From 7b9a5eb561948521ac4669074cc746a0f848ed23 Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Thu, 8 Jan 2026 22:33:36 -0600 Subject: headscale --- hosts/ganymede/config.nix | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) (limited to 'hosts/ganymede/config.nix') diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 50ef29a..c2b312f 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -1,4 +1,6 @@ -{config, ...}: { +{config, ...}: let + tailscaleIP = "100.69.180.89"; +in { collinux = { user.name = "collin"; @@ -32,12 +34,25 @@ }; }; tailscale.enable = true; - sshd.enable = true; + sshd = { + enable = true; + bind_host = tailscaleIP; + }; }; selfhost = { - adguard.enable = true; - forgejo.enable = true; + adguard = { + enable = true; + bind_host = tailscaleIP; + }; + forgejo = { + enable = true; + bind_host = tailscaleIP; + }; + headscale = { + enable = true; + root_url = "https://headscale.williamsfam.us.com"; + }; caddy = { enable = true; envFile = config.collinux.secrets."caddy-env".path; -- cgit v1.3.1 From 547d6dc4731b04a240048b0b95c0ea12e0d1f6bd Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Fri, 9 Jan 2026 20:36:36 -0600 Subject: lots of changes, including revamp of network services boot chain on mercury --- flake.lock | 57 +++++++++++++++++++++++++- flake.nix | 5 +++ hosts/ganymede/caddy-env.age | 11 ++--- hosts/ganymede/caddy.nix | 6 --- hosts/ganymede/config.nix | 18 +++++--- hosts/ganymede/minecraft.nix | 10 ++--- hosts/ganymede/nixos.nix | 28 ++++++++++++- hosts/ganymede/tsnsrv-authkey.age | 7 ++++ hosts/mercury/hjem.nix | 1 + modules/services/nixos/bluetooth.nix | 12 ++++++ modules/services/nixos/networking/default.nix | 3 +- modules/services/nixos/networking/networkd.nix | 6 +++ modules/services/nixos/selfhost/adguard.nix | 3 +- modules/services/nixos/selfhost/forgejo.nix | 7 +++- modules/services/nixos/selfhost/headscale.nix | 25 ++++++++--- modules/services/nixos/ssh.nix | 14 +++++++ modules/services/nixos/tailscale.nix | 6 +++ modules/services/options.nix | 4 +- secrets.nix | 1 + 19 files changed, 188 insertions(+), 36 deletions(-) create mode 100644 hosts/ganymede/tsnsrv-authkey.age (limited to 'hosts/ganymede/config.nix') diff --git a/flake.lock b/flake.lock index 63739b2..b4d9b39 100644 --- a/flake.lock +++ b/flake.lock @@ -150,6 +150,24 @@ "type": "github" } }, + "flake-parts": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib" + }, + "locked": { + "lastModified": 1765835352, + "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "a34fae9c08a15ad73f295041fec82323541400a9", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -283,6 +301,21 @@ "type": "github" } }, + "nixpkgs-lib": { + "locked": { + "lastModified": 1765674936, + "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "pre-commit": { "inputs": { "flake-compat": "flake-compat_2", @@ -316,7 +349,8 @@ "lanzaboote": "lanzaboote", "nixos-facter-modules": "nixos-facter-modules", "nixpkgs": "nixpkgs", - "tmux-tsunami": "tmux-tsunami" + "tmux-tsunami": "tmux-tsunami", + "tsnsrv": "tsnsrv" } }, "rust-overlay": { @@ -451,6 +485,27 @@ "type": "github" } }, + "tsnsrv": { + "inputs": { + "flake-parts": "flake-parts", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1767001347, + "narHash": "sha256-uRm4oWMFUBSmXgofOngMWIyA/yUmLlon6f3XoFTWvBA=", + "owner": "boinkor-net", + "repo": "tsnsrv", + "rev": "8f3fbf69e1517612c0fde9be27522e12c2ddc238", + "type": "github" + }, + "original": { + "owner": "boinkor-net", + "repo": "tsnsrv", + "type": "github" + } + }, "utils": { "inputs": { "systems": "systems_2" diff --git a/flake.nix b/flake.nix index 6958a06..6f71eb4 100644 --- a/flake.nix +++ b/flake.nix @@ -37,6 +37,11 @@ url = "github:MrOtherGuy/firefox-csshacks"; flake = false; }; + + tsnsrv = { + url = "github:boinkor-net/tsnsrv"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = inputs: let diff --git a/hosts/ganymede/caddy-env.age b/hosts/ganymede/caddy-env.age index 79d7b91..ecfc05a 100644 --- a/hosts/ganymede/caddy-env.age +++ b/hosts/ganymede/caddy-env.age @@ -1,6 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ cVxgS8Sy6bB9lQVeDBQVhmCaD437YxPAZduSzFA6WHE -KV9ZrAEH3z8cT0IeaIfkqMYhU/4LS2St0ySK030Ie1c ---- pUeKTMwZf3FARqVLl9TARgItjcr1O82hUKaZ9YtjFRM -a_v1BRgʫ*+r֘0}ܨd`˟ϞJ<3hi1|Gjl3!7r 3Xp=d`71ݻѲhFW5/2̞?