summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.nix8
-rw-r--r--hosts/apocalypse/default.nix2
-rw-r--r--hosts/omega-relay/default.nix141
-rw-r--r--hosts/omega-relay/disko.nix79
-rw-r--r--hosts/omega-relay/firewall.nix9
-rw-r--r--hosts/omega-relay/vm.nix34
-rw-r--r--modules/default.nix4
-rw-r--r--modules/desktop/wayland.nix1
-rw-r--r--modules/virt.nix2
-rw-r--r--services/email.nix246
-rw-r--r--services/freshrss.nix143
-rw-r--r--services/mysql.nix28
-rw-r--r--services/uptimekuma.nix84
-rw-r--r--services/vaultwarden.nix126
-rw-r--r--services/wakapi.nix184
-rw-r--r--users/wilkuu-server.nix8
16 files changed, 579 insertions, 520 deletions
diff --git a/flake.nix b/flake.nix
index aacd740..439593a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,7 +9,7 @@
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";
};
-
+
disko = {
url = "github:nix-community/disko/latest";
inputs.nixpkgs.follows = "nixpkgs";
@@ -110,7 +110,7 @@
};
omega-relay = nixpkgs.lib.nixosSystem {
specialArgs = {
- inherit inputs;
+ inherit inputs;
};
system = "x86_64-linux";
modules = [
@@ -120,9 +120,9 @@
inputs.home-manager.nixosModules.default
disko.nixosModules.disko
inputs.sops-nix.nixosModules.sops
- ];
+ ];
- };
+ };
vm-shell = nixpkgs.lib.nixosSystem {
specialArgs = {
inherit inputs;
diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix
index 6882cbb..09aed91 100644
--- a/hosts/apocalypse/default.nix
+++ b/hosts/apocalypse/default.nix
@@ -10,7 +10,7 @@
## TODO REMOVE LATER TO PREVENT ELI FROM BUILDING REMOTELY
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
networking.hosts = {
- "127.0.0.1" = ["omega-relay.local"];
+ "127.0.0.1" = [ "omega-relay.local" ];
};
## Addons for this system
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 4154e2c..17af116 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -1,22 +1,27 @@
-{ pkgs, lib, config, ...}: {
+{
+ pkgs,
+ lib,
+ config,
+ ...
+}:
+{
imports = [
- ./firewall.nix
- ./disko.nix
- ./vm.nix
- ../../services/mysql.nix
- ../../services/email.nix
- ../../services/vaultwarden.nix
- ../../services/uptimekuma.nix
- ../../services/freshrss.nix
- ../../services/wakapi.nix
+ ./firewall.nix
+ ./disko.nix
+ ./vm.nix
+ ../../services/mysql.nix
+ ../../services/email.nix
+ ../../services/vaultwarden.nix
+ ../../services/uptimekuma.nix
+ ../../services/freshrss.nix
+ ../../services/wakapi.nix
];
-
addons = {
- desktop.hyprland.enable = lib.mkForce false;
- # desktop.cosmic.enable = lib.mkForce false;
- desktop.xfce.enable = lib.mkForce false;
-
+ desktop.hyprland.enable = lib.mkForce false;
+ # desktop.cosmic.enable = lib.mkForce false;
+ desktop.xfce.enable = lib.mkForce false;
+
gpg.enable = true;
};
boot.loader.grub = {
@@ -27,66 +32,73 @@
environment.systemPackages = with pkgs; [
lynx
chawan
- ];
+ ];
- wilkuu.services = let
- isVM = config.addons.virtualisation.isTestVM;
- in {
- stalwart = {
- enable = true;
- domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
- doACME = !isVM;
- };
+ wilkuu.services =
+ let
+ isVM = config.addons.virtualisation.isTestVM;
+ in
+ {
+ stalwart = {
+ enable = true;
+ domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
+ doACME = !isVM;
+ };
- vaultwarden = {
- enable = true;
- signupWhitelist = ["wilkuu.xyz" "omega-relay.local"];
- backupDir = "/srv/data/vaultwarden";
- domain = if isVM then "vaultwarden.omega-relay.local" else "vaultwarden.wilkuu.xyz";
- doACME = !isVM;
- };
- uptimekuma = {
- enable = true;
- domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz";
- dataDir = "/srv/data/uptimekuma";
- doACME = !isVM;
- };
- freshrss = {
- enable = true;
- domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz";
- doACME = !isVM;
- };
- wakapi = {
- enable = true;
- domain = if isVM then "wakapi.omega-relay.local" else "wakapi.wilkuu.xyz";
- doACME = !isVM;
+ vaultwarden = {
+ enable = true;
+ signupWhitelist = [
+ "wilkuu.xyz"
+ "omega-relay.local"
+ ];
+ backupDir = "/srv/data/vaultwarden";
+ domain = if isVM then "vaultwarden.omega-relay.local" else "vaultwarden.wilkuu.xyz";
+ doACME = !isVM;
+ };
+ uptimekuma = {
+ enable = true;
+ domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz";
+ dataDir = "/srv/data/uptimekuma";
+ doACME = !isVM;
+ };
+ freshrss = {
+ enable = true;
+ domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz";
+ doACME = !isVM;
+ };
+ wakapi = {
+ enable = true;
+ domain = if isVM then "wakapi.omega-relay.local" else "wakapi.wilkuu.xyz";
+ doACME = !isVM;
+ };
};
- };
# TODO: Make a nginx module
security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) {
acceptTerms = true;
defaults.email = "jakub@wilkuu.xyz";
};
- services.nginx = let
- isVM = config.addons.virtualisation.isTestVM;
- domain = if isVM then "omega-relay.local" else "wilkuu.xyz";
- in {
- enable = true;
- virtualHosts."${domain}" = {
- enableACME = !isVM;
- addSSL = !isVM;
- locations."/" = {
- root = "/srv/www/wilkuu.xyz/";
- index = "index.html";
- tryFiles = "$uri $uri/ =404";
- };
+ services.nginx =
+ let
+ isVM = config.addons.virtualisation.isTestVM;
+ domain = if isVM then "omega-relay.local" else "wilkuu.xyz";
+ in
+ {
+ enable = true;
+ virtualHosts."${domain}" = {
+ enableACME = !isVM;
+ addSSL = !isVM;
+ locations."/" = {
+ root = "/srv/www/wilkuu.xyz/";
+ index = "index.html";
+ tryFiles = "$uri $uri/ =404";
+ };
+ };
};
- };
- networking.hostName = "omega-relay";
+ networking.hostName = "omega-relay";
services.resolved = {
- enable = true;
+ enable = true;
dnsovertls = "opportunistic";
};
@@ -104,7 +116,4 @@
};
};
-
-
-
}
diff --git a/hosts/omega-relay/disko.nix b/hosts/omega-relay/disko.nix
index 9694e2a..307f6de 100644
--- a/hosts/omega-relay/disko.nix
+++ b/hosts/omega-relay/disko.nix
@@ -1,52 +1,53 @@
-{pkgs, config, lib, ...}: {
+{ config, lib, ... }:
+{
config = lib.mkIf (!config.addons.virtualisation.isTestVM) ({
- services.btrfs.autoScrub = {
- enable = true;
- interval = "weekly";
- };
+ services.btrfs.autoScrub = {
+ enable = true;
+ interval = "weekly";
+ };
- boot.loader.grub.device = "/dev/sda";
- # Workaround
- boot.loader.grub.devices = lib.mkForce ["/dev/sda"];
- boot.loader.efi.canTouchEfiVariables = false;
+ boot.loader.grub.device = "/dev/sda";
+ # Workaround
+ boot.loader.grub.devices = lib.mkForce [ "/dev/sda" ];
+ boot.loader.efi.canTouchEfiVariables = false;
- # TODO: Mount points
+ # TODO: Mount points
- # Disko for formatting
- disko.devices = {
- disk = {
- main-disk = {
- device = "/dev/sda";
- type = "disk";
- content = {
- type = "gpt";
- partitions = {
- BOOT = {
- type = "EF02";
- size = "1M";
- };
- ESP = {
- type = "EF00";
- size = "128M";
- content = {
- type = "filesystem";
- format = "vfat";
- mountpoint = "/boot";
- mountOptions = [ "umask=0077" ];
- };
+ # Disko for formatting
+ disko.devices = {
+ disk = {
+ main-disk = {
+ device = "/dev/sda";
+ type = "disk";
+ content = {
+ type = "gpt";
+ partitions = {
+ BOOT = {
+ type = "EF02";
+ size = "1M";
+ };
+ ESP = {
+ type = "EF00";
+ size = "128M";
+ content = {
+ type = "filesystem";
+ format = "vfat";
+ mountpoint = "/boot";
+ mountOptions = [ "umask=0077" ];
};
- root = {
- size = "100%";
- content = {
- type = "filesystem";
- format = "btrfs";
- mountpoint = "/";
- };
+ };
+ root = {
+ size = "100%";
+ content = {
+ type = "filesystem";
+ format = "btrfs";
+ mountpoint = "/";
};
};
};
};
};
};
+ };
});
}
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index 6311337..360e7da 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,7 +1,14 @@
{ ... }:
let
baseTCP = [
- 20 22 25 80 143 443 993 465
+ 20
+ 22
+ 25
+ 80
+ 143
+ 443
+ 993
+ 465
];
baseUDP = [
16555 # Wireguard
diff --git a/hosts/omega-relay/vm.nix b/hosts/omega-relay/vm.nix
index 06310f9..6672949 100644
--- a/hosts/omega-relay/vm.nix
+++ b/hosts/omega-relay/vm.nix
@@ -1,20 +1,22 @@
-{lib, config,...}: let
- forward = proto: gport: hport: {
- from = "host";
- proto = proto;
- host = {
- port = hport;
+{ ... }:
+let
+ forward = proto: gport: hport: {
+ from = "host";
+ proto = proto;
+ host = {
+ port = hport;
# address = "10.0.69.1";
};
- guest = {
- port = gport;
+ guest = {
+ port = gport;
# address = "10.0.69.2";
};
};
-in {
- # TODO: Make this into a more global module.
