oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-10-07 20:47:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

br v4

Browse Source
This commit is contained in:
oqyude
2026-08-11 22:13:53 +03:00
parent 056e5895fe
commit 411c118500
29 changed files with 543 additions and 517 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/options.nix
+35 -95
View File
@@ -3,6 +3,17 @@
lib,
...
}:
let
# Option factory for the xlib.dirs namespace
mkDir =
default: description:
lib.mkOption {
type = lib.types.str;
inherit default description;
};
helpers = import ../lib/xlib.nix { inherit lib; };
in
{
options = {
xlib = {
@@ -39,101 +50,30 @@
};
};
dirs = {
user-home = lib.mkOption {
type = lib.types.str;
default = "/home/${config.xlib.device.username}";
description = "User home directory.";
};
user-storage = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.user-home}/Storage";
description = "User storage directory.";
};
archive-drive = lib.mkOption {
type = lib.types.str;
default = "/mnt/archive";
description = "Archive drive mount point.";
};
lamet-drive = lib.mkOption {
type = lib.types.str;
default = "/mnt/lamet";
description = "Lamet drive mount point.";
};
mobile-drive = lib.mkOption {
type = lib.types.str;
default = "/mnt/mobile";
description = "Mobile drive mount point.";
};
therima-drive = lib.mkOption {
type = lib.types.str;
default = "/mnt/therima";
description = "Therima drive mount point.";
};
vetymae-drive = lib.mkOption {
type = lib.types.str;
default = "/mnt/vetymae";
description = "Vetymae drive mount point.";
};
soptur-drive = lib.mkOption {
type = lib.types.str;
default = "/mnt/soptur";
description = "Soptur drive mount point.";
};
wsl-home = lib.mkOption {
type = lib.types.str;
default = "/mnt/c/Users/${config.xlib.device.username}";
description = "WSL home directory.";
};
wsl-storage = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.wsl-home}/Storage";
description = "WSL storage directory.";
};
server-home = lib.mkOption {
type = lib.types.str;
default = "/home/${config.xlib.device.username}/External";
description = "Server home directory.";
};
server-credentials = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.server-home}/Credentials/server";
description = "Server credentials directory.";
};
storage = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.server-home}/Storage";
description = "General storage directory.";
};
calibre-library = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.server-home}/Books-Library";
description = "Calibre library directory.";
};
music-library = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.user-home}/Music";
description = "Music library directory.";
};
services-folder = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.server-home}/Services";
description = "All services folder.";
};
services-mnt-folder = lib.mkOption {
type = lib.types.str;
default = "/mnt/services";
description = "All services folder.";
};
services-nodes-folder = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.services-mnt-folder}/nodes";
description = "All nodes folder.";
};
postgresql-folder = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.services-mnt-folder}/postgresql";
description = "PostgreSQL service folder.";
};
user-home = mkDir "/home/${config.xlib.device.username}" "User home directory.";
user-storage = mkDir "${config.xlib.dirs.user-home}/Storage" "User storage directory.";
archive-drive = mkDir "/mnt/archive" "Archive drive mount point.";
lamet-drive = mkDir "/mnt/lamet" "Lamet drive mount point.";
mobile-drive = mkDir "/mnt/mobile" "Mobile drive mount point.";
therima-drive = mkDir "/mnt/therima" "Therima drive mount point.";