[HZ - Sd:FCGq%-#W~Wz_XF)ZS~MhCF!C)N*ٟ -R \ No newline at end of file +-> ssh-ed25519 Jg4yWQ t4jtOOcuC4v735Yi4FzdDnvjQFNYVgzMluuH7H3oxx4 +qLKbZ3wA3kk7UXqwUJN2HH+6Wr3qgzINNwLx+dbgsIg +--- im4dvpbhdvB7fwa8QJ7clFZ+5aVIaXld/gPlhUalc14 +>u4BECQD:3kkKļc}}}mK)HM3v}ܣI9Ikxr1s?"8Д>J{uafϚ}.3Oa9m2- @C0b X|]:9`WX1ba|W2=l]Cw U&~"0 ! +6 +MFίp D˅+q `-R6/L 4 \ No newline at end of file diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix index e6f18ab..6ad32cf 100644 --- a/hosts/ganymede/caddy.nix +++ b/hosts/ganymede/caddy.nix @@ -19,12 +19,6 @@ } ''; - virtualHosts."https://web.tail7cca06.ts.net".extraConfig = '' - bind tailscale/web - root * /var/www - file_server - ''; - virtualHosts."https://williamsfam.us.com".extraConfig = '' root * /var/www file_server diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index c2b312f..3adf620 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -1,5 +1,5 @@ {config, ...}: let - tailscaleIP = "100.69.180.89"; + tailscaleIP = "100.100.218.182"; in { collinux = { user.name = "collin"; @@ -7,6 +7,7 @@ in { secrets = { "williams-psk".file = ./williams-psk.age; "caddy-env".file = ./caddy-env.age; + "tsnsrv-authkey".file = ./tsnsrv-authkey.age; }; terminal = { @@ -33,7 +34,10 @@ in { gateway = "192.168.50.1"; }; }; - tailscale.enable = true; + tailscale = { + enable = true; + tailnet = "collinux.tailnet"; + }; sshd = { enable = true; bind_host = tailscaleIP; @@ -41,10 +45,12 @@ in { }; selfhost = { - adguard = { - enable = true; - bind_host = tailscaleIP; - }; + magic_caddy.enable = false; + + # adguard = { + # enable = true; + # bind_host = tailscaleIP; + # }; forgejo = { enable = true; bind_host = tailscaleIP; diff --git a/hosts/ganymede/minecraft.nix b/hosts/ganymede/minecraft.nix index cff5de2..c244868 100644 --- a/hosts/ganymede/minecraft.nix +++ b/hosts/ganymede/minecraft.nix @@ -1,6 +1,6 @@ {config, ...}: { networking.firewall.allowedUDPPorts = [19132]; - virtualisation.oci-containers.backend = "podman"; + virtualisation.oci-containers.backend = "docker"; virtualisation.oci-containers.containers."Minecraft" = { environment = { @@ -9,16 +9,14 @@ SERVER_NAME = "YServer"; TZ = config.time.timeZone; - VERSION = "1.21.81.2"; - CONTENT_LOG_FILE_ENABLED = "true"; + VERSION = "1.21.131.1"; + CONTENT_LOG_FILE_ENABLED = "false"; ALLOW_CHEATS = "false"; DIFFICULTY = "1"; }; image = "itzg/minecraft-bedrock-server"; ports = ["0.0.0.0:19132:19132/udp"]; - volumes = ["/srv/minecraft/:/data"]; - - podman.sdnotify = "conmon"; # avoid nasty errors about healthcheck (idk, the service runs fine) + volumes = ["/var/lib/minecraft/:/data"]; }; } diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 863032f..ce30973 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -1,8 +1,16 @@ -{inputs, ...}: { +{ + config, + lib, + inputs, + ... +}: { imports = [ inputs.disko.nixosModules.disko + inputs.tsnsrv.nixosModules.default ./disks.nix + ./minecraft.nix + ./iwlwifi.nix ./caddy.nix ]; @@ -15,6 +23,24 @@ networkConfig.DHCP = "yes"; }; + services.openssh.settings.PasswordAuthentication = lib.mkForce true; + + # services.tsnsrv = { + # enable = true; + # defaults = { + # authKeyPath = config.collinux.secrets."tsnsrv-authkey".path; + # ephemeral = true; + # loginServerUrl = "https://williamsfam.us.com"; + # }; + + # services = { + # "adguard" = { + # listenAddr = ":80"; + # toURL = "http://localhost:8001"; + # }; + # }; + # }; + nixpkgs.hostPlatform = "x86_64-linux"; system.stateVersion = "25.05"; } diff --git a/hosts/ganymede/tsnsrv-authkey.age b/hosts/ganymede/tsnsrv-authkey.age new file mode 100644 index 0000000..d0e6eb1 --- /dev/null +++ b/hosts/ganymede/tsnsrv-authkey.