From c7e9ff3c853755cd3b0e8bc7443d55d222a06f80 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sun, 11 Jan 2026 08:03:03 -0600
Subject: clean up services/networking config even more

---
 modules/services/nixos/networking/default.nix  | 17 +--------------
 modules/services/nixos/networking/networkd.nix |  1 +
 modules/services/nixos/networking/resolved.nix | 17 +++++++++++++++
 modules/services/nixos/selfhost/adguard.nix    | 13 ++++++------
 modules/services/nixos/selfhost/forgejo.nix    | 10 ++++-----
 modules/services/nixos/selfhost/headscale.nix  | 17 ++++++++++-----
 modules/services/options.nix                   | 29 ++++++++++++++++----------
 7 files changed, 60 insertions(+), 44 deletions(-)
 create mode 100644 modules/services/nixos/networking/resolved.nix

(limited to 'modules')

diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 62b9146..9fa56da 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -3,23 +3,8 @@
     ./iwd.nix
     ./networkmanager.nix
     ./networkd.nix
+    ./resolved.nix
   ];
 
   networking.firewall.enable = true;
-
-  # DNS
-  services.resolved = {
-    enable = true;
-    dnsovertls = "opportunistic";
-    dnssec = "allow-downgrade";
-    fallbackDns = [
-      "9.9.9.9#dns.quad9.net"
-      "149.112.112.112#dns.quad9.net"
-    ];
-
-    # disable extra stuff
-    llmnr = "false";
-    extraConfig = "MulticastDNS=no";
-  };
-  networking.resolvconf.enable = false;
 }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index 470bcec..920b93f 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -29,6 +29,7 @@ in
       wait-online = {
         enable = true;
         ignoredInterfaces = ["docker0"];
+        anyInterface = true;
       };
 
       networks."11-static-lan" = {
diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix
new file mode 100644
index 0000000..b552095
--- /dev/null
+++ b/modules/services/nixos/networking/resolved.nix
@@ -0,0 +1,17 @@
+{
+  networking.resolvconf.enable = false;
+
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+    fallbackDns = [
+      "9.9.9.9#dns.quad9.net"
+      "149.112.112.112#dns.quad9.net"
+    ];
+
+    # disable extra stuff
+    llmnr = "false";
+    extraConfig = "MulticastDNS=no";
+  };
+}
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index 73c6caf..69fb8a4 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -32,17 +32,16 @@ in
       DNSStubListener=no
     '';
 
-    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable
-      && config.collinux.services.selfhost.magic_caddy.enable) {
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
-          if config.collinux.services.networking.tailscale.enable
-          then "bind tailscale/adguard"
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
           else ""
         }
-        reverse_proxy localhost:${toString cfg.port}
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
       '';
     };
-
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
   }
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index e499e64..4571dca 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -8,7 +8,7 @@ in
   lib.mkIf cfg.enable {
     services.forgejo = {
       enable = true;
-      database.type = "postgres";
+      database.type = "sqlite3";
       settings = {
         server = {
           DOMAIN = "localhost";
@@ -41,14 +41,14 @@ in
       wants = lib.mkAfter ["network-online.target"];
     };
 
-    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable && config.collinux.services.selfhost.magic_caddy.enable) {
+    services.caddy = lib.mkIf cfg.caddy.enable {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
-          if config.collinux.services.networking.tailscale.enable
-          then "bind tailscale/forgejo"
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
           else ""
         }
-        reverse_proxy localhost:${toString cfg.port}
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
       '';
     };
   }
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
index 9989742..2bdcca1 100644
--- a/modules/services/nixos/selfhost/headscale.nix
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -23,7 +23,7 @@ in
       address = cfg.bind_host;
       port = cfg.port;
       settings = {
-        server_url = cfg.root_url;
+        server_url = "https://${cfg.root_url}";
 
         database.type = "sqlite";
 
@@ -60,9 +60,16 @@ in
       description = "Target represents headscale is running. started by headscale.service";
     };
 
-    services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable ''
-      reverse_proxy localhost:8080
-    '';
-
     environment.systemPackages = [pkgs.headscale];
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
+          else ""
+        }
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+      '';
+    };
   }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 8be7c42..df8bc52 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -17,7 +17,7 @@ in {
         networkmanager.enable = mkEnableOption "heavier wifi daemon";
 
         networkd = {
-          enable = mkEnableOption "set static IP (systemd-networkd)";
+          enable = mkEnableOption "use systemd-networkd";
           ssid = mkOption {type = lib.types.str;};
           pskFile = mkOption {type = lib.types.str;};
 
@@ -61,9 +61,13 @@ in {
         selfhostOptions = {
           service_name,
           default_port ? null,
-          ...
         }: {
-          enable = mkEnableOption "";
+          enable = mkEnableOption "${service_name} selfhosted service";
+
+          service_name = mkOption {
+            type = lib.types.str;
+          };
+
           bind_host = mkOption {
             type = ip_addr;
             default = "0.0.0.0";
@@ -72,29 +76,32 @@ in {
             type = lib.types.port;
             default = default_port;
           };
+
           root_url = mkOption {
-            type = lib.types.str;
-            default = with config.collinux.services.networking.tailscale;
-              if enable
-              then "http://${service_name}.${tailnet}"
-              else null;
+            type = lib.types.nullOr lib.types.str;
+          };
+
+          caddy = {
+            enable = mkEnableOption "Automatically create caddy configurations for this service";
+            bind_tailscale = mkEnableOption "Bind the service to {service_name}.{tailnet}";
           };
         };
       in {
-        magic_caddy.enable = mkEnableOption "Automatically create caddy configurations for services";
-
         adguard = selfhostOptions {
           service_name = "adguard";
           default_port = 8001;
         };
+
         forgejo = selfhostOptions {
           service_name = "forgejo";
           default_port = 8010;
         };
+
         headscale = selfhostOptions {
           service_name = "headscale";
           default_port = 8080;
         };
+
         caddy = {
           enable = mkEnableOption "caddy https server";
           envFile = mkOption {
@@ -109,7 +116,7 @@ in {
     assertions = [
       {
         assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable);
-        message = "only one networking method (iwd, networkmanager, static) can be active";
+        message = "only one networking method (iwd, networkmanager, networkd) can be active";
       }
     ];
   };
-- 
cgit v1.3.1