Jimbo/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

The Blue Update #1

Merged
Jimbo merged 101 commits from Refactor into main 2024-10-25 21:26:22 -04:00
Conversation 0 Commits 101 Files changed 306 +212 -197
44 changed files with 212 additions and 197 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit a5f06865de - Show all commits

16
hosts/cyberspark/home/default.nix
View file

@ -1,14 +1,18 @@
{ ... }:
{
imports = [
# Programs and apps
../../../modules/home
../../../modules/home/users
../../../modules/home/programs/fastfetch
../../../modules/home/programs/git
../../../modules/home/programs/ncmpcpp
../../../modules/home/programs/neovim
../../../modules/home/programs/ranger
../../../modules/home/programs/tmux
../../../modules/home/programs/terminal/fastfetch
../../../modules/home/programs/terminal/git
../../../modules/home/programs/terminal/neovim
../../../modules/home/programs/terminal/ranger
../../../modules/home/programs/terminal/tmux
../../../modules/home/utils/zsh
# Misc
../../../overlays
../../../variables
];
}

7
hosts/cyberspark/system/default.nix
View file

@ -3,10 +3,10 @@
imports = [
./hardware
mailserver.nixosModule
../../../modules/system
../../../modules/system/accounts
../../../modules/system/devices/filesystems
../../../modules/system/devices/boot/systemd
../../../modules/system/devices/networking
../../../modules/system/devices/networking/firewall/server
../../../modules/system/devices/networking/wireguard/server
@ -14,6 +14,11 @@
../../../modules/system/programs/security
../../../modules/system/services/common
../../../modules/system/services/server
../../../overlays
../../../variables
mailserver.nixosModule
];
networking.hostName = "cyberspark";

4
hosts/cyberspark/system/hardware/default.nix
View file

@ -1,4 +1,4 @@
{ config, outputs, lib, pkgs, modulesPath, ... }:
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
@ -25,7 +25,7 @@
swraid = {
enable = true;
mdadmConf = ''
MAILADDR jimbo@${outputs.secrets.jimDomain}
MAILADDR jimbo@jimbosfiles.com
'';
};
};

34
modules/system/devices/networking/firewall/server/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ config, ... }:
{
# Allow forwarding
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@ -10,9 +10,9 @@
firewall = {
allowPing = false;
extraInputRules = ''
ip saddr { ${outputs.ips.localSpan}.0/24, ${outputs.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
ip saddr { ${outputs.ips.pc}, ${outputs.secrets.lunaIP}, ${outputs.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
ip saddr ${outputs.ips.wgSpan}.3 tcp dport ${mailPorts} accept comment "Accept mail"
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
ip saddr ${config.ips.wgSpan}.3 tcp dport ${mailPorts} accept comment "Accept mail"
'';
};
@ -24,28 +24,28 @@
content = ''
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
tcp dport 2211 dnat to ${outputs.ips.pc}:22 comment "SSH to PC"
tcp dport 2233 dnat to ${outputs.ips.wgSpan}.3:22 comment "SSH to Oracle VM"
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
tcp dport 2233 dnat to ${config.ips.wgSpan}.3:22 comment "SSH to Oracle VM"
udp dport { 27005, 27015, 7777 } dnat to ${outputs.ips.pc} comment "PC Hosted Games"
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
tcp dport { 58010, 57989, 57984 } dnat to ${outputs.ips.pc} comment "PC Sunshine TCP"
udp dport { 57998, 57999, 58000 } dnat to ${outputs.ips.pc} comment "PC Sunshine UDP"
tcp dport { 58010, 57989, 57984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
udp dport { 57998, 57999, 58000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat to ${outputs.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat to ${outputs.ips.vm} comment "VM Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
udp dport { 7790, 7791, 7792 } dnat to ${outputs.ips.hx} comment "Deus Ex"
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
ip saddr ${outputs.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${outputs.ips.vm} comment "VM ALVR TCP"
ip saddr ${outputs.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${outputs.ips.vm} comment "VM ALVR UDP"
ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP"
ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP"
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "${outputs.ips.netInt}" masquerade
iifname "${outputs.ips.netInt}" oifname "${outputs.ips.wgInt}" masquerade comment "Traffic from public to WireGuard"
tcp dport ${mailPorts} oifname != "${outputs.ips.wgInt}" drop comment "Send mail"
oifname "${config.ips.netInt}" masquerade
iifname "${config.ips.netInt}" oifname "${config.ips.wgInt}" masquerade comment "Traffic from public to WireGuard"
tcp dport ${mailPorts} oifname != "${config.ips.wgInt}" drop comment "Send mail"
}
'';
};

