diff options
| -rw-r--r-- | .sops.yaml | 8 | ||||
| -rw-r--r-- | flake.lock | 38 | ||||
| -rw-r--r-- | flake.nix | 2 | ||||
| -rw-r--r-- | home-modules/apps/desktop/default.nix | 12 | ||||
| -rw-r--r-- | hosts/apocalypse/default.nix | 4 | ||||
| -rw-r--r-- | hosts/omega-relay/certs.nix | 32 | ||||
| -rw-r--r-- | hosts/omega-relay/default.nix | 31 | ||||
| -rw-r--r-- | hosts/omega-relay/firewall.nix | 2 | ||||
| -rw-r--r-- | hosts/tacitus/default.nix | 33 | ||||
| -rw-r--r-- | hosts/tacitus/network.nix | 1 | ||||
| -rw-r--r-- | modules/default.nix | 3 | ||||
| -rw-r--r-- | modules/mjmap.nix | 51 | ||||
| -rw-r--r-- | secrets/apocalypse/mjmap.scfg.bin | 19 | ||||
| -rw-r--r-- | secrets/tacitus/firefly_iii.yaml | 29 | ||||
| -rw-r--r-- | secrets/tacitus/kanboard.yaml | 26 | ||||
| -rw-r--r-- | secrets/tacitus/mjmap.scfg.bin | 18 | ||||
| -rw-r--r-- | services/firefly_iii.nix | 140 | ||||
| -rw-r--r-- | services/kanboard.nix | 61 |
18 files changed, 451 insertions, 59 deletions
@@ -8,22 +8,22 @@ keys: creation_rules: - - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/[^/]+\.(yaml|json|env|ini|bin)$ key_groups: age: - *admin_wilkuu - *server_apocalypse - - path_regex: secrets/apocalypse/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/apocalypse/[^/]+\.(yaml|json|env|ini|bin)$ age: - *admin_wilkuu - *server_apocalypse - - path_regex: secrets/omega-relay/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/omega-relay/[^/]+\.(yaml|json|env|ini|bin)$ age: - *admin_wilkuu - *virtserver_omega_relay - *vm_omega_relay - *server_omega_relay - - path_regex: secrets/tacitus/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/tacitus/[^/]+\.(yaml|json|env|ini|bin)$ age: - *admin_wilkuu - *server_tacitus @@ -145,11 +145,11 @@ ] }, "locked": { - "lastModified": 1782749631, - "narHash": "sha256-slFTUgDy0KTPA4LBAmC/9SngDq8GCPdX+ZR0yQHHN1E=", + "lastModified": 1783823409, + "narHash": "sha256-OI4IkRjRXa1e7hYmCGJDPDq5H/kPwhsyoS80cNUF9fI=", "owner": "nix-community", "repo": "home-manager", - "rev": "5d72a29fc36ac21adae6ae35568fe5ee6700850f", + "rev": "7566825d4652a1b885bd4ce65bd9e8def432fec9", "type": "github" }, "original": { @@ -160,11 +160,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1782467914, - "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", + "lastModified": 1783776592, + "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=", "owner": "nixos", "repo": "nixpkgs", - "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", + "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3", "type": "github" }, "original": { @@ -191,11 +191,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1782535326, - "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=", + "lastModified": 1783703440, + "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "714a5f8c4ead6b31148d829288440ed033ccc041", + "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283", "type": "github" }, "original": { @@ -207,16 +207,16 