Omega-Relay host replacement for Ubuntu VM on Feox

* Add omega-relay prototype host

* Add omega-relay prototype host

* Inital commit for working omega-relay host.

This commit includes:
- Mysql module from umbriel
- Disko configuration for the Ferox VM
- Freshrss module
- Stalwart module
- Vaultwarden module
- Wakapi module
- Uptime Kuma module
- Support for using mysql socket
- Server user that does not depend on full home-manager preset.
- ACME for wilkuu.xyz domains, including all the services.

* Nix fmt

* Fixes in secrets and services.

Mostly fixes connection to mysql and the unix-socket auth for it.

* Little fixes and update

* Format and do fixes

* Update secrets and keys for omega-relay

* Apply changes from messing around and making things work

6 files changed, 676 insertions, 0 deletions

diff --git a/services/email.nix b/services/email.nix
new file mode 100644
index 0000000..906b44d
--- /dev/null
+++ b/services/email.nix
@@ -0,0 +1,174 @@
+{ config, lib, ... }:
+let
+  cfg = config.wilkuu.services.stalwart;
+  hostname = config.networking.hostName;
+in
+{
+  options.wilkuu.services.stalwart = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "mail.${hostname}.local";
+      example = "mail.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    wellKnownDomains = mkOption {
+      type = types.listOf types.str;
+      default = [ "${hostname}.local" ];
+      example = [ "wilkuu.xyz" ];
+      description = "Domain for well-known items";
+    };
+    doACME = mkEnableOption "Enable ACME for stalwart here";
+    enable = mkEnableOption "Enable the email service";
+    dataDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for Stalwart user data";
+      default = "/srv/data/stalwart";
+      example = "/srv/data/stalwart";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      sopsPath = ../secrets/${hostname}/stalwart.yaml;
+      secrets = [ "user_admin_password" ];
+      toSops = (sname: "stalwart/${sname}");
+      toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
+      toStalwartCred = name: "%{file:/run/credentials/${config.systemd.services.stalwart.name}/${name}}%";
+
+      basicListener = proto: port: tls: {
+        bind = [ "[::]:${toString port}" ];
+        protocol = proto;
+        tls.implicit = tls;
+      };
+
+      proxyWellKnown =
+        names:
+        let
+          uris = map (n: "/.well-known/${n}") names;
+        in
+        (lib.genAttrs uris (uri: {
+          proxyPass = "http://localhost:3080${uri}";
+          recommendedProxySettings = true;
+        }));
+
+      makeHttpRedirect = target: https: {
+        return = "302 ${if https then "https" else "http"}://${target}";
+      };
+
+    in
+    {
+      networking.hosts = {
+        "127.0.0.1" = [ cfg.domain ];
+      };
+
+      # Need this bc otherwise sops will complain for some reason
+      users = {
+        groups.stalwart = { };
+        users.stalwart = {
+          isSystemUser = true;
+          group = "stalwart";
+        };
+      };
+
+      # TODO: Move this into a util function or option;
+      sops.secrets = (
+        lib.genAttrs (map toSops secrets) (_name: {
+          sopsFile = sopsPath;
+          mode = "0440";
+          owner = "stalwart-mail";
+        })
+      );
+
+      services.nginx.virtualHosts =
+        (lib.genAttrs cfg.wellKnownDomains (
+          (_wdomain: {
+            locations =
+              (proxyWellKnown [
+                "jmap"
+                "mta-sts.txt"
+                "mail-v1.xml"
+                "autoconfig/mail"
+              ])
+              // (lib.genAttrs [ "/.well_known/caldav" "/.well_known/webdav" ] (
+                uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME
+              ));
+          })
+        )) //
+        { ${cfg.domain} = {
+	      addSSL = cfg.doACME;
+	      enableACME = cfg.doACME;
+	      serverName = "${cfg.domain}";
+	      locations."/" = {
+		proxyPass = "http://localhost:3080";
+		recommendedProxySettings = true;
+	      };
+        };};
+
+      services.stalwart = {
