SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 16:21:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

vps-private: Switch completely to nebula

Browse source
This commit is contained in:
SebastianStork 2026-01-10 23:25:13 +01:00
parent 116b4437fe
commit b7a2598ebe
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
5 changed files with 17 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

21
hosts/vps-private/default.nix
View file

@ -15,7 +15,7 @@
custom = custom =
let let
tailscaleDomain = config.custom.services.tailscale.domain; privateDomain = config.custom.services.nebula.network.domain;
in in
{ {
persistence.enable = true; persistence.enable = true;
@ -30,11 +30,6 @@
onlyCleanRoots = true; onlyCleanRoots = true;
}; };
tailscale = {
enable = true;
exitNode.enable = true;
};
nebula.node = { nebula.node = {
enable = true; enable = true;
address = "10.254.250.2"; address = "10.254.250.2";
@ -49,44 +44,44 @@
isServer = true; isServer = true;
doBackups = true; doBackups = true;
deviceId = "5R2MH7T-Q2ZZS2P-ZMSQ2UJ-B6VBHES-XYLNMZ6-7FYC27L-4P7MGJ2-FY4ITQD"; deviceId = "5R2MH7T-Q2ZZS2P-ZMSQ2UJ-B6VBHES-XYLNMZ6-7FYC27L-4P7MGJ2-FY4ITQD";
gui.domain = "syncthing.${tailscaleDomain}"; gui.domain = "syncthing.${privateDomain}";
}; };
}; };
web-services = { web-services = {
filebrowser = { filebrowser = {
enable = true; enable = true;
domain = "files.${tailscaleDomain}"; domain = "files.${privateDomain}";
doBackups = true; doBackups = true;
}; };
radicale = { radicale = {
enable = true; enable = true;
domain = "calendar.${tailscaleDomain}"; domain = "calendar.${privateDomain}";
doBackups = true; doBackups = true;
}; };
memos = { memos = {
enable = true; enable = true;
domain = "memos.${tailscaleDomain}"; domain = "memos.${privateDomain}";
doBackups = true; doBackups = true;
}; };
actualbudget = { actualbudget = {
enable = true; enable = true;
domain = "budget.${tailscaleDomain}"; domain = "budget.${privateDomain}";
doBackups = true; doBackups = true;
}; };
freshrss = { freshrss = {
enable = true; enable = true;
domain = "rss.${tailscaleDomain}"; domain = "rss.${privateDomain}";
doBackups = true; doBackups = true;
}; };
alloy = { alloy = {
enable = true; enable = true;
domain = "alloy-${config.networking.hostName}.${tailscaleDomain}"; domain = "alloy.${config.networking.hostName}.${privateDomain}";
}; };
}; };
}; };

8
hosts/vps-private/secrets.json
View file

@ -24,6 +24,10 @@
"nebula": { "nebula": {
"host-key": "ENC[AES256_GCM,data:dS3tXWUK+POzTZ98wLETaWz4ief/yFULCfI5Y3EbK26KQpwxzw6cpLXUNOSZeUwz9brN/4JcwUgewJR08Uq3HZhKZKoMPZfPRtZMDe51I4RYg4hZd1mMWXQn82KmSytZCiDIL/9qCwYvObVRiNCpAOKRj6JBpgpoQ1u5hgn1EA==,iv:G25EpAnvoLfYXAdPyJVqS3ocUPg5LQlUoi7fA+XFOZ8=,tag:/BNhuxJCunM85H9DnPF5Kg==,type:str]" "host-key": "ENC[AES256_GCM,data:dS3tXWUK+POzTZ98wLETaWz4ief/yFULCfI5Y3EbK26KQpwxzw6cpLXUNOSZeUwz9brN/4JcwUgewJR08Uq3HZhKZKoMPZfPRtZMDe51I4RYg4hZd1mMWXQn82KmSytZCiDIL/9qCwYvObVRiNCpAOKRj6JBpgpoQ1u5hgn1EA==,iv:G25EpAnvoLfYXAdPyJVqS3ocUPg5LQlUoi7fA+XFOZ8=,tag:/BNhuxJCunM85H9DnPF5Kg==,type:str]"
}, },
"porkbun": {
"api-key": "ENC[AES256_GCM,data:RV/+aEQRcfQ9LMjZjxGNvCeiso51VqvqrOBRRrR/dXhmBvyoGuh2LaAjyoDoWEjWy5kIStStR+jXZEFWZ8KXvnmEnoU=,iv:j3sYW85Vf88EfeOfezlspDxEms6YqZYnzy5JAiES3+U=,tag:0M9vDvsirc6ze3Ut+yMSoA==,type:str]",
"secret-api-key": "ENC[AES256_GCM,data:SUngZ65fBmC9WlPkmJMjyBb6sHREKhqyRj9fsBGkj5IyjtGDfQ1b7Iv0VNeSY//bWv0VZruwT48a320BUlg1xiNCKU8=,iv:glUaArlHJsxCP5z3y7JnWvmtsdRzszXhYydpd1YaX5U=,tag:185iAkQ/J9CfKkTsgPP6lA==,type:str]"
},
"sops": { "sops": {
"age": [ "age": [
{ {
@ -35,8 +39,8 @@
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqU01heng3NHdrYnZFZmZn\nZlJtUUIyd1ExTmhzeU5iZFZadFcwR25GOEVZCmxHOXNWQVh1ZlJSRHJtaDVHNVUv\nbTY0TlNmZ2hESDkzS2M3WHdlamxwclkKLS0tIEEvOFd3TDFkQmQwbjBodHhpb1BD\nZ2NvTnNqQmtrLy9aVDdGRGxZbVgrZG8KdnnjJWcjZFu3R8fVKToj6THHHRCFou9k\njQoedCZAML2A2FZIhHugH9wnDUPQQjG86WbcCBuFWcOTGiTF2gN+Qg==\n-----END AGE ENCRYPTED FILE-----\n" "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqU01heng3NHdrYnZFZmZn\nZlJtUUIyd1ExTmhzeU5iZFZadFcwR25GOEVZCmxHOXNWQVh1ZlJSRHJtaDVHNVUv\nbTY0TlNmZ2hESDkzS2M3WHdlamxwclkKLS0tIEEvOFd3TDFkQmQwbjBodHhpb1BD\nZ2NvTnNqQmtrLy9aVDdGRGxZbVgrZG8KdnnjJWcjZFu3R8fVKToj6THHHRCFou9k\njQoedCZAML2A2FZIhHugH9wnDUPQQjG86WbcCBuFWcOTGiTF2gN+Qg==\n-----END AGE ENCRYPTED FILE-----\n"
} }
], ],
"lastmodified": "2025-12-21T22:05:56Z", "lastmodified": "2026-01-10T17:15:33Z",
"mac": "ENC[AES256_GCM,data:i6N/BeTtqkiYz5igk7mHxa69Z8MEe2cRF9541P93utNBddrTGev4VQ5VoqEQEkcOpKWvH5DbQcfsa8k60/zaGXJZ9tWbmbBiBTrbjdslpPJTbVkIwMXWYVhbS87WhfAsyQbRzXu73/jArGKVfDPzcdl2FuRmzXZKQkVjRc7x+Rc=,iv:HxjT6ppxY6jkrSPrcP9m84dd2gy2rGCGKV8MdjGy7FA=,tag:KPWQ2nhsGFuhX8ddFhEZow==,type:str]", "mac": "ENC[AES256_GCM,data:laYkgmwyEQTqUPAI3VBKmhzewfcFAm4duM/s8wcrG1Vdlf+PR/LvSfstCJSEyNrfnPhZNYkDy3SX5qBJGbxjguJkYbeUDWXat78+qZElHtguitAsjclSCZMmizmICEyaFJYkNvad960Mm/CDTzyMQNG6whHdJTXQ309ve/OnKSQ=,iv:PtCxMjO0he3wTbP32sNZx82sik/JIZDIwuwivgGsDRw=,tag:U51Dwv1BmeQUiWoqcj+6SQ==,type:str]",
"unencrypted_suffix": "_unencrypted", "unencrypted_suffix": "_unencrypted",
"version": "3.11.0" "version": "3.11.0"
} }

2
modules/system/services/syncthing.nix
View file

@ -59,7 +59,7 @@ in
message = "Running syncthing on a server requires `gui.domain` to be set"; message = "Running syncthing on a server requires `gui.domain` to be set";
} }
{ {
assertion = (cfg.gui.domain != null) -> (lib'.isTailscaleDomain cfg.gui.domain); assertion = (cfg.gui.domain != null) -> (lib'.isPrivateDomain cfg.gui.domain);
message = lib'.mkUnprotectedMessage "Syncthing-GUI"; message = lib'.mkUnprotectedMessage "Syncthing-GUI";
} }
]; ];

2
modules/system/web-services/filebrowser.nix
View file

@ -27,7 +27,7 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
assertions = lib.singleton { assertions = lib.singleton {
assertion = lib'.isTailscaleDomain cfg.domain; assertion = lib'.isPrivateDomain cfg.domain;
message = lib'.mkUnprotectedMessage "Filebrowser"; message = lib'.mkUnprotectedMessage "Filebrowser";
}; };

2
modules/system/web-services/freshrss.nix
View file

@ -25,7 +25,7 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
assertions = lib.singleton { assertions = lib.singleton {
assertion = lib'.isTailscaleDomain cfg.domain; assertion = lib'.isPrivateDomain cfg.domain;
message = lib'.mkUnprotectedMessage "FreshRSS"; message = lib'.mkUnprotectedMessage "FreshRSS";
}; };