From c9a1d2da80bca0a85e8c18f6d2db71c4d1127eda Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Thu, 29 Jan 2026 20:15:19 -0600
Subject: Spring Cleaning

- create new module, `system`, that consumes the `boot` module and takes
in the more system-interested services from the `services` module
- touch up left over services (which are more self-hosting interested)
- touch up yo and yoshi configs
---
 modules/services/nixos/adguard.nix                 | 40 +++++++++
 modules/services/nixos/audio.nix                   | 21 -----
 modules/services/nixos/bluetooth.nix               | 40 ---------
 modules/services/nixos/caddy.nix                   | 23 ++++++
 modules/services/nixos/default.nix                 | 13 +--
 modules/services/nixos/forgejo.nix                 | 48 +++++++++++
 modules/services/nixos/headscale.nix               | 69 ++++++++++++++++
 modules/services/nixos/jellyfin.nix                | 10 +++
 modules/services/nixos/mkCaddyCfg.nix              | 15 ++++
 modules/services/nixos/navidrome.nix               | 19 +++++
 modules/services/nixos/networking/default.nix      | 13 ---
 modules/services/nixos/networking/iwd.nix          | 27 ------
 modules/services/nixos/networking/networkd.nix     | 60 --------------
 .../services/nixos/networking/networkmanager.nix   | 20 -----
 modules/services/nixos/networking/resolved.nix     | 18 ----
 modules/services/nixos/openssh.nix                 | 96 ++++++++++++++++++++++
 modules/services/nixos/selfhost/adguard.nix        | 47 -----------
 modules/services/nixos/selfhost/caddy.nix          | 28 -------
 modules/services/nixos/selfhost/default.nix        |  8 --
 modules/services/nixos/selfhost/forgejo.nix        | 54 ------------
 modules/services/nixos/selfhost/headscale.nix      | 75 -----------------
 modules/services/nixos/selfhost/jellyfin.nix       | 20 -----
 modules/services/nixos/selfhost/navidrome.nix      | 19 -----
 modules/services/nixos/ssh.nix                     | 86 -------------------
 modules/services/nixos/tailscale.nix               | 34 --------
 25 files changed, 327 insertions(+), 576 deletions(-)
 create mode 100644 modules/services/nixos/adguard.nix
 delete mode 100644 modules/services/nixos/audio.nix
 delete mode 100644 modules/services/nixos/bluetooth.nix
 create mode 100644 modules/services/nixos/caddy.nix
 create mode 100644 modules/services/nixos/forgejo.nix
 create mode 100644 modules/services/nixos/headscale.nix
 create mode 100644 modules/services/nixos/jellyfin.nix
 create mode 100644 modules/services/nixos/mkCaddyCfg.nix
 create mode 100644 modules/services/nixos/navidrome.nix
 delete mode 100644 modules/services/nixos/networking/default.nix
 delete mode 100644 modules/services/nixos/networking/iwd.nix
 delete mode 100644 modules/services/nixos/networking/networkd.nix
 delete mode 100644 modules/services/nixos/networking/networkmanager.nix
 delete mode 100644 modules/services/nixos/networking/resolved.nix
 create mode 100644 modules/services/nixos/openssh.nix
 delete mode 100644 modules/services/nixos/selfhost/adguard.nix
 delete mode 100644 modules/services/nixos/selfhost/caddy.nix
 delete mode 100644 modules/services/nixos/selfhost/default.nix
 delete mode 100644 modules/services/nixos/selfhost/forgejo.nix
 delete mode 100644 modules/services/nixos/selfhost/headscale.nix
 delete mode 100644 modules/services/nixos/selfhost/jellyfin.nix
 delete mode 100644 modules/services/nixos/selfhost/navidrome.nix
 delete mode 100644 modules/services/nixos/ssh.nix
 delete mode 100644 modules/services/nixos/tailscale.nix

(limited to 'modules/services/nixos')

diff --git a/modules/services/nixos/adguard.nix b/modules/services/nixos/adguard.nix
new file mode 100644
index 0000000..f59934e
--- /dev/null
+++ b/modules/services/nixos/adguard.nix
@@ -0,0 +1,40 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.adguard;
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
+    services.adguardhome = {
+      enable = true;
+      port = cfg.port;
+      mutableSettings = true;
+      settings = {
+        http = {
+          pprof.enabled = false;
+          address = "localhost:${toString cfg.port}";
+        };
+        users = []; # disable auth (only accessable over tailscale anyway)
+        dns = {
+          bind_hosts = ["127.0.0.1" cfg.bind_host];
+          upstream_dns = ["https://dns.quad9.net/dns-query"];
+          enable_dnssec = true;
+        };
+        tls.enabled = false;
+        dhcp.enabled = false;
+      };
+    };
+
+    # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
+    services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
+      DNS=127.0.0.1
+      DNSStubListener=no
+    '';
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+  };
+}
