From e29dd8a2283399b7e046937340509d5aec4b52ba Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Wed, 29 Jul 2026 06:54:49 -0500
Subject: changes

---
 modules/services/nixos/btopweb.nix      |   7 +-
 modules/services/nixos/caddy.nix        |   4 +-
 modules/services/nixos/cgit/default.nix |   5 ++
 modules/services/nixos/default.nix      |   1 +
 modules/services/nixos/filebrowser.nix  |  52 +++++++++++
 modules/services/nixos/glance.nix       |  32 +------
 modules/services/nixos/goaccess.nix     |   7 +-
 modules/services/nixos/minecraft.nix    |   8 +-
 modules/services/nixos/ngircd.nix       |   8 +-
 modules/services/nixos/openssh.nix      |   9 +-
 modules/services/nixos/qbittorrent.nix  |  11 ++-
 modules/services/options.nix            | 153 ++++++++++----------------------
 12 files changed, 141 insertions(+), 156 deletions(-)
 create mode 100644 modules/services/nixos/filebrowser.nix

(limited to 'modules/services')

diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix
index d8f4598..75498a9 100644
--- a/modules/services/nixos/btopweb.nix
+++ b/modules/services/nixos/btopweb.nix
@@ -33,7 +33,7 @@ in {
         User = "btopweb";
         Type = "simple";
 
-        ExecStart = ''${pkgs.ttyd}/bin/ttyd -W -i ${cfg.listenAddr} -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
+        ExecStart = ''${lib.getExe pkgs.ttyd} -W -i 127.0.0.1 -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
       };
     };
 
@@ -41,5 +41,10 @@ in {
       tls internal
       reverse_proxy 127.0.0.1:${toString cfg.port}
     '';
+
+    collinux.services.glance.homelabServices."btop" = {
+      url = "https://btop.ganymede";
+      icon = "si:htop";
+    };
   };
 }
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
index b61a3c6..4b41c76 100644
--- a/modules/services/nixos/caddy.nix
+++ b/modules/services/nixos/caddy.nix
@@ -7,8 +7,10 @@
   cfg = config.collinux.services.caddy;
 in
   lib.mkIf cfg.enable {
+    users.users."caddy".extraGroups = ["fileserver"];
     networking.firewall.allowedTCPPorts = [80 443];
-    environment.systemPackages = with pkgs; [nss.tools]; # required for caddy https stuff
+    environment.systemPackages = [pkgs.nss.tools]; # required for caddy https stuff
+
     services.caddy = {
       enable = true;
       environmentFile = cfg.envFile;
diff --git a/modules/services/nixos/cgit/default.nix b/modules/services/nixos/cgit/default.nix
index 2a78607..4f0a7ba 100644
--- a/modules/services/nixos/cgit/default.nix
+++ b/modules/services/nixos/cgit/default.nix
@@ -96,5 +96,10 @@ in {
       	}
       }
     '';
+
+    collinux.services.glance.homelabServices."git" = {
+      url = "https://git.ganymede";
+      icon = "si:git";
+    };
   };
 }
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 65315cf..fa74cf6 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -9,6 +9,7 @@
     ./ganyupload
     ./jta
     ./glance.nix
+    ./filebrowser.nix
 
     ./minecraft.nix
     ./ngircd.nix
diff --git a/modules/services/nixos/filebrowser.nix b/modules/services/nixos/filebrowser.nix
new file mode 100644
index 0000000..df0d536
--- /dev/null
+++ b/modules/services/nixos/filebrowser.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: let
+  cfg = config.collinux.services.filebrowser;
+in
+  lib.mkIf cfg.enable {
+    users.groups."dufs" = {};
+    users.users."dufs" = {
+      isSystemUser = true;
+      group = "dufs";
+      extraGroups = ["fileserver"];
+    };
+
+    systemd.services."dufs" = {
+      description = "dufs file server";
+      restartIfChanged = true;
+      wants = ["network-online.target"];
+      after = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        # ExecStart = "${pkgs.dufs}/bin/dufs /media --port ${toString cfg.port}";
+        ExecStart = "${lib.getExe pkgs.dufs} /media --bind /run/dufs/dufs.sock";
+
+        RuntimeDirectory = "dufs"; # /run/dufs
+
+        User = "dufs";
+        Group = "dufs";
+
+        # Hardening
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        NoNewPrivileges = true;
+
+        Restart = "on-failure";
+      };
+    };
+
+    services.caddy.virtualHosts."files.ganymede".extraConfig = ''
+      tls internal
+      reverse_proxy unix//run/dufs/dufs.sock
+    '';
+
+    collinux.services.glance.homelabServices."files" = {
+      url = "https://files.ganymede";
+      icon = "si:folder";
+    };
+  }
diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix
index 1396562..38e5e1d 100644
--- a/modules/services/nixos/glance.nix
+++ b/modules/services/nixos/glance.nix
@@ -8,6 +8,8 @@
 
   pure = x: [x];
 
