refactor

hosts/freun.dev/services/default.nix

@@ -0,0 +1,40 @@
+{ pkgs, ... }:
+{
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_17;
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      # Required for container networking to be able to use names.
+      dns_enabled = true;
+    };
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  networking.firewall = {
+    trustedInterfaces = [ "podman1" ];
+    interfaces.podman1.allowedUDPPorts = [ 53 ];
+  };
+
+  modules.webserver.enable = true;
+
+  imports = [
+    ./vaultwarden.nix
+    ./immich.nix
+    ./syncthing.nix
+    ./invidious.nix
+    ./grafana.nix
+    ./gtrackmap.nix
+    ./owncast.nix
+    ./tailscale.nix
+    ./workout-tracker.nix
+    ./gotosocial.nix
+    ./snips.nix
+  ];
+}

hosts/freun.dev/services/gotosocial.nix

@@ -0,0 +1,47 @@
+{ config, lib, ... }:
+let
+  domain = "freun.dev";
+  fqdn = "social.${domain}";
+  port = 3500;
+in
+{
+  services.gotosocial = {
+    enable = true;
+    environmentFile = "/var/secrets/gotosocial.env";
+    settings = {
+      host = "social.freun.dev";
+      account-domain = "freun.dev";
+      protocol = "https";
+      bind-address = "localhost";
+      instance-languages = [ "de" "fi" "en" ];
+      instance-inject-mastodon-version = true;
+      accounts-registration-open = true;
+      instance-expose-public-timeline = true;
+      letsencrypt-enabled = false;
+      smtp-host = "horologium.uberspace.de";
+      smtp-port = 587;
+      smtp-username = "noreply@freun.dev";
+      smtp-from = "noreply@freun.dev";
+      inherit port;
+    };
+    setupPostgresqlDB = true;
+  };
+
+  modules.webserver.vHosts = {
+    ${domain}.locations = lib.listToAttrs (
+      lib.map
+        (path: {
+          name = "/.well-known/${path}";
+          value.extraConfig = ''
+            rewrite ^.*$ https://${fqdn}/.well-known/${path} permanent;
+          '';
+        }) [
+        "host-meta"
+        "webfinger"
+        "nodeinfo"
+      ]
+    );
+
+    "${fqdn}".locations."/".proxy = "http://localhost:${toString port}";
+  };
+}

hosts/freun.dev/services/grafana.nix

@@ -0,0 +1,55 @@
+{ ... }:
+let
+  fqdn = "graph.freun.dev";
+  port = 3300;
+in
+{
+  services.grafana = {
+    enable = true;
+
+    settings = {
+      server = {
+        root_url = "https://${fqdn}";
+        http_port = port;
+      };
+
+      database = {
+        host = "/var/run/postgresql";
+        type = "postgres";
+        user = "grafana";
+      };
+
+      smtp = {
+        enabled = true;
+        host = "horologium.uberspace.de";
+        from_address = "noreply@freun.dev";
+        from_name = "Vaultwarden";
+        user = "noreply@freun.dev";
+        password = "$__file{/var/secrets/smtp-password}";
+      };
+    };
+  };
+
+  services.prometheus = {
+    enable = true;
+    exporters.node.enable = true;
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = [
+          { targets = [ "localhost:9100" ]; }
+        ];
+      }
+    ];
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+
+  services.postgresql = {
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [{
+      name = "grafana";
+      ensureDBOwnership = true;
+    }];
+  };
+}

hosts/freun.dev/services/gtrackmap.nix

@@ -0,0 +1,13 @@
+{ ... }:
+let
+  fqdn = "trackmap.freun.dev";
+  port = 3200;
+in
+{
+  services.gtrackmap = {
+    enable = true;
+    inherit port;
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+}

hosts/freun.dev/services/immich.nix

@@ -0,0 +1,185 @@
+{ pkgs, lib, ... }:
+
+let
+  fqdn = "img.freun.dev";
+  port = 2283;
+
+  immich_version = "v1.125.2";
+  storage_dir = "/mnt/storage/syncthing";
+  immich_data_dir = "/mnt/storage/immich";
+
+  volumeServices = names: (
+    lib.lists.foldl
+      (services: name:
+        services // {
+          "podman-volume-immich_${name}" = {
+            path = [ pkgs.podman ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+            script = ''
+              podman volume inspect immich_${name} || podman volume create immich_${name}
+            '';
+            partOf = [ "podman-compose-immich-root.target" ];
+            wantedBy = [ "podman-compose-immich-root.target" ];
+          };
+        }
+      )
+      { }
+      names
+  );
+
+  containerServices = services: (
+    lib.lists.foldl
+      (acc: { name, volumes ? [ ], ... }:
+        let
+          volume_services = map (volume: "podman-volume-immich_${volume}.service") volumes;
+          dependent_services = [ "podman-network-immich_default.service" ] ++ volume_services;
+        in
+
+        acc // {
+          "podman-immich_${name}" = {
+            serviceConfig = {
+              Restart = lib.mkOverride 500 "always";
+            };
+            after = dependent_services;
+            requires = dependent_services;
+            partOf = [
+              "podman-compose-immich-root.target"
+            ];
+            wantedBy = [
+              "podman-compose-immich-root.target"
+            ];
+          };
+        }
+      )
+      { }
+      services
+  );
+in
+{
+  # Containers
+  virtualisation.oci-containers.containers = {
+    "immich_machine_learning" = {
+      image = "ghcr.io/immich-app/immich-machine-learning:${immich_version}";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      volumes = [
+        "immich_model_cache:/cache:rw"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=immich-machine-learning"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_postgres" = {
+      image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      environment = {
+        POSTGRES_INITDB_ARGS = "--data-checksums";
+      };
+      volumes = [
+        "immich_db_data:/var/lib/postgresql/data:rw"
+      ];
+      cmd = [ "postgres" "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=database"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_redis" = {
+      image = "registry.hub.docker.com/library/redis:6.2-alpine";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=redis"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_server" = {
+      image = "ghcr.io/immich-app/immich-server:${immich_version}";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      volumes = [
+        "/etc/localtime:/etc/localtime:ro"
+        "${immich_data_dir}:/usr/src/app/upload:rw"
+        "${storage_dir}:${storage_dir}:ro"
+      ];
+      ports = [
+        "${toString port}:2283/tcp"
+      ];
+      dependsOn = [
+        "immich_postgres"
+        "immich_redis"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=immich-server"
+        "--network=immich_default"
+      ];
+    };
+  };
+
+  systemd.services = (containerServices [
+    { name = "machine_learning"; volumes = [ "model_cache" ]; }
+    { name = "postgres"; volumes = [ "db_data" ]; }
+    { name = "redis"; }
+    { name = "server"; }
+  ]) // {
+    # Networks
+    "podman-network-immich_default" = {
+      path = [ pkgs.podman ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStop = "${pkgs.podman}/bin/podman network rm -f immich_default";
+      };
+      script = ''
+        podman network inspect immich_default || podman network create immich_default
+      '';
+      partOf = [ "podman-compose-immich-root.target" ];
+      wantedBy = [ "podman-compose-immich-root.target" ];
+    };
+  } // (volumeServices [
+    "db_data"
+    "model_cache"
+  ]);
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-immich-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+
+  fileSystems."${immich_data_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/immich";
+    fsType = "cifs";
+    options =
+      let
+        # this line prevents hanging on network split
+        automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+
+      in
+      [ "${automount_opts},credentials=/var/secrets/smb-storage" ];
+  };
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

hosts/freun.dev/services/invidious.nix

@@ -0,0 +1,23 @@
+{ ... }:
+let
+  fqdn = "vid.freun.dev";
+  port = 3000;
+in
+{
+  services.invidious = {
+    enable = true;
+    domain = fqdn;
+    address = "127.0.0.1";
+    inherit port;
+
+    settings = {
+      external_port = 443;
+      db = {
+        dbname = "invidious";
+        user = "invidious";
+      };
+    };
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+}

hosts/freun.dev/services/owncast.nix

@@ -0,0 +1,14 @@
+{ ... }:
+let
+  fqdn = "stream.freun.dev";
+  port = 8080;
+in
+{
+  services.owncast = {
+    enable = true;
+    openFirewall = true;
+    inherit port;
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+}

