dns-server setup

flake.lock

@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781189114,
+        "lastModified": 1781365335,
-        "narHash": "sha256-5inaamLgUMWy+MOBE9ChF9QAF1o/74LFuHkI0W/9rqc=",
+        "narHash": "sha256-zqDBhXMzfbdlO7F2bGHe7MOtB3xngd/+4ieMHDC+ZXo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "486595d2cf49cfcd649b58a284fa11ac0e34da22",
+        "rev": "5b6f5733726a1b2ccafb5dec6ac4ca7299fad66c",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1781298072,
+        "lastModified": 1781461743,
-        "narHash": "sha256-p7sszdPeM3Gm7LA+NrWlxn5Rp6Qp+TGbt2qC/XBCxgI=",
+        "narHash": "sha256-gjBRAyMLpEJ+xtfHNLNE+5iFiSREBMmEYp8hFtL0Afs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "633f0c001a27731ee16cc504e831a4a9ccf071d6",
+        "rev": "94af5fb07bc318fb359ad100ab64457ccbbaf38a",
         "type": "github"
       },
       "original": {

modules/server/coredns.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  services.coredns = {
+    enable = true;
+    config = ''
+      zeroq.su:53 {
+          hosts {
+              192.168.1.20 agent.zeroq.su
+              192.168.1.20 bentopdf.zeroq.su
+              192.168.1.20 calibre.zeroq.su
+              192.168.1.20 dns.zeroq.su
+              192.168.1.20 flux.zeroq.su
+              192.168.1.20 gitea.zeroq.su
+              192.168.1.20 health.zeroq.su
+              192.168.1.20 immich.zeroq.su
+              192.168.1.20 kuma.zeroq.su
+              192.168.1.20 n8n.zeroq.su
+              192.168.1.20 nextcloud.zeroq.su
+              192.168.1.20 office.zeroq.su
+              fallthrough
+          }
+          cache 300
+          log
+      }
+      .:53 {
+          forward . 1.1.1.1 9.9.9.9
+          cache 300
+      }
+    '';
+  };
+}

modules/server/default.nix

@@ -7,6 +7,7 @@
     ../software/beets
     ./bentopdf.nix
     ./calibre-web.nix
+    ./coredns.nix
     ./gitea.nix
     ./glances.nix
     ./immich.nix
@@ -20,6 +21,7 @@
     ./open-webui.nix
     ./postgresql.nix
     ./samba.nix
+    ./step-ca.nix
     ./stirling-pdf.nix
     ./syncthing.nix
     ./systemd.nix

modules/server/n8n.nix

@@ -6,11 +6,15 @@
   inputs,
   ...
 }:
+let
+  configDir = "${xlib.dirs.services-mnt-folder}/n8n";
+  varDir = "/var/lib/n8n";
+in
 {
   services.n8n = {
     enable = false;
     environment = {
-      # N8N_USER_FOLDER = lib.mkForce "${xlib.dirs.services-mnt-folder}/n8n";
+      # N8N_USER_FOLDER = lib.mkForce "${configDir}";
       N8N_SECURE_COOKIE = "false";
       N8N_PORT = 5678;
     };
@@ -18,12 +22,12 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${xlib.dirs.services-mnt-folder}/n8n 0755 nobody nogroup -"
+    "d ${configDir} 0755 nobody nogroup -"
-    "z ${xlib.dirs.services-mnt-folder}/n8n 0755 nobody nogroup -"
+    "z ${configDir} 0755 nobody nogroup -"
   ];
 
-  fileSystems."/var/lib/n8n" = {
+  fileSystems.${varDir} = {
-    device = "${xlib.dirs.services-mnt-folder}/n8n";
+    device = "${configDir}";
     fsType = "none";
     options = [
       "bind"

modules/server/nginx.nix

@@ -34,22 +34,6 @@ in
         "office.local" = {
           forceSSL = false;
           enableACME = false;
-          # locations = {
-          #   "/" = {
-          #     proxyPass = "http://localhost:8090";
-          #     proxyWebsockets = true;
-          #   };
-          # };
-          # extraConfig = ''
-          #   proxy_set_header Host $host;
-          #   proxy_set_header X-Forwarded-Proto $scheme;
-          #   proxy_set_header X-Forwarded-Host $host;
-          #   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-          #   proxy_http_version 1.1;
-          #   proxy_set_header Upgrade $http_upgrade;
-          #   proxy_set_header Connection "upgrade";
-          # '';
         };
         "bentopdf.local" = {
           forceSSL = false;
@@ -100,6 +84,23 @@ in
             client_max_body_size 5G;
           '';
         };
+        "nextcloud.zeroq.su" = {
+          forceSSL = false;
+          enableACME = false;
+          locations = {
+            "/" = {
+              proxyPass = "http://${server}:10000";
+              proxyWebsockets = true;
+            };
+            "/whiteboard" = {
+              proxyPass = "http://${server}:3002";
+              proxyWebsockets = true;
+            };
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
         "n8n.local" = {
           forceSSL = false;
           enableACME = false;
@@ -154,22 +155,6 @@ in
             client_max_body_size 5G;
           '';
         };
-        #         "office.local" = {
-        #           enableACME = false;
-        #           forceSSL = false;
-        #           locations = {
-        #             "/" = {
-        #               proxyPass = "http://${server}:8000"; # 9980
-        #               proxyWebsockets = true;
-        #             };
-        #           };
-        #           extraConfig = ''
-        #             client_max_body_size 5G;
-        #             proxy_set_header X-Forwarded-Proto $scheme;
-        #             proxy_set_header X-Real-IP $remote_addr;
-        #             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        #           ''; # absolute_redirect off;
-        #         };
         "calibre.local" = {
           forceSSL = false;
           enableACME = false;

