kiri/lux
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor

Browse Source
This commit is contained in:
kiri committed 2026-08-22 16:55:00 +02:00
1 parent 81e576a877
commit cde67e4d75
46 files changed
+619 -518
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

modules/capabilities/services/actual.nix
+6 -4
View File
@@ -1,19 +1,21 @@
{ config, ... }:
let
service = config.facts.services.actual;
nixosModules = config.flake.modules.nixos;
in
{
flake.modules.nixos.actual = {
imports = [ nixosModules.caddy ];
services.actual = {
enable = true;
openFirewall = false;
settings = {
inherit (service) port;
hostname = service.host;
hostname = "127.0.0.1";
port = 3000;
};
};
services.caddy.virtualHosts.${service.domain}.extraConfig =
"reverse_proxy :${toString service.port}";
services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:3000";
};
}
modules/capabilities/services/caddy.nix
+1 -1
View File
@@ -6,7 +6,7 @@ in
flake.modules.nixos.caddy = {
services.caddy = {
enable = true;
email = facts.account.primaryEmail.address;
email = facts.account.emails.${facts.account.primaryEmail}.address;
openFirewall = true;
};
};
modules/capabilities/services/gitea.nix
+10 -5
View File
@@ -1,18 +1,24 @@
{ config, ... }:
let
service = config.facts.services.gitea;
nixosModules = config.flake.modules.nixos;
in
{
flake.modules.nixos.gitea = {
imports = [
nixosModules.caddy
nixosModules.openssh
];
services.gitea = {
enable = true;
settings = {
server = {
DOMAIN = service.domain;
ROOT_URL = service.url;
HTTP_PORT = service.port;
HTTP_ADDR = service.host;
ROOT_URL = "${service.origin}/";
HTTP_PORT = 3001;
HTTP_ADDR = "127.0.0.1";
START_SSH_SERVER = false;
SSH_PORT = 22;
@@ -24,7 +30,6 @@ in
services.openssh.settings.AllowUsers = [ "gitea" ];
services.caddy.virtualHosts.${service.domain}.extraConfig =
"reverse_proxy :${toString service.port}";
services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:3001";
};
}
modules/capabilities/services/openssh.nix
+2 -2
View File
@@ -3,8 +3,8 @@ let
account = config.facts.account;
personalPublicKeys =
machines:
map (machine: (machine.sshKeys or { }).personal.publicKey) (
lib.filter (machine: (machine.sshKeys or { }) ? personal) (builtins.attrValues machines)
map (machine: machine.sshKeys.personal.publicKey) (
lib.filter (machine: machine.sshKeys ? personal) (builtins.attrValues machines)
);
in
{
modules/capabilities/services/radicale.nix
+5 -2
View File
@@ -1,13 +1,16 @@
{ config, ... }:
let
service = config.facts.services.radicale;
nixosModules = config.flake.modules.nixos;
in
{
flake.modules.nixos.radicale = {
imports = [ nixosModules.caddy ];
services.radicale = {
enable = true;
settings = {
server.hosts = [ "${service.host}:${toString service.port}" ];
server.hosts = [ "127.0.0.1:5232" ];
auth = {
type = "htpasswd";
@@ -20,7 +23,7 @@ in
};
services.caddy.virtualHosts.${service.domain}.extraConfig = ''
reverse_proxy :${toString service.port} {
reverse_proxy 127.0.0.1:5232 {
header_up X-Script-Name /
header_up X-Forwarded-For {remote}
header_up X-Remote-User {http.auth.user.id}
modules/capabilities/services/vaultwarden.nix
+7 -4
View File
@@ -1,21 +1,24 @@
{ config, ... }:
let
service = config.facts.services.vaultwarden;
nixosModules = config.flake.modules.nixos;
in
{
flake.modules.nixos.vaultwarden = {
imports = [ nixosModules.caddy ];
services.vaultwarden = {
enable = true;
backupDir = "/var/backup/vaultwarden";
config = {
DOMAIN = service.url;
DOMAIN = service.origin;
SIGNUPS_ALLOWED = false;
ROCKET_PORT = service.port;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8100;
ROCKET_LOG = "critical";
};
};
services.caddy.virtualHosts.${service.domain}.extraConfig =
"reverse_proxy :${toString service.port}";
services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:8100";
};
}
modules/capabilities/services/vps-insights.nix
+18 -11
View File
@@ -1,13 +1,20 @@
{ ... }:
{
flake.modules.nixos.vps-insights =
{ config, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
localAddress = "127.0.0.1";
grafanaDataDir = config.services.grafana.dataDir;
lokiDataDir = config.services.loki.dataDir;
lokiUrl = "http://${localAddress}:3100";
prometheusUrl = "http://${localAddress}:9090";
hasCaddy = config.services.caddy.enable;
hasOpenSSH = config.services.openssh.enable;
in
{
environment = {
@@ -64,21 +71,17 @@
# Detect and block common attacks against SSH and Caddy.
crowdsec = {
enable = true;
hub.collections = [
"crowdsecurity/linux"
"crowdsecurity/caddy"
];
localConfig.acquisitions = [
{
hub.collections = [ "crowdsecurity/linux" ] ++ lib.optional hasCaddy "crowdsecurity/caddy";
localConfig.acquisitions =
lib.optional hasOpenSSH {
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
++ lib.optional hasCaddy {
filenames = [ "/var/log/caddy/*.log" ];
labels.type = "caddy";
}
];
};
};
crowdsec-firewall-bouncer = {
@@ -86,11 +89,15 @@
registerBouncer.bouncerName = "${config.networking.hostName}-firewall-bouncer";
};
# Grafana defaults to 127.0.0.1:3000; add secrets and datasources only.
# Keep Grafana local and separate from Actual's port.
grafana = {
enable = true;
settings = {
analytics.reporting_enabled = false;
server = {
http_addr = localAddress;
http_port = 3002;
};
security = {
admin_password = "$__file{${grafanaDataDir}/admin-password}";
secret_key = "$__file{${grafanaDataDir}/secret-key}";