+in
+{
+ # TODO: Make this into a more global module.
virtualisation.vmVariant = {
- addons.virtualisation.isTestVM = true;
+ addons.virtualisation.isTestVM = true;
addons.virtualisation.guest = true;
fileSystems."/" = {
device = "none";
@@ -25,14 +27,14 @@ in {
"mode=755"
];
};
- virtualisation = {
+ virtualisation = {
forwardPorts = [
- (forward "tcp" 80 9080)
+ (forward "tcp" 80 9080)
(forward "tcp" 443 9443)
(forward "tcp" 143 9143)
- (forward "tcp" 25 9025)
- (forward "tcp" 22 9022)
- ];
+ (forward "tcp" 25 9025)
+ (forward "tcp" 22 9022)
+ ];
memorySize = 2048; # Use 2048MiB memory.
cores = 3;
graphics = false;
diff --git a/modules/default.nix b/modules/default.nix
index 90f65d8..4b433c8 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -60,9 +60,9 @@
# options = "--delete-older-than 30d";
# };
zramSwap = {
- enable = true;
+ enable = true;
algorithm = "lz4";
- memoryPercent = 50;
+ memoryPercent = 50;
};
systemd.services.nix-daemon.serviceConfig = {
MemoryAccounting = true;
diff --git a/modules/desktop/wayland.nix b/modules/desktop/wayland.nix
index 457a7f0..0a6a0e5 100644
--- a/modules/desktop/wayland.nix
+++ b/modules/desktop/wayland.nix
@@ -1,5 +1,4 @@
{
- pkgs,
lib,
config,
...
diff --git a/modules/virt.nix b/modules/virt.nix
index 7799bff..01547b4 100644
--- a/modules/virt.nix
+++ b/modules/virt.nix
@@ -11,7 +11,7 @@ in
options.addons.virtualisation = {
host = lib.mkEnableOption "Allow to host vm's and containers";
guest = lib.mkEnableOption "Enable guest agents";
- isTestVM = lib.mkEnableOption "Enabled if the system is a test VM";
+ isTestVM = lib.mkEnableOption "Enabled if the system is a test VM";
};
config = lib.mkMerge ([
diff --git a/services/email.nix b/services/email.nix
index d3f60ab..5fbd04a 100644
--- a/services/email.nix
+++ b/services/email.nix
@@ -1,142 +1,164 @@
-{config, pkgs, lib, ...}:
+{ config, lib, ... }:
let
- cfg = config.wilkuu.services.stalwart;
- hostname = config.networking.hostName;
-in
+ cfg = config.wilkuu.services.stalwart;
+ hostname = config.networking.hostName;
+in
{
options.wilkuu.services.stalwart = with lib; {
domain = mkOption {
- type = types.str;
- default = "mail.${hostname}.local";
- example = "mail.wilkuu.xyz";
- description = "Domain for http connections.";
- };
+ type = types.str;
+ default = "mail.${hostname}.local";
+ example = "mail.wilkuu.xyz";
+ description = "Domain for http connections.";
+ };
wellKnownDomains = mkOption {
- type = types.listOf types.str;
- default = [ "${hostname}.local" ];
- example = [ "wilkuu.xyz"] ;
+ type = types.listOf types.str;
+ default = [ "${hostname}.local" ];
+ example = [ "wilkuu.xyz" ];
description = "Domain for well-known items";
};
doACME = mkEnableOption "Enable ACME for stalwart here";
- enable = mkEnableOption "Enable the email service";
- dataDir = mkOption {
- type = types.path;
- description = "Storage localtion for Stalwart user data";
- default = "/srv/data/stalwart";
- example = "/srv/data/stalwart";
- };
- };
+ enable = mkEnableOption "Enable the email service";
+ dataDir = mkOption {
+ type = types.path;
+ description = "Storage localtion for Stalwart user data";
+ default = "/srv/data/stalwart";
+ example = "/srv/data/stalwart";
+ };
+ };
- config = lib.mkIf cfg.enable (let
- sopsPath = ../secrets/${hostname}/stalwart.yaml;
- secrets = ["user_admin_password"];
- toSops = (sname: "stalwart/${sname}");
- toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
+ config = lib.mkIf cfg.enable (
+ let
+ sopsPath = ../secrets/${hostname}/stalwart.yaml;
+ secrets = [ "user_admin_password" ];
+ toSops = (sname: "stalwart/${sname}");
+ toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
toStalwartCred = name: "%{file:/run/credentials/stalwart-mail.service/${name}}%";
-
- basicListener = proto: port: tls: {
- bind = ["[::]:${toString port}"];
- protocol = proto;
- tls.implicit = tls;
- };
- proxyWellKnown = names: let
- uris = map (n: "/.well-known/${n}") names;
- in (lib.genAttrs uris (uri: {
- proxyPass = "http://localhost:3080${uri}";
- recommendedProxySettings = true;
- }));
+ basicListener = proto: port: tls: {
+ bind = [ "[::]:${toString port}" ];
+ protocol = proto;
+ tls.implicit = tls;
+ };
+
+ proxyWellKnown =
+ names:
+ let
+ uris = map (n: "/.well-known/${n}") names;
+ in
+ (lib.genAttrs uris (uri: {
+ proxyPass = "http://localhost:3080${uri}";
+ recommendedProxySettings = true;
+ }));
- makeHttpRedirect = target: https: { return = "302 ${if https then "https" else "http"}://${target}";};
