SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 14:01:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: SebastianStork:92d61afc401500944a81385dcdb4a7ba2e45f1c2
Branches Tags
SebastianStork:main
SebastianStork:develop
..
compare: SebastianStork:7b8435a5553ff7b4fe1a33052f14b67f78f19572
Branches Tags
SebastianStork:main
SebastianStork:develop

No commits in common. "92d61afc401500944a81385dcdb4a7ba2e45f1c2" and "7b8435a5553ff7b4fe1a33052f14b67f78f19572" have entirely different histories.
92d61afc40 ... 7b8435a555

6 changed files with 79 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/vps-monitor/default.nix
View file

@ -40,14 +40,6 @@
nebula.enable = true;
sshd.enable = true;
dns.enable = true;
caddy.virtualHosts."alerts.sprouted.cloud" = {
inherit (config.custom.web-services.ntfy) port;
extraConfig = ''
@putpost method PUT POST
respond @putpost "Access denied" 403 { close }
'';
};
};
web-services =
@ -67,7 +59,7 @@
ntfy = {
enable = true;
domain = "alerts.${privateDomain}";
domain = "alerts.sprouted.cloud";
};
grafana = {

149
hosts/vps-public/default.nix
View file

@ -13,90 +13,77 @@
ports.validate = true;
};
custom =
let
sproutedDomain = "sprouted.cloud";
in
{
persistence.enable = true;
custom = {
persistence.enable = true;
sops.enable = true;
sops.enable = true;
boot.loader.systemd-boot.enable = true;
boot.loader.systemd-boot.enable = true;
networking = {
overlay.address = "10.254.250.4";
underlay = {
interface = "enp1s0";
address = "167.235.73.246";
isPublic = true;
};
isServer = true;
networking = {
overlay.address = "10.254.250.4";
underlay = {
interface = "enp1s0";
address = "167.235.73.246";
isPublic = true;
};
services = {
gc = {
enable = true;
onlyCleanRoots = true;
};
nebula.enable = true;
sshd.enable = true;
caddy.virtualHosts."dav.${sproutedDomain}" = {
inherit (config.custom.web-services.radicale) port;
extraConfig = ''
respond /.web/ "Access denied" 403 {
close
}
'';
};
};
web-services =
let
privateDomain = config.custom.networking.overlay.domain;
sstorkDomain = "sstork.dev";
in
{
personal-blog = {
enable = true;
domain = sstorkDomain;
};
forgejo = {
enable = true;
domain = "git.${sstorkDomain}";
doBackups = true;
};
outline = {
enable = true;
domain = "wiki.${sproutedDomain}";
doBackups = true;
};
it-tools = {
enable = true;
domain = "tools.${sproutedDomain}";
};
privatebin = {
enable = true;
domain = "pastebin.${sproutedDomain}";
branding.name = "SproutedBin";
};
radicale = {
enable = true;
domain = "dav.${privateDomain}";
doBackups = true;
};
alloy = {
enable = true;
domain = "alloy.${config.networking.hostName}.${privateDomain}";
};
};
isServer = true;
};
services = {
gc = {
enable = true;
onlyCleanRoots = true;
};
nebula.enable = true;
sshd.enable = true;
};
web-services =
let
sstorkDomain = "sstork.dev";
sproutedDomain = "sprouted.cloud";
in
{
personal-blog = {
enable = true;
domain = sstorkDomain;
};
forgejo = {
enable = true;
domain = "git.${sstorkDomain}";
doBackups = true;
};
outline = {
enable = true;
domain = "wiki.${sproutedDomain}";
doBackups = true;
};
it-tools = {
enable = true;
domain = "tools.${sproutedDomain}";
};
privatebin = {
enable = true;
domain = "pastebin.${sproutedDomain}";
branding.name = "SproutedBin";
};
radicale = {
enable = true;
domain = "dav.${sproutedDomain}";
doBackups = true;
};
alloy = {
enable = true;
domain = "alloy.${config.networking.hostName}.${config.custom.networking.overlay.domain}";
};
};
};
}

15
modules/system/networking.nix
View file

@ -21,15 +21,18 @@ in
overlay = {
networkAddress = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
default = "10.254.250.0";
readOnly = true;
};
prefixLength = lib.mkOption {
type = lib.types.nullOr (lib.types.ints.between 0 32);
default = null;
type = lib.types.ints.between 0 32;
default = 24;
readOnly = true;
};
domain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
default = "splitleaf.de";
readOnly = true;
};
address = lib.mkOption {
@ -38,11 +41,11 @@ in
};
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
default = "nebula";
};
systemdUnit = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
default = "nebula@mesh.service";
};
dnsServers = lib.mkOption {

6
modules/system/services/caddy.nix
View file

@ -23,7 +23,6 @@ let
domain,
port,
files,
extraConfig,
...
}:
lib.nameValuePair domain {
@ -44,7 +43,6 @@ let
encode
file_server
'')
(lib.optionalString (extraConfig != null) extraConfig)
];
};
in
@ -75,10 +73,6 @@ in
type = lib.types.nullOr lib.types.path;
default = null;
};
extraConfig = lib.mkOption {
type = lib.types.nullOr lib.types.lines;
default = null;
};
};
}
)

8
modules/system/services/nebula/default.nix
View file

@ -30,14 +30,6 @@ in
message = "'${netCfg.hostname}' is a Nebula lighthouse, but underlay.isPublic is not set. Lighthouses must be publicly reachable.";
};
custom.networking.overlay = {
networkAddress = "10.254.250.0";
prefixLength = 24;
domain = "splitleaf.de";
interface = "nebula";
systemdUnit = "nebula@mesh.service";
};
meta.ports.udp = lib.optional netCfg.underlay.isPublic publicPort;
sops.secrets."nebula/host-key" = {

2
modules/system/web-services/gatus.nix
View file

@ -113,7 +113,7 @@ in
connectivity.checker.target = "1.1.1.1:53"; # Cloudflare DNS
alerting.ntfy = {
topic = "uptime";
url = "https://alerts.${config.custom.networking.overlay.domain}";
url = "https://alerts.sprouted.cloud";
click = "https://${cfg.domain}";
default-alert = {
enable = true;