refactor: ponytail audit

modules/capabilities/services/actual.nix

@@ -1,21 +1,17 @@
 { config, ... }:
-let
-  service = config.facts.services.actual;
-  nixosModules = config.flake.modules.nixos;
-in
 {
   flake.modules.nixos.actual = {
-    imports = [ nixosModules.caddy ];
+    imports = [ config.flake.modules.nixos.caddy ];
 
     services.actual = {
       enable = true;
-      openFirewall = false;
       settings = {
         hostname = "127.0.0.1";
         port = 3000;
       };
     };
 
-    services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:3000";
+    services.caddy.virtualHosts.${config.facts.services.actual.domain}.extraConfig =
+      "reverse_proxy 127.0.0.1:3000";
   };
 }

modules/capabilities/services/gitea.nix

@@ -19,9 +19,6 @@ in
           ROOT_URL = "${service.origin}/";
           HTTP_PORT = 3001;
           HTTP_ADDR = "127.0.0.1";
-
-          START_SSH_SERVER = false;
-          SSH_PORT = 22;
         };
 
         service.DISABLE_REGISTRATION = true;

modules/capabilities/services/openssh.nix

@@ -1,11 +1,9 @@
 { config, lib, ... }:
 let
   account = config.facts.account;
-  personalPublicKeys =
-    machines:
-    map (machine: machine.sshKeys.personal.publicKey) (
-      lib.filter (machine: machine.sshKeys ? personal) (builtins.attrValues machines)
-    );
+  personalPublicKeys = map (machine: machine.sshKeys.personal.publicKey) (
+    lib.filter (machine: machine.sshKeys ? personal) (builtins.attrValues config.facts.machines)
+  );
 in
 {
   flake.modules.nixos.sudo-ssh-agent-auth = {
@@ -15,18 +13,16 @@ in
     };
   };
 
-  flake.modules.nixos.openssh =
-    { ... }:
-    {
-      services.openssh = {
-        enable = true;
-        settings = {
-          PermitRootLogin = "no";
-          PasswordAuthentication = false;
-          AllowUsers = [ account.name ];
-        };
+  flake.modules.nixos.openssh = {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        AllowUsers = [ account.name ];
       };
-
-      users.users.${account.name}.openssh.authorizedKeys.keys = personalPublicKeys config.facts.machines;
     };
+
+    users.users.${account.name}.openssh.authorizedKeys.keys = personalPublicKeys;
+  };
 }

modules/capabilities/services/radicale.nix

@@ -1,11 +1,7 @@
 { config, ... }:
-let
-  service = config.facts.services.radicale;
-  nixosModules = config.flake.modules.nixos;
-in
 {
   flake.modules.nixos.radicale = {
-    imports = [ nixosModules.caddy ];
+    imports = [ config.flake.modules.nixos.caddy ];
 
     services.radicale = {
       enable = true;
@@ -17,15 +13,12 @@ in
           htpasswd_filename = "/var/lib/radicale/users";
           htpasswd_encryption = "bcrypt";
         };
-
-        storage.filesystem_folder = "/var/lib/radicale/collections";
       };
     };
 
-    services.caddy.virtualHosts.${service.domain}.extraConfig = ''
+    services.caddy.virtualHosts.${config.facts.services.radicale.domain}.extraConfig = ''
       reverse_proxy 127.0.0.1:5232 {
         header_up X-Script-Name /
-        header_up X-Forwarded-For {remote}
         header_up X-Remote-User {http.auth.user.id}
       }
     '';

modules/capabilities/services/vaultwarden.nix

@@ -1,11 +1,10 @@
 { config, ... }:
 let
   service = config.facts.services.vaultwarden;
-  nixosModules = config.flake.modules.nixos;
 in
 {
   flake.modules.nixos.vaultwarden = {
-    imports = [ nixosModules.caddy ];
+    imports = [ config.flake.modules.nixos.caddy ];
 
     services.vaultwarden = {
       enable = true;

