feat: added per service enable options for impermanence configs

README.md

@@ -53,7 +53,6 @@ nix multi user, multi system, configuration with `sops` secret management, `home
 ## Tech Debt
 - [ ] monitor configuration in `~/.config/monitors.xml` should be sym linked to `/run/gdm/.config/monitors.xml` (https://www.reddit.com/r/NixOS/comments/u09cz9/home_manager_create_my_own_symlinks_automatically/)
 - [ ] migrate away from flakes and move to npins
-- [ ] rework the reverse_proxy.nix file so that it is a normally named service. Then also change it so that we can hook into it with both a base domain and a subdomain to make migrating to vpn accessible services easier
 
 ## Broken things
 - [ ] figure out steam vr things?
@@ -73,12 +72,13 @@ nix multi user, multi system, configuration with `sops` secret management, `home
 - [ ] offline access for nfs mounts (overlay with rsync might be a good option here? https://www.spinics.net/lists/linux-unionfs/msg07105.html note about nfs4 and overlay fs)
 - [ ] figure out why syncthing and jellyfins permissions don't propagate downwards
 - [ ] make radarr, sonarr, and bazarr accessible over vpn
-- [ ] move searx, home-assistant, actual, jellyfin, paperless, and immich to only be accessible via vpn
+- [ ] move searx, home-assistant, actual, vikunja, jellyfin, paperless, and immich to only be accessible via vpn
 
 ## Services
 - [ ] vikunja service for project management
 - [ ] Create Tor guard/relay server
 - [ ] mastodon instance
+- [ ] screeps server
 
 ## DevOps
 - [ ] wake on LAN for updates

configurations/nixos/defiant/configuration.nix

@@ -310,7 +310,7 @@
 
     forgejo = {
       enable = true;
-      domain = "git.jan-leila.com";
+      reverseProxy.domain = "git.jan-leila.com";
     };
 
     searx = {

modules/nixos-modules/server/actual/impermanence.nix

@@ -6,7 +6,14 @@
   const = import ./const.nix;
   dataDirectory = const.dataDirectory;
 in {
-  config = lib.mkIf (config.services.actual.enable && config.host.impermanence.enable) {
+  options.services.actual = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.actual.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.actual.impermanence.enable {
     assertions = [
       {
         assertion = config.services.actual.settings.ACTUAL_DATA_DIR == dataDirectory;

modules/nixos-modules/server/actual/proxy.nix

@@ -14,9 +14,13 @@
       description = "extra domains that should be configured for actual";
       default = [];
     };
+    reverseProxy.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.actual.enable && config.services.reverseProxy.enable;
+    };
   };
 
-  config = lib.mkIf (config.services.actual.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.actual.reverseProxy.enable {
     services.reverseProxy.services.actual = {
       target = "http://localhost:${toString config.services.actual.settings.port}";
       domain = config.services.actual.domain;

modules/nixos-modules/server/bazarr/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   bazarr_data_directory = "/var/lib/bazarr";
 in {
-  config = lib.mkIf (config.services.bazarr.enable && config.host.impermanence.enable) {
+  options.services.bazarr = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.bazarr.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.bazarr.impermanence.enable {
     assertions = [
       {
         assertion = config.services.bazarr.dataDir == bazarr_data_directory;

modules/nixos-modules/server/crab-hole/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   workingDirectory = "/var/lib/private/crab-hole";
 in {
-  config = lib.mkIf (config.services.crab-hole.enable && config.host.impermanence.enable) {
+  options.services.crab-hole = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.crab-hole.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.crab-hole.impermanence.enable {
     assertions = [
       {
         assertion =

modules/nixos-modules/server/fail2ban/impermanence.nix

@@ -6,7 +6,14 @@
   dataFolder = "/var/lib/fail2ban";
   dataFile = "fail2ban.sqlite3";
 in {
-  config = lib.mkIf (config.services.fail2ban.enable && config.host.impermanence.enable) {
+  options.services.fail2ban = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.fail2ban.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.fail2ban.impermanence.enable {
     assertions = [
       {
         assertion = config.services.fail2ban.daemonSettings.Definition.dbfile == "${dataFolder}/${dataFile}";