+ makeHttpRedirect = target: https: {
+ return = "302 ${if https then "https" else "http"}://${target}";
+ };
- in {
- networking.hosts = {
- "127.0.0.1" = [cfg.domain];
- };
+ in
+ {
+ networking.hosts = {
+ "127.0.0.1" = [ cfg.domain ];
+ };
- # Need this bc otherwise sops will complain for some reason
- users = {
+ # Need this bc otherwise sops will complain for some reason
+ users = {
groups.stalwart-mail = { };
users.stalwart-mail = {
isSystemUser = true;
group = "stalwart-mail";
};
- };
-
-
- # TODO: Move this into a util function or option;
- sops.secrets =
- (lib.genAttrs (map toSops secrets)
- (name: {
- sopsFile = sopsPath;
- mode = "0440";
- owner = "stalwart-mail";
- }));
+ };
+ # TODO: Move this into a util function or option;
+ sops.secrets = (
+ lib.genAttrs (map toSops secrets) (_name: {
+ sopsFile = sopsPath;
+ mode = "0440";
+ owner = "stalwart-mail";
+ })
+ );
- services.nginx.virtualHosts = (lib.genAttrs cfg.wellKnownDomains (
- (wdomain: {
- locations = (proxyWellKnown ["jmap" "mta-sts.txt" "mail-v1.xml" "autoconfig/mail"])
- // (lib.genAttrs ["/.well_known/caldav" "/.well_known/webdav" ] (uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME ));
- })))
- //
+ services.nginx.virtualHosts =
+ (lib.genAttrs cfg.wellKnownDomains (
+ (_wdomain: {
+ locations =
+ (proxyWellKnown [
+ "jmap"
+ "mta-sts.txt"
+ "mail-v1.xml"
+ "autoconfig/mail"
+ ])
+ // (lib.genAttrs [ "/.well_known/caldav" "/.well_known/webdav" ] (
+ uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME
+ ));
+ })
+ ))
+ //
- (lib.genAttrs (map (x: "${x}${cfg.domain}") ["" "autodiscover." "autoconfig."]) (domain: {
- addSSL = cfg.doACME;
- enableACME = cfg.doACME;
- serverName = "${domain}";
- locations."/" = {
- proxyPass = "http://localhost:3080";
- recommendedProxySettings = true;
- };
- }));
+ (lib.genAttrs
+ (map (x: "${x}${cfg.domain}") [
+ ""
+ "autodiscover."
+ "autoconfig."
+ ])
+ (domain: {
+ addSSL = cfg.doACME;
+ enableACME = cfg.doACME;
+ serverName = "${domain}";
+ locations."/" = {
+ proxyPass = "http://localhost:3080";
+ recommendedProxySettings = true;
+ };
+ })
+ );
-
- services.stalwart-mail = {
- enable = true;
- dataDir = cfg.dataDir;
- openFirewall = false;
- credentials = lib.genAttrs secrets toCredfilePath;
- settings = {
- server.listener = {
- smtp = basicListener "smtp" 25 false;
- submission = basicListener "smtp" 465 true;
- imaptls = basicListener "imap" 993 true;
- imap = basicListener "imap" 143 true;
- webdav = basicListener "http" 3080 false;
- jmap = basicListener "http" 3080 false;
- http = basicListener "http" 3080 false;
- };
+ services.stalwart-mail = {
+ enable = true;
+ dataDir = cfg.dataDir;
+ openFirewall = false;
+ credentials = lib.genAttrs secrets toCredfilePath;
+ settings = {
+ server.listener = {
+ smtp = basicListener "smtp" 25 false;
+ submission = basicListener "smtp" 465 true;
+ imaptls = basicListener "imap" 993 true;
+ imap = basicListener "imap" 143 true;
+ webdav = basicListener "http" 3080 false;
+ jmap = basicListener "http" 3080 false;
+ http = basicListener "http" 3080 false;
+ };
- store.rocksdb = {
- type = "rocksdb";
- path = cfg.dataDir;
- compression = "lz4";
- };
+ store.rocksdb = {
+ type = "rocksdb";
+ path = cfg.dataDir;
+ compression = "lz4";
+ };
- directory.internal = {
- type = "internal";
- store = "rocksdb";
- };
+ directory.internal = {
+ type = "internal";
+ store = "rocksdb";
+ };
- storage = {
- data = "rocksdb";
- fts = "rocksdb";
- blob = "rocksdb";
- lookup = "rocksdb";
- directory = "internal";
- };
+ storage = {
+ data = "rocksdb";
+ fts = "rocksdb";
+ blob = "rocksdb";
+ lookup = "rocksdb";
+ directory = "internal";
+ };
- authentication.fallback-admin = {
- user = "admin";
- secret = toStalwartCred "user_admin_password";
- };
+ authentication.fallback-admin = {
+ user = "admin";
+ secret = toStalwartCred "user_admin_password";
+ };
- http = {
- use-x-forwarded = true;
- url = "protocol + \"${cfg.domain}\"";
- };
+ http = {
+ use-x-forwarded = true;
+ url = "protocol + \"${cfg.domain}\"";
+ };
+ };
};
- };
- });
+ }
+ );
}
diff --git a/services/freshrss.nix b/services/freshrss.nix
index 0b66755..acb1770 100644
--- a/services/freshrss.nix
+++ b/services/freshrss.nix
@@ -1,81 +1,92 @@
-{config, lib, pkgs, ...}:
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}:
let
- cfg = config.wilkuu.services.freshrss;
- hostname = config.networking.hostName;
-in