diff --git a/modules/services/nixos/audio.nix b/modules/services/nixos/audio.nix
deleted file mode 100644
index 9de6787..0000000
--- a/modules/services/nixos/audio.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.audio;
-in
-  lib.mkIf cfg.enable {
-    security.rtkit.enable = true;
-    services.pipewire = {
-      enable = true;
-      wireplumber.enable = true;
-      alsa.enable = true;
-      pulse.enable = false;
-    };
-
-    boot.blacklistedKernelModules = ["snd_seq_dummy"]; # remove extraneous alsa midi devices
-
-    environment.systemPackages = with pkgs; [pwvucontrol qpwgraph];
-  }
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
deleted file mode 100644
index acf628c..0000000
--- a/modules/services/nixos/bluetooth.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.bluetooth;
-in
-  lib.mkIf cfg.enable {
-    hardware.bluetooth = {
-      enable = true;
-      powerOnBoot = true;
-
-      settings.General = {
-        FastConnectable = true;
-        ControllerMode = "bredr";
-        JustWorksRepairing = "always";
-      };
-    };
-
-    systemd.user.services."mpris-proxy" = {
-      unitConfig = {
-        BindsTo = ["bluetooth.target"];
-        After = ["bluetooth.target"];
-      };
-
-      wantedBy = ["bluetooth.target"];
-
-      # serviceConfig already exists (?)
-    };
-
-    # hardening (down to 2.1 OK)
-    systemd.services."bluetooth".serviceConfig = {
-      IPAddressDeny = "any";
-      ProtectKernelLogs = true;
-      ProtectKernelModules = lib.mkForce true;
-      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
-      ProtectClock = true;
-      ProcSubset = "pid";
-    };
-  }
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
new file mode 100644
index 0000000..06f040c
--- /dev/null
+++ b/modules/services/nixos/caddy.nix
@@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.services.caddy;
+in
+  lib.mkIf cfg.enable {
+    services.caddy = {
+      # just always install this. No harm in installing an extra plugin
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
+        ];
+        hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
+      };
+      enable = true;
+      environmentFile = cfg.envFile;
+    };
+    networking.firewall.allowedTCPPorts = [80 443];
+    environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
+  }
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 9c95180..234a712 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -1,10 +1,11 @@
 {
   imports = [
-    ./networking
-    ./audio.nix
-    ./bluetooth.nix
-    ./tailscale.nix
-    ./selfhost
-    ./ssh.nix
+    # ./navidrome.nix
+    ./headscale.nix
+    ./forgejo.nix
+    ./openssh.nix
+    # ./jellyfin.nix
+    ./caddy.nix
+    ./adguard.nix
   ];
 }
diff --git a/modules/services/nixos/forgejo.nix b/modules/services/nixos/forgejo.nix
new file mode 100644
index 0000000..5c98633
--- /dev/null
+++ b/modules/services/nixos/forgejo.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.services.forgejo;
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
+    services.forgejo = {
+      enable = true;
+      database.type = "sqlite3";
+      settings = {
+        server = {
+          DOMAIN = "localhost";
+          ROOT_URL = cfg.root_url;
+          HTTP_PORT = cfg.port;
+
+          # ssh
+          START_SSH_SERVER = true; # use builtin ssh server
+          BUILTIN_SSH_SERVER_USER = "git";
+          SSH_DOMAIN = cfg.root_url or "ganymede";
+          SSH_PORT = cfg.git_ssh_port; # don't conflict with system ssh
+          SSH_LISTEN_HOST = cfg.bind_host;
+          SSH_LISTEN_PORT = cfg.git_ssh_port;
+        };
+        service = {
+          DISABLE_REGISTRATION = false;
+          ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
+        };
+        repository = {
+          # disable stuff
+          DISABLE_MIGRATIONS = true;
+          DISABLE_STARS = true;
+          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
+        };
+      };
+    };
+
+    systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+  };
+}
diff --git a/modules/services/nixos/headscale.nix b/modules/services/nixos/headscale.nix
new file mode 100644
index 0000000..51d3da5
--- /dev/null
+++ b/modules/services/nixos/headscale.nix
@@ -0,0 +1,69 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.headscale;
+
+  acl_file = (pkgs.formats.json {}).generate "acl.json" {
+    ssh = [
+      {
+        src = ["collin@"];
+        dst = ["collin@"];
+        users = ["autogroup:nonroot" "root"];
+        action = "accept";
+      }
+    ];
+  };
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
+    services.headscale = {
+      enable = true;
+      address = cfg.bind_host;
+      port = cfg.port;
+      settings = {
+        server_url = "https://${cfg.root_url}";
+
+        database.type = "sqlite";
