oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-06-15 22:41:52 +03:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: oqyude/nixos:6468c6583e601923e43d7f83683b7094c7f504ca
Branches Tags
oqyude/nixos:master oqyude/nixos:dev oqyude/nixos:old
...
compare: oqyude/nixos:dev
Branches Tags
oqyude/nixos:dev oqyude/nixos:master oqyude/nixos:old

5 Commits
6468c6583e ... dev

Author SHA1 Message Date
oqyude d033c55b4e 1 2026-06-15 22:36:49 +03:00
oqyude 3c3e3c75fb n8n removed 2026-06-15 22:35:21 +03:00
oqyude acd8b33a8b coredns added 2026-06-14 22:10:22 +03:00
oqyude 624b63bc02 n8n added 2026-06-14 19:05:58 +03:00
oqyude 544aafd919 step-ca added 2026-06-14 01:59:39 +03:00
9 changed files with 204 additions and 61 deletions
Expand all files Collapse all files
flake.lock
Generated
+6 -6
View File
@@ -88,11 +88,11 @@
]
},
"locked": {
"lastModified": 1781189114,
"narHash": "sha256-5inaamLgUMWy+MOBE9ChF9QAF1o/74LFuHkI0W/9rqc=",
"lastModified": 1781365335,
"narHash": "sha256-zqDBhXMzfbdlO7F2bGHe7MOtB3xngd/+4ieMHDC+ZXo=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "486595d2cf49cfcd649b58a284fa11ac0e34da22",
"rev": "5b6f5733726a1b2ccafb5dec6ac4ca7299fad66c",
"type": "github"
},
"original": {
@@ -191,11 +191,11 @@
},
"nixpkgs-master": {
"locked": {
"lastModified": 1781298072,
"narHash": "sha256-p7sszdPeM3Gm7LA+NrWlxn5Rp6Qp+TGbt2qC/XBCxgI=",
"lastModified": 1781461743,
"narHash": "sha256-gjBRAyMLpEJ+xtfHNLNE+5iFiSREBMmEYp8hFtL0Afs=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "633f0c001a27731ee16cc504e831a4a9ccf071d6",
"rev": "94af5fb07bc318fb359ad100ab64457ccbbaf38a",
"type": "github"
},
"original": {
modules/server/coredns.nix
+25
View File
@@ -0,0 +1,25 @@
{
config,
pkgs,
...
}:
{
services.coredns = {
enable = true;
config = ''
zeroq.su:53 {
hosts {
192.168.1.20 dns.zeroq.su
192.168.1.20 immich.zeroq.su
fallthrough
}
cache 300
log
}
.:53 {
forward . 1.1.1.1 9.9.9.9
cache 300
}
'';
};
}
modules/server/default.nix
+2
View File
@@ -7,6 +7,7 @@
../software/beets
./bentopdf.nix
./calibre-web.nix
./coredns.nix
./gitea.nix
./glances.nix
./immich.nix
@@ -20,6 +21,7 @@
./open-webui.nix
./postgresql.nix
./samba.nix
./step-ca.nix
./stirling-pdf.nix
./syncthing.nix
./systemd.nix
modules/server/n8n.nix
+9 -5
View File
@@ -6,11 +6,15 @@
inputs,
...
}:
let
configDir = "${xlib.dirs.services-mnt-folder}/n8n";
varDir = "/var/lib/n8n";
in
{
services.n8n = {
enable = false;
environment = {
# N8N_USER_FOLDER = lib.mkForce "${xlib.dirs.services-mnt-folder}/n8n";
# N8N_USER_FOLDER = lib.mkForce "${configDir}";
N8N_SECURE_COOKIE = "false";
N8N_PORT = 5678;
};
@@ -18,12 +22,12 @@
};
systemd.tmpfiles.rules = [
"d ${xlib.dirs.services-mnt-folder}/n8n 0755 nobody nogroup -"
"z ${xlib.dirs.services-mnt-folder}/n8n 0755 nobody nogroup -"
"d ${configDir} 0755 nobody nogroup -"
"z ${configDir} 0755 nobody nogroup -"
];
fileSystems."/var/lib/n8n" = {
device = "${xlib.dirs.services-mnt-folder}/n8n";
fileSystems.${varDir} = {
device = "${configDir}";
fsType = "none";
options = [
"bind"
modules/server/nginx.nix
+17 -32
View File
@@ -34,22 +34,6 @@ in
"office.local" = {
forceSSL = false;
enableACME = false;
# locations = {
# "/" = {
# proxyPass = "http://localhost:8090";
# proxyWebsockets = true;
# };
# };
# extraConfig = ''
# proxy_set_header Host $host;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header X-Forwarded-Host $host;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_http_version 1.1;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
# '';
};
