mirror of
https://codeberg.org/muon/home.git
synced 2026-03-08 03:25:16 +00:00
Merge remote-tracking branch 'refs/remotes/origin/main'
This commit is contained in:
commit
8fbcb14ebf
7 changed files with 319 additions and 107 deletions
|
|
@ -1,103 +1,107 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.mods;
|
||||
wg = cfg.wireguard;
|
||||
in
|
||||
with lib; {
|
||||
options.mods = {
|
||||
i2p.enable = mkEnableOption "enables i2p network";
|
||||
tailscale.enable = mkEnableOption "enables tailscale";
|
||||
|
||||
in with lib; {
|
||||
options.mods = {
|
||||
i2p.enable = mkEnableOption "enables i2p network";
|
||||
tailscale.enable = mkEnableOption "enables tailscale";
|
||||
|
||||
wireguard.id = mkOption {
|
||||
type = with types; nullOr ints.u8;
|
||||
default = null;
|
||||
};
|
||||
|
||||
openvpn.enable = mkEnableOption "enables openvpn config";
|
||||
openvpn.config = let
|
||||
username = "${config.mods.user.name}";
|
||||
folder = "${config.users.users.${username}.home}/documents/openvpn/";
|
||||
file = "${config.mods.user.name}.ovpn";
|
||||
in mkOption {
|
||||
description = "the config location";
|
||||
default = "${folder}${file}";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking.networkmanager.enable = true;
|
||||
# networking.nameservers = [ "45.90.28.97" "45.90.30.97" ];
|
||||
networking.nameservers = [ "194.242.2.4#base.dns.mullvad.net" ];
|
||||
# services.resolved = {
|
||||
# enable = true;
|
||||
# dnssec = "false";
|
||||
# dnsovertls = "true";
|
||||
# domains = [ "~." ];
|
||||
# fallbackDns = [ "194.242.2.4#base.dns.mullvad.net" ];
|
||||
# };
|
||||
|
||||
# udev 250 doesn't reliably reinitialize devices after restart
|
||||
systemd.services.systemd-udevd.restartIfChanged = false;
|
||||
# systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
|
||||
# systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
|
||||
|
||||
services.tailscale.enable = cfg.tailscale.enable;
|
||||
|
||||
services.openvpn.servers = mkIf cfg.openvpn.enable {
|
||||
remote.config = "config ${cfg.openvpn.config}";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
7656 # default proto sam port
|
||||
7070 # default web interface port
|
||||
4447 # default socks proxy port
|
||||
4444 # default http proxy port
|
||||
];
|
||||
services.i2pd = lib.mkIf cfg.i2p.enable {
|
||||
enable = true;
|
||||
proto.sam.enable = true;
|
||||
address = "127.0.0.1";
|
||||
proto = {
|
||||
http.enable = true;
|
||||
socksProxy.enable = true;
|
||||
httpProxy.enable = true;
|
||||
wireguard.id = mkOption {
|
||||
type = with types; nullOr ints.u8;
|
||||
default = null;
|
||||
};
|
||||
|
||||
openvpn.enable = mkEnableOption "enables openvpn config";
|
||||
openvpn.config = let
|
||||
username = "${config.mods.user.name}";
|
||||
folder = "${config.users.users.${username}.home}/documents/openvpn/";
|
||||
file = "${config.mods.user.name}.ovpn";
|
||||
in
|
||||
mkOption {
|
||||
description = "the config location";
|
||||
default = "${folder}${file}";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedUDPPorts = [ 51820 16261 ];
|
||||
networking.wg-quick.interfaces = lib.mkIf (wg.id != null) {
|
||||
wg0 = {
|
||||
address = [
|
||||
"10.0.0.${toString wg.id}/24"
|
||||
"fdc9:281f:04d7:9ee9::${toString wg.id}/64"
|
||||
];
|
||||
dns = [ "10.0.0.1" "fdc9:281f:04d7:9ee9::1" ];
|
||||
mtu = 1500;
|
||||
privateKeyFile = "/home/muon/wireguard-keys/private";
|
||||
config = {
|
||||
networking.networkmanager.enable = true;
|
||||
# networking.nameservers = [ "45.90.28.97" "45.90.30.97" ];
|
||||
networking.nameservers = ["194.242.2.4#base.dns.mullvad.net"];
|
||||
# services.resolved = {
|
||||
# enable = true;
|
||||
# dnssec = "false";
|
||||
# dnsovertls = "true";
|
||||
# domains = [ "~." ];
|
||||
# fallbackDns = [ "194.242.2.4#base.dns.mullvad.net" ];
|
||||
# };
|
||||
|
||||
peers = [{
|
||||
publicKey = "2RF8GmTZwQdzVm2l2piYy6U0qiMU3wSxC7Lt8urAjwA=";
|
||||
presharedKeyFile =
|
||||
"/home/muon/wireguard-keys/psk-${config.networking.hostName}";
|
||||
allowedIPs = [ "10.0.0.${toString wg.id}/24" ];
|
||||
# allowedIPs = [ "0.0.0.0/0" ];
|
||||
# ip route add 93.95.230.11 via 192.168.0.1
|
||||
endpoint = "93.95.230.11:51820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
# udev 250 doesn't reliably reinitialize devices after restart
|
||||
systemd.services.systemd-udevd.restartIfChanged = false;
|
||||
# systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
|
||||
# systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
|
||||
|
||||
services.tailscale.enable = cfg.tailscale.enable;
|
||||
|
||||
services.openvpn.servers = mkIf cfg.openvpn.enable {
|
||||
remote.config = "config ${cfg.openvpn.config}";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
7656 # default proto sam port
|
||||
7070 # default web interface port
|
||||
4447 # default socks proxy port
|
||||
4444 # default http proxy port
|
||||
];
|
||||
services.i2pd = lib.mkIf cfg.i2p.enable {
|
||||
enable = true;
|
||||
proto.sam.enable = true;
|
||||
address = "127.0.0.1";
|
||||
proto = {
|
||||
http.enable = true;
|
||||
socksProxy.enable = true;
|
||||
httpProxy.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedUDPPorts = [51820 16261];
|
||||
networking.wg-quick.interfaces = lib.mkIf (wg.id != null) {
|
||||
wg0 = {
|
||||
address = [
|
||||
"10.0.0.${toString wg.id}/24"
|
||||
"fdc9:281f:04d7:9ee9::${toString wg.id}/64"
|
||||
];
|
||||
# dns = ["10.0.0.1" "fdc9:281f:04d7:9ee9::1"];
|
||||
mtu = 1500;
|
||||
privateKeyFile = "/home/muon/wireguard-keys/private";
|
||||
|
||||
peers = [
|
||||
{
|
||||
publicKey = "2RF8GmTZwQdzVm2l2piYy6U0qiMU3wSxC7Lt8urAjwA=";
|
||||
presharedKeyFile = "/home/muon/wireguard-keys/psk-${config.networking.hostName}";
|
||||
allowedIPs = ["10.0.0.${toString wg.id}/24"];
|
||||
# allowedIPs = [ "0.0.0.0/0" ];
|
||||
# ip route add 93.95.230.11 via 192.168.0.1
|
||||
endpoint = "93.95.230.11:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
networking.extraHosts = ''
|
||||
10.0.0.1 mups
|
||||
10.0.0.2 muon
|
||||
10.0.0.3 muho
|
||||
10.0.0.4 muop
|
||||
'';
|
||||
|
||||
# gateway =
|
||||
# "${pkgs.networkmanager}/bin/nmcli dev show ${interface} | ${pkgs.gnugrep}/bin/fgrep IP4.GATEWAY | ${pkgs.awk}/bin/awk {print $2}";
|
||||
};
|
||||
|
||||
networking.extraHosts = ''
|
||||
10.0.0.1 mups
|
||||
10.0.0.2 muon
|
||||
10.0.0.3 muho
|
||||
10.0.0.4 muop
|
||||
'';
|
||||
|
||||
# gateway =
|
||||
# "${pkgs.networkmanager}/bin/nmcli dev show ${interface} | ${pkgs.gnugrep}/bin/fgrep IP4.GATEWAY | ${pkgs.awk}/bin/awk {print $2}";
|
||||
|
||||
};
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ pkgs, lib, config, ... }: {
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
options.mods.containers = {
|
||||
enable = lib.mkEnableOption {
|
||||
default = false;
|
||||
|
|
@ -6,7 +11,10 @@
|
|||
};
|
||||
};
|
||||
|
||||
imports = [ ./steam.nix ];
|
||||
imports = [
|
||||
./steam.nix
|
||||
./seedbox.nix
|
||||
];
|
||||
|
||||
config = lib.mkIf config.mods.containers.enable {
|
||||
virtualisation.docker.enable = true;
|
||||
|
|
@ -16,10 +24,10 @@
|
|||
};
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
internalInterfaces = ["ve-+"];
|
||||
externalInterface = "enp0s31f6";
|
||||
};
|
||||
networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
|
||||
networking.networkmanager.unmanaged = ["interface-name:ve-*"];
|
||||
# networking = {
|
||||
# bridges.br0.interfaces = [ "enp0s31f6" ]; # Adjust interface accordingly
|
||||
|
||||
|
|
@ -45,6 +53,6 @@
|
|||
# tcp = { enable = true; anonymousClients = { allowedIpRanges = ["127.0.0.1" "192.168.100.0/24"]; }; };
|
||||
# };
|
||||
|
||||
environment.systemPackages = with pkgs; [ xorg.xhost ];
|
||||
environment.systemPackages = with pkgs; [xorg.xhost];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
186
modules/nixos/server/containers/seedbox.nix
Normal file
186
modules/nixos/server/containers/seedbox.nix
Normal file
|
|
@ -0,0 +1,186 @@
|
|||
# Auto-generated by compose2nix.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.mods.server.seedbox;
|
||||
port = config.mods.server.nginx.ports.stream;
|
||||
backend-port = config.mods.server.local.ports.seedbox;
|
||||
in
|
||||
with lib; {
|
||||
options.mods.server.seedbox = {
|
||||
enable = mkEnableOption {
|
||||
default = false;
|
||||
description = "enables seedbox-lite containers";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Runtime
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
|
||||
# Enable container name DNS for all Podman networks.
|
||||
networking.firewall.interfaces = let
|
||||
matchAll =
|
||||
if !config.networking.nftables.enable
|
||||
then "podman+"
|
||||
else "podman*";
|
||||
in {
|
||||
"${matchAll}".allowedUDPPorts = [53];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.backend = "podman";
|
||||
|
||||
# Containers
|
||||
virtualisation.oci-containers.containers."seedbox-backend" = {
|
||||
image = "localhost/compose2nix/seedbox-backend";
|
||||
volumes = [
|
||||
"seedbox-lite_seedbox_cache:/app/cache:rw"
|
||||
"seedbox-lite_seedbox_data:/app/data:rw"
|
||||
];
|
||||
ports = [
|
||||
"${backend-port}:3001/tcp"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=seedbox-backend"
|
||||
"--network=seedbox-lite_seedbox-network"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-seedbox-backend" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-seedbox-lite_seedbox-network.service"
|
||||
"podman-volume-seedbox-lite_seedbox_cache.service"
|
||||
"podman-volume-seedbox-lite_seedbox_data.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-seedbox-lite_seedbox-network.service"
|
||||
"podman-volume-seedbox-lite_seedbox_cache.service"
|
||||
"podman-volume-seedbox-lite_seedbox_data.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-seedbox-lite-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-seedbox-lite-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."seedbox-frontend" = {
|
||||
image = "localhost/compose2nix/seedbox-frontend";
|
||||
ports = [
|
||||
"${port}:80/tcp"
|
||||
];
|
||||
dependsOn = [
|
||||
"seedbox-backend"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=seedbox-frontend"
|
||||
"--network=seedbox-lite_seedbox-network"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-seedbox-frontend" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-seedbox-lite_seedbox-network.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-seedbox-lite_seedbox-network.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-seedbox-lite-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-seedbox-lite-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
# Networks
|
||||
systemd.services."podman-network-seedbox-lite_seedbox-network" = {
|
||||
path = [pkgs.podman];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStop = "podman network rm -f seedbox-lite_seedbox-network";
|
||||
};
|
||||
script = ''
|
||||
podman network inspect seedbox-lite_seedbox-network || podman network create seedbox-lite_seedbox-network --driver=bridge
|
||||
'';
|
||||
partOf = ["podman-compose-seedbox-lite-root.target"];
|
||||
wantedBy = ["podman-compose-seedbox-lite-root.target"];
|
||||
};
|
||||
|
||||
# Volumes
|
||||
systemd.services."podman-volume-seedbox-lite_seedbox_cache" = {
|
||||
path = [pkgs.podman];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect seedbox-lite_seedbox_cache || podman volume create seedbox-lite_seedbox_cache --driver=local
|
||||
'';
|
||||
partOf = ["podman-compose-seedbox-lite-root.target"];
|
||||
wantedBy = ["podman-compose-seedbox-lite-root.target"];
|
||||
};
|
||||
systemd.services."podman-volume-seedbox-lite_seedbox_data" = {
|
||||
path = [pkgs.podman];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect seedbox-lite_seedbox_data || podman volume create seedbox-lite_seedbox_data --driver=local
|
||||
'';
|
||||
partOf = ["podman-compose-seedbox-lite-root.target"];
|
||||
wantedBy = ["podman-compose-seedbox-lite-root.target"];
|
||||
};
|
||||
|
||||
# Builds
|
||||
systemd.services."podman-build-seedbox-backend" = {
|
||||
path = [pkgs.podman pkgs.git];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
TimeoutSec = 300;
|
||||
};
|
||||
script = ''
|
||||
cd /home/muon/projects/seedbox-lite/server
|
||||
podman build -t compose2nix/seedbox-backend .
|
||||
'';
|
||||
};
|
||||
systemd.services."podman-build-seedbox-frontend" = {
|
||||
path = [pkgs.podman pkgs.git];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
TimeoutSec = 300;
|
||||
};
|
||||
script = ''
|
||||
cd /tmp
|
||||
git clone https://github.com/hotheadhacker/seedbox-lite.git
|
||||
cd seedbox-lite/client
|
||||
podman build -t compose2nix/seedbox-frontend --build-arg VITE_API_BASE_URL=http://localhost:${backend-port} .
|
||||
'';
|
||||
};
|
||||
|
||||
# Root service
|
||||
# When started, this will automatically create all resources and start
|
||||
# the containers. When stopped, this will teardown all resources.
|
||||
systemd.targets."podman-compose-seedbox-lite-root" = {
|
||||
unitConfig = {
|
||||
Description = "Root target generated by compose2nix.";
|
||||
};
|
||||
wantedBy = ["multi-user.target"];
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue