gatus: Fix ntfy url

hosts/vps-monitor/default.nix

@@ -40,6 +40,14 @@
       nebula.enable = true;
       sshd.enable = true;
       dns.enable = true;
+
+      caddy.virtualHosts."alerts.sprouted.cloud" = {
+        inherit (config.custom.web-services.ntfy) port;
+        extraConfig = ''
+          @putpost method PUT POST
+          respond @putpost "Access denied" 403 { close }
+        '';
+      };
     };
 
     web-services =
@@ -59,7 +67,7 @@
 
         ntfy = {
           enable = true;
-          domain = "alerts.sprouted.cloud";
+          domain = "alerts.${privateDomain}";
         };
 
         grafana = {

hosts/vps-public/default.nix

@@ -13,77 +13,90 @@
     ports.validate = true;
   };
 
-  custom = {
-    persistence.enable = true;
+  custom =
+    let
+      sproutedDomain = "sprouted.cloud";
+    in
+    {
+      persistence.enable = true;
 
-    sops.enable = true;
+      sops.enable = true;
 
-    boot.loader.systemd-boot.enable = true;
+      boot.loader.systemd-boot.enable = true;
 
-    networking = {
-      overlay.address = "10.254.250.4";
-      underlay = {
-        interface = "enp1s0";
-        address = "167.235.73.246";
-        isPublic = true;
+      networking = {
+        overlay.address = "10.254.250.4";
+        underlay = {
+          interface = "enp1s0";
+          address = "167.235.73.246";
+          isPublic = true;
+        };
+        isServer = true;
       };
-      isServer = true;
+
+      services = {
+        gc = {
+          enable = true;
+          onlyCleanRoots = true;
+        };
+
+        nebula.enable = true;
+        sshd.enable = true;
+
+        caddy.virtualHosts."dav.${sproutedDomain}" = {
+          inherit (config.custom.web-services.radicale) port;
+          extraConfig = ''
+            respond /.web/ "Access denied" 403 {
+            	close
+            }
+          '';
+        };
+      };
+
+      web-services =
+        let
+          privateDomain = config.custom.networking.overlay.domain;
+          sstorkDomain = "sstork.dev";
+        in
+        {
+          personal-blog = {
+            enable = true;
+            domain = sstorkDomain;
+          };
+
+          forgejo = {
+            enable = true;
+            domain = "git.${sstorkDomain}";
+            doBackups = true;
+          };
+
+          outline = {
+            enable = true;
+            domain = "wiki.${sproutedDomain}";
+            doBackups = true;
+          };
+
+          it-tools = {
+            enable = true;
+            domain = "tools.${sproutedDomain}";
+          };
+
+          privatebin = {
+            enable = true;
+            domain = "pastebin.${sproutedDomain}";
+            branding.name = "SproutedBin";
+          };
+
+          radicale = {
+            enable = true;
+            domain = "dav.${privateDomain}";
+            doBackups = true;
+          };
+
+          alloy = {
+            enable = true;
+            domain = "alloy.${config.networking.hostName}.${privateDomain}";
+          };
+        };
     };
-
-    services = {
-      gc = {
-        enable = true;
-        onlyCleanRoots = true;
-      };
-
-      nebula.enable = true;
-      sshd.enable = true;
-    };
-
-    web-services =
-      let
-        sstorkDomain = "sstork.dev";
-        sproutedDomain = "sprouted.cloud";
-      in
-      {
-        personal-blog = {
-          enable = true;
-          domain = sstorkDomain;
-        };
-
-        forgejo = {
-          enable = true;
-          domain = "git.${sstorkDomain}";
-          doBackups = true;
-        };
-
-        outline = {
-          enable = true;
-          domain = "wiki.${sproutedDomain}";
-          doBackups = true;
-        };
-
-        it-tools = {
-          enable = true;
-          domain = "tools.${sproutedDomain}";
-        };
-
-        privatebin = {
-          enable = true;
-          domain = "pastebin.${sproutedDomain}";
-          branding.name = "SproutedBin";
-        };
-
-        radicale = {
-          enable = true;
-          domain = "dav.${sproutedDomain}";
-          doBackups = true;
-        };
-
-        alloy = {
-          enable = true;
-          domain = "alloy.${config.networking.hostName}.${config.custom.networking.overlay.domain}";
-        };
-      };
-  };
 }

modules/system/networking.nix

@@ -21,18 +21,15 @@ in
     overlay = {
       networkAddress = lib.mkOption {
         type = lib.types.nonEmptyStr;
-        default = "10.254.250.0";
-        readOnly = true;
+        default = "";
       };
       prefixLength = lib.mkOption {
-        type = lib.types.ints.between 0 32;
-        default = 24;
-        readOnly = true;
+        type = lib.types.nullOr (lib.types.ints.between 0 32);
+        default = null;
       };
       domain = lib.mkOption {
         type = lib.types.nonEmptyStr;
-        default = "splitleaf.de";
-        readOnly = true;
+        default = "";
       };
 
       address = lib.mkOption {
@@ -41,11 +38,11 @@ in
       };
       interface = lib.mkOption {
         type = lib.types.nonEmptyStr;
-        default = "nebula";
+        default = "";
       };
       systemdUnit = lib.mkOption {
         type = lib.types.nonEmptyStr;
-        default = "nebula@mesh.service";
+        default = "";
       };
 
       dnsServers = lib.mkOption {

modules/system/services/caddy.nix

@@ -23,6 +23,7 @@ let
       domain,
       port,
       files,
+      extraConfig,
       ...
     }:
     lib.nameValuePair domain {
@@ -43,6 +44,7 @@ let
           encode
           file_server
         '')
+        (lib.optionalString (extraConfig != null) extraConfig)
       ];
     };
 in
@@ -73,6 +75,10 @@ in
                 type = lib.types.nullOr lib.types.path;
                 default = null;
               };
+              extraConfig = lib.mkOption {
+                type = lib.types.nullOr lib.types.lines;
+                default = null;
+              };
             };
           }
         )

modules/system/services/nebula/default.nix

@@ -30,6 +30,14 @@ in
       message = "'${netCfg.hostname}' is a Nebula lighthouse, but underlay.isPublic is not set. Lighthouses must be publicly reachable.";
     };
 
+    custom.networking.overlay = {
+      networkAddress = "10.254.250.0";
+      prefixLength = 24;
+      domain = "splitleaf.de";
+      interface = "nebula";
+      systemdUnit = "nebula@mesh.service";
+    };
+
     meta.ports.udp = lib.optional netCfg.underlay.isPublic publicPort;
 
     sops.secrets."nebula/host-key" = {

modules/system/web-services/gatus.nix

@@ -113,7 +113,7 @@ in
         connectivity.checker.target = "1.1.1.1:53"; # Cloudflare DNS
         alerting.ntfy = {
           topic = "uptime";
-          url = "https://alerts.sprouted.cloud";
+          url = "https://alerts.${config.custom.networking.overlay.domain}";
           click = "https://${cfg.domain}";
           default-alert = {
             enable = true;