123

modules/vds/cloudflared.nix

@@ -0,0 +1,72 @@
+{ inputs, ... }@flakeContext:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    cloudflared = {
+      enable = true;
+      certificateFile = "${inputs.zeroq-credentials}/services/cloudflared/cert.pem";
+      tunnels = {
+        "58b340ee-e98a-4af9-b786-74600c71f49e" = {
+          credentialsFile = "${inputs.zeroq-credentials}/services/cloudflared/server.json";
+          warp-routing.enabled = true;
+          ingress = {
+            "immich.zeroq.ru" = {
+              service = "http://sapphira.latxa-platy.ts.net:2283";
+            };
+            "nextcloud.zeroq.ru" = {
+              service = "http://sapphira.latxa-platy.ts.net";
+            };
+          };
+          default = "http_status:404";
+        };
+        #         "58b340ee-e98a-4af9-b786-74600c71f49e" = {
+        #           credentialsFile = "${inputs.zeroq.dirs.server-credentials}/cloudflared/server.json";
+        #           warp-routing.enabled = true;
+        #           ingress = {
+        #             "nextcloud.zeroq.ru" = {
+        #               service = "http://localhost:10000";
+        #             };
+        #           };
+        #           default = "http_status:404";
+        #         };
+      };
+    };
+  };
+
+  #   users.users = {
+  #     cloudflared = {
+  #       group = "cloudflared";
+  #       isSystemUser = true;
+  #     };
+  #   };
+  #   users.groups.cloudflared = { };
+  #
+  #   systemd.services.cloudflared = {
+  #     after = [
+  #       "network.target"
+  #       "network-online.target"
+  #     ];
+  #     wants = [
+  #       "network.target"
+  #       "network-online.target"
+  #     ];
+  #     wantedBy = [ "multi-user.target" ];
+  #     serviceConfig = {
+  #       ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate --config=${inputs.zeroq.dirs.server-credentials}/cloudflared/config.yaml --origincert=${inputs.zeroq.dirs.server-credentials}/cloudflared/cert.pem --credentials-file=${inputs.zeroq.dirs.server-credentials}/cloudflared/server.json run";
+  #       Group = "root";
+  #       User = "root";
+  #       Restart = "on-failure";
+  #     };
+  #   };
+
+  environment = {
+    systemPackages = with pkgs; [
+      cloudflared
+    ];
+  };
+}

modules/vds/nginx.nix

@@ -0,0 +1,34 @@
+{ inputs, ... }@flakeContext:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    nginx = {
+      enable = false;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts = {
+        "localhost:10000" = {
+          forceSSL = false;
+          enableACME = false;
+          listen = [
+            {
+              addr = "100.64.0.0";
+              port = 10000;
+            }
+            {
+              addr = "192.168.1.20";
+              port = 10000;
+            }
+          ];
+        };
+      };
+    };
+  };
+}

modules/vds/xray.nix

@@ -0,0 +1,20 @@
+{ inputs, ... }@flakeContext:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services.xray = {
+    enable = true;
+    settings = inputs.zeroq-credentials.services.xray;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 443 ];
+    allowedUDPPorts = [ 443 ];
+  };
+
+  environment.systemPackages = with pkgs; [ xray ];
+}