modules/nixos-modules/server/flaresolverr/impermanence.nix

@@ -3,7 +3,14 @@
   config,
   ...
 }: {
-  config = lib.mkIf (config.services.flaresolverr.enable && config.host.impermanence.enable) {
+  options.services.flaresolverr = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.flaresolverr.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.flaresolverr.impermanence.enable {
     # FlareSolverr typically doesn't need persistent storage as it's a proxy service
     # but we'll add basic structure in case it's needed for logs or configuration
     environment.persistence."/persist/system/root" = {

modules/nixos-modules/server/forgejo/fail2ban.nix

@@ -4,7 +4,16 @@
   pkgs,
   ...
 }: {
-  config = lib.mkIf (config.services.forgejo.enable && config.services.fail2ban.enable) {
+  options.services.forgejo = {
+    fail2ban = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.forgejo.enable && config.services.fail2ban.enable;
+      };
+    };
+  };
+
+  config = lib.mkIf config.services.forgejo.fail2ban.enable {
     environment.etc = {
       "fail2ban/filter.d/forgejo.local".text = lib.mkIf config.services.forgejo.enable (
         pkgs.lib.mkDefault (pkgs.lib.mkAfter ''

modules/nixos-modules/server/forgejo/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   stateDir = "/var/lib/forgejo";
 in {
-  config = lib.mkIf (config.services.forgejo.enable && config.host.impermanence.enable) {
+  options.services.forgejo = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.forgejo.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.forgejo.impermanence.enable {
     assertions = [
       {
         assertion = config.services.forgejo.stateDir == stateDir;

modules/nixos-modules/server/forgejo/proxy.nix

@@ -8,6 +8,10 @@
 in {
   options.services.forgejo = {
     reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.forgejo.enable && config.services.reverseProxy.enable;
+      };
       domain = lib.mkOption {
         type = lib.types.str;
         description = "domain that forgejo will be hosted at";
@@ -21,7 +25,7 @@ in {
     };
   };
 
-  config = lib.mkIf (config.services.forgejo.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.forgejo.reverseProxy.enable {
     services.reverseProxy.services.forgejo = {
       target = "http://localhost:${toString httpPort}";
       domain = config.services.forgejo.reverseProxy.domain;

modules/nixos-modules/server/home-assistant/fail2ban.nix

@@ -3,36 +3,46 @@
   pkgs,
   config,
   ...
-}:
+}: {
-lib.mkIf (config.services.fail2ban.enable && config.services.home-assistant.enable) {
+  options.services.home-assistant = {
-  environment.etc = {
+    fail2ban = {
-    "fail2ban/filter.d/hass.local".text = (
+      enable = lib.mkOption {
-      pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+        type = lib.types.bool;
-        [INCLUDES]
+        default = config.services.fail2ban.enable && config.services.home-assistant.enable;
-        before = common.conf
+      };
-
+    };
-        [Definition]
-        failregex = ^%(__prefix_line)s.*Login attempt or request with invalid authentication from <HOST>.*$
-
-        ignoreregex =
-
-        [Init]
-        datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
-      '')
-    );
   };
 
-  services.fail2ban = {
+  config = lib.mkIf config.services.home-assistant.fail2ban.enable {
-    jails = {
+    environment.etc = {
-      home-assistant-iptables.settings = {
+      "fail2ban/filter.d/hass.local".text = (
-        enabled = true;
+        pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
-        filter = "hass";
+          [INCLUDES]
-        action = ''iptables-multiport[name=HTTP, port="http,https"]'';
+          before = common.conf
-        logpath = "${config.services.home-assistant.configDir}/*.log";
+
-        backend = "auto";
+          [Definition]
-        findtime = 600;
+          failregex = ^%(__prefix_line)s.*Login attempt or request with invalid authentication from <HOST>.*$
-        bantime = 600;
+
-        maxretry = 5;
+          ignoreregex =
+
+          [Init]
+          datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
+        '')
+      );
+    };
+
+    services.fail2ban = {
+      jails = {
+        home-assistant-iptables.settings = {
+          enabled = true;
+          filter = "hass";
+          action = ''iptables-multiport[name=HTTP, port="http,https"]'';
+          logpath = "${config.services.home-assistant.configDir}/*.log";
+          backend = "auto";
+          findtime = 600;
+          bantime = 600;
+          maxretry = 5;
+        };
       };
     };
   };

modules/nixos-modules/server/home-assistant/proxy.nix

@@ -14,9 +14,15 @@
       description = "extra domains that should be configured for home-assistant";
       default = [];
     };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.reverseProxy.enable && config.services.home-assistant.enable;
+      };
+    };
   };
 
-  config = lib.mkIf (config.services.reverseProxy.enable && config.services.home-assistant.enable) {
+  config = lib.mkIf config.services.home-assistant.reverseProxy.enable {
     services.reverseProxy.services.home-assistant = {
       target = "http://localhost:${toString config.services.home-assistant.config.http.server_port}";
       domain = config.services.home-assistant.domain;

modules/nixos-modules/server/immich/fail2ban.nix

@@ -4,7 +4,16 @@
   pkgs,
   ...
 }: {
-  config = lib.mkIf (config.services.fail2ban.enable && config.services.immich.enable) {
+  options.services.immich = {
+    fail2ban = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.fail2ban.enable && config.services.immich.enable;
+      };
+    };
+  };
+
+  config = lib.mkIf config.services.immich.fail2ban.enable {
     environment.etc = {
       "fail2ban/filter.d/immich.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
         [Definition]

modules/nixos-modules/server/immich/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   mediaLocation = "/var/lib/immich";
 in {
-  config = lib.mkIf (config.services.immich.enable && config.host.impermanence.enable) {
+  options.services.immich = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.immich.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.immich.impermanence.enable {
     assertions = [
       {
         assertion = config.services.immich.mediaLocation == mediaLocation;

modules/nixos-modules/server/immich/proxy.nix

@@ -14,9 +14,15 @@
       description = "extra domains that should be configured for immich";
       default = [];
     };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.immich.enable && config.services.reverseProxy.enable;
+      };
+    };
   };
 
-  config = lib.mkIf (config.services.immich.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.immich.reverseProxy.enable {
     services.reverseProxy.services.immich = {
       target = "http://localhost:${toString config.services.immich.port}";
       domain = config.services.immich.domain;

modules/nixos-modules/server/jackett/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   jackett_data_directory = "/var/lib/jackett/.config/Jackett";
 in {
-  config = lib.mkIf (config.services.jackett.enable && config.host.impermanence.enable) {
+  options.services.jackett = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.jackett.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.jackett.impermanence.enable {
     assertions = [
       {
         assertion = config.services.jackett.dataDir == jackett_data_directory;

modules/nixos-modules/server/jellyfin/impermanence.nix

@@ -6,7 +6,14 @@
   jellyfin_data_directory = "/var/lib/jellyfin";
   jellyfin_cache_directory = "/var/cache/jellyfin";
 in {
-  config = lib.mkIf (config.services.jellyfin.enable && config.host.impermanence.enable) {
+  options.services.jellyfin = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.jellyfin.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.jellyfin.impermanence.enable {
     fileSystems."/persist/system/jellyfin".neededForBoot = true;
 
     host.storage.pool.extraDatasets = {

modules/nixos-modules/server/jellyfin/proxy.nix

@@ -16,9 +16,15 @@ in {
       description = "extra domains that should be configured for jellyfin";
       default = [];
     };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.jellyfin.enable && config.services.reverseProxy.enable;
+      };
+    };
   };
 
