···

       
6
       
 
       
    ./services/fail2ban.nix

     

       
7
       
 
       


     

       
8
       
 
       
    ../modules/basic.nix

     

       
0
       
 
       

     

       
9
       
 
       
    ../modules/development/nix.nix

     

       
10
       
 
       
    ../modules/development/sh.nix

     

       
11
       
 
       
    ../modules/editor.nix

     
···

       
17
       
 
       
    ../modules/nix.nix

     

       
18
       
 
       
    ../modules/remote-builder.nix

     

       
19
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
20
       
 
       
    ../modules/services/nextcloud.nix

     

       
21
       
 
       
    ../modules/services/openssh.nix

     

       
22
       
 
       
    ../modules/services/pds.nix

     

       
0
       
 
       

     

       
23
       
 
       
    ../modules/services/tangled.nix

     

       
24
       
 
       
  ];

     

       
25
       
 
       


     

       
26
       
-
       
  garden.info.host = {

     

       
27
       
-
       
    server = true;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
28
       
 
       
  };

     

       
29
       
 
       


     

       
30
       
 
       
  sops = {

     

···

       
6
       
 
       
    ./services/fail2ban.nix

     

       
7
       
 
       


     

       
8
       
 
       
    ../modules/basic.nix

     

       
9
       
+
       
    ../modules/caddy.nix

     

       
10
       
 
       
    ../modules/development/nix.nix

     

       
11
       
 
       
    ../modules/development/sh.nix

     

       
12
       
 
       
    ../modules/editor.nix

     
···

       
18
       
 
       
    ../modules/nix.nix

     

       
19
       
 
       
    ../modules/remote-builder.nix

     

       
20
       
 
       


     

       
21
       
+
       
    ../modules/services/caddy

     

       
22
       
+
       
    ../modules/services/caddy/atproto-did.nix

     

       
23
       
+
       
    ../modules/services/caddy/nextcloud.nix

     

       
24
       
+
       
    ../modules/services/caddy/pds.nix

     

       
25
       
+
       
    ../modules/services/caddy/soju.nix

     

       
26
       
+
       
    ../modules/services/caddy/tangled-knot.nix

     

       
27
       
+
       
    ../modules/services/caddy/websites/boo-b77.nix

     

       
28
       
+
       
    ../modules/services/caddy/websites/boo-y6d.nix

     

       
29
       
+
       
    ../modules/services/caddy/websites/org-biotabit.nix

     

       
30
       
+
       
    ../modules/services/caddy/websites/org-butwho.nix

     

       
31
       
+
       
    ../modules/services/caddy/websites/pink-lilac.nix

     

       
32
       
+
       
    ../modules/services/caddy/websites/pink-yemou.nix

     

       
33
       
+
       


     

       
34
       
 
       
    ../modules/services/nextcloud.nix

     

       
35
       
 
       
    ../modules/services/openssh.nix

     

       
36
       
 
       
    ../modules/services/pds.nix

     

       
37
       
+
       
    ../modules/services/soju.nix

     

       
38
       
 
       
    ../modules/services/tangled.nix

     

       
39
       
 
       
  ];

     

       
40
       
 
       


     

       
41
       
+
       
  garden = {

     

       
42
       
+
       
    caddy.package = {

     

       
43
       
+
       
      plugins = [

     

       
44
       
+
       
        "github.com/mholt/caddy-events-exec@v0.1.0"

     

       
45
       
+
       
        "github.com/mholt/caddy-l4@v0.0.0-20250530154005-4d3c80e89c5f"

     

       
46
       
+
       
      ];

     

       
47
       
+
       
      hash = "sha256-X+46XM2UzadAifeTvKOdUdawU8EaINUTIeCjAVVCGqU=";

     

       
48
       
+
       
    };

     

       
49
       
+
       
    info.host.server = true;

     

       
50
       
 
       
  };

     

       
51
       
 
       


     

       
52
       
 
       
  sops = {

     

···

       
19
       
 
       
    settings = {

     

       
20
       
 
       
      PasswordAuthentication = false;

     

       
21
       
 
       
      PermitRootLogin = "no";

     

       
22
       
-
       
      PerSourcePenalties = "no"; # TODO: Look into mmproxy or some other way of giving the client-ip to openssh

     

       
23
       
 
       
    };

     

       
24
       
 
       
  };

     

       
25
       
 
       
}

     

···

       
19
       
 
       
    settings = {

     

       
20
       
 
       
      PasswordAuthentication = false;

     

       
21
       
 
       
      PermitRootLogin = "no";

     

       
0
       
 
       

     

       
22
       
 
       
    };

     

       
23
       
 
       
  };

     

       
24
       
 
       
}

     

···

       
1
       
-
       
{ config, ... }:

     

       
2
       
 
       
