init

modules/homelab.nix

@@ -0,0 +1,13 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    ./services/vaultwarden.nix
+    ./services/navidrome.nix
+    ./services/caddy.nix
+    ./services/unifi.nix
+    ./services/gitea.nix
+  ];
+}

modules/security.nix

@@ -0,0 +1,6 @@
+{ pkgs, lib, config, ... }:
+{
+	imports = [
+			./security/ssh.nix
+	];
+}

modules/security/ssh.nix

@@ -0,0 +1,21 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = ["nick" "gitea"];
+      MaxAuthTries = 3;
+      PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
+    };
+  };
+  users.users."nick".openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus"
+  ];
+}

modules/services/caddy.nix

@@ -0,0 +1,85 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  services.caddy = {
+    enable = true;
+    environmentFile = "/run/secrets/caddy.env";
+    package = pkgs.caddy.withPlugins {
+      plugins = ["github.com/caddy-dns/cloudflare@v0.2.4"];
+      hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ=";
+    };
+    globalConfig = ''
+      email {$EMAIL}
+      acme_dns cloudflare {$CLOUDFLARE} {
+      	resolvers 1.1.1.1:53 1.0.0.1:53
+      }
+    '';
+    # Public
+    virtualHosts = {
+      "nicknase27.com" = {
+        extraConfig = ''
+          respond "Blank" 200
+        '';
+      };
+      "nv.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy localhost:4533
+        '';
+        serverAliases = ["music.nicknase27.com"];
+      };
+      "vt.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy localhost:8222
+        '';
+        serverAliases = ["vault.nicknase27.com"];
+      };
+      "git.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy localhost:3000
+        '';
+      };
+      "jf.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy 10.0.0.5:8096
+        '';
+        serverAliases = ["watch.nicknase27.com"];
+      };
+
+      # Local
+      "opn.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy 10.0.0.1:80
+        '';
+      };
+      "ui.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy https://localhost:11443 {
+                   transport http {
+                     tls_insecure_skip_verify
+               }
+
+           }
+
+        '';
+      };
+      "storage.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy 10.0.0.5:80
+        '';
+      };
+      "photos.nicknase27.com" = {
+        extraConfig = ''
+          reverse_proxy 10.0.0.5:2283
+        '';
+      };
+    };
+  };
+
+  age.secrets.caddy = {
+    file = ../../secrets/caddy.age;
+    path = "/run/secrets/caddy.env";
+  };
+}

modules/services/gitea.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  services.gitea = {
+    enable = true;
+    database = {
+      type = "sqlite3";
+      passwordFile = "${config.age.secrets.gitea-db.path}";
+    };
+    settings = {
+      server = {
+        DOMAIN = "git.nicknase27.com";
+        ROOT_URL = "https://git.nicknase27.com";
+      };
+    };
+  };
+
+  age.secrets.gitea-db = {
+    file = ../../secrets/gitea-db.age;
+    path = "/run/secrets/gitea-db";
+    mode = "777";
+  };
+}

modules/services/navidrome.nix

@@ -0,0 +1,56 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  services.navidrome = {
+    #Settings
+    enable = true;
+    openFirewall = true;
+    settings = {
+      Address = "0.0.0.0";
+      Port = 4533;
+      DataFolder = "/var/lib/navidrome";
+      BaseURL = "https://nv.nicknase27.com";
+
+      # Library
+      MusicFolder = "/mnt/media/music";
+      AlbumPlayCountMode = "normalized";
+      AutoImportPlaylists = false;
+      PID.Track = "musicbrainz_trackid|albumid,discnumber,tracknumber,title";
+      PID.Album = "musicbrainz_albumid|albumartistid,album,albumversion,musicbrainz_acoustid";
+
+      # UI / Features
+      DefaultTheme = "Spotify-ish";
+      EnableDownloads = true;
+      DefaultDownloadableShare = true;
+      EnableInsightsCollector = false;
+      EnableSharing = true;
+      EnableStarRating = true;
+      DefaultUIVolume = 100;
+
+      LastFM.Enabled = true;
+    };
+
+    #Plugins
+    plugins = with pkgs.navidromePlugins; [
+      discord-rich-presence
+    ];
+
+    #Environment
+    environmentFile = "/run/secrets/navidrome.env";
+  };
+
+  age.secrets.navidrome = {
+    file = ../../secrets/navidrome.age;
+    path = "/run/secrets/navidrome.env";
+  };
+
+  systemd.services = {
+    navidrome = {
+      after = ["mnt-media.mount"];
+      requires = ["mnt-media.mount"];
+    };
+  };
+}

modules/services/unifi.nix

@@ -0,0 +1,16 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  virtualisation.podman.enable = true;
+  virtualisation.oci-containers.backend = "podman";
+
+  services.unifi-os-server = {
+    enable = true;
+    uosSystemIP = "10.0.0.10";
+    openFirewallUiPort = true;
+    openFirewallServicePorts = true;
+  };
+}

modules/services/vaultwarden.nix

@@ -0,0 +1,24 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "sqlite";
+    backupDir = "/var/local/vaultwarden/backup";
+    config = {
+      DOMAIN = "https://vt.nicknase27.com";
+      SIGNUPS_ALLOWED = "true";
+
+      ROCKET_ADDRESS = "0.0.0.0";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+    environmentFile = ["/run/secrets/vaultwarden.env"];
+  };
+  age.secrets.vaultwarden = {
+    file = ../../secrets/vaultwarden.age;
+    path = "/run/secrets/vaultwarden.env";
+  };
+}

modules/system.nix

@@ -0,0 +1,7 @@
+{ pkgs, lib, config, ... }:
+{
+	imports = [
+		./system/garbage-collection.nix
+    ./system/backups.nix
+	];
+}

modules/system/backups.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  services.restic.backups.hermes = {
+    initialize = true;
+
+    repository = "/mnt/backups/";
+
+    passwordFile = config.age.secrets.restic.path;
+
+    paths = [
+      "/var/lib"
+    ];
+
+    timerConfig = {
+      OnCalendar = "daily";
+      RandomizedDelaySec = "1h";
+    };
+
+    pruneOpts = [
+      "--keep-daily=7"
+      "--keep-weekly=4"
+      "--keep-monthly=12"
+    ];
+  };
+
+  age.secrets.restic = {
+    file = ../../secrets/restic.age;
+  };
+}

modules/system/garbage-collection.nix

@@ -0,0 +1,16 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  nix = {
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+
+    optimise.automatic = true;
+  };
+}