixos/caddy.nix4
-rw-r--r--modules/services/nixos/cgit/default.nix5
-rw-r--r--modules/services/nixos/default.nix1
-rw-r--r--modules/services/nixos/filebrowser.nix52
-rw-r--r--modules/services/nixos/glance.nix32
-rw-r--r--modules/services/nixos/goaccess.nix7
-rw-r--r--modules/services/nixos/minecraft.nix8
-rw-r--r--modules/services/nixos/ngircd.nix8
-rw-r--r--modules/services/nixos/openssh.nix9
-rw-r--r--modules/services/nixos/qbittorrent.nix11
11 files changed, 92 insertions, 52 deletions
diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix
index d8f4598..75498a9 100644
--- a/modules/services/nixos/btopweb.nix
+++ b/modules/services/nixos/btopweb.nix
@@ -33,7 +33,7 @@ in {
User = "btopweb";
Type = "simple";
- ExecStart = ''${pkgs.ttyd}/bin/ttyd -W -i ${cfg.listenAddr} -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
+ ExecStart = ''${lib.getExe pkgs.ttyd} -W -i 127.0.0.1 -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
};
};
@@ -41,5 +41,10 @@ in {
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
+
+ collinux.services.glance.homelabServices."btop" = {
+ url = "https://btop.ganymede";
+ icon = "si:htop";
+ };
};
}
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
index b61a3c6..4b41c76 100644
--- a/modules/services/nixos/caddy.nix
+++ b/modules/services/nixos/caddy.nix
@@ -7,8 +7,10 @@
cfg = config.collinux.services.caddy;
in
lib.mkIf cfg.enable {
+ users.users."caddy".extraGroups = ["fileserver"];
networking.firewall.allowedTCPPorts = [80 443];
- environment.systemPackages = with pkgs; [nss.tools]; # required for caddy https stuff
+ environment.systemPackages = [pkgs.nss.tools]; # required for caddy https stuff
+
services.caddy = {
enable = true;
environmentFile = cfg.envFile;
diff --git a/modules/services/nixos/cgit/default.nix b/modules/services/nixos/cgit/default.nix
index 2a78607..4f0a7ba 100644
--- a/modules/services/nixos/cgit/default.nix
+++ b/modules/services/nixos/cgit/default.nix
@@ -96,5 +96,10 @@ in {
}
}
'';
+
+ collinux.services.glance.homelabServices."git" = {
+ url = "https://git.ganymede";
+ icon = "si:git";
+ };
};
}
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 65315cf..fa74cf6 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -9,6 +9,7 @@
./ganyupload
./jta
./glance.nix
+ ./filebrowser.nix
./minecraft.nix
./ngircd.nix
diff --git a/modules/services/nixos/filebrowser.nix b/modules/services/nixos/filebrowser.nix
new file mode 100644
index 0000000..df0d536
--- /dev/null
+++ b/modules/services/nixos/filebrowser.nix
@@ -0,0 +1,52 @@
+{
+ lib,
+ pkgs,
+ config,
+ ...
+}: let
+ cfg = config.collinux.services.filebrowser;
+in
+ lib.mkIf cfg.enable {
+ users.groups."dufs" = {};
+ users.users."dufs" = {
+ isSystemUser = true;
+ group = "dufs";
+ extraGroups = ["fileserver"];
+ };
+
+ systemd.services."dufs" = {
+ description = "dufs file server";
+ restartIfChanged = true;
+ wants = ["network-online.target"];
+ after = ["network-online.target"];
+ wantedBy = ["multi-user.target"];
+
+ serviceConfig = {
+ # ExecStart = "${pkgs.dufs}/bin/dufs /media --port ${toString cfg.port}";
+ ExecStart = "${lib.getExe pkgs.dufs} /media --bind /run/dufs/dufs.sock";
+
+ RuntimeDirectory = "dufs"; # /run/dufs
+
+ User = "dufs";
+ Group = "dufs";
+
+ # Hardening
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ PrivateTmp = true;
+ NoNewPrivileges = true;
+
+ Restart = "on-failure";
+ };
+ };
+
+ services.caddy.virtualHosts."files.ganymede".extraConfig = ''
+ tls internal
+ reverse_proxy unix//run/dufs/dufs.sock
+ '';
+
+ collinux.services.glance.homelabServices."files" = {
+ url = "https://files.ganymede";
+ icon = "si:folder";
+ };
+ }
diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix
index 1396562..38e5e1d 100644
--- a/modules/services/nixos/glance.nix
+++ b/modules/services/nixos/glance.nix
@@ -8,6 +8,8 @@
pure = x: [x];
+ servicesLinks = builtins.attrValues cfg.homelabServices;
+
settings = {
server = {
inherit (cfg) port;
@@ -68,33 +70,7 @@
type = "monitor";
cache = "1m";
title = "Services";
- sites = [
- {
- title = "stats";
- url = "https://stats.ganymede";
