refactor file structure

hosts/apu/configuration.nix

@@ -0,0 +1,297 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is availanodev";
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ lib, pkgs, ... }:
+let
+  services = {
+    ssh = { tcp = [ 22 ]; };
+    dhcp = { udp = [ 67 68 ]; };
+    dns = { udp = [ 53 ]; };
+    web = { tcp = [ 80 443 ]; };
+  };
+
+  vlans = {
+    koti = {
+      id = 10;
+      ipv6 = true;
+      availableServices = with services; [ dhcp dns ssh ];
+    };
+    gast = {
+      id = 20;
+      ipv6 = true;
+      staticLeases = [
+        { macAddress = "dc:a6:32:05:08:5d"; address = "10.20.1.235"; }
+      ];
+      availableServices = with services; [ dhcp dns ];
+    };
+    iot = {
+      id = 30;
+      availableServices = with services; [ dhcp dns ];
+    };
+    cfg = {
+      id = 40;
+      staticLeases = [
+        { macAddress = "8c:3b:ad:c5:b8:ee"; address = "10.40.0.10"; }
+      ];
+      availableServices = with services; [ dhcp dns ];
+    };
+  };
+
+  pvid = vlans.cfg.id;
+  vlanIds = lib.map ({ id, ... }: id) (lib.attrValues vlans);
+  vlanRange = {
+    min = lib.foldr lib.min 999 vlanIds;
+    max = lib.foldr lib.max 0 vlanIds;
+  };
+
+  buildVlanNetdev = name: { id, ... }: {
+    name = "20-${name}";
+    value = {
+      netdevConfig = {
+        Name = name;
+        Kind = "vlan";
+        MACAddress = "00:0d:b9:49:d2:${toString id}";
+      };
+      vlanConfig = { Id = id; };
+    };
+  };
+
+  buildStaticLease = { macAddress, address }: ''
+    [DHCPServerStaticLease]
+    MACAddress=${macAddress}
+    Address=${address}
+  '';
+
+  buildBridgeVLANConfig = id: { VLAN = id; };
+
+  buildVlanNetwork = name: { id, ipv6 ? false, staticLeases ? [ ], ... }: {
+    name = "30-${name}";
+    value = {
+      matchConfig = {
+        Name = name;
+      };
+      networkConfig = {
+        Address = "10.${toString id}.0.1/23";
+        IPMasquerade = "ipv4";
+        DHCPServer = true;
+        IPv6AcceptRA = false;
+        IPv6SendRA = ipv6;
+        DHCPPrefixDelegation = ipv6;
+      };
+      dhcpServerConfig = {
+        PoolOffset = 255;
+        DNS = "10.${toString id}.0.1";
+      };
+      extraConfig = lib.concatLines (lib.map buildStaticLease staticLeases);
+    };
+  };
+
+  buildFirewallRules = name: { availableServices ? [ ], ... }: {
+    allowedUDPPorts = lib.flatten (lib.map ({ udp ? [ ], ... }: udp) availableServices);
+    allowedTCPPorts = lib.flatten (lib.map ({ tcp ? [ ], ... }: tcp) availableServices);
+  };
+
+  vlanNetdevs = lib.mapAttrs' buildVlanNetdev vlans;
+  vlanNetworks = lib.mapAttrs' buildVlanNetwork vlans;
+  firewallRules = lib.mapAttrs buildFirewallRules (
+    vlans // { "tailscale*".availableServices = with services; [ ssh web ]; }
+  );
+
+  nginxVhost = options: {
+    http2 = true;
+    forceSSL = true;
+    enableACME = true;
+    acmeRoot = null;
+  } // options;
+
+  nginxProxy = options: {
+    proxyWebsockets = true;
+  } // options;
+in
+{
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+
+  networking.hostName = "apu";
+  networking.useNetworkd = true;
+
+  systemd.network = {
+    enable = true;
+    config.networkConfig.IPv6Forwarding = true;
+
+    links = {
+      "10-extern0" = {
+        matchConfig.Path = "pci-0000:01:00.0";
+        linkConfig.Name = "extern0";
+      };
+      "10-intern0" = {
+        matchConfig.Path = "pci-0000:02:00.0";
+        linkConfig.Name = "intern0";
+      };
