Omega-Relay host replacement for Ubuntu VM on Feox

* Add omega-relay prototype host

* Add omega-relay prototype host

* Inital commit for working omega-relay host.

This commit includes:
- Mysql module from umbriel
- Disko configuration for the Ferox VM
- Freshrss module
- Stalwart module
- Vaultwarden module
- Wakapi module
- Uptime Kuma module
- Support for using mysql socket
- Server user that does not depend on full home-manager preset.
- ACME for wilkuu.xyz domains, including all the services.

* Nix fmt

* Fixes in secrets and services.

Mostly fixes connection to mysql and the unix-socket auth for it.

* Little fixes and update

* Format and do fixes

* Update secrets and keys for omega-relay

* Apply changes from messing around and making things work

1 files changed, 139 insertions, 0 deletions

diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
new file mode 100644
index 0000000..3c7272c
--- /dev/null
+++ b/hosts/omega-relay/default.nix
@@ -0,0 +1,139 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  imports = [
+    ./firewall.nix
+    ./disko.nix
+    ./vm.nix
+    ./hardware-configuration.nix
+    ../../services/mysql.nix
+    ../../services/email.nix
+    ../../services/vaultwarden.nix
+    ../../services/uptimekuma.nix
+    ../../services/freshrss.nix
+    ../../services/wakapi.nix
+  ];
+
+  addons = {
+    desktop.hyprland.enable = lib.mkForce false;
+    # desktop.cosmic.enable = lib.mkForce false;
+    desktop.xfce.enable = lib.mkForce false;
+
+    gpg.enable = true;
+    virtualisation.guest = true; 
+  };
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+  };
+
+
+  environment.systemPackages = with pkgs; [
+    lynx
+    chawan
+  ];
+
+  wilkuu.services =
+    let
+      isVM = config.addons.virtualisation.isTestVM;
+    in
+    {
+      stalwart = {
+        enable = true;
+        domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
+        doACME = !isVM;
+      };
+
+      vaultwarden = {
+        enable = true;
+        signupWhitelist = [
+          "wilkuu.xyz"
+          "omega-relay.local"
+        ];
+        backupDir = "/srv/data/vaultwarden";
+        domain = if isVM then "bitwarden.omega-relay.local" else "bitwarden.wilkuu.xyz";
+        doACME = !isVM;
+      };
+      uptimekuma = {
+        enable = true;
+        domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz";
+        dataDir = "/srv/data/uptimekuma";
+        doACME = !isVM;
+      };
+      freshrss = {
+        enable = true;
+        domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz";
+        doACME = !isVM;
+      };
+      wakapi = {
+        enable = false;
+        domain = if isVM then "wakapi.omega-relay.local" else "wakapi.wilkuu.xyz";
+        doACME = !isVM;
+      };
+    };
+
+  services.fail2ban = {
+    enable = true; 
+    maxretry = 5;
+    ignoreIP = [
+      "192.168.80.0/24" 
+      "192.168.80.0/24"
+    ]; 
+    bantime = "24h"; 
+    bantime-increment = {
+      enable = true; # Enable increment of bantime after each violation
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+      # multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h"; # Do not ban for more than 1 week
+      overalljails = true; # Calculate the bantime based on all the violations
+    }; 
+  };
+	
+  # TODO: Make a nginx module
+  security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) {
+    acceptTerms = true;
+    defaults.email = "jstachurski9991@gmail.com";
+  };
+  services.nginx =
+    let
+      isVM = config.addons.virtualisation.isTestVM;
+      domain = if isVM then "omega-relay.local" else "wilkuu.xyz";
+    in
+    {
+      enable = true;
+      virtualHosts."${domain}" = {
+        enableACME = !isVM;
+        addSSL = !isVM;
+        root = "/srv/www/wilkuu.xyz/";
+	locations."/" = {
+		index = "index.html";
+		tryFiles = "$uri $uri/ =404";
+	};
+      };
+    };
+
+  networking.hostName = "omega-relay";
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+  };
+
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    openFirewall = true;
+    allowSFTP = true;
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = [ "wilkuu" ];
+      X11Forwarding = false;
+      PermitRootLogin = "no";
+      PrintMotd = true;
+    };
+  };
+
+}