+ cfg = config.wilkuu.services.freshrss;
+ hostname = config.networking.hostName;
+in
{
options.wilkuu.services.freshrss = with lib; {
domain = mkOption {
- type = types.str;
- default = "rss.${hostname}.local";
- example = "rss.wilkuu.xyz";
- description = "Domain for http connections.";
- };
+ type = types.str;
+ default = "rss.${hostname}.local";
+ example = "rss.wilkuu.xyz";
+ description = "Domain for http connections.";
+ };
doACME = mkEnableOption "Enable ACME for fresh-rss here";
- enable = mkEnableOption "Enable the fresh-rss service";
- dataDir = mkOption {
- type = types.path;
- description = "Storage localtion for fresh-rss data";
- default = "/srv/data/freshrss";
- example = "/srv/data/freshrss";
- };
+ enable = mkEnableOption "Enable the fresh-rss service";
+ dataDir = mkOption {
+ type = types.path;
+ description = "Storage localtion for fresh-rss data";
+ default = "/srv/data/freshrss";
+ example = "/srv/data/freshrss";
+ };
};
- config = lib.mkIf cfg.enable (let
- sopsPath = ../secrets/${hostname}/freshrss.yaml;
- secrets = ["admin_password" "db_pass"];
- toSops = (sname: "fresh-rss/${sname}");
- in {
- networking.hosts = {
- "127.0.0.1" = [cfg.domain];
- };
+ config = lib.mkIf cfg.enable (
+ let
+ sopsPath = ../secrets/${hostname}/freshrss.yaml;
+ secrets = [
+ "admin_password"
+ "db_pass"
+ ];
+ toSops = (sname: "fresh-rss/${sname}");
+ in
+ {
+ networking.hosts = {
+ "127.0.0.1" = [ cfg.domain ];
+ };
- sops.secrets =
- (lib.genAttrs (map toSops secrets)
- (name: {
- sopsFile = sopsPath;
- mode = "0440";
- owner = config.services.freshrss.user;
- }));
+ sops.secrets = (
+ lib.genAttrs (map toSops secrets) (_name: {
+ sopsFile = sopsPath;
+ mode = "0440";
+ owner = config.services.freshrss.user;
+ })
+ );
- services.nginx.virtualHosts."${cfg.domain}" = {
- addSSL = cfg.doACME;
- enableACME = cfg.doACME;
- };
-
- wilkuu.services.mysql = {
- enable = true;
- users."freshrss" = {
- sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
+ services.nginx.virtualHosts."${cfg.domain}" = {
+ addSSL = cfg.doACME;
+ enableACME = cfg.doACME;
};
- databases."freshrss" = {
- enable = true;
- allowedUsers = ["freshrss"];
+
+ wilkuu.services.mysql = {
+ enable = true;
+ users."freshrss" = {
+ sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
+ };
+ databases."freshrss" = {
+ enable = true;
+ allowedUsers = [ "freshrss" ];
+ };
};
- };
- services.freshrss = {
- enable = true;
- # api.enable = true;
- dataDir = cfg.dataDir;
- baseUrl = "https://${cfg.domain}";
- extensions = with pkgs.freshrss-extensions; [
- youtube
- title-wrap
- auto-ttl
- reading-time
- ];
- passwordFile = config.sops.secrets."fresh-rss/admin_password".path;
- virtualHost = cfg.domain;
- database = {
- passFile = config.sops.secrets."fresh-rss/db_pass".path;
- host = "localhost";
- port = config.wilkuu.services.mysql.port;
- name = "freshrss";
- user = "freshrss";
- type = "mysql";
+ services.freshrss = {
+ enable = true;
+ # api.enable = true;
+ dataDir = cfg.dataDir;
+ baseUrl = "https://${cfg.domain}";
+ extensions = with pkgs.freshrss-extensions; [
+ youtube
+ title-wrap
+ auto-ttl
+ reading-time
+ ];
+ passwordFile = config.sops.secrets."fresh-rss/admin_password".path;
+ virtualHost = cfg.domain;
+ database = {
+ passFile = config.sops.secrets."fresh-rss/db_pass".path;
+ host = "localhost";
+ port = config.wilkuu.services.mysql.port;
+ name = "freshrss";
+ user = "freshrss";
+ type = "mysql";
+ };
};
- };
- });
+ }
+ );
}
diff --git a/services/mysql.nix b/services/mysql.nix
index 8a7b5e2..92db5f7 100644
--- a/services/mysql.nix
+++ b/services/mysql.nix
@@ -30,14 +30,15 @@ let
)
else
" -- Ommitted user ${name}";
-
+
add-unix-user-clauses =
- name: ''
- -- Clauses for user ${name}
- ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket';
- CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket';
- ''
- + (lib.concatMapAttrsStringSep "\n" (priviledge_clause name) (create_users_ensure name));
+ name:
+ ''
+ -- Clauses for user ${name}
+ ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket';
+ CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket';
+ ''
+ + (lib.concatMapAttrsStringSep "\n" (priviledge_clause name) (create_users_ensure name));
in
{
@@ -87,10 +88,10 @@ in
default = { };
};
unix_users = lib.mkOption {
- type = lib.types.listOf lib.types.str;
+ type = lib.types.listOf lib.types.str;
description = "Users that can identify using the unix socket";
- default = [];
