moved service config out of host namespace

README.md

@@ -51,7 +51,6 @@ nix multi user, multi system, configuration with `sops` secret management, `home
 - syncthing folder passwords
 - nfs export should be backed by the same values for server and client
 - move fail2ban configs out of fail2ban.nix and into configs for their respective services
-- move extra custom configuration for services out of host config and instead extend services
 ## New Features
 - offline access for nfs mounts (overlay with rsync might be a good option here? https://www.spinics.net/lists/linux-unionfs/msg07105.html note about nfs4 and overlay fs)
 - samba mounts

configurations/nixos/defiant/configuration.nix

@@ -48,9 +48,6 @@
         ];
       };
     };
-    fail2ban = {
-      enable = true;
-    };
     network_storage = {
       enable = true;
       directories = [
@@ -74,7 +71,7 @@
           folder = "media";
           user = "jellyfin";
           group = "jellyfin_media";
-          bind = config.host.jellyfin.media_directory;
+          bind = config.services.jellyfin.media_directory;
         }
       ];
       nfs = {
@@ -94,19 +91,6 @@
         };
       };
     };
-    jellyfin = {
-      enable = true;
-      subdomain = "media";
-      extraSubdomains = ["jellyfin"];
-    };
-    forgejo = {
-      enable = true;
-      subdomain = "git";
-    };
-    searx = {
-      enable = true;
-      subdomain = "search";
-    };
     home-assistant = {
       enable = false;
       subdomain = "home";
@@ -114,10 +98,6 @@
     adguardhome = {
       enable = false;
     };
-    immich = {
-      enable = true;
-      subdomain = "photos";
-    };
     sync = {
       enable = true;
       folders = {
@@ -187,6 +167,29 @@
         "--accept-dns=false"
       ];
     };
+
+    fail2ban.enable = true;
+
+    jellyfin = {
+      enable = true;
+      subdomain = "media";
+      extraSubdomains = ["jellyfin"];
+    };
+
+    immich = {
+      enable = true;
+      subdomain = "photos";
+    };
+
+    forgejo = {
+      enable = true;
+      subdomain = "git";
+    };
+
+    searx = {
+      enable = true;
+      subdomain = "search";
+    };
   };
 
   # disable computer sleeping

modules/nixos-modules/server/fail2ban.nix

@@ -7,11 +7,7 @@
   dataFolder = "/var/lib/fail2ban";
   dataFile = "fail2ban.sqlite3";
 in {
-  options.host.fail2ban = {
+  config = lib.mkIf config.services.fail2ban.enable (lib.mkMerge [
-    enable = lib.mkEnableOption "should fail 2 ban be enabled on this server";
-  };
-
-  config = lib.mkIf config.host.fail2ban.enable (lib.mkMerge [
     {
       environment.etc = {
         "fail2ban/filter.d/nginx.local".text = lib.mkIf config.services.nginx.enable (
@@ -37,7 +33,6 @@ in {
       };
 
       services.fail2ban = {
-        enable = true;
         maxretry = 5;
         ignoreIP = [
           # Whitelist local networks
@@ -90,8 +85,6 @@ in {
       ];
 
       environment.persistence."/persist/system/root" = {
-        enable = true;
-        hideMounts = true;
         directories = [
           {
             directory = dataFolder;

modules/nixos-modules/server/forgejo.nix

@@ -9,8 +9,7 @@
   db_user = "forgejo";
   sshPort = 22222;
 in {
-  options.host.forgejo = {
+  options.services.forgejo = {
-    enable = lib.mkEnableOption "should forgejo be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that forgejo will be hosted at";
@@ -18,10 +17,10 @@ in {
     };
   };
 
-  config = lib.mkIf config.host.forgejo.enable (lib.mkMerge [
+  config = lib.mkIf config.services.forgejo.enable (lib.mkMerge [
     {
       host = {
-        reverse_proxy.subdomains.${config.host.forgejo.subdomain} = {
+        reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
           target = "http://localhost:${toString forgejoPort}";
         };
         postgres = {
@@ -34,32 +33,29 @@ in {
         };
       };
 
