diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/services/nixos/networking/default.nix | 5 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/adguard.nix | 54 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/caddy.nix | 26 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/default.nix | 8 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/jellyfin.nix | 20 | ||||
| -rw-r--r-- | modules/services/nixos/ssh.nix | 3 | ||||
| -rw-r--r-- | modules/services/nixos/tailscale.nix | 3 | ||||
| -rw-r--r-- | modules/services/options.nix | 2 |
8 files changed, 111 insertions, 10 deletions
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix index de22f8b..929578d 100644 --- a/modules/services/nixos/networking/default.nix +++ b/modules/services/nixos/networking/default.nix @@ -8,11 +8,10 @@ services.resolved = { enable = true; domains = [ - "10.0.0.1" - "10.0.0.10" + "1.1.1.1" + "1.0.0.1" ]; }; - networking.resolvconf.enable = false; systemd.network.wait-online.enable = false; diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix new file mode 100644 index 0000000..196dab5 --- /dev/null +++ b/modules/services/nixos/selfhost/adguard.nix @@ -0,0 +1,54 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.selfhost.adguard; + + # tailscale constants (should be configured elsewhere) + tailscaleIP = "100.69.180.89"; +in + lib.mkIf cfg.enable (lib.mkMerge [ + { + services.adguardhome = { + enable = true; + port = 8001; + mutableSettings = true; + settings = { + http = { + pprof.enabled = false; + address = "localhost:${toString config.services.adguardhome.port}"; + }; + users = []; # disable auth (only accessable over tailscale anyway) + dns = { + bind_hosts = [ + ( + if config.collinux.services.networking.tailscale.enable + then tailscaleIP + else "0.0.0.0" + ) + ]; + upstream_dns = ["1.1.1.1"]; + }; + tls.enabled = false; + dhcp.enabled = false; + }; + }; + + # tailscale stuff + # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse) + services.resolved.extraConfig = lib.mkIf config.services.resolved.enable '' + DNS=127.0.0.1 + DNSStubListener=no + ''; + } + (lib.mkIf config.collinux.services.networking.tailscale.enable { + services.tailscale.extraSetFlags = ["--accept-dns=false"]; # would create an infinite loop of dns lookups + services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable { + virtualHosts."https://adguard.tail7cca06.ts.net".extraConfig = '' + bind tailscale/adguard + reverse_proxy ${config.services.adguardhome.settings.http.address} + ''; + }; + }) + ]) diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix new file mode 100644 index 0000000..903407f --- /dev/null +++ b/modules/services/nixos/selfhost/caddy.nix @@ -0,0 +1,26 @@ +{ + pkgs, + lib, + config, + ... +}: let + cfg = config.collinux.services.selfhost.caddy; +in + lib.mkIf cfg.enable (lib.mkMerge [ + { + services.caddy.enable = true; + networking.firewall.allowedTCPPorts = [80 443]; + environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff + } + (lib.mkIf config.collinux.services.networking.tailscale.enable { + services.caddy = { + package = pkgs.caddy.withPlugins { + plugins = [ + "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61" + ]; + hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; + }; + environmentFile = config.age.secrets."caddy-tailscale-authkey".path; + }; + }) + ]) diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix index d3b884a..a0a9194 100644 --- a/modules/services/nixos/selfhost/default.nix +++ b/modules/services/nixos/selfhost/default.nix @@ -1,11 +1,7 @@ { - lib, - config, - ... -}: { imports = [ ./navidrome.nix + ./adguard.nix + ./caddy.nix ]; - - qt.style = lib.optionalAttrs (config.collinux.theme == "adwaita") {name = "adwaita-dark";}; } diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix new file mode 100644 index 0000000..59ea473 --- /dev/null +++ b/modules/services/nixos/selfhost/jellyfin.nix @@ -0,0 +1,20 @@ +{ + config, + lib, + ... +}: let + cfg = config.collinux.services.selfhost.jellyfin; +in + lib.mkIf cfg.enable (lib.mkMerge [ + { + services.jellyfin = { + enable = true; + }; + } + # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) { + # services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = '' + # bind tailscale/jellyfin + # reverse_proxy localhost:${config.services.jellyfin.port} + # ''; + # }) + ]) diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix index bf1aefe..b594a2d 100644 --- a/modules/services/nixos/ssh.nix +++ b/modules/services/nixos/ssh.nix @@ -8,6 +8,7 @@ in lib.mkIf cfg.enable { services.openssh = { enable = true; + openFirewall = true; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; @@ -19,4 +20,6 @@ in PasswordAuthentication = false; }; }; + + services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true"; } diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix index f60e48e..f39fc27 100644 --- a/modules/services/nixos/tailscale.nix +++ b/modules/services/nixos/tailscale.nix @@ -10,12 +10,13 @@ in services.tailscale = { enable = true; useRoutingFeatures = "both"; - extraSetFlags = ["--ssh=true"]; }; + networking.firewall = { checkReversePath = "loose"; trustedInterfaces = ["tailscale0"]; allowedUDPPorts = [config.services.tailscale.port]; }; + environment.systemPackages = [pkgs.tailscale]; } diff --git a/modules/services/options.nix b/modules/services/options.nix index ee85982..681ed99 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -33,6 +33,8 @@ in { default = config.collinux.user.name; }; }; + adguard.enable = mkEnableOption "AdGuardHome network-wide adblocking"; + caddy.enable = mkEnableOption "caddy https server"; }; }; }; |