satr14/nix-flake
Watch
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: satr14:fc663163439bc8c425dd0cc4fe98ac88c444f93c
Branches Tags
satr14:main
satr14:renovate/lock-file-maintenance
satr14:mc-backup
satr14:sops-implementation
..
compare: satr14:8565063558fd6040af9937ce6427e86cfb3066e5
Branches Tags
satr14:main
satr14:renovate/lock-file-maintenance
satr14:mc-backup
satr14:sops-implementation
6 changed files with 55 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/options.nix
View file

@ -15,19 +15,18 @@
homelab = rec {
domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
disks = {
share = "/dev/disk/by-uuid/ac61f6c8-ac20-41dd-ba93-41c4a225dc98"; # disk for nas share
data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
};
records = [
[ "server.dns.${domain}" "10.3.14.69" ]
[ "router.dns.${domain}" "10.3.14.1" ]
[ "home.dns.${domain}" "10.3.14.235" ]
[ "workspace.dns.${domain}" "10.3.14.57" ]
[ "old-main.dns.${domain}" "10.3.14.42" ] # old main machine for connecting while migrating
[ "server.dns.${domain}" "10.3.14.69" ]
[ "home.dns.${domain}" "10.3.14.235" ]
[ "main.dns.${domain}" "10.3.14.215" ] # this machine
[ "old-main.dns.${domain}" "10.3.14.42" ] # old main machine for connecting while migrating
[ "proxy.${domain}" "main.dns.${domain}" ]
[ "*.proxy.${domain}" "proxy.${domain}" ]

1
modules/system/homelab/dash.nix
View file

@ -58,7 +58,6 @@
[ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ]
[ "ApacheHTTPD" "apache" "https://cdn.proxy.${homelab.domain}" "http://localhost:3000/" ]
[ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ]
[ "Jellyfin" "jellyfin" "https://media.proxy.${homelab.domain}" "http://localhost:8096/" ]
[ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ]
[ "Ollama" "ollama" "https://ai.proxy.${homelab.domain}" "http://localhost:8080/" ]
[ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ]

65
modules/system/homelab/media.nix
View file

@ -1,4 +1,5 @@
{ pkgs, ... }: {
# WIP: declaratively integrate media services into homelab configuration
environment.systemPackages = with pkgs; [
jellyfin jellyfin-web jellyfin-ffmpeg
];
@ -7,37 +8,37 @@
enable = true;
hardwareAcceleration.enable = true;
};
# jellyseerr = {
# enable = true;
# port = 5055;
# };
# radarr = {
# enable = true;
# settings = {
# server = {
# port = 7878;
# bindaddress = "127.0.0.1";
# };
# };
# };
# sonarr = {
# enable = true;
# server = {
# port = 8989;
# bindaddress = "127.0.0.1";
# };
# };
# qbittorrent = {
# enable = true;
# webuiPort = 8020;
# };
# jackett = {
# enable = true;
# port = 9117;
# };
# flaresolverr = {
# enable = true;
# port = 8191;
# };
jellyseerr = {
enable = true;
port = 5055;
};
radarr = {
enable = true;
settings = {
server = {
port = 7878;
bindaddress = "127.0.0.1";
};
};
};
sonarr = {
enable = true;
server = {
port = 8989;
bindaddress = "127.0.0.1";
};
};
qbittorrent = {
enable = true;
webuiPort = 8020;
};
jackett = {
enable = true;
port = 9117;
};
flaresolverr = {
enable = true;
port = 8191;
};
};
}

8
modules/system/homelab/proxy.nix
View file

@ -4,13 +4,19 @@
"dns" = { dest = "http://localhost:8088"; auth = true; };
"ai" = { dest = "http://localhost:8080"; auth = true; };
# "jsr" = { dest = "http://localhost:5055"; auth = false; };
# "rdr" = { dest = "http://localhost:5055"; auth = false; };
# "snr" = { dest = "http://localhost:5055"; auth = false; };
# "qbt" = { dest = "http://localhost:8020"; auth = false; };
# "jkt" = { dest = "http://localhost:9117"; auth = false; };
# "media" = { dest = "http://localhost:8096"; auth = false; };
"auth" = { dest = "http://localhost:1411"; auth = false; };
"git" = { dest = "http://localhost:5080"; auth = false; };
"containers" = { dest = "http://localhost:5001"; auth = false; };
"gallery" = { dest = "http://localhost:2283"; auth = false; };
"remote" = { dest = "http://localhost:8085"; auth = false; };
"media" = { dest = "http://localhost:8096"; auth = false; };
"pass" = { dest = "http://localhost:8060"; auth = false; };
"cdn" = { dest = "http://localhost:3000"; auth = false; };
"@" = { dest = "http://localhost:5070"; auth = false; };

32
modules/system/homelab/tunnels.nix
View file

@ -1,36 +1,16 @@
{ pkgs, lib, homelab, ... }: let
routes = {
"git.${homelab.domain}" = "http://localhost:3000";
"auth.${homelab.domain}" = "http://localhost:1411";
"dash.${homelab.domain}" = "http://localhost:5070";
"gallery.${homelab.domain}" = "http://localhost:2284";
};
in {
{ homelab, ... }: {
services.cloudflared = {
enable = true;
tunnels.homelab = {
credentialsFile = "/mnt/data/cloudflared/homelab.json";
certificateFile = "/mnt/data/cloudflared/cert.pem";
default = "http_status:404";
ingress = routes;
ingress = {
"git.${homelab.domain}" = "http://localhost:3000";
"auth.${homelab.domain}" = "http://localhost:1411";
"dash.${homelab.domain}" = "http://localhost:5070";
"gallery.${homelab.domain}" = "http://localhost:2284";
};
systemd.services.cloudflared-dns-route = {
description = "Sync Cloudflare Tunnel DNS routes";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
RemainAfterExit = true;
Type = "oneshot";
User = "root";
};
script = lib.concatMapStringsSep "\n" (domain: ''
echo "Ensuring DNS route for ${domain}..."
${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
'') builtins.attrNames routes;
};
};
}

2
modules/system/server.nix
View file

@ -10,7 +10,7 @@ in {
./homelab/gallery.nix
./homelab/tunnels.nix
./homelab/remote.nix
./homelab/media.nix
# ./homelab/media.nix # wip
./homelab/share.nix
./homelab/proxy.nix
./homelab/auth.nix