oqyude/nixos
1
0
Fork 0
mirror of https://github.com/oqyude/nixos.git synced 2026-08-10 08:33:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: oqyude/nixos:dev
Branches Tags
oqyude/nixos:master oqyude/nixos:dev oqyude/nixos:old
..
compare: oqyude/nixos:4636868b433aa9c58c95e154e85a9a8dbd07b4a2
Branches Tags
oqyude/nixos:dev oqyude/nixos:master oqyude/nixos:old
1 Commits
dev .. 4636868b43
Author SHA1 Message Date
oqyude 4636868b43 unused code 2026-08-08 02:30:01 +03:00
29 changed files with 520 additions and 483 deletions
Expand all files Collapse all files
configurations/hardware/server.nix
-1
View File
@@ -28,7 +28,6 @@
kernel = {
sysctl = {
"fs.inotify.max_user_watches" = "204800";
"net.ipv4.ip_forward" = 1;
};
};
kernelModules = [
configurations/server.nix
+4 -4
View File
@@ -110,10 +110,10 @@ let
hostName = "${xlib.device.hostname}";
networkmanager.enable = true;
firewall.enable = false;
# nameservers = [
# "192.168.1.1"
# "127.0.0.1"
# ];
nameservers = [
"127.0.0.1"
"192.168.1.1"
];
};
system = {
flake.lock
Generated
+18 -18
View File
@@ -13,11 +13,11 @@
]
},
"locked": {
"lastModified": 1785892481,
"narHash": "sha256-1JTy9/LyITSBP1a4WZ9tmOv2yDh9OTbA3YUJbQHiMYc=",
"lastModified": 1785518313,
"narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "f6f2359a6cb7e3c51ea673bcb39933ac2622350d",
"rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
"type": "github"
},
"original": {
@@ -88,11 +88,11 @@
]
},
"locked": {
"lastModified": 1786031233,
"narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
"lastModified": 1785531816,
"narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "7834e82588860aaf780cec1366524456a70898d7",
"rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe",
"type": "github"
},
"original": {
@@ -277,11 +277,11 @@
},
"nixpkgs-master": {
"locked": {
"lastModified": 1786198689,
"narHash": "sha256-XkvYmpRd4cmcrzKS8QplEHPZkDDeKwpalJQwosCd3+Q=",
"lastModified": 1785744216,
"narHash": "sha256-DoNu3f4opSpQOTSaC/SYzSDDmcej4GBsT5s7rum7TYk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "94ec6671dbe7d4879c2c8103e67425e85bf066d7",
"rev": "34dca5401eac106b575afb642997094472f0d449",
"type": "github"
},
"original": {
@@ -325,11 +325,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1785975029,
"narHash": "sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU=",
"lastModified": 1785602060,
"narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "70ce234312134a463ba7728e94da2486a1d237ac",
"rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e",
"type": "github"
},
"original": {
@@ -341,11 +341,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1785967620,
"narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
"lastModified": 1785571196,
"narHash": "sha256-KoTsyMQqnXQZq8deCEnu4QkyldkwH/bpMMhUcfMdGIw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
"rev": "148bab9c1c3c53136ecb44a6ea356a0ed5b39b06",
"type": "github"
},
"original": {
@@ -403,11 +403,11 @@
]
},
"locked": {
"lastModified": 1785762349,
"narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
"lastModified": 1783574839,
"narHash": "sha256-ICof1tV4/9XheBLBGf7dhMhfMq4dOs1zwTHrr7zGFlA=",
"owner": "nix-community",
"repo": "plasma-manager",
"rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
"rev": "c551f0687658e4bb699cfff6015436ad7ee57a0d",
"type": "github"
},
"original": {
modules/containers/3x-ui.nix
+9 -12
View File
@@ -5,9 +5,6 @@
xlib,
...