+      "10-intern1" = {
+        matchConfig.Path = "pci-0000:03:00.0";
+        linkConfig.Name = "intern1";
+      };
+    };
+    netdevs = {
+      "20-lan" = {
+        netdevConfig = {
+          Name = "lan";
+          Kind = "bridge";
+        };
+        bridgeConfig = {
+          VLANFiltering = true;
+          DefaultPVID = pvid;
+        };
+      };
+    } // vlanNetdevs;
+    networks = {
+      "30-bind-lan" = {
+        matchConfig = {
+          Name = "intern*";
+        };
+        networkConfig = {
+          Bridge = "lan";
+        };
+        extraConfig = ''
+          [BridgeVLAN]
+          VLAN=${toString vlanRange.min}-${toString vlanRange.max}
+          EgressUntagged=${toString pvid}
+          PVID=${toString pvid}
+        '';
+      };
+      "30-lan" = {
+        matchConfig = {
+          Name = "lan";
+        };
+        networkConfig = {
+          IPv6AcceptRA = false;
+          ConfigureWithoutCarrier = true;
+        };
+        vlan = lib.attrNames vlans;
+        bridgeVLANs = lib.map buildBridgeVLANConfig vlanIds;
+      };
+      "30-wan" = {
+        matchConfig = {
+          Name = "extern0";
+        };
+        networkConfig = {
+          DHCP = true;
+          DNS = "127.0.0.1";
+          IPv6AcceptRA = true;
+          IPv4Forwarding = true;
+        };
+        dhcpV6Config = {
+          PrefixDelegationHint = "::/56";
+        };
+        dhcpV4Config = {
+          Use6RD = true;
+        };
+      };
+    } // vlanNetworks;
+  };
+
+  time.timeZone = "Europe/Helsinki";
+
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4="
+    ];
+    initialPassword = "change-me";
+  };
+
+  environment.systemPackages = with pkgs; [
+    wget
+    curl
+    dig
+    neovim
+    vim
+    htop
+  ];
+
+  services.openssh = {
+    enable = true;
+    openFirewall = false;
+    settings.PasswordAuthentication = false;
+  };
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+  };
+
+  services.resolved.enable = false;
+
+  services.nextdns = {
+    enable = true;
+    arguments = [ "-profile" "9c4ac9" "-setup-router" "-mdns" "koti" ];
+  };
+
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      # Components required to complete the onboarding
+      "esphome"
+      "met"
+      "radio_browser"
+
+      "yeelight"
+      "xiaomi_aqara"
+      "shelly"
+    ];
+    extraPackages = python3Packages: with python3Packages; [
+      gtts
+      numpy
+    ];
+    config = {
+      homeassistant = {
+        name = "Koti";
+        unit_system = "metric";
+        time_zone = "Europe/Helsinki";
+      };
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = "127.0.0.1";
+      };
+      default_config = { };
+    };
+  };
+
+  services.nginx.virtualHosts."koti.repomaa.com" = nginxVhost {
+    extraConfig = ''
+      proxy_buffering off;
+    '';
+    locations."/" = nginxProxy {
+      proxyPass = "http://127.0.0.1:8123";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedBrotliSettings = true;
+    recommendedGzipSettings = true;
+    recommendedZstdSettings = true;
+    recommendedOptimisation = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      dnsProvider = "hetzner";
+      environmentFile = "/var/secrets/lego";
+      email = "admin@j.repomaa.com";
+    };
+  };
+
+  networking.nftables.enable = true;
+  networking.firewall.enable = true;
+  networking.useDHCP = false;
+  networking.firewall.interfaces = firewallRules;
+
+  system.stateVersion = "24.05";
+}

