refactor file structure

hosts/freun.dev/configuration.nix

@@ -0,0 +1,150 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, self, ... }:
+
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "sourcehut:~repomaa/NixOS";
+    flags = [
+      "--update-input"
+      "nixpkgs"
+      "-L" # print build logs
+    ];
+    dates = "02:00";
+    randomizedDelaySec = "45min";
+  };
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.efiSupport = false;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  networking.hostName = "freun-dev"; # Define your hostname.
+  networking.useDHCP = false;
+  networking.nftables.enable = true;
+
+  systemd.network = {
+    enable = true;
+    networks.static = {
+      name = "enp1s0";
+      address = [
+        "95.217.223.61/32"
+        "2a01:4f9:c012:5e97::1/64"
+      ];
+      routes = [
+        { Gateway = "fe80::1"; }
+        {
+          Gateway = "172.31.1.1";
+          GatewayOnLink = true;
+        }
+      ];
+      dns = [
+        # Hetzner
+        "185.12.64.1"
+        "185.12.64.2"
+        "2a01:4ff:ff00::add:1"
+        "2a01:4ff:ff00::add:2"
+        # Quad9
+        "9.9.9.9"
+        "149.112.112.112"
+        "2620:fe::fe"
+        "2620:fe::9"
+      ];
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Helsinki";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkbOptions in tty.
+  # };
+
+
+  # Configure keymap in X11
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    # packages = with pkgs; [
+    #   firefox
+    #   tree
+    # ];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4="
+    ];
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    htop
+    git
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}

hosts/freun.dev/default.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+let
+  inherit (inputs) gtrackmap;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./services.nix
+    gtrackmap.nixosModules.x86_64-linux.default
+  ];
+}

hosts/freun.dev/gotosocial.nix

@@ -0,0 +1,42 @@
+{ config, ... }:
+let
+  fqdn = "social.freun.dev";
+  port = 3500;
+in
+{
+  services.gotosocial = {
+    enable = true;
+    environmentFile = "/var/secrets/gotosocial.env";
+    settings = {
+      host = "social.freun.dev";
+      account-domain = "freun.dev";
+      protocol = "https";
+      bind-address = "localhost";
+      instance-languages = [ "de" "fi" "en" ];
+      instance-inject-mastodon-version = true;
+      accounts-registration-open = true;
+      instance-expose-public-timeline = true;
+      letsencrypt-enabled = false;
+      smtp-host = "horologium.uberspace.de";
+      smtp-port = 587;
+      smtp-username = "noreply@freun.dev";
+      smtp-from = "noreply@freun.dev";
+      inherit port;
+    };
+    setupPostgresqlDB = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "freun.dev".extraConfig = ''
+      redir /.well-known/host-meta* https://${fqdn}{uri} permanent
+      redir /.well-known/webfinger* https://${fqdn}{uri} permanent
+      redir /.well-known/nodeinfo* https://${fqdn}{uri} permanent
+    '';
+
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString config.services.gotosocial.settings.port} {
+        flush_interval -1
+      }
+    '';
+  };
+}

hosts/freun.dev/grafana.nix

@@ -0,0 +1,60 @@
+{ ... }:
+let
+  fqdn = "graph.freun.dev";
+  port = 3300;
+in
+{
+  services.grafana = {
+    enable = true;
+
+    settings = {
+      server = {
+      	root_url = "https://${fqdn}";
+        http_port = port;
+      };
+
+      database = {
+        host = "/var/run/postgresql";
+        type = "postgres";
+        user = "grafana";
+      };
+
+      smtp = {
+        enabled = true;
+        host = "horologium.uberspace.de";
+        from_address = "noreply@freun.dev";
+        from_name = "Vaultwarden";
+        user = "noreply@freun.dev";
+        password = "$__file{/var/secrets/smtp-password}";
+      };
+    };
+  };
+
+  services.prometheus = {
+    enable = true;
+    exporters.node.enable = true;
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = [
+          { targets = [ "localhost:9100" ]; }
+        ];
+      }
+    ];
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${builtins.toString port}
+    '';
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [{
+      name = "grafana";
+      ensureDBOwnership = true;
+    }];
+  };
+}
+

hosts/freun.dev/gtrackmap.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+let
+  fqdn = "trackmap.freun.dev";
+in
+{
+  services.gtrackmap = {
+    enable = true;
+    port = 3200;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString config.services.gtrackmap.port}
+    '';
+  };
+}

hosts/freun.dev/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8456c7de-2116-4cbe-8deb-76cafbd3e6dd";
+      fsType = "btrfs";
+      options = [ "subvol=@" ];
+    };
+
+  fileSystems."/var" =
+    { device = "/dev/disk/by-uuid/8456c7de-2116-4cbe-8deb-76cafbd3e6dd";
+      fsType = "btrfs";
+      options = [ "subvol=@var" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/614a1b7f-04aa-478c-9011-8b81f133da98"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/freun.dev/hydra.nix

