summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.lock85
-rw-r--r--flake.nix7
-rw-r--r--home-modules/apps/desktop/default.nix3
-rw-r--r--hosts/omega-relay/certs.nix18
-rw-r--r--hosts/omega-relay/default.nix15
-rw-r--r--hosts/omega-relay/firewall.nix6
-rw-r--r--hosts/tacitus/default.nix57
-rw-r--r--hosts/tacitus/network.nix2
-rw-r--r--modules/prometheus.nix2
-rw-r--r--secrets/omega-relay/desec.yaml7
-rw-r--r--secrets/tacitus/prometheus.yaml31
-rw-r--r--services/ddns.nix2
12 files changed, 185 insertions, 50 deletions
diff --git a/flake.lock b/flake.lock
index b81dcbc..86809a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -145,11 +145,11 @@
]
},
"locked": {
- "lastModified": 1779969295,
- "narHash": "sha256-HwIJ3tOcwSMiV75L7KqJXciXR9UfT+d7rwOZMX7cTnA=",
+ "lastModified": 1782749631,
+ "narHash": "sha256-slFTUgDy0KTPA4LBAmC/9SngDq8GCPdX+ZR0yQHHN1E=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "61e2c9659324181e0f0ed911958c536333b1d4f6",
+ "rev": "5d72a29fc36ac21adae6ae35568fe5ee6700850f",
"type": "github"
},
"original": {
@@ -160,11 +160,11 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1779560665,
- "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+ "lastModified": 1782467914,
+ "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+ "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
"type": "github"
},
"original": {
@@ -191,16 +191,32 @@
},
"nixpkgs-stable": {
"locked": {
- "lastModified": 1767313136,
- "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+ "lastModified": 1782535326,
+ "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+ "rev": "714a5f8c4ead6b31148d829288440ed033ccc041",
"type": "github"
},
"original": {
"owner": "nixos",
- "ref": "nixos-25.05",
+ "ref": "nixos-26.05",
+ "repo": "nixpkgs",
+ "type": "github"
+ }
+ },
+ "nixpkgs_2": {
+ "locked": {
+ "lastModified": 1782535326,
+ "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=",
+ "owner": "nixos",
+ "repo": "nixpkgs",
+ "rev": "714a5f8c4ead6b31148d829288440ed033ccc041",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nixos",
+ "ref": "nixos-26.05",
"repo": "nixpkgs",
"type": "github"
}
@@ -214,7 +230,7 @@
"nixpkgs-stable": "nixpkgs-stable",
"sops-nix": "sops-nix",
"stalwart-nix": "stalwart-nix",
- "treefmt-nix": "treefmt-nix"
+ "treefmt-nix": "treefmt-nix_2"
}
},
"rust-analyzer-src": {
@@ -241,11 +257,11 @@
]
},
"locked": {
- "lastModified": 1777944972,
- "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+ "lastModified": 1782165805,
+ "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
"owner": "Mic92",
"repo": "sops-nix",
- "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+ "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
"type": "github"
},
"original": {
@@ -256,19 +272,15 @@
},
"stalwart-nix": {
"inputs": {
- "nixpkgs": [
- "nixpkgs"
- ],
- "treefmt-nix": [
- "treefmt-nix"
- ]
+ "nixpkgs": "nixpkgs_2",
+ "treefmt-nix": "treefmt-nix"
},
"locked": {
- "lastModified": 1780211733,
- "narHash": "sha256-9keQVrQN6ZhODsyITo25sPMfbWlmBYfLQ59MyiX8Y38=",
+ "lastModified": 1782750101,
+ "narHash": "sha256-mpLDFwjW0XedqONTlBJ5AAwjgKF8CusVkNF1i+BUgWw=",
"owner": "Wilkuu-2",
"repo": "stalwart-nix",
- "rev": "3752aa11c22073b00507b67e1c14ba17e7ed3629",
+ "rev": "1fa32a16578553816383079896453a711298ae1e",
"type": "github"
},
"original": {
@@ -280,15 +292,36 @@
"treefmt-nix": {
"inputs": {
"nixpkgs": [
+ "stalwart-nix",
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1780220602,
+ "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+ "owner": "numtide",
+ "repo": "treefmt-nix",
+ "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+ "type": "github"
+ },
+ "original": {
+ "owner": "numtide",
+ "repo": "treefmt-nix",
+ "type": "github"
+ }
+ },
+ "treefmt-nix_2": {
+ "inputs": {
+ "nixpkgs": [
"nixpkgs"
]
},
"locked": {
- "lastModified": 1775636079,
- "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+ "lastModified": 1780220602,
+ "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
"owner": "numtide",
"repo": "treefmt-nix",
- "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+ "rev": "db947814a175b7ca6ded66e21383d938df01c227",
"type": "github"
},
"original": {
diff --git a/flake.nix b/flake.nix
index bf012fc..430dc96 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,14 +3,15 @@
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
- nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+ nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
stalwart-nix = {
# local testing
# url = "path:/store2/code/stalwart-nix";
url = "github:Wilkuu-2/stalwart-nix";
- inputs.nixpkgs.follows = "nixpkgs";
- inputs.treefmt-nix.follows = "treefmt-nix";
+ # Letting stalwart-nix using it's own nixpkgs prevents unnecessary rebuilds at the cost of some disk space.
