refactor immich

modules/services/grafana.nix

@@ -0,0 +1,60 @@
+{ ... }:
+let
+  fqdn = "graph.freun.dev";
+  port = 3300;
+in
+{
+  services.grafana = {
+    enable = true;
+
+    settings = {
+      server = {
+      	root_url = "https://${fqdn}";
+        http_port = port;
+      };
+
+      database = {
+        host = "/var/run/postgresql";
+        type = "postgres";
+        user = "grafana";
+      };
+
+      smtp = {
+        enabled = true;
+        host = "horologium.uberspace.de";
+        from_address = "noreply@freun.dev";
+        from_name = "Vaultwarden";
+        user = "noreply@freun.dev";
+        password = "$__file{/var/secrets/smtp-password}";
+      };
+    };
+  };
+
+  services.prometheus = {
+    enable = true;
+    exporters.node.enable = true;
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = [
+          { targets = [ "localhost:9100" ]; }
+        ];
+      }
+    ];
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${builtins.toString port}
+    '';
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [{
+      name = "grafana";
+      ensureDBOwnership = true;
+    }];
+  };
+}
+

modules/services/gtrackmap.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+let
+  fqdn = "trackmap.freun.dev";
+in
+{
+  services.gtrackmap = {
+    enable = true;
+    port = 3200;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${toString config.services.gtrackmap.port}
+    '';
+  };
+}

modules/services/hydra.nix

@@ -0,0 +1,21 @@
+{ ... }:
+let
+  fqdn = "ci.freun.dev";
+  port = 3400;
+in
+{
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://${fqdn}";
+    notificationSender = "Hydra <noreply@freun.dev>";
+    buildMachinesFiles = [];
+    useSubstitutes = true;
+    inherit port;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:${builtins.toString port}
+    '';
+  };
+}

modules/services/immich.nix

@@ -0,0 +1,110 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.immich;
+in
+{
+  options.services.immich = with lib; {
+    enable = mkEnableOption "Enable immich";
+
+    fqdn = mkOption {
+      type = types.str;
+      description = "FQDN to use for the immich server";
+    };
+    data_dir = mkOption {
+      type = types.str;
+      description = "The directory to store immich data in";
+    };
+    secrets = mkOption {
+      type = types.str;
+      description = "Path to file with secrets";
+    };
+    version = mkOption {
+      type = types.str;
+      default = "release";
+      description = "The version (docker image tag) of immich to use";
+    };
+    mounts = mkOption {
+      type = types.listOf types.str;
+      description = "Additional mounts to add to the immich container";
+      default = [ ];
+    };
+    port = mkOption {
+      type = types.int;
+      default = 2283;
+      description = "Port to expose the immich server on";
+    };
+  };
+
+  imports = [
+    ../util/container-services.nix
+  ];
+
+  config = lib.mkIf cfg.enable rec {
+    container-services.immich = {
+      description = "Immich image server";
+      services = {
+        server = {
+          image = "ghcr.io/immich-app/immich-server:${cfg.version}";
+          environmentFiles = [
+            cfg.secrets
+          ];
+          volumes = [
+            "${cfg.data_dir}:/usr/src/app/upload:rw"
+            "/etc/localtime:/etc/localtime:ro"
+          ] ++ cfg.mounts;
+          ports = [ "${builtins.toString cfg.port}:3001/tcp" ];
+          dependsOn = [
+            container-services.immich.services.redis
+            container-services.immich.services.postgres
+          ];
+        };
+        machine_learning = {
+          image = "ghcr.io/immich-app/immich-machine-learning:${cfg.version}";
+          environmentFiles = [
+            cfg.secrets
+          ];
+          volumes = [
+            "model_cache:/cache:rw"
+          ];
+        };
+        redis = {
+          image = "registry.hub.docker.com/library/redis:6.2-alpine";
+          healthCheck.test = "redis-cli ping || exit 1";
+          environmentFiles = [
+            cfg.secrets
+          ];
+        };
+        postgres = {
+          image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
+          environmentFiles = [
+            cfg.secrets
+          ];
+          environment = {
+            POSTGRES_INITDB_ARGS = "--data-checksums";
+          };
+          volumes = [
+            "db_data:/var/lib/postgresql/data:rw"
+          ];
+          cmd = [ "postgres" "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
+          healthCheck = {
+            test = ''
+              pg_isready --dbname='$\{DB_DATABASE_NAME}' || exit 1
+              Chksum="$(psql --dbname='$\{DB_DATABASE_NAME}' --username='$\{DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"
+              echo "checksum failure count is $Chksum"
+              [ "$Chksum" = '0' ] || exit 1
+            '';
+            interval = "5m";
+            startInterval = "30s";
+            startPeriod = "5m";
+          };
+        };
+      };
+    };
+
+    services.caddy.virtualHosts = {
+      "${cfg.fqdn}".extraConfig = ''
+        reverse_proxy localhost:${builtins.toString cfg.port}
+      '';
+    };
+  };
+}

