Merge branch 'vps' of codeberg.org:muon/home into vps

modules/nixos/server/containers/default.nix

@@ -22,6 +22,22 @@
       externalInterface = "enp0s31f6";
     };
     networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
+    networking = {
+      bridges.br0.interfaces = [ "enp0s31f6" ]; # Adjust interface accordingly
+  
+      # Get bridge-ip with DHCP
+      useDHCP = false;
+      interfaces."br0".useDHCP = true;
+
+      # Set bridge-ip static
+      interfaces."br0".ipv4.addresses = [{
+        address = "192.168.1.171";
+        prefixLength = 24;
+      }];
+
+      defaultGateway = "192.168.1.1";
+      nameservers = [ "192.168.1.1" ];
+    };
 
     # networking.firewall.allowedTCPPorts = [ 4713 6000 ];
     # hardware.pulseaudio = {

modules/nixos/server/containers/steam.nix

@@ -18,8 +18,10 @@ in {
 
     containers.steam = {
       privateNetwork = true;
-      hostAddress = "192.168.100.10";
-      localAddress = "192.168.100.11";
+      # hostAddress = "192.168.100.10";
+      # localAddress = "192.168.100.11";
+      # hostBridge = "br0"; # Specify the bridge name
+      # localAddress = "192.168.1.171/24";
 
       bindMounts = {
         "/home/steam/.steam/steam/steamapps/common/SMITE" = {
@@ -48,7 +50,6 @@ in {
             "steam-run"
           ];
 
-
         programs.steam = {
           enable = true;
           remotePlay.openFirewall = true;
@@ -64,6 +65,8 @@ in {
           glxinfo
           wget
           bottles
+          ungoogled-chromium
+          zellij
 
           openbox
           steam-xinit
@@ -109,6 +112,14 @@ in {
           initialPassword = "changeme";
         };
 
+        networking = {
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
+        };
+    
+        services.resolved.enable = true;
+
         system.stateVersion = "23.11";
       };
     };

modules/nixos/server/default.nix

@@ -2,8 +2,10 @@
   imports = [
     ./containers
     ./gaming
+    ./docker
 
     ./media.nix
     ./sync.nix
+    ./wireguard.nix
   ];
 }

modules/nixos/server/docker/default.nix

@@ -0,0 +1,32 @@
+{ pkgs, lib, config, ... }: {
+  imports = [
+    ./media.nix
+  ];
+
+  options.mods.docker = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables docker containers";
+    };
+  };
+
+  config = lib.mkIf config.mods.docker.enable {
+    environment.systemPackages = [
+      pkgs.arion
+
+       # Do install the docker CLI to talk to podman.
+       # Not needed when virtualisation.docker.enable = true;
+      pkgs.docker-client
+    ];
+
+    # Arion works with Docker, but for NixOS-based containers, you need Podman
+    # since NixOS 21.05.
+    virtualisation.docker.enable = false;
+    virtualisation.podman.enable = true;
+    virtualisation.podman.dockerSocket.enable = true;
+    virtualisation.podman.defaultNetwork.dnsname.enable = true;
+
+    # Use your username instead of `myuser`
+    users.extraUsers.${config.mods.user.name}.extraGroups = ["podman"];
+  };
+}

modules/nixos/server/docker/media.nix

@@ -0,0 +1,30 @@
+{ pkgs, lib, config, ... }: {
+  options.mods.docker.media = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables docker containers for media server";
+    };
+  };
+
+  config = lib.mkIf config.mods.docker.media.enable {
+    # virtualisation.arion = {
+    #   backend = "docker";
+    #   projects = {
+    #     "hyperpipe".settings.services = {
+    #       "hyperpipe-frontend".service = {
+    #         image = "codeberg.org/hyperpipe/hyperpipe:latest";
+    #         container-name = "hyperpipe-frontend";
+    #         restart = "unless-stopped";
+    #         ports = ["8080:80"];
+    #       };
+    #       "hyperpipe-backend".service = {
+    #         image = "codeberg.org/hyperpipe/hyperpipe:latest";
+    #         container_name = "hyperpipe-backend";
+    #         restart = "unless-stopped";
+    #         ports = ["3000:3000"];
+    #       };
+    #     };
+    #   };
+    # };
+  };
+}

modules/nixos/server/gaming/astral.nix

@@ -20,6 +20,10 @@ in {
       default = "4G";
       description = "server detitated wam";
     };
+    autoStart = lib.mkEnableOption {
+      default = true;
+      description = "start server on boot";
+    };
   };
 
   config = lib.mkIf config.mods.server.astral.enable {
@@ -28,6 +32,7 @@ in {
       serverProperties = {
         online-mode = true;
       };
+      autoStart = config.mods.server.astral.autoStart;
       jvmOpts = (import ./aikar-flags.nix) config.mods.server.astral.memory;
       package = pkgs.fabricServers.${serverVersion}.override {
         loaderVersion = fabricVersion;

modules/nixos/server/wireguard.nix

@@ -0,0 +1,45 @@
+{ pkgs, lib, config, ... }: {
+  options.mods.server.wireguard = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables wireguard server";
+    };
+  };
+
+
+  config = lib.mkIf config.mods.server.wireguard.enable {
+    networking.nat.enable = true;
+    networking.nat.externalInterface = "ens3";
+    networking.nat.internalInterfaces = [ "wg0" ];
+    networking.firewall = {
+      allowedUDPPorts = [ 51820 ];
+    };
+
+    networking.wireguard.interfaces = {
+      wg0 = {
+        ips = [ "10.100.0.1/24" ];
+
+        listenPort = 51820;
+
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+
+        # This undoes the above command
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+
+        privateKeyFile = "/home/muon/wireguard-keys/private";
+
+        peers = [
+          { 
+            publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg=";
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+
+  };
+}