+        enable = true;
+        dataDir = cfg.dataDir;
+        openFirewall = false;
+        credentials = (lib.genAttrs secrets toCredfilePath) // (let 
+		acme_dir = config.security.acme.certs.${cfg.domain}.directory;
+		cert_path = file: "${acme_dir}/${file}";
+	in (if cfg.doACME then {
+		"tls_cert.pem" = cert_path "cert.pem";
+		"tls_key.pem"  = cert_path  "key.pem";
+	} else {}));
+
+        settings = {
+          server.listener = {
+            smtp = basicListener "smtp" 25 false;
+            submission = basicListener "smtp" 465 true;
+            imaptls = basicListener "imap" 993 true;
+            imap = basicListener "imap" 143 true;
+            # webdav = basicListener "http" 3080 false;
+            # jmap = basicListener "http" 3080 false;
+            http = basicListener "http" 3080 false;
+          };
+
+          store.rocksdb = {
+            type = "rocksdb";
+            path = cfg.dataDir;
+            compression = "lz4";
+          };
+
+          directory.internal = {
+            type = "internal";
+            store = "rocksdb";
+          };
+
+          storage = {
+            data = "rocksdb";
+            fts = "rocksdb";
+            blob = "rocksdb";
+            lookup = "rocksdb";
+            directory = "internal";
+          };
+
+          authentication.fallback-admin = {
+            user = "admin";
+            secret = toStalwartCred "user_admin_password";
+          };
+
+          http = {
+            use-x-forwarded = true;
+            url = "protocol + \"://${cfg.domain}\"";
+          };
+
+	  session.connect = {
+		hostname = "config_get('server.hostname')";
+	  };
+
+	  server.hostname = "${cfg.domain}";  
+
+	  certificate."nix_${cfg.domain}" = lib.mkIf cfg.doACME {
+		cert = toStalwartCred "tls_cert.pem"; 
+		private-key = toStalwartCred "tls_key.pem";
+		default = true; 
+	  };  
+        };
+      };
+    }
+  );
+}
diff --git a/services/freshrss.nix b/services/freshrss.nix
new file mode 100644
index 0000000..26a1853
--- /dev/null
+++ b/services/freshrss.nix
@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.wilkuu.services.freshrss;
+  hostname = config.networking.hostName;
+in
+{
+
+  options.wilkuu.services.freshrss = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "rss.${hostname}.local";
+      example = "rss.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    doACME = mkEnableOption "Enable ACME for fresh-rss here";
+    enable = mkEnableOption "Enable the fresh-rss service";
+    dataDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for fresh-rss data";
+      default = "/srv/data/freshrss";
+      example = "/srv/data/freshrss";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      sopsPath = ../secrets/${hostname}/freshrss.yaml;
+      secrets = [
+        "admin_password"
+        "db_pass"
+      ];
+      toSops = (sname: "fresh-rss/${sname}");
+    in
+    {
+      networking.hosts = {
+        "127.0.0.1" = [ cfg.domain ];
+      };
+
+      sops.secrets = (
+        lib.genAttrs (map toSops secrets) (_name: {
+          sopsFile = sopsPath;
+          mode = "0440";
+          owner = config.services.freshrss.user;
+        })
+      );
+
+      services.nginx.virtualHosts."${cfg.domain}" = {
+        addSSL = cfg.doACME;
+        enableACME = cfg.doACME;
+      };
+
+      systemd.services.freshrss.after = [ "mysql.service" ];
+      wilkuu.services.mysql = {
+        enable = true;
+        users."freshrss" = {
+          sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
+	  host = "localhost";
+        };
+        databases."freshrss" = {
+          enable = true;
+          allowedUsers = [ "freshrss" ];
+        };
+      };
+
+      services.freshrss = {
+        enable = true;
+        # api.enable = true;
+        dataDir = cfg.dataDir;
+        baseUrl = "https://${cfg.domain}";
+        extensions = with pkgs.freshrss-extensions; [
+          youtube
+          title-wrap
+          auto-ttl
+          reading-time
+        ];
+        passwordFile = config.sops.secrets."fresh-rss/admin_password".path;