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 Jg4yWQ NYO6CUksU6appmdib7CER3YYbcKoyn0wmB4YGTCeTE0 +tizx14UdvQftYrkDa3iXQYDp6JPWHfjDmFwjr11FBxQ +-> ssh-ed25519 azBilg 3PYXHVdB2y2Y42ijOiv8LJ9c4WmeB5ivEPcehfS3Wns +tP/xCHzd31DydF5aCn1tJGudanXLl+DIPod7KFtglXQ +--- nbch7DRt1CYKBqzE9CeUIJgTMKIUCEA/CXVQZjkywfI +~}H <42)U{QK3%G^FW3GJy 1 \ No newline at end of file diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix index 1db654f..6eba4c9 100644 --- a/hosts/mercury/hjem.nix +++ b/hosts/mercury/hjem.nix @@ -6,6 +6,7 @@ kdePackages.kleopatra mpv musescore + zed-editor # experimenting kew # music player prismlauncher diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix index a86b5b3..bdcaa00 100644 --- a/modules/services/nixos/bluetooth.nix +++ b/modules/services/nixos/bluetooth.nix @@ -12,6 +12,18 @@ in powerOnBoot = true; }; + # hardening (down to 2.1 OK) + systemd.services."bluetooth".serviceConfig = { + IPAddressDeny = "any"; + ProtectHostname = true; + ProtectKernelTunables = lib.mkForce true; + ProtectKernelLogs = true; + ProtectKernelModules = lib.mkForce true; + RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"]; + ProtectClock = true; + ProcSubset = "pid"; + }; + environment.systemPackages = [ (lib.mkIf cfg.blueman.enable pkgs.blueman) (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith) diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix index 2667849..62b9146 100644 --- a/modules/services/nixos/networking/default.nix +++ b/modules/services/nixos/networking/default.nix @@ -11,6 +11,7 @@ services.resolved = { enable = true; dnsovertls = "opportunistic"; + dnssec = "allow-downgrade"; fallbackDns = [ "9.9.9.9#dns.quad9.net" "149.112.112.112#dns.quad9.net" @@ -21,6 +22,4 @@ extraConfig = "MulticastDNS=no"; }; networking.resolvconf.enable = false; - - systemd.network.wait-online.enable = false; } diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix index 9a11129..470bcec 100644 --- a/modules/services/nixos/networking/networkd.nix +++ b/modules/services/nixos/networking/networkd.nix @@ -25,6 +25,12 @@ in systemd.network = { enable = true; + + wait-online = { + enable = true; + ignoredInterfaces = ["docker0"]; + }; + networks."11-static-lan" = { name = "wl*"; diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix index c5e93ee..73c6caf 100644 --- a/modules/services/nixos/selfhost/adguard.nix +++ b/modules/services/nixos/selfhost/adguard.nix @@ -32,7 +32,8 @@ in DNSStubListener=no ''; - services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable { + services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable + && config.collinux.services.selfhost.magic_caddy.enable) { virtualHosts.${cfg.root_url}.extraConfig = '' ${ if config.collinux.services.networking.tailscale.enable diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix index b1a6095..e499e64 100644 --- a/modules/services/nixos/selfhost/forgejo.nix +++ b/modules/services/nixos/selfhost/forgejo.nix @@ -36,7 +36,12 @@ in }; }; - services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable { + systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable { + after = lib.mkAfter ["network-online.target"]; + wants = lib.mkAfter ["network-online.target"]; + }; + + services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable && config.collinux.services.selfhost.magic_caddy.enable) { virtualHosts.