+
+        dns = {
+          magic_dns = true;
+          base_domain = "collinux.tailnet";
+          override_local_dns = true;
+          nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
+        };
+
+        policy.path = acl_file;
+
+        prefixes = {
+          "v4" = "100.100.0.0/16";
+          allocation = "random";
+        };
+
+        # leave tls for caddy to worry about
+        tls_cert_path = null;
+        tls_key_path = null;
+
+        logtail.enabled = false;
+      };
+    };
+
+    # make sure headscale can start before tailscale
+    systemd.services."headscale" = lib.mkIf config.collinux.system.networking.tailscale.enable {
+      after = lib.mkForce ["network.target"];
+      before = lib.mkForce ["headscale.target"];
+      wants = lib.mkForce ["network.target" "headscale.target"];
+    };
+
+    systemd.targets."headscale" = {
+      description = "Target represents headscale is running. started by headscale.service";
+    };
+
+    environment.systemPackages = [pkgs.headscale];
+  };
+}
diff --git a/modules/services/nixos/jellyfin.nix b/modules/services/nixos/jellyfin.nix
new file mode 100644
index 0000000..65193f2
--- /dev/null
+++ b/modules/services/nixos/jellyfin.nix
@@ -0,0 +1,10 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.jellyfin;
+in
+  lib.mkIf cfg.enable {
+    services.jellyfin.enable = true;
+  }
diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix
new file mode 100644
index 0000000..bb2e06d
--- /dev/null
+++ b/modules/services/nixos/mkCaddyCfg.nix
@@ -0,0 +1,15 @@
+cfg: {
+  services.caddy =
+    if cfg.caddy.enable
+    then {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
+          else ""
+        }
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+      '';
+    }
+    else {};
+}
diff --git a/modules/services/nixos/navidrome.nix b/modules/services/nixos/navidrome.nix
new file mode 100644
index 0000000..5250b85
--- /dev/null
+++ b/modules/services/nixos/navidrome.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.navidrome;
+in
+  lib.mkIf cfg.enable {
+    services.navidrome = {
+      enable = true;
+      inherit (cfg) user;
+      settings = {
+        Port = 4533;
+        Address = "0.0.0.0";
+        EnableInsightsCollector = false;
+        MusicFolder = "/home/${cfg.user}/Music";
+      };
+    };
+  }
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
deleted file mode 100644
index a042411..0000000
--- a/modules/services/nixos/networking/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  imports = [
-    ./iwd.nix
-    ./networkmanager.nix
-    ./networkd.nix
-    ./resolved.nix
-  ];
-
-  networking.firewall = {
-    enable = true;
-    checkReversePath = "loose";
-  };
-}
diff --git a/modules/services/nixos/networking/iwd.nix b/modules/services/nixos/networking/iwd.nix
deleted file mode 100644
index db5cc2e..0000000
--- a/modules/services/nixos/networking/iwd.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.networking.iwd;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      wireless.iwd = {
-        enable = true;
-        settings = {
-          General = {
-            EnableNetworkConfiguration = !config.collinux.services.networking.networkd.enable;
-            AddressRandomization = "once";
-            AddressRandomizationRange = "full";
-          };
-          Network.NameResolvingService = "systemd"; # either systemd or resolvconf
-        };
-      };
-
-      # Disable default networking stuff
-      dhcpcd.enable = false;
-      useDHCP = false;
-      networkmanager.enable = false;
-    };
-  }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
deleted file mode 100644
index e84fd2f..0000000
--- a/modules/services/nixos/networking/networkd.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.networking.networkd;
-
-  dhcp_enabled = cfg.static == null;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      wireless =
-        if !config.collinux.services.networking.iwd.enable
-        then {
-          enable = true;
-          networks.${cfg.ssid}.pskRaw = "ext:psk";
-          secretsFile = cfg.pskFile;
-        }
-        else {};
-
-      useNetworkd = true;
-
-      # Disable default networking stuff
-      dhcpcd.enable = false;
-      useDHCP = false;
-      networkmanager.enable = false;
-    };
-
-    systemd.network = {
-      enable = true;
-
-      wait-online = {
-        enable = true;
-        ignoredInterfaces = ["docker0"];
-        anyInterface = true;
-      };
-
-      networks."11-lan" = {
-        name = "wl*";
-
-        networkConfig =
-          (
-            if dhcp_enabled
-            then {DHCP = "yes";}
-            else {
-              Address = cfg.static.ip;
-              Gateway = cfg.static.gateway;
-              DHCP = "no";