{

     

       
3
       
 
       
  services.caddy.virtualHosts."cloud.lilac.pink".extraConfig = ''

     

       
4
       
 
       
    encode

     

       
5
       
-
       
    reverse_proxy ${config.garden.info.network.lily.netbird-ip}:80 {

     

       
6
       
 
       
      # NixOS uses nginx as a webserver for NextCloud by default and nginx will send 301 redirects to the client

     

       
7
       
 
       
      # using http as the protocol instead of https since it doesn't have SSL certs of its own.

     

       
8
       
 
       
      # Because the redirect isn't also https, this can cause a Content-Security-Policy error on the client.

     

···

       
1
       
+
       
{ ... }:

     

       
2
       
 
       
{

     

       
3
       
 
       
  services.caddy.virtualHosts."cloud.lilac.pink".extraConfig = ''

     

       
4
       
 
       
    encode

     

       
5
       
+
       
    reverse_proxy [::1]:8080 {

     

       
6
       
 
       
      # NixOS uses nginx as a webserver for NextCloud by default and nginx will send 301 redirects to the client

     

       
7
       
 
       
      # using http as the protocol instead of https since it doesn't have SSL certs of its own.

     

       
8
       
 
       
      # Because the redirect isn't also https, this can cause a Content-Security-Policy error on the client.

     

···

       
1
       
-
       
{ config, ... }:

     

       
2
       
 
       
{

     

       
3
       
 
       
  services.caddy = {

     

       
4
       
 
       
    globalConfig = ''

     

       
5
       
 
       
      on_demand_tls {

     

       
6
       
-
       
        ask http://${config.garden.info.network.lily.netbird-ip}:3000/tls-check

     

       
7
       
 
       
      }

     

       
8
       
 
       
    '';

     

       
9
       
 
       
    virtualHosts = {

     
···

       
12
       
 
       
          on_demand

     

       
13
       
 
       
        }

     

       
14
       
 
       
        encode

     

       
15
       
-
       
        reverse_proxy ${config.garden.info.network.lily.netbird-ip}:3000

     

       
16
       
 
       
      '';

     

       
17
       
 
       
      "*.butwho.club".extraConfig = ''

     

       
18
       
 
       
        tls {

     

       
19
       
 
       
          on_demand

     

       
20
       
 
       
        }

     

       
21
       
 
       
        encode

     

       
22
       
-
       
        reverse_proxy ${config.garden.info.network.lily.netbird-ip}:3000

     

       
23
       
 
       
      '';

     

       
24
       
 
       
      "*.butwho.social".extraConfig = ''

     

       
25
       
 
       
        tls {

     

       
26
       
 
       
          on_demand

     

       
27
       
 
       
        }

     

       
28
       
 
       
        encode

     

       
29
       
-
       
        reverse_proxy ${config.garden.info.network.lily.netbird-ip}:3000

     

       
30
       
 
       
      '';

     

       
31
       
 
       
    };

     

       
32
       
 
       
  };

     

···

       
1
       
+
       
{ ... }:

     

       
2
       
 
       
{

     

       
3
       
 
       
  services.caddy = {

     

       
4
       
 
       
    globalConfig = ''

     

       
5
       
 
       
      on_demand_tls {

     

       
6
       
+
       
        ask http://[::1]:3000/tls-check

     

       
7
       
 
       
      }

     

       
8
       
 
       
    '';

     

       
9
       
 
       
    virtualHosts = {

     
···

       
12
       
 
       
          on_demand

     

       
13
       
 
       
        }

     

       
14
       
 
       
        encode

     

       
15
       
+
       
        reverse_proxy [::1]:3000

     

       
16
       
 
       
      '';

     

       
17
       
 
       
      "*.butwho.club".extraConfig = ''

     

       
18
       
 
       
        tls {

     

       
19
       
 
       
          on_demand

     

       
20
       
 
       
        }

     

       
21
       
 
       
        encode

     

       
22
       
+
       
        reverse_proxy [::1]:3000

     

       
23
       
 
       
      '';

     

       
24
       
 
       
      "*.butwho.social".extraConfig = ''

     

       
25
       
 
       
        tls {

     

       
26
       
 
       
          on_demand

     

       
27
       
 
       
        }

     

       
28
       
 
       
        encode

     

       
29
       
+
       
        reverse_proxy [::1]:3000

     

       
30
       
 
       
      '';

     

       
31
       
 
       
    };

     

       
32
       
 
       
  };

     

···

       
1
       
 
       
{ ... }:

     

       
2
       
 
       
{

     

       
3
       
-
       
  networking.firewall.interfaces."enp1s0".allowedTCPPorts = [ 6697 ];

     

       
4
       
 
       


     

       
5
       
 
       
  services.caddy.virtualHosts."soju.y6d.boo".extraConfig = ''

