satr14/nix-flake
Watch
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: satr14:fc663163439bc8c425dd0cc4fe98ac88c444f93c
Branches Tags
satr14:main
satr14:renovate/lock-file-maintenance
satr14:mc-backup
satr14:sops-implementation
..
compare: satr14:8565063558fd6040af9937ce6427e86cfb3066e5
Branches Tags
satr14:main
satr14:renovate/lock-file-maintenance
satr14:mc-backup
satr14:sops-implementation
6 changed files with 55 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/options.nix
View file

@ -15,24 +15,23 @@
homelab = rec { homelab = rec {
domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc. domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
disks = { disks = {
share = "/dev/disk/by-uuid/ac61f6c8-ac20-41dd-ba93-41c4a225dc98"; # disk for nas share share = "/dev/disk/by-uuid/ac61f6c8-ac20-41dd-ba93-41c4a225dc98"; # disk for nas share
data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
}; };
records = [ records = [
[ "server.dns.${domain}" "10.3.14.69" ] [ "router.dns.${domain}" "10.3.14.1" ]
[ "router.dns.${domain}" "10.3.14.1" ] [ "workspace.dns.${domain}" "10.3.14.57" ]
[ "home.dns.${domain}" "10.3.14.235" ] [ "server.dns.${domain}" "10.3.14.69" ]
[ "workspace.dns.${domain}" "10.3.14.57" ] [ "home.dns.${domain}" "10.3.14.235" ]
[ "old-main.dns.${domain}" "10.3.14.42" ] # old main machine for connecting while migrating
[ "main.dns.${domain}" "10.3.14.215" ] # this machine [ "main.dns.${domain}" "10.3.14.215" ] # this machine
[ "old-main.dns.${domain}" "10.3.14.42" ] # old main machine for connecting while migrating
[ "proxy.${domain}" "main.dns.${domain}" ] [ "proxy.${domain}" "main.dns.${domain}" ]
[ "*.proxy.${domain}" "proxy.${domain}" ] [ "*.proxy.${domain}" "proxy.${domain}" ]
# [ "lancache.steamcontent.com" "main.dns.${domain}" ] # [ "lancache.steamcontent.com" "main.dns.${domain}" ]
# [ "steam.cache.lancache.net" "main.dns.${domain}" ] # [ "steam.cache.lancache.net" "main.dns.${domain}" ]
]; ];
}; };

1
modules/system/homelab/dash.nix
View file

@ -58,7 +58,6 @@
[ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ] [ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ]
[ "ApacheHTTPD" "apache" "https://cdn.proxy.${homelab.domain}" "http://localhost:3000/" ] [ "ApacheHTTPD" "apache" "https://cdn.proxy.${homelab.domain}" "http://localhost:3000/" ]
[ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ] [ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ]
[ "Jellyfin" "jellyfin" "https://media.proxy.${homelab.domain}" "http://localhost:8096/" ]
[ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ] [ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ]
[ "Ollama" "ollama" "https://ai.proxy.${homelab.domain}" "http://localhost:8080/" ] [ "Ollama" "ollama" "https://ai.proxy.${homelab.domain}" "http://localhost:8080/" ]
[ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ] [ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ]

65
modules/system/homelab/media.nix
View file

@ -1,4 +1,5 @@
{ pkgs, ... }: { { pkgs, ... }: {
# WIP: declaratively integrate media services into homelab configuration
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
jellyfin jellyfin-web jellyfin-ffmpeg jellyfin jellyfin-web jellyfin-ffmpeg
]; ];
@ -7,37 +8,37 @@
enable = true; enable = true;
hardwareAcceleration.enable = true; hardwareAcceleration.enable = true;
}; };
# jellyseerr = { jellyseerr = {
# enable = true; enable = true;
# port = 5055; port = 5055;
# }; };
# radarr = { radarr = {
# enable = true; enable = true;
# settings = { settings = {
# server = { server = {
# port = 7878; port = 7878;
# bindaddress = "127.0.0.1"; bindaddress = "127.0.0.1";
# }; };
# }; };
# }; };
# sonarr = { sonarr = {
# enable = true; enable = true;
# server = { server = {
# port = 8989; port = 8989;
# bindaddress = "127.0.0.1"; bindaddress = "127.0.0.1";
# }; };
# }; };
# qbittorrent = { qbittorrent = {
# enable = true; enable = true;
# webuiPort = 8020; webuiPort = 8020;
# }; };
# jackett = { jackett = {
# enable = true; enable = true;
# port = 9117; port = 9117;
# }; };
# flaresolverr = { flaresolverr = {
# enable = true; enable = true;
# port = 8191; port = 8191;
# }; };
}; };
} }

8
modules/system/homelab/proxy.nix
View file

@ -4,13 +4,19 @@
"dns" = { dest = "http://localhost:8088"; auth = true; }; "dns" = { dest = "http://localhost:8088"; auth = true; };
"ai" = { dest = "http://localhost:8080"; auth = true; }; "ai" = { dest = "http://localhost:8080"; auth = true; };
# "jsr" = { dest = "http://localhost:5055"; auth = false; };
# "rdr" = { dest = "http://localhost:5055"; auth = false; };
# "snr" = { dest = "http://localhost:5055"; auth = false; };
# "qbt" = { dest = "http://localhost:8020"; auth = false; };
# "jkt" = { dest = "http://localhost:9117"; auth = false; };
# "media" = { dest = "http://localhost:8096"; auth = false; };
"auth" = { dest = "http://localhost:1411"; auth = false; }; "auth" = { dest = "http://localhost:1411"; auth = false; };
"git" = { dest = "http://localhost:5080"; auth = false; }; "git" = { dest = "http://localhost:5080"; auth = false; };
"containers" = { dest = "http://localhost:5001"; auth = false; }; "containers" = { dest = "http://localhost:5001"; auth = false; };
"gallery" = { dest = "http://localhost:2283"; auth = false; }; "gallery" = { dest = "http://localhost:2283"; auth = false; };
"remote" = { dest = "http://localhost:8085"; auth = false; }; "remote" = { dest = "http://localhost:8085"; auth = false; };
"media" = { dest = "http://localhost:8096"; auth = false; };
"pass" = { dest = "http://localhost:8060"; auth = false; }; "pass" = { dest = "http://localhost:8060"; auth = false; };
"cdn" = { dest = "http://localhost:3000"; auth = false; }; "cdn" = { dest = "http://localhost:3000"; auth = false; };
"@" = { dest = "http://localhost:5070"; auth = false; }; "@" = { dest = "http://localhost:5070"; auth = false; };

32
modules/system/homelab/tunnels.nix
View file

@ -1,36 +1,16 @@
{ pkgs, lib, homelab, ... }: let { homelab, ... }: {
routes = {
"git.${homelab.domain}" = "http://localhost:3000";
"auth.${homelab.domain}" = "http://localhost:1411";
"dash.${homelab.domain}" = "http://localhost:5070";
"gallery.${homelab.domain}" = "http://localhost:2284";
};
in {
services.cloudflared = { services.cloudflared = {
enable = true; enable = true;
tunnels.homelab = { tunnels.homelab = {
credentialsFile = "/mnt/data/cloudflared/homelab.json"; credentialsFile = "/mnt/data/cloudflared/homelab.json";
certificateFile = "/mnt/data/cloudflared/cert.pem"; certificateFile = "/mnt/data/cloudflared/cert.pem";
default = "http_status:404"; default = "http_status:404";
ingress = routes; ingress = {
}; "git.${homelab.domain}" = "http://localhost:3000";
"auth.${homelab.domain}" = "http://localhost:1411";
systemd.services.cloudflared-dns-route = { "dash.${homelab.domain}" = "http://localhost:5070";
description = "Sync Cloudflare Tunnel DNS routes"; "gallery.${homelab.domain}" = "http://localhost:2284";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
RemainAfterExit = true;
Type = "oneshot";
User = "root";
}; };
script = lib.concatMapStringsSep "\n" (domain: ''
echo "Ensuring DNS route for ${domain}..."
${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
'') builtins.attrNames routes;
}; };
}; };
} }

2
modules/system/server.nix
View file

@ -10,7 +10,7 @@ in {
./homelab/gallery.nix ./homelab/gallery.nix
./homelab/tunnels.nix ./homelab/tunnels.nix
./homelab/remote.nix ./homelab/remote.nix
./homelab/media.nix # ./homelab/media.nix # wip
./homelab/share.nix ./homelab/share.nix
./homelab/proxy.nix ./homelab/proxy.nix
./homelab/auth.nix ./homelab/auth.nix