hosts/apu/default.nix

@@ -0,0 +1,11 @@
+{ inputs, ... }:
+let
+  inherit (inputs) nixos-hardware;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    nixos-hardware.nixosModules.pcengines-apu
+  ];
+}

hosts/apu/hardware-configuration.nix

@@ -0,0 +1,53 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f221c6a7-e05e-40dc-bc85-7970d7c8f22b";
+      fsType = "btrfs";
+      options = [ "subvol=@" ];
+    };
+
+  fileSystems."/var/log" =
+    { device = "/dev/disk/by-uuid/f221c6a7-e05e-40dc-bc85-7970d7c8f22b";
+      fsType = "btrfs";
+      options = [ "subvol=@var_log" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/14D2-F8F4";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-uuid/f221c6a7-e05e-40dc-bc85-7970d7c8f22b";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/freun.dev/configuration.nix

@@ -0,0 +1,150 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, self, ... }:
+
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "sourcehut:~repomaa/NixOS";
+    flags = [
+      "--update-input"
+      "nixpkgs"
+      "-L" # print build logs
+    ];
+    dates = "02:00";
+    randomizedDelaySec = "45min";
+  };
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.efiSupport = false;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  networking.hostName = "freun-dev"; # Define your hostname.
+  networking.useDHCP = false;
+  networking.nftables.enable = true;
+
+  systemd.network = {
+    enable = true;
+    networks.static = {
+      name = "enp1s0";
+      address = [
+        "95.217.223.61/32"
+        "2a01:4f9:c012:5e97::1/64"
+      ];
+      routes = [
+        { Gateway = "fe80::1"; }
+        {
+          Gateway = "172.31.1.1";
+          GatewayOnLink = true;
+        }
+      ];
+      dns = [
+        # Hetzner
+        "185.12.64.1"
+        "185.12.64.2"
+        "2a01:4ff:ff00::add:1"
+        "2a01:4ff:ff00::add:2"
+        # Quad9
+        "9.9.9.9"
+        "149.112.112.112"
+        "2620:fe::fe"
+        "2620:fe::9"
+      ];
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Helsinki";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkbOptions in tty.
+  # };
+
+
+  # Configure keymap in X11
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    # packages = with pkgs; [
+    #   firefox
+    #   tree
+    # ];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4="
+    ];
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    htop
+    git
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}

hosts/freun.dev/default.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+let
+  inherit (inputs) gtrackmap;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./services.nix
+    gtrackmap.nixosModules.x86_64-linux.default
+  ];
+}

hosts/freun.dev/gotosocial.nix

@@ -0,0 +1,42 @@
+{ config, ... }:
+let
+  fqdn = "social.freun.dev";
+  port = 3500;
+in
+{
+  services.gotosocial = {
+    enable = true;
+    environmentFile = "/var/secrets/gotosocial.env";
+    settings = {
+      host = "social.freun.dev";
+      account-domain = "freun.dev";
+      protocol = "https";
+      bind-address = "localhost";
+      instance-languages = [ "de" "fi" "en" ];
+      instance-inject-mastodon-version = true;
+      accounts-registration-open = true;
+      instance-expose-public-timeline = true;
+      letsencrypt-enabled = false;
+      smtp-host = "horologium.uberspace.de";
+      smtp-port = 587;
+      smtp-username = "noreply@freun.dev";
+      smtp-from = "noreply@freun.dev";
+      inherit port;
+    };
+    setupPostgresqlDB = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "freun.dev".extraConfig = ''
+      redir /.well-known/host-meta* https://${fqdn}{uri} permanent
+      redir /.well-known/webfinger* https://${fqdn}{uri} permanent
+      redir /.well-known/nodeinfo* https://${fqdn}{uri} permanent
+    '';
+
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString config.services.gotosocial.settings.port} {
+        flush_interval -1
+      }
+    '';
+  };
+}

hosts/freun.dev/grafana.nix

@@ -0,0 +1,60 @@
+{ ... }:
+let
+  fqdn = "graph.freun.dev";
+  port = 3300;
+in
+{
+  services.grafana = {
+    enable = true;
+
+    settings = {
+      server = {
+      	root_url = "https://${fqdn}";
+        http_port = port;
+      };
+
+      database = {
+        host = "/var/run/postgresql";
+        type = "postgres";
+        user = "grafana";
+      };
+
+      smtp = {
+        enabled = true;
+        host = "horologium.uberspace.de";
+        from_address = "noreply@freun.dev";
+        from_name = "Vaultwarden";
+        user = "noreply@freun.dev";
+        password = "$__file{/var/secrets/smtp-password}";
+      };
+    };
+  };
+
+  services.prometheus = {
+    enable = true;
+    exporters.node.enable = true;
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = [
+          { targets = [ "localhost:9100" ]; }
+        ];
+      }
+    ];
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${builtins.toString port}
+    '';
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [{
+      name = "grafana";
+      ensureDBOwnership = true;
+    }];
+  };
+}
+

