Merge remote-tracking branch 'refs/remotes/origin/main'

hosts/muho/configuration.nix

@@ -1,5 +1,11 @@
-{ config, lib, pkgs, inputs, system, ... }:
+{
-let
+  config,
+  lib,
+  pkgs,
+  inputs,
+  system,
+  ...
+}: let
   cfg = config.mods;
   keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon"
@@ -8,7 +14,7 @@ let
   ];
 in {
   # Hardware
-  imports = [ ./hardware-configuration.nix ../ports.nix ];
+  imports = [./hardware-configuration.nix ../ports.nix];
 
   # System
   mods.user.name = "muon";
@@ -45,6 +51,7 @@ in {
   mods.server.lemmy.enable = true;
   mods.server.audio.enable = true;
   mods.server.atuin.enable = true;
+  mods.server.seedbox.enable = true;
 
   mods.server.dash.enable = false;
   mods.server.nginx.ports.dash = 3009;

hosts/ports.nix

@@ -1,8 +1,13 @@
-{ pkgs, lib, config, ... }: {
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
   options.mods.server = with lib; {
     local.ports = mkOption {
       type = types.attrsOf (types.ints.u16);
-      default = { };
+      default = {};
     };
   };
   config = {
@@ -19,6 +24,7 @@
       ntfy = 3010;
       audio = 3011;
       atuin = 3012;
+      stream = 3013;
 
       search = 8081;
       videos = 8082;
@@ -33,6 +39,7 @@
       prowlarr = 5006;
       flaresolverr = 5007;
       torrent = 5008;
+      seedbox = 5009;
     };
   };
 }

modules/home/desktop/media.nix

@@ -14,7 +14,7 @@
       pavucontrol
 
       # Video
-      (callPackage ./packages/stremio-linux-shell.nix {})
+      # (callPackage ./packages/stremio-linux-shell.nix {})
 
       # Podcasts
       gpodder

modules/home/desktop/productivity.nix

@@ -17,8 +17,8 @@ in
       home.packages = with pkgs; [
         # ISO downloader
         qbittorrent
-        xd
+        # xd
-        biglybt
+        # biglybt
         # transmission_4-gtk
 
         # email

modules/nixos/core/network.nix

@@ -1,103 +1,107 @@
-{ pkgs, lib, config, ... }:
+{
-
+  pkgs,
-let
+  lib,
+  config,
+  ...
+}: let
   cfg = config.mods;
   wg = cfg.wireguard;
+in
+  with lib; {
+    options.mods = {
+      i2p.enable = mkEnableOption "enables i2p network";
+      tailscale.enable = mkEnableOption "enables tailscale";
 
-in with lib; {
+      wireguard.id = mkOption {
-  options.mods = {
+        type = with types; nullOr ints.u8;
-    i2p.enable = mkEnableOption "enables i2p network";
+        default = null;
-    tailscale.enable = mkEnableOption "enables tailscale";
-
-    wireguard.id = mkOption {
-      type = with types; nullOr ints.u8;
-      default = null;
-    };
-
-    openvpn.enable = mkEnableOption "enables openvpn config";
-    openvpn.config = let
-      username = "${config.mods.user.name}";
-      folder = "${config.users.users.${username}.home}/documents/openvpn/";
-      file = "${config.mods.user.name}.ovpn";
-    in mkOption {
-      description = "the config location";
-      default = "${folder}${file}";
-    };
-  };
-
-  config = {
-    networking.networkmanager.enable = true;
-    # networking.nameservers = [ "45.90.28.97" "45.90.30.97" ];
-    networking.nameservers = [ "194.242.2.4#base.dns.mullvad.net" ];
-    # services.resolved = {
-    #   enable = true;
-    #   dnssec = "false";
-    #   dnsovertls = "true";
-    #   domains = [ "~." ];
-    #   fallbackDns = [ "194.242.2.4#base.dns.mullvad.net" ];
-    # };
-
-    # udev 250 doesn't reliably reinitialize devices after restart
-    systemd.services.systemd-udevd.restartIfChanged = false;
-    # systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
-    # systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
-
-    services.tailscale.enable = cfg.tailscale.enable;
-
-    services.openvpn.servers = mkIf cfg.openvpn.enable {
-      remote.config = "config ${cfg.openvpn.config}";
-    };
-
-    networking.firewall.allowedTCPPorts = [
-      7656 # default proto sam port
-      7070 # default web interface port
-      4447 # default socks proxy port
-      4444 # default http proxy port
-    ];
-    services.i2pd = lib.mkIf cfg.i2p.enable {
-      enable = true;
-      proto.sam.enable = true;
-      address = "127.0.0.1";
-      proto = {
-        http.enable = true;
-        socksProxy.enable = true;
-        httpProxy.enable = true;
       };
+
+      openvpn.enable = mkEnableOption "enables openvpn config";
+      openvpn.config = let
+        username = "${config.mods.user.name}";
+        folder = "${config.users.users.${username}.home}/documents/openvpn/";
+        file = "${config.mods.user.name}.ovpn";
+      in
+        mkOption {
+          description = "the config location";
+          default = "${folder}${file}";
+        };
     };
 
-    networking.firewall.allowedUDPPorts = [ 51820 16261 ];
+    config = {
-    networking.wg-quick.interfaces = lib.mkIf (wg.id != null) {
+      networking.networkmanager.enable = true;
-      wg0 = {
+      # networking.nameservers = [ "45.90.28.97" "45.90.30.97" ];
-        address = [
+      networking.nameservers = ["194.242.2.4#base.dns.mullvad.net"];
-          "10.0.0.${toString wg.id}/24"
+      # services.resolved = {
-          "fdc9:281f:04d7:9ee9::${toString wg.id}/64"
+      #   enable = true;
-        ];
+      #   dnssec = "false";
-        dns = [ "10.0.0.1" "fdc9:281f:04d7:9ee9::1" ];
+      #   dnsovertls = "true";
-        mtu = 1500;
+      #   domains = [ "~." ];
-        privateKeyFile = "/home/muon/wireguard-keys/private";
+      #   fallbackDns = [ "194.242.2.4#base.dns.mullvad.net" ];
+      # };
 
-        peers = [{
+      # udev 250 doesn't reliably reinitialize devices after restart
-          publicKey = "2RF8GmTZwQdzVm2l2piYy6U0qiMU3wSxC7Lt8urAjwA=";
+      systemd.services.systemd-udevd.restartIfChanged = false;
-          presharedKeyFile =
+      # systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
-            "/home/muon/wireguard-keys/psk-${config.networking.hostName}";
+      # systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
-          allowedIPs = [ "10.0.0.${toString wg.id}/24" ];
+
-          # allowedIPs = [ "0.0.0.0/0" ];
+      services.tailscale.enable = cfg.tailscale.enable;
-          # ip route add 93.95.230.11 via 192.168.0.1
+
-          endpoint = "93.95.230.11:51820";
+      services.openvpn.servers = mkIf cfg.openvpn.enable {
-          persistentKeepalive = 25;
+        remote.config = "config ${cfg.openvpn.config}";
-        }];
       };
+
+      networking.firewall.allowedTCPPorts = [
+        7656 # default proto sam port
+        7070 # default web interface port
+        4447 # default socks proxy port
+        4444 # default http proxy port
+      ];
+      services.i2pd = lib.mkIf cfg.i2p.enable {
+        enable = true;
+        proto.sam.enable = true;
+        address = "127.0.0.1";
+        proto = {
+          http.enable = true;
+          socksProxy.enable = true;
+          httpProxy.enable = true;
+        };
+      };
+
+      networking.firewall.allowedUDPPorts = [51820 16261];
+      networking.wg-quick.interfaces = lib.mkIf (wg.id != null) {
+        wg0 = {
+          address = [
+            "10.0.0.${toString wg.id}/24"
+            "fdc9:281f:04d7:9ee9::${toString wg.id}/64"
+          ];
+          # dns = ["10.0.0.1" "fdc9:281f:04d7:9ee9::1"];
+          mtu = 1500;
+          privateKeyFile = "/home/muon/wireguard-keys/private";
+
+          peers = [
+            {
+              publicKey = "2RF8GmTZwQdzVm2l2piYy6U0qiMU3wSxC7Lt8urAjwA=";
+              presharedKeyFile = "/home/muon/wireguard-keys/psk-${config.networking.hostName}";
+              allowedIPs = ["10.0.0.${toString wg.id}/24"];
+              # allowedIPs = [ "0.0.0.0/0" ];
+              # ip route add 93.95.230.11 via 192.168.0.1
+              endpoint = "93.95.230.11:51820";
+              persistentKeepalive = 25;
+            }
+          ];
+        };
+      };
+
+      networking.extraHosts = ''
+        10.0.0.1 mups
+        10.0.0.2 muon
+        10.0.0.3 muho
+        10.0.0.4 muop
+      '';
+
+      # gateway =
+      # "${pkgs.networkmanager}/bin/nmcli dev show ${interface} | ${pkgs.gnugrep}/bin/fgrep IP4.GATEWAY | ${pkgs.awk}/bin/awk {print $2}";
     };
-
+  }
-    networking.extraHosts = ''
-      10.0.0.1 mups
-      10.0.0.2 muon
-      10.0.0.3 muho
-      10.0.0.4 muop
-    '';
-
-    # gateway =
-    # "${pkgs.networkmanager}/bin/nmcli dev show ${interface} | ${pkgs.gnugrep}/bin/fgrep IP4.GATEWAY | ${pkgs.awk}/bin/awk {print $2}";
-
-  };
-}

modules/nixos/server/containers/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }: {
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
   options.mods.containers = {
     enable = lib.mkEnableOption {
       default = false;
@@ -6,7 +11,10 @@
     };
   };
 
-  imports = [ ./steam.nix ];
+  imports = [
+    ./steam.nix
+    ./seedbox.nix
+  ];
 
   config = lib.mkIf config.mods.containers.enable {
     virtualisation.docker.enable = true;
@@ -16,10 +24,10 @@
     };
     networking.nat = {
       enable = true;
-      internalInterfaces = [ "ve-+" ];
+      internalInterfaces = ["ve-+"];
       externalInterface = "enp0s31f6";
     };
-    networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
+    networking.networkmanager.unmanaged = ["interface-name:ve-*"];
     # networking = {
     #   bridges.br0.interfaces = [ "enp0s31f6" ]; # Adjust interface accordingly
 
@@ -45,6 +53,6 @@
     #   tcp = { enable = true; anonymousClients = { allowedIpRanges = ["127.0.0.1" "192.168.100.0/24"]; }; };
     # };
 
-    environment.systemPackages = with pkgs; [ xorg.xhost ];
+    environment.systemPackages = with pkgs; [xorg.xhost];
   };
 }

modules/nixos/server/containers/seedbox.nix

@@ -0,0 +1,186 @@
+# Auto-generated by compose2nix.
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.mods.server.seedbox;
+  port = config.mods.server.nginx.ports.stream;
+  backend-port = config.mods.server.local.ports.seedbox;
+in
+  with lib; {
+    options.mods.server.seedbox = {
+      enable = mkEnableOption {
+        default = false;
+        description = "enables seedbox-lite containers";
+      };
+    };
+
+    config = mkIf cfg.enable {
+      # Runtime
+      virtualisation.podman = {
+        enable = true;
+        autoPrune.enable = true;
+        dockerCompat = true;
+      };
+
+      # Enable container name DNS for all Podman networks.
+      networking.firewall.interfaces = let
+        matchAll =
+          if !config.networking.nftables.enable
+          then "podman+"
+          else "podman*";
+      in {
+        "${matchAll}".allowedUDPPorts = [53];
+      };
+
+      virtualisation.oci-containers.backend = "podman";
+
+      # Containers
+      virtualisation.oci-containers.containers."seedbox-backend" = {
+        image = "localhost/compose2nix/seedbox-backend";
+        volumes = [
+          "seedbox-lite_seedbox_cache:/app/cache:rw"
+          "seedbox-lite_seedbox_data:/app/data:rw"
+        ];
+        ports = [
+          "${backend-port}:3001/tcp"
+        ];
+        log-driver = "journald";
+        extraOptions = [
+          "--network-alias=seedbox-backend"
+          "--network=seedbox-lite_seedbox-network"
+        ];
+      };
+      systemd.services."podman-seedbox-backend" = {
+        serviceConfig = {
+          Restart = lib.mkOverride 90 "always";
+        };
+        after = [
+          "podman-network-seedbox-lite_seedbox-network.service"
+          "podman-volume-seedbox-lite_seedbox_cache.service"
+          "podman-volume-seedbox-lite_seedbox_data.service"
+        ];
+        requires = [
+          "podman-network-seedbox-lite_seedbox-network.service"
+          "podman-volume-seedbox-lite_seedbox_cache.service"
+          "podman-volume-seedbox-lite_seedbox_data.service"
+        ];
+        partOf = [
+          "podman-compose-seedbox-lite-root.target"
+        ];
+        wantedBy = [
+          "podman-compose-seedbox-lite-root.target"
+        ];
+      };
+      virtualisation.oci-containers.containers."seedbox-frontend" = {
+        image = "localhost/compose2nix/seedbox-frontend";
+        ports = [
+          "${port}:80/tcp"
+        ];
+        dependsOn = [
+          "seedbox-backend"
+        ];
+        log-driver = "journald";
+        extraOptions = [
+          "--network-alias=seedbox-frontend"
+          "--network=seedbox-lite_seedbox-network"
+        ];
+      };
+      systemd.services."podman-seedbox-frontend" = {
+        serviceConfig = {
+          Restart = lib.mkOverride 90 "always";
+        };
+        after = [
+          "podman-network-seedbox-lite_seedbox-network.service"
+        ];
+        requires = [
+          "podman-network-seedbox-lite_seedbox-network.service"
+        ];
+        partOf = [
+          "podman-compose-seedbox-lite-root.target"
+        ];
+        wantedBy = [
+          "podman-compose-seedbox-lite-root.target"
+        ];
+      };
+
+      # Networks
+      systemd.services."podman-network-seedbox-lite_seedbox-network" = {
+        path = [pkgs.podman];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStop = "podman network rm -f seedbox-lite_seedbox-network";
+        };
+        script = ''
+          podman network inspect seedbox-lite_seedbox-network || podman network create seedbox-lite_seedbox-network --driver=bridge
+        '';
+        partOf = ["podman-compose-seedbox-lite-root.target"];
+        wantedBy = ["podman-compose-seedbox-lite-root.target"];
+      };
+
+      # Volumes
+      systemd.services."podman-volume-seedbox-lite_seedbox_cache" = {
+        path = [pkgs.podman];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+        script = ''
+          podman volume inspect seedbox-lite_seedbox_cache || podman volume create seedbox-lite_seedbox_cache --driver=local
+        '';
+        partOf = ["podman-compose-seedbox-lite-root.target"];
+        wantedBy = ["podman-compose-seedbox-lite-root.target"];
+      };
+      systemd.services."podman-volume-seedbox-lite_seedbox_data" = {
+        path = [pkgs.podman];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+        script = ''
+          podman volume inspect seedbox-lite_seedbox_data || podman volume create seedbox-lite_seedbox_data --driver=local
+        '';
+        partOf = ["podman-compose-seedbox-lite-root.target"];
+        wantedBy = ["podman-compose-seedbox-lite-root.target"];
+      };
+
+      # Builds
+      systemd.services."podman-build-seedbox-backend" = {
+        path = [pkgs.podman pkgs.git];
+        serviceConfig = {
+          Type = "oneshot";
+          TimeoutSec = 300;
+        };
+        script = ''
+          cd /home/muon/projects/seedbox-lite/server
+          podman build -t compose2nix/seedbox-backend .
+        '';
+      };
+      systemd.services."podman-build-seedbox-frontend" = {
+        path = [pkgs.podman pkgs.git];
+        serviceConfig = {
+          Type = "oneshot";
+          TimeoutSec = 300;
+        };
+        script = ''
+          cd /tmp
+          git clone https://github.com/hotheadhacker/seedbox-lite.git
+          cd seedbox-lite/client
+          podman build -t compose2nix/seedbox-frontend --build-arg VITE_API_BASE_URL=http://localhost:${backend-port} .
+        '';
+      };
+
+      # Root service
+      # When started, this will automatically create all resources and start
+      # the containers. When stopped, this will teardown all resources.
+      systemd.targets."podman-compose-seedbox-lite-root" = {
+        unitConfig = {
+          Description = "Root target generated by compose2nix.";
+        };
+        wantedBy = ["multi-user.target"];
+      };
+    };
+  }