}:
let
panel = "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}/3x-ui";
in
{
virtualisation = {
podman = {
@@ -28,8 +25,8 @@ in
"TZ" = "Europe/Moscow";
};
volumes = [
"${panel}/cert/:/root/cert:rw"
"${panel}/db/:/etc/x-ui:rw"
"${xlib.dirs.services-mnt-folder}/containers/3x-ui/cert/:/root/cert:rw"
"${xlib.dirs.services-mnt-folder}/containers/3x-ui/db/:/etc/x-ui:rw"
];
log-driver = "journald";
extraOptions = [
@@ -100,13 +97,13 @@ in
};
# Folders
tmpfiles.rules = [
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
"d ${xlib.dirs.services-nodes-folder} 0755 root root -"
"d ${xlib.dirs.services-nodes-folder}/${xlib.device.hostname} 0755 root root -"
"d ${panel} 0755 root root -"
"d ${panel}/db 0755 root root -"
"d ${panel}/cert 0755 root root -"
"Z ${panel} 0755 root root -"
"d /mnt 0755 root root -"
"d /mnt/services 0755 root root -"
"d /mnt/services/containers 0755 root root -"
"d /mnt/services/containers/3x-ui 0755 root root -"
"d /mnt/services/containers/3x-ui/cert 0755 root root -"
"d /mnt/services/containers/3x-ui/db 0755 root root -"
"Z /mnt/services/containers/3x-ui 0755 root root -"
];
};
modules/essentials/settings.nix
+2 -2
View File
@@ -15,7 +15,7 @@
settings = {
require-sigs = false;
substituters = [
"https://nix-cache.zeroq.su"
"http://100.64.0.0:5000"
"https://cache.nixos.org"
"https://nix-community.cachix.org"
"https://mirror.yandex.ru/nixos"
@@ -27,7 +27,7 @@
# "https://nixos.snix.store" # https://nixos.snix.store/
];
trusted-public-keys = [
"nix-cache.zeroq.su:be5jFLkiwNyOep/McxSafB3jguBmztxx+oJ46ySyc/s="
"nix-cache.home.arpa:be5jFLkiwNyOep/McxSafB3jguBmztxx+oJ46ySyc/s="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
stalled-download-timeout = 8;
modules/options.nix
-5
View File
@@ -118,11 +118,6 @@
default = "/mnt/services";
description = "All services folder.";
};
services-nodes-folder = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.services-mnt-folder}/nodes";
description = "All nodes folder.";
};
postgresql-folder = lib.mkOption {
type = lib.types.str;
default = "${config.xlib.dirs.services-mnt-folder}/postgresql";
modules/server/acme.nix
+11 -11
View File
@@ -8,20 +8,20 @@
acme = {
acceptTerms = true;
defaults = {
email = "oqyude@gmail.com";
email = "oqyude@zeroq.su";
server = "https://localhost:9000/acme/acme/directory";
dnsProvider = null;
};
# certs = {
# "home.arpa" = {
# email = "oqyude@zeroq.su";
# domain = "*.home.arpa";
# server = "https://localhost:9000/acme/acme/directory";
# listenHTTP = ":80";
# dnsProvider = null;
# };
# # "turn.home.arpa" = {
# # listenHTTP = "127.0.0.1:80";
# # group = "turnserver";
# # "home.arpa" = {
# # domain = "*.home.arpa";
# # server = "https://localhost:9000/acme/acme/directory";
# # listenHTTP = ":80";
# # };
# "turn.home.arpa" = {
# listenHTTP = "127.0.0.1:80";
# group = "turnserver";
# };
# };
};
};
modules/server/calibre-web.nix
+9 -14
View File
@@ -6,21 +6,18 @@
...