- example = ["wakapi"];
+ default = [ ];
+ example = [ "wakapi" ];
};
};
# config.sops.secrets = lib.mkIf cfg.enable {
@@ -100,7 +101,12 @@ in
# };
config.sops.templates."init-mysql" = {
owner = config.systemd.services.mysql.serviceConfig.User;
- content = (lib.concatLines ((builtins.attrValues (builtins.mapAttrs add-user-clauses cfg.users)) ++ (map add-unix-user-clauses cfg.unix_users)));
+ content = (
+ lib.concatLines (
+ (builtins.attrValues (builtins.mapAttrs add-user-clauses cfg.users))
+ ++ (map add-unix-user-clauses cfg.unix_users)
+ )
+ );
};
config.services.mysql = {
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
index 4cdd5f2..1ac6006 100644
--- a/services/uptimekuma.nix
+++ b/services/uptimekuma.nix
@@ -1,78 +1,76 @@
-{config, lib, pkgs, ...}:
+{ config, lib, ... }:
let
- cfg = config.wilkuu.services.uptimekuma;
- hostname = config.networking.hostName;
-in
+ cfg = config.wilkuu.services.uptimekuma;
+ hostname = config.networking.hostName;
+in
{
options.wilkuu.services.uptimekuma = with lib; {
domain = mkOption {
- type = types.str;
- default = "uptime.${hostname}.local";
- example = "uptime.wilkuu.xyz";
- description = "Domain for http connections.";
- };
+ type = types.str;
+ default = "uptime.${hostname}.local";
+ example = "uptime.wilkuu.xyz";
+ description = "Domain for http connections.";
+ };
doACME = mkEnableOption "Enable ACME for uptime kuma here";
- enable = mkEnableOption "Enable the uptime-kuma service";
- dataDir = mkOption {
- type = types.path;
- description = "Storage localtion for uptime kuma data, currently ignored, because nixpkgs sucks";
- default = "/srv/data/uptimekuma";
- example = "/srv/data/uptimekuma";
- };
+ enable = mkEnableOption "Enable the uptime-kuma service";
+ dataDir = mkOption {
+ type = types.path;
+ description = "Storage localtion for uptime kuma data, currently ignored, because nixpkgs sucks";
+ default = "/srv/data/uptimekuma";
+ example = "/srv/data/uptimekuma";
+ };
};
- config = lib.mkIf cfg.enable (let
- # sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
- # secrets = [];
- # toSops = (sname: "uptime-kuma/${sname}");
- in {
- networking.hosts = {
- "127.0.0.1" = [cfg.domain];
- };
+ config = lib.mkIf cfg.enable ({
+ networking.hosts = {
+ "127.0.0.1" = [ cfg.domain ];
+ };
users.users.uptimekuma = {
isSystemUser = true;
group = "uptimekuma";
};
- users.groups.uptimekuma = {};
+ users.groups.uptimekuma = { };
systemd.services.uptime-kuma.serviceConfig.User = "uptimekuma";
- # sops.secrets =
- # (lib.genAttrs (map toSops secrets)
+ # sops.secrets =
+ # (lib.genAttrs (map toSops secrets)
# (name: {
- # sopsFile = sopsPath;
- # mode = "0440";
- # owner = "uptime-kuma";
- # }));
+ # sopsFile = sopsPath;
+ # mode = "0440";
+ # owner = "uptime-kuma";
+ # }));
services.nginx.virtualHosts."${cfg.domain}" = {
- addSSL = cfg.doACME;
+ addSSL = cfg.doACME;
enableACME = cfg.doACME;
locations."/" = {
- proxyPass = "http://localhost:3111";
+ proxyPass = "http://localhost:3111";
recommendedProxySettings = true;
};
};
- wilkuu.services.mysql = let
- user = config.systemd.services.uptime-kuma.serviceConfig.User;
- in {
- unix_users = [user];
- databases.uptimekuma = {
- enable = true;
- allowedUsers = [user];
+ wilkuu.services.mysql =
+ let
+ user = config.systemd.services.uptime-kuma.serviceConfig.User;
+ in
+ {
+ unix_users = [ user ];
+ databases.uptimekuma = {
+ enable = true;
+ allowedUsers = [ user ];
+ };
};
- };
services.uptime-kuma = {
enable = true;
settings = {
UPTIME_KUMA_PORT = "3111";
- UPTIME_KUMA_HOST="127.0.0.1";
+ UPTIME_KUMA_HOST = "127.0.0.1";
UPTIME_KUMA_DB_TYPE = "sqlite";
UPTIME_KUMA_DB_SOCKET = "/var/lib/mysql/mysql.sock";
};
};
- });
+ });
}
diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
index f68a2fa..4aa24ba 100644
--- a/services/vaultwarden.nix
+++ b/services/vaultwarden.nix
@@ -1,76 +1,78 @@
-{config, pkgs, lib, ...}:
+{ config, lib, ... }:
let
- cfg = config.wilkuu.services.vaultwarden;
- hostname = config.networking.hostName;
-in
+ cfg = config.wilkuu.services.vaultwarden;
+ hostname = config.networking.hostName;
+in
{
options.wilkuu.services.vaultwarden = with lib; {
domain = mkOption {
- type = types.str;
- default = "bitwarden.${hostname}.local";
- example = "bitwarden.wilkuu.xyz";
- description = "Domain for http connections.";
- };
+ type = types.str;
+ default = "bitwarden.${hostname}.local";
+ example = "bitwarden.wilkuu.xyz";
+ description = "Domain for http connections.";