+        virtualHost = cfg.domain;
+        database = {
+          passFile = config.sops.secrets."fresh-rss/db_pass".path;
+          host = "127.0.0.1";
+          port = config.wilkuu.services.mysql.port;
+          name = "freshrss";
+          user = "freshrss";
+          type = "mysql";
+        };
+      };
+    }
+  );
+}
diff --git a/services/mysql.nix b/services/mysql.nix
new file mode 100644
index 0000000..06edfcb
--- /dev/null
+++ b/services/mysql.nix
@@ -0,0 +1,139 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.wilkuu.services.mysql;
+
+  create_users_ensure =
+    uname:
+    (lib.genAttrs (lib.map (dn: "${dn}.*") (
+      lib.attrNames (lib.filterAttrs (_: dcfg: (builtins.elem uname dcfg.allowedUsers)) cfg.databases)
+    )) (_: "ALL PRIVILEGES"));
+
+  priviledge_clause =
+    name: db: priv:
+    ("GRANT ${priv} ON ${db} TO ${name};");
+
+  add-user-clauses =
+    name: ucfg:
+    if (!isNull ucfg.sopsPlaceholder) then
+      (
+        ''
+          -- Clauses for user ${name}
+          ALTER USER IF EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; 
+          CREATE USER IF NOT EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}';  
+        ''
+        + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'${ucfg.host}'") (create_users_ensure name))
+      )
+    else
+      " -- Ommitted user ${name}";
+
+  add-unix-user-clauses =
+    name:
+    ''
+      -- Clauses for user ${name}
+      ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED VIA unix_socket; 
+      CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED VIA unix_socket;  
+    ''
+    + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'localhost'") (
+      create_users_ensure name
+    ));
+
+in
+{
+  options.wilkuu.services.mysql = {
+    enable = lib.mkEnableOption "Enable database for containers";
+    port =
+      with lib;
+      mkOption {
+        type = types.port;
+        default = 3306;
+      };
+    databases =
+      with lib;
+      mkOption {
+        type = types.attrsOf (
+          types.submodule {
+            options = {
+              enable = mkEnableOption "Enable the database";
+              allowedUsers = mkOption {
+                type = types.listOf types.str;
+              };
+            };
+          }
+        );
+        default = { };
+      };
+    users =
+      with lib;
+      mkOption {
+        type = types.attrsOf (
+          types.submodule {
+            options = {
+              scramPassword = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+              };
+              sopsPlaceholder = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+              };
+              allowedRanges = mkOption {
+                type = types.listOf types.str;
+              };
+	      host = mkOption {
+		type = types.str; 
+		default = "%"; 
+	      };
+            };
+          }
+        );
+        default = { };
+      };
+    unix_users = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Users that can identify using the unix socket";
+      default = [ ];
+      example = [ "wakapi" ];
+    };
+  };
+  # config.sops.secrets = lib.mkIf cfg.enable {
+  #   "database/root_pass" = {
+  #     sopsFile = ../secrets/${config.networking.hostName}/secrets.yaml;
+  #   };
+  # };
+  config.sops.templates."init-mysql" = lib.mkIf cfg.enable {
+    owner = config.systemd.services.mysql.serviceConfig.User;
+    content = (
+      lib.concatLines (
+        (builtins.attrValues (builtins.mapAttrs add-user-clauses cfg.users))
+        ++ (map add-unix-user-clauses cfg.unix_users)
+        ++ [ "FLUSH PRIVILEGES;" ]
+      )
+    );
+  };
+
+  config.services.mysql = {
+    enable = cfg.enable;
+    ensureDatabases = builtins.attrNames cfg.databases;
+    initialScript = config.sops.templates."init-mysql".path;
+    package = pkgs.mariadb;
+    settings = {
+      mysqld = {
+        # socket="/var/lib/mysql/mysql.sock";
+        log_error = "/var/log/mysql_err.log";
+        log_warnings = 2;
+      };
+    };
+  };
+