}:
let
# stable = import inputs.nixpkgs-previous {
# system = "x86_64-linux";
# };
libraryDir = "${xlib.dirs.services-mnt-folder}/calibre-web-library";
sourceDir = "${xlib.dirs.services-mnt-folder}/calibre-web";
targetDir = "/var/lib/calibre-web";
stable = import inputs.nixpkgs-previous {
system = "x86_64-linux";
};
in
{
services = {
calibre-web = {
# package = stable.calibre-web;
package = stable.calibre-web;
enable = true;
# dataDir = "${xlib.dirs.services-mnt-folder}/calibre-web";
options = {
calibreLibrary = "${libraryDir}";
calibreLibrary = "${xlib.dirs.services-mnt-folder}/calibre-web-library";
enableBookUploading = true;
enableKepubify = true;
enableBookConversion = false;
@@ -43,15 +40,13 @@ in
};
systemd.tmpfiles.rules = [
"d ${libraryDir} 0755 calibre-web calibre-web -"
"d ${sourceDir} 0755 calibre-web calibre-web -"
"Z ${libraryDir} 0755 calibre-web calibre-web -"
"Z ${sourceDir} 0755 calibre-web calibre-web -"
"d ${xlib.dirs.services-mnt-folder}/calibre-web 0755 calibre-web calibre-web -"
"d ${xlib.dirs.services-mnt-folder}/calibre-web-library 0755 calibre-web calibre-web -"
];
fileSystems = {
"${targetDir}" = {
device = "${sourceDir}";
"/var/lib/calibre-web" = {
device = "${xlib.dirs.services-mnt-folder}/calibre-web";
fsType = "none";
options = [
"bind"
modules/server/coredns.nix
+1 -1
View File
@@ -15,7 +15,7 @@
192.168.1.20 flux.zeroq.su
192.168.1.20 git.zeroq.su
192.168.1.20 glances.zeroq.su
192.168.1.20 homebox.zeroq.su
192.168.1.20 homebox.home.arpa
192.168.1.20 immich.zeroq.su
192.168.1.20 kuma.zeroq.su
192.168.1.20 navidrome.zeroq.su
modules/server/default.nix
+3 -8
View File
@@ -1,11 +1,9 @@
{
lib,
xlib,
...
}:
{
imports = [
../containers/3x-ui.nix
../software/beets
./acme.nix
./bentopdf.nix
@@ -25,9 +23,9 @@
./postgresql.nix
./power.nix
./samba.nix
./step-ca.nix
./syncthing.nix
./systemd.nix
./uptime-kuma.nix
# ../containers/remnawave.nix
# ./coturn.nix
# ./mealie.nix
@@ -35,16 +33,13 @@
# ./n8n.nix
# ./netdata.nix
# ./nfs.nix
# ./node-red.nix
# ./open-webui.nix
# ./rsync.nix
# ./step-ca.nix
# ./stirling-pdf.nix
# ./transmission.nix
# ./trilium.nix
# ./uptime-kuma.nix
# ./zerotier.nix
];
systemd.tmpfiles.rules = [
"d /mnt 0755 root root -"
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
];
}
modules/server/gitea.nix
+1 -1
View File
@@ -14,7 +14,7 @@
appName = "ZeroQ Gitea Service";
settings = {
server = {
DOMAIN = "git.zeroq.su";
DOMAIN = "git.home.arpa";
HTTP_PORT = 3000;
};
service.DISABLE_REGISTRATION = true;
modules/server/homebox.nix
+20 -22
View File
@@ -5,8 +5,8 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/homebox";
targetDir = "/var/lib/homebox";
configDir = "${xlib.dirs.services-mnt-folder}/homebox";
varDir = "/var/lib/homebox";
in
{
services.homebox = {
@@ -14,33 +14,31 @@ in
settings = {
HBOX_WEB_HOST = "0.0.0.0";
HBOX_WEB_PORT = "7745";
HBOX_STORAGE_CONN_STRING = "file://${targetDir}";
HBOX_STORAGE_CONN_STRING = "file://${varDir}";
HBOX_STORAGE_PREFIX_PATH = "data";
HBOX_DATABASE_DRIVER = "sqlite3";
HBOX_DATABASE_SQLITE_PATH = "${targetDir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_DATABASE_SQLITE_PATH = "${varDir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
HBOX_MODE = "production";
HOME = "${targetDir}";
TMPDIR = "${targetDir}/tmp";
HOME = "${varDir}";
TMPDIR = "${varDir}/tmp";
};
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0755 homebox homebox -"
"z ${sourceDir} 0755 homebox homebox -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
];
systemd.tmpfiles.rules = [
"d ${configDir} 0755 homebox homebox -"
"z ${configDir} 0755 homebox homebox -"
];
fileSystems = {
"${varDir}" = {
device = "${configDir}";
fsType = "none";
options = [
"bind"
"nofail"
];
};
};
}
modules/server/miniflux.nix
+1
View File
@@ -12,6 +12,7 @@
CLEANUP_FREQUENCY = 48;
LISTEN_ADDR = "0.0.0.0:6061";
};
# adminCredentialsFile = "${inputs.zeroq-credentials}/services/miniflux/admin-pass.txt";
adminCredentialsFile = config.sops.secrets.minifluxenv.path;
};
modules/server/n8n.nix
+14 -18
View File
@@ -7,35 +7,31 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/n8n";
targetDir = "/var/lib/n8n";
configDir = "${xlib.dirs.services-mnt-folder}/n8n";
varDir = "/var/lib/n8n";
in
{
services.n8n = {
enable = false;
environment = {
# N8N_USER_FOLDER = lib.mkForce "${sourceDir}";
# N8N_USER_FOLDER = lib.mkForce "${configDir}";
N8N_SECURE_COOKIE = "false";
N8N_PORT = 5678;
};
openFirewall = true;
