cleslie/nixfiles
1
0
Fork 0
mirror of https://github.com/callumio/nixfiles.git synced 2026-08-06 20:49:17 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

format all

Browse source
This commit is contained in:
Callum Leslie 2026-04-22 21:28:19 +01:00
parent 091cfbdf96
commit bcf0553529
Signed by: cleslie
GPG key ID: D382C4AFEECEAA90
40 changed files with 271 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/hermes/configuration.nix
View file

@ -2,7 +2,8 @@
config,
pkgs,
...
}: {
}:
{
nixpkgs.hostPlatform = "x86_64-linux";
c.services.mesh = {
enable = true;
@ -22,7 +23,10 @@
users.users.media = {
isNormalUser = true;
extraGroups = ["wheel" "multimedia"];
extraGroups = [
"wheel"
"multimedia"
];
openssh.authorizedKeys.keys = config.keys.c;
packages = with pkgs; [
tree
@ -30,7 +34,7 @@
];
};
nix.settings.trusted-users = ["media"];
nix.settings.trusted-users = [ "media" ];
environment.systemPackages = with pkgs; [
wget

15
hosts/hermes/containers.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
virtualisation = {
podman.enable = true;
podman.dockerCompat = true;
@ -9,7 +10,7 @@
#image = "ghcr.io/flaresolverr/flaresolverr:pr-1282";
image = "docker.io/alexfozor/flaresolverr:pr-1300-experimental";
autoStart = true;
ports = ["127.0.0.1:8191:8191"];
ports = [ "127.0.0.1:8191:8191" ];
environment = {
LOG_LEVEL = "debug";
};
@ -17,7 +18,10 @@
tdarr = {
image = "ghcr.io/haveagitgat/tdarr";
autoStart = true;
ports = ["0.0.0.0:8265:8265" "127.0.0.1:8266:8266"];
ports = [
"0.0.0.0:8265:8265"
"127.0.0.1:8266:8266"
];
volumes = [
"/var/lib/tdarr/server:/app/server"
"/var/lib/tdarr/configs:/app/configs"
@ -37,7 +41,10 @@
PUID = "1000";
PGID = "994";
};
extraOptions = ["--device=/dev/dri:/dev/dri" "--network=bridge"];
extraOptions = [
"--device=/dev/dri:/dev/dri"
"--network=bridge"
];
};
};
};

14
hosts/hermes/copyparty.nix
View file

@ -1,13 +1,15 @@
{config, ...}: let
{ config, ... }:
let
domain = "files.cleslie.uk";
in {
in
{
services = {
cloudflare-dyndns.domains = [domain];
cloudflare-dyndns.domains = [ domain ];
copyparty = {
enable = true;
settings = {
i = "127.0.0.1";
p = [3210];
p = [ 3210 ];
};
accounts = {
c.passwordFile = config.age.secrets.copyparty-c.path;
@ -16,13 +18,13 @@ in {
"/media" = {
path = "/var/lib/media/library";
access = {
rw = ["c"];
rw = [ "c" ];
};
};
"/paperless" = {
path = "/var/lib/paperless";
access = {
rw = ["c"];
rw = [ "c" ];
};
};
};

5
hosts/hermes/ddns.nix
View file

@ -1,11 +1,12 @@
{config, ...}: {
{ config, ... }:
{
services.cloudflare-dyndns = {
enable = true;
ipv4 = true;
ipv6 = false;
proxied = false;
deleteMissing = false;
domains = [];
domains = [ ];
apiTokenFile = config.age.secrets.cloudflare-api.path;
};
# services.cloudflare-dyndns.domains = [];

3
hosts/hermes/default.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
imports = [
./hardware-configuration.nix
./configuration.nix

59
hosts/hermes/fail2ban.nix
View file

@ -1,8 +1,11 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
services.fail2ban = {
enable = true;
jails = {
sshd.settings = {enabled = false;};
sshd.settings = {
enabled = false;
};
radarr.settings = {
enabled = true;
filter = "arr";
@ -74,33 +77,39 @@
};
};
environment.etc = {
"fail2ban/filter.d/arr.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[INCLUDES]
before = common.conf
"fail2ban/filter.d/arr.local".text = pkgs.lib.mkDefault (
pkgs.lib.mkAfter ''
[INCLUDES]
before = common.conf
[Definition]
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S\.%%f\|
failregex = ^\s*Warn\|Auth\|Auth-Failure ip <ADDR> username '<F-USER>[^']+</F-USER>'
ignoreregex =
'');
[Definition]
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S\.%%f\|
failregex = ^\s*Warn\|Auth\|Auth-Failure ip <ADDR> username '<F-USER>[^']+</F-USER>'
ignoreregex =
''
);
"fail2ban/filter.d/jellyseerr.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[INCLUDES]
before = common.conf
"fail2ban/filter.d/jellyseerr.local".text = pkgs.lib.mkDefault (
pkgs.lib.mkAfter ''
[INCLUDES]
before = common.conf
[Definition]
failregex = ^.*\[warn\]\[API\]: Failed sign-in attempt using invalid Overseerr password {"ip":"<HOST>","email":
^.*\[warn\]\[Auth\]: Failed login attempt from user with incorrect Jellyfin credentials {"account":{"ip":"<HOST>","email":
ignoreregex =
'');
[Definition]
failregex = ^.*\[warn\]\[API\]: Failed sign-in attempt using invalid Overseerr password {"ip":"<HOST>","email":
^.*\[warn\]\[Auth\]: Failed login attempt from user with incorrect Jellyfin credentials {"account":{"ip":"<HOST>","email":
ignoreregex =
''
);
"fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[INCLUDES]
before = common.conf
"fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (
pkgs.lib.mkAfter ''
[INCLUDES]
before = common.conf
[Definition]
failregex = ^.*Authentication request for .* has been denied \(IP: "<ADDR>"\)\.
ignoreregex =
'');
[Definition]
failregex = ^.*Authentication request for .* has been denied \(IP: "<ADDR>"\)\.
ignoreregex =
''
);
};
}

8
hosts/hermes/forgejo.nix
View file

@ -2,11 +2,13 @@
lib,
config,
...
}: let
}:
let
domain = "git.cleslie.uk";
in {
in
{
services = {
cloudflare-dyndns.domains = [domain];
cloudflare-dyndns.domains = [ domain ];
forgejo = {
enable = true;
database.type = "postgres";

24
hosts/hermes/hardware-configuration.nix
View file

@ -3,18 +3,25 @@
lib,
modulesPath,
...
}: {
}:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot = {
initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
initrd.kernelModules = [];
kernelModules = ["kvm-intel"];
initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
initrd.kernelModules = [ ];
kernelModules = [ "kvm-intel" ];
kernelParams = [
"i915.enable_guc=2"
];
extraModulePackages = [];
extraModulePackages = [ ];
};
#boot.kernelPackages = pkgs.linuxPackages_latest;
@ -27,10 +34,13 @@
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/57CE-8609";
fsType = "vfat";
options = ["fmask=0077" "dmask=0077"];
options = [
"fmask=0077"
"dmask=0077"
];
};
swapDevices = [];
swapDevices = [ ];
networking.useDHCP = lib.mkDefault true;

8
hosts/hermes/headscale.nix
View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
domain = "mesh.cleslie.uk";
in {
in
{
services = {
headscale = {
enable = true;
@ -16,7 +18,7 @@ in {
ip_prefixes = "100.64.0.0/10";
};
};
cloudflare-dyndns.domains = [domain];
cloudflare-dyndns.domains = [ domain ];
caddy.virtualHosts.${domain}.extraConfig = ''
reverse_proxy localhost:${toString config.services.headscale.port}
'';

22
hosts/hermes/media.nix
View file

@ -1,10 +1,14 @@
{pkgs, ...}: let
{ pkgs, ... }:
let
mediaDir = "/var/lib/media";
in {
in
{
users = {
groups.multimedia = {gid = 994;};
users."root".extraGroups = ["multimedia"];
users."media".extraGroups = ["multimedia"];
groups.multimedia = {
gid = 994;
};
users."root".extraGroups = [ "multimedia" ];
users."media".extraGroups = [ "multimedia" ];
};
systemd.tmpfiles.rules = [
@ -87,7 +91,11 @@ in {
};
};
cloudflare-dyndns.domains = ["media.cleslie.uk" "watch.cleslie.uk" "request.cleslie.uk"];
cloudflare-dyndns.domains = [
"media.cleslie.uk"
"watch.cleslie.uk"
"request.cleslie.uk"
];
jellyfin = {
enable = true;
@ -126,7 +134,7 @@ in {
dataDir = "${mediaDir}/torrents";
declarative = true;
config = {
enabled_plugins = ["Label"];
enabled_plugins = [ "Label" ];
outgoing_interface = "wg1";
allow_remote = true;
openFirewall = false;

10
hosts/hermes/n8n.nix
View file

@ -1,8 +1,10 @@
{pkgs, ...}: let
{ pkgs, ... }:
let
domain = "automation.cleslie.uk";
in {
in
{
services = {
cloudflare-dyndns.domains = [domain];
cloudflare-dyndns.domains = [ domain ];
n8n = {
enable = true;
environment = {
@ -14,5 +16,5 @@ in {
reverse_proxy http://127.0.0.1:5678
'';
};
environment.systemPackages = with pkgs; [mupdf-headless];
environment.systemPackages = with pkgs; [ mupdf-headless ];
}

9
hosts/hermes/networking.nix
View file

@ -1,8 +1,13 @@
{config, ...}: {
{ config, ... }:
{
networking = {
hostName = "hermes";
enableIPv6 = false;
firewall.allowedTCPPorts = [80 443 8265];
firewall.allowedTCPPorts = [
80
443
8265
];
firewall.checkReversePath = false;
iproute2.enable = true;
iproute2.rttablesExtraConfig = ''

8
hosts/hermes/nocodb.nix
View file

@ -1,8 +1,10 @@
_: let
_:
let
domain = "hub.cleslie.uk";
in {
in
{
services = {
cloudflare-dyndns.domains = [domain];
cloudflare-dyndns.domains = [ domain ];
nocodb = {
enable = true;
environment = {

5
hosts/hermes/quassel.nix
View file

@ -1,6 +1,7 @@
{...}: {
{ ... }:
{
services.quassel = {
enable = true;
interfaces = ["0.0.0.0"];
interfaces = [ "0.0.0.0" ];
};
}

5
hosts/hermes/ssh.nix
View file

@ -1,8 +1,9 @@
{...}: {
{ ... }:
{
services = {
openssh = {
enable = true;
ports = [62480];
ports = [ 62480 ];
settings.PasswordAuthentication = false;
settings.PermitRootLogin = "no";
};

8
hosts/hermes/vaultwarden.nix
View file

@ -1,8 +1,10 @@
{config, ...}: let
{ config, ... }:
let
domain = "vaultwarden.cleslie.uk";
in {
in
{
services = {
cloudflare-dyndns.domains = [domain];
cloudflare-dyndns.domains = [ domain ];
vaultwarden = {
enable = true;
dbBackend = "sqlite";