+ };
doACME = mkEnableOption "Enable ACME for vaultwarden here";
- enable = mkEnableOption "Enable the vaultwarden service";
- backupDir = mkOption {
- type = types.path;
- description = "Storage localtion for Vaultwarden user data backup";
- default = "/srv/data/vaultwarden";
- example = "/srv/data/vaultwarden";
- };
+ enable = mkEnableOption "Enable the vaultwarden service";
+ backupDir = mkOption {
+ type = types.path;
+ description = "Storage localtion for Vaultwarden user data backup";
+ default = "/srv/data/vaultwarden";
+ example = "/srv/data/vaultwarden";
+ };
signupWhitelist = mkOption {
- type = types.listOf types.str;
- default = [];
- example = ["wilkuu.xyz"];
+ type = types.listOf types.str;
+ default = [ ];
+ example = [ "wilkuu.xyz" ];
description = "Domains that can sign up on vaultwarden";
- };
+ };
};
- config = lib.mkIf cfg.enable (let
- sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
- secrets = ["admin_token"];
- toSops = (sname: "vaultwarden/${sname}");
- toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
- in {
- networking.hosts = {
- "127.0.0.1" = [cfg.domain];
- };
+ config = lib.mkIf cfg.enable (
+ let
+ sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
+ secrets = [ "admin_token" ];
+ toSops = (sname: "vaultwarden/${sname}");
+ in
+ {
+ networking.hosts = {
+ "127.0.0.1" = [ cfg.domain ];
+ };
+
+ sops.secrets = (
+ lib.genAttrs (map toSops secrets) (_name: {
+ sopsFile = sopsPath;
+ mode = "0440";
+ owner = "vaultwarden";
+ })
+ );
- sops.secrets =
- (lib.genAttrs (map toSops secrets)
- (name: {
- sopsFile = sopsPath;
- mode = "0440";
- owner = "vaultwarden";
- }));
+ sops.templates.vaultwardenEnvFile.content = ''
+ ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
+ '';
- sops.templates.vaultwardenEnvFile.content = ''
- ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
- '';
-
- services.nginx.virtualHosts."${cfg.domain}" = {
- enableACME = cfg.doACME;
- addSSL = cfg.doACME;
- locations."/" = {
- proxyPass = "http://localhost:3222";
- recommendedProxySettings = true;
+ services.nginx.virtualHosts."${cfg.domain}" = {
+ enableACME = cfg.doACME;
+ addSSL = cfg.doACME;
+ locations."/" = {
+ proxyPass = "http://localhost:3222";
+ recommendedProxySettings = true;
+ };
};
- };
- services.vaultwarden = {
- enable = cfg.enable;
- backupDir = "/srv/data/vaultwarden";
- config = {
- DOMAIN=cfg.domain;
- ROCKET_ADDRESS = "127.0.0.1";
- ROCKET_PORT ="3222";
- SIGNUPS_DOMAINS_WHITELIST=(lib.concatStringsSep "," cfg.signupWhitelist);
- SIGNUPS_ALLOWED="false";
- IP_HEADER="X-Forwarded-For";
- };
- environmentFile = config.sops.templates.vaultwardenEnvFile.path;
- };
-
- });
+ services.vaultwarden = {
+ enable = cfg.enable;
+ backupDir = "/srv/data/vaultwarden";
+ config = {
+ DOMAIN = cfg.domain;
+ ROCKET_ADDRESS = "127.0.0.1";
+ ROCKET_PORT = "3222";
+ SIGNUPS_DOMAINS_WHITELIST = (lib.concatStringsSep "," cfg.signupWhitelist);
+ SIGNUPS_ALLOWED = "false";
+ IP_HEADER = "X-Forwarded-For";
+ };
+ environmentFile = config.sops.templates.vaultwardenEnvFile.path;
+ };
+
+ }
+ );
}
diff --git a/services/wakapi.nix b/services/wakapi.nix
index 1b1e312..c89a46a 100644
--- a/services/wakapi.nix
+++ b/services/wakapi.nix
@@ -1,110 +1,112 @@
-{config, lib, pkgs, ...}:
+{ config, lib, ... }:
let
- cfg = config.wilkuu.services.wakapi;
- hostname = config.networking.hostName;
+ cfg = config.wilkuu.services.wakapi;
+ hostname = config.networking.hostName;
service_user = config.systemd.services.wakapi.serviceConfig.User;
-in
+in
{
options.wilkuu.services.wakapi = with lib; {
domain = mkOption {
- type = types.str;
- default = "wakapi.${hostname}.local";
- example = "wakapi.wilkuu.xyz";
- description = "Domain for http connections.";
- };
+ type = types.str;
+ default = "wakapi.${hostname}.local";
+ example = "wakapi.wilkuu.xyz";
+ description = "Domain for http connections.";
+ };
email = mkOption {
- type = types.str;
- default = "wakapi@${hostname}.local";
- example = "noreply@wilkuu.xyz";
- description = "Mailer address";
- };
+ type = types.str;
+ default = "wakapi@${hostname}.local";
+ example = "noreply@wilkuu.xyz";
+ description = "Mailer address";
+ };
doACME = mkEnableOption "Enable ACME for wakapi here";
- enable = mkEnableOption "Enable the wakapi service";
- dataDir = mkOption {
- type = types.path;
- description = "Storage localtion for wakapi data";
- default = "/srv/data/wakapi";
- example = "/srv/data/wakapi";
- };