@@ -0,0 +1,21 @@
+{ ... }:
+let
+  fqdn = "ci.freun.dev";
+  port = 3400;
+in
+{
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://${fqdn}";
+    notificationSender = "Hydra <noreply@freun.dev>";
+    buildMachinesFiles = [];
+    useSubstitutes = true;
+    inherit port;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${builtins.toString port}
+    '';
+  };
+}

hosts/freun.dev/immich.nix

@@ -0,0 +1,186 @@
+{ pkgs, lib, ... }:
+
+let
+  immich_version = "v1.125.2";
+  storage_dir = "/mnt/storage/syncthing";
+  immich_data_dir = "/mnt/storage/immich";
+
+  volumeServices = names: (
+    lib.lists.foldl
+      (services: name:
+        services // {
+          "podman-volume-immich_${name}" = {
+            path = [ pkgs.podman ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+            script = ''
+              podman volume inspect immich_${name} || podman volume create immich_${name}
+            '';
+            partOf = [ "podman-compose-immich-root.target" ];
+            wantedBy = [ "podman-compose-immich-root.target" ];
+          };
+        }
+      )
+      { }
+      names
+  );
+
+  containerServices = services: (
+    lib.lists.foldl
+      (acc: { name, volumes ? [ ], ... }:
+        let
+          volume_services = map (volume: "podman-volume-immich_${volume}.service") volumes;
+          dependent_services = [ "podman-network-immich_default.service" ] ++ volume_services;
+        in
+
+        acc // {
+          "podman-immich_${name}" = {
+            serviceConfig = {
+              Restart = lib.mkOverride 500 "always";
+            };
+            after = dependent_services;
+            requires = dependent_services;
+            partOf = [
+              "podman-compose-immich-root.target"
+            ];
+            wantedBy = [
+              "podman-compose-immich-root.target"
+            ];
+          };
+        }
+      )
+      { }
+      services
+  );
+in
+{
+  # Containers
+  virtualisation.oci-containers.containers = {
+    "immich_machine_learning" = {
+      image = "ghcr.io/immich-app/immich-machine-learning:${immich_version}";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      volumes = [
+        "immich_model_cache:/cache:rw"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=immich-machine-learning"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_postgres" = {
+      image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      environment = {
+        POSTGRES_INITDB_ARGS = "--data-checksums";
+      };
+      volumes = [
+        "immich_db_data:/var/lib/postgresql/data:rw"
+      ];
+      cmd = [ "postgres" "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=database"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_redis" = {
+      image = "registry.hub.docker.com/library/redis:6.2-alpine";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=redis"
+        "--network=immich_default"
+      ];
+    };
+
+    "immich_server" = {
+      image = "ghcr.io/immich-app/immich-server:${immich_version}";
+      environmentFiles = [
+        "/var/secrets/immich.env"
+      ];
+      volumes = [
+        "/etc/localtime:/etc/localtime:ro"
+        "${immich_data_dir}:/usr/src/app/upload:rw"
+        "${storage_dir}:${storage_dir}:ro"
+      ];
+      ports = [
+        "2283:2283/tcp"
+      ];
+      dependsOn = [
+        "immich_postgres"
+        "immich_redis"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=immich-server"
+        "--network=immich_default"
+      ];
+    };
+  };
+
+  systemd.services = (containerServices [
+    { name = "machine_learning"; volumes = [ "model_cache" ]; }
+    { name = "postgres"; volumes = [ "db_data" ]; }
+    { name = "redis"; }
+    { name = "server"; }
+  ]) // {
+    # Networks
+    "podman-network-immich_default" = {
+      path = [ pkgs.podman ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStop = "${pkgs.podman}/bin/podman network rm -f immich_default";
+      };
+      script = ''
+        podman network inspect immich_default || podman network create immich_default
+      '';
+      partOf = [ "podman-compose-immich-root.target" ];
+      wantedBy = [ "podman-compose-immich-root.target" ];
+    };
+  } // (volumeServices [
+    "db_data"
+    "model_cache"
+  ]);
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-immich-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  services.caddy.virtualHosts = {
+    "img.freun.dev".extraConfig = ''
+      reverse_proxy localhost:2283
+    '';
+  };
+
+  fileSystems."${immich_data_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/immich";
+    fsType = "cifs";
+    options =
+      let
+        # this line prevents hanging on network split
+        automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+
+      in
+      [ "${automount_opts},credentials=/var/secrets/smb-storage" ];
+  };
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