-  config = lib.mkIf (config.services.jellyfin.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.jellyfin.reverseProxy.enable {
     services.reverseProxy.services.jellyfin = {
       target = "http://localhost:${toString jellyfinPort}";
       domain = config.services.jellyfin.domain;

modules/nixos-modules/server/lidarr/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   lidarr_data_directory = "/var/lib/lidarr/.config/Lidarr";
 in {
-  config = lib.mkIf (config.services.lidarr.enable && config.host.impermanence.enable) {
+  options.services.lidarr = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.lidarr.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.lidarr.impermanence.enable {
     assertions = [
       {
         assertion = config.services.lidarr.dataDir == lidarr_data_directory;

modules/nixos-modules/server/panoramax/impermanence.nix

@@ -3,7 +3,14 @@
   config,
   ...
 }: {
-  config = lib.mkIf (config.services.panoramax.enable && config.host.impermanence.enable) {
+  options.services.panoramax = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.panoramax.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.panoramax.impermanence.enable {
     # TODO: configure impermanence for panoramax data
     # This would typically include directories like:
     # - /var/lib/panoramax

modules/nixos-modules/server/panoramax/proxy.nix

@@ -14,9 +14,15 @@
       description = "extra domains that should be configured for panoramax";
       default = [];
     };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.panoramax.enable && config.services.reverseProxy.enable;
+      };
+    };
   };
 
-  config = lib.mkIf (config.services.panoramax.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.panoramax.reverseProxy.enable {
     services.reverseProxy.services.panoramax = {
       target = "http://localhost:${toString config.services.panoramax.port}";
       domain = config.services.panoramax.domain;

modules/nixos-modules/server/paperless/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   dataDir = "/var/lib/paperless";
 in {
-  config = lib.mkIf (config.services.paperless.enable && config.host.impermanence.enable) {
+  options.services.paperless = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.paperless.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.paperless.impermanence.enable {
     assertions = [
       {
         assertion = config.services.paperless.dataDir == dataDir;

modules/nixos-modules/server/paperless/proxy.nix

@@ -9,9 +9,15 @@
       description = "extra domains that should be configured for paperless";
       default = [];
     };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.paperless.enable && config.services.reverseProxy.enable;
+      };
+    };
   };
 
-  config = lib.mkIf (config.services.paperless.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.paperless.reverseProxy.enable {
     services.reverseProxy.services.paperless = {
       target = "http://${config.services.paperless.address}:${toString config.services.paperless.port}";
       domain = config.services.paperless.domain;

modules/nixos-modules/server/qbittorent/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   qbittorent_profile_directory = "/var/lib/qBittorrent/";
 in {
-  config = lib.mkIf (config.services.qbittorrent.enable && config.host.impermanence.enable) {
+  options.services.qbittorrent = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.qbittorrent.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.qbittorrent.impermanence.enable {
     fileSystems."/persist/system/qbittorrent".neededForBoot = true;
 
     host.storage.pool.extraDatasets = {

modules/nixos-modules/server/radarr/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   radarr_data_directory = "/var/lib/radarr/.config/Radarr";
 in {
-  config = lib.mkIf (config.services.radarr.enable && config.host.impermanence.enable) {
+  options.services.radarr = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.radarr.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.radarr.impermanence.enable {
     assertions = [
       {
         assertion = config.services.radarr.dataDir == radarr_data_directory;

modules/nixos-modules/server/searx/proxy.nix

@@ -9,9 +9,15 @@
       description = "extra domains that should be configured for searx";
       default = [];
     };
+    reverseProxy = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.searx.enable && config.services.reverseProxy.enable;
+      };
+    };
   };
 
-  config = lib.mkIf (config.services.searx.enable && config.services.reverseProxy.enable) {
+  config = lib.mkIf config.services.searx.reverseProxy.enable {
     services.reverseProxy.services.searx = {
       target = "http://localhost:${toString config.services.searx.settings.server.port}";
       domain = config.services.searx.domain;

modules/nixos-modules/server/sonarr/impermanence.nix

@@ -5,7 +5,14 @@
 }: let
   sonarr_data_directory = "/var/lib/sonarr/.config/NzbDrone";
 in {
-  config = lib.mkIf (config.services.sonarr.enable && config.host.impermanence.enable) {
+  options.services.sonarr = {
+    impermanence.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.sonarr.enable && config.host.impermanence.enable;
+    };
+  };
+
+  config = lib.mkIf config.services.sonarr.impermanence.enable {
     assertions = [
       {
         assertion = config.services.sonarr.dataDir == sonarr_data_directory;