Compare commits
6 Commits
a1f92323dd
...
596081838e
| Author | SHA1 | Date | |
|---|---|---|---|
|
596081838e | ||
|
|
8e51146132 | ||
|
|
0e263ee06b | ||
|
|
a75b5bd2a0 | ||
|
|
5c59f48f39 | ||
|
|
8469a54c9e |
28
flake.lock
generated
28
flake.lock
generated
@ -8,11 +8,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1750173260,
|
||||
"narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
|
||||
"lastModified": 1754433428,
|
||||
"narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
|
||||
"rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -152,27 +152,27 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1745391562,
|
||||
"narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=",
|
||||
"lastModified": 1754028485,
|
||||
"narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7",
|
||||
"rev": "59e69648d345d6e8fef86158c555730fa12af9de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"ref": "nixos-25.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-master": {
|
||||
"locked": {
|
||||
"lastModified": 1753715863,
|
||||
"narHash": "sha256-wUsY8bZpLBa7rkJuqsVKLuzFSEvGRUcoCU5HGiDbM5o=",
|
||||
"lastModified": 1754468877,
|
||||
"narHash": "sha256-4f2CMXEM6PtLcfIC5Emo4pYaj+yLizWEQAekSwy4gzQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6a7d91d53ac0fdf6dffac103b616a548938f84fc",
|
||||
"rev": "5b7d804f77c2e9e89ddd527ed6a5e5bf77f0a826",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -200,17 +200,17 @@
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1754028485,
|
||||
"narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
|
||||
"lastModified": 1754292888,
|
||||
"narHash": "sha256-1ziydHSiDuSnaiPzCQh1mRFBsM2d2yRX9I+5OPGEmIE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "59e69648d345d6e8fef86158c555730fa12af9de",
|
||||
"rev": "ce01daebf8489ba97bd1609d185ea276efdeb121",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "59e69648d345d6e8fef86158c555730fa12af9de",
|
||||
"rev": "ce01daebf8489ba97bd1609d185ea276efdeb121",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
{
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/59e69648d345d6e8fef86158c555730fa12af9de";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/ce01daebf8489ba97bd1609d185ea276efdeb121";
|
||||
nixos-unstable.url = "github:NixOS/nixpkgs/5b09dc45f24cf32316283e62aec81ffee3c3e376";
|
||||
nixpkgs-master.url = "github:NixOS/nixpkgs/master";
|
||||
local-unstable.url = "path:///home/giulio/dev/nixpkgs";
|
||||
|
||||
@ -1,39 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
domain = "books.giugl.io";
|
||||
auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
|
||||
|
||||
utilities = import ./utilities.nix { inherit lib config; };
|
||||
inherit (utilities) architectInterfaceAddress;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
calibre-web = {
|
||||
enable = true;
|
||||
group = "media";
|
||||
options = {
|
||||
enableBookConversion = true;
|
||||
enableBookUploading = true;
|
||||
};
|
||||
};
|
||||
|
||||
nginx.virtualHosts.${domain} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8083";
|
||||
extraConfig = ''
|
||||
client_max_body_size 500M;
|
||||
'' + auth_block { access_role = "calibre"; };
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.extraHosts = ''
|
||||
${architectInterfaceAddress "lan"} ${domain}
|
||||
${architectInterfaceAddress "tailscale"} ${domain}
|
||||
'';
|
||||
|
||||
users.groups.media.members = [ "calibre-web" ];
|
||||
}
|
||||
@ -19,7 +19,6 @@ in
|
||||
./tailscale.nix
|
||||
./sunshine.nix
|
||||
./postgres.nix
|
||||
./netdata.nix
|
||||
./searx.nix
|
||||
];
|
||||
|
||||
@ -140,25 +139,21 @@ in
|
||||
radarr = {
|
||||
enable = true;
|
||||
domain = "htrad.giugl.io";
|
||||
package = pkgs.unstablePkgs.radarr;
|
||||
};
|
||||
|
||||
sonarr = {
|
||||
enable = true;
|
||||
domain = "htson.giugl.io";
|
||||
package = pkgs.unstablePkgs.sonarr;
|
||||
};
|
||||
|
||||
bazarr = {
|
||||
enable = true;
|
||||
domain = "htbaz.giugl.io";
|
||||
package = pkgs.unstablePkgs.bazarr;
|
||||
};
|
||||
|
||||
nzbget = {
|
||||
enable = true;
|
||||
domain = "htnzb.giugl.io";
|
||||
package = pkgs.unstablePkgs.nzbget;
|
||||
};
|
||||
|
||||
jellyfin = {
|
||||
@ -193,7 +188,7 @@ in
|
||||
|
||||
llm = {
|
||||
enable = true;
|
||||
package = pkgs.unstablePkgs.ollama-cuda;
|
||||
package = pkgs.masterPkgs.ollama-cuda;
|
||||
backendDomain = "ollama.giugl.io";
|
||||
acceleration = "cuda";
|
||||
|
||||
@ -230,17 +225,6 @@ in
|
||||
domain = "music.giugl.io";
|
||||
package = pkgs.unstablePkgs.navidrome;
|
||||
};
|
||||
|
||||
languagetool = {
|
||||
enable = true;
|
||||
domain = "lang.giugl.io";
|
||||
};
|
||||
|
||||
|
||||
whisparr = {