10
modules/system/devices/networking/wireguard/pc/default.nix
View file

@ -1,19 +1,19 @@
{ outputs, ... }:
{ config, ... }:
{
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
networking.wireguard.interfaces = {
"${outputs.ips.wgInt}" = {
"${config.ips.wgInt}" = {
# Define IP of client in per device config
listenPort = 51820;
privateKey = outputs.secrets.wgClientPriv;
privateKey = config.secrets.wgClientPriv;
peers = [
{ # 0.0.0.0 makes wg act like a traditional VPN
publicKey = outputs.secrets.wgServerPub;
publicKey = config.secrets.wgServerPub;
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "sv.${outputs.secrets.jimDomain}:51820";
endpoint = "sv.${config.secrets.jimDomain}:51820";
persistentKeepalive = 25;
}
];

24
modules/system/devices/networking/wireguard/server/default.nix
View file

@ -1,10 +1,10 @@
{ outputs, ... }:
{ config, ... }:
{
networking = {
nat = {
enable = true;
externalInterface = "${outputs.ips.netInt}";
internalInterfaces = [ "${outputs.ips.wgInt}" ];
externalInterface = "${config.ips.netInt}";
internalInterfaces = [ "${config.ips.wgInt}" ];
};
firewall.allowedUDPPorts = [ 51820 ];
};
@ -12,22 +12,22 @@
networking.wireguard = {
enable = true;
interfaces = {
"${outputs.ips.wgInt}" = {
ips = [ "${outputs.ips.wgSpan}.1/24" ];
"${config.ips.wgInt}" = {
ips = [ "${config.ips.wgSpan}.1/24" ];
listenPort = 51820;
privateKey = outputs.secrets.wgServerPriv;
privateKey = config.secrets.wgServerPriv;
peers = [
{ # Jimbo Pixel 9
publicKey = outputs.secrets.wgPixel9Pub;
allowedIPs = [ "${outputs.ips.wgSpan}.2/32" ];
publicKey = config.secrets.wgPixel9Pub;
allowedIPs = [ "${config.ips.wgSpan}.2/32" ];
}
{ # Oracle VM
publicKey = outputs.secrets.wgOraclePub;
allowedIPs = [ "${outputs.ips.wgSpan}.3/32" ];
publicKey = config.secrets.wgOraclePub;
allowedIPs = [ "${config.ips.wgSpan}.3/32" ];
}
{ # General Nix
publicKey = outputs.secrets.wgClientPub;
allowedIPs = [ "${outputs.ips.wgSpan}.16/28" ];
publicKey = config.secrets.wgClientPub;
allowedIPs = [ "${config.ips.wgSpan}.16/28" ];
}
];
};

2
modules/system/devices/networking/wireless/default.nix
View file

@ -1,4 +1,4 @@
{ lib, config, ... }:
{ ... }:
{
networking = {
wireless.iwd.enable = true;

6
modules/system/services/server/acme/default.nix
View file

@ -1,10 +1,10 @@
{ outputs, ... }:
{ config, ... }:
{
security.acme = {
acceptTerms = true;
defaults.email = outputs.secrets.jimEmail;
defaults.email = "jimjam4real@gmail.com";
certs = {
"turn.${outputs.secrets.jimDomain}" = {
"turn.${config.secrets.jimDomain}" = {
group = "turnserver";
postRun = "systemctl restart coturn.service";
};

