commit ee906241cd376513605cb8230cc2ef51b1d297f6 · pyrox.dev/nix

lib/data/default.nix

···

       1
       1
        
       {

     

       2
       2
        
         data.hosts = builtins.fromTOML (builtins.readFile ./hosts.toml);

     

       3
       3
        
         data.services = builtins.fromTOML (builtins.readFile ./services.toml);

     

       4
       4
       +
         data.tsNet = "coelacanth-dragon.ts.net";

     

       4
       5
        
       }

+86 -30

systems/x86_64-linux/prefect/services/caddy.nix

···

       1
       1
       -
       { pkgs, lib, ... }: let

     

       1
       1
       +
       { pkgs, lib, ... }:

     

       2
       2
       +
       let

     

       2
       3
        
         pns = lib.py.data.services;

     

       3
       4
        
         marvin = lib.py.data.hosts.marvin.ts.ip4;

     

       4
       4
       -
         reverseProxyToMarvin = port: {

     

       5
       5
       -
         extraConfig = ''

     

       6
       6
       -
           reverse_proxy http://${marvin}:${toString port}

     

       7
       7
       -
         '';

     

       5
       5
       +
         tsNet = lib.py.data.tsNet;

     

       6
       6
       +
         reverseProxyToMarvin = port: ts: {

     

       7
       7
       +
           extraConfig = ''

     

       8
       8
       +
             reverse_proxy http://${marvin}:${toString port}

     

       9
       9
       +
             ${if ts then "tailscale_auth" else ""}

     

       10
       10
       +
           '';

     

       8
       11
        
         };

     

       9
       9
       -
         # Hosts that are just a reverse proxy declaration and nothing else

     

       10
       10
       -
         simpleHosts = [

     

       11
       11
       -
           "nextcloud"

     

       12
       12
       -
           "nextcloud-office"

     

       13
       13
       -
           "git"

     

       14
       14
       -
           "miniflux"

     

       15
       15
       -
           "iceshrimp"

     

       16
       16
       -
           "grafana"

     

       17
       17
       -
           "deemix"

     

       18
       18
       -
           "planka"

     

       19
       19
       -
         ];

     

       20
       20
       -
       

     

       21
       21
       -
         simpleHostAttrs = lib.mapAttrs' (name: value: lib.nameValuePair "${pns.${name}.extUrl}" (reverseProxyToMarvin (toString pns.${value}.port)))

     

       22
       22
       -
           (lib.genAttrs simpleHosts (name: name));

     

       23
       23
       -
       in {

     

       12
       12
       +
       in

     

       13
       13
       +
       {

     

       24
       14
        
         services.caddy = {

     

       25
       15
        
           enable = true;

     

       26
       16
        
           package = pkgs.caddy.withPlugins {

     

       27
       17
        
             plugins = [

     

       28
       18
        
               "github.com/caddy-dns/desec@v0.0.0-20240526070323-822a6a2014b2"

     

       29
       29
       -
               "github.com/greenpau/caddy-security@v1.1.29"

     

       19
       19
       +
               "github.com/greenpau/caddy-security@v1.1.31"

     

       20
       20
       +
               "github.com/tailscale/caddy-tailscale@v0.0.0-20250207163903-69a970c84556"

     

       30
       21
        
             ];

     

       31
       31
       -
             hash = "sha256-nfBjtwqn7UOGRr5Aqy0y1u9AYhWU9TLjbdhZ9uAwtHY=";

     

       22
       22
       +
             hash = "sha256-rvPZ/Lomx40tvlqqhUBIG9wCHJorN2FGus7gtO7ob/0=";

     

       32
       23
        
           };

     

       33
       24
        
           email = "pyrox@pyrox.dev";

     

       34
       25
        
           virtualHosts = {

     

       35
       26
        
             # Just get TLS certs for mailserver

     

       36
       36
       -
             "mail.pyrox.dev" = {};

     

       27
       27
       +
             "mail.pyrox.dev" = { };

     

       37
       28
        
             # Redirect old domains -> pyrox.dev

     

       38
       29
        
             "blog.pyrox.dev" = {

     

       39
       39
       -
               serverAliases = ["www.pyrox.dev" "thehedgehog.me"];

     

       30
       30
       +
               serverAliases = [

     

       31
       31
       +
                 "www.pyrox.dev"

     

       32
       32
       +
                 "thehedgehog.me"

     

       33
       33
       +
               ];

     

       40
       34
        
               extraConfig = ''

     

       41
       35
        
                 redir https://pyrox.dev{uri} permanent

     

       42
       36
        
               '';

     
···

       74
       68
        
             };

     

       75
       69
        
       

     

       76
       70
        
             # Authentik

     

       77
       77
       -
             "${pns.authentik.extUrl}:443" = reverseProxyToMarvin pns.authentik.port;

     

       78
       78
       -
             "${pns.authentik.extUrl}:80" = reverseProxyToMarvin pns.authentik.port;

     

       79
       79
       -
             "http://${pns.authentik.extUrl}:389" = reverseProxyToMarvin 389;

     