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0755 nobody nogroup -"
"z ${sourceDir} 0755 nobody nogroup -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
systemd.tmpfiles.rules = [
"d ${configDir} 0755 nobody nogroup -"
"z ${configDir} 0755 nobody nogroup -"
];
fileSystems.${varDir} = {
device = "${configDir}";
fsType = "none";
options = [
"bind"
"nofail"
];
};
}
modules/server/navidrome.nix
+1 -16
View File
@@ -6,10 +6,6 @@
xlib,
...
}:
let
pointDir = "/var/lib/services/navidrome-point";
libraryDir = "${xlib.dirs.server-home}/Music";
in
{
services = {
navidrome = {
@@ -19,19 +15,8 @@ in
settings = {
Address = "0.0.0.0";
Port = 4533;
MusicFolder = "${pointDir}";
MusicFolder = "/mnt/beets/music";
};
};
};
systemd.mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${libraryDir}";
where = "${pointDir}";
}
];
}
modules/server/nextcloud.nix
+9 -11
View File
@@ -11,7 +11,7 @@
nextcloud-whiteboard-server = {
enable = true;
settings = {
NEXTCLOUD_URL = "https://nextcloud.zeroq.su";
NEXTCLOUD_URL = "https://nextcloud.home.arpa";
};
secrets = [ config.sops.secrets.nextcloud-whiteboard-jwt.path ];
};
@@ -20,8 +20,8 @@
hostName = "talk.private";
backends.nextcloud = {
urls = [
"https://nextcloud.home.arpa"
"https://nextcloud.zeroq.su"
# "https://nextcloud.home.arpa"
];
secretFile = config.sops.secrets.nextcloud-talk-secret.path;
};
@@ -40,9 +40,9 @@
secretFile = config.sops.secrets.turn-secret.path;
apikeyFile = config.sops.secrets.turn-api-key.path;
servers = [
"turn:turn.zeroq.su:3478?transport=udp"
"turn:turn.zeroq.su:3478?transport=tcp"
# "turns:turn.zeroq.su:5349?transport=tcp"
"turn:turn.home.arpa:3478?transport=udp"
"turn:turn.home.arpa:3478?transport=tcp"
# "turns:turn.home.arpa:5349?transport=tcp"
];
};
};
@@ -72,19 +72,17 @@
trusted_domains = [
"100.64.0.0"
"192.168.1.20"
"37.128.246.126"
"localhost"
"nextcloud.home.arpa"
"nextcloud.private"
"nextcloud.zeroq.su"
"office.home.arpa"
"office.zeroq.su"
"office.home.arpa"
"nextcloud.home.arpa"
];
trusted_proxies = [
"100.64.1.0"
"109.248.161.5"
"192.168.1.20"
"37.128.246.126"
"109.248.161.5"
];
overwriteprotocol = "https"; # maybe no
};
@@ -93,7 +91,7 @@
notify_push = {
enable = true;
bendDomainToLocalhost = true;
nextcloudUrl = "https://nextcloud.zeroq.su";
nextcloudUrl = "https://nextcloud.home.arpa";
};
# phpPackage = pkgs.php85;
extraApps = {
modules/server/nginx.nix
+115 -266
View File
@@ -35,7 +35,7 @@ in
}
];
};
"office.zeroq.su" = {
"office.home.arpa" = {
forceSSL = true;
enableACME = true;
};
@@ -64,29 +64,47 @@ in
client_max_body_size 5G;
'';
};
"x.zeroq.su" = {
"pdf.home.arpa" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://${server}:2049";
proxyPass = "http://127.0.0.1:8446";
proxyWebsockets = true;
};
"/subs/" = {
proxyPass = "http://${server}:2096";
proxyWebsockets = true;
};
"/subsjs/" = {
proxyPass = "http://${server}:2096";
proxyWebsockets = true;
};
"/clash/" = {
proxyPass = "http://${server}:2096";
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"homebox.home.arpa" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://127.0.0.1:7745";
proxyWebsockets = true;
};
};
};
# "talk.zeroq.su" = {
"nextcloud.home.arpa" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://127.0.0.1:10000";
proxyWebsockets = true;
};
"/whiteboard" = {
proxyPass = "http://127.0.0.1:3002";
proxyWebsockets = true;
};
};
extraConfig = ''
client_max_body_size 5G;
'';
};
# "talk.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# # locations = {
@@ -99,7 +117,7 @@ in
# client_max_body_size 5G;
# '';
# };
# "turn.zeroq.su" = {
# "turn.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations = {
@@ -112,285 +130,120 @@ in
# client_max_body_size 5G;
# '';
# };
# "ca.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:9000";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
# "n8n.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:5678";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
# "kuma.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:4001";
# proxyWebsockets = true;
# };
# };
# "flux.home.arpa" = {
# addSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:6061";
# proxyWebsockets = true;
# };
# };
# "navidrome.home.arpa" = {
# addSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:4533";
# proxyWebsockets = true;
# };
# };
# "immich.home.arpa" = {
# addSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:2283";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
"immich.zeroq.su" = {
