README.md

@@ -43,6 +43,7 @@ nix multi user, multi system, configuration with `sops` secret management, `home
 - Look into this for auto rotating sops keys `https://technotim.live/posts/rotate-sops-encryption-keys/`
 - Look into this for npins https://jade.fyi/blog/pinning-nixos-with-npins/
 - https://nixos-and-flakes.thiscute.world/
+- nix config mcp https://github.com/utensils/mcp-nixos
 
 # Tasks:
 
@@ -69,4 +70,4 @@ nix multi user, multi system, configuration with `sops` secret management, `home
 - ISO target that contains authorized keys for nixos-anywhere https://github.com/diegofariasm/yggdrasil/blob/4acc43ebc7bcbf2e41376d14268e382007e94d78/hosts/bootstrap/default.nix
 - panoramax instance
 - mastodon instance
-- move searx, home-assistant, actual, jellyfin, paperless, and immich to only be accessible via vpn
+- move searx, jellyfin, paperless, and immich to only be accessible via vpn

modules/nixos-modules/server/actual/default.nix

@@ -12,6 +12,14 @@ in {
     ./impermanence.nix
   ];
 
+  options.services.actual = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      default = "actual";
+      description = "subdomain of base domain that actual will be hosted at";
+    };
+  };
+
   config = lib.mkIf config.services.actual.enable {
     systemd.tmpfiles.rules = [
       "d ${dataDirectory} 2770 actual actual"

modules/nixos-modules/server/actual/proxy.nix

@@ -3,14 +3,6 @@
   config,
   ...
 }: {
-  options.services.actual = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      default = "actual";
-      description = "subdomain of base domain that actual will be hosted at";
-    };
-  };
-
   config = lib.mkIf (config.services.actual.enable && config.host.reverse_proxy.enable) {
     host = {
       reverse_proxy.subdomains.${config.services.actual.subdomain} = {

modules/nixos-modules/server/forgejo/default.nix

@@ -15,6 +15,14 @@ in {
     ./impermanence.nix
   ];
 
+  options.services.forgejo = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that forgejo will be hosted at";
+      default = "forgejo";
+    };
+  };
+
   config = lib.mkIf config.services.forgejo.enable {
     assertions = [
       {

modules/nixos-modules/server/forgejo/proxy.nix

@@ -6,14 +6,6 @@
   const = import ./const.nix;
   httpPort = const.httpPort;
 in {
-  options.services.forgejo = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that forgejo will be hosted at";
-      default = "forgejo";
-    };
-  };
-
   config = lib.mkIf (config.services.forgejo.enable && config.host.reverse_proxy.enable) {
     host.reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
       target = "http://localhost:${toString httpPort}";

modules/nixos-modules/server/home-assistant/default.nix

@@ -12,6 +12,12 @@
   ];
 
   options.services.home-assistant = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that home-assistant will be hosted at";
+      default = "home-assistant";
+    };
+
     database = lib.mkOption {
       type = lib.types.enum [
         "builtin"

modules/nixos-modules/server/home-assistant/proxy.nix

@@ -2,32 +2,23 @@
   lib,
   config,
   ...
-}: {
-  options.services.home-assistant = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that home-assistant will be hosted at";
-      default = "home-assistant";
-    };
-  };
+}:
+lib.mkIf (config.host.reverse_proxy.enable && config.services.home-assistant.enable) {
+  host = {
+    reverse_proxy.subdomains.${config.services.home-assistant.subdomain} = {
+      target = "http://localhost:${toString config.services.home-assistant.config.http.server_port}";
 
-  config = lib.mkIf (config.host.reverse_proxy.enable && config.services.home-assistant.enable) {
-    host = {
-      reverse_proxy.subdomains.${config.services.home-assistant.subdomain} = {
-        target = "http://localhost:${toString config.services.home-assistant.config.http.server_port}";
+      websockets.enable = true;
+      forwardHeaders.enable = true;
 
-        websockets.enable = true;
-        forwardHeaders.enable = true;
+      extraConfig = ''
+        add_header Upgrade $http_upgrade;
+        add_header Connection \"upgrade\";
 
-        extraConfig = ''
-          add_header Upgrade $http_upgrade;
-          add_header Connection \"upgrade\";
+        proxy_buffering off;
 