       80
       80
       -
             "${pns.authentik.extUrl}:636" = reverseProxyToMarvin 636;

     

       71
       71
       +
             "${pns.authentik.extUrl}:443" = reverseProxyToMarvin pns.authentik.port false;

     

       72
       72
       +
             "${pns.authentik.extUrl}:80" = reverseProxyToMarvin pns.authentik.port false;

     

       73
       73
       +
             "http://${pns.authentik.extUrl}:389" = reverseProxyToMarvin 389 false;

     

       74
       74
       +
             "${pns.authentik.extUrl}:636" = reverseProxyToMarvin 636 false;

     

       81
       75
        
       

     

       82
       76
        
             # Vaultwarden

     

       83
       77
        
             ${pns.vaultwarden.extUrl} = {

     
···

       112
       106
        
                 }

     

       113
       107
        
               '';

     

       114
       108
        
             };

     

       115
       115
       -
       

     

       116
       109
        
             # Jellyfin

     

       117
       110
        
             ${pns.jellyfin.extUrl} = {

     

       118
       111
        
               extraConfig = ''

     
···

       172
       165
        
                 metrics /metrics

     

       173
       166
        
               '';

     

       174
       167
        
             };

     

       175
       175
       -
           } // simpleHostAttrs;

     

       168
       168
       +
             # SIMPLE HOSTS

     

       169
       169
       +
       

     

       170
       170
       +
             # Forgejo

     

       171
       171
       +
             ${pns.git.extUrl} = {

     

       172
       172
       +
               extraConfig = ''

     

       173
       173
       +
                 reverse_proxy http://${marvin}:${toString pns.git.port}

     

       174
       174
       +
               '';

     

       175
       175
       +
             };

     

       176
       176
       +
       

     

       177
       177
       +
             # Grafana

     

       178
       178
       +
             ${pns.grafana.extUrl} = {

     

       179
       179
       +
               extraConfig = ''

     

       180
       180
       +
                 reverse_proxy http://${marvin}:${toString pns.grafana.port}

     

       181
       181
       +
               '';

     

       182
       182
       +
             };

     

       183
       183
       +
       

     

       184
       184
       +
             # Miniflux

     

       185
       185
       +
             ${pns.miniflux.extUrl} = {

     

       186
       186
       +
               extraConfig = ''

     

       187
       187
       +
                 reverse_proxy http://${marvin}:${toString pns.miniflux.port}

     

       188
       188
       +
               '';

     

       189
       189
       +
             };

     

       190
       190
       +
       

     

       191
       191
       +
             # Nextcloud

     

       192
       192
       +
             ${pns.nextcloud.extUrl} = {

     

       193
       193
       +
               extraConfig = ''

     

       194
       194
       +
                 reverse_proxy http://${marvin}:${toString pns.nextcloud.port}

     

       195
       195
       +
               '';

     

       196
       196
       +
             };

     

       197
       197
       +
       

     

       198
       198
       +
             # Nextcloud-Office(Collabora)

     

       199
       199
       +
             ${pns.nextcloud-office.extUrl} = {

     

       200
       200
       +
               extraConfig = ''

     

       201
       201
       +
                 reverse_proxy http://${marvin}:${toString pns.nextcloud-office.port}

     

       202
       202
       +
               '';

     

       203
       203
       +
             };

     

       204
       204
       +
       

     

       205
       205
       +
             # Planka

     

       206
       206
       +
             ${pns.planka.extUrl} = {

     

       207
       207
       +
               extraConfig = ''

     

       208
       208
       +
                 reverse_proxy http://${marvin}:${toString pns.planka.port}

     

       209
       209
       +
               '';

     

       210
       210
       +
             };

     

       211
       211
       +
       

     

       212
       212
       +
             # Simple Tailscale Hosts

     

       213
       213
       +
       

     

       214
       214
       +
             # Deemix

     

       215
       215
       +
             "${pns.deemix.tsHost}.${tsNet}" = {

     

       216
       216
       +
               extraConfig = ''

     

       217
       217
       +
                 bind tailscale/${pns.deemix.tsHost}

     

       218
       218
       +
                 tailscale_auth

     

       219
       219
       +
                 reverse_proxy http://${marvin}:${toString pns.deemix.port}

     

       220
       220
       +
               '';

     

       221
       221
       +
             };

     

       222
       222
       +
             # Pinchflat

     

       223
       223
       +
             "${pns.pinchflat.tsHost}.${tsNet}" = {

     

       224
       224
       +
               extraConfig = ''

     

       225
       225
       +
                 bind tailscale/${pns.pinchflat.tsHost}

     

       226
       226
       +
                 tailscale_auth

     

       227
       227
       +
                 reverse_proxy http://${marvin}:${toString pns.pinchflat.port}

     

       228
       228
       +
               '';

     

       229
       229
       +
             };

     

       230
       230
       +
       

     

       231
       231
       +
           };

     

       176
       232
        
         };

     

       177
       233
        
         systemd.services.caddy.serviceConfig.CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";

     

       178
       234
        
         systemd.services.caddy.serviceConfig.AmbientCapabilities = "CAP_NET_BIND_SERVICE";