-      services = {
+      services.forgejo = {
-        forgejo = {
+        database = {
-          enable = true;
+          type = "postgres";
-          database = {
+          socket = "/run/postgresql";
-            type = "postgres";
+        };
-            socket = "/run/postgresql";
+        lfs.enable = true;
+        settings = {
+          server = {
+            DOMAIN = "${config.services.forgejo.subdomain}.${config.host.reverse_proxy.hostname}";
+            HTTP_PORT = forgejoPort;
+            START_SSH_SERVER = true;
+            SSH_LISTEN_PORT = sshPort;
+            SSH_PORT = 22;
+            BUILTIN_SSH_SERVER_USER = config.users.users.git.name;
+            ROOT_URL = "https://git.jan-leila.com";
           };
-          lfs.enable = true;
+          service = {
-          settings = {
+            DISABLE_REGISTRATION = true;
-            server = {
+          };
-              DOMAIN = "${config.host.forgejo.subdomain}.${config.host.reverse_proxy.hostname}";
+          database = {
-              HTTP_PORT = forgejoPort;
+            DB_TYPE = "postgres";
-              START_SSH_SERVER = true;
+            NAME = db_user;
-              SSH_LISTEN_PORT = sshPort;
+            USER = db_user;
-              SSH_PORT = 22;
-              BUILTIN_SSH_SERVER_USER = config.users.users.git.name;
-              ROOT_URL = "https://git.jan-leila.com";
-            };
-            service = {
-              DISABLE_REGISTRATION = true;
-            };
-            database = {
-              DB_TYPE = "postgres";
-              NAME = db_user;
-              USER = db_user;
-            };
           };
         };
       };

modules/nixos-modules/server/immich.nix

@@ -6,8 +6,7 @@
 }: let
   mediaLocation = "/var/lib/immich";
 in {
-  options.host.immich = {
+  options.services.immich = {
-    enable = lib.mkEnableOption "should immich be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that immich will be hosted at";
@@ -15,10 +14,10 @@ in {
     };
   };
 
-  config = lib.mkIf config.host.immich.enable (lib.mkMerge [
+  config = lib.mkIf config.services.immich.enable (lib.mkMerge [
     {
       host = {
-        reverse_proxy.subdomains.${config.host.immich.subdomain} = {
+        reverse_proxy.subdomains.${config.services.immich.subdomain} = {
           target = "http://localhost:${toString config.services.immich.port}";
 
           websockets.enable = true;
@@ -45,12 +44,6 @@ in {
         };
       };
 
-      services.immich = {
-        enable = true;
-        port = 2283;
-        # redis.enable = false;
-      };
-
       networking.firewall.interfaces.${config.services.tailscale.interfaceName} = {
         allowedUDPPorts = [
           config.services.immich.port
@@ -89,8 +82,6 @@ in {
         }
       ];
       environment.persistence."/persist/system/root" = {
-        enable = true;
-        hideMounts = true;
         directories = [
           {
             directory = mediaLocation;

modules/nixos-modules/server/jellyfin.nix

@@ -8,8 +8,7 @@
   jellyfin_data_directory = "/var/lib/jellyfin";
   jellyfin_cache_directory = "/var/cache/jellyfin";
 in {
-  options.host.jellyfin = {
+  options.services.jellyfin = {
-    enable = lib.mkEnableOption "should jellyfin be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that jellyfin will be hosted at";
@@ -27,16 +26,14 @@ in {
     };
   };
 
-  config = lib.mkIf config.host.jellyfin.enable (
+  config = lib.mkIf config.services.jellyfin.enable (
     lib.mkMerge [
       {
-        services.jellyfin.enable = true;
-
         host.reverse_proxy.subdomains.jellyfin = {
           target = "http://localhost:${toString jellyfinPort}";
 