modules/server/secrets/ca.json

@@ -0,0 +1,46 @@
+{
+	"root": "/root/.step/certs/root_ca.crt",
+	"federatedRoots": null,
+	"crt": "/root/.step/certs/intermediate_ca.crt",
+	"key": "/root/.step/secrets/intermediate_ca_key",
+	"address": "0.0.0.0:9000",
+	"insecureAddress": "",
+	"dnsNames": [
+		"ca.zeroq.su"
+	],
+	"logger": {
+		"format": "text"
+	},
+	"db": {
+		"type": "badgerv2",
+		"dataSource": "/root/.step/db",
+		"badgerFileLoadingMode": ""
+	},
+	"authority": {
+		"provisioners": [
+			{
+				"type": "JWK",
+				"name": "oqyude@zeroq.su",
+				"key": {
+					"use": "sig",
+					"kty": "EC",
+					"kid": "vhOaaOVnwo0MtJVP13ZM60ckirLUqq-5WEbq2PQTQ-w",
+					"crv": "P-256",
+					"alg": "ES256",
+					"x": "0WXy0B9DHwz4POacxrSiml7bbOPFYPKVvyUlm18M5ro",
+					"y": "AptaeuzpC2TV9_hHAx8s2afDmCa_QJSzke23kCYzKfU"
+				},
+				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiVTBRS24wUHFJUUZiNTRyRkVYeDVwZyJ9.Xc96u-JxlKELcawpLmyrzqp4_UUY1sAqUo7PX6hBWL8_Ix2RzS8ZwA.fs5K5A9kXmp3KEUu.J1s016RTlqKbfRzQJB1bdz8v93S9PLpU3DqlEvIVnOIEhovL9vG5dzPLAfLApZ_MArHhubVkirHhZHB4fYd3KvbFpCRaYQomB4vP0V188zclL7gyatiQ36R_fTG_oiRiKHeP0nPubVpL-I-ESdtXR05pMQtit5A1luLGm3H78FuTF883Hiz-hc84v8E-nq0Z5l5zQeV-fy4QaCFzg1_5s7MacNlgplDLopzbfJIhp3SDKiwWjsotPjsuKMSQ-blawbBL5skf44t23hDelSaRvASq8-Dq-hkBLsKssMX7SzccHPWpxazZ07Ug8PKc8_o2kxc6k5-K0Xr5tY4h8VI.YSsnw_InABsga1SCjLtq1g"
+			}
+		]
+	},
+	"tls": {
+		"cipherSuites": [
+			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+		],
+		"minVersion": 1.2,
+		"maxVersion": 1.3,
+		"renegotiation": false
+	}
+}

modules/server/secrets/step-ca.yaml

@@ -0,0 +1,16 @@
+intermediate-password: ENC[AES256_GCM,data:SvV5uYVXVTuhh/dhzXIDJw69dJ3s33a0ibKCyDWnfyA=,iv:S9VydNWm4PL+quWQ7arCmSFXa6YO1/hL+xrYty/2IPE=,tag:zHJ6/ZNRfs9w9vrt77xdow==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5K3YyYkRkVkxwamMybWRj
+            WGxEZnc3TGRYRHNtTXRZYlZKQ2hBK0YrQjNZCndVQVhYcTJqRitCdUdmMjduTk1M
+            azNnMUhHKzB1M25vZGFScjZBcHJOaUEKLS0tIHJBRnZwamhvYU1ybFVFMFZsTmVS
+            ZmN3NTVnZ1RwRkNzTUxJTjVGMU4yUHMKMEZdpDBm6pdZmrFidkOdivnnd2/b8OO/
+            IUYmiWPlPd1IDV1NeMtlSYtO8exzB22XL9DqW4x/tJ7DeSZaBsjcOw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-06-13T22:59:34Z"
+    mac: ENC[AES256_GCM,data:72E73xauS1Xrfw6tcyN/PHSJZ4ZZnIeKp8JVUPFGPBvIzaD6ZThYZwQ10FDD4JF+YOwn3QhCEh3t0ozcSNNnJFkyBgSqFtRMkym0ede12VAOPu2wQFoNvMdkT7+n14lJ/9OOz6KDyMf0BQDJKlSfDBkt+mLi61zte5iUxPsWsp4=,iv:xuOwFBEnlRgbaVdMq4O6w9T2edpS6uEPh9yhNbYBJIk=,tag:Y+dtcU17Q83o/9Nt1LGCcg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