hosts/freun.dev/gtrackmap.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+let
+  fqdn = "trackmap.freun.dev";
+in
+{
+  services.gtrackmap = {
+    enable = true;
+    port = 3200;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString config.services.gtrackmap.port}
+    '';
+  };
+}

hosts/freun.dev/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8456c7de-2116-4cbe-8deb-76cafbd3e6dd";
+      fsType = "btrfs";
+      options = [ "subvol=@" ];
+    };
+
+  fileSystems."/var" =
+    { device = "/dev/disk/by-uuid/8456c7de-2116-4cbe-8deb-76cafbd3e6dd";
+      fsType = "btrfs";
+      options = [ "subvol=@var" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/614a1b7f-04aa-478c-9011-8b81f133da98"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/freun.dev/hydra.nix

@@ -0,0 +1,21 @@
+{ ... }:
+let
+  fqdn = "ci.freun.dev";
+  port = 3400;
+in
+{
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://${fqdn}";
+    notificationSender = "Hydra <noreply@freun.dev>";
+    buildMachinesFiles = [];
+    useSubstitutes = true;
+    inherit port;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${builtins.toString port}
+    '';
+  };
+}

hosts/freun.dev/immich.nix

@@ -0,0 +1,186 @@
+{ pkgs, lib, ... }:
+
+let
+  immich_version = "v1.125.2";
+  storage_dir = "/mnt/storage/syncthing";
+  immich_data_dir = "/mnt/storage/immich";
+
+  volumeServices = names: (
+    lib.lists.foldl
+      (services: name:
+        services // {
+          "podman-volume-immich_${name}" = {
+            path = [ pkgs.podman ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+            script = ''
+              podman volume inspect immich_${name} || podman volume create immich_${name}
+            '';
+            partOf = [ "podman-compose-immich-root.target" ];
+            wantedBy = [ "podman-compose-immich-root.target" ];
+          };
+        }
+      )
+      { }
+      names
+  );
+
+  containerServices = services: (
+    lib.lists.foldl
+      (acc: { name, volumes ? [ ], ... }:
+        let
+          volume_services = map (volume: "podman-volume-immich_${volume}.service") volumes;
+          dependent_services = [ "podman-network-immich_default.service" ] ++ volume_services;
+        in
+
+        acc // {
+          "podman-immich_${name}" = {
+            serviceConfig = {
+              Restart = lib.mkOverride 500 "always";
+            };
+            after = dependent_services;
+            requires = dependent_services;
+            partOf = [
+              "podman-compose-immich-root.target"
+            ];
+            wantedBy = [
+              "podman-compose-immich-root.target"
+            ];
+          };
+        }
+      )
+      { }
+      services
+  );
+in
+{
+  # Containers
+  virtualisation.oci-containers.containers = {
+    "immich_machine_learning" = {
+      image = "ghcr.io/immich-app/immich-machine-learning:${immich_version}";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      volumes = [
+        "immich_model_cache:/cache:rw"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=immich-machine-learning"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_postgres" = {
+      image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      environment = {
+        POSTGRES_INITDB_ARGS = "--data-checksums";
+      };
+      volumes = [
+        "immich_db_data:/var/lib/postgresql/data:rw"
+      ];
+      cmd = [ "postgres" "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=database"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_redis" = {
+      image = "registry.hub.docker.com/library/redis:6.2-alpine";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=redis"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_server" = {
+      image = "ghcr.io/immich-app/immich-server:${immich_version}";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      volumes = [
+        "/etc/localtime:/etc/localtime:ro"
+        "${immich_data_dir}:/usr/src/app/upload:rw"
+        "${storage_dir}:${storage_dir}:ro"
+      ];
+      ports = [
+        "2283:2283/tcp"
+      ];
+      dependsOn = [
+        "immich_postgres"
+        "immich_redis"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=immich-server"
+        "--network=immich_default"
+      ];
+    };
+  };
+
+  systemd.services = (containerServices [
+    { name = "machine_learning"; volumes = [ "model_cache" ]; }
+    { name = "postgres"; volumes = [ "db_data" ]; }
+    { name = "redis"; }
+    { name = "server"; }
+  ]) // {
+    # Networks
+    "podman-network-immich_default" = {
+      path = [ pkgs.podman ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStop = "${pkgs.podman}/bin/podman network rm -f immich_default";
+      };
+      script = ''
+        podman network inspect immich_default || podman network create immich_default
+      '';
+      partOf = [ "podman-compose-immich-root.target" ];
+      wantedBy = [ "podman-compose-immich-root.target" ];
+    };
+  } // (volumeServices [
+    "db_data"
+    "model_cache"
+  ]);
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-immich-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  services.caddy.virtualHosts = {
+    "img.freun.dev".extraConfig = ''
+      reverse_proxy localhost:2283
+    '';
+  };
+
+  fileSystems."${immich_data_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/immich";
+    fsType = "cifs";
+    options =
+      let
+        # this line prevents hanging on network split
+        automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+
+      in
+      [ "${automount_opts},credentials=/var/secrets/smb-storage" ];
+  };
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

