Lithospherical/nix-config
1
0
Fork 0
forked from jan-leila/nix-config
Code Pull requests Activity

main #5

Merged
Lithospherical merged 59 commits from jan-leila/nix-config:main into main 2025-08-27 15:36:39 +00:00
Conversation 0 Commits 59 Files changed 62 +64 -21
6 changed files with 64 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit c8f163ed0c - Show all commits

9
configurations/nixos/defiant/configuration.nix
View file

@ -17,6 +17,12 @@
"services/zfs_smtp_token" = { "services/zfs_smtp_token" = {
sopsFile = "${inputs.secrets}/defiant-services.yaml"; sopsFile = "${inputs.secrets}/defiant-services.yaml";
}; };
"services/paperless_password" = {
sopsFile = "${inputs.secrets}/defiant-services.yaml";
mode = "0700";
owner = "paperless";
group = "paperless";
};
}; };
host = { host = {
@ -289,8 +295,9 @@
}; };
paperless = { paperless = {
enable = false; enable = true;
subdomain = "documents"; subdomain = "documents";
passwordFile = config.sops.secrets."services/paperless_password".path;
}; };
qbittorrent = { qbittorrent = {

26
flake.lock generated
View file

@ -28,11 +28,11 @@
}, },
"locked": { "locked": {
"dir": "pkgs/firefox-addons", "dir": "pkgs/firefox-addons",
"lastModified": 1752269946, "lastModified": 1752379414,
"narHash": "sha256-vL26J2f9uXvwBNkfwYH1v75VwN22ZLhBcyZeenJwnCU=", "narHash": "sha256-0R3slhrjrnzyxR/fAYy5UliZvSgaVS38YCESBdH5RJw=",
"owner": "rycee", "owner": "rycee",
"repo": "nur-expressions", "repo": "nur-expressions",
"rev": "9885400dbd82f9b2970b30e18f233404416f7cca", "rev": "51e77bb95540b7dd6c60f8fd65a0c472a2c9c3b7",
"type": "gitlab" "type": "gitlab"
}, },
"original": { "original": {
@ -115,11 +115,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1752265577, "lastModified": 1752467539,
"narHash": "sha256-YhnBM3oknReSFTAuc2SMwekwjl9nDd5PUhcar4DsefM=", "narHash": "sha256-4kaR+xmng9YPASckfvIgl5flF/1nAZOplM+Wp9I5SMI=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "3976e0507edc9a5f332cb2be93fa20e646d22374", "rev": "1e54837569e0b80797c47be4720fab19e0db1616",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -227,11 +227,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1752200230, "lastModified": 1752459325,
"narHash": "sha256-WqqWjRX4qZYqO/cgvU/ZEzJBQqHBi17OEVv2kt05WiU=", "narHash": "sha256-46TgjdxT02a4nFd9HCXCf8kK5ZSH7r9gYROLtc8zVOg=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nix-vscode-extensions", "repo": "nix-vscode-extensions",
"rev": "3c866dfb70d282247452742098d315b97df713d2", "rev": "61c2e99ebd586f463a6c0ebe3d931e74883b163d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -293,11 +293,11 @@
"secrets": { "secrets": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1749061163, "lastModified": 1752531440,
"narHash": "sha256-WflcbitH7ErNZBFqZCdy1ODUqKF51xbu2zYfqA35+1M=", "narHash": "sha256-04tQ3EUrtmZ7g6fVUkZC4AbAG+Z7lng79qU3jsiqWJY=",
"ref": "refs/heads/main", "ref": "refs/heads/main",
"rev": "1c5c059c0c7b6ce691993262fe10a2b63e1c31ba", "rev": "f016767c13aa36dde91503f7a9f01bdd02468045",
"revCount": 19, "revCount": 20,
"type": "git", "type": "git",
"url": "ssh://git@git.jan-leila.com/jan-leila/nix-config-secrets.git" "url": "ssh://git@git.jan-leila.com/jan-leila/nix-config-secrets.git"
}, },

6
modules/nixos-modules/server/forgejo.nix
View file

@ -28,6 +28,12 @@ in {
extraUsers = { extraUsers = {
${db_user} = { ${db_user} = {
isClient = true; isClient = true;
createUser = true;
};
};
extraDatabases = {
${db_user} = {
name = db_user;
}; };
}; };
}; };

