remove unused links

lib/options.nix

@@ -4,6 +4,8 @@ let
   
   ext4 = path: { inherit path; type = "ext4"; };
   btrfs = path: { inherit path; type = "btrfs"; };
+  
+  selfSigned = service: { inherit service; originRequest.noTLSVerify = true; };
 in {
   flake-path = "~/Projects/nix-flake"; # set this to the cloned repo path
 
@@ -21,20 +23,19 @@ in {
   
   homelab = rec {
     domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
-    cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
     ssh-keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESvQFXoUBafatqnxTd6qk3WEOcfwb3AIWVTstR3lHzX forgejo"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
     ];
     disks = {
-      gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
+      # gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
-      data = ext4 "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
+      # data = ext4 "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
-      host = ext4 "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
+      # host = ext4 "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
       # ^^ virtual disks
       
-      apps = ext4 "/dev/disk/by-uuid/aa453135-4b7a-4b12-8efc-f3dda093d2b7"; # app data
       # achive = ext4 "/dev/disk/by-uuid/"; # long term archival 
-      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # file share
+      data = ext4 "/dev/disk/by-uuid/aa453135-4b7a-4b12-8efc-f3dda093d2b7"; # app data
+      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # file server
     };
     dash = [
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
@@ -53,8 +54,8 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
+      "cdn.${domain}"     = selfSigned "https://localhost:3923";
       "git.${domain}"     = "http://localhost:5080";
-      "cdn.${domain}"     = "http://localhost:3923";
       "docs.${domain}"    = "http://localhost:7090";
       "auth.${domain}"    = "http://localhost:1411";
       "dash.${domain}"    = "http://localhost:5070";

modules/system/homelab/ai.nix

@@ -5,7 +5,7 @@
       host = "127.0.0.1";
       port = 11434;
       user = "ollama";
-      home = "/mnt/data/ollama";
+      home = "/mnt/data/apps/ollama";
       loadModels = [ 
         "gemma3n:e4b" # "gemma3n:e2b" 
         "qwen3-coder-next:cloud" # "codellama:7b" "starcoder:3b"
@@ -14,7 +14,7 @@
     open-webui = {
       enable = true;
       port = 8080;
-      environmentFile = "/mnt/data/ollama/.env";
+      environmentFile = "/mnt/data/apps/ollama/.env";
       environment = {
         OLLAMA_BASE_URL = "http://localhost:11434";
         # WEBUI_AUTH = "False";

modules/system/homelab/auth.nix

@@ -1,8 +1,8 @@
 { homelab, ... }: {
   services.pocket-id = {
     enable = true;
-    credentials.ENCRYPTION_KEY = "/mnt/data/pocketid/encryption-key";
+    credentials.ENCRYPTION_KEY = "/mnt/data/apps/pocketid/encryption-key";
-    dataDir = "/mnt/data/pocketid/data";
+    dataDir = "/mnt/data/apps/pocketid/data";
     settings = {
       PORT = "1411";
       HOST = "127.0.0.1";

modules/system/homelab/cdn.nix

@@ -1,5 +1,14 @@
 { pkgs, ... }: {
   environment.systemPackages = with pkgs; [ copyparty-most ];
 
-  # TODO: systemd service
+  systemd.services.copyparty = {
+    description = "File Sharing Service";
+    enable = true;
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
+      Restart = "on-failure";
+    };
+  };
 }

modules/system/homelab/code.nix

@@ -1,4 +1,4 @@
-{ pkgs, username, ... }: {
+{ username, ... }: {
   services.code-server = {
     enable = true;
     host = "127.0.0.1";
@@ -6,8 +6,7 @@
     user = username;
     auth = "none";
     disableTelemetry = true;
-    extensionsDir = "/mnt/data/code-server/extensions";
+    extensionsDir = "/mnt/data/apps/code-server/extensions";
-    userDataDir = "/mnt/data/code-server/user-data";
+    userDataDir = "/mnt/data/apps/code-server/user-data";
-    extraPackages = with pkgs; [];
   };
 }