hosts/freun.dev/invidious.nix

@@ -0,0 +1,25 @@
+{ ... }:
+let
+  fqdn = "vid.freun.dev";
+in
+{
+  services.invidious = {
+    enable = true;
+    domain = fqdn;
+
+    settings = {
+      external_port = 443;
+      db = {
+        dbname = "invidious";
+        user = "invidious";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:3000
+    '';
+  };
+
+}

hosts/freun.dev/owncast.nix

@@ -0,0 +1,16 @@
+{ ... }:
+let
+  fqdn = "stream.freun.dev";
+in 
+{
+  services.owncast = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:8080
+    '';
+  };
+}

hosts/freun.dev/services.nix

@@ -0,0 +1,45 @@
+{ pkgs, ... }:
+{
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.caddy = {
+    enable = true;
+    enableReload = true;
+    email = "admin@pimeys.pm";
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_17;
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      # Required for container networking to be able to use names.
+      dns_enabled = true;
+    };
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  networking.firewall = {
+    trustedInterfaces = [ "podman1" ];
+    interfaces.podman1.allowedUDPPorts = [ 53 ];
+  };
+
+  imports = [
+    ./vaultwarden.nix
+    ./immich.nix
+    ./syncthing.nix
+    ./invidious.nix
+    ./grafana.nix
+    ./gtrackmap.nix
+    ./owncast.nix
+    ./tailscale.nix
+    ./workout-tracker.nix
+    ./gotosocial.nix
+  ];
+}

hosts/freun.dev/syncthing.nix

@@ -0,0 +1,33 @@
+{ pkgs, config, lib, ... }:
+let
+  storage_dir = "/mnt/storage/syncthing";
+in
+{
+  services.syncthing = {
+    enable = true;
+    dataDir = "/mnt/storage/syncthing";
+    openDefaultPorts = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "sync.freun.dev".extraConfig = ''
+      reverse_proxy localhost:8384 {
+        header_up Host {upstream_hostport}
+      }
+    '';
+  };
+
+  fileSystems."${storage_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/syncthing";
+    fsType = "cifs";
+    options = let
+      # this line prevents hanging on network split
+      automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+      uid = builtins.toString config.users.users.syncthing.uid;
+      gid = builtins.toString config.users.groups.syncthing.gid;
+    in ["${automount_opts},credentials=/var/secrets/smb-storage,uid=${uid},gid=${gid}"];
+  };
+
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

hosts/freun.dev/tailscale.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "server";
+  };
+}

hosts/freun.dev/vaultwarden.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    environmentFile = "/var/secrets/vaultwarden.env";
+    config = {
+      DOMAIN = "https://pw.freun.dev";
+      DATABASE_URL = "postgres://%2Fvar%2Frun%2Fpostgresql/vaultwarden";
+      WEBSOCKET_ENABLED = true;
+      WEBSOCKET_ADDRESS = "127.0.0.1";
+      WEBSOCKET_PORT = 3012;
+      SIGNUPS_VERIFY = true;
+      PASSWORD_ITERATIONS = 600000;
+      YUBICO_CLIENT_ID = 86799;
+      SMTP_HOST = "horologium.uberspace.de";
+      SMTP_FROM = "noreply@freun.dev";
+      SMTP_FROM_NAME = "Vaultwarden";
+      SMTP_USERNAME = "noreply@freun.dev";
+      SMTP_PORT = 587;
+      HELO_NAME = "freun.dev";
+      ROCKET_LIMITS = "{json=10485760}";
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "pw.freun.dev".extraConfig = ''
+      reverse_proxy /notifications/hub localhost:3012
+      reverse_proxy localhost:8000 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "vaultwarden" ];
+    ensureUsers = [{
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+    }];
+  };
+}