26
modules/system/services/server/ddclient/default.nix
View file

@ -1,23 +1,23 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.ddclient = {
enable = true;
protocol = "cloudflare";
use = "web, web=https://ipinfo.io/ip";
zone = "${outputs.secrets.jimDomain}";
zone = "${config.secrets.jimDomain}";
username = "token";
passwordFile = "${pkgs.writeText "cloudflareapikey" outputs.secrets.flareApiKey}";
passwordFile = "${pkgs.writeText "cloudflareapikey" config.secrets.flareApiKey}";
domains = [
"${outputs.secrets.jimDomain}"
"*.${outputs.secrets.jimDomain}"
"sv.${outputs.secrets.jimDomain}"
"git.${outputs.secrets.jimDomain}"
"rtmp.${outputs.secrets.jimDomain}"
"turn.${outputs.secrets.jimDomain}"
"dew.${outputs.secrets.jimDomain}"
"john.${outputs.secrets.jimDomain}"
"beta.${outputs.secrets.jimDomain}"
"rogue.${outputs.secrets.jimDomain}"
"${config.secrets.jimDomain}"
"*.${config.secrets.jimDomain}"
"sv.${config.secrets.jimDomain}"
"git.${config.secrets.jimDomain}"
"rtmp.${config.secrets.jimDomain}"
"turn.${config.secrets.jimDomain}"
"dew.${config.secrets.jimDomain}"
"john.${config.secrets.jimDomain}"
"beta.${config.secrets.jimDomain}"
"rogue.${config.secrets.jimDomain}"
];
};
}

4
modules/system/services/server/fileserver/local/samba/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ config, ... }:
{
services = {
samba = {
@ -9,7 +9,7 @@
workgroup = WORKGROUP
server string = JimSMB
security = user
hosts allow = ${outputs.ips.localSpan}. 127.0.0.1 localhost
hosts allow = ${config.ips.localSpan}. 127.0.0.1 localhost
hosts deny = 0.0.0.0/0
guest account = nobody
map to guest = bad user

16
modules/system/services/server/fileserver/public/nextcloud/default.nix
View file

@ -1,10 +1,10 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services = {
nextcloud = {
enable = true;
package = pkgs.nextcloud29;
hostName = "cloud.${outputs.secrets.jimDomain}";
hostName = "cloud.${config.secrets.jimDomain}";
datadir = "/mnt/nextcloud";
https = true;
config = {
@ -13,20 +13,20 @@
};
settings = {
trusted_proxies = [ "127.0.0.1" ];
trusted_domains = [ "cloud.${outputs.secrets.jimDomain}" ];
trusted_domains = [ "cloud.${config.secrets.jimDomain}" ];
overwriteprotocol = "https";
mail_smtphost = "mx.${outputs.secrets.jimDomain}";
mail_domain = "${outputs.secrets.jimDomain}";
mail_smtphost = "mx.${config.secrets.jimDomain}";
mail_domain = "${config.secrets.jimDomain}";
mail_from_address = "noreply";
mail_smtpauth = "true";
mail_smtpname = "noreply@${outputs.secrets.jimDomain}";
mail_smtppassword = outputs.secrets.noreplyPassword;
mail_smtpname = "noreply@${config.secrets.jimDomain}";
mail_smtppassword = config.secrets.noreplyPassword;
mail_smtpmode = "smtp";
mail_smtpport = 587;
};
};
nginx.virtualHosts."cloud.${outputs.secrets.jimDomain}" = {
nginx.virtualHosts."cloud.${config.secrets.jimDomain}" = {
enableACME = true;
addSSL = true;
locations."/" = {

8
modules/system/services/server/fileserver/public/photoprism/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ config, ... }:
{
services = {
photoprism = {
@ -8,17 +8,17 @@
address = "0.0.0.0";
settings = {
PHOTOPRISM_ADMIN_USER = "jimbo";
PHOTOPRISM_ADMIN_PASSWORD = "${outputs.secrets.prismAdminPass}";
PHOTOPRISM_ADMIN_PASSWORD = "${config.secrets.prismAdminPass}";
PHOTOPRISM_DEFAULT_LOCALE = "en";
PHOTOPRISM_DATABASE_DRIVER = "mysql";
PHOTOPRISM_DATABASE_NAME = "photoprism";
PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock";
PHOTOPRISM_DATABASE_USER = "photoprism";
PHOTOPRISM_SITE_URL = "https://gallery.${outputs.secrets.jimDomain}";
PHOTOPRISM_SITE_URL = "https://gallery.${config.secrets.jimDomain}";
PHOTOPRISM_SITE_TITLE = "Jimbo's PhotoPrism";
};
};
nginx.virtualHosts."gallery.${outputs.secrets.jimDomain}" = {
nginx.virtualHosts."gallery.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