${cfg.root_url}.extraConfig = '' ${ if config.collinux.services.networking.tailscale.enable diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix index 9319691..9989742 100644 --- a/modules/services/nixos/selfhost/headscale.nix +++ b/modules/services/nixos/selfhost/headscale.nix @@ -7,12 +7,14 @@ cfg = config.collinux.services.selfhost.headscale; acl_file = (pkgs.formats.json {}).generate "acl.json" { - ssh = { - src = ["*"]; - dst = ["*"]; - users = ["autogroup:nonroot" "root"]; - action = "accept"; - }; + ssh = [ + { + src = ["collin@"]; + dst = ["collin@"]; + users = ["autogroup:nonroot" "root"]; + action = "accept"; + } + ]; }; in lib.mkIf cfg.enable { @@ -47,6 +49,17 @@ in }; }; + # make sure headscale can start before tailscale + systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable { + after = lib.mkForce ["network.target"]; + before = lib.mkForce ["headscale.target"]; + wants = lib.mkForce ["network.target" "headscale.target"]; + }; + + systemd.targets."headscale" = { + description = "Target represents headscale is running. started by headscale.service"; + }; + services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable '' reverse_proxy localhost:8080 ''; diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix index 2867d10..cfe7883 100644 --- a/modules/services/nixos/ssh.nix +++ b/modules/services/nixos/ssh.nix @@ -8,18 +8,32 @@ in { config = lib.mkIf cfg.enable { services.openssh = { enable = true; + openFirewall = false; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; } ]; + + listenAddresses = [ + { + addr = cfg.bind_host; + port = 22; + } + ]; + settings = { PermitRootLogin = "prohibit-password"; PasswordAuthentication = false; }; }; + systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable { + after = lib.mkAfter ["network-online.target"]; + wants = lib.mkAfter ["network-online.target"]; + }; + services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true"; }; } diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix index f39fc27..6af3c1c 100644 --- a/modules/services/nixos/tailscale.nix +++ b/modules/services/nixos/tailscale.nix @@ -18,5 +18,11 @@ in allowedUDPPorts = [config.services.tailscale.port]; }; + # don't start tailscale until after headscale starts + systemd.services."tailscaled" = lib.mkIf config.collinux.services.selfhost.headscale.enable { + wants = lib.mkForce ["network.target" "headscale.target"]; + after = lib.mkForce ["network.target" "headscale.target"]; + }; + environment.systemPackages = [pkgs.tailscale]; } diff --git a/modules/services/options.nix b/modules/services/options.nix index 2084c45..8be7c42 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -76,11 +76,13 @@ in { type = lib.types.str; default = with config.collinux.services.networking.tailscale; if enable - then "https://${service_name}.${tailnet}" + then "http://${service_name}.${tailnet}" else null; }; }; in { + magic_caddy.enable = mkEnableOption "Automatically create caddy configurations for services"; + adguard = selfhostOptions { service_name = "adguard"; default_port = 8001; diff --git a/secrets.nix b/secrets.nix index 3dc8491..d0a5ffb 100644 --- a/secrets.nix +++ b/secrets.nix @@ -5,6 +5,7 @@ let ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; in { "caddy-env.age".publicKeys = [ganymede]; + "tsnsrv-authkey.age".publicKeys = [ganymede mercury]; "williams-psk.age".publicKeys = [ganymede]; "github-ssh-key.age".publicKeys = [mercury jupiter]; } -- cgit v1.3.1 From c7e9ff3c853755cd3b0e8bc7443d55d222a06f80 Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Sun, 11 Jan 2026 08:03:03 -0600 Subject: clean up services/networking config even more --- hosts/ganymede/config.nix | 25 +++++++++++----------- modules/services/nixos/networking/default.nix | 17 +-------------- modules/services/nixos/networking/networkd.nix | 1 + modules/services/nixos/networking/resolved.nix | 17 +++++++++++++++ modules/services/nixos/selfhost/adguard.nix | 13 ++++++------ modules/services/nixos/selfhost/forgejo.nix | 10 ++++----- modules/services/nixos/selfhost/headscale.nix | 17 ++++++++++----- modules/services/options.nix | 29 ++++++++++++++++---------- 8 files changed, 73 insertions(+), 56 deletions(-) create mode 100644 modules/services/nixos/networking/resolved.nix (limited to 'hosts/ganymede/config.nix') diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 3adf620..0d3f15e 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -5,7 +5,10 @@ in { user.name = "collin"; secrets = { - "williams-psk".file = ./williams-psk.age; + "williams-psk" = { + file = ./williams-psk.age; + owner = "wpa_supplicant"; + }; "caddy-env".file = ./caddy-env.age; "tsnsrv-authkey".file = ./tsnsrv-authkey.age; }; @@ -40,28 +43,26 @@ in { }; sshd = { enable = true; - bind_host = tailscaleIP; + bind_host = "0.0.0.0"; }; }; selfhost = { - magic_caddy.enable = false; + caddy = { + enable = true; + envFile = config.collinux.secrets."caddy-env".path; + }; - # adguard = { - # enable = true; - # bind_host = tailscaleIP; - # }; forgejo = { enable = true; bind_host = tailscaleIP; + root_url = "ganymede.collinux.tailnet:8010"; }; + headscale = { enable = true; - root_url = "https://headscale.williamsfam.us.com"; - }; - caddy = { - enable = true; - envFile = config.collinux.secrets."caddy-env".path; + root_url = "headscale.williamsfam.us.com"; + caddy.enable = true; }; }; }; diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix index 62b9146..9fa56da 100644 --- a/modules/services/nixos/networking/default.nix +++ b/modules/services/nixos/networking/default.nix @@ -3,23 +3,8 @@ ./iwd.nix ./networkmanager.nix ./networkd.nix + ./resolved.nix ]; networking.firewall.enable = true; - - # DNS - services.resolved = { - enable = true; - dnsovertls = "opportunistic"; - dnssec = "allow-downgrade"; - fallbackDns = [ - "9.9.9.9#dns.quad9.net" - "149.112.112.112#dns.quad9.net" - ]; - - # disable extra stuff - llmnr = "false"; - extraConfig = "MulticastDNS=no"; - }; - networking.resolvconf.enable = false; } diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix index 470bcec..920b93f 100644 --- a/modules/services/nixos/networking/networkd.nix +++ b/modules/services/nixos/networking/networkd.nix @@ -29,6 +29,7 @@ in wait-online = { enable = true; ignoredInterfaces = ["docker0"]; + anyInterface = true; }; networks."11-static-lan" = { diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix new file mode 100644 index 0000000..b552095 --- /dev/null +++ b/modules/services/nixos/networking/resolved.nix @@ -0,0 +1,17 @@ +{ + networking.resolvconf.enable = false; + + services.resolved = { + enable = true; + dnsovertls = "opportunistic"; + dnssec = "allow-downgrade"; + fallbackDns = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + ]; + + # disable extra stuff + llmnr = "false"; + extraConfig = "MulticastDNS=no"; + }; +} diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix index 73c6caf..69fb8a4 100644 --- a/modules/services/nixos/selfhost/adguard.nix +++ b/modules/services/nixos/selfhost/adguard.nix @@ -32,17 +32,16 @@ in DNSStubListener=no ''; - services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable - && config.collinux.services.selfhost.magic_caddy.enable) { + services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups + + services.caddy = lib.mkIf cfg.caddy.enable { virtualHosts.