hosts/freun.dev/workout-tracker.nix

@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+let
+  fqdn = "fit.freun.dev";
+  port = 3322;
+  version = "2.0.3";
+in
+{
+  services.workout-tracker = {
+    enable = true;
+    inherit port;
+    package = pkgs.stdenv.mkDerivation {
+      name = "workout-tracker";
+      src = pkgs.fetchurl {
+        url = "https://github.com/jovandeginste/workout-tracker/releases/download/v${version}/workout-tracker-v${version}-linux-amd64.tar.gz";
+        hash = "sha256-kcchO+7HQwmpYRXqrTtyHWDqy7DkKugO+PJRucboycE=";
+      };
+      nativeBuildInputs = [
+        pkgs.autoPatchelfHook
+      ];
+      sourceRoot = ".";
+      installPhase = ''
+        runHook preInstall
+        install -m755 -D workout-tracker $out/bin/workout-tracker
+        runHook postInstall
+      '';
+      meta = with pkgs.lib; {
+        description = "A simple workout tracker";
+        license = licenses.mit;
+        mainProgram = "workout-tracker";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString port}
+    '';
+  };
+}

hosts/radish/boot.nix

@@ -0,0 +1,31 @@
+{ lib, pkgs, ... }:
+{
+  boot = {
+    loader.systemd-boot.enable = lib.mkForce false;
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/etc/secureboot";
+      configurationLimit = 10;
+      settings = {
+        editor = false;
+      };
+    };
+    loader.efi.canTouchEfiVariables = true;
+    bootspec.enable = true;
+    kernelPackages = pkgs.linuxPackages_latest;
+    kernelParams = [
+      "amdgpu.sg_display=0"
+      "resume_offset=533760"
+    ];
+
+    resumeDevice = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+    tmp.useTmpfs = true;
+    kernel.sysctl = {
+      "vm.max_map_count" = 262144;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    efibootmgr
+  ];
+}

hosts/radish/configuration.nix

@@ -0,0 +1,39 @@
+{ ... }:
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+    };
+
+    gc = {
+      automatic = true;
+      dates = "daily";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  networking.extraHosts = ''
+    10.10.0.1 warden.apu.repomaa.com
+  '';
+
+  networking.nftables.enable = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "23.11"; # Did you read the comment?
+}

hosts/radish/containers.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  virtualisation.docker.storageDriver = "btrfs";
+  virtualisation.docker.rootless = {
+    enable = true;
+    setSocketVariable = true;
+  };
+}

hosts/radish/default.nix

@@ -0,0 +1,22 @@
+{ inputs, ... }:
+let
+  inherit (inputs) lanzaboote nixos-hardware auto-cpufreq home-manager;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./host.nix
+    ./boot.nix
+    ./hardware.nix
+    ./packages.nix
+    ./containers.nix
+    ./desktop.nix
+    ./users.nix
+    lanzaboote.nixosModules.lanzaboote
+    nixos-hardware.nixosModules.framework-13-7040-amd
+    auto-cpufreq.nixosModules.default
+    home-manager.nixosModules.home-manager
+    ../../home
+  ];
+}

hosts/radish/desktop.nix

@@ -0,0 +1,26 @@
+{ ... }:
+{
+  services.xserver = {
+    enable = true;
+    displayManager.gdm.enable = true;
+    desktopManager.gnome.enable = true;
+  };
+
+  services.printing.enable = true;
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+  };
+}

hosts/radish/hardware-configuration.nix

@@ -0,0 +1,64 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+      fsType = "btrfs";
+      options = [ "subvol=@" ];
+    };
+
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-uuid/43895585-8899-4e94-a413-889127c214f8";
+    allowDiscards = true;
+  };
+
+  fileSystems."/var/log" =
+    { device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+      fsType = "btrfs";
+      options = [ "subvol=@var_log" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/01E6-6258";
+      fsType = "vfat";
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  swapDevices = [ {
+    device = "/swap/swapfile";
+    size = 64*1024;
+  } ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/radish/hardware.nix