hosts/freun.dev/services/snips.nix

@@ -0,0 +1,50 @@
+{ pkgs, bin, ... }:
+let
+  fqdn = "bin.freun.dev";
+  port = 3600;
+  sshPort = bin.sshPort;
+  authorizedKeys = pkgs.writeTextFile {
+    name = "authorized_keys";
+    text = ''
+      ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4=
+    '';
+  };
+in
+{
+  nixpkgs.config.snips-sh.withTensorflow = true;
+
+  systemd.services.snips = {
+    enable = true;
+    description = "Snips pastebin";
+    environment = {
+      SNIPS_HTTP_INTERNAL = "http://127.0.0.1:${toString port}";
+      SNIPS_HTTP_EXTERNAL = "https://${fqdn}";
+      SNIPS_SSH_INTERNAL = "ssh://0.0.0.0:${toString sshPort}";
+      SNIPS_SSH_EXTERNAL = "ssh://${fqdn}:${toString sshPort}";
+      SNIPS_HOST_KEY_PATH = "/var/lib/snips/keys/snips";
+      SNIPS_DB_FILEPATH = "/var/lib/snips/snips.db";
+      SNIPS_SSH_AUTHORIZEDKEYSPATH = authorizedKeys;
+    };
+    serviceConfig = {
+      EnvironmentFile = "/var/secrets/snips.env";
+      StateDirectory = "snips";
+      ExecStart = "${pkgs.snips-sh}/bin/snips.sh";
+      WorkingDirectory = "/var/lib/snips";
+      ConfigurationDirectory = "snips";
+      DynamicUser = true;
+    };
+    wantedBy = [ "multi-user.target" ];
+    confinement = {
+      enable = true;
+      packages = [ authorizedKeys ];
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString port}
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+}

hosts/freun.dev/services/syncthing.nix

@@ -0,0 +1,33 @@
+{ pkgs, config, lib, ... }:
+let
+  fqdn = "sync.freun.dev";
+  port = 8384;
+
+  storage_dir = "/mnt/storage/syncthing";
+in
+{
+  services.syncthing = {
+    enable = true;
+    dataDir = "/mnt/storage/syncthing";
+    openDefaultPorts = true;
+    guiAddress = "127.0.0.1:${toString port}";
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+
+  fileSystems."${storage_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/syncthing";
+    fsType = "cifs";
+    options =
+      let
+        # this line prevents hanging on network split
+        automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+        uid = builtins.toString config.users.users.syncthing.uid;
+        gid = builtins.toString config.users.groups.syncthing.gid;
+      in
+      [ "${automount_opts},credentials=/var/secrets/smb-storage,uid=${uid},gid=${gid}" ];
+  };
+
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

hosts/freun.dev/services/tailscale.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "server";
+  };
+}

hosts/freun.dev/services/vaultwarden.nix

@@ -0,0 +1,41 @@
+{ lib, ... }:
+let
+  fqdn = "pw.freun.dev";
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    environmentFile = "/var/secrets/vaultwarden.env";
+    config = {
+      DOMAIN = "https://${fqdn}";
+      DATABASE_URL = "postgres://%2Fvar%2Frun%2Fpostgresql/vaultwarden";
+      WEBSOCKET_ENABLED = true;
+      WEBSOCKET_ADDRESS = "127.0.0.1";
+      WEBSOCKET_PORT = 3012;
+      SIGNUPS_VERIFY = true;
+      PASSWORD_ITERATIONS = 600000;
+      YUBICO_CLIENT_ID = 86799;
+      SMTP_HOST = "horologium.uberspace.de";
+      SMTP_FROM = "noreply@freun.dev";
+      SMTP_FROM_NAME = "Vaultwarden";
+      SMTP_USERNAME = "noreply@freun.dev";
+      SMTP_PORT = 587;
+      HELO_NAME = "freun.dev";
+      ROCKET_LIMITS = "{json=10485760}";
+    };
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations = {
+    "/".proxy = "http://localhost:8000";
+    "/notifications/hub".proxy = "http://localhost:3012";
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "vaultwarden" ];
+    ensureUsers = [{
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+    }];
+  };
+}

hosts/freun.dev/services/workout-tracker.nix

@@ -0,0 +1,35 @@
+{ pkgs, ... }:
+let
+  fqdn = "fit.freun.dev";
+  port = 3322;
+  version = "2.0.3";
+in
+{
+  services.workout-tracker = {
+    enable = true;
+    inherit port;
+    package = pkgs.stdenv.mkDerivation {
+      name = "workout-tracker";
+      src = pkgs.fetchurl {
+        url = "https://github.com/jovandeginste/workout-tracker/releases/download/v${version}/workout-tracker-v${version}-linux-amd64.tar.gz";
+        hash = "sha256-kcchO+7HQwmpYRXqrTtyHWDqy7DkKugO+PJRucboycE=";
+      };
+      nativeBuildInputs = [
+        pkgs.autoPatchelfHook
+      ];
+      sourceRoot = ".";
+      installPhase = ''
+        runHook preInstall
+        install -m755 -D workout-tracker $out/bin/workout-tracker
+        runHook postInstall
+      '';
+      meta = with pkgs.lib; {
+        description = "A simple workout tracker";
+        license = licenses.mit;
+        mainProgram = "workout-tracker";
+      };
+    };
+  };
+
+  modules.webserver.vHosts.${fqdn}.locations."/".proxy = "http://localhost:${toString port}";
+}