4
modules/nixos-modules/server/jellyfin.nix
View file

@ -55,7 +55,7 @@ in {
} }
(lib.mkIf config.services.fail2ban.enable { (lib.mkIf config.services.fail2ban.enable {
environment.etc = { environment.etc = {
"fail2ban/filter.d/jellyfin.local".text = lib.mkIf config.services.jellyfin.enable ( "fail2ban/filter.d/jellyfin.local".text = (
pkgs.lib.mkDefault (pkgs.lib.mkAfter '' pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition] [Definition]
failregex = "^.*Authentication request for .* has been denied \\\(IP: \"<ADDR>\"\\\)\\\." failregex = "^.*Authentication request for .* has been denied \\\(IP: \"<ADDR>\"\\\)\\\."
@ -65,7 +65,7 @@ in {
services.fail2ban = { services.fail2ban = {
jails = { jails = {
jellyfin-iptables.settings = lib.mkIf config.services.jellyfin.enable { jellyfin-iptables.settings = {
enabled = true; enabled = true;
filter = "jellyfin"; filter = "jellyfin";
action = ''iptables-multiport[name=HTTP, port="http,https"]''; action = ''iptables-multiport[name=HTTP, port="http,https"]'';

38
modules/nixos-modules/server/paperless.nix
View file

@ -1,6 +1,7 @@
{ {
config, config,
lib, lib,
pkgs,
... ...
}: let }: let
dataDir = "/var/lib/paperless"; dataDir = "/var/lib/paperless";
@ -24,7 +25,7 @@ in {
{ {
host = { host = {
reverse_proxy.subdomains.${config.services.paperless.subdomain} = { reverse_proxy.subdomains.${config.services.paperless.subdomain} = {
target = "http://${config.services.paperless.address}:${config.services.paperless.port}"; target = "http://${config.services.paperless.address}:${toString config.services.paperless.port}";
websockets.enable = true; websockets.enable = true;
forwardHeaders.enable = true; forwardHeaders.enable = true;
@ -39,15 +40,20 @@ in {
extraUsers = { extraUsers = {
${config.services.paperless.database.user} = { ${config.services.paperless.database.user} = {
isClient = true; isClient = true;
createUser = true;
};
};
extraDatabases = {
${config.services.paperless.database.user} = {
name = config.services.paperless.database.user;
}; };
}; };
}; };
}; };
services.paperless = { services.paperless = {
# TODO: configure passwordFile with sops
configureTika = true; configureTika = true;
settings = { settings = {
PAPERLESS_URL = "${config.services.paperless.subdomain}.${config.host.reverse_proxy.hostname}"; PAPERLESS_URL = "https://${config.services.paperless.subdomain}.${config.host.reverse_proxy.hostname}";
PAPERLESS_DBENGINE = "postgresql"; PAPERLESS_DBENGINE = "postgresql";
PAPERLESS_DBHOST = "/run/postgresql"; PAPERLESS_DBHOST = "/run/postgresql";
@ -57,7 +63,31 @@ in {
}; };
} }
(lib.mkIf config.services.fail2ban.enable { (lib.mkIf config.services.fail2ban.enable {
# TODO: fail2ban config environment.etc = {
"fail2ban/filter.d/paperless.local".text = (
pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
failregex = Login failed for user `.*` from (?:IP|private IP) `<HOST>`\.$
ignoreregex =
'')
);
};
services.fail2ban = {
jails = {
paperless.settings = {
enabled = true;
filter = "paperless";
action = ''iptables-multiport[name=HTTP, port="http,https"]'';
logpath = "${config.services.paperless.dataDir}/log/*.log";
backend = "auto";
findtime = 600;
bantime = 600;
maxretry = 5;
};
};
};
}) })
(lib.mkIf config.host.impermanence.enable { (lib.mkIf config.host.impermanence.enable {
assertions = [ assertions = [

2
nix-config-secrets

@ -1 +1 @@
Subproject commit 1c5c059c0c7b6ce691993262fe10a2b63e1c31ba Subproject commit f016767c13aa36dde91503f7a9f01bdd02468045