+ # inputs.nixpkgs.follows = "nixpkgs";
+ # inputs.treefmt-nix.follows = "treefmt-nix";
};
sops-nix = {
diff --git a/home-modules/apps/desktop/default.nix b/home-modules/apps/desktop/default.nix
index 11a3152..614e627 100644
--- a/home-modules/apps/desktop/default.nix
+++ b/home-modules/apps/desktop/default.nix
@@ -88,7 +88,8 @@ in
})
(lib.mkIf cfg.browser.enable {
home.packages = with pkgs; [
- librewolf
+ # librewolf
+ firefox
];
})
(lib.mkIf cfg.work.enable {
diff --git a/hosts/omega-relay/certs.nix b/hosts/omega-relay/certs.nix
new file mode 100644
index 0000000..affa18e
--- /dev/null
+++ b/hosts/omega-relay/certs.nix
@@ -0,0 +1,18 @@
+{pkgs, config, lib, ...}:
+ let
+ names = [
+ "moni.wilkuu.xyz"
+ "matrix.wilkuu.xyz"
+ "rss.wilkuu.xyz"
+ "bulwark.wilkuu.xyz"
+ "uptime.wilkuu.xyz"
+ "bitwarden.wilkuu.xyz"
+ "wilkuu.xyz"
+ ];
+ in
+{
+ services.nginx.virtualHosts = lib.genAttrs names (name: {
+ enableACME = lib.mkForce false;
+ useACMEHost = "wilkuu.xyz";
+ });
+}
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 27cbf13..181add4 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -10,6 +10,7 @@
./disko.nix
./vm.nix
./hardware-configuration.nix
+ ./certs.nix
../../services/mysql.nix
../../services/vaultwarden.nix
../../services/uptimekuma.nix
@@ -53,7 +54,7 @@
prometheus.enableExporters = true;
desecDyn = {
enable = true;
- domains."wilkuu.dedyn.io" = {
+ domains."wilkuu.xyz" = {
doWildcard = true;
enableDDNS = true;
enableACME = true;
@@ -174,18 +175,10 @@
tryFiles = "$uri $uri/ =404";
};
};
- virtualHosts."wilkuu.dedyn.io" = {
- forceSSL = true;
- useACMEHost = "wilkuu.dedyn.io";
- root = "/srv/www/wilkuu.dedyn.io/";
- locations."/" = {
- index = "index.html";
- tryFiles = "$uri $uri/ =404";
- };
- };
virtualHosts."moni.wilkuu.xyz" = {
forceSSL = true;
- enableACME = true;
+ enableACME = false;
+ useACMEHost = "wilkuu.xyz";
locations."/" = {
proxyPass = "http://192.168.88.5:3132";
recommendedProxySettings = true;
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index c276831..4bbc77a 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -79,10 +79,10 @@ in
];
presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk=";
- # endpoint = "45.138.54.155:16556";
- endpoint = "wilkuu.duckdns.org:16556";
+ endpoint = "45.138.54.155:16556";
+ # endpoint = "wilkuu.duckdns.org:16556";
name = "wg-home-chronosphere";
-
+ persistentKeepalive = 5;
}
];
};
diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix
index f4a135c..50d5542 100644
--- a/hosts/tacitus/default.nix
+++ b/hosts/tacitus/default.nix
@@ -64,4 +64,61 @@
PermitRootLogin = "no";
};
};
+ users.groups.mikrotik-exporter = { };
+ users.users.mikrotik-exporter = {
+ isSystemUser = true;
+ group = "mikrotik-exporter";
+ };
+
+ # TODO: "Make each device hold it's own password."