vetymae-drive = mkDir "/mnt/vetymae" "Vetymae drive mount point.";
soptur-drive = mkDir "/mnt/soptur" "Soptur drive mount point.";
wsl-home = mkDir "/mnt/c/Users/${config.xlib.device.username}" "WSL home directory.";
wsl-storage = mkDir "${config.xlib.dirs.wsl-home}/Storage" "WSL storage directory.";
server-home = mkDir "/home/${config.xlib.device.username}/External" "Server home directory.";
server-credentials = mkDir "${config.xlib.dirs.server-home}/Credentials/server" "Server credentials directory.";
storage = mkDir "${config.xlib.dirs.server-home}/Storage" "General storage directory.";
calibre-library = mkDir "${config.xlib.dirs.server-home}/Books-Library" "Calibre library directory.";
music-library = mkDir "${config.xlib.dirs.user-home}/Music" "Music library directory.";
services-folder = mkDir "${config.xlib.dirs.server-home}/Services" "All services folder.";
services-mnt-folder = mkDir "/mnt/services" "All services folder.";
services-nodes-folder = mkDir "${config.xlib.dirs.services-mnt-folder}/nodes" "All nodes folder.";
postgresql-folder = mkDir "${config.xlib.dirs.services-mnt-folder}/postgresql" "PostgreSQL service folder.";
};
helpers = lib.mkOption {
type = lib.types.anything;
default = helpers;
description = "Shared helper functions (see lib/xlib.nix).";
};
};
};
modules/pkgs/beets.nix
+2 -7
View File
@@ -68,14 +68,9 @@ in
};
};
systemd.mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
(xlib.helpers.mkSystemdBind {
what = "/home/${xlib.device.username}/Music";
where = "/home/${xlib.device.username}/.config/beets";
}
})
];
}
modules/server/calibre-web.nix
+23 -14
View File
@@ -42,21 +42,30 @@ in
# };
};
systemd.tmpfiles.rules = [
"d ${libraryDir} 0755 calibre-web calibre-web -"
"d ${sourceDir} 0755 calibre-web calibre-web -"
"Z ${libraryDir} 0755 calibre-web calibre-web -"
"Z ${sourceDir} 0755 calibre-web calibre-web -"
];
fileSystems = {
"${targetDir}" = {
device = "${sourceDir}";
fsType = "none";
options = [
"bind"
"nofail"
systemd.tmpfiles.rules =
xlib.helpers.mkTmpDirs {
dir = libraryDir;
mode = "0755";
user = "calibre-web";
group = "calibre-web";
types = [
"d"
"Z"
];
}
++ xlib.helpers.mkTmpDirs {
dir = sourceDir;
mode = "0755";
user = "calibre-web";
group = "calibre-web";
types = [
"d"
"Z"
];
};
fileSystems = xlib.helpers.mkBindMount {
what = sourceDir;
where = targetDir;
};
}
modules/server/default.nix
+2 -2
View File
@@ -44,7 +44,7 @@
# ./zerotier.nix
];
systemd.tmpfiles.rules = [
"d /mnt 0755 root root -"
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
(xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
];
}
modules/server/gitea.nix
+6 -4
View File
@@ -22,8 +22,10 @@
};
};
systemd.tmpfiles.rules = [
"d ${config.services.gitea.stateDir} 0755 gitea gitea -"
"z ${config.services.gitea.stateDir} 0755 gitea gitea -"
];
systemd.tmpfiles.rules = xlib.helpers.mkTmpDirs {
dir = config.services.gitea.stateDir;
mode = "0755";
user = "gitea";
group = "gitea";
};
}
modules/server/homebox.nix
+10 -23
View File
@@ -5,8 +5,11 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/homebox";
targetDir = "/var/lib/homebox";
storage = xlib.helpers.mkServiceStorage {
name = "homebox";
user = "homebox";
group = "homebox";
};
in
{
services.homebox = {
@@ -14,33 +17,17 @@ in
settings = {
HBOX_WEB_HOST = "0.0.0.0";
HBOX_WEB_PORT = "7745";
HBOX_STORAGE_CONN_STRING = "file://${targetDir}";
HBOX_STORAGE_CONN_STRING = "file://${storage.target}";
HBOX_STORAGE_PREFIX_PATH = "data";
HBOX_DATABASE_DRIVER = "sqlite3";
HBOX_DATABASE_SQLITE_PATH = "${targetDir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_DATABASE_SQLITE_PATH = "${storage.target}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
HBOX_MODE = "production";