@@ -0,0 +1,87 @@
+{ pkgs, inputs, lib, config, ... }:
+{
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+
+  services.pcscd = {
+    enable = true;
+    plugins = [
+      pkgs.ccid
+    ];
+  };
+  services.udev.packages = [
+    pkgs.zsa-udev-rules
+    pkgs.yubikey-personalization
+    inputs.ksoloti-pr.legacyPackages.${pkgs.system}.ksoloti
+  ];
+  services.usbmuxd = {
+    enable = true;
+    package = pkgs.usbmuxd;
+  };
+  services.fwupd = {
+    enable = true;
+  };
+  services.fprintd.enable = true;
+  services.fstrim.enable = true;
+
+  security.pam.services.login.fprintAuth = false;
+  # similarly to how other distributions handle the fingerprinting login
+  security.pam.services.gdm-fingerprint = lib.mkIf (config.services.fprintd.enable) {
+    text = ''
+      auth       required                    pam_shells.so
+      auth       requisite                   pam_nologin.so
+      auth       requisite                   pam_faillock.so      preauth
+      auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
+      auth       optional                    pam_permit.so
+      auth       required                    pam_env.so
+      auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
+      auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
+
+      account    include                     login
+
+      password   required                    pam_deny.so
+
+      session    include                     login
+      session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
+    '';
+  };
+
+  hardware.keyboard.zsa.enable = true;
+
+  services.logind = {
+    lidSwitch = "suspend";
+    powerKey = "suspend";
+    extraConfig = ''
+      IdleAction=suspend
+    '';
+  };
+
+  powerManagement = {
+    enable = true;
+    powerDownCommands = "${pkgs.networkmanager}/bin/nmcli radio wifi off";
+    powerUpCommands = "${pkgs.networkmanager}/bin/nmcli radio wifi on";
+  };
+
+  services.power-profiles-daemon.enable = false;
+
+  services.tlp = {
+    enable = true;
+    settings = {
+      CPU_BOOST_ON_BAT = 0;
+      CPU_SCALING_GOVERNOR_ON_BATTERY = "powersave";
+      START_CHARGE_THRESH_BATx = 85;
+      STOP_CHARGE_THRES_BATx = 90;
+      RUNTIME_PM_ON_BAT = "auto";
+    };
+  };
+
+  programs.auto-cpufreq.enable = true;
+
+  hardware.amdgpu.opencl.enable = true;
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [ rocmPackages.clr.icd ];
+  };
+  networking.networkmanager.wifi.backend = "iwd";
+  security.tpm2.enable = true;
+}

hosts/radish/host.nix

@@ -0,0 +1,12 @@
+{ lib, ... }:
+{
+  networking.hostName = "radish";
+  time.timeZone = lib.mkForce null; # allow TZ to be set by desktop user
+  i18n.defaultLocale = "de_DE.UTF-8";
+  i18n.supportedLocales = map (locale: "${locale}.UTF-8/UTF-8") [ "C" "en_US" "de_DE" "fi_FI" ];
+  i18n.extraLocaleSettings.LANG = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+}

hosts/radish/packages.nix

@@ -0,0 +1,44 @@
+{ pkgs, lib, inputs, ... }:
+{
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.overlays = [ (import ../../custom-pkgs { inherit lib inputs; }) ];
+
+  environment = {
+    systemPackages = with pkgs; [
+      vim
+      wget
+      curl
+      htop
+      tmux
+      libimobiledevice
+      ripgrep
+      fd
+    ];
+
+    pathsToLink = [ "/share/zsh" ];
+  };
+
+  services = {
+    tailscale = {
+      enable = true;
+      useRoutingFeatures = "client";
+    };
+
+    ollama = {
+      enable = false; # FIXME: https://github.com/NixOS/nixpkgs/issues/376930
+      acceleration = "rocm";
+      environmentVariables = {
+        HSA_OVERRIDE_GFX_VERSION = "11.0.3";
+      };
+    };
+  };
+
+  programs = {
+    zsh.enable = true;
+    _1password-gui = {
+      enable = true;
+      polkitPolicyOwners = [ "moco" ];
+    };
+    _1password.enable = true;
+  };
+}

hosts/radish/users.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+{
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+  };
+
+  users.users.moco = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+    subUidRanges = [{ startUid = 10000; count = 65536; }];
+    subGidRanges = [{ startGid = 10000; count = 65536; }];
+  };
+}