14
modules/system/services/server/forgejo/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ config, ... }:
{
imports = [
./nginx
@ -9,8 +9,8 @@
enable = true;
settings = {
server = {
DOMAIN = "git.${outputs.secrets.jimDomain}";
ROOT_URL = "https://git.${outputs.secrets.jimDomain}:443";
DOMAIN = "git.${config.secrets.jimDomain}";
ROOT_URL = "https://git.${config.secrets.jimDomain}:443";
HTTP_PORT = 3110;
SSH_PORT = 2299;
START_SSH_SERVER = true;
@ -20,10 +20,10 @@
};
mailer = {
ENABLED = true;
SMTP_ADDR = "mx.${outputs.secrets.jimDomain}";
FROM = "Jimbo's Git <noreply@${outputs.secrets.jimDomain}>";
USER = "noreply@${outputs.secrets.jimDomain}";
PASSWD = outputs.secrets.noreplyPassword;
SMTP_ADDR = "mx.${config.secrets.jimDomain}";
FROM = "Jimbo's Git <noreply@${config.secrets.jimDomain}>";
USER = "noreply@${config.secrets.jimDomain}";
PASSWD = config.secrets.noreplyPassword;
PROTOCOL = "smtps";
};
service = {

4
modules/system/services/server/forgejo/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."git.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."git.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

10
modules/system/services/server/icecast/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
imports = [
./nginx
@ -8,14 +8,14 @@
icecast = {
enable = true;
listen.port = 265;
hostname = "icecast.${outputs.secrets.jimDomain}";
hostname = "icecast.${config.secrets.jimDomain}";
admin = {
user = "jimbo";
password = "${outputs.secrets.castAdminPass}";
password = "${config.secrets.castAdminPass}";
};
extraConf = ''
<authentication>
<source-password>${outputs.secrets.castSourcePass}</source-password>
<source-password>${config.secrets.castSourcePass}</source-password>
</authentication>
<location>Canada</location>
@ -52,7 +52,7 @@
%ffmpeg(format="ogg", %audio(codec="libvorbis", samplerate=48000, b="256k", channels=2)),
host="127.0.0.1",
port=265,
password="${outputs.secrets.castSourcePass}",
password="${config.secrets.castSourcePass}",
public=true,
icy_metadata=["artist", "title"],
mount="jimbops.opus",

4
modules/system/services/server/icecast/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.nginx.virtualHosts."icecast.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."icecast.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

30
modules/system/services/server/mailserver/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
imports = [
./nginx
@ -8,8 +8,8 @@
mailserver = rec {
enable = true;
openFirewall = false;
domains = [ "${outputs.secrets.jimDomain}" ];
fqdn = "mx.${outputs.secrets.jimDomain}";
domains = [ "${config.secrets.jimDomain}" ];
fqdn = "mx.${config.secrets.jimDomain}";
certificateScheme = "acme-nginx";
localDnsResolver = false;
redis.port = 1515;
@ -17,29 +17,29 @@
# Dmarc info
dmarcReporting = {
enable = true;
domain = "${outputs.secrets.jimDomain}";
domain = "${config.secrets.jimDomain}";
localpart = "noreply";
organizationName = "Jimbo's Files";
};
# A list of accounts, passwords generated with nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
loginAccounts = {
"noreply@${outputs.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "noreply" outputs.secrets.noreplyMailHash;
"noreply@${config.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "noreply" config.secrets.noreplyMailHash;
sendOnly = true;
};
"jimbo@${outputs.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "jimbo" outputs.secrets.jimboMailHash;
aliases = [ "james@${outputs.secrets.jimDomain}" "contact@${outputs.secrets.jimDomain}" ];
"jimbo@${config.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "jimbo" config.secrets.jimboMailHash;
aliases = [ "james@${config.secrets.jimDomain}" "contact@${config.secrets.jimDomain}" ];
};
"lunamoonlight@${outputs.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "luna" outputs.secrets.lunaMailHash;
"lunamoonlight@${config.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "luna" config.secrets.lunaMailHash;
};
"freecorn1854@${outputs.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "freecorn" outputs.secrets.freecornMailHash;
"freecorn1854@${config.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "freecorn" config.secrets.freecornMailHash;
};
"tinyattack09@${outputs.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "tiny" outputs.secrets.tinyMailHash;
"tinyattack09@${config.secrets.jimDomain}" = {
hashedPasswordFile = pkgs.writeText "tiny" config.secrets.tinyMailHash;
};
};
};