|
||||
enable = true;
|
||||
domain = "whisparr.giugl.io";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,22 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "tube.giugl.io";
|
||||
in
|
||||
{
|
||||
services.invidious = {
|
||||
enable = true;
|
||||
package = pkgs.unstablePkgs.invidious;
|
||||
settings = {
|
||||
hmac_key = "a2a91eca269d26de1221285e8981879834045bff";
|
||||
};
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = {
|
||||
dnsInterfaces = [ "lan" "tailscale" ];
|
||||
locations."/" = {
|
||||
port = config.services.invidious.port;
|
||||
allowWAN = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,82 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
domain = "photos.giugl.io";
|
||||
backendPort = 8001;
|
||||
frontendPort = 3000;
|
||||
in
|
||||
{
|
||||
architect.vhost.${domain} = {
|
||||
dnsInterfaces = [ "tailscale" ];
|
||||
|
||||
locations."/" = {
|
||||
host = "172.17.0.1";
|
||||
port = frontendPort;
|
||||
# allowLan = true;
|
||||
# allow = [ config.architect.networks."tailscale".net ];
|
||||
};
|
||||
|
||||
locations."~ ^/(api|media)/" = {
|
||||
host = "172.17.0.1";
|
||||
port = backendPort;
|
||||
# allowLan = true;
|
||||
# allow = [ config.architect.networks."tailscale".net ];
|
||||
};
|
||||
|
||||
locations."/ws" = {
|
||||
host = "172.17.0.1";
|
||||
port = backendPort;
|
||||
proxyWebsockets = true;
|
||||
# allowLan = true;
|
||||
# allow = [ config.architect.networks."tailscale".net ];
|
||||
};
|
||||
};
|
||||
|
||||
services.redis.servers."librephotos" = {
|
||||
enable = true;
|
||||
port = 1233;
|
||||
bind = "172.17.0.1";
|
||||
extraParams = [ "--protected-mode no" ];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers = {
|
||||
containers = {
|
||||
librephotos-front = {
|
||||
image = "reallibrephotos/librephotos-frontend:latest";
|
||||
autoStart = true;
|
||||
ports = [
|
||||
"172.17.0.1:${toString frontendPort}:${toString frontendPort}"
|
||||
];
|
||||
};
|
||||
|
||||
librephotos-back = {
|
||||
image = "reallibrephotos/librephotos:latest";
|
||||
autoStart = true;
|
||||
|
||||
ports = [
|
||||
"172.17.0.1:${toString backendPort}:${toString backendPort}"
|
||||
];
|
||||
|
||||
environment = {
|
||||
SECRET_KEY = "LOLOL";
|
||||
BACKEND_HOST = domain;
|
||||
ADMIN_EMAIL = "me@giugl.io";
|
||||
ADMIN_USERNAME = "giulio";
|
||||
ADMIN_PASSWORD = "giulio";
|
||||
ALLOWED_HOSTS = domain;
|
||||
DB_BACKEND = "mysql";
|
||||
DB_NAME = "librephotos";
|
||||
DB_USER = "librephotos";
|
||||
DB_PASS = "librephotos";
|
||||
DB_HOST = "172.17.0.1";
|
||||
DB_PORT = toString config.services.mysql.settings.mysqld.port;
|
||||
REDIS_HOST = "172.17.0.1";
|
||||
REDIS_PORT = toString config.services.redis.servers."librephotos".port;
|
||||
MAPBOX_API_KEY = "SOME_KEY";
|
||||
WEB_CONCURRENCY = "24";
|
||||
DEBUG = "0";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,25 +0,0 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
domain = "htlid.giugl.io";
|
||||
in
|
||||
{
|
||||
services = {
|
||||
lidarr = {
|
||||
enable = true;
|
||||
group = "media";
|
||||
};
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = {
|
||||
dnsInterfaces = [ "lan" "tailscale" ];
|
||||
locations."/" = {
|
||||
port = 8686;
|
||||
allowLan = true;
|
||||
allowWAN = false;
|
||||
allow = [ config.architect.networks."tailscale".net ];
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.media.members = [ "lidarr" ];
|
||||
}
|
||||
@ -1,26 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "monitor.giugl.io";
|
||||
in
|
||||
{
|
||||
services.netdata = {
|
||||
enable = true;
|
||||
package = pkgs.unstablePkgs.netdata;
|
||||
config = {
|
||||
db.mode = "dbengine";
|
||||
};
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = with config.architect.networks; {
|
||||
dnsInterfaces = [ "tailscale" "lan" ];
|
||||
|
||||
locations."/" = {
|
||||
port = 19999;
|
||||
allowLan = true;
|
||||
allow = [
|
||||
tailscale.net
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,24 +0,0 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
domain = "htnzb.giugl.io";
|
||||
in
|
||||
{
|
||||
services.nzbget = {
|
||||
enable = true;
|
||||
group = "media";
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = with config.architect.networks; {
|
||||
dnsInterfaces = [ "tailscale" "lan" ];
|
||||
|
||||
locations."/" = {
|
||||
port = 6789;
|
||||
allowLan = true;
|
||||
|
||||
allow = [ tailscale.net ];
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.media.members = [ "nzbget" ];
|
||||
}
|
||||
@ -1,50 +0,0 @@
|
||||
{ lib }:
|
||||
|
||||
{
|
||||
openresty_oidc_block =
|
||||
{ access_role ? "", whitelisted_ips ? [ ] }: ''
|
||||
|
||||
'';