${cfg.root_url}.extraConfig = '' ${ - if config.collinux.services.networking.tailscale.enable - then "bind tailscale/adguard" + if cfg.caddy.bind_tailscale + then "bind tailscale/${cfg.service_name}" else "" } - reverse_proxy localhost:${toString cfg.port} + reverse_proxy ${cfg.bind_host}:${toString cfg.port} ''; }; - - services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups } diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix index e499e64..4571dca 100644 --- a/modules/services/nixos/selfhost/forgejo.nix +++ b/modules/services/nixos/selfhost/forgejo.nix @@ -8,7 +8,7 @@ in lib.mkIf cfg.enable { services.forgejo = { enable = true; - database.type = "postgres"; + database.type = "sqlite3"; settings = { server = { DOMAIN = "localhost"; @@ -41,14 +41,14 @@ in wants = lib.mkAfter ["network-online.target"]; }; - services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable && config.collinux.services.selfhost.magic_caddy.enable) { + services.caddy = lib.mkIf cfg.caddy.enable { virtualHosts.${cfg.root_url}.extraConfig = '' ${ - if config.collinux.services.networking.tailscale.enable - then "bind tailscale/forgejo" + if cfg.caddy.bind_tailscale + then "bind tailscale/${cfg.service_name}" else "" } - reverse_proxy localhost:${toString cfg.port} + reverse_proxy ${cfg.bind_host}:${toString cfg.port} ''; }; } diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix index 9989742..2bdcca1 100644 --- a/modules/services/nixos/selfhost/headscale.nix +++ b/modules/services/nixos/selfhost/headscale.nix @@ -23,7 +23,7 @@ in address = cfg.bind_host; port = cfg.port; settings = { - server_url = cfg.root_url; + server_url = "https://${cfg.root_url}"; database.type = "sqlite"; @@ -60,9 +60,16 @@ in description = "Target represents headscale is running. started by headscale.service"; }; - services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable '' - reverse_proxy localhost:8080 - ''; - environment.systemPackages = [pkgs.headscale]; + + services.caddy = lib.mkIf cfg.caddy.enable { + virtualHosts.${cfg.root_url}.extraConfig = '' + ${ + if cfg.caddy.bind_tailscale + then "bind tailscale/${cfg.service_name}" + else "" + } + reverse_proxy ${cfg.bind_host}:${toString cfg.port} + ''; + }; } diff --git a/modules/services/options.nix b/modules/services/options.nix index 8be7c42..df8bc52 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -17,7 +17,7 @@ in { networkmanager.enable = mkEnableOption "heavier wifi daemon"; networkd = { - enable = mkEnableOption "set static IP (systemd-networkd)"; + enable = mkEnableOption "use systemd-networkd"; ssid = mkOption {type = lib.types.str;}; pskFile = mkOption {type = lib.types.str;}; @@ -61,9 +61,13 @@ in { selfhostOptions = { service_name, default_port ? null, - ... }: { - enable = mkEnableOption ""; + enable = mkEnableOption "${service_name} selfhosted service"; + + service_name = mkOption { + type = lib.types.str; + }; + bind_host = mkOption { type = ip_addr; default = "0.0.0.0"; @@ -72,29 +76,32 @@ in { type = lib.types.port; default = default_port; }; + root_url = mkOption { - type = lib.types.str; - default = with config.collinux.services.networking.tailscale; - if enable - then "http://${service_name}.${tailnet}" - else null; + type = lib.types.nullOr lib.types.str; + }; + + caddy = { + enable = mkEnableOption "Automatically create caddy configurations for this service"; + bind_tailscale = mkEnableOption "Bind the service to {service_name}.{tailnet}"; }; }; in { - magic_caddy.enable = mkEnableOption "Automatically create caddy configurations for services"; - adguard = selfhostOptions { service_name = "adguard"; default_port = 8001; }; + forgejo = selfhostOptions { service_name = "forgejo"; default_port = 8010; }; + headscale = selfhostOptions { service_name = "headscale"; default_port = 8080; }; + caddy = { enable = mkEnableOption "caddy https server"; envFile = mkOption { @@ -109,7 +116,7 @@ in { assertions = [ { assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable); - message = "only one networking method (iwd, networkmanager, static) can be active"; + message = "only one networking method (iwd, networkmanager, networkd) can be active"; } ]; }; -- cgit v1.3.1