4
modules/system/services/server/mailserver/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.nginx.virtualHosts."mx.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."mx.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

6
modules/system/services/server/mailserver/roundcube/default.nix
View file

@ -1,10 +1,10 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.roundcube = {
enable = true;
hostName = "mail.${outputs.secrets.jimDomain}";
hostName = "mail.${config.secrets.jimDomain}";
extraConfig = ''
$config['smtp_server'] = "tls://mx.${outputs.secrets.jimDomain}";
$config['smtp_server'] = "tls://mx.${config.secrets.jimDomain}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
'';

6
modules/system/services/server/minecraft/default.nix
View file

@ -1,7 +1,7 @@
{ inputs, ... }:
{ minecraft, ... }:
{
imports = [
inputs.minecraft.nixosModules.minecraft-servers
minecraft.nixosModules.minecraft-servers
./servers/velocity
./servers/dewdemolisher
./servers/johnside
@ -10,6 +10,8 @@
./servers/uberbeta
];
nixpkgs.overlays = [ minecraft.overlay ];
services.minecraft-servers = {
enable = true;
eula = true;

2
modules/system/services/server/minecraft/servers/blockworld/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
let
common = import ../common.nix { inherit pkgs; };
common = import ../../common { inherit pkgs; };
in {
services.minecraft-servers.servers.blockworld = {
enable = true;

2
modules/system/services/server/minecraft/servers/dewdemolisher/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
let
common = import ../common.nix { inherit pkgs; };
common = import ../../common { inherit pkgs; };
in {
services.minecraft-servers.servers.dewdemolisher = {
enable = true;

6
modules/system/services/server/minecraft/servers/johnside/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
let
common = import ../common.nix { inherit pkgs; };
common = import ../../common { inherit pkgs; };
in {
services = {
minecraft-servers.servers.johnside = {
@ -43,7 +43,7 @@ in {
};
# BlueMap webhost
nginx.virtualHosts."john.${outputs.secrets.jimDomain}" = {
nginx.virtualHosts."john.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

10
modules/system/services/server/minecraft/servers/roguecraft/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
let
common = import ../common.nix { inherit pkgs; };
common = import ../../common { inherit pkgs; };
in {
services = {
minecraft-servers.servers.roguecraft = {
@ -12,19 +12,19 @@ in {
server-port = 30014;
motd = "\\u00A7l\\u00A7bJimbo's \\u00A7cRoguecraft \\u00A7bserver.";
require-resource-pack = true;
resource-pack = "https://${outputs.secrets.jimDomain}/roguecraftresourcepackredir";
resource-pack = "https://${config.secrets.jimDomain}/roguecraftresourcepackredir";
resource-pack-sha1 = "b540c0562aba90c3ead2356bb9cb74fcf0db36b3";
};
whitelist = common.whitelist;
symlinks = common.paperSymlinks;
files = common.configFiles // {
"world/datapacks/roguecraft.zip" = builtins.fetchurl {
url = "https://${outputs.secrets.jimDomain}/roguecraftdatapackredir";
url = "https://${config.secrets.jimDomain}/roguecraftdatapackredir";
sha256 = "04zrkvzvi1i898al45fh9j3k635sf9qhwca7phbv4ynkfl8bz3q3";
};
};
};
nginx.virtualHosts."${outputs.secrets.jimDomain}".locations = {
nginx.virtualHosts."${config.secrets.jimDomain}".locations = {
"/roguecraftdatapackredir" = {
return = "301 https://cdn.modrinth.com/data/HtKjVijx/versions/Rme4c23R/Roguecraft%201.2.6%20-%20Data%20Pack.zip";
};

2
modules/system/services/server/minecraft/servers/uberbeta/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
let
common = import ../common.nix { inherit pkgs; };
common = import ../../common { inherit pkgs; };
uberBukkitZip = pkgs.fetchzip {
url = "https://github.com/Moresteck/Project-Poseidon-Uberbukkit/releases/download/2.0.0/uberbukkit-2.0.0-java17.zip";
sha256 = "m4hgcqXJ43SnBGn6qNBGeEcXFv5Q8f/VFYJmx3aJ9PE=";