modules/server/step-ca.nix

@@ -0,0 +1,83 @@
+{
+  config,
+  inputs,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  configDir = "${xlib.dirs.services-mnt-folder}/step-ca";
+  varDir = "/var/lib/step-ca";
+in
+{
+  services.step-ca = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 9000;
+    openFirewall = true;
+    intermediatePasswordFile = config.sops.secrets.intermediate-password.path;
+    settings = {
+      root = "${varDir}/certs/root_ca.crt";
+      crt = "${varDir}/certs/intermediate_ca.crt";
+      key = "${varDir}/secrets/intermediate_ca_key";
+      # address = "0.0.0.0:9000";
+      dnsNames = [
+        "ca.zeroq.su"
+      ];
+      db = {
+        type = "badgerv2";
+        dataSource = "${varDir}/db";
+      };
+      authority = {
+        provisioners = [
+          {
+            type = "JWK";
+            name = "oqyude@zeroq.su";
+            key = {
+              use = "sig";
+              kty = "EC";
+              kid = "XEpzFJA-sedFf0ANCiEH1UDaSvrHiZabLahQOyoAYmc";
+              crv = "P-256";
+              alg = "ES256";
+              x = "AGHevH0UU7_abhE6d8JhNuNRgXBeVI7qCldZrFfkn5o";
+              y = "pLKOpAwUiGRv4HRQUyiXFAMqsywTjrjazeEkDOr29Sk";
+            };
+            encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoibFlONzBwMWJiVzc0MDlGaS1EOEZVUSJ9.zBEsf2hAaj4yyy_Lk1Jss7h5Hn68kz6UMeg3Jz3X_VVeMWLvcoRVaw.tpY50S9CSzmcfWXz.u5ta_Yd3GLMz19RKA2WondVIwTGbGs3is5v7_D0aUOtQ0158d4GcjrOHFD2PexaackbTNuUPtqa2X38ypnFq5wh1uq3udWu-qWRjRSd_YkY4YJt_GWFvUHQ_jldx0NSfMDNGndU2IakR62-9WklEjU3UGmUeaPGP9DTuzmdJa36t2aLuPuNnmV-tEJIH3eQ5huU8nLy1ROZjdkrF-agHh78EG_Ss8P4vHuqOtTAjZW3YCtfSfb57iKAsbrk3nUTo6zhPc0ds8cPB7Rva0K8Rj2Pf3apB7qZnCVF5zBiu1icvhOYIfwVQAiqpdz6qMi42QSBWZ4ROu4Db2q5a6D0.AS7Dr3v_Niiwy7aHIR-0bw";
+          }
+        ];
+      };
+    };
+  };
+
+  fileSystems."${varDir}" = {
+    device = "${configDir}";
+    fsType = "none";
+    options = [
+      "bind"
+      "nofail"
+    ];
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      step-cli
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${configDir} 0755 nobody nogroup -"
+    "z ${configDir} 0755 nobody nogroup -"
+    "Z ${configDir}/ 0700 nobody nogroup -"
+  ];
+
+  sops.secrets = {
+    intermediate-password = {
+      format = "yaml";
+      key = "intermediate-password";
+      sopsFile = ./secrets/step-ca.yaml;
+      # owner = "nobody";
+      # group = "nogroup";
+      mode = "0600";
+    };
+  };
+}

modules/server/systemd.nix

@@ -11,15 +11,6 @@
       rsync-archivesta = {
         # Archivesta
         description = "Backup data using rsync";
-        # wants = [
-        #   "mnt-archive.mount"
-        # ];
-        # requires = [
-        #   "mnt-archive.mount"
-        # ];
-        # after = [
-        #   "mnt-archive.mount"
-        # ];
         unitConfig.RequiresMountsFor = [
           "${xlib.dirs.archive-drive}"
           "${xlib.dirs.server-home}"
@@ -42,15 +33,6 @@
       rsync-archivesta-lite = {
         # Archivesta Lite
         description = "Backup data using rsync";
-        # wants = [
-        #   "mnt-mobile.mount"
-        # ];
-        # after = [
-        #   "mnt-mobile.mount"
-        # ];
-        # requires = [
-        #   "mnt-mobile.mount"
-        # ];
         unitConfig.RequiresMountsFor = [
           "${xlib.dirs.server-home}"
           "${xlib.dirs.mobile-drive}"