addSSL = true;
"ca.home.arpa" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:2283";
proxyPass = "http://127.0.0.1:9000";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"kuma.zeroq.su" = {
"git.home.arpa" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4001";
proxyWebsockets = true;
};
};
"health.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:19999";
proxyPass = "http://127.0.0.1:3000";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"git.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:3000";
proxyPass = "http://127.0.0.1:3000";
proxyWebsockets = true;
};
};
"homebox.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:7745";
proxyWebsockets = true;
};
};
# "agent.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:3000";
# proxyWebsockets = true;
# };
# };
# "node-red.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
# kTLS = true;
# locations."/" = {
# proxyPass = "http://${server}:1880";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
"zeroq.su" = {
forceSSL = true;
enableACME = true;
root = pkgs.writeTextDir "index.html" ''
<!doctype html>
<html>
<body>
<pre>What are you doing here?</pre>
</body>
</html>
extraConfig = ''
client_max_body_size 5G;
'';
locations = {
"/guest/" = {
proxyPass = "http://${server}:80";
proxyWebsockets = true;
};
# "/.well-known/discord" = {
# extraConfig = ''
# default_type text/plain;
# return 200 "dh=c2d103553a4cfdaa1b7952a87a7d8120a1e167cc";
# '';
# };
};
};
"flux.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:6061";
proxyWebsockets = true;
};
};
"navidrome.zeroq.su" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4533";
proxyWebsockets = true;
};
};
"vetymae.opencodes.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://100.86.62.4:4096";
proxyWebsockets = true;
};
};
"lamet.opencodes.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://100.106.21.39:6061";
proxyWebsockets = true;
};
};
# "n8n.zeroq.su" = {
# "n8n.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:5678";
# proxyWebsockets = true;
# };
# };
# "office.zeroq.su" = {
# enableACME = true;
# forceSSL = true;
# locations = {
# "/" = {
# proxyPass = "http://${server}:8090";
# proxyWebsockets = true;
# };
# };
# };
"nextcloud.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://${server}:10000";
proxyWebsockets = true;
};
"/whiteboard" = {
proxyPass = "http://${server}:3002";
proxyWebsockets = true;
};
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"calibre.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8083";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"nix-cache.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:5000";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"pdf.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8446";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
# "calibre.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:8083";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
# "dns.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:53";
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
# "glances.home.arpa" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:61208";
# };
# };
# "syncthing.home.arpa" = {
# addSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:8384";
# };
# };
"kuma.home.arpa" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:4001";
proxyWebsockets = true;
};
};
"flux.home.arpa" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:6061";
proxyWebsockets = true;
};
};
"navidrome.home.arpa" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:4533";
proxyWebsockets = true;
};
};
"immich.home.arpa" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:2283";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"calibre.home.arpa" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8083";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"dns.home.arpa" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:53";
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"glances.home.arpa" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:61208";
};
};
"syncthing.home.arpa" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8384";
};
};
# "zeroq.home.arpa" = {
# forceSSL = true;
# enableACME = true;
@@ -416,8 +269,4 @@ in
};
};
};
networking.firewall.allowedTCPPorts = [
80
443
];
}
modules/server/node-red.nix
+21
View File
@@ -0,0 +1,21 @@
{
config,
lib,
pkgs,
xlib,
inputs,
...