- icon = "mdi:poll";
- }
- {
- title = "btop";
- url = "https://btop.ganymede";
- icon = "si:htop";
- }
- {
- title = "git";
- url = "https://git.ganymede";
- icon = "si:git";
- }
- {
- title = "bittorrent";
- url = "https://bittorrent.ganymede";
- icon = "si:qbittorrent";
- }
- {
- title = "website";
- url = "https://williamsfam.us.com";
- icon = "mdi:web";
- }
- ];
+ sites = servicesLinks;
}
];
};
@@ -117,6 +93,7 @@ in {
restartIfChanged = true;
wants = ["network-online.target"];
after = ["network-online.target"];
+ wantedBy = ["multi-user.target"];
serviceConfig = {
User = "glance";
@@ -138,7 +115,6 @@ in {
services.caddy.virtualHosts."home.ganymede".extraConfig = ''
tls internal
-
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
index b77f370..288428d 100644
--- a/modules/services/nixos/goaccess.nix
+++ b/modules/services/nixos/goaccess.nix
@@ -16,7 +16,7 @@
ws-url = "wss://stats.ganymede:443/ws";
port = cfg.port;
- addr = cfg.listenAddr;
+ addr = "127.0.0.1";
real-time-html = "true";
output = "/var/www/goaccess/index.html";
@@ -80,5 +80,10 @@ in {
reverse_proxy /ws 127.0.0.1:${toString cfg.port}
'';
+
+ collinux.services.glance.homelabServices."stats" = {
+ url = "https://stats.ganymede";
+ icon = "mdi:poll";
+ };
};
}
diff --git a/modules/services/nixos/minecraft.nix b/modules/services/nixos/minecraft.nix
index 45af606..0209549 100644
--- a/modules/services/nixos/minecraft.nix
+++ b/modules/services/nixos/minecraft.nix
@@ -6,7 +6,7 @@
cfg = config.collinux.services.minecraft;
in
lib.mkIf cfg.enable {
- networking.firewall.allowedUDPPorts = lib.optional cfg.public cfg.port;
+ networking.firewall.allowedUDPPorts = [cfg.port];
virtualisation.oci-containers.containers."Minecraft" = {
environment = {
@@ -23,11 +23,7 @@ in
};
image = "itzg/minecraft-bedrock-server";
ports = [
- "${
- if cfg.public
- then "0.0.0.0"
- else "127.0.0.1"
- }:${toString cfg.port}:19132/udp"
+ "0.0.0.0:${toString cfg.port}:19132/udp"
];
volumes = ["/var/lib/minecraft/:/data"];
diff --git a/modules/services/nixos/ngircd.nix b/modules/services/nixos/ngircd.nix
index ac93f06..d06a497 100644
--- a/modules/services/nixos/ngircd.nix
+++ b/modules/services/nixos/ngircd.nix
@@ -6,7 +6,7 @@
cfg = config.collinux.services.ngircd;
in
lib.mkIf cfg.enable {
- networking.firewall.allowedTCPPorts = lib.optional cfg.public cfg.port;
+ networking.firewall.allowedTCPPorts = [cfg.port];
services.ngircd = {
enable = true;
@@ -16,11 +16,7 @@ in
Info = Ganymede IRC Chat
AdminInfo1 = Collin
- Listen = ${
- if cfg.public
- then "0.0.0.0"
- else "127.0.0.1"
- }
+ Listen = 0.0.0.0
Ports = ${toString cfg.port}
[Channel]
diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
index 1d7834b..4826369 100644
--- a/modules/services/nixos/openssh.nix
+++ b/modules/services/nixos/openssh.nix
@@ -5,7 +5,6 @@
...
}: let
cfg = config.collinux.services.sshd;
-
pure = x: [x];
authorizedKeys =
@@ -30,11 +29,7 @@ in {
};
settings = {
- PermitRootLogin =
- if cfg.conf.rootLogin
- then "yes"
- else "no";
-
+ PermitRootLogin = "yes";
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PubkeyAuthentication = true;
@@ -43,7 +38,7 @@ in {
users.users = {
${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
- root.openssh.authorizedKeys.keys = lib.mkIf cfg.conf.rootLogin authorizedKeys;
+ root.openssh.authorizedKeys.keys = authorizedKeys;
};
systemd.services.openssh = {
diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix
index cc147b1..fe2831a 100644
--- a/modules/services/nixos/qbittorrent.nix
+++ b/modules/services/nixos/qbittorrent.nix
@@ -11,8 +11,10 @@ in {
extraGroups = ["fileserver"]; # torrent files go to /media/library
};
- networking.firewall.allowedTCPPorts = [49252];
- networking.firewall.allowedUDPPorts = [49252];
+ networking.firewall = {
+ allowedTCPPorts = [49252];
+ allowedUDPPorts = [49252];
+ };
services.qbittorrent = {
enable = true;
@@ -25,5 +27,10 @@ in {
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
+
+ collinux.services.glance.homelabServices."bittorrent" = {
+ url = "https://bittorrent.ganymede";
+ icon = "si:qbittorrent";
+ };
};
}