-          proxy_buffering off;
-
-          proxy_read_timeout 90;
-        '';
-      };
+        proxy_read_timeout 90;
+      '';
     };
   };
 }

modules/nixos-modules/server/immich/default.nix

@@ -1,4 +1,4 @@
-{...}: {
+{lib, ...}: {
   imports = [
     ./proxy.nix
     ./database.nix
@@ -6,6 +6,14 @@
     ./impermanence.nix
   ];
 
+  options.services.immich = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that immich will be hosted at";
+      default = "immich";
+    };
+  };
+
   # NOTE: This shouldn't be needed now that we are out of testing
   # config = lib.mkIf config.services.immich.enable {
   #   networking.firewall.interfaces.${config.services.tailscale.interfaceName} = {

modules/nixos-modules/server/immich/proxy.nix

@@ -3,14 +3,6 @@
   config,
   ...
 }: {
-  options.services.immich = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that immich will be hosted at";
-      default = "immich";
-    };
-  };
-
   config = lib.mkIf (config.services.immich.enable && config.host.reverse_proxy.enable) {
     host = {
       reverse_proxy.subdomains.${config.services.immich.subdomain} = {

modules/nixos-modules/server/jellyfin/default.nix

@@ -14,6 +14,16 @@ in {
   ];
 
   options.services.jellyfin = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that jellyfin will be hosted at";
+      default = "jellyfin";
+    };
+    extraSubdomains = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "ex subdomain of base domain that jellyfin will be hosted at";
+      default = [];
+    };
     media_directory = lib.mkOption {
       type = lib.types.str;
       description = "directory jellyfin media will be hosted at";

modules/nixos-modules/server/jellyfin/proxy.nix

@@ -5,19 +5,6 @@
 }: let
   jellyfinPort = 8096;
 in {
-  options.services.jellyfin = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that jellyfin will be hosted at";
-      default = "jellyfin";
-    };
-    extraSubdomains = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      description = "ex subdomain of base domain that jellyfin will be hosted at";
-      default = [];
-    };
-  };
-
   config = lib.mkIf (config.services.jellyfin.enable && config.host.reverse_proxy.enable) {
     host.reverse_proxy.subdomains.jellyfin = {
       target = "http://localhost:${toString jellyfinPort}";

modules/nixos-modules/server/panoramax/default.nix

@@ -57,6 +57,12 @@ in {
       description = "The panoramax package to use";
     };
 
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that panoramax will be hosted at";
+      default = "panoramax";
+    };
+
     database = {
       createDB = mkOption {
         type = types.bool;

modules/nixos-modules/server/panoramax/proxy.nix

@@ -3,14 +3,6 @@
   config,
   ...
 }: {
-  options.services.panoramax = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that panoramax will be hosted at";
-      default = "panoramax";
-    };
-  };
-
   config = lib.mkIf (config.services.panoramax.enable && config.host.reverse_proxy.enable) {
     host = {
       reverse_proxy.subdomains.${config.services.panoramax.subdomain} = {

modules/nixos-modules/server/paperless/default.nix

@@ -11,6 +11,11 @@
   ];
 
   options.services.paperless = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that paperless will be hosted at";
+      default = "paperless";
+    };
     database = {
       user = lib.mkOption {
         type = lib.types.str;

modules/nixos-modules/server/paperless/proxy.nix

@@ -3,14 +3,6 @@
   lib,
   ...
 }: {
-  options.services.paperless = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that paperless will be hosted at";
-      default = "paperless";
-    };
-  };
-
   config = lib.mkIf (config.services.paperless.enable && config.host.reverse_proxy.enable) {
     host = {
       reverse_proxy.subdomains.${config.services.paperless.subdomain} = {

modules/nixos-modules/server/searx/default.nix

@@ -8,6 +8,14 @@
     ./proxy.nix
   ];
 
+  options.services.searx = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that searx will be hosted at";
+      default = "searx";
+    };
+  };
+
   config = lib.mkIf config.services.searx.enable {
     sops.secrets = {
       "services/searx" = {

modules/nixos-modules/server/searx/proxy.nix

@@ -3,14 +3,6 @@
   lib,
   ...
 }: {
-  options.services.searx = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      description = "subdomain of base domain that searx will be hosted at";
-      default = "searx";
-    };
-  };
-
   config = lib.mkIf (config.services.searx.enable && config.host.reverse_proxy.enable) {
     host = {
       reverse_proxy.subdomains.searx = {