|
||||
# access_by_lua_block {
|
||||
# local opts = {
|
||||
# discovery = "https://auth.giugl.io/realms/master/.well-known/openid-configuration",
|
||||
# client_id = "nginx",
|
||||
# client_secret = "9C6BYxPhTbrRS4DIwd3Smk7e11ABmnt8",
|
||||
# logout_path = "/logout",
|
||||
# redirect_after_logout_uri = "/",
|
||||
# redirect_uri = "/redirect_uri",
|
||||
# keepalive = "yes",
|
||||
# accept_none_alg = true,
|
||||
# revoke_tokens_on_logout = true,
|
||||
# -- access token valid for a day
|
||||
# access_token_expires_in = 86400
|
||||
# }
|
||||
|
||||
# ${lib.optionalString (whitelisted_ips != []) ''
|
||||
# local whitelist = {${lib.strings.concatMapStringsSep "," (x: "\"${x}\"") whitelisted_ips}}
|
||||
|
||||
# if is_ip_whitelisted(ngx.var.remote_addr, whitelist) then
|
||||
# return
|
||||
# end
|
||||
# ''}
|
||||
|
||||
# -- call introspect for OAuth 2.0 Bearer Access Token validation
|
||||
# local res, err = require("resty.openidc").authenticate(opts)
|
||||
|
||||
# if err then
|
||||
# ngx.status = 403
|
||||
# ngx.say(err)
|
||||
# ngx.exit(ngx.HTTP_FORBIDDEN)
|
||||
# end
|
||||
|
||||
# ${lib.optionalString (access_role != "") ''
|
||||
# if not check_role(res, "${access_role}") then
|
||||
# ngx.status = 401
|
||||
# ngx.header.content_type = 'text/html';
|
||||
# ngx.say("You are not authorized to access this page. Please contact Er Pepotto.")
|
||||
# ngx.exit(ngx.HTTP_UNAUTHORIZED)
|
||||
# end
|
||||
# ''}
|
||||
# }
|
||||
# '';
|
||||
}
|
||||
@ -1,37 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
domain = "photos.giugl.io";
|
||||
in
|
||||
{
|
||||
services.photoprism = {
|
||||
enable = true;
|
||||
package = pkgs.unstablePkgs.photoprism;
|
||||
originalsPath = "/var/lib/private/photoprism/originals";
|
||||
address = "0.0.0.0";
|
||||
settings = {
|
||||
PHOTOPRISM_DEFAULT_LOCALE = "en";
|
||||
PHOTOPRISM_DATABASE_DRIVER = "mysql";
|
||||
PHOTOPRISM_DATABASE_NAME = "photoprism";
|
||||
PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock";
|
||||
PHOTOPRISM_DATABASE_USER = "photoprism";
|
||||
PHOTOPRISM_SITE_URL = "https://${domain}";
|
||||
PHOTOPRISM_SITE_TITLE = "PePrism";
|
||||
PHOTOPRISM_FFMPEG_ENCODER = "nvidia";
|
||||
PHOTOPRISM_INIT = "tensorflow";
|
||||
NVIDIA_VISIBLE_DEVICES = "all";
|
||||
NVIDIA_DRIVER_CAPABILITIES = "compute,video,utility";
|
||||
PHOTOPRISM_FFMPEG_BIN = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||
};
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = {
|
||||
dnsInterfaces = [ "tailscale" "lan" ];
|
||||
locations."/" = {
|
||||
port = config.services.photoprism.port;
|
||||
allowLan = true;
|
||||
allow = [ config.architect.networks."tailscale".net ];
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,79 +0,0 @@
|
||||
{ pkgs, config, ... }:
|
||||
|
||||
let
|
||||
domain = "media.giugl.io";
|
||||
port = 32400;
|
||||
in
|
||||
{
|
||||
architect.firewall = {
|
||||
openTCP = [ 32400 3005 8324 32469 ];
|
||||
openUDP = [ 1900 5353 32410 32412 32413 32414 ];
|
||||
};
|
||||
|
||||
services.plex = {
|
||||
enable = true;
|
||||
package = pkgs.unstablePkgs.plex;
|
||||
dataDir = "/plex";
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = with config.architect.networks; {
|
||||
dnsInterfaces = [ "lan" "tailscale" ];
|
||||
locations = {
|
||||
"/" = {
|
||||
inherit port;
|
||||
|
||||
proxyWebsockets = true;
|
||||
allowLan = true;
|
||||
allow = [
|
||||
tailscale.net
|
||||
];
|
||||
extraConfig = ''
|
||||
#Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
|
||||
send_timeout 100m;
|
||||
|
||||
# Forward real ip and host to Plex
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $server_addr;
|
||||
proxy_set_header Referer $server_addr;
|
||||
proxy_set_header Origin $server_addr;
|
||||
|
||||
# Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off.
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 1000;
|
||||
gzip_proxied any;
|
||||
gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml;
|
||||
gzip_disable "MSIE [1-6]\.";
|
||||
|
||||
# Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
|
||||
# Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
|
||||
client_max_body_size 100M;
|
||||
|
||||
# Plex headers
|
||||
proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
|
||||
proxy_set_header X-Plex-Device $http_x_plex_device;
|
||||
proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
|
||||
proxy_set_header X-Plex-Platform $http_x_plex_platform;
|
||||
proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
|
||||
proxy_set_header X-Plex-Product $http_x_plex_product;
|
||||
proxy_set_header X-Plex-Token $http_x_plex_token;
|
||||
proxy_set_header X-Plex-Version $http_x_plex_version;
|
||||
proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
|
||||
proxy_set_header X-Plex-Provides $http_x_plex_provides;
|
||||
proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
|
||||
proxy_set_header X-Plex-Model $http_x_plex_model;
|
||||
|
||||
# Buffering off send to the client as soon as the data is received from Plex.
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
|
||||
add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.media.members = [ "plex" ];
|
||||
}
|
||||
@ -1,55 +0,0 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
domain = "xmpp.giugl.io";
|
||||
conference_domain = "conference.${domain}";
|
||||
upload_domain = "uploads.${domain}";
|
||||
|
||||
utilities = import ./utilities.nix { inherit lib config; };
|
||||
inherit (utilities) architectInterfaceAddress;
|
||||
in
|
||||
{
|
||||
architect.firewall = {
|
||||
openTCP = [ 5222 5269 ];
|
||||
};
|
||||
|
||||
services = {
|
||||
prosody = {
|
||||
enable = true;
|
||||
virtualHosts.${domain} = {
|
||||
inherit domain;
|
||||
|
||||
enabled = true;
|
||||
ssl.key = "${config.security.acme.certs.${domain}.directory}/key.pem";
|
||||
ssl.cert =
|
||||
"${config.security.acme.certs.${domain}.directory}/fullchain.pem";
|
||||
};
|
||||
|
||||
muc = [{ domain = conference_domain; }];
|
||||
uploadHttp = { domain = upload_domain; };
|
||||
|
||||
admins = [ "giulio@${domain}" ];
|
||||
#httpInterfaces = [ "wg0" ];
|
||||
#httpsInterfaces = [ "wg0" ];
|
||||
};
|
||||
|
||||
nginx.virtualHosts = {
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
# "${conference_domain}".enableACME = true;
|
||||
# "${upload_domain}".enableACME = true;
|
||||
};
|
||||
};
|
||||
|
||||
networking.extraHosts = ''
|
||||
${architectInterfaceAddress "lan"} ${domain}
|
||||
${architectInterfaceAddress "tailscale"} ${domain}
|
||||
'';
|
||||
|
||||
users.groups = {
|
||||
acme.members = [ "prosody" ];
|
||||
nginx.members = [ "prosody" ];
|
||||
};
|
||||
}
|
||||
@ -1,29 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "reddit.giugl.io";
|
||||
in
|
||||
{
|
||||
systemd.services.redlib.environment = {
|
||||
REDLIB_ROBOTS_DISABLE_INDEXING = "on";
|
||||
REDLIB_DEFAULT_THEME = "dracula";
|
||||
REDLIB_DEFAULT_SHOW_NSFW = "on";
|
||||
REDLIB_DEFAULT_BLUR_NSFW = "off";