+ enable = mkEnableOption "Enable the wakapi service";
+ dataDir = mkOption {
+ type = types.path;
+ description = "Storage localtion for wakapi data";
+ default = "/srv/data/wakapi";
+ example = "/srv/data/wakapi";
+ };
};
- config = lib.mkIf cfg.enable (let
- sopsPath = ../secrets/${hostname}/wakapi.yaml;
- secrets = ["password_salt"];
- toSops = (sname: "wakapi/${sname}");
- in {
- networking.hosts = {
- "127.0.0.1" = [cfg.domain];
- };
+ config = lib.mkIf cfg.enable (
+ let
+ sopsPath = ../secrets/${hostname}/wakapi.yaml;
+ secrets = [ "password_salt" ];
+ toSops = (sname: "wakapi/${sname}");
+ in
+ {
+ networking.hosts = {
+ "127.0.0.1" = [ cfg.domain ];
+ };
- sops.secrets =
- (lib.genAttrs (map toSops secrets)
- (name: {
- sopsFile = sopsPath;
- mode = "0440";
- owner = service_user;
- }));
+ sops.secrets = (
+ lib.genAttrs (map toSops secrets) (_name: {
+ sopsFile = sopsPath;
+ mode = "0440";
+ owner = service_user;
+ })
+ );
- services.nginx.virtualHosts."${cfg.domain}" = {
- enableACME = cfg.doACME;
- addSSL = cfg.doACME;
- locations."/" = {
- proxyPass = "http://localhost:3111";
- recommendedProxySettings = true;
+ services.nginx.virtualHosts."${cfg.domain}" = {
+ enableACME = cfg.doACME;
+ addSSL = cfg.doACME;
+ locations."/" = {
+ proxyPass = "http://localhost:3111";
+ recommendedProxySettings = true;
+ };
};
- };
- wilkuu.services.mysql = let
- in {
- unix_users = [service_user];
- databases.wakapi = {
- enable = true;
- allowedUsers = [service_user];
+ wilkuu.services.mysql = {
+ unix_users = [ service_user ];
+ databases.wakapi = {
+ enable = true;
+ allowedUsers = [ service_user ];
+ };
};
- };
- services.wakapi = {
- enable = true;
- stateDir = cfg.dataDir;
- passwordSaltFile = config.sops.secrets.wakapi/password_salt;
- settings = {
- server = {
- port = 3111;
- public_url = cfg.domain;
- };
- app = {
- leaderboard_enabled = false;
- leaderboard_require_auth = true;
- inactive_days = 7; # time of previous days within a user must have logged in to be considered active
- # go time format strings to format human-readable dates
- # for details, check https://pkg.go.dev/time#Time.Format
- date_format= "Mon, 02 Jan 2006";
- datetime_format= "Mon, 02 Jan 2006 15:04";
- };
- db = {
- socket= "/var/lib/mysql/mysql.sock";
- name = "wakapi";
- dialect = "mysql";
- charset = "utf8mb4";
+ services.wakapi = {
+ enable = true;
+ stateDir = cfg.dataDir;
+ passwordSaltFile = config.sops.secrets.wakapi/password_salt;
+ settings = {
+ server = {
+ port = 3111;
+ public_url = cfg.domain;
+ };
+ app = {
+ leaderboard_enabled = false;
+ leaderboard_require_auth = true;
+ inactive_days = 7; # time of previous days within a user must have logged in to be considered active
+ # go time format strings to format human-readable dates
+ # for details, check https://pkg.go.dev/time#Time.Format
+ date_format = "Mon, 02 Jan 2006";
+ datetime_format = "Mon, 02 Jan 2006 15:04";
+ };
+ db = {
+ socket = "/var/lib/mysql/mysql.sock";
+ name = "wakapi";
+ dialect = "mysql";
+ charset = "utf8mb4";
+ };
+ security = {
+ insecure_cookies = false;
+ trust_reverse_proxy_ips = "127.0.0.1";
+ };
+ mail = {
+ # FIXME: Add email
+ enabled = false;
+ provider = "smtp";
+ sender = "<Wakapi ${cfg.email}>";
+ smtp = {
+ };
+ };
};
- security = {
- insecure_cookies = false;
- trust_reverse_proxy_ips= "127.0.0.1";
+ database = {
+ dialect = "mysql";
+ createLocally = false;
};
- mail = {
- # FIXME: Add email
- enabled = false;
- provider = "smtp";
- sender = "<Wakapi ${cfg.email}>";
- smtp = {
- };
- };
- };
- database = {
- dialect = "mysql";
- createLocally = false;
+
};
-
- };
- });
+ }
+ );
}
diff --git a/users/wilkuu-server.nix b/users/wilkuu-server.nix
index ba5fec2..d53fc50 100644
--- a/users/wilkuu-server.nix
+++ b/users/wilkuu-server.nix
@@ -9,7 +9,7 @@
programs.adb.enable = true;
users.users.wilkuu = {
shell = pkgs.zsh;
- openssh.authorizedKeys.keyFiles = [../certs/wilkuu_rsa.pub ];
+ openssh.authorizedKeys.keyFiles = [ ../certs/wilkuu_rsa.pub ];
isNormalUser = true;
initialPassword = "PleazeChangeThis123";
extraGroups = [
@@ -30,9 +30,9 @@
home-manager.users.wilkuu = {
imports = [ ../home-modules ];
- homeapps.presets = lib.genAttrs
- ["base" "utils" "browser"]
- (_: {enable = true; });
+ homeapps.presets = lib.genAttrs [ "base" "utils" "browser" ] (_: {
+ enable = true;
+ });
# homeapps.vnc = true;
# services.wayvnc = {
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-10 23:23:29 +0000