-              # DNS is managed by systemd-resolved (not specified here)
-            }
-          )
-          // {
-            LinkLocalAddressing = "no";
-          };
-
-        dhcpV4Config.UseDNS = "no";
-        dhcpV6Config.UseDNS = "no";
-      };
-    };
-  }
diff --git a/modules/services/nixos/networking/networkmanager.nix b/modules/services/nixos/networking/networkmanager.nix
deleted file mode 100644
index e032bd0..0000000
--- a/modules/services/nixos/networking/networkmanager.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.networking.networkmanager;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      networkmanager = {
-        enable = true;
-        dns = "systemd-resolved";
-        dhcp = "internal";
-      };
-
-      dhcpcd.enable = false;
-    };
-
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=true";
-  }
diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix
deleted file mode 100644
index 03333b1..0000000
--- a/modules/services/nixos/networking/resolved.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  networking.resolvconf.enable = false;
-
-  networking.nameservers = [
-    "9.9.9.9#dns.quad9.net"
-    "149.112.112.112#dns.quad9.net"
-  ];
-
-  services.resolved = {
-    enable = true;
-    dnsovertls = "opportunistic";
-    dnssec = "allow-downgrade";
-
-    # disable extra stuff
-    llmnr = "false";
-    extraConfig = "MulticastDNS=no";
-  };
-}
diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
new file mode 100644
index 0000000..c0c8c30
--- /dev/null
+++ b/modules/services/nixos/openssh.nix
@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  hosts,
+  ...
+}: let
+  cfg = config.collinux.services.sshd;
+
+  anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x);
+  anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x);
+
+  authorizedKeys =
+    hosts
+    |> builtins.mapAttrs (_: data: data.user_pubkey or null)
+    |> builtins.attrValues
+    |> builtins.filter (x: x != null);
+in {
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port);
+
+    services.openssh = {
+      enable = true;
+      allowSFTP = false;
+
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
+
+      listenAddresses =
+        cfg.portConfig
+        |> builtins.map (x: {
+          addr = "0.0.0.0";
+          port = x.port;
+        });
+
+      # Lock down everything by default
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        PubkeyAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        AllowAgentForwarding = false;
+      };
+
+      extraConfig =
+        cfg.portConfig
+        |> builtins.map (x:
+          lib.concatStringsSep "\n" [
+            "Match LocalPort ${toString x.port}"
+            (
+              if x.otp
+              then ''
+                ChallengeResponseAuthentication yes
+                PubkeyAuthentication yes
+                KbdInteractiveAuthentication yes
+                AuthenticationMethods publickey,keyboard-interactive:pam
+              ''
+              else ''
+                PubkeyAuthentication yes
+                AuthenticationMethods publickey
+              ''
+            )
+            (lib.optionalString x.rootLogin "PermitRootLogin yes")
+          ])
+        |> lib.concatStringsSep "\n\n";
+    };
+
+    security.pam.services = lib.optionalAttrs anyOTP {
+      login.googleAuthenticator.enable = true;
+
+      sshd.text = ''
+        account required pam_unix.so
+
+        auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp
+        auth sufficient pam_permit.so
+
+        session required pam_env.so conffile=/etc/pam/environment readenv=0
+        session required pam_unix.so
+        session required pam_loginuid.so
+        session optional ${pkgs.systemd}/lib/security/pam_systemd.so
+      '';
+    };
+
+    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
+    users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys;
+
+    systemd.services."openssh" = {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+  };
+}
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
deleted file mode 100644
index 69fb8a4..0000000
--- a/modules/services/nixos/selfhost/adguard.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.adguard;
-in
-  lib.mkIf cfg.enable {
-    services.adguardhome = {
-      enable = true;
-      port = cfg.port;
-      mutableSettings = true;
-      settings = {
-        http = {
-          pprof.enabled = false;
-          address = "localhost:${toString cfg.port}";
-        };
-        users = []; # disable auth (only accessable over tailscale anyway)
-        dns = {
-          bind_hosts = ["127.0.0.1" cfg.bind_host];
-          upstream_dns = ["https://dns.quad9.net/dns-query"];
-          enable_dnssec = true;
-        };
