Compare commits

..

No commits in common. "62326b6c99422c5aa6a7ecacf1e295584d55c9d9" and "faf97e2b3fea505d3cea77b1050a12ecbff1c79f" have entirely different histories.

17 changed files with 127 additions and 150 deletions

View File

@ -1,20 +1,15 @@
{ lib, ... }:
let
domain = "htbaz.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
bazarr.enable = true;
nginx.virtualHosts.${domain} = {
nginx.virtualHosts.${bazarrdomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:6767";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -22,8 +17,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${bazarrdomain}
${architect-wg} ${bazarrdomain}
'';
users.groups.media.members = [ "bazarr" ];

View File

@ -1,11 +1,11 @@
{ config, pkgs, ... }:
with import ./network.nix;
let
pubkeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1we38/N+t8Ah5yrLof8QUwhrob7/VXFKIddaJeOVBLuDVnW7ljiAtdtEiL69D/DV4Ohmt5wMvkAAjfuHmim6FD9A6lzPbSU4KH9W2dcckszKbbI636kuDwem/xui6BW3wJa6P+0xW5ksygEAkzcK2PXuC2b4B9uwhuUdKahiGMKDxISG/WianqAe72cGMfNkYvion3Y1VsMLUdm48d2ABnxNpr7NI9B5iJ8dziOft9gpgfz13CCQRlReo75gk/4xI+vSNrQp7eR+wzJy2/dZg/T8jtyA9Q6jVxrxBpqQ1LNXkAKaJkGo9OabF6Wgpzp+YTAurL4nwR2NaJxwFuyoKvACQy0ai4jrS3206gC6JXZv8ktZMZrwUN+jPqCwfgh5qObFkAqKCxbp52ioDek2MQLdOvzQBX//DBhGEp5rzHGLZ3vhRIiiQiaof5sF5zWiYDW5mqezSPNxJPX/BrTP/Wbs/jpwTLBh3wytiia0S1WXQmya89bqzTPFiDWvTRA62EVKB/JaQtPQQOFAxWwg799DMycPeZ81xttZOyMtI/MZSddyqx2S8fWGwvToZQvuZ38mSIpFseLM1IkgabRIrAmat5SBNGGy9Dqa0eMEa7bwIY/4CMB1y6HMTnaoMXA6cnQfHMoB/zyTZ6oTXIeqeOyiZsK+RN0Mvahj8mXi7dw== giulio@giulio-X230"
];
hostname = "architect";
network = import ./network.nix;
in {
imports = [ # Include the results of the hardware scan.
./backup.nix
@ -26,7 +26,7 @@ in {
# ./minecraft.nix
./prowlarr.nix
./plex.nix
# ./transmission.nix
./transmission.nix
./githubrunner.nix
./libreddit.nix
./invidious.nix
@ -40,7 +40,7 @@ in {
services.fwupd.enable = true;
boot = {
kernelParams = [
"ip=${network.architect-lan}::10.0.0.1:255.255.255.0::${network.wan-if}:off"
"ip=${architect-lan}::10.0.0.1:255.255.255.0::${wan-if}:off"
"nvme_core.default_ps_max_latency_us=5500"
];
kernel.sysctl."net.ipv4.ip_forward" = 1;
@ -82,7 +82,7 @@ in {
defaultGateway = "10.0.0.1";
interfaces = {
enp5s0.ipv4.addresses = [{
address = network.architect-lan;
address = architect-lan;
prefixLength = 24;
}];
enp6s0.useDHCP = false;
@ -92,10 +92,11 @@ in {
127.0.0.1 ${hostname}.devs.giugl.io localhost
# LAN
${network.architect-lan} ${hostname}.devs.giugl.io
${architect-lan} ${hostname}.devs.giugl.io
${network.dvr-lan} dvr.devs.giugl.io
${network.nas-lan} nas.devs.giugl.io
${dvr-lan} dvr.devs.giugl.io
${nas-lan} nas.devs.giugl.io
${giupi-lan} giupi.devs.giugl.io
# Blacklist
0.0.0.0 metrics.plex.tv

View File

@ -1,20 +1,15 @@
{ lib, ... }:
let
domain = "git.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services.gitea = {
enable = true;
database.type = "sqlite3";
domain = domain;
domain = "git.giugl.io";
appName = "Gitea";
rootUrl = "https://${domain}";
rootUrl = "https://git.giugl.io";
ssh.clonePort = 22;
settings.server.LFS_START_SERVER = true;
};
services.nginx.virtualHosts.${domain} = {
services.nginx.virtualHosts.${gitdomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
@ -22,7 +17,7 @@ in {
extraConfig = ''
allow 127.0.0.1;
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
allow 10.4.0.0/24;
deny all;
'';
@ -30,8 +25,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${gitdomain}
${architect-wg} ${gitdomain}
'';
}

View File

@ -1,8 +1,8 @@
{ lib, ... }:
{ pkgs, ... }:
let
domain = "tube.giugl.io";
network = import ./network.nix;
with import ./network.nix;
let domain = "tube.giugl.io";
in {
services = {
invidious = {
@ -13,12 +13,14 @@ in {
nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { proxyPass = "http://localhost:9092"; };
locations."/" = {
proxyPass = "http://localhost:9092";
};
};
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${domain}
${architect-wg} ${domain}
'';
}

View File

@ -1,8 +1,8 @@
{ lib, ... }:
{ pkgs, ... }:
let
domain = "reddit.giugl.io";
network = import ./network.nix;
with import ./network.nix;
let domain = "reddit.giugl.io";
in {
services = {
libreddit = {
@ -13,12 +13,14 @@ in {
nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { proxyPass = "http://localhost:9090"; };
locations."/" = {
proxyPass = "http://localhost:9090";
};
};
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${domain}
${architect-wg} ${domain}
'';
}

View File

@ -1,16 +1,12 @@
{ pkgs, ... }:
{ pkgs, config, tmp, ... }:
let
domain = "matrix.giugl.io";
webui_domain = "chat.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
matrix-synapse = {
enable = true;
server_name = "${domain}";
server_name = "${matrixdomain}";
database_name = "synapse";
public_baseurl = "https://${domain}";
public_baseurl = "https://${matrixdomain}";
registration_shared_secret = "runas!";
dynamic_thumbnails = true;
# enable_registration = true;
@ -56,14 +52,14 @@ in {
nginx.virtualHosts = {
# server
${domain} = {
${matrixdomain} = {
enableACME = true;
forceSSL = true;
extraConfig = ''
client_max_body_size 30m;
'';
locations."= /.well-known/matrix/server".extraConfig =
let server = { "m.server" = "${domain}:443"; };
let server = { "m.server" = "${matrixdomain}:443"; };
in ''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
@ -71,7 +67,7 @@ in {
locations."= /.well-known/matrix/client".extraConfig = let
client = {
"m.homeserver" = { "base_url" = "https://${domain}:443"; };
"m.homeserver" = { "base_url" = "https://${matrixdomain}:443"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
};
# ACAO required to allow element-web on any URL to request this json file
@ -93,15 +89,15 @@ in {
# web client
"${webui_domain}" = {
"${matrixwebdomain}" = {
enableACME = true;
forceSSL = true;
root = pkgs.element-web.override {
root = pkgs.unstable.element-web.override {
conf = {
default_server_config."m.homeserver" = {
"base_url" = "https://${domain}";
"server_name" = "${domain}";
"base_url" = "https://${matrixdomain}";
"server_name" = "${matrixdomain}";
};
};
};
@ -116,8 +112,8 @@ in {
# It's also possible to use PostgreSQL.
settings = {
bridge = {
domain = domain;
homeserverUrl = "https://${domain}";
domain = matrixdomain;
homeserverUrl = "https://${matrixdomain}";
disablePresence = true;
};
};
@ -131,8 +127,8 @@ in {
settings = {
homeserver = {
address = "https://${domain}";
domain = "${domain}";
address = "https://${matrixdomain}";
domain = "${matrixdomain}";
};
appservice = {
@ -142,8 +138,8 @@ in {
bridge = {
permissions = {
"@pepe:${domain}" = "admin";
"${domain}" = "puppeting";
"@pepe:${matrixdomain}" = "admin";
"${matrixdomain}" = "puppeting";
};
# Animated stickers conversion requires additional packages in the
@ -178,8 +174,8 @@ in {
];
networking.extraHosts = ''
${network.architect-lan} ${domain} ${webui_domain}
${network.architect-wg} ${domain} ${webui_domain}
${architect-lan} ${matrixdomain} ${matrixwebdomain}
${architect-wg} ${matrixdomain} ${matrixwebdomain}
'';
}

View File

@ -1,7 +1,6 @@
{ config, pkgs, ... }:
let domain = "minecraft.giugl.io";
in {
with import ./network.nix; {
services.minecraft-server = {
enable = true;
eula = true;
@ -10,7 +9,7 @@ in {
};
networking.extraHosts = ''
${architect-lan} ${domain}
${architect-wg} ${domain}
${architect-lan} minecraft.giugl.io
${architect-wg} minecraft.giugl.io
'';
}

View File

@ -1,20 +1,15 @@
{ lib, ... }:
let
domain = "s3.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
minio.enable = true;
nginx.virtualHosts.${domain} = {
nginx.virtualHosts.${miniodomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:9000";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -22,7 +17,7 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${miniodomain}
${architect-wg} ${miniodomain}
'';
}

View File

@ -14,6 +14,7 @@ rec {
dvr-lan = "10.0.0.2";
nas-lan = "10.0.0.3";
architect-lan = "10.0.0.250";
giupi-lan = "10.0.0.251";
proxy-wg = "10.4.0.1";
architect-wg = "10.3.0.1";
@ -66,4 +67,19 @@ rec {
flavio-wg
salvatore-wg
];
# domains
sonarrdomain = "htson.giugl.io";
radarrdomain = "htrad.giugl.io";
bazarrdomain = "htbaz.giugl.io";
nzbgetdomain = "htnzb.giugl.io";
mediadomain = "media.giugl.io";
gitdomain = "git.giugl.io";
nextclouddomain = "cloud.giugl.io";
miniodomain = "s3.giugl.io";
clouddomain = "cloud.giugl.io";
matrixdomain = "matrix.giugl.io";
matrixwebdomain = "chat.giugl.io";
prowlarrdomain = "htpro.giugl.io";
jupyterdomain = "labs.giugl.io";
}

View File

@ -1,9 +1,6 @@
{ pkgs, ... }:
let
domain = "cloud.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
mysql.enable = true;
mysql.package = pkgs.unstable.mysql80;
@ -12,7 +9,7 @@ in {
nextcloud = {
enable = true;
hostName = "${domain}";
hostName = "${nextclouddomain}";
https = true;
package = pkgs.unstable.nextcloud22;
@ -31,7 +28,7 @@ in {
dbpassFile = "/secrets/nextcloud/dbpass.txt";
adminpassFile = "/secrets/nextcloud/adminpass.txt";
adminuser = "giulio";
extraTrustedDomains = [ "${domain}" ];
extraTrustedDomains = [ "${nextclouddomain}" ];
};
};
};
@ -42,11 +39,11 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${clouddomain}
${architect-wg} ${clouddomain}
'';
services.nginx.virtualHosts.${domain} = {
services.nginx.virtualHosts.${clouddomain} = {
forceSSL = true;
enableACME = true;
};

View File

@ -1,8 +1,8 @@
{ lib, ... }:
{ pkgs, ... }:
let
domain = "tweet.giugl.io";
network = import ./network.nix;
with import ./network.nix;
let domain = "tweet.giugl.io";
in {
services = {
nitter = {
@ -20,12 +20,14 @@ in {
nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { proxyPass = "http://localhost:9093"; };
locations."/" = {
proxyPass = "http://localhost:9093";
};
};
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${domain}
${architect-wg} ${domain}
'';
}

View File

@ -1,20 +1,15 @@
{ lib, ... }:
let
domain = "htnzb.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
nzbget.enable = true;
nginx.virtualHosts.${domain} = {
nginx.virtualHosts.${nzbgetdomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:6789";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -22,8 +17,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${nzbgetdomain}
${architect-wg} ${nzbgetdomain}
'';
users.groups.media.members = [ "nzbget" ];

View File

@ -1,9 +1,6 @@
{ pkgs, lib, ... }:
{ pkgs, ... }:
let
domain = "media.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services.plex = {
enable = true;
package = pkgs.unstable.plex;
@ -13,7 +10,7 @@ in {
services.nginx = {
enable = true;
# give a name to the virtual host. It also becomes the server name.
virtualHosts.${domain} = {
virtualHosts.${mediadomain} = {
forceSSL = true;
enableACME = true;
http2 = true;
@ -82,8 +79,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${mediadomain}
${architect-wg} ${mediadomain}
'';
users.groups.media.members = [ "plex" ];

View File

@ -1,20 +1,17 @@
{ lib, ... }:
{ pkgs, ... }:
let
domain = "htpro.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
prowlarr.enable = true;
nginx.virtualHosts.${domain} = {
nginx.virtualHosts.${prowlarrdomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:9696";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -30,8 +27,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${prowlarrdomain}
${architect-wg} ${prowlarrdomain}
'';
users.groups.media.members = [ "prowlarr" ];

View File

@ -1,20 +1,15 @@
{ lib, ... }:
let
domain = "htrad.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
radarr.enable = true;
nginx.virtualHosts.${domain} = {
nginx.virtualHosts.${radarrdomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:7878";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -22,8 +17,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${radarrdomain}
${architect-wg} ${radarrdomain}
'';
users.groups.media.members = [ "radarr" ];

View File

@ -1,20 +1,15 @@
{ lib, ... }:
let
domain = "htson.giugl.io";
network = import ./network.nix;
in {
with import ./network.nix; {
services = {
sonarr.enable = true;
nginx.virtualHosts.${domain} = {
nginx.virtualHosts.${sonarrdomain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:8989";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -22,8 +17,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${sonarrdomain}
${architect-wg} ${sonarrdomain}
'';
users.groups.media.members = [ "sonarr" ];

View File

@ -1,8 +1,6 @@
{ lib, config }:
with import ./network.nix;
let
domain = "httra.giugl.io";
network = import ./network.nix;
let domain = "httra.giugl.io";
in {
services = {
transmission = {
@ -27,7 +25,7 @@ in {
proxyPass = "http://localhost:9091";
extraConfig = ''
allow 10.0.0.0/24;
${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
allow 10.3.0.0/24;
deny all;
'';
};
@ -35,8 +33,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain}
${network.architect-wg} ${domain}
${architect-lan} ${domain}
${architect-wg} ${domain}
'';
users.groups.media.members = [ "transmission" ];