HOME = "${targetDir}";
TMPDIR = "${targetDir}/tmp";
HOME = "${storage.target}";
TMPDIR = "${storage.target}/tmp";
};
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0755 homebox homebox -"
"z ${sourceDir} 0755 homebox homebox -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
];
};
systemd = storage.systemd;
}
modules/server/immich.nix
+1 -1
View File
@@ -20,7 +20,7 @@
};
systemd.tmpfiles.rules = [
"z ${config.services.immich.mediaLocation} 0755 immich immich -"
(xlib.helpers.mkTmpfile "z" config.services.immich.mediaLocation "0755" "immich" "immich")
];
users.users.immich.extraGroups = [
modules/server/memos.nix
+1 -1
View File
@@ -21,6 +21,6 @@
};
systemd.tmpfiles.rules = [
"z /mnt/services/memos 0750 memos memos -"
(xlib.helpers.mkTmpfile "z" "${xlib.dirs.services-mnt-folder}/memos" "0750" "memos" "memos")
];
}
modules/server/n8n.nix
+6 -19
View File
@@ -7,8 +7,11 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/n8n";
targetDir = "/var/lib/n8n";
storage = xlib.helpers.mkServiceStorage {
name = "n8n";
user = "nobody";
group = "nogroup";
};
in
{
services.n8n = {
@@ -21,21 +24,5 @@ in
openFirewall = true;
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0755 nobody nogroup -"
"z ${sourceDir} 0755 nobody nogroup -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
];
};
systemd = storage.systemd;
}
modules/server/navidrome.nix
+4 -9
View File
@@ -24,14 +24,9 @@ in
};
};
systemd.mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${libraryDir}";
where = "${pointDir}";
}
(xlib.helpers.mkSystemdBind {
what = libraryDir;
where = pointDir;
})
];
}
modules/server/nextcloud.nix
+1 -1
View File
@@ -201,7 +201,7 @@
# };
systemd.tmpfiles.rules = [
"z ${config.services.nextcloud.home} 0750 nextcloud nextcloud -"
(xlib.helpers.mkTmpfile "z" config.services.nextcloud.home "0750" "nextcloud" "nextcloud")
];
environment.systemPackages = [
modules/server/nfs.nix
+1 -1
View File
@@ -6,7 +6,7 @@
}:
{
systemd.tmpfiles.rules = [
"z /export 0755 nobody nogroup -"
(xlib.helpers.mkTmpfile "z" "/export" "0755" "nobody" "nogroup")
];
services.nfs = {
server = {
modules/server/nginx.nix
+78 -93
View File
@@ -7,6 +7,83 @@
}:
let
server = "192.168.1.20";
# Standard TLS proxy vhost: "/" -> http://server:port
# Returns { name = domain; value = vhost; } for builtins.listToAttrs
mkProxy =
{
domain,
port,
addSSL ? false,
body ? false,
}:
{
name = domain;
value = {
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:${toString port}";
proxyWebsockets = true;
};
}
// lib.optionalAttrs (!addSSL) { forceSSL = true; }
// lib.optionalAttrs addSSL { addSSL = true; }
// lib.optionalAttrs body {
extraConfig = ''
client_max_body_size 5G;
'';
};
};
# Simple proxy sites
sites = [
{
domain = "immich.zeroq.su";
port = 2283;
addSSL = true;
body = true;
}
{
domain = "kuma.zeroq.su";
port = 4001;
}
{
domain = "health.zeroq.su";
port = 19999;
}
{
domain = "git.zeroq.su";
port = 3000;
}
{
domain = "homebox.zeroq.su";
port = 7745;
}
{
domain = "flux.zeroq.su";
port = 6061;
}
{
domain = "navidrome.zeroq.su";
port = 4533;
addSSL = true;
}
{
domain = "calibre.zeroq.su";
port = 8083;
body = true;
}
{
domain = "nix-cache.zeroq.su";
port = 5000;
body = true;
}
{
domain = "pdf.zeroq.su";
port = 8446;
body = true;
}
];
in
{
services = {
@@ -16,7 +93,7 @@ in
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
virtualHosts = (builtins.listToAttrs (map mkProxy sites)) // {
"nextcloud.private" = {
forceSSL = false;
enableACME = false;
@@ -169,49 +246,6 @@ in
# client_max_body_size 5G;
# '';
# };
"immich.zeroq.su" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:2283";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"kuma.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4001";