-        tls.enabled = false;
-        dhcp.enabled = false;
-      };
-    };
-
-    # disable systemd-resolved (https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse)
-    services.resolved.extraConfig = lib.mkIf config.services.resolved.enable ''
-      DNS=127.0.0.1
-      DNSStubListener=no
-    '';
-
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
-
-    services.caddy = lib.mkIf cfg.caddy.enable {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    };
-  }
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
deleted file mode 100644
index f625f62..0000000
--- a/modules/services/nixos/selfhost/caddy.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.caddy;
-in
-  lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      services.caddy = {
-        enable = true;
-        environmentFile = cfg.envFile;
-      };
-      networking.firewall.allowedTCPPorts = [80 443];
-      environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
-    }
-    (lib.mkIf config.collinux.services.networking.tailscale.enable {
-      services.caddy = {
-        package = pkgs.caddy.withPlugins {
-          plugins = [
-            "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
-          ];
-          hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
-        };
-      };
-    })
-  ])
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
deleted file mode 100644
index de1078b..0000000
--- a/modules/services/nixos/selfhost/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  imports = [
-    ./adguard.nix
-    ./forgejo.nix
-    ./headscale.nix
-    ./caddy.nix
-  ];
-}
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
deleted file mode 100644
index 1b02628..0000000
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.forgejo;
-in
-  lib.mkIf cfg.enable {
-    services.forgejo = {
-      enable = true;
-      database.type = "sqlite3";
-      settings = {
-        server = {
-          DOMAIN = "localhost";
-          ROOT_URL = cfg.root_url;
-          HTTP_PORT = cfg.port;
-
-          # ssh
-          START_SSH_SERVER = true; # use builtin ssh server
-          BUILTIN_SSH_SERVER_USER = "git";
-          SSH_DOMAIN = "ganymede";
-          SSH_PORT = 2225; # don't conflict with system ssh
-          SSH_LISTEN_HOST = cfg.bind_host;
-          SSH_LISTEN_PORT = 2225;
-        };
-        service = {
-          DISABLE_REGISTRATION = false;
-          ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
-        };
-        repository = {
-          # disable stuff
-          DISABLE_MIGRATIONS = true;
-          DISABLE_STARS = true;
-          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
-        };
-      };
-    };
-
-    systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
-      after = lib.mkAfter ["network-online.target"];
-      wants = lib.mkAfter ["network-online.target"];
-    };
-
-    services.caddy = lib.mkIf cfg.caddy.enable {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    };
-  }
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
deleted file mode 100644
index 2bdcca1..0000000
--- a/modules/services/nixos/selfhost/headscale.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.headscale;
-
-  acl_file = (pkgs.formats.json {}).generate "acl.json" {
-    ssh = [
-      {
-        src = ["collin@"];
-        dst = ["collin@"];
-        users = ["autogroup:nonroot" "root"];
-        action = "accept";
-      }
-    ];
-  };
-in
-  lib.mkIf cfg.enable {
-    services.headscale = {
-      enable = true;
-      address = cfg.bind_host;
-      port = cfg.port;
-      settings = {
-        server_url = "https://${cfg.root_url}";
-
-        database.type = "sqlite";
-
-        dns = {
-          magic_dns = true;
-          base_domain = "collinux.tailnet";
-          override_local_dns = true;
-          nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
-        };
-
-        policy.path = "${acl_file}";
-
-        prefixes = {
-          "v4" = "100.100.0.0/16";
-          allocation = "random";
-        };
-
-        # leave tls for caddy to worry about
-        tls_cert_path = null;
-        tls_key_path = null;
-
-        logtail.enabled = false;
-      };
-    };
-
-    # make sure headscale can start before tailscale
-    systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
-      after = lib.mkForce ["network.target"];
-      before = lib.mkForce ["headscale.target"];
-      wants = lib.mkForce ["network.target" "headscale.target"];
-    };
-
-    systemd.targets."headscale" = {
-      description = "Target represents headscale is running. started by headscale.service";
-    };
-
-    environment.systemPackages = [pkgs.headscale];
-
-    services.caddy = lib.mkIf cfg.caddy.enable {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    };