2
modules/system/services/server/minecraft/servers/velocity/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, ... }:
let
common = import ../common.nix { inherit pkgs; };
common = import ../../common { inherit pkgs; };
in {
services.minecraft-servers.servers.velocity = {
enable = true;

10
modules/system/services/server/nginx/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.nginx = {
enable = true;
@ -11,7 +11,7 @@
recommendedProxySettings = true;
virtualHosts = {
# Landing page
"${outputs.secrets.jimDomain}" = {
"${config.secrets.jimDomain}" = {
enableACME = true;
addSSL = true;
root = "/var/www/Jimbo-Landing-Page";
@ -22,13 +22,13 @@
return 200 '
{
"m.homeserver": {
"base_url": "https://matrix.${outputs.secrets.jimDomain}"
"base_url": "https://matrix.${config.secrets.jimDomain}"
},
"m.identity_server": {
"base_url": "https://matrix.org"
},
"org.matrix.msc3575.proxy": {
"url": "https://matrix.${outputs.secrets.jimDomain}"
"url": "https://matrix.${config.secrets.jimDomain}"
}
}';
'';
@ -36,7 +36,7 @@
"/.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
return 200 '{"m.server": "matrix.${outputs.secrets.jimDomain}:443"}';
return 200 '{"m.server": "matrix.${config.secrets.jimDomain}:443"}';
'';
};
};

12
modules/system/services/server/social/lemmy/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ config, ... }:
{
imports = [
./nginx
@ -9,12 +9,12 @@
nginx.enable = true;
database.createLocally = true;
settings = {
hostname = "lemmy.${outputs.secrets.jimDomain}";
hostname = "lemmy.${config.secrets.jimDomain}";
email = {
smtp_server = "mx.${outputs.secrets.jimDomain}:587";
smtp_login = "noreply@${outputs.secrets.jimDomain}";
smtp_from_address = "Jimbo's Lemmy <noreply@${outputs.secrets.jimDomain}>";
smtp_password = outputs.secrets.noreplyPassword;
smtp_server = "mx.${config.secrets.jimDomain}:587";
smtp_login = "noreply@${config.secrets.jimDomain}";
smtp_from_address = "Jimbo's Lemmy <noreply@${config.secrets.jimDomain}>";
smtp_password = config.secrets.noreplyPassword;
tls_type = "starttls";
};
};

4
modules/system/services/server/social/lemmy/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."lemmy.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."lemmy.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
};

12
modules/system/services/server/social/mastodon/default.nix
View file

@ -1,18 +1,18 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.mastodon = {
enable = true;
localDomain = "social.${outputs.secrets.jimDomain}";
localDomain = "social.${config.secrets.jimDomain}";
streamingProcesses = 4;
configureNginx = true;
smtp = {
createLocally = false;
host = "mx.${outputs.secrets.jimDomain}";
host = "mx.${config.secrets.jimDomain}";
port = 587;
authenticate = true;
fromAddress = "Jimbo's Mastodon <noreply@${outputs.secrets.jimDomain}>";
user = "noreply@${outputs.secrets.jimDomain}";
passwordFile = pkgs.writeText "smtp_pass.txt" outputs.secrets.noreplyPassword;
fromAddress = "Jimbo's Mastodon <noreply@${config.secrets.jimDomain}>";
user = "noreply@${config.secrets.jimDomain}";
passwordFile = pkgs.writeText "smtp_pass.txt" config.secrets.noreplyPassword;
};
};
}

12
modules/system/services/server/social/matrix/element/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
imports = [
./nginx
@ -7,16 +7,16 @@
nixpkgs.config.element-web.conf = {
default_server_config = {
"m.homeserver" = {
base_url = "https://matrix.${outputs.secrets.jimDomain}";
server_name = "matrix.${outputs.secrets.jimDomain}";
base_url = "https://matrix.${config.secrets.jimDomain}";
server_name = "matrix.${config.secrets.jimDomain}";
};
};
branding = {
#welcome_background_url = "https://staging.${outputs.secrets.jimDomain}/images/backgrounds/bloxelcom-sunset.jpg";
#auth_header_logo_url = "https://staging.${outputs.secrets.jimDomain}/images/logos/bloxelcom.png";
#welcome_background_url = "https://staging.${config.secrets.jimDomain}/images/backgrounds/bloxelcom-sunset.jpg";
#auth_header_logo_url = "https://staging.${config.secrets.jimDomain}/images/logos/bloxelcom.png";
};
embedded_pages = {
home_url = "https://www.${outputs.secrets.jimDomain}/";
home_url = "https://www.${config.secrets.jimDomain}/";
};
disable_custom_urls = true;
disable_guests = true;