modules/system/homelab/containers.nix

@@ -1,5 +1,6 @@
 { homelab, lib, ... }: let
-  stacks-dir = "/mnt/data/dockge/stacks";
+  dockge-dir = "/mnt/data/apps/dockge";
+  stacks-dir = "${dockge-dir}/stacks";
 in {
   virtualisation.oci-containers.containers."dockge" = {
     image = "louislam/dockge:nightly";
@@ -8,7 +9,7 @@ in {
     };
     volumes = [
       "${stacks-dir}:${stacks-dir}:rw"
-      "/mnt/data/dockge/data:/app/data:rw"
+      "${dockge-dir}/data:/app/data:rw"
       "/var/run/docker.sock:/var/run/docker.sock:rw"
     ];
     ports = [

modules/system/homelab/dash.nix

@@ -61,9 +61,6 @@
   external = [
     [ "Proxmox" "proxmox" "https://server.proxy.${homelab.domain}" "http://server.dns.${homelab.domain}:8006/" ]
     [ "OpenWRT" "openwrt" "https://router.proxy.${homelab.domain}" "http://router.dns.${homelab.domain}:80/" ]
-    [ "HomeAssistant" "homeassistant" "https://home.proxy.${homelab.domain}" "http://home.dns.${homelab.domain}:8123/" ]
-    [ "OpenMediaVault" "openmediavault" "https://nas.local:80" "http://nas.local:80/" ]
-    [ "ApacheHTTPD" "apache" "https://nas.local:3000" "http://nas.local:3000/" ]
   ];
   bookmarks = [
     [ "Tailscale" "tailscale" "https://login.tailscale.com/" ]
@@ -83,7 +80,6 @@ in {
   };
   services.glance = {
     enable = true;
-    environmentFile = "/var/lib/glance/.env";
     settings = {
       server = {
         host = "127.0.0.1";
@@ -260,7 +256,7 @@ in {
                   type = "server-stats";
                   servers = [{
                     type = "local";
-                    mountpoints."/nix/store".hide = true;
+                    # mountpoints."/nix/store".hide = true;
                   }];
                 }
                 {

modules/system/homelab/db.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }: {
+  services.postgresql = {
+    enable = true;
+    dataDir = "/mnt/data/apps/postgresql"; 
+    package = pkgs.postgresql_16;
+  };
+}

modules/system/homelab/gallery.nix

@@ -1,4 +1,4 @@
-{ lib, homelab, ... }: {
+{ lib, ... }: {
   users.users.immich.extraGroups = [ "video" "render" ];
 
   services = {
@@ -6,7 +6,7 @@
       enable = true;
       port = 2283;
       host = "127.0.0.1";
-      mediaLocation = "/mnt/gallery";
+      mediaLocation = "/mnt/data/gallery";
       accelerationDevices = null;
       environment.DB_URL = lib.mkForce "postgresql:///immich?host=/var/run/postgresql&user=immich"; # https://github.com/immich-app/immich/issues/26140
       machine-learning.enable = true;

modules/system/homelab/git.nix

@@ -3,7 +3,7 @@
     forgejo = {
       enable = true;
       lfs.enable = true;
-      stateDir = "/mnt/data/forgejo";
+      stateDir = "/mnt/data/apps/forgejo";
       package = pkgs.forgejo;
       settings = {
         server = {
@@ -43,7 +43,7 @@
       enable = true;
       name = "nixos-server-runner";
       url = "https://git.proxy.${homelab.domain}";
-      tokenFile = "/root/forgejo-token-runner"; 
+      tokenFile = "/mnt/data/apps/forgejo/token-runner"; 
       labels = [ "self-hosted:host" ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };

modules/system/homelab/media.nix

@@ -5,6 +5,7 @@
   services = {
     jellyfin = {
       enable = true;
+      dataDir = "/mnt/data/apps/jellyfin";
       hardwareAcceleration = {
         enable = true;
         device = "/dev/dri/renderD128";