"bentopdf.local" = {
forceSSL = false;
@@ -100,6 +84,23 @@ in
client_max_body_size 5G;
'';
};
"nextcloud.zeroq.su" = {
forceSSL = false;
enableACME = false;
locations = {
"/" = {
proxyPass = "http://${server}:10000";
proxyWebsockets = true;
};
"/whiteboard" = {
proxyPass = "http://${server}:3002";
proxyWebsockets = true;
};
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"n8n.local" = {
forceSSL = false;
enableACME = false;
@@ -154,22 +155,6 @@ in
client_max_body_size 5G;
'';
};
# "office.local" = {
# enableACME = false;
# forceSSL = false;
# locations = {
# "/" = {
# proxyPass = "http://${server}:8000"; # 9980
# proxyWebsockets = true;
# };
# };
# extraConfig = ''
# client_max_body_size 5G;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# ''; # absolute_redirect off;
# };
"calibre.local" = {
forceSSL = false;
enableACME = false;
modules/server/secrets/ca.json
+46
View File
@@ -0,0 +1,46 @@
{
"root": "/root/.step/certs/root_ca.crt",
"federatedRoots": null,
"crt": "/root/.step/certs/intermediate_ca.crt",
"key": "/root/.step/secrets/intermediate_ca_key",
"address": "0.0.0.0:9000",
"insecureAddress": "",
"dnsNames": [
"ca.zeroq.su"
],
"logger": {
"format": "text"
},
"db": {
"type": "badgerv2",
"dataSource": "/root/.step/db",
"badgerFileLoadingMode": ""
},
"authority": {
"provisioners": [
{
"type": "JWK",
"name": "oqyude@zeroq.su",
"key": {
"use": "sig",
"kty": "EC",
"kid": "vhOaaOVnwo0MtJVP13ZM60ckirLUqq-5WEbq2PQTQ-w",
"crv": "P-256",
"alg": "ES256",
"x": "0WXy0B9DHwz4POacxrSiml7bbOPFYPKVvyUlm18M5ro",
"y": "AptaeuzpC2TV9_hHAx8s2afDmCa_QJSzke23kCYzKfU"
},
"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiVTBRS24wUHFJUUZiNTRyRkVYeDVwZyJ9.Xc96u-JxlKELcawpLmyrzqp4_UUY1sAqUo7PX6hBWL8_Ix2RzS8ZwA.fs5K5A9kXmp3KEUu.J1s016RTlqKbfRzQJB1bdz8v93S9PLpU3DqlEvIVnOIEhovL9vG5dzPLAfLApZ_MArHhubVkirHhZHB4fYd3KvbFpCRaYQomB4vP0V188zclL7gyatiQ36R_fTG_oiRiKHeP0nPubVpL-I-ESdtXR05pMQtit5A1luLGm3H78FuTF883Hiz-hc84v8E-nq0Z5l5zQeV-fy4QaCFzg1_5s7MacNlgplDLopzbfJIhp3SDKiwWjsotPjsuKMSQ-blawbBL5skf44t23hDelSaRvASq8-Dq-hkBLsKssMX7SzccHPWpxazZ07Ug8PKc8_o2kxc6k5-K0Xr5tY4h8VI.YSsnw_InABsga1SCjLtq1g"
}
]
},
"tls": {
"cipherSuites": [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
],
"minVersion": 1.2,
"maxVersion": 1.3,
"renegotiation": false
}
}
modules/server/secrets/step-ca.yaml
+16
View File
@@ -0,0 +1,16 @@
intermediate-password: ENC[AES256_GCM,data:SvV5uYVXVTuhh/dhzXIDJw69dJ3s33a0ibKCyDWnfyA=,iv:S9VydNWm4PL+quWQ7arCmSFXa6YO1/hL+xrYty/2IPE=,tag:zHJ6/ZNRfs9w9vrt77xdow==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5K3YyYkRkVkxwamMybWRj
WGxEZnc3TGRYRHNtTXRZYlZKQ2hBK0YrQjNZCndVQVhYcTJqRitCdUdmMjduTk1M
azNnMUhHKzB1M25vZGFScjZBcHJOaUEKLS0tIHJBRnZwamhvYU1ybFVFMFZsTmVS
ZmN3NTVnZ1RwRkNzTUxJTjVGMU4yUHMKMEZdpDBm6pdZmrFidkOdivnnd2/b8OO/
IUYmiWPlPd1IDV1NeMtlSYtO8exzB22XL9DqW4x/tJ7DeSZaBsjcOw==
-----END AGE ENCRYPTED FILE-----
recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
lastmodified: "2026-06-13T22:59:34Z"
mac: ENC[AES256_GCM,data:72E73xauS1Xrfw6tcyN/PHSJZ4ZZnIeKp8JVUPFGPBvIzaD6ZThYZwQ10FDD4JF+YOwn3QhCEh3t0ozcSNNnJFkyBgSqFtRMkym0ede12VAOPu2wQFoNvMdkT7+n14lJ/9OOz6KDyMf0BQDJKlSfDBkt+mLi61zte5iUxPsWsp4=,iv:xuOwFBEnlRgbaVdMq4O6w9T2edpS6uEPh9yhNbYBJIk=,tag:Y+dtcU17Q83o/9Nt1LGCcg==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1
modules/server/step-ca.nix
+83
View File
@@ -0,0 +1,83 @@
{
config,
inputs,
pkgs,
xlib,
...
