oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-06-11 04:30:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

test

Browse Source
This commit is contained in:
Jor Oqyude
2026-03-01 16:02:34 +03:00
parent 4a8abddc82
commit d00e298dc5
10 changed files with 601 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/vds-new/containers/3x-ui.nix
+108
View File
@@ -0,0 +1,108 @@
# Auto-generated using compose2nix v0.3.3-pre.
{
pkgs,
lib,
config,
...
}:
{
# Runtime
virtualisation.podman = {
enable = true;
autoPrune = {
enable = true;
flags = [ "--all" ];
};
dockerCompat = true;
};
# Enable container name DNS for all Podman networks.
networking.firewall.interfaces =
let
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
in
{
"${matchAll}".allowedUDPPorts = [ 53 ];
};
networking.firewall = {
allowedUDPPortRanges = [
{
from = 14380;
to = 15380;
}
];
allowedTCPPortRanges = [
{
from = 14380;
to = 15380;
}
];
allowedTCPPorts = [
8443
9443
13380
];
allowedUDPPorts = [
8443
9443
13380
];
};
virtualisation.oci-containers.backend = "podman";
# Containers
virtualisation.oci-containers.containers."3xui_app" = {
image = "ghcr.io/mhsanaei/3x-ui:latest";
environment = {
"XRAY_VMESS_AEAD_FORCED" = "false";
"XUI_ENABLE_FAIL2BAN" = "true";
};
volumes = [
"/mnt/containers/3x-ui/cert/:/root/cert:rw"
"/mnt/containers/3x-ui/db/:/etc/x-ui:rw"
];
log-driver = "journald";
extraOptions = [
"--network=host"
];
};
systemd.services."podman-3xui_app" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
partOf = [
"podman-compose-3x-ui-root.target"
];
wantedBy = [
"podman-compose-3x-ui-root.target"
];
};
# Builds
systemd.services."podman-build-3xui_app" = {
path = [
pkgs.podman
pkgs.git
];
serviceConfig = {
Type = "oneshot";
TimeoutSec = 300;
};
script = ''
cd /mnt/containers/3x-ui
podman build -t compose2nix/3xui_app -f ./Dockerfile .
'';
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-3x-ui-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}
modules/vds-new/containers/default.nix
+16
View File
@@ -0,0 +1,16 @@
{
config,
pkgs,
inputs,
...
}:
{
imports = [
./3x-ui.nix
];
environment.systemPackages = with pkgs; [
compose2nix
podman-tui
];
}
modules/vds-new/default.nix
+10
View File
@@ -0,0 +1,10 @@
{
lib,
...
}:
{
imports = [
./containers
./nginx.nix
];
}
modules/vds-new/netbird.nix
+40
View File
@@ -0,0 +1,40 @@
{
config,
pkgs,
...
}:
{
services.netbird.server = {
enable = false;
enableNginx = true;
domain = "netbird.zeroq.ru";
dashboard = {
enable = false;
domain = "netbird.zeroq.ru";
settings = {
#AUTH_AUTHORITY = "nbp_ufe0v5mbb5H1lQWL8eJfuzJ5ItPmlM46Mik0";
};
};
management = {
enable = false;
domain = "netbird.zeroq.ru";
};
};
# networking.firewall = {
# allowedTCPPorts = [
# 80
# 443
# 33073
# 10000
# 33080
# ];
# allowedUDPPorts = [ 3478 ];
# allowedUDPPortRanges = [
# {
# from = 49152;
# to = 65535;
# }
# ];
# };
}
modules/vds-new/nginx.nix
+198
View File
@@ -0,0 +1,198 @@
{
config,
inputs,
pkgs,
...
}:
let
server = "100.64.0.0";
in
{
environment.etc."nginx/pubray".text = inputs.zeroq-credentials.services.xray.auth;
users.users.nginx.extraGroups = [ "acme" ];
services = {
nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
appendHttpConfig = inputs.zeroq-credentials.services.xray.maps;
virtualHosts = {
"pubray.zeroq.ru" = {
enableACME = true;
forceSSL = true;
root = "${inputs.zeroq-credentials.services.xray.subs}";
locations."/" = {
extraConfig = ''
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/pubray;
if ($subfile = "") { return 403; }
rewrite ^/$ $subfile break;
'';
};
};
"x.new.zeroq.ru" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://localhost:2049";
proxyWebsockets = true;
};
"/subs/" = {
proxyPass = "http://localhost:2096";
proxyWebsockets = true;
};
};
};
"kuma.new.zeroq.ru" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4001";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
# "node-red.zeroq.ru" = {
# forceSSL = true;
# enableACME = true;
# kTLS = true;
# locations."/" = {
# proxyPass = "http://${server}:1880";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
# "new.zeroq.ru" = {
# forceSSL = true;
# enableACME = true;
# root = pkgs.writeTextDir "index.html" ''
# <!doctype html>
# <html>
# <body>
# <pre>What are you doing here?</pre>
# </body>
# </html>
# '';
# locations = {
# "/guest/" = {
# proxyPass = "http://${server}:80";
# proxyWebsockets = true;
# };
# # "/.well-known/discord" = {
# # extraConfig = ''
# # default_type text/plain;
# # return 200 "dh=c2d103553a4cfdaa1b7952a87a7d8120a1e167cc";
# # '';
# # };
# };
# };
"flux.new.zeroq.ru" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:6061";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"office.new.zeroq.ru" = {
enableACME = true;
forceSSL = true;
locations = {
"/" = {
proxyPass = "http://${server}:9980"; # API и coauthoring
proxyWebsockets = true;
};
};
extraConfig = ''
client_max_body_size 5G;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
''; # absolute_redirect off;
};
"immich.new.zeroq.ru" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:2283";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"nextcloud.new.zeroq.ru" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://${server}:10000";
proxyWebsockets = true;
};
"/whiteboard" = {
proxyPass = "http://${server}:3002";
proxyWebsockets = true;
};
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"calibre.new.zeroq.ru" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8083";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
# "pdf.new.zeroq.ru" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:6060";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
# "ai.zeroq.ru" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:11112";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
};
};
};
security.acme = {
acceptTerms = true;
defaults = {
email = "go.bin043120@gmail.com";
};
};
networking.firewall.allowedTCPPorts = [
80
443
];
}