modules/services/invidious.nix

@@ -0,0 +1,25 @@
+{ ... }:
+let
+  fqdn = "vid.freun.dev";
+in
+{
+  services.invidious = {
+    enable = true;
+    domain = fqdn;
+
+    settings = {
+      external_port = 443;
+      db = {
+        dbname = "invidious";
+        user = "invidious";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:3000
+    '';
+  };
+
+}

modules/services/owncast.nix

@@ -0,0 +1,16 @@
+{ ... }:
+let
+  fqdn = "stream.freun.dev";
+in 
+{
+  services.owncast = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "${fqdn}".extraConfig = ''
+      reverse_proxy localhost:8080
+    '';
+  };
+}

modules/services/syncthing.nix

@@ -0,0 +1,33 @@
+{ pkgs, config, lib, ... }:
+let
+  storage_dir = "/mnt/storage/syncthing";
+in
+{
+  services.syncthing = {
+    enable = true;
+    dataDir = "/mnt/storage/syncthing";
+    openDefaultPorts = true;
+  };
+
+  services.caddy.virtualHosts = {
+    "sync.freun.dev".extraConfig = ''
+      reverse_proxy localhost:8384 {
+        header_up Host {upstream_hostport}
+      }
+    '';
+  };
+
+  fileSystems."${storage_dir}" = {
+    device = "//u407959.your-storagebox.de/backup/syncthing";
+    fsType = "cifs";
+    options = let
+      # this line prevents hanging on network split
+      automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+      uid = builtins.toString config.users.users.syncthing.uid;
+      gid = builtins.toString config.users.groups.syncthing.gid;
+    in ["${automount_opts},credentials=/var/secrets/smb-storage,uid=${uid},gid=${gid}"];
+  };
+
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

modules/services/vaultwarden.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    environmentFile = "/var/secrets/vaultwarden.env";
+    config = {
+      DOMAIN = "https://pw.freun.dev";
+      DATABASE_URL = "postgres://%2Fvar%2Frun%2Fpostgresql/vaultwarden";
+      WEBSOCKET_ENABLED = true;
+      WEBSOCKET_ADDRESS = "127.0.0.1";
+      WEBSOCKET_PORT = 3012;
+      SIGNUPS_VERIFY = true;
+      PASSWORD_ITERATIONS = 600000;
+      YUBICO_CLIENT_ID = 86799;
+      SMTP_HOST = "horologium.uberspace.de";
+      SMTP_FROM = "noreply@freun.dev";
+      SMTP_FROM_NAME = "Vaultwarden";
+      SMTP_USERNAME = "noreply@freun.dev";
+      SMTP_PORT = 587;
+      HELO_NAME = "freun.dev";
+      ROCKET_LIMITS = "{json=10485760}";
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "pw.freun.dev".extraConfig = ''
+      reverse_proxy /notifications/hub localhost:3012
+      reverse_proxy localhost:8000 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "vaultwarden" ];
+    ensureUsers = [{
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+    }];
+  };
+}

modules/services/wireguard.nix

@@ -0,0 +1,41 @@
+{ config, pkgs, lib, ...  }: 
+let
+  port = 51820;
+  name = "wg0";
+  peers = [
+    {
+      PublicKey = "XI0/k2j20CVSfevwjkmo4IddVoA2VY2fN6feauXYEXU=";
+      AllowedIPs = [ "10.100.0.2" ];
+    } # radish
+  ];
+  address = [ "10.100.0.1/24" ];
+in
+{
+  networking.firewall.allowedUDPPorts = [ port ];
+  networking.useNetworkd = true;
+
+  systemd.network = {
+    enable = true;
+    netdevs.${name} = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "${name}";
+        MTUBytes = "1300";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = "/var/secrets/wireguard-privkey";
+        ListenPort = port;
+      };
+      wireguardPeers = peers;
+    };
+
+    networks.${name} = {
+      matchConfig.Name = name;
+      inherit address;
+      networkConfig = {
+        IPMasquerade = "ipv4";
+        IPForward = true;
+      };
+    };
+  };
+}