     

       
6
       
 
       
    encode

     

       
7
       
-
       
    reverse_proxy [::1]:8080

     

       
8
       
 
       
  '';

     

       
9
       
 
       


     

       
10
       
 
       
  garden.caddy.layer4 = ''

     

···

       
1
       
 
       
{ ... }:

     

       
2
       
 
       
{

     

       
3
       
+
       
  networking.firewall.allowedTCPPorts = [ 6697 ];

     

       
4
       
 
       


     

       
5
       
 
       
  services.caddy.virtualHosts."soju.y6d.boo".extraConfig = ''

     

       
6
       
 
       
    encode

     

       
7
       
+
       
    reverse_proxy [::1]:8081

     

       
8
       
 
       
  '';

     

       
9
       
 
       


     

       
10
       
 
       
  garden.caddy.layer4 = ''

     

···

       
1
       
-
       
{ config, ... }:

     

       
2
       
 
       
{

     

       
3
       
-
       
  networking.firewall.interfaces."enp1s0".allowedTCPPorts = [ 22 ];

     

       
4
       
-
       


     

       
5
       
 
       
  services.caddy.virtualHosts."knot.butwho.org".extraConfig = ''

     

       
6
       
 
       
    encode

     

       
7
       
-
       
    reverse_proxy ${config.garden.info.network.lily.netbird-ip}:5555

     

       
8
       
-
       
  '';

     

       
9
       
-
       


     

       
10
       
-
       
  garden.caddy.layer4 = ''

     

       
11
       
-
       
    [::]:22 {

     

       
12
       
-
       
      route {

     

       
13
       
-
       
        proxy ${config.garden.info.network.lily.netbird-ip}:2222

     

       
14
       
-
       
      }

     

       
15
       
-
       
    }

     

       
16
       
 
       
  '';

     

       
17
       
 
       
}

     

···

       
1
       
+
       
{ ... }:

     

       
2
       
 
       
{

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
  services.caddy.virtualHosts."knot.butwho.org".extraConfig = ''

     

       
4
       
 
       
    encode

     

       
5
       
+
       
    reverse_proxy [::1]:5555

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
6
       
 
       
  '';

     

       
7
       
 
       
}

     

···

       
21
       
 
       
        respond "{err.status_code} {err.status_text}"

     

       
22
       
 
       
      }

     

       
23
       
 
       
    '';

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
24
       
 
       
    "butwho.social".extraConfig = ''

     

       
25
       
 
       
      redir https://butwho.org{uri}

     

       
26
       
 
       
    '';

     

···

       
21
       
 
       
        respond "{err.status_code} {err.status_text}"

     

       
22
       
 
       
      }

     

       
23
       
 
       
    '';

     

       
24
       
+
       
    "butwho.club".extraConfig = ''

     

       
25
       
+
       
      redir https://butwho.org{uri}

     

       
26
       
+
       
    '';

     

       
27
       
 
       
    "butwho.social".extraConfig = ''

     

       
28
       
 
       
      redir https://butwho.org{uri}

     

       
29
       
 
       
    '';

     

···

       
46
       
 
       
  };

     

       
47
       
 
       


     

       
48
       
 
       
  # This is the port that nginx listens on by default

     

       
49
       
-
       
  networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 80 ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
50
       
 
       


     

       
51
       
 
       
  services = {

     

       
52
       
 
       
    redis.package = pkgs.valkey;

     
···

       
74
       
 
       
      maxUploadSize = "1G";

     

       
75
       
 
       
      notify_push = {

     

       
76
       
 
       
        enable = true;

     

       
77
       
-
       
        nextcloudUrl = "http://${config.garden.info.network.${config.networking.hostName}.netbird-ip}";

     

       
78
       
 
       
      };

     

       
79
       
 
       
      phpOptions = {

     

       
80
       
 
       
        "opcache.interned_strings_buffer" = "16";

     
···

       
103
       
 
       
        };

     

       
104
       
 
       
        "simpleSignUpLink.shown" = false;

     

       
105
       
 
       
        trusted_proxies = [

     

       
106
       
-
       
          config.garden.info.network.${config.networking.hostName}.netbird-ip

     

       
107
       
-
       
          config.garden.info.network.dandelion.netbird-ip

     

       
108
       
-
       
          config.garden.info.network.${config.networking.hostName}.ipv4-local

     

       
109
       
 
       
        ];

     

       
110
       
 
       
      };

     

       
111
       
 
       
    };

     
···

       
115
       
 
       
    services = {

     

       
116
       
 
       
      # TODO: Need to make sure that this runs after nextcloud to avoid startup errors especially when there is a nextcloud

     

       
117
       
 
       
      #       upgrade

     

       
118
       
-
       
      nextcloud-notify_push_setup.environment = {

     

       
119
       
-
       
        NEXTCLOUD_URL = config.services.nextcloud.notify_push.nextcloudUrl;

     

       
120
       
-
       
      };

     

       
121
       
 
       
      nextcloud-generate-previews = {

     

       
122
       
 
       
        enable = true;

     

       
123
       
 
       
        description = "Nextcloud preview generator app (https://github.com/nextcloud/previewgenerator)";

     

···

       
46
       
 
       
  };

     

       
47
       
 
       


     

       
48
       
 
       
  # This is the port that nginx listens on by default

     

       
49
       
+
       


     

       
50
       
+
       
  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [

     

       
51
       
+
       
    {

     

       
52
       
+
       
      addr = "[::1]";

     

       
53
       
+
       
      port = 8080;

     

       
54
       
+
       
    }

     

       
55
       
+
       
  ];

     

       
56
       
 
       


     

       
57
       
 
       
  services = {

     

       
58
       
 
       
    redis.package = pkgs.valkey;

     
···

       
80
       
 
       
      maxUploadSize = "1G";

     

       
81
       
 
       
      notify_push = {

     

       
82
       
 
       
        enable = true;

     

       
83
       
+
       
        nextcloudUrl = "http://[::1]:8080";

     

       
84
       
 
       
      };

     

       
85
       
 
       
      phpOptions = {

     

       
86
       
 
       
        "opcache.interned_strings_buffer" = "16";

     
···

       
109
       
 
       
        };

     

       
110
       
 
       
        "simpleSignUpLink.shown" = false;

     

       
111
       
 
       
        trusted_proxies = [

     

       
112
       
+
       
          "::1"

     

       
0
       
 
       

     

       
0
       
 
       

     

       
113
       
 
       
        ];

     

       
114
       
 
       
      };

     

       
115
       
 
       
    };

     
···

       
119
       
 
       
    services = {

     

       
120
       
 
       
      # TODO: Need to make sure that this runs after nextcloud to avoid startup errors especially when there is a nextcloud

     

       
121
       
 
       
      #       upgrade

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
122
       
 
       
      nextcloud-generate-previews = {

     

       
123
       
 
       
        enable = true;

     

       
124
       
 
       
        description = "Nextcloud preview generator app (https://github.com/nextcloud/previewgenerator)";

     

···

       
5
       
 
       
    hostName = "soju.y6d.boo";

     

       
6
       
 
       
    listen = [

     

       
7
       
 
       
      "irc+insecure://[::1]:6667"

     

       
8
       
-
       
      "http+insecure://[::1]:8080" # Needed for file-upload

     

       
9
       
 
       
    ];

     

       
10
       
 
       
    acceptProxyIP = [ "localhost" ];

     

       
11
       
 
       
    enableMessageLogging = false; # This stores messages using the filesystem, I want to use the database.

     

···

       
5
       
 
       
    hostName = "soju.y6d.boo";

     

       
6
       
 
       
    listen = [

     

       
7
       
 
       
      "irc+insecure://[::1]:6667"

     

       
8
       
+
       
      "http+insecure://[::1]:8081" # Needed for file-upload

     

       
9
       
 
       
    ];

     

       
10
       
 
       
    acceptProxyIP = [ "localhost" ];

     

       
11
       
 
       
    enableMessageLogging = false; # This stores messages using the filesystem, I want to use the database.

     

···

       
21
       
 
       
    '';

     

       
22
       
 
       
  };

     

       
23
       
 
       


     

       
24
       
-
       
  services.openssh.settings.AllowUsers = [

     

       
25
       
-
       
    "${config.services.tangled-knot.gitUser}@${config.garden.info.network.dandelion.netbird-ip}"

     

       
26
       
-
       
  ];

     

       
0
       
 
       

     

       
27
       
 
       


     

       
28
       
-
       
  networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 5555 ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
29
       
 
       


     

       
30
       
 
       
  services.tangled-knot = {

     

       
31
       
 
       
    enable = true;

     

···

       
21
       
 
       
    '';

     

       
22
       
 
       
  };

     

       
23
       
 
       


     

       
24
       
+
       
  services.openssh = {

     

       
25
       
+
       
    ports = [ 22 ];

     

       
26
       
+
       
    settings.AllowUsers = [ "${config.services.tangled-knot.gitUser}" ];

     

       
27
       
+
       
  };

     

       
28
       
 
       


     

       
29
       
+
       
  networking.firewall.allowedTCPPorts = [

     

       
30
       
+
       
    22

     

       
31
       
+
       
    5555

     

       
32
       
+
       
  ];

     

       
33
       
 
       


     

       
34
       
 
       
  services.tangled-knot = {

     

       
35
       
 
       
    enable = true;