From bc81e75bead05fdf2cb6aaf3fec6e933ce8feb1a Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Sat, 22 Aug 2026 12:42:46 -0500 Subject: everything is working now --- modules/desktop/nixos/programs/firefox.nix | 7 +- modules/services/nixos/btopweb.nix | 17 ++++- modules/services/nixos/caddy.nix | 1 - modules/services/nixos/default.nix | 2 + modules/services/nixos/filebrowser.nix | 8 +- modules/services/nixos/glance.nix | 117 ++++++++++++++--------------- modules/services/nixos/goaccess.nix | 25 +++--- modules/services/nixos/qbittorrent.nix | 5 +- modules/services/options.nix | 6 +- 9 files changed, 97 insertions(+), 91 deletions(-) (limited to 'modules') diff --git a/modules/desktop/nixos/programs/firefox.nix b/modules/desktop/nixos/programs/firefox.nix index 30a74b4..a0fe4de 100644 --- a/modules/desktop/nixos/programs/firefox.nix +++ b/modules/desktop/nixos/programs/firefox.nix @@ -20,15 +20,12 @@ in DisablePocket = true; NoDefaultBookmarks = true; + Certificates.ImportEnterpriseRoots = true; + OverrideFirstRunPage = ""; OverridePostUpdatePage = ""; SearchEngines.Default = "DuckDuckGo"; - # Homepage = { - # URL = "https://home.ganymede"; - # Locked = true; - # StartPage = "homepage-locked"; - # }; AIControls = let opt = Value: { diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix index 75498a9..9c78295 100644 --- a/modules/services/nixos/btopweb.nix +++ b/modules/services/nixos/btopweb.nix @@ -21,6 +21,7 @@ in { isSystemUser = true; group = "btopweb"; }; + users.users.caddy.extraGroups = ["btopweb"]; systemd.services."btopweb" = { description = "Host btop on a website"; @@ -31,15 +32,27 @@ in { serviceConfig = { User = "btopweb"; + Group = "btopweb"; Type = "simple"; - ExecStart = ''${lib.getExe pkgs.ttyd} -W -i 127.0.0.1 -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}''; + RuntimeDirectory = "btopweb"; + RuntimeDirectoryMode = "0770"; + UMask = "0007"; + + ExecStart = '' + ${lib.getExe pkgs.ttyd} \ + -W \ + -i /run/btopweb/ttyd.sock \ + -t renderType=canvas \ + -t fontSize=16 \ + ${pkgs.btop}/bin/btop -c ${btopSettings} + ''; }; }; services.caddy.virtualHosts."btop.ganymede".extraConfig = '' tls internal - reverse_proxy 127.0.0.1:${toString cfg.port} + reverse_proxy unix//run/btopweb/ttyd.sock ''; collinux.services.glance.homelabServices."btop" = { diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix index 4b41c76..02aeca3 100644 --- a/modules/services/nixos/caddy.nix +++ b/modules/services/nixos/caddy.nix @@ -7,7 +7,6 @@ cfg = config.collinux.services.caddy; in lib.mkIf cfg.enable { - users.users."caddy".extraGroups = ["fileserver"]; networking.firewall.allowedTCPPorts = [80 443]; environment.systemPackages = [pkgs.nss.tools]; # required for caddy https stuff diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index fa74cf6..9aea299 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -15,4 +15,6 @@ ./ngircd.nix ./qbittorrent.nix ]; + + users.groups."fileserver" = {}; } diff --git a/modules/services/nixos/filebrowser.nix b/modules/services/nixos/filebrowser.nix index df0d536..9791f8d 100644 --- a/modules/services/nixos/filebrowser.nix +++ b/modules/services/nixos/filebrowser.nix @@ -13,6 +13,7 @@ in group = "dufs"; extraGroups = ["fileserver"]; }; + users.users.caddy.extraGroups = ["dufs"]; systemd.services."dufs" = { description = "dufs file server"; @@ -22,15 +23,14 @@ in wantedBy = ["multi-user.target"]; serviceConfig = { - # ExecStart = "${pkgs.dufs}/bin/dufs /media --port ${toString cfg.port}"; ExecStart = "${lib.getExe pkgs.dufs} /media --bind /run/dufs/dufs.sock"; - RuntimeDirectory = "dufs"; # /run/dufs + RuntimeDirectory = "dufs"; User = "dufs"; Group = "dufs"; + UMask = "0007"; - # Hardening ProtectSystem = "strict"; ProtectHome = true; PrivateTmp = true; @@ -47,6 +47,6 @@ in collinux.services.glance.homelabServices."files" = { url = "https://files.ganymede"; - icon = "si:folder"; + icon = "mdi:folder"; }; } diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix index 38e5e1d..8d305a5 100644 --- a/modules/services/nixos/glance.nix +++ b/modules/services/nixos/glance.nix @@ -6,8 +6,6 @@ }: let cfg = config.collinux.services.glance; - pure = x: [x]; - servicesLinks = builtins.attrValues cfg.homelabServices; settings = { @@ -19,76 +17,73 @@ }; branding.hide-footer = true; - pages = pure { - name = "Dashboard"; - width = "slim"; - hide-desktop-navigation = true; - center-vertically = true; - columns = pure { - size = "full"; - widgets = [ + pages = [ + { + name = "Dashboard"; + width = "slim"; + hide-desktop-navigation = true; + center-vertically = true; + columns = [ { - type = "search"; - autofocus = true; - search-engine = "duckduckgo"; - bangs = [ - { - title = "GitHub"; - shortcut = "gh"; - url = "https://github.com/search?q={QUERY}&type=repositories"; - } + size = "full"; + widgets = [ { - title = "I'm Feeling Lucky"; - shortcut = "!"; - url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1"; + type = "search"; + autofocus = true; + search-engine = "duckduckgo"; + bangs = [ + { + title = "GitHub"; + shortcut = "gh"; + url = "https://github.com/search?q={QUERY}&type=repositories"; + } + { + title = "I'm Feeling Lucky"; + shortcut = "!"; + url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1"; + } + { + title = "YouTube Music"; + shortcut = "ytm"; + url = "https://music.youtube.com/search?q={QUERY}"; + } + { + title = "Google AI Mode"; + shortcut = "ai"; + url = "https://www.google.com/search?udm=50&q={QUERY}"; + } + ]; } { - title = "YouTube Music"; - shortcut = "ytm"; - url = "https://music.youtube.com/search?q={QUERY}"; + type = "server-stats"; + servers = [ + { + type = "local"; + name = "ganymede"; + hide-mountpoints-by-default = true; + mountpoints = { + "/".hide = false; + "/media".hide = false; + }; + } + ]; } { - title = "Google AI Mode"; - shortcut = "ai"; - url = "https://www.google.com/search?udm=50&q={QUERY}"; + type = "monitor"; + cache = "1m"; + title = "Services"; + sites = servicesLinks; } ]; } - { - type = "server-stats"; - servers = pure { - type = "local"; - name = "Ganymede"; - hide-mountpoints-by-default = true; - mountpoints = { - "/".hide = false; - "/media".hide = false; - }; - }; - } - { - type = "monitor"; - cache = "1m"; - title = "Services"; - sites = servicesLinks; - } ]; - }; - }; + } + ]; }; settingsFile = (pkgs.formats.yaml {}).generate "config.yml" settings; in { config = lib.mkIf cfg.enable { - users.groups."glance" = {}; - users.users."glance" = { - isSystemUser = true; - group = "glance"; - - home = "/var/lib/glance"; - createHome = true; - }; - systemd.services."glance" = { restartIfChanged = true; wants = ["network-online.target"]; @@ -96,12 +91,12 @@ in { wantedBy = ["multi-user.target"]; serviceConfig = { - User = "glance"; Type = "simple"; - ReadWritePaths = "/var/lib/glance"; - WorkingDirectory = "/var/lib/glance"; - ExecStart = "${pkgs.glance}/bin/glance -config ${settingsFile}"; + DynamicUser = true; + StateDirectory = "glance"; + + ExecStart = "${lib.getExe pkgs.glance} -config ${settingsFile}"; NoNewPrivileges = true; PrivateTmp = true; diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix index 288428d..f0b6c34 100644 --- a/modules/services/nixos/goaccess.nix +++ b/modules/services/nixos/goaccess.nix @@ -14,12 +14,11 @@ log-file = "/var/log/caddy/access-williamsfam.us.com.log"; geoip-database = inputs.geolite-db; - ws-url = "wss://stats.ganymede:443/ws"; - port = cfg.port; - addr = "127.0.0.1"; + ws-url = "wss://stats.ganymede:443/ws"; # url that the frontend uses to fetch data + unix-socket = "/run/goaccess/goaccess.sock"; real-time-html = "true"; - output = "/var/www/goaccess/index.html"; + output = "/var/lib/goaccess/index.html"; external-assets = "true"; all-static-files = "false"; html-report-title = "stats@ganymede"; @@ -44,6 +43,7 @@ in { group = "goaccess"; extraGroups = ["caddy"]; # to read caddy log files }; + users.users.caddy.extraGroups = ["goaccess"]; systemd.services."goaccess" = { description = "GoAccess Real-Time Log Analyzer"; @@ -56,9 +56,14 @@ in { User = "goaccess"; Type = "simple"; - ReadWritePaths = "/var/www/goaccess"; - WorkingDirectory = "/var/www/goaccess"; - ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}"; + RuntimeDirectory = "goaccess"; + RuntimeDirectoryMode = "0770"; + UMask = "0007"; + + StateDirectory = "goaccess"; + StateDirectoryMode = "0750"; # caddy must read this dir + + ExecStart = "${lib.getExe pkgs.goaccess} -p ${settingsFile}"; NoNewPrivileges = true; PrivateTmp = true; @@ -70,15 +75,13 @@ in { }; }; - systemd.tmpfiles.rules = ["d /var/www/goaccess/ 755 goaccess goaccess"]; - services.caddy.virtualHosts."stats.ganymede".extraConfig = '' tls internal - root * /var/www/goaccess + root * /var/lib/goaccess file_server - reverse_proxy /ws 127.0.0.1:${toString cfg.port} + reverse_proxy /ws unix//run/goaccess/goaccess.sock ''; collinux.services.glance.homelabServices."stats" = { diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix index fe2831a..c7bfe95 100644 --- a/modules/services/nixos/qbittorrent.nix +++ b/modules/services/nixos/qbittorrent.nix @@ -6,10 +6,7 @@ cfg = config.collinux.services.qbittorrent; in { config = lib.mkIf cfg.enable { - users.users."qbittorrent" = { - uid = 985; - extraGroups = ["fileserver"]; # torrent files go to /media/library - }; + users.users."qbittorrent" = {}; networking.firewall = { allowedTCPPorts = [49252]; diff --git a/modules/services/options.nix b/modules/services/options.nix index 0e033be..38baf9e 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -20,12 +20,12 @@ in { jta = basicService {desc = "personal project";}; ganyupload = basicService {desc = "anonymous file uploads";}; - btopweb = basicService {desc = "btop accessable in a browser tab";}; + btopweb.enable = mkEnableOption "btop accessable in a browser tab"; forgejo = basicService {desc = "Self-hosted git forge";}; qbittorrent = basicService {desc = "webui for qBittorrent";}; - goaccess = basicService {desc = "webserver stats from caddy logs";}; - filebrowser = basicService {desc = "dufs file browser";}; + goaccess.enable = mkEnableOption "webserver stats from caddy logs"; + filebrowser.enable = mkEnableOption "dufs file browser"; cgit.enable = mkEnableOption "cgit git webui"; glance = -- cgit v1.3.1