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1782535326, - "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=", + "lastModified": 1783224372, + "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "714a5f8c4ead6b31148d829288440ed033ccc041", + "rev": "d407951447dcd00442e97087bf374aad70c04cea", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-26.05", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } @@ -257,11 +257,11 @@ ] }, "locked": { - "lastModified": 1782165805, - "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=", + "lastModified": 1783174389, + "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", "owner": "Mic92", "repo": "sops-nix", - "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24", + "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", "type": "github" }, "original": { @@ -276,11 +276,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1782750101, - "narHash": "sha256-mpLDFwjW0XedqONTlBJ5AAwjgKF8CusVkNF1i+BUgWw=", + "lastModified": 1783459962, + "narHash": "sha256-/vE7IZVVeVS8mK9g1tUZmSOXpVu61mJ4nl8xfRbGpJE=", "owner": "Wilkuu-2", "repo": "stalwart-nix", - "rev": "1fa32a16578553816383079896453a711298ae1e", + "rev": "282c9ee6d23ce520076cf07c46b8727cc3d5dd4b", "type": "github" }, "original": { @@ -9,7 +9,7 @@ # local testing # url = "path:/store2/code/stalwart-nix"; url = "github:Wilkuu-2/stalwart-nix"; - # Letting stalwart-nix using it's own nixpkgs prevents unnecessary rebuilds at the cost of some disk space. + # Letting stalwart-nix using it's own nixpkgs prevents unnecessary rebuilds at the cost of some disk space. # inputs.nixpkgs.follows = "nixpkgs"; # inputs.treefmt-nix.follows = "treefmt-nix"; }; diff --git a/home-modules/apps/desktop/default.nix b/home-modules/apps/desktop/default.nix index 614e627..c1a8a84 100644 --- a/home-modules/apps/desktop/default.nix +++ b/home-modules/apps/desktop/default.nix @@ -71,13 +71,7 @@ in with pkgs; [ obsidian - kdePackages.kdepim-runtime - ] - ++ (with pkgs.kdePackages; [ - zanshin - kdepim-runtime - akonadi-calendar - ]); + ]; # Todo force synthing to be on here }) (lib.mkIf cfg.art.enable { @@ -88,8 +82,8 @@ in }) (lib.mkIf cfg.browser.enable { home.packages = with pkgs; [ - # librewolf - firefox + librewolf + # firefox ]; }) (lib.mkIf cfg.work.enable { diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index db2f6c2..2bc3fab 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -19,6 +19,10 @@ HandleLidSwitchDocked = "ignore"; }; + wilkuu.mjmap = { + enable = true; + # users = ["wilkuu"]; + }; ## Addons for this system addons = { desktop.hyprland.enable = false; diff --git a/hosts/omega-relay/certs.nix b/hosts/omega-relay/certs.nix index affa18e..079d201 100644 --- a/hosts/omega-relay/certs.nix +++ b/hosts/omega-relay/certs.nix @@ -1,18 +1,18 @@ -{pkgs, config, lib, ...