+ sops.secrets."prometheus/mikrotik/username" = {
+ owner = "mikrotik-exporter";
+ sopsFile = ../../secrets/tacitus/prometheus.yaml;
+ };
+ sops.secrets."prometheus/mikrotik/password" = {
+ owner = "mikrotik-exporter";
+ sopsFile = ../../secrets/tacitus/prometheus.yaml;
+ };
+
+ sops.templates."prometheus-mikrotik-config" = {
+ owner = "mikrotik-exporter";
+ content = lib.generators.toYAML {} {
+ devices = [
+ {
+ name = "chronosphere";
+ address = "192.168.88.1";
+ user = config.sops.placeholder."prometheus/mikrotik/username";
+ password = config.sops.placeholder."prometheus/mikrotik/password";
+ }
+ {
+ name = "geneticmutator";
+ address = "192.168.88.2";
+ user = config.sops.placeholder."prometheus/mikrotik/username";
+ password = config.sops.placeholder."prometheus/mikrotik/password";
+ }
+
+ ];
+ features = {
+ dhcp = true;
+ dhcpv6 = true;
+ optics = true;
+ health = true;
+ poe = true;
+ wlansta = true;
+ wlanif = true;
+ monitor=true;
+ routes = true;
+ firware = true;
+ netwatch = true;
+ conntrack = true;
+ };
+ };
+ };
+
+ services.prometheus.exporters.mikrotik = {
+ enable = true;
+ group = "mikrotik-exporter";
+ user = "mikrotik-exporter";
+ configFile = config.sops.templates.prometheus-mikrotik-config.path;
+ };
}
diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix
index d29e73f..df48a9b 100644
--- a/hosts/tacitus/network.nix
+++ b/hosts/tacitus/network.nix
@@ -6,7 +6,7 @@ let
25
80
443
- config.services.grafana.port
+ config.services.grafana.settings.server.http_port
config.services.prometheus.port
]
++ lib.mapAttrsToList (_: opt: opt.port) (
diff --git a/modules/prometheus.nix b/modules/prometheus.nix
index 22db413..63b761f 100644
--- a/modules/prometheus.nix
+++ b/modules/prometheus.nix
@@ -114,7 +114,7 @@ in
job_name = "mikrotik";
static_configs =
let
- port = toString config.services.prometheus.exporters.fail2ban.port;
+ port = toString config.services.prometheus.exporters.mikrotik.port;
in
[
{ targets = [ "localhost:${port}" ]; }
diff --git a/secrets/omega-relay/desec.yaml b/secrets/omega-relay/desec.yaml
index 2d409c1..5fab9cb 100644
--- a/secrets/omega-relay/desec.yaml
+++ b/secrets/omega-relay/desec.yaml
@@ -1,5 +1,6 @@
desec:
- token: ENC[AES256_GCM,data:NM3nh8FNd0Xy0Iw4s8N0xdKR7jOIlnnw6S2oDg==,iv:ETgIEHoV4fboFZDALT3jlxFppscaurgpLz9LPRI+xXc=,tag:XAzBbuOjR0p24/8Vutwsfg==,type:str]
+ old_token: ENC[AES256_GCM,data:cqLMWgqrvEn8iZurjL3hEdcpAc3ScHJoYLLXCg==,iv:vqJqqEpGWeW0Be6A09v45UD0LzsrW3Doew7P4VGcMtM=,tag:3zSHdVSmPCl+UtBVpujXXQ==,type:str]
+ token: ENC[AES256_GCM,data:BzqGC7pd80cWxnqR2E103lTVbQeExx9Stja8Gw==,iv:VO4XvkxMGLaqph890TVmXnRLgUxYJDr+O9xVahOKOPg=,tag:z0hzKFfHPByp1mplOSE/+A==,type:str]
sops:
age:
- enc: |
@@ -38,7 +39,7 @@ sops:
Wfcz+DURBsqrPGkUhdss8kwzD+ngrjBvLr9e4u/ew94rFiSzTCNpPA==
-----END AGE ENCRYPTED FILE-----
recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
- lastmodified: "2026-06-07T19:57:02Z"