4
modules/system/services/server/social/matrix/element/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.nginx.virtualHosts."chat.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."chat.${config.secrets.jimDomain}" = {
enableACME = true;
addSSL = true;
root = "${pkgs.element-web}";

16
modules/system/services/server/social/matrix/synapse/coturn/default.nix
View file

@ -1,5 +1,9 @@
{ outputs, config, ... }:
{ config, ... }:
{
imports = [
./nginx
];
services = {
coturn = {
enable = true;
@ -9,16 +13,16 @@
max-port = 50000;
use-auth-secret = true;
static-auth-secret = "will be world readable for local users :(";
realm = "turn.${outputs.secrets.jimDomain}";
cert = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/fullchain.pem";
pkey = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/key.pem";
realm = "turn.${config.secrets.jimDomain}";
cert = "/var/lib/acme/turn.${config.secrets.jimDomain}.com/fullchain.pem";
pkey = "/var/lib/acme/turn.${config.secrets.jimDomain}.com/key.pem";
};
# Enable coturn on Synapse
matrix-synapse.settings = {
turn_uris = [
"turn:turn.${outputs.secrets.jimDomain}:3478?transport=udp"
"turn:turn.${outputs.secrets.jimDomain}:3478?transport=tcp"
"turn:turn.${config.secrets.jimDomain}:3478?transport=udp"
"turn:turn.${config.secrets.jimDomain}:3478?transport=tcp"
];
turn_shared_secret = config.services.coturn.static-auth-secret;
turn_user_lifetime = "1h";

4
modules/system/services/server/social/matrix/synapse/coturn/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, config, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."turn.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."turn.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
listen = [{

14
modules/system/services/server/social/matrix/synapse/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
imports = [
./coturn
@ -9,8 +9,8 @@
services.matrix-synapse = {
enable = true;
settings = {
server_name = "${outputs.secrets.jimDomain}";
public_baseurl = "https://matrix.${outputs.secrets.jimDomain}";
server_name = "${config.secrets.jimDomain}";
public_baseurl = "https://matrix.${config.secrets.jimDomain}";
suppress_key_server_warning = true;
listeners = [{
@ -23,10 +23,10 @@
}];
email = {
notif_from = "Jimbo's Matrix <noreply@${outputs.secrets.jimDomain}>";
smtp_host = "mx.${outputs.secrets.jimDomain}";
smtp_user = "noreply@${outputs.secrets.jimDomain}";
smtp_pass = outputs.secrets.noreplyPassword;
notif_from = "Jimbo's Matrix <noreply@${config.secrets.jimDomain}>";
smtp_host = "mx.${config.secrets.jimDomain}";
smtp_user = "noreply@${config.secrets.jimDomain}";
smtp_pass = config.secrets.noreplyPassword;
enable_tls = true;
smtp_port = 587;
require_transport_security = true;

4
modules/system/services/server/social/matrix/synapse/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."matrix.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."matrix.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations = {

10
modules/system/services/server/social/matrix/synapse/slidingsync/default.nix
View file

@ -1,13 +1,13 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.matrix-sliding-sync = {
enable = true;
settings = {
SYNCV3_SERVER = "https://matrix.${outputs.secrets.jimDomain}";
SYNCV3_SERVER = "https://matrix.${config.secrets.jimDomain}";
SYNCV3_BINDADDR = "0.0.0.0:8009";
};
environmentFile = pkgs.writeText "matrixsecret" ''
SYNCV3_SECRET=${outputs.secrets.matrixSecret}
'';
environmentFile = "${pkgs.writeText "matrixsecret" ''
SYNCV3_SECRET=${config.secrets.matrixSecret}
''}";
};
}

2
modules/system/services/server/social/owncast/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ ... }:
{
imports = [
./nginx

4
modules/system/services/server/social/owncast/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."live.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."live.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