}: - let - names = [ - "moni.wilkuu.xyz" - "matrix.wilkuu.xyz" - "rss.wilkuu.xyz" - "bulwark.wilkuu.xyz" - "uptime.wilkuu.xyz" - "bitwarden.wilkuu.xyz" - "wilkuu.xyz" - ]; - in +{ lib, ... }: +let + names = [ + "moni.wilkuu.xyz" + "matrix.wilkuu.xyz" + "rss.wilkuu.xyz" + "bulwark.wilkuu.xyz" + "uptime.wilkuu.xyz" + "bitwarden.wilkuu.xyz" + "wilkuu.xyz" + ]; +in { - services.nginx.virtualHosts = lib.genAttrs names (name: { - enableACME = lib.mkForce false; + services.nginx.virtualHosts = lib.genAttrs names (_name: { + enableACME = lib.mkForce false; useACMEHost = "wilkuu.xyz"; - }); -} + }); +} diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 181add4..cd0e9dc 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -178,12 +178,41 @@ virtualHosts."moni.wilkuu.xyz" = { forceSSL = true; enableACME = false; - useACMEHost = "wilkuu.xyz"; + useACMEHost = "wilkuu.xyz"; locations."/" = { proxyPass = "http://192.168.88.5:3132"; recommendedProxySettings = true; }; }; + virtualHosts."fin.wilkuu.xyz" = { + forceSSL = true; + enableACME = false; + useACMEHost = "wilkuu.xyz"; + locations."/" = { + proxyPass = "http://192.168.88.5:80"; + recommendedProxySettings = true; + }; + }; + virtualHosts."fin-imp.wilkuu.xyz" = { + forceSSL = true; + enableACME = false; + useACMEHost = "wilkuu.xyz"; + locations."/" = { + proxyPass = "http://192.168.88.5:80"; + recommendedProxySettings = true; + }; + }; + virtualHosts."kb.wilkuu.xyz" = { + forceSSL = true; + enableACME = false; + useACMEHost = "wilkuu.xyz"; + locations."/" = { + proxyPass = "http://192.168.88.5:80"; + recommendedProxySettings = true; + }; + }; + + }; networking.hostName = "omega-relay"; diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix index 4bbc77a..0e82fea 100644 --- a/hosts/omega-relay/firewall.nix +++ b/hosts/omega-relay/firewall.nix @@ -79,7 +79,7 @@ in ]; presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path; publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk="; - endpoint = "45.138.54.155:16556"; + endpoint = "45.138.54.155:16556"; # endpoint = "wilkuu.duckdns.org:16556"; name = "wg-home-chronosphere"; persistentKeepalive = 5; diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix index 50d5542..fa39daa 100644 --- a/hosts/tacitus/default.nix +++ b/hosts/tacitus/default.nix @@ -8,11 +8,30 @@ ./network.nix ./disko.nix ./hardware.nix + ./../../services/mysql.nix + ./../../services/kanboard.nix + ./../../services/firefly_iii.nix ]; + wilkuu.mjmap = { + enable = true; + users = ["wilkuu"]; + }; wilkuu.services = { prometheus.enableScraper = true; prometheus.enableExporters = true; + test_endpoint.enable = false; + mysql.enable = true; + kanboard = { + enable = true; + domain = "kb.wilkuu.xyz"; + }; + firefly-iii = { + enable = true; + enable-importer = true; + domain = "fin.wilkuu.xyz"; + importer-domain = "fin-imp.wilkuu.xyz"; + }; }; addons = { @@ -82,7 +101,7 @@ sops.templates."prometheus-mikrotik-config" = { owner = "mikrotik-exporter"; - content = lib.generators.toYAML {} { + content = lib.generators.toYAML { } { devices = [ { name = "chronosphere"; @@ -100,15 +119,15 @@ ]; features = { dhcp = true; - dhcpv6 = true; + dhcpv6 = true; optics = true; health = true; poe = true; - wlansta = true; - wlanif = true; - monitor=true; - routes = true; - firware = true; + wlansta = false; + wlanif = false; + monitor = true; + routes = true; + firware = true; netwatch = true; conntrack = true; }; diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix index df48a9b..2409ba1 100644 --- a/hosts/tacitus/network.nix +++ b/hosts/tacitus/network.nix @@ -8,6 +8,7 @@ let 443 config.services.grafana.settings.server.http_port config.services.prometheus.port + config.services.mysql.settings.mysqld.port ] ++ lib.mapAttrsToList (_: opt: opt.port) ( lib.filterAttrs ( diff --git a/modules/default.nix b/modules/default.nix index 180e31b..5c93f8e 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -15,7 +15,8 @@ ./motd.nix ./locale.nix ./test_endpoint.nix - ./prometheus.nix + ./prometheus.nix + ./mjmap.nix ]; nixpkgs.overlays = [ diff --git a/modules/mjmap.nix b/modules/mjmap.nix new file mode 100644 index 0000000..b826469 --- /dev/null +++ b/modules/mjmap.nix @@ -0,0 +1,51 @@ +{pkgs, config, lib, ...}: let + cfg = config.wilkuu.mjmap; + inherit (lib) mkEnableOption mkOption types mkIf; + # TODO: Once the mjmap patch is upstreamed, use this. + #mjmap_wrap = (pkgs.writeScriptBin "mjmap" '' + # #! ${pkgs.bash}/bin/bash + # export MJMAP_CONFIG=${config.sops.secrets."mjmap-creds".path}; + # exec ${pkgs.mjmap} "$@" + # ''); + + # Workaround since the current version does not support setting config path; + mjmap_wrap = (pkgs.writeScriptBin "mjmap-send" '' + #! ${pkgs.bash}/bin/bash + export XDG_CONFIG_DIR=/etc/; + exec ${pkgs.mjmap}/bin/mjmap "$@" + ''); + + sendmail_wrap = pkgs.symlinkJoin { + name = "sendmail-wrapper"; + paths = [ mjmap_wrap ]; + postBuild = '' + ln -s $out/bin/mjmap-send $out/bin/sendmail + ''; + }; + +in { + options.wilkuu.mjmap = { + enable = mkEnableOption "mjmap jmap email"; + users = mkOption { + type = types.listOf types.str; + description = "users that are allowed to view the credentials file and thus use mjmail"; + }; + }; + + config = mkIf cfg.enable{ + users.groups.mjmap = mkIf (cfg.users != []) {}; + users.users = lib.genAttrs cfg.users (_: { + extraGroups = ["mjmap"]; + packages = [mjmap_wrap sendmail_wrap]; + }); + sops.secrets."mjmap-creds" = mkIf (cfg.users != []) { + sopsFile = ../secrets/${config.networking.hostName}/mjmap.scfg.bin; + key = ""; + format = "binary"; + group = "mjmap"; + mode = "440"; + }; + environment.etc."mjmap/config.scfg" = mkIf (cfg.users != []) { source = config.sops.secrets."mjmap-creds".path; }; + environment.systemPackages = [ pkgs.mjmap ]; + }; +} diff --git a/secrets/apocalypse/mjmap.scfg.bin b/secrets/apocalypse/mjmap.scfg.bin new file mode 100644 index 0000000..df7f1ec --- /dev/null +++ b/secrets/apocalypse/mjmap.scfg.bin @@ -0,0 +1,19 @@ +{ + "data": "ENC[AES256_GCM,data:OjjwOOrULeDT9uMstnJNgzoNuXi07g0T3Mrk5Suucd1feoVeMzhmMdhi+P5QdFcTDLv96yC5WO+7LtTI7I7Y5UGHfqRjDD8VduO7dPIgTh75dd1Q/6+wVE1tOnWzJvIyd57eKn9r7JCxB8LHbqyiwrUayCzi+gO1yNHsNMoim4Jk3OF45Jw8/vwjFzaL/+e9HQbBMTs=,iv:Xqjgn6OGGEnA1uFt61i8RIKfNi8+w0JCLVy9zE/eEgs=,tag:xfcmc8frHVzS3hihK4EtxA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVjlYNStpUlJCSjBnTGZU\nWk44cmtKQ0tBcTlTT2dneGVhQ3dzNmtodFdFCnY5b2ZNQ0FRVWIyRWZiamJvNzBG\nKzlVN0YzTm11bjZLZkg4bkYyU0w1MXcKLS0tIHZMVlZYOWVTMzY0bEFzYW5wbHND\nRjZ4MTRBalhtWGordmtnY2EzZ0tLQUEKpJry6/lFQgtClYuf8PeNUJW/Hpljolgu\nb//WRVTiXE6QhPAGJf1f01Flfx/G7zeGh6PjkLuC3JcIabXlm40D6g==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUYkRYQlZIaHAwcXk1Q2FC\nd0l4MHRwZEZ4SXZmVTZWbnRGd0FYREk1VkZRCmRnRjR0aDFTV0g5UkJPOU9Gbm1x\nVEw0Ym1nWGxHOHhKZTRKQ01FaEJBaVEKLS0tIHlmNTltcWNkdWZYUk9iNDVsSllw\ndTc3WXEwK09ldHNzMHpVNVpkbEhRUGMK9iGi9WVzzpv/vee6qhXz4XyxakHwy5tp\nt4/mLeQF9TcaRuFOus5wlIUNu2TCZkdv6YNtCNh2UUBKwgRUOd2E7w==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age19cw4x4ycrdhfdkwvp009czmvfhucpdtn8lme4ja0rvq7er87z3wsd2fxz7" + } + ], + "lastmodified": "2026-07-07T14:45:36Z", + "mac": "ENC[AES256_GCM,data:DrQRG605y7pAEpZz60G4pOIjnUV4wUqWJKPi0380LjeXJxHab4aQlEGcGIjYxYXycSEkK6fPr0Q7wvLPHcZ4LVYOlEumX1hJk0gLeBJL91J4HsM4CP24r8BVohuZ0unrT00020Io2+qYW87XMbVOaFHfWAlZkWVh/zvuNGZf8nQ=,iv:kekRVlauaC1aoFdUjEBtZ63go4BsJhtVqbbhrLp2Nts=,tag:tPpwBzmlyRV/VBmmBB3KNQ==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.13.1" + } +} diff --git a/secrets/tacitus/firefly_iii.yaml b/secrets/tacitus/firefly_iii.yaml new file mode 100644 index 0000000..cfa2147 --- /dev/null +++ b/secrets/tacitus/firefly_iii.yaml @@ -0,0 +1,29 @@ +firefly_iii: + email_password: ENC[AES256_GCM,data:wtRY4B6v9Tk0Mp7kzAJp+DD3brH/na496ZKL56oGmEo=,iv:sPnQgmKSvEvdk92VJERgABI+gZ9xYa8jTD8qUX1UGaA=,tag:qZSWzjTIDLbMER5aXGdz0Q==,type:str] + email_username: ENC[AES256_GCM,data:9RRIWFicyGkypwFY7eAvzR+O,iv:uBMR/0QfgXTJCO02pSzSSrEJ8wzl/9iSuvgu7UIStj0=,tag:ue3xd9glJ/7AESL1ZzyNYA==,type:str] + app_key: ENC[AES256_GCM,data:zcNv4syeWe8LLQHMlQ+3EPcRa9QHAjdwp7QWNgaRz58Nw2wT9Gj6l+t6OGQW7QkD3TLr,iv:deNDy6dMBa8Nu2Cfge5kL5Ji0FhguYv9CS9Bszf2j/0=,tag:E4Ev1o5jIoAsjZEebnslpg==,type:str] + db_password: ENC[AES256_GCM,data:7ifIiL7x4cl195kRtgfQeW8IHlPzTuFg4g==,iv:vpjp3JLrZNmaleW7K+3Sh7sIsyHggKO4GcWZ6/72TF4=,tag:NNXov0nzEkOg/y1oOW5R4w==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdTNDWWVGVFJuMjREeXVP + L1U3ZDdGaFlUOXZFY205Zi9CTlE1b3FoVDJvClpkdllpSXNzd1docml6OUtoY3lL + MkdNaDlRdUFmOUlDcGVpTlJ6UkhXVG8KLS0tIDJZTFJkYmFsd0FvNUpaL2tPM0t0 + YVZCQ2R3UFNFQjJHNU1jdnloaFlFVDAKLyepjgvZPLfKt2hbmGk+DagAmbwH9JoD + sOfrMqi4mq0z66bVYc9L+KLtdN4KBrYBb2CQbfIuxXJcjCmcyU8nDA== + -----END AGE ENCRYPTED FILE----- + recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvczhQNXhHbmJLTlFtVisv + dTlhLzA1ekdPVU5rNlFpZ2dnb0Q5WWxnNVc4CnFud3BNQzN3THFzUDRsNlZYWldu + eS9SWWRoLzNja0JWdDFVMnJmallUZkUKLS0tIGJwbDBQL1FiZHRHaEhBNG9PdEVI + TDNPSEdOTVdWRVdEWXhTam1PMEVPYmsKcd5/P0JYMi4XTuMs/GoakMHnVrdX1XGF + fkAsh+QtOkdNcylVSlIxKQkF2Ogx0fKa5zj6M73TW0XurVS5aB9sJA== + -----END AGE ENCRYPTED FILE----- + recipient: age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht + lastmodified: "2026-07-04T13:23:35Z" + mac: ENC[AES256_GCM,data:8ZB0cNJEXaaZJ4LrB0Qlyx47mdAWKMlt2do+b20DOQCNzN2K0Lm9DJEzcPbRIt9Ygk0c3AneH3v8+tzqsDHh/GnDMOXclfWbFd1zE8DwE4cwCw8G5tvpoZIDA/6TparIfMLBEuozEUyxt4qec6cznCsaBH9/fAGzvSrPi/JQjgw=,iv:U4GnRnY3RdnRUQ2whYsQqosQDzNbJy1Z5gB4/DkO72o=,tag:tPePVqBzB0uGwXYcz9RFMg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/secrets/tacitus/kanboard.yaml b/secrets/tacitus/kanboard.yaml new file mode 100644 index 0000000..f73d109 --- /dev/null +++ b/secrets/tacitus/kanboard.yaml @@ -0,0 +1,26 @@ +kanboard: + db_password: ENC[AES256_GCM,data:phlXGLGrESjr85jLGLHPVANFy97iN3oh,iv:6tYXox1HJYwqxPakuhUB39UINsSOtAHPcIidrbRAL7E=,tag:l9JM2peQ8pZGwIMbmE1kqg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5WngyYjIyUXdBbTI5ZlVh + ZjF4SVlVUXR0WWErdk5EeDhKb2hDVGdndFI0CjkxeTlXQTNZQmZXOTE0VU1RK3l0 + ZktES3h0T0wrbGZ6eFgvWUp6UWNjdXcKLS0tIFk0bU5MT2FjTkVaRXJZV2tENW9G + NGFQdEVHSUtIbi9ZaUlISVRWKzJESmsKnh9jAPDKhsT0T19nTXW8CqW//AuJ5rfV + NB1goyraOsB9eka139gsWY89ItGd1VZGwMVuDqh61y8dYkmeiLzLKw== + -----END AGE ENCRYPTED FILE----- + recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwR01HSmpsRUdtTmZ4S2NZ + ZUhJa1dBRG5rSmNyRGhEcFAyV0Z3S2dVU2lJCmJkY1VONzZLdTJjeHRiZ2U5Zjlh + M1FlQWtHTDRJWGtkZ2xxb2JQVlAxQ0EKLS0tIC9HWlpRcStqNk1YaGJkbHdaUTBn + bzcxNTFyOFpScHZ6T0NqR292V0pVSVEKMa6U/XqbkiaIL76WAeouEG5LzSWf53C0 + ls4fygzt29yNX4hWWV5CoBvEfn3EUB9LZG8vm7+8fKZMIM505cn9vg== + -----END AGE ENCRYPTED FILE----- + recipient: age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht + lastmodified: "2026-07-07T22:48:04Z" + mac: ENC[AES256_GCM,data:ujhfURDiZNaIwGn2Z6MzRpfmH32G+/UIdltZcNDb1dJsx4cygp06y0FYXDfs7z5z1dbLSgrjpQeFKVfBm9chepjLmShJUSb9MdQPxv9oKY2wsKCSHXRmgOFqPGNrKlRt9lW3PPOjxAgmF6DohPx+u3XMw8Wi9jjSYnjRtuBGlos=,iv:JL+18TOdpnf30JEvdd3lWolyYpkYX5Li/R96beEo+fw=,tag:lmCW81SKXp2dxcjd0c3Xrw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/secrets/tacitus/mjmap.scfg.bin b/secrets/tacitus/mjmap.scfg.bin new file mode 100644 index 0000000..9382beb --- /dev/null +++ b/secrets/tacitus/mjmap.scfg.bin @@ -0,0 +1,18 @@ +{ + "data": "ENC[AES256_GCM,data:4zpTUlMN+1QE9uFi64K3AhyzPql96wFAMDcWV6aILuU5K35hjCwb9Qja9PP+3nfyFc6ciJPcov5oH7xZ+x7pdUJZRwSZ/1ENF70NuHA2X/glpzI8QGjmQdzLXed+lFKEOSMhcdsbk3tegLDsQvpvTrAcrGdrC4uej/MMN4zeoMMforU6vF3XfUNqCdf0loQLHFalmkWVjg==,iv:4rluzl7dqepDJftq/btBqUDSxLpY4uybOwQZw6mh/HA=,tag:9YVF+3fHImx17uexS4xlbw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQWUvNE4waUxRS2Z3ZjFV\nVGN2VmdUWTJPenlNVUs2bGZSRjhjZVBNK1VnCmdNbVNlLzFucmNkU0E1TEMwWTR5\nMmVQeWJDeFNNVmdPb2tyd1R4cjlHbWMKLS0tIEtLNzhaYW1keDg1SXB4MlhRTUdl\nYWJxdzZUU1g3NG9waWFZUU93V3Azb1kKgoKjPP90CKU/ZKV4+d6VzX/9PNHfmuHG\nxMhhYC1ZQtszDA65t7cvg9SRft4ruBl7oLfkhXNcu3YdvD6cedh8Jg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZjNBMWRnV0pZYmN0Tk9I\nZ0N6ZFpvbU9OR0JGMFQ2T1JxWGcvSGUrVFJVCkw3QUF4V2RhaERXanVUR2ZMSUNR\nODBIck5UbFh2aHNEME1lNVBFdUVjancKLS0tIGQyK3B2WVFOb2JXSTJrWk16N2Ru\nYktXcVZ4NUtmbWRJR0YyOTg0TTlqYjQKXv9NoQG+e27DV4uehzDD5HUz2IQSf83l\n/91GptH5N8e353nO5Qj1LtciOMdnH0D3URawi/DR4GWoeZEPU2Hdlw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht" + } + ], + "lastmodified": "2026-07-07T20:10:13Z", + "mac": "ENC[AES256_GCM,data:yznGrws1Fd4flK89PN1wv6KK0P2xJnvfJwfBtqFaBa1BttmWHOgW5bmKgbmfG2T1AF3ZXtysPxfWypUQIJQvMBdG+iBEIO5Qy0o5iPxoLmM/hF+VOUlLmVohZZR3wBtbKNOC1laNwhptSwBvXVv3X91K0WoawD0WaLTFNJGF8Yk=,iv:AB3gD13dX8jjyG3hSDS6ed3j6Ib8ATvJXWuYPhddlas=,tag:s1zODOQ6L3yHYhvlyZKAYg==,type:str]", + "version": "3.13.1" + } +} diff --git a/services/firefly_iii.nix b/services/firefly_iii.nix new file mode 100644 index 0000000..1f9bd64 --- /dev/null +++ b/services/firefly_iii.nix @@ -0,0 +1,140 @@ +{ config, lib, ... }: +let + cfg = config.wilkuu.services.firefly-iii; + inherit (lib) + types + mkOption + mkEnableOption + mkIf + ; +in +{ + options.wilkuu.services.firefly-iii = { + enable = mkEnableOption "firefly III"; + enable-importer = mkEnableOption "firefly III data importer"; + domain = mkOption { + type = types.str; + description = "domain"; + default = "fin.${config.networking.hostName}.local"; + example = "fin.wilkuu.xyz"; + }; + importer-domain = mkOption { + type = types.str; + description = "domain for the importer"; + default = "fin-imp.${config.networking.hostName}.local"; + example = "fin-imp.wilkuu.xyz"; + }; + + }; + config = mkIf cfg.enable { + services.nginx.virtualHosts = { + ${cfg.domain} = { + enableACME = lib.mkForce false; + addSSL = lib.mkForce false; + forceSSL = lib.mkForce false; + }; + ${cfg.importer-domain} = { + enableACME = lib.mkForce false; + addSSL = lib.mkForce false; + forceSSL = lib.mkForce false; + }; + }; + users.users."firefly_iii" = { + isSystemUser = true; + group = "firefly_iii"; + }; + users.groups."firefly_iii" = { }; + sops.secrets = + lib.genAttrs + [ + "firefly_iii/app_key" + "firefly_iii/email_password" + "firefly_iii/email_username" + "firefly_iii/db_password" + ] + (_: { + sopsFile = ../secrets/${config.networking.hostName}/firefly_iii.yaml; + owner = "firefly_iii"; + }); + wilkuu.services.mysql = { + enable = true; + databases."firefly_iii" = { + enable = true; + allowedUsers = [ "firefly_iii" ]; + }; + users.firefly_iii = { + sopsPlaceholder = config.sops.placeholder."firefly_iii/db_password"; + host = "localhost"; + }; + }; + services.firefly-iii = { + enableNginx = true; + virtualHost = cfg.domain; + enable = true; + user = "firefly_iii"; + group = "nginx"; + settings = { + APP_KEY_FILE = config.sops.secrets."firefly_iii/app_key".path; + APP_URL = "https://${cfg.domain}"; + + # DB + DB_CONNECTION = "mysql"; + DB_DATABASE = "firefly_iii"; + DB_HOST = "localhost"; + DB_PORT = config.services.mysql.settings.mysqld.port; + DB_USERNAME = "firefly_iii"; + DB_PASSWORD = config.sops.secrets."firefly_iii/db_password".path; + + # Proxying + TRUSTED_PROXIES = "192.168.80.100"; + + # Email + MAIL_MAILER = "stmp"; + MAIL_HOST = "mail.wilkuu.xyz"; + MAIL_FROM_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_USERNAME_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_PASSWORD_FILE = config.sops.secrets."firefly_iii/email_password".path; + MAIL_ENCRYPTION = "starttls"; + MAIL_PORT = 587; + # Locale and info + DEFAULT_LOCALE = "nl_NL"; + LANGUAGE = "en_US"; + SITE_OWNER = "jakub@wilkuu.xyz"; + + }; + }; + services.firefly-iii-data-importer = mkIf cfg.enable-importer { + enableNginx = true; + enable = true; + virtualHost = cfg.importer-domain; + user = "firefly_iii"; + group = "nginx"; + settings = { + FIREFLY_III_URL = "https://${cfg.domain}"; + VANITY_URL = "https://${cfg.domain}"; + + # FIREFLY_III_ACCESS_TOKEN = ""; #TODO + APP_URL = "https://${cfg.importer-domain}"; + LOG_CHANNEL = "syslog"; + + # Proxying + TRUSTED_PROXIES = "192.168.80.100"; + + # Email + MAIL_MAILER = "stmp"; + MAIL_HOST = "mail.wilkuu.xyz"; + MAIL_FROM_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_USERNAME_FILE = config.sops.secrets."firefly_iii/email_username".path; + MAIL_PASSWORD_FILE = config.sops.secrets."firefly_iii/email_password".path; + MAIL_ENCRYPTION = "starttls"; + MAIL_PORT = 587; + + # Locale and info + FALLBACK_LOCALE = "nl_NL"; + LANGUAGE = "en_US"; + + }; + }; + }; + +} diff --git a/services/kanboard.nix b/services/kanboard.nix new file mode 100644 index 0000000..c19b673 --- /dev/null +++ b/services/kanboard.nix @@ -0,0 +1,61 @@ +{pkgs, config, lib, ...}: + let + cfg = config.wilkuu.services.kanboard; + inherit (lib) mkEnableOption mkOption types mkIf; + in +{ + options.wilkuu.services.kanboard = { + enable = mkEnableOption "kanboard"; + domain = mkOption { + type = types.str; + example = "kb.wilkuu.xyz"; + }; + }; + + config = mkIf cfg.enable { + wilkuu.services.mysql.unix_users = ["kanboard"]; + wilkuu.mjmap = { + enable = lib.mkDefault true; + users = ["kanboard"]; + }; + sops.secrets."kanboard/db_password" = { + sopsFile = ../secrets/${config.networking.hostName}/kanboard.yaml; + owner = "kanboard"; + mode = "500"; + }; + sops.templates."kanboard-env" = { + content = '' + DB_PASSWORD=${config.sops.placeholder."kanboard/db_password"} + PLUGIN_INSTALLER=true + ''; + owner = "kanboard"; + mode = "500"; + }; + systemd.services.phpfpm-kanboard.serviceConfig = { + EnvironmentFile = config.sops.templates."kanboard-env".path; + }; + services.kanboard = { + nginx = { + enableACME = false; + forceSSL = false; + addSSL = false; + }; + domain = cfg.domain; + enable = true; + settings = { + PLUGIN_INSTALLER = "$PLUGIN_INSTALLER"; + PLUGINS_DIR = "${config.services.kanboard.dataDir}/plugins"; + MAIL_FROM = "Kanboard <noreply@wilkuu.nl>"; + MAIL_TRANSPORT = "sendmail"; + MAIL_SENDMAIL_COMMAND = "sendmail"; + DB_DRIVER = "mysql"; + DB_USERNAME = "kanboard"; + DB_HOSTNAME = "127.0.0.1;unix_socket=/run/mysqld/mysqld.sock"; + DB_PASSWORD = "$DB_PASSWORD"; + ENABLE_URL_REWRITE = true; + TRUSTED_PROXY_HEADERS = "HOST,X-REAL-IP,X-FORWARDED-FOR,X-FORWARDED-HOST,X-FORWARDED-SERVER"; + TRUSTED_PROXY_NETWORKS = "192.168.80.0/24,192.168.88.0/24"; + }; + }; + }; +} |