+  servicesLinks = builtins.attrValues cfg.homelabServices;
+
   settings = {
     server = {
       inherit (cfg) port;
@@ -68,33 +70,7 @@
             type = "monitor";
             cache = "1m";
             title = "Services";
-            sites = [
-              {
-                title = "stats";
-                url = "https://stats.ganymede";
-                icon = "mdi:poll";
-              }
-              {
-                title = "btop";
-                url = "https://btop.ganymede";
-                icon = "si:htop";
-              }
-              {
-                title = "git";
-                url = "https://git.ganymede";
-                icon = "si:git";
-              }
-              {
-                title = "bittorrent";
-                url = "https://bittorrent.ganymede";
-                icon = "si:qbittorrent";
-              }
-              {
-                title = "website";
-                url = "https://williamsfam.us.com";
-                icon = "mdi:web";
-              }
-            ];
+            sites = servicesLinks;
           }
         ];
       };
@@ -117,6 +93,7 @@ in {
       restartIfChanged = true;
       wants = ["network-online.target"];
       after = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
 
       serviceConfig = {
         User = "glance";
@@ -138,7 +115,6 @@ in {
 
     services.caddy.virtualHosts."home.ganymede".extraConfig = ''
       tls internal
-
       reverse_proxy 127.0.0.1:${toString cfg.port}
     '';
   };
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
index b77f370..288428d 100644
--- a/modules/services/nixos/goaccess.nix
+++ b/modules/services/nixos/goaccess.nix
@@ -16,7 +16,7 @@
 
     ws-url = "wss://stats.ganymede:443/ws";
     port = cfg.port;
-    addr = cfg.listenAddr;
+    addr = "127.0.0.1";
 
     real-time-html = "true";
     output = "/var/www/goaccess/index.html";
@@ -80,5 +80,10 @@ in {
 
       reverse_proxy /ws 127.0.0.1:${toString cfg.port}
     '';
+
+    collinux.services.glance.homelabServices."stats" = {
+      url = "https://stats.ganymede";
+      icon = "mdi:poll";
+    };
   };
 }
diff --git a/modules/services/nixos/minecraft.nix b/modules/services/nixos/minecraft.nix
index 45af606..0209549 100644
--- a/modules/services/nixos/minecraft.nix
+++ b/modules/services/nixos/minecraft.nix
@@ -6,7 +6,7 @@
   cfg = config.collinux.services.minecraft;
 in
   lib.mkIf cfg.enable {
-    networking.firewall.allowedUDPPorts = lib.optional cfg.public cfg.port;
+    networking.firewall.allowedUDPPorts = [cfg.port];
 
     virtualisation.oci-containers.containers."Minecraft" = {
       environment = {
@@ -23,11 +23,7 @@ in
       };
       image = "itzg/minecraft-bedrock-server";
       ports = [
-        "${
-          if cfg.public
-          then "0.0.0.0"
-          else "127.0.0.1"
-        }:${toString cfg.port}:19132/udp"
+        "0.0.0.0:${toString cfg.port}:19132/udp"
       ];
       volumes = ["/var/lib/minecraft/:/data"];
 
diff --git a/modules/services/nixos/ngircd.nix b/modules/services/nixos/ngircd.nix
index ac93f06..d06a497 100644
--- a/modules/services/nixos/ngircd.nix
+++ b/modules/services/nixos/ngircd.nix
@@ -6,7 +6,7 @@
   cfg = config.collinux.services.ngircd;
 in
   lib.mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = lib.optional cfg.public cfg.port;
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     services.ngircd = {
       enable = true;
@@ -16,11 +16,7 @@ in
           Info = Ganymede IRC Chat
           AdminInfo1 = Collin
 
-          Listen = ${
-          if cfg.public
-          then "0.0.0.0"
-          else "127.0.0.1"
-        }
+          Listen = 0.0.0.0
           Ports = ${toString cfg.port}
 
         [Channel]
diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
index 1d7834b..4826369 100644
--- a/modules/services/nixos/openssh.nix
+++ b/modules/services/nixos/openssh.nix
@@ -5,7 +5,6 @@
   ...
 }: let
   cfg = config.collinux.services.sshd;
-
   pure = x: [x];
 
   authorizedKeys =
@@ -30,11 +29,7 @@ in {
       };
 
       settings = {
-        PermitRootLogin =
-          if cfg.conf.rootLogin
-          then "yes"
-          else "no";
-
+        PermitRootLogin = "yes";
         PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
         PubkeyAuthentication = true;
@@ -43,7 +38,7 @@ in {
 
     users.users = {
       ${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
-      root.openssh.authorizedKeys.keys = lib.mkIf cfg.conf.rootLogin authorizedKeys;
+      root.openssh.authorizedKeys.keys = authorizedKeys;
     };
 
     systemd.services.openssh = {
diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix
index cc147b1..fe2831a 100644
--- a/modules/services/nixos/qbittorrent.nix
+++ b/modules/services/nixos/qbittorrent.nix
@@ -11,8 +11,10 @@ in {
       extraGroups = ["fileserver"]; # torrent files go to /media/library
     };
 
-    networking.firewall.allowedTCPPorts = [49252];
-    networking.firewall.allowedUDPPorts = [49252];
+    networking.firewall = {
+      allowedTCPPorts = [49252];
+      allowedUDPPorts = [49252];
+    };
 
     services.qbittorrent = {
       enable = true;
@@ -25,5 +27,10 @@ in {
       tls internal
       reverse_proxy 127.0.0.1:${toString cfg.port}
     '';
+
+    collinux.services.glance.homelabServices."bittorrent" = {
+      url = "https://bittorrent.ganymede";
+      icon = "si:qbittorrent";
+    };
   };
 }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 7dbaa2c..0e033be 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -1,117 +1,62 @@
-{
-  lib,
-  my-lib,
-  ...
-}: let
+{lib, ...}: let
   inherit (lib) mkOption mkEnableOption types;
-  inherit (my-lib.netTypes {inherit lib;}) ipAddr;
 
-  # A helper function to generate the submodule
-  webserviceOptions = {
-    service_name,
-    reverse_proxy ? true,
-  }:
-    {
-      enable = mkEnableOption "${service_name} selfhosted service";
-      listenAddr = mkOption {
-        description = "The IP address on which ${service_name} will listen for incoming connections";
-        type = ipAddr;
-        default = "127.0.0.1";
-      };
-      privateUrl = mkOption {
-        description = "Internal .local name for the service. Don't put the protocol (https://) in the string";
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-      };
-      publicUrl = mkOption {
-        description = "Public website on which the service will be hosted. Don't put the protocol (https://) in the string";
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-      };
-    }
-    // (
-      if reverse_proxy
-      then {
-        reverseProxy = mkOption {
-          internal = true;
-          type = lib.types.bool;
-          default = true;
-        };
-        port = mkOption {
-          description = "The port on which ${service_name} will listen for incomming connections";
-          type = lib.types.port;
-        };
-      }
-      else {
-        manualCaddyConfig = mkOption {
-          description = "Configuration to describe this service in caddy, since reverse_proxy = false.";
-          type = lib.types.str;
-        };
-      }
-    );
+  basicService = {
+    desc,
+    default_port ? null,
+  }: {
+    enable = mkEnableOption desc;
+    port = mkOption {
+      type = lib.types.port;
+      default = default_port;
+    };
+  };
 in {
   options.collinux.services = {
-    sshd = {
-      enable = mkEnableOption "OpenSSH server";
-      port = mkOption {
-        description = "Port to run on";
-        type = lib.types.port;
-        default = 22;
-      };
-      public = mkEnableOption "whether to make this service accessable over the internet";
-
-      conf = {
-        otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes to login";
-        rootLogin = mkEnableOption "Whether to allow root login";
-      };
+    sshd = basicService {
+      desc = "OpenSSH server";
+      default_port = 22;
     };
-    minecraft = {
-      enable = mkEnableOption "Minecraft bedrock server";
-      port = mkOption {
-        description = "port to run on";
-        type = lib.types.port;
-        default = 19132;
-      };
 
-      public = mkEnableOption "whether to make this service accessable over the internet";
-    };
-    ngircd = {
-      enable = mkEnableOption "ngircd IRC server";
-      port = mkOption {
-        type = lib.types.port;
-        default = 6667;
-      };
+    jta = basicService {desc = "personal project";};
+    ganyupload = basicService {desc = "anonymous file uploads";};
+    btopweb = basicService {desc = "btop accessable in a browser tab";};
 
-      public = mkEnableOption "whether to make this service accessable over the internet";
-    };
+    forgejo = basicService {desc = "Self-hosted git forge";};
+    qbittorrent = basicService {desc = "webui for qBittorrent";};
+    goaccess = basicService {desc = "webserver stats from caddy logs";};
+    filebrowser = basicService {desc = "dufs file browser";};
+    cgit.enable = mkEnableOption "cgit git webui";
 
-    jta = webserviceOptions {
-      service_name = "jta";
-    };
-    ganyupload = webserviceOptions {
-      service_name = "ganyupload";
-    };
-    forgejo = webserviceOptions {
-      service_name = "forgejo";
-    };
-    btopweb = webserviceOptions {
-      service_name = "btopweb";
-    };
-    goaccess = webserviceOptions {
-      service_name = "goaccess";
-    };
-    glance = {
-      enable = mkEnableOption "Glance homepage";
-      port = lib.mkOption {
-        type = lib.types.port;
+    glance =
+      (basicService {desc = "Glance homepage";})
+      // {
+        homelabServices = lib.mkOption {
+          type = lib.types.attrsOf (lib.types.submodule ({config, ...}: {
+            options = {
+              title = lib.mkOption {
+                type = lib.types.str;
+                default = config._module.args.name;
+              };
+              url = lib.mkOption {
+                type = lib.types.str;
+              };
+              icon = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+              };
+            };
+          }));
+        };
       };
+
+    minecraft = basicService {
+      desc = "Minecraft bedrock server";
+      default_port = 19132;
     };
-    cgit = webserviceOptions {
-      service_name = "cgit";
-      reverse_proxy = false;
-    };
-    qbittorrent = webserviceOptions {
-      service_name = "qbittorrent";
+    ngircd = basicService {
+      desc = "ngircd IRC server";
+      default_port = 6667;
     };
 
     caddy = {
-- 
cgit v1.3.1