+  # config.host-config.utilpkgs = lib.mkIf (cfg.enable) (
+  #   with pkgs;
+  #   [
+  #     mycli
+  #   ]
+  # );
+}
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
new file mode 100644
index 0000000..720040d
--- /dev/null
+++ b/services/uptimekuma.nix
@@ -0,0 +1,79 @@
+{ config, lib, ... }:
+let
+  cfg = config.wilkuu.services.uptimekuma;
+  hostname = config.networking.hostName;
+in
+{
+  options.wilkuu.services.uptimekuma = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "uptime.${hostname}.local";
+      example = "uptime.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    doACME = mkEnableOption "Enable ACME for uptime kuma here";
+    enable = mkEnableOption "Enable the uptime-kuma service";
+    dataDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for uptime kuma data, currently ignored, because nixpkgs sucks";
+      default = "/srv/data/uptimekuma";
+      example = "/srv/data/uptimekuma";
+    };
+  };
+
+  config = lib.mkIf cfg.enable ({
+    networking.hosts = {
+      "127.0.0.1" = [ cfg.domain ];
+    };
+
+    users.users.uptimekuma = {
+      isSystemUser = true;
+      group = "uptimekuma";
+    };
+    users.groups.uptimekuma = { };
+
+    systemd.services.uptime-kuma.serviceConfig.User = "uptimekuma";
+    systemd.services.uptime-kuma.after = [ "mysql.service" ];
+
+    # sops.secrets =
+    #   (lib.genAttrs (map toSops secrets)
+    #     (name: {
+    #       sopsFile = sopsPath;
+    #       mode = "0440";
+    #       owner = "uptime-kuma";
+    #     }));
+
+    services.nginx.virtualHosts."${cfg.domain}" = {
+      addSSL = cfg.doACME;
+      enableACME = cfg.doACME;
+      locations."/" = {
+        proxyPass = "http://localhost:3111";
+        recommendedProxySettings = true;
+      };
+    };
+
+    wilkuu.services.mysql =
+      let
+        user = config.systemd.services.uptime-kuma.serviceConfig.User;
+      in
+      {
+        unix_users = [ user ];
+        databases.uptimekuma = {
+          enable = true;
+          allowedUsers = [ user ];
+        };
+      };
+
+    services.uptime-kuma = {
+      enable = true;
+      settings = {
+        UPTIME_KUMA_PORT        = "3111";
+        UPTIME_KUMA_HOST        = "127.0.0.1";
+        UPTIME_KUMA_DB_TYPE     = "sqlite";
+        #UPTIME_KUMA_DB_SOCKET   = "/run/mysqld/mysqld.sock";
+	#UPTIME_KUMA_DB_USERNAME = config.systemd.services.uptime-kuma.serviceConfig.User;
+	#UPTIME_KUMA_DB_NAME     = "uptimekuma"; 
+      };
+    };
+  });
+}
diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
new file mode 100644
index 0000000..ff3466d
--- /dev/null
+++ b/services/vaultwarden.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  cfg = config.wilkuu.services.vaultwarden;
+  hostname = config.networking.hostName;
+in
+{
+  options.wilkuu.services.vaultwarden = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "bitwarden.${hostname}.local";
+      example = "bitwarden.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    doACME = mkEnableOption "Enable ACME for vaultwarden here";
+    enable = mkEnableOption "Enable the vaultwarden service";
+    backupDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for Vaultwarden user data backup";
+      default = "/srv/data/vaultwarden";
+      example = "/srv/data/vaultwarden";
+    };
+    signupWhitelist = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "wilkuu.xyz" ];
+      description = "Domains that can sign up on vaultwarden";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
+      secrets = [ "admin_token" ];
+      toSops = (sname: "vaultwarden/${sname}");
+    in
+    {
+      networking.hosts = {
+        "127.0.0.1" = [ cfg.domain ];
+      };
+
+      sops.secrets = (
+        lib.genAttrs (map toSops secrets) (_name: {
+          sopsFile = sopsPath;
+          mode = "0440";
+          owner = "vaultwarden";
+        })
+      );
+
+      sops.templates.vaultwardenEnvFile.content = ''
+        ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
+      '';
+
+      services.nginx.virtualHosts."${cfg.domain}" = {
+        enableACME = cfg.doACME;
+        addSSL = cfg.doACME;
+        locations."/" = {
+          proxyPass = "http://localhost:3222";
+          recommendedProxySettings = true;
+        };
+      };
+
+      services.vaultwarden = {
+        enable = cfg.enable;
+        # backupDir = cfg.backupDir;
+        config = {
+          DOMAIN = "${if cfg.doACME then "https" else "http"}://${cfg.domain}";
+          ROCKET_ADDRESS = "127.0.0.1";
+          ROCKET_PORT = "3222";
+          SIGNUPS_DOMAINS_WHITELIST = (lib.concatStringsSep "," cfg.signupWhitelist);
+          SIGNUPS_ALLOWED = "false";
+          IP_HEADER = "X-Forwarded-For";
+        };
+        environmentFile = config.sops.templates.vaultwardenEnvFile.path;
+      };
+
+    }
+  );
+}
diff --git a/services/wakapi.nix b/services/wakapi.nix
new file mode 100644
index 0000000..a350b6a
--- /dev/null
+++ b/services/wakapi.nix
@@ -0,0 +1,112 @@
+{ config, lib, ... }:
+let
+  cfg = config.wilkuu.services.wakapi;
+  hostname = config.networking.hostName;
+  service_user = config.systemd.services.wakapi.serviceConfig.User;
+in
+{
+  options.wilkuu.services.wakapi = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "wakapi.${hostname}.local";
+      example = "wakapi.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    email = mkOption {
+      type = types.str;
+      default = "wakapi@${hostname}.local";
+      example = "noreply@wilkuu.xyz";
+      description = "Mailer address";
+    };
+    doACME = mkEnableOption "Enable ACME for wakapi here";
+    enable = mkEnableOption "Enable the wakapi service";
+    dataDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for wakapi data";
+      default = "/srv/data/wakapi";
+      example = "/srv/data/wakapi";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      sopsPath = ../secrets/${hostname}/wakapi.yaml;
+      secrets = [ "password_salt" ];
+      toSops = (sname: "wakapi/${sname}");
+    in
+    {
+      networking.hosts = {
+        "127.0.0.1" = [ cfg.domain ];
+      };
+
+      sops.secrets = (
+        lib.genAttrs (map toSops secrets) (_name: {
+          sopsFile = sopsPath;
+          mode = "0440";
+          owner = service_user;
+        })
+      );
+
+      services.nginx.virtualHosts."${cfg.domain}" = {
+        enableACME = cfg.doACME;
+        addSSL = cfg.doACME;
+        locations."/" = {
+          proxyPass = "http://localhost:3111";
+          recommendedProxySettings = true;
+        };
+      };
+
+      wilkuu.services.mysql = {
+        unix_users = [ service_user ];
+        databases.wakapi = {
+          enable = true;
+          allowedUsers = [ service_user ];
+        };
+      };
+
+      systemd.services.wakapi.after = [ "mysql.service" ];
+      services.wakapi = {
+        enable = true;
+        stateDir = cfg.dataDir;
+        passwordSaltFile = config.sops.secrets."wakapi/password_salt".path;
+        settings = {
+          server = {
+            port = 3111;
+            public_url = cfg.domain;
+          };
+          app = {
+            leaderboard_enabled = false;
+            leaderboard_require_auth = true;
+            inactive_days = 7; # time of previous days within a user must have logged in to be considered active
+            # go time format strings to format human-readable dates
+            # for details, check https://pkg.go.dev/time#Time.Format
+            date_format = "Mon, 02 Jan 2006";
+            datetime_format = "Mon, 02 Jan 2006 15:04";
+          };
+          db = {
+            socket = "/run/mysqld/mysqld.sock";
+            name = "wakapi";
+            dialect = "mysql";
+          };
+          security = {
+            insecure_cookies = false;
+            trust_reverse_proxy_ips = "127.0.0.1";
+          };
+          mail = {
+            # FIXME: Add email
+            enabled = false;
+            provider = "smtp";
+            sender = "<Wakapi ${cfg.email}>";
+            smtp = {
+            };
+          };
+        };
+        database = {
+          dialect = "mysql";
+          createLocally = false;
+        };
+
+      };
+    }
+  );
+}