hosts/freun.dev/invidious.nix

@@ -0,0 +1,25 @@
+{ ... }:
+let
+  fqdn = "vid.freun.dev";
+in
+{
+  services.invidious = {
+    enable = true;
+    domain = fqdn;
+
+    settings = {
+      external_port = 443;
+      db = {
+        dbname = "invidious";
+        user = "invidious";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:3000
+    '';
+  };
+
+}

hosts/freun.dev/owncast.nix

@@ -0,0 +1,16 @@
+{ ... }:
+let
+  fqdn = "stream.freun.dev";
+in 
+{
+  services.owncast = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:8080
+    '';
+  };
+}

hosts/freun.dev/services.nix

@@ -0,0 +1,45 @@
+{ pkgs, ... }:
+{
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.caddy = {
+    enable = true;
+    enableReload = true;
+    email = "admin@pimeys.pm";
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_17;
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      # Required for container networking to be able to use names.
+      dns_enabled = true;
+    };
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  networking.firewall = {
+    trustedInterfaces = [ "podman1" ];
+    interfaces.podman1.allowedUDPPorts = [ 53 ];
+  };
+
+  imports = [
+    ./vaultwarden.nix
+    ./immich.nix
+    ./syncthing.nix
+    ./invidious.nix
+    ./grafana.nix
+    ./gtrackmap.nix
+    ./owncast.nix
+    ./tailscale.nix
+    ./workout-tracker.nix
+    ./gotosocial.nix
+  ];
+}

hosts/freun.dev/syncthing.nix

@@ -0,0 +1,33 @@
+{ pkgs, config, lib, ... }:
+let
+  storage_dir = "/mnt/storage/syncthing";
+in
+{
+  services.syncthing = {
+    enable = true;
+    dataDir = "/mnt/storage/syncthing";
+    openDefaultPorts = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "sync.freun.dev".extraConfig = ''
+      reverse_proxy localhost:8384 {
+        header_up Host {upstream_hostport}
+      }
+    '';
+  };
+
+  fileSystems."${storage_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/syncthing";
+    fsType = "cifs";
+    options = let
+      # this line prevents hanging on network split
+      automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+      uid = builtins.toString config.users.users.syncthing.uid;
+      gid = builtins.toString config.users.groups.syncthing.gid;
+    in ["${automount_opts},credentials=/var/secrets/smb-storage,uid=${uid},gid=${gid}"];
+  };
+
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

hosts/freun.dev/tailscale.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "server";
+  };
+}

hosts/freun.dev/vaultwarden.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    environmentFile = "/var/secrets/vaultwarden.env";
+    config = {
+      DOMAIN = "https://pw.freun.dev";
+      DATABASE_URL = "postgres://%2Fvar%2Frun%2Fpostgresql/vaultwarden";
+      WEBSOCKET_ENABLED = true;
+      WEBSOCKET_ADDRESS = "127.0.0.1";
+      WEBSOCKET_PORT = 3012;
+      SIGNUPS_VERIFY = true;
+      PASSWORD_ITERATIONS = 600000;
+      YUBICO_CLIENT_ID = 86799;
+      SMTP_HOST = "horologium.uberspace.de";
+      SMTP_FROM = "noreply@freun.dev";
+      SMTP_FROM_NAME = "Vaultwarden";
+      SMTP_USERNAME = "noreply@freun.dev";
+      SMTP_PORT = 587;
+      HELO_NAME = "freun.dev";
+      ROCKET_LIMITS = "{json=10485760}";
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "pw.freun.dev".extraConfig = ''
+      reverse_proxy /notifications/hub localhost:3012
+      reverse_proxy localhost:8000 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "vaultwarden" ];
+    ensureUsers = [{
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+    }];
+  };
+}

hosts/freun.dev/workout-tracker.nix

@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+let
+  fqdn = "fit.freun.dev";
+  port = 3322;
+  version = "2.0.3";
+in
+{
+  services.workout-tracker = {
+    enable = true;
+    inherit port;
+    package = pkgs.stdenv.mkDerivation {
+      name = "workout-tracker";
+      src = pkgs.fetchurl {
+        url = "https://github.com/jovandeginste/workout-tracker/releases/download/v${version}/workout-tracker-v${version}-linux-amd64.tar.gz";
+        hash = "sha256-kcchO+7HQwmpYRXqrTtyHWDqy7DkKugO+PJRucboycE=";
+      };
+      nativeBuildInputs = [
+        pkgs.autoPatchelfHook
+      ];
+      sourceRoot = ".";
+      installPhase = ''
+        runHook preInstall
+        install -m755 -D workout-tracker $out/bin/workout-tracker
+        runHook postInstall
+      '';
+      meta = with pkgs.lib; {
+        description = "A simple workout tracker";
+        license = licenses.mit;
+        mainProgram = "workout-tracker";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString port}
+    '';
+  };
+}