modules/capabilities/services/vps-insights.nix

@@ -1,222 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.vps-insights =
-    {
-      config,
-      lib,
-      pkgs,
-      ...
-    }:
-    let
-      localAddress = "127.0.0.1";
-      grafanaDataDir = config.services.grafana.dataDir;
-      lokiDataDir = config.services.loki.dataDir;
-      lokiUrl = "http://${localAddress}:3100";
-      prometheusUrl = "http://${localAddress}:9090";
-      hasCaddy = config.services.caddy.enable;
-      hasOpenSSH = config.services.openssh.enable;
-    in
-    {
-      environment = {
-        etc."alloy/config.alloy".text = ''
-          loki.relabel "journal" {
-            forward_to = []
-
-            rule {
-              source_labels = ["__journal__systemd_unit"]
-              target_label  = "unit"
-            }
-
-            rule {
-              source_labels = ["__journal_syslog_identifier"]
-              target_label  = "syslog_identifier"
-            }
-
-            rule {
-              source_labels = ["__journal_priority_keyword"]
-              target_label  = "level"
-            }
-          }
-
-          loki.source.journal "system" {
-            forward_to    = [loki.write.local.receiver]
-            relabel_rules = loki.relabel.journal.rules
-            max_age       = "24h"
-            labels        = {
-              host = "${config.networking.hostName}",
-            }
-          }
-
-          loki.write "local" {
-            endpoint {
-              url = "${lokiUrl}/loki/api/v1/push"
-            }
-          }
-        '';
-
-        systemPackages = with pkgs; [
-          goaccess
-          lynis
-        ];
-      };
-
-      services = {
-        # Keep local system logs available for Loki and manual inspection.
-        journald.extraConfig = ''
-          Storage=persistent
-          SystemMaxUse=1G
-          MaxRetentionSec=30day
-        '';
-
-        # Detect and block common attacks against SSH and Caddy.
-        crowdsec = {
-          enable = true;
-          hub.collections = [ "crowdsecurity/linux" ] ++ lib.optional hasCaddy "crowdsecurity/caddy";
-          localConfig.acquisitions =
-            lib.optional hasOpenSSH {
-              source = "journalctl";
-              journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
-              labels.type = "syslog";
-            }
-            ++ lib.optional hasCaddy {
-              filenames = [ "/var/log/caddy/*.log" ];
-              labels.type = "caddy";
-            };
-        };
-
-        crowdsec-firewall-bouncer = {
-          enable = true;
-          registerBouncer.bouncerName = "${config.networking.hostName}-firewall-bouncer";
-        };
-
-        # Keep Grafana local and separate from Actual's port.
-        grafana = {
-          enable = true;
-          settings = {
-            analytics.reporting_enabled = false;
-            server = {
-              http_addr = localAddress;
-              http_port = 3002;
-            };
-            security = {
-              admin_password = "$__file{${grafanaDataDir}/admin-password}";
-              secret_key = "$__file{${grafanaDataDir}/secret-key}";
-            };
-          };
-          provision.datasources.settings = {
-            prune = true;
-            datasources = [
-              {
-                name = "Prometheus";
-                type = "prometheus";
-                uid = "prometheus";
-                url = prometheusUrl;
-                isDefault = true;
-              }
-              {
-                name = "Loki";
-                type = "loki";
-                uid = "loki";
-                url = lokiUrl;
-              }
-            ];
-          };
-        };
-
-        # Store local logs in Loki and feed them from journald through Alloy.
-        loki = {
-          enable = true;
-          configuration = {
-            analytics.reporting_enabled = false;
-            auth_enabled = false;
-
-            server = {
-              http_listen_address = localAddress;
-              http_listen_port = 3100;
-              grpc_listen_address = localAddress;
-              grpc_listen_port = 9096;
-            };
-
-            common = {
-              path_prefix = lokiDataDir;
-              replication_factor = 1;
-              instance_interface_names = [ "lo" ];
-              ring = {
-                instance_addr = localAddress;
-                kvstore.store = "inmemory";
-              };
-            };
-
-            schema_config.configs = [
-              {
-                from = "2025-01-01";
-                store = "tsdb";
-                object_store = "filesystem";
-                schema = "v13";
-                index = {
-                  prefix = "index_";
-                  period = "24h";
-                };
-              }
-            ];
-
-            storage_config.filesystem.directory = "${lokiDataDir}/chunks";
-
-            compactor = {
-              working_directory = "${lokiDataDir}/compactor";
-              retention_enabled = true;
-              delete_request_store = "filesystem";
-            };
-
-            limits_config.retention_period = "720h";
-          };
-        };
-
-        alloy = {
-          enable = true;
-          extraFlags = [ "--server.http.listen-addr=${localAddress}:12345" ];
-        };
-
-        # Collect basic VPS health metrics for Grafana.
-        prometheus = {
-          enable = true;
-          listenAddress = localAddress;
-          retentionTime = "30d";
-          scrapeConfigs = [
-            {
-              job_name = "prometheus";
-              static_configs = [
-                {
-                  targets = [ "${localAddress}:9090" ];
-                }
-              ];
-            }
-            {
-              job_name = "node";
-              static_configs = [
-                {
-                  targets = [ "${localAddress}:9100" ];
-                }
-              ];
-            }
-          ];
-          exporters.node = {
-            enable = true;
-            listenAddress = localAddress;
-          };
-        };
-      };
-
-      systemd.services.grafana.preStart = ''
-        umask 077
-
-        if [ ! -s ${grafanaDataDir}/admin-password ]; then
-          ${pkgs.openssl}/bin/openssl rand -base64 32 > ${grafanaDataDir}/admin-password
-        fi
-
-        if [ ! -s ${grafanaDataDir}/secret-key ]; then
-          ${pkgs.openssl}/bin/openssl rand -hex 32 > ${grafanaDataDir}/secret-key
-        fi
-      '';
-    };
-}