18
modules/system/services/server/social/pixelfed/default.nix
View file

@ -1,13 +1,13 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
services.pixelfed = {
enable = true;
domain = "pics.${outputs.secrets.jimDomain}";
secretFile = pkgs.writeText "appkey" outputs.secrets.pixelfedKey;
domain = "pics.${config.secrets.jimDomain}";
secretFile = pkgs.writeText "appkey" config.secrets.pixelfedKey;
settings = {
APP_NAME = ''"Jimbo's Pixelfed"'';
INSTANCE_DESCRIPTION = ''"The Jimbosfiles Pixelfed Instance"'';
INSTANCE_CONTACT_EMAIL = "jimbo@${outputs.secrets.jimDomain}";
INSTANCE_CONTACT_EMAIL = "jimbo@${config.secrets.jimDomain}";
OPEN_REGISTRATION = true;
APP_LOCALE = "en";
INSTANCE_DISCOVER_PUBLIC = false;
@ -15,14 +15,14 @@
# Mail config
ENFORCE_EMAIL_VERIFICATION = true;
MAIL_FROM_ADDRESS = "noreply@${outputs.secrets.jimDomain}";
MAIL_FROM_NAME = ''"Jimbo's Pixelfed <noreply@${outputs.secrets.jimDomain}>"'';
MAIL_FROM_ADDRESS = "noreply@${config.secrets.jimDomain}";
MAIL_FROM_NAME = ''"Jimbo's Pixelfed <noreply@${config.secrets.jimDomain}>"'';
MAIL_ENCRYPTION = "tls";
MAIL_DRIVER = "smtp";
MAIL_HOST = "mx.${outputs.secrets.jimDomain}";
MAIL_HOST = "mx.${config.secrets.jimDomain}";
MAIL_PORT = 587;
MAIL_USERNAME = "noreply@${outputs.secrets.jimDomain}";
MAIL_PASSWORD = "${outputs.secrets.noreplyPassword}";
MAIL_USERNAME = "noreply@${config.secrets.jimDomain}";
MAIL_PASSWORD = "${config.secrets.noreplyPassword}";
};
nginx = {
enableACME = true;

4
modules/system/services/server/transmission/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, outputs, ... }:
{ pkgs, config, ... }:
{
imports = [
./nginx
@ -6,7 +6,7 @@
services.transmission = {
enable = true;
credentialsFile = pkgs.writeText "credentials" outputs.secrets.transmissionCredFile;
credentialsFile = pkgs.writeText "credentials" config.secrets.transmissionCredFile;
openPeerPorts = true;
settings = {
rpc-authentication-required = true;

4
modules/system/services/server/transmission/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."torrent.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."torrent.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {

12
modules/system/services/server/vaultwarden/default.nix
View file

@ -1,4 +1,4 @@
{ outputs, ... }:
{ config, ... }:
{
imports = [
./nginx
@ -7,18 +7,18 @@
services.vaultwarden = {
enable = true;
config = {
DOMAIN = "https://warden.${outputs.secrets.jimDomain}";
DOMAIN = "https://warden.${config.secrets.jimDomain}";
SIGNUPS_ALLOWED = false;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8222;
ROCKET_LOG = "critical";
# Smtp email
SMTP_HOST = "mx.${outputs.secrets.jimDomain}";
SMTP_FROM = "Jimbo's Vaultwarden <noreply@${outputs.secrets.jimDomain}>";
SMTP_HOST = "mx.${config.secrets.jimDomain}";
SMTP_FROM = "Jimbo's Vaultwarden <noreply@${config.secrets.jimDomain}>";
SMTP_FROM_NAME = "Vaultwarden";
SMTP_USERNAME = "noreply@${outputs.secrets.jimDomain}";
SMTP_PASSWORD = outputs.secrets.noreplyPassword;
SMTP_USERNAME = "noreply@${config.secrets.jimDomain}";
SMTP_PASSWORD = config.secrets.noreplyPassword;
SMTP_SECURITY = "starttls";
SMTP_PORT = 587;
SMTP_TIMEOUT = 15;

4
modules/system/services/server/vaultwarden/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ outputs, ... }:
{ config, ... }:
{
services.nginx.virtualHosts."warden.${outputs.secrets.jimDomain}" = {
services.nginx.virtualHosts."warden.${config.secrets.jimDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {