moved service config out of host namespace

README.md

@@ -51,7 +51,6 @@ nix multi user, multi system, configuration with `sops` secret management, `home
 - syncthing folder passwords
 - nfs export should be backed by the same values for server and client
 - move fail2ban configs out of fail2ban.nix and into configs for their respective services
-- move extra custom configuration for services out of host config and instead extend services
 ## New Features
 - offline access for nfs mounts (overlay with rsync might be a good option here? https://www.spinics.net/lists/linux-unionfs/msg07105.html note about nfs4 and overlay fs)
 - samba mounts

configurations/nixos/defiant/configuration.nix

@@ -48,9 +48,6 @@
         ];
       };
     };
-    fail2ban = {
-      enable = true;
-    };
     network_storage = {
       enable = true;
       directories = [
@@ -74,7 +71,7 @@
           folder = "media";
           user = "jellyfin";
           group = "jellyfin_media";
-          bind = config.host.jellyfin.media_directory;
+          bind = config.services.jellyfin.media_directory;
         }
       ];
       nfs = {
@@ -94,19 +91,6 @@
         };
       };
     };
-    jellyfin = {
-      enable = true;
-      subdomain = "media";
-      extraSubdomains = ["jellyfin"];
-    };
-    forgejo = {
-      enable = true;
-      subdomain = "git";
-    };
-    searx = {
-      enable = true;
-      subdomain = "search";
-    };
     home-assistant = {
       enable = false;
       subdomain = "home";
@@ -114,10 +98,6 @@
     adguardhome = {
       enable = false;
     };
-    immich = {
-      enable = true;
-      subdomain = "photos";
-    };
     sync = {
       enable = true;
       folders = {
@@ -187,6 +167,29 @@
         "--accept-dns=false"
       ];
     };
+
+    fail2ban.enable = true;
+
+    jellyfin = {
+      enable = true;
+      subdomain = "media";
+      extraSubdomains = ["jellyfin"];
+    };
+
+    immich = {
+      enable = true;
+      subdomain = "photos";
+    };
+
+    forgejo = {
+      enable = true;
+      subdomain = "git";
+    };
+
+    searx = {
+      enable = true;
+      subdomain = "search";
+    };
   };
 
   # disable computer sleeping

modules/nixos-modules/server/fail2ban.nix

@@ -7,11 +7,7 @@
   dataFolder = "/var/lib/fail2ban";
   dataFile = "fail2ban.sqlite3";
 in {
-  options.host.fail2ban = {
+  config = lib.mkIf config.services.fail2ban.enable (lib.mkMerge [
-    enable = lib.mkEnableOption "should fail 2 ban be enabled on this server";
-  };
-
-  config = lib.mkIf config.host.fail2ban.enable (lib.mkMerge [
     {
       environment.etc = {
         "fail2ban/filter.d/nginx.local".text = lib.mkIf config.services.nginx.enable (
@@ -37,7 +33,6 @@ in {
       };
 
       services.fail2ban = {
-        enable = true;
         maxretry = 5;
         ignoreIP = [
           # Whitelist local networks
@@ -90,8 +85,6 @@ in {
       ];
 
       environment.persistence."/persist/system/root" = {
-        enable = true;
-        hideMounts = true;
         directories = [
           {
             directory = dataFolder;

modules/nixos-modules/server/forgejo.nix

@@ -9,8 +9,7 @@
   db_user = "forgejo";
   sshPort = 22222;
 in {
-  options.host.forgejo = {
+  options.services.forgejo = {
-    enable = lib.mkEnableOption "should forgejo be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that forgejo will be hosted at";
@@ -18,10 +17,10 @@ in {
     };
   };
 
-  config = lib.mkIf config.host.forgejo.enable (lib.mkMerge [
+  config = lib.mkIf config.services.forgejo.enable (lib.mkMerge [
     {
       host = {
-        reverse_proxy.subdomains.${config.host.forgejo.subdomain} = {
+        reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
           target = "http://localhost:${toString forgejoPort}";
         };
         postgres = {
@@ -34,9 +33,7 @@ in {
         };
       };
 
-      services = {
+      services.forgejo = {
-        forgejo = {
-          enable = true;
         database = {
           type = "postgres";
           socket = "/run/postgresql";
@@ -44,7 +41,7 @@ in {
         lfs.enable = true;
         settings = {
           server = {
-              DOMAIN = "${config.host.forgejo.subdomain}.${config.host.reverse_proxy.hostname}";
+            DOMAIN = "${config.services.forgejo.subdomain}.${config.host.reverse_proxy.hostname}";
             HTTP_PORT = forgejoPort;
             START_SSH_SERVER = true;
             SSH_LISTEN_PORT = sshPort;
@@ -62,7 +59,6 @@ in {
           };
         };
       };
-      };
 
       networking.firewall.allowedTCPPorts = [
         config.services.forgejo.settings.server.SSH_LISTEN_PORT

modules/nixos-modules/server/immich.nix

@@ -6,8 +6,7 @@
 }: let
   mediaLocation = "/var/lib/immich";
 in {
-  options.host.immich = {
+  options.services.immich = {
-    enable = lib.mkEnableOption "should immich be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that immich will be hosted at";
@@ -15,10 +14,10 @@ in {
     };
   };
 
-  config = lib.mkIf config.host.immich.enable (lib.mkMerge [
+  config = lib.mkIf config.services.immich.enable (lib.mkMerge [
     {
       host = {
-        reverse_proxy.subdomains.${config.host.immich.subdomain} = {
+        reverse_proxy.subdomains.${config.services.immich.subdomain} = {
           target = "http://localhost:${toString config.services.immich.port}";
 
           websockets.enable = true;
@@ -45,12 +44,6 @@ in {
         };
       };
 
-      services.immich = {
-        enable = true;
-        port = 2283;
-        # redis.enable = false;
-      };
-
       networking.firewall.interfaces.${config.services.tailscale.interfaceName} = {
         allowedUDPPorts = [
           config.services.immich.port
@@ -89,8 +82,6 @@ in {
         }
       ];
       environment.persistence."/persist/system/root" = {
-        enable = true;
-        hideMounts = true;
         directories = [
           {
             directory = mediaLocation;

modules/nixos-modules/server/jellyfin.nix

@@ -8,8 +8,7 @@
   jellyfin_data_directory = "/var/lib/jellyfin";
   jellyfin_cache_directory = "/var/cache/jellyfin";
 in {
-  options.host.jellyfin = {
+  options.services.jellyfin = {
-    enable = lib.mkEnableOption "should jellyfin be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that jellyfin will be hosted at";
@@ -27,16 +26,14 @@ in {
     };
   };
 
-  config = lib.mkIf config.host.jellyfin.enable (
+  config = lib.mkIf config.services.jellyfin.enable (
     lib.mkMerge [
       {
-        services.jellyfin.enable = true;
-
         host.reverse_proxy.subdomains.jellyfin = {
           target = "http://localhost:${toString jellyfinPort}";
 
-          subdomain = config.host.jellyfin.subdomain;
+          subdomain = config.services.jellyfin.subdomain;
-          extraSubdomains = config.host.jellyfin.extraSubdomains;
+          extraSubdomains = config.services.jellyfin.extraSubdomains;
 
           forwardHeaders.enable = true;
 
@@ -107,8 +104,6 @@ in {
 
         environment.persistence = {
           "/persist/system/root" = {
-            enable = true;
-            hideMounts = true;
             directories = [
               {
                 directory = jellyfin_data_directory;
@@ -128,7 +123,7 @@ in {
             hideMounts = true;
             directories = [
               {
-                directory = config.host.jellyfin.media_directory;
+                directory = config.services.jellyfin.media_directory;
                 user = "jellyfin";
                 group = "jellyfin_media";
                 mode = "1770";

modules/nixos-modules/server/searx.nix

@@ -4,8 +4,7 @@
   inputs,
   ...
 }: {
-  options.host.searx = {
+  options.services.searx = {
-    enable = lib.mkEnableOption "should searx be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that searx will be hosted at";
@@ -13,7 +12,7 @@
     };
   };
 
-  config = lib.mkIf config.host.searx.enable {
+  config = lib.mkIf config.services.searx.enable {
     sops.secrets = {
       "services/searx" = {
         sopsFile = "${inputs.secrets}/defiant-services.yaml";
@@ -21,13 +20,11 @@
     };
     host = {
       reverse_proxy.subdomains.searx = {
-        subdomain = config.host.searx.subdomain;
+        subdomain = config.services.searx.subdomain;
         target = "http://localhost:${toString config.services.searx.settings.server.port}";
       };
     };
-    services = {
+    services.searx = {
-      searx = {
-        enable = true;
       environmentFile = config.sops.secrets."services/searx".path;
 
       # Rate limiting
@@ -72,5 +69,4 @@
       };
     };
   };
-  };
 }