|
||||
REDLIB_DEFAULT_USE_HLS = "on";
|
||||
REDLIB_DEFAULT_HIDE_HLS_NOTIFICATION = "on";
|
||||
};
|
||||
|
||||
services.redlib = {
|
||||
enable = true;
|
||||
port = 9090;
|
||||
package = pkgs.unstablePkgs.redlib;
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = {
|
||||
dnsInterfaces = [ "lan" "tailscale" ];
|
||||
locations."/" = {
|
||||
port = config.services.redlib.port;
|
||||
allowWAN = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,48 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
domain = "runas.rocks";
|
||||
runas_root = "/var/lib/runas.rocks/dist";
|
||||
service_name = "runas.rocks-pull";
|
||||
mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
|
||||
set -euo pipefail
|
||||
cd ${runas_root}
|
||||
git pull origin main --rebase
|
||||
'';
|
||||
|
||||
utilities = import ./utilities.nix { inherit lib config; };
|
||||
inherit (utilities) architectInterfaceAddress;
|
||||
in
|
||||
{
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
locations."/".root = runas_root;
|
||||
|
||||
locations."/.git" = { return = "404"; };
|
||||
};
|
||||
|
||||
systemd = {
|
||||
services.${service_name} = {
|
||||
path = [ pkgs.git ];
|
||||
enable = true;
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = mkStartScript "${service_name}";
|
||||
};
|
||||
};
|
||||
timers.${service_name} = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "hourly";
|
||||
Unit = "${service_name}.service";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.extraHosts = ''
|
||||
${architectInterfaceAddress "lan"} ${domain}
|
||||
${architectInterfaceAddress "tailscale"} ${domain}
|
||||
'';
|
||||
}
|
||||
@ -1,64 +0,0 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
domain = "tesla.giugl.io";
|
||||
teslamatePort = 11234;
|
||||
grafanaPort = 11334;
|
||||
allowLan = true;
|
||||
allowWAN = false;
|
||||
in
|
||||
{
|
||||
age.secrets.teslamate = {
|
||||
file = ../../secrets/teslamate.age;
|
||||
owner = "teslamate";
|
||||
};
|
||||
|
||||
architect.vhost.${domain} = with config.architect.networks; {
|
||||
dnsInterfaces = [ "lan" "tailscale" ];
|
||||
locations = {
|
||||
"/" = {
|
||||
inherit allowLan allowWAN;
|
||||
port = teslamatePort;
|
||||
proxyWebsockets = true;
|
||||
allow = [
|
||||
tailscale.net
|
||||
];
|
||||
};
|
||||
"/live/websocket" = {
|
||||
inherit allowLan allowWAN;
|
||||
port = teslamatePort;
|
||||
proxyWebsockets = true;
|
||||
allow = [
|
||||
tailscale.net
|
||||
];
|
||||
};
|
||||
"/grafana" = {
|
||||
inherit allowLan allowWAN;
|
||||
port = grafanaPort;
|
||||
proxyWebsockets = true;
|
||||
allow = [
|
||||
tailscale.net
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.teslamate = {
|
||||
enable = true;
|
||||
port = teslamatePort;
|
||||
|
||||
listenAddress = "127.0.0.1";
|
||||
secretsFile = config.age.secrets.teslamate.path;
|
||||
virtualHost = domain;
|
||||
postgres.enable_server = true;
|
||||
grafana = {
|
||||
enable = true;
|
||||
port = grafanaPort;
|
||||
listenAddress = "127.0.0.1";
|
||||
urlPath = "/grafana";
|
||||
};
|
||||
mqtt = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -103,6 +103,15 @@ in
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
"${cfg.backend.domain}" = {
|
||||
locations."/docling" = {
|
||||
host = config.services.docling-serve.host;
|
||||
port = config.services.docling-serve.port;
|
||||
allowLAN = true;
|
||||
allowVPN = true;
|
||||
allowWAN = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user