-  }
diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix
deleted file mode 100644
index 59ea473..0000000
--- a/modules/services/nixos/selfhost/jellyfin.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.jellyfin;
-in
-  lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      services.jellyfin = {
-        enable = true;
-      };
-    }
-    # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) {
-    #   services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = ''
-    #     bind tailscale/jellyfin
-    #     reverse_proxy localhost:${config.services.jellyfin.port}
-    #   '';
-    # })
-  ])
diff --git a/modules/services/nixos/selfhost/navidrome.nix b/modules/services/nixos/selfhost/navidrome.nix
deleted file mode 100644
index 5250b85..0000000
--- a/modules/services/nixos/selfhost/navidrome.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.navidrome;
-in
-  lib.mkIf cfg.enable {
-    services.navidrome = {
-      enable = true;
-      inherit (cfg) user;
-      settings = {
-        Port = 4533;
-        Address = "0.0.0.0";
-        EnableInsightsCollector = false;
-        MusicFolder = "/home/${cfg.user}/Music";
-      };
-    };
-  }
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
deleted file mode 100644
index fa8b2ef..0000000
--- a/modules/services/nixos/ssh.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  hosts,
-  ...
-}: let
-  cfg = config.collinux.services.networking.sshd;
-in {
-  config = lib.mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [2222]; # only on local network
-
-    services.openssh = {
-      enable = true;
-
-      allowSFTP = false;
-
-      hostKeys = [
-        {
-          path = "/etc/ssh/ssh_host_ed25519_key";
-          type = "ed25519";
-        }
-      ];
-
-      listenAddresses = [
-        {
-          addr = cfg.bind_host;
-          port = 22;
-        }
-        {
-          addr = cfg.bind_host;
-          port = 2222;
-        }
-      ];
-
-      settings = {
-        PermitRootLogin = "no";
-        PasswordAuthentication = false;
-        PubkeyAuthentication = true;
-        KbdInteractiveAuthentication = true; # for google authenticator totp codes
-        AuthenticationMethods = "publickey,keyboard-interactive:pam";
-      };
-
-      extraConfig = ''
-        Match LocalPort 2222
-          AuthenticationMethods publickey
-          PermitRootLogin prohibit-password
-      '';
-    };
-
-    security.pam.services = {
-      login.googleAuthenticator.enable = true;
-
-      sshd.text = ''
-        account required pam_unix.so # unix (order 10900)
-
-        auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp # google_authenticator (order 12500)
-        auth sufficient pam_permit.so
-
-        session required pam_env.so conffile=/etc/pam/environment readenv=0 # env (order 10100)
-        session required pam_unix.so # unix (order 10200)
-        session required pam_loginuid.so # loginuid (order 10300)
-        session optional ${pkgs.systemd}/lib/security/pam_systemd.so # systemd (order 12000)
-      '';
-    };
-
-    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys =
-      hosts
-      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
-      |> builtins.attrValues
-      |> (builtins.filter (x: x != null));
-
-    users.users."root".openssh.authorizedKeys.keys =
-      hosts
-      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
-      |> builtins.attrValues
-      |> (builtins.filter (x: x != null)); # only possible over home network (:2222)
-
-    systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
-      after = lib.mkAfter ["network-online.target"];
-      wants = lib.mkAfter ["network-online.target"];
-    };
-
-    services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
-  };
-}
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
deleted file mode 100644
index 50e35d3..0000000
--- a/modules/services/nixos/tailscale.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.networking.tailscale;
-in
-  lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
-    };
-
-    networking.firewall = {
-      checkReversePath = "loose";
-      trustedInterfaces = ["tailscale0"];
-      allowedUDPPorts = [config.services.tailscale.port];
-    };
-
-    # don't start tailscale until after headscale starts
-    systemd.services."tailscaled" =
-      if config.collinux.services.selfhost.headscale.enable
-      then {
-        wants = lib.mkForce ["network.target" "headscale.target"];
-        after = lib.mkForce ["network.target" "headscale.target"];
-      }
-      else {
-        wants = lib.mkForce ["network.target"];
-        after = lib.mkForce ["network.target"];
-      };
-
-    environment.systemPackages = [pkgs.tailscale];
-  }
-- 
cgit v1.3.1