- mac: ENC[AES256_GCM,data:8n3YQFFeg7BMuxSiyEMdXN7jMVwT04sbpswfjfNLgpb6/JaAwLwLyfqnJwDqn9bdU2QpeXtpWCauSbzAxZ6n6MrkWDc3ZMXdGn/YqrJW0iBShAu0snfcMNrG0/av3JoD0Xf5A6JhLnhs8mxw+gCT36kItJxdEKtDV3jESTDxMW4=,iv:iEHvyqFXnrHPrnlMUMKnTlnLEPK8Sms/3Cxbj/Pka0k=,tag:g8lMSdCyJPnq9IMxVw3KuQ==,type:str]
+ lastmodified: "2026-06-22T14:08:32Z"
+ mac: ENC[AES256_GCM,data:+ag6vA/5lHOrLtdcAilIOpplUT4VzlUVm8kvnosb8sFd/m6UK4h4fGM0ivKEsb1Ot/I596Qxy/4wh2vNZgrUBXZFAQwwsmIWPLHT5vQYttiz6Yx1pq/tnIVWfK/25PASdSNBrAAI2sr03ikW4/ywKNbm1/uMqLW3X9LoHkH7Skk=,iv:ysxIT3b2PcUH6SSas6ieJ7pQs/0kar0IQ58eAQewOjc=,tag:JVacMGMCppLGvkQ8SVOC9g==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1
diff --git a/secrets/tacitus/prometheus.yaml b/secrets/tacitus/prometheus.yaml
new file mode 100644
index 0000000..562875a
--- /dev/null
+++ b/secrets/tacitus/prometheus.yaml
@@ -0,0 +1,31 @@
+prometheus:
+ stalwart-pass: ENC[AES256_GCM,data:hZJXAnjoUzMyMM9KUcg8pFGJQO3VT4Unz5c51Osu47Q=,iv:HacjhSg+c6Eia7X3k6JtKbyiUFGB0Leea1wamjGBEFM=,tag:QIz/uncRORzojlEehnxyJQ==,type:str]
+ mikrotik:
+ username: ENC[AES256_GCM,data:bC7SChQg6xi1Sw==,iv:4hMXhV1le5Jxvmatc6Rw0RZTj6/HNKtJ1E8CUExpY1Y=,tag:LImUR9ApbWJqd0DN67L0Xg==,type:str]
+ password: ENC[AES256_GCM,data:FI0DZAEwK/PU+FqGvn44GofMCeMhiPyt2gNHr0HFOoJt,iv:QrCs2hK+rxi9E1DoZQPmTDnXBGoZnlxRZXt0a8rGguk=,tag:JioHPEX/MIa/gkSmKD3RmQ==,type:str]
+grafana:
+ secret: ENC[AES256_GCM,data:FVMjDWPusLf0P1oqnHFZBIl39dwY+rXgQHl0kaeyQwFnI2t2SAUuDy6mbWPXE4tbZj6EJ2NeenvAXCfAb6KbrQ==,iv:+D5MBCrLmsgV54ptB8xM+1GR87HgDwnSBZV8U0EDQDU=,tag:g37+3XKf0djIaEGxe/jdeA==,type:str]
+sops:
+ age:
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5U09oaUlseWJyUkM1WWcy
+ a1Z5c0I0YXVuejdoKy9GaHlUMnZ5eTVaVGxvCmo0TjZ2d2RSMkRCZzU5bFgrVEJR
+ UjI1OEtsRUpXUGtwVlh5RzArZy8yMlEKLS0tIGp4Q1V4N3pMMnljYkJ4WjdvODdX
+ azV1a2lFUW1Ic2VacktoZkdjK3M5Y1UKfSob+dIKNmb4XjZt4wyEDhq6/AC/1X2m
+ +LUun1SFiLOQzlAzM9IczrobHe+ThlffObl8ESq6pKwpBC2fP2QIPg==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvdVFkbHdtVDRnN2o2d09B
+ WExJNGhMTk9zVEFURW5MckF3V01lMTJ6azNBCldDektkWms5aHU1TTV0RDZhUjZG
+ NHhpWUJHRG9nV29rV1FKZFRuME1lMHMKLS0tIHhwQ0d5YlhrdW5mUkxGT0NjS3hR
+ VGdYeFc2QWNic2RuQ05KRnhkUmZUYlEKXUA4WE/+5gKZ774P+n2phQfnulXBPCek
+ ZrGi8v9dUJAJpv0mTzksNCotiMrMi9R3RS1J1k24a97FTyNNG10WOA==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht
+ lastmodified: "2026-06-22T14:52:00Z"
+ mac: ENC[AES256_GCM,data:p/uvg7wUDHhiXHgxiN0e/2F4urxqO+gI40Vy8AMu78GhkSheZymokmQMBO5QsNyP3kjnbOQfQoqaBaMOBIEzU+FQagbtAnZvrVCmzwZ6BcPVjC0BLBCQFtpbXigXbAuGJArez2LuJM76u3YreOdp/zxTvQVN4t6iFI+LmXjRP6U=,iv:53BCVeGW5zMPpGv+diufmhzbF6b+89RcWK419z2mPPM=,tag:9ecyz00IaPccGP6XN0X/bQ==,type:str]
+ unencrypted_suffix: _unencrypted
+ version: 3.13.1
diff --git a/services/ddns.nix b/services/ddns.nix
index 2a04a26..014b122 100644
--- a/services/ddns.nix
+++ b/services/ddns.nix
@@ -48,7 +48,7 @@ in
(
lib.optional dcfg.doWildcard ({
provider = "desec";
- domains = "*.${name}";
+ domain = "*.${name}";
token = config.sops.placeholder.${cfg.tokenSopsName};
ip_version = "ipv4";
})
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-10 23:09:44 +0000