proxyWebsockets = true;
};
};
"health.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:19999";
proxyWebsockets = true;
};
};
"git.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:3000";
proxyWebsockets = true;
};
};
"homebox.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:7745";
proxyWebsockets = true;
};
};
# "agent.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
@@ -256,22 +290,6 @@ in
# };
};
};
"flux.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:6061";
proxyWebsockets = true;
};
};
"navidrome.zeroq.su" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4533";
proxyWebsockets = true;
};
};
"vetymae.opencodes.zeroq.su" = {
forceSSL = true;
enableACME = true;
@@ -323,39 +341,6 @@ in
client_max_body_size 5G;
'';
};
"calibre.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8083";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"nix-cache.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:5000";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"pdf.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8446";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
# "calibre.home.arpa" = {
# forceSSL = true;
# enableACME = true;
modules/server/postgresql.nix
+7 -19
View File
@@ -7,8 +7,12 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/postgresql";
targetDir = "/var/lib/postgresql";
storage = xlib.helpers.mkServiceStorage {
name = "postgresql";
user = "postgres";
group = "postgres";
mode = "0760";
};
in
{
services = {
@@ -19,21 +23,5 @@ in
# postgresqlBackup.enable = true;
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0760 postgres postgres -"
"z ${sourceDir} 0760 postgres postgres -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
];
};
systemd = storage.systemd;
}
modules/server/samba.nix
+6 -19
View File
@@ -6,8 +6,11 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/samba";
targetDir = "/var/lib/samba";
storage = xlib.helpers.mkServiceStorage {
name = "samba";
user = "root";
group = "root";
};
in
{
services = {
@@ -69,21 +72,5 @@ in
};
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0755 root root -"
"z ${sourceDir} 0755 root root -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
];
};
systemd = storage.systemd;
}
modules/server/step-ca.nix
+11 -12
View File
@@ -69,13 +69,9 @@ in
};
};
fileSystems."${targetDir}" = {
device = "${sourceDir}";
fsType = "none";
options = [
"bind"
"nofail"
];
fileSystems = xlib.helpers.mkBindMount {
what = sourceDir;
where = targetDir;
};
environment = {
@@ -84,11 +80,14 @@ in
];
};
systemd.tmpfiles.rules = [
"d ${sourceDir} 0755 nobody nogroup -"
"z ${sourceDir} 0755 nobody nogroup -"
"Z ${sourceDir}/ 0700 nobody nogroup -"
];
systemd.tmpfiles.rules =
xlib.helpers.mkTmpDirs {
dir = sourceDir;
mode = "0755";
user = "nobody";
group = "nogroup";
}
++ [ (xlib.helpers.mkTmpfile "Z" "${sourceDir}/" "0700" "nobody" "nogroup") ];
sops.secrets = {
intermediate-password = {
modules/server/trilium.nix
+1 -1
View File
@@ -18,6 +18,6 @@ in
};
systemd.tmpfiles.rules = [
"z ${sourceDir} 0750 trilium trilium -"
(xlib.helpers.mkTmpfile "z" sourceDir "0750" "trilium" "trilium")
];
}
modules/server/uptime-kuma.nix
+4 -8
View File
@@ -20,15 +20,11 @@ in
};
systemd.tmpfiles.rules = [
"z ${xlib.dirs.services-mnt-folder}/uptime-kuma 0755 nobody nogroup -"
(xlib.helpers.mkTmpfile "z" sourceDir "0755" "nobody" "nogroup")
];
fileSystems."${targetDir}" = {
device = "${xlib.dirs.services-mnt-folder}/uptime-kuma";
fsType = "none";
options = [
"bind"
"nofail"
];
fileSystems = xlib.helpers.mkBindMount {
what = sourceDir;
where = targetDir;
};
}
modules/users.nix
+45 -33
View File
@@ -2,23 +2,54 @@
config,
xlib,
lib,
pkgs,
...