modules/system/homelab/pass.nix

@@ -2,9 +2,10 @@
   services.vaultwarden = {
     enable = true;
     domain = "pass.proxy.${homelab.domain}";
-    backupDir = "/mnt/data/vaultwarden/backups";
+    backupDir = "/mnt/data/apps/vaultwarden/backups";
-    environmentFile = "/mnt/data/vaultwarden/.env";
+    environmentFile = "/mnt/data/apps/vaultwarden/.env";
     config = {
+      # DATA_FOLDER = "/mnt/data/apps/vaultwarden/data"; # [vaultwarden][ERROR] Error creating private key '/mnt/data/apps/vaultwarden/data/rsa_key.pem'
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_LOG = "critical";

modules/system/homelab/proxy.nix

@@ -1,4 +1,5 @@
 { pkgs, homelab, lib, ... }: let
+  htpasswd = "/mnt/data/apps/nginx/htpasswd";
   exta-conf = ''
     # proxy_set_header X-Auth-User $remote_user;
     proxy_read_timeout 600s;
@@ -21,7 +22,7 @@ in {
       domain = "*.${homelab.proxy.base}";
       extraDomainNames = [ homelab.proxy.base ];
       dnsProvider = "cloudflare";
-      environmentFile = "/mnt/data/acme/.env";
+      environmentFile = "/mnt/data/apps/acme/cf-api.env";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
     };
   };
@@ -60,7 +61,7 @@ in {
         locations."/" = {
           proxyPass = cfg.dest;
           proxyWebsockets = true;
-          basicAuthFile = if cfg.auth then "/var/lib/nginx/.htpasswd" else null;
+          basicAuthFile = if cfg.auth then htpasswd else null;
           extraConfig = exta-conf;
         };
       }) homelab.proxy.hosts;
@@ -68,7 +69,7 @@ in {
     traefik = {
       enable = true;
       dynamicConfigOptions = {
-        http.middlewares.auth.basicAuth.usersFile = "/var/lib/nginx/.htpasswd";
+        http.middlewares.auth.basicAuth.usersFile = htpasswd;
       };
       staticConfigOptions = {
         entryPoints = {

modules/system/homelab/search.nix

@@ -2,7 +2,7 @@
   services.searx = {
     enable = true;
     redisCreateLocally = true;
-    environmentFile = "/mnt/data/searxng/.env";
+    environmentFile = "/mnt/data/apps/searxng/.env";
     settings = {
       server = {
         bind_address = "127.0.0.1";

modules/system/homelab/tunnels.nix

@@ -2,8 +2,8 @@
   services.cloudflared = {
     enable = true;
     tunnels.homelab = {
-      credentialsFile = "/mnt/data/cloudflared/homelab.json";
+      credentialsFile = "/mnt/data/apps/cloudflared/homelab.json";
-      certificateFile = "/mnt/data/cloudflared/cert.pem";
+      certificateFile = "/mnt/data/apps/cloudflared/cert.pem";
       default = "http_status:404";
       ingress = homelab.routes;
     };
@@ -23,7 +23,7 @@
 
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
-      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
+      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns --overwrite-dns $(cat /mnt/data/apps/cloudflared/homelab.json | ${pkgs.jq}/bin/jq -r .TunnelID) ${domain} || true
     '') (builtins.attrNames homelab.routes);
   };
 }

modules/system/server.nix

@@ -21,7 +21,9 @@ in {
     ./homelab/code.nix
     ./homelab/dns.nix
     ./homelab/git.nix
+    ./homelab/cdn.nix
     ./homelab/ai.nix
+    ./homelab/db.nix
     
     ./core/swapfile.nix
     ./core/oom.nix
@@ -33,7 +35,7 @@ in {
   
   services.tailscale = {
     enable = true;
-    authKeyFile = "/mnt/data/tailscale/authkey";
+    authKeyFile = "/mnt/data/apps/tailscale/authkey";
     useRoutingFeatures = "server";
     extraUpFlags = ts-flags;
     extraSetFlags = ts-flags;