}:
let
configDir = "${xlib.dirs.services-mnt-folder}/step-ca";
varDir = "/var/lib/step-ca";
in
{
services.step-ca = {
enable = true;
address = "0.0.0.0";
port = 9000;
openFirewall = true;
intermediatePasswordFile = config.sops.secrets.intermediate-password.path;
settings = {
root = "${varDir}/certs/root_ca.crt";
crt = "${varDir}/certs/intermediate_ca.crt";
key = "${varDir}/secrets/intermediate_ca_key";
# address = "0.0.0.0:9000";
dnsNames = [
"ca.zeroq.su"
];
db = {
type = "badgerv2";
dataSource = "${varDir}/db";
};
authority = {
provisioners = [
{
type = "JWK";
name = "oqyude@zeroq.su";
key = {
use = "sig";
kty = "EC";
kid = "XEpzFJA-sedFf0ANCiEH1UDaSvrHiZabLahQOyoAYmc";
crv = "P-256";
alg = "ES256";
x = "AGHevH0UU7_abhE6d8JhNuNRgXBeVI7qCldZrFfkn5o";
y = "pLKOpAwUiGRv4HRQUyiXFAMqsywTjrjazeEkDOr29Sk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoibFlONzBwMWJiVzc0MDlGaS1EOEZVUSJ9.zBEsf2hAaj4yyy_Lk1Jss7h5Hn68kz6UMeg3Jz3X_VVeMWLvcoRVaw.tpY50S9CSzmcfWXz.u5ta_Yd3GLMz19RKA2WondVIwTGbGs3is5v7_D0aUOtQ0158d4GcjrOHFD2PexaackbTNuUPtqa2X38ypnFq5wh1uq3udWu-qWRjRSd_YkY4YJt_GWFvUHQ_jldx0NSfMDNGndU2IakR62-9WklEjU3UGmUeaPGP9DTuzmdJa36t2aLuPuNnmV-tEJIH3eQ5huU8nLy1ROZjdkrF-agHh78EG_Ss8P4vHuqOtTAjZW3YCtfSfb57iKAsbrk3nUTo6zhPc0ds8cPB7Rva0K8Rj2Pf3apB7qZnCVF5zBiu1icvhOYIfwVQAiqpdz6qMi42QSBWZ4ROu4Db2q5a6D0.AS7Dr3v_Niiwy7aHIR-0bw";
}
];
};
};
};
fileSystems."${varDir}" = {
device = "${configDir}";
fsType = "none";
options = [
"bind"
"nofail"
];
};
environment = {
systemPackages = with pkgs; [
step-cli
];
};
systemd.tmpfiles.rules = [
"d ${configDir} 0755 nobody nogroup -"
"z ${configDir} 0755 nobody nogroup -"
"Z ${configDir}/ 0700 nobody nogroup -"
];
sops.secrets = {
intermediate-password = {
format = "yaml";
key = "intermediate-password";
sopsFile = ./secrets/step-ca.yaml;
# owner = "nobody";
# group = "nogroup";
mode = "0600";
};
};
}
modules/server/systemd.nix
-18
View File
@@ -11,15 +11,6 @@
rsync-archivesta = {
# Archivesta
description = "Backup data using rsync";
# wants = [
# "mnt-archive.mount"
# ];
# requires = [
# "mnt-archive.mount"
# ];
# after = [
# "mnt-archive.mount"
# ];
unitConfig.RequiresMountsFor = [
"${xlib.dirs.archive-drive}"
"${xlib.dirs.server-home}"
@@ -42,15 +33,6 @@
rsync-archivesta-lite = {
# Archivesta Lite
description = "Backup data using rsync";
# wants = [
# "mnt-mobile.mount"
# ];
# after = [
# "mnt-mobile.mount"
# ];
# requires = [
# "mnt-mobile.mount"
# ];
unitConfig.RequiresMountsFor = [
"${xlib.dirs.server-home}"
"${xlib.dirs.mobile-drive}"