-          subdomain = config.host.jellyfin.subdomain;
+          subdomain = config.services.jellyfin.subdomain;
-          extraSubdomains = config.host.jellyfin.extraSubdomains;
+          extraSubdomains = config.services.jellyfin.extraSubdomains;
 
           forwardHeaders.enable = true;
 
@@ -107,8 +104,6 @@ in {
 
         environment.persistence = {
           "/persist/system/root" = {
-            enable = true;
-            hideMounts = true;
             directories = [
               {
                 directory = jellyfin_data_directory;
@@ -128,7 +123,7 @@ in {
             hideMounts = true;
             directories = [
               {
-                directory = config.host.jellyfin.media_directory;
+                directory = config.services.jellyfin.media_directory;
                 user = "jellyfin";
                 group = "jellyfin_media";
                 mode = "1770";

modules/nixos-modules/server/searx.nix

@@ -4,8 +4,7 @@
   inputs,
   ...
 }: {
-  options.host.searx = {
+  options.services.searx = {
-    enable = lib.mkEnableOption "should searx be enabled on this computer";
     subdomain = lib.mkOption {
       type = lib.types.str;
       description = "subdomain of base domain that searx will be hosted at";
@@ -13,7 +12,7 @@
     };
   };
 
-  config = lib.mkIf config.host.searx.enable {
+  config = lib.mkIf config.services.searx.enable {
     sops.secrets = {
       "services/searx" = {
         sopsFile = "${inputs.secrets}/defiant-services.yaml";
@@ -21,56 +20,53 @@
     };
     host = {
       reverse_proxy.subdomains.searx = {
-        subdomain = config.host.searx.subdomain;
+        subdomain = config.services.searx.subdomain;
         target = "http://localhost:${toString config.services.searx.settings.server.port}";
       };
     };
-    services = {
+    services.searx = {
-      searx = {
+      environmentFile = config.sops.secrets."services/searx".path;
-        enable = true;
-        environmentFile = config.sops.secrets."services/searx".path;
 
-        # Rate limiting
+      # Rate limiting
-        limiterSettings = {
+      limiterSettings = {
-          real_ip = {
+        real_ip = {
-            x_for = 1;
+          x_for = 1;
-            ipv4_prefix = 32;
+          ipv4_prefix = 32;
-            ipv6_prefix = 56;
+          ipv6_prefix = 56;
-          };
-
-          botdetection = {
-            ip_limit = {
-              filter_link_local = true;
-              link_token = true;
-            };
-          };
         };
 
-        settings = {
+        botdetection = {
-          server = {
+          ip_limit = {
-            port = 8083;
+            filter_link_local = true;
-            secret_key = "@SEARXNG_SECRET@";
+            link_token = true;
           };
-
-          # Search engine settings
-          search = {
-            safe_search = 2;
-            autocomplete_min = 2;
-            autocomplete = "duckduckgo";
-          };
-
-          # Enabled plugins
-          enabled_plugins = [
-            "Basic Calculator"
-            "Hash plugin"
-            "Tor check plugin"
-            "Open Access DOI rewrite"
-            "Hostnames plugin"
-            "Unit converter plugin"
-            "Tracker URL remover"
-          ];
         };
       };
+
+      settings = {
+        server = {
+          port = 8083;
+          secret_key = "@SEARXNG_SECRET@";
+        };
+
+        # Search engine settings
+        search = {
+          safe_search = 2;
+          autocomplete_min = 2;
+          autocomplete = "duckduckgo";
+        };
+
+        # Enabled plugins
+        enabled_plugins = [
+          "Basic Calculator"
+          "Hash plugin"
+          "Tor check plugin"
+          "Open Access DOI rewrite"
+          "Hostnames plugin"
+          "Unit converter plugin"
+          "Tracker URL remover"
+        ];
+      };
     };
   };
 }