}:
{
services.node-red = {
enable = false;
port = 1880;
openFirewall = true;
userDir = "${xlib.dirs.services-mnt-folder}/node-red";
configFile = "${inputs.zeroq-credentials}/configs/node-red/settings.js";
};
systemd.tmpfiles.rules = [
"z ${config.services.node-red.userDir} 0750 node-red node-red -"
];
}
modules/server/onlyoffice.nix
+6 -6
View File
@@ -7,17 +7,17 @@
...
}:
let
# previous = import inputs.nixpkgs-master {
# system = "x86_64-linux";
# config.allowUnfree = true;
# config.allowUnfreePredicate = true;
# };
previous = import inputs.nixpkgs-master {
system = "x86_64-linux";
config.allowUnfree = true;
config.allowUnfreePredicate = true;
};
in
{
services.onlyoffice = {
enable = true;
# package = previous.onlyoffice-documentserver;
hostname = "office.zeroq.su";
hostname = "office.home.arpa";
port = 8090;
allowLocalConnections = true;
wopi = true;
modules/server/postgresql.nix
+12 -19
View File
@@ -6,34 +6,27 @@
xlib,
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/postgresql";
targetDir = "/var/lib/postgresql";
in
{
services = {
postgresql = {
enable = true;
package = pkgs.postgresql_17;
# dataDir = "${xlib.dirs.services-mnt-folder}/postgresql";
};
# postgresqlBackup.enable = true;
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0760 postgres postgres -"
"z ${sourceDir} 0760 postgres postgres -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
fileSystems."/var/lib/postgresql" = {
device = "${xlib.dirs.services-mnt-folder}/postgresql";
fsType = "none";
options = [
"bind"
"nofail"
];
};
systemd.tmpfiles.rules = [
"z ${xlib.dirs.services-mnt-folder}/postgresql 0760 postgres postgres -"
# "z ${config.services.postgresql.dataDir} 0760 postgres postgres -"
];
}
modules/server/power.nix
+6
View File
@@ -13,4 +13,10 @@
power-profiles-daemon.enable = lib.mkForce false;
throttled.enable = false;
};
environment = {
systemPackages = with pkgs; [
cpupower-gui
];
};
}
modules/server/samba.nix
+15 -21
View File
@@ -5,16 +5,12 @@
xlib,
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/samba";
targetDir = "/var/lib/samba";
in
{
services = {
samba-wsdd = {
enable = true;
openFirewall = true;
hostname = "sapphira";
hostname = "sapphira.home.arpa";
discovery = true;
};
samba = {
@@ -69,21 +65,19 @@ in
};
};
systemd = {
tmpfiles.rules = [
"d ${sourceDir} 0755 root root -"
"z ${sourceDir} 0755 root root -"
];
mounts = [
{
enable = true;
options = "bind,x-systemd.automount,nofail";
requires = [ "local-fs.target" ];
type = "none";
wantedBy = [ "multi-user.target" ];
what = "${sourceDir}";
where = "${targetDir}";
}
];
systemd.tmpfiles.rules = [
"d ${xlib.dirs.services-mnt-folder}/samba 0755 root root -"
"z ${xlib.dirs.services-mnt-folder}/samba 0755 root root -"
];
fileSystems = {
"/var/lib/samba" = {
device = "${xlib.dirs.services-mnt-folder}/samba";
fsType = "none";
options = [
"bind"
"nofail"
];
};
};
}
modules/server/step-ca.nix
+11 -11
View File
@@ -6,8 +6,8 @@
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/step-ca";
targetDir = "/var/lib/step-ca";
configDir = "${xlib.dirs.services-mnt-folder}/step-ca";
varDir = "/var/lib/step-ca";
in
{
services.step-ca = {
@@ -17,9 +17,9 @@ in
openFirewall = true;
intermediatePasswordFile = config.sops.secrets.intermediate-password.path;
settings = {
root = "${targetDir}/certs/root_ca.crt";
crt = "${targetDir}/certs/intermediate_ca.crt";
key = "${targetDir}/secrets/intermediate_ca_key";
root = "${varDir}/certs/root_ca.crt";
crt = "${varDir}/certs/intermediate_ca.crt";
key = "${varDir}/secrets/intermediate_ca_key";
# address = "0.0.0.0:9000";
dnsNames = [
"*.zeroq.su"
@@ -28,7 +28,7 @@ in
];
db = {
type = "badgerv2";
dataSource = "${targetDir}/db";
dataSource = "${varDir}/db";
};
authority = {
claims = {
@@ -69,8 +69,8 @@ in
};
};
fileSystems."${targetDir}" = {
device = "${sourceDir}";
fileSystems."${varDir}" = {
device = "${configDir}";
fsType = "none";
options = [
"bind"
@@ -85,9 +85,9 @@ in
};
systemd.tmpfiles.rules = [
"d ${sourceDir} 0755 nobody nogroup -"
"z ${sourceDir} 0755 nobody nogroup -"
"Z ${sourceDir}/ 0700 nobody nogroup -"
"d ${configDir} 0755 nobody nogroup -"
"z ${configDir} 0755 nobody nogroup -"
"Z ${configDir}/ 0700 nobody nogroup -"
];
sops.secrets = {
modules/server/syncthing.nix
+1
View File
@@ -7,6 +7,7 @@
{
services.syncthing = {
enable = true;
# package = master.syncthing;
systemService = true;
guiAddress = "0.0.0.0:8384";
configDir = "${xlib.dirs.storage}/persist/Syncthing/${xlib.device.hostname}";
modules/server/trilium.nix
+2 -5
View File
@@ -3,9 +3,6 @@
xlib,
...
}:
let
sourceDir = "${xlib.dirs.services-mnt-folder}/trilium";
in
{
services.trilium-server = {
enable = false;
@@ -14,10 +11,10 @@ in
hostName = "trilium";
};
host = "0.0.0.0";
dataDir = "${sourceDir}";
dataDir = "/mnt/services/trilium";
};
systemd.tmpfiles.rules = [
"z ${sourceDir} 0750 trilium trilium -"
"z /mnt/services/trilium 0750 trilium trilium -"
];
}
modules/server/uptime-kuma.nix
+2 -6
View File
@@ -6,13 +6,9 @@
inputs,
...
}:
let
targetDir = "/var/lib/private/uptime-kuma";
sourceDir = "${xlib.dirs.services-mnt-folder}/uptime-kuma";
in
{
services.uptime-kuma = {
enable = true;
enable = false;
settings = {
PORT = "4001";
HOST = "0.0.0.0";
@@ -23,7 +19,7 @@ in
"z ${xlib.dirs.services-mnt-folder}/uptime-kuma 0755 nobody nogroup -"
];
fileSystems."${targetDir}" = {
fileSystems."/var/lib/private/uptime-kuma" = {
device = "${xlib.dirs.services-mnt-folder}/uptime-kuma";
fsType = "none";
options = [
modules/vds/default.nix
+2 -1
View File
@@ -14,6 +14,7 @@
];
systemd.tmpfiles.rules = [
"d /mnt 0755 root root -"
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
"d /mnt/services 0755 root root -"
"d /mnt/services/containers 0755 root root -"
];
}
modules/vds/nginx.nix
+222 -2
View File
@@ -8,6 +8,7 @@ let
server = "100.64.0.0";
in
{
# environment.etc."nginx/pubray".text = inputs.zeroq-credentials.services.xray.auth;
users.users.nginx.extraGroups = [ "acme" ];
services = {
nginx = {
@@ -16,8 +17,23 @@ in
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
# appendHttpConfig = inputs.zeroq-credentials.services.xray.maps;
virtualHosts = {
"pubray1.zeroq.su" = {
# "pubray.zeroq.su" = {
# enableACME = true;
# forceSSL = true;
# root = "${inputs.zeroq-credentials.services.xray.subs}";
# locations."/" = {
# extraConfig = ''
# auth_basic "Restricted";
# auth_basic_user_file /etc/nginx/pubray;
# if ($subfile = "") { return 403; }
# rewrite ^/$ $subfile break;
# '';
# };
# };
"x.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations = {
@@ -39,13 +55,217 @@ in
};
};
};
"kuma.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4001";
proxyWebsockets = true;
};
};
"health.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:19999";
proxyWebsockets = true;
};
};
"git.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:3000";
proxyWebsockets = true;
};
};
"homebox.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:7745";
proxyWebsockets = true;
};
};
# "agent.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:3000";
# proxyWebsockets = true;
# };
# };
# "node-red.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
# kTLS = true;
# locations."/" = {
# proxyPass = "http://${server}:1880";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
"zeroq.su" = {
forceSSL = true;
enableACME = true;
root = pkgs.writeTextDir "index.html" ''
<!doctype html>
<html>
<body>
<pre>What are you doing here?</pre>
</body>
</html>
'';
locations = {
"/guest/" = {
proxyPass = "http://${server}:80";
proxyWebsockets = true;
};
# "/.well-known/discord" = {
# extraConfig = ''
# default_type text/plain;
# return 200 "dh=c2d103553a4cfdaa1b7952a87a7d8120a1e167cc";
# '';
# };
};
};
"flux.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:6061";
proxyWebsockets = true;
};
};
"navidrome.zeroq.su" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:4533";
proxyWebsockets = true;
};
};
"vetymae.opencodes.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://100.86.62.4:4096";
proxyWebsockets = true;
};
};
"lamet.opencodes.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://100.106.21.39:6061";
proxyWebsockets = true;
};
};
"n8n.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:5678";
proxyWebsockets = true;
};
};
"office.zeroq.su" = {
enableACME = true;
forceSSL = true;
locations = {
"/" = {
proxyPass = "http://${server}:8090";
proxyWebsockets = true;
};
};
# extraConfig = ''
# client_max_body_size 5G;
# proxy_http_version 1.1;
# proxy_buffering off;
# proxy_set_header Host $host;
# proxy_set_header X-Forwarded-Host $host;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header Authorization $http_authorization;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
# ''; # absolute_redirect off;
};
"immich.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:2283";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"nextcloud.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://${server}:10000";
proxyWebsockets = true;
};
"/whiteboard" = {
proxyPass = "http://${server}:3002";
proxyWebsockets = true;
};
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"calibre.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8083";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
"pdf.zeroq.su" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://${server}:8446";
proxyWebsockets = true;
};
extraConfig = ''
client_max_body_size 5G;
'';
};
# "ai.zeroq.su" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${server}:11112";
# proxyWebsockets = true;
# };
# extraConfig = ''
# client_max_body_size 5G;
# '';
# };
};
};
};
security.acme = {
acceptTerms = true;
defaults = {
email = "oqyude@gmail.com";
email = "go.bin043120@gmail.com";
};
};
networking.firewall.allowedTCPPorts = [
modules/vds/systemd.nix
+2 -2
View File
@@ -8,8 +8,8 @@
let
serviceName = "rsync-services-sync";
serverAddress = "oqyude@100.64.0.0";
serverDir = "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}";
nodeDir = "${xlib.dirs.services-mnt-folder}";
serverDir = "/mnt/services/nodes/vds";
nodeDir = "/mnt/services";
in
{
systemd = {