}:
let
user = "${xlib.device.username}";
userGroup = config.users.users."${user}".group;
# sops secret factory: name == key by default, owner/group default to root
mkSecret =
{
path,
mode,
key ? null,
owner ? null,
group ? null,
}:
{
format = "yaml";
inherit path mode;
}
// lib.optionalAttrs (key != null) { inherit key; }
// lib.optionalAttrs (owner != null) { inherit owner; }
// lib.optionalAttrs (group != null) { inherit group; };
# default owner = device user
mkUserSecret =
args:
mkSecret (
args
// {
owner = user;
group = userGroup;
}
);
in
{
xlib.device.username = "oqyude";
users = {
mutableUsers = false;
users = {
"${xlib.device.username}" = {
name = "${xlib.device.username}";
"${user}" = {
name = "${user}";
isNormalUser = true;
group = "users";
description = "Jor Oqyude";
hashedPasswordFile = config.sops.secrets.hashed_password.path; # hashed_password
homeMode = "700";
home = "/home/${xlib.device.username}";
home = "/home/${user}";
extraGroups = [
"audio"
"disk"
@@ -46,51 +77,32 @@
secrets = {
hashed_password = {
neededForUsers = true;
format = "yaml";
key = "hashed_password";
format = "yaml";
};
age_key_private = {
format = "yaml";
key = "age_key_private";
path = "/home/${xlib.device.username}/.config/sops/age/keys.txt";
owner = config.users.users."${xlib.device.username}".name;
group = config.users.users."${xlib.device.username}".group;
age_key_private = mkUserSecret {
path = "${xlib.dirs.user-home}/.config/sops/age/keys.txt";
mode = "0600";
};
ssh_key_private = {
format = "yaml";
key = "ssh_key_private";
path = "/home/${xlib.device.username}/.ssh/id_ed25519";
owner = config.users.users."${xlib.device.username}".name;
group = config.users.users."${xlib.device.username}".group;
ssh_key_private = mkUserSecret {
path = "${xlib.dirs.user-home}/.ssh/id_ed25519";
mode = "0600";
};
ssh_key_public = {
format = "yaml";
key = "ssh_key_public";
path = "/home/${xlib.device.username}/.ssh/id_ed25519.pub";
owner = config.users.users."${xlib.device.username}".name;
group = config.users.users."${xlib.device.username}".group;
ssh_key_public = mkUserSecret {
path = "${xlib.dirs.user-home}/.ssh/id_ed25519.pub";
mode = "0655";
};
ssh_key_private_root = {
format = "yaml";
ssh_key_private_root = mkSecret {
key = "ssh_key_private";
path = "/root/.ssh/id_ed25519";
owner = "root";
group = "root";
mode = "0600";
};
ssh_key_public_root = {
format = "yaml";
ssh_key_public_root = mkSecret {
key = "ssh_key_public";
path = "/root/.ssh/id_ed25519.pub";
owner = "root";
group = "root";
mode = "0655";
};
ssh_key_public_host = {
format = "yaml";
ssh_key_public_host = mkSecret {
key = "ssh_key_public";
path = "/etc/ssh/id_ed25519.pub";
mode = "0655";
modules/vds/default.nix
+3 -2
View File
@@ -1,5 +1,6 @@
{
lib,
xlib,
...
}:
{
@@ -13,7 +14,7 @@
# ./xray.nix
];
systemd.tmpfiles.rules = [
"d /mnt 0755 root root -"
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
(xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
(xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
];
}