Julia Lange
823c6d0738
convert to using flake-parts and easy-hosts for the flake system. This allows me to remove my poor file-system based code and replace it with the code done in easy-hosts. Which also has good knock-on effects. This change factors users out of hosts, which is probably a good change since users aren't a nixos-module, but aren't completely untangled either. I'm going to leave users broken for a minute as I decide exactly how I want to handle them.
106 lines
2.5 KiB
Nix
106 lines
2.5 KiB
Nix
{ config, ... }:
|
|
let
|
|
email = "admin@woach.me";
|
|
in {
|
|
imports = [
|
|
./hardware.nix ];
|
|
system.stateVersion = "24.11";
|
|
system.timezone = "America/Los_Angeles";
|
|
system.users.bigWheels = [ "pan" ];
|
|
|
|
sops-nix = {
|
|
enable = true;
|
|
keyFile = "/etc/sops/age/keys.txt";
|
|
sopsFile = ./secrets.yaml;
|
|
secrets = {
|
|
pdsEnv = {};
|
|
forgejoPassword = {
|
|
owner = "forgejo";
|
|
};
|
|
caddyApi = {};
|
|
};
|
|
};
|
|
|
|
caddy = {
|
|
enable = true;
|
|
adminEmail = email;
|
|
environmentFile = config.sops.secrets.caddyApi.path;
|
|
vhosts = {
|
|
"juri.woach.me" = {
|
|
extraConfig = ''
|
|
reverse_proxy :3000
|
|
'';
|
|
serverAliases = [ "*.juri.woach.me" ];
|
|
};
|
|
"winry.woach.me" = {
|
|
extraConfig = ''
|
|
reverse_proxy :${builtins.toString config.forgejo.server.port}
|
|
'';
|
|
};
|
|
"ginko.woach.me" = {
|
|
extraConfig = ''
|
|
reverse_proxy :${builtins.toString config.headscale.server.port}
|
|
'';
|
|
serverAliases = [ "*.dns.ginko.woach.me" ];
|
|
};
|
|
"juri.${config.services.headscale.settings.dns.base_domain}" = {
|
|
extraConfig = ''
|
|
reverse_proxy :${builtins.toString config.fava.port}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
pds = {
|
|
enable = true;
|
|
hostname = "juri.woach.me";
|
|
adminEmail = email;
|
|
environmentFile = config.sops.secrets.pdsEnv.path;
|
|
};
|
|
|
|
forgejo = {
|
|
enable = true;
|
|
server.domain = "winry.woach.me";
|
|
users.admin = {
|
|
enable = true;
|
|
username = "Julia";
|
|
passwordFile = config.sops.secrets.forgejoPassword.path;
|
|
};
|
|
};
|
|
|
|
headscale = {
|
|
enable = true;
|
|
server.domain = "ginko.woach.me";
|
|
};
|
|
|
|
fava = {
|
|
enable = true;
|
|
port = 5128;
|
|
};
|
|
|
|
syncthing = {
|
|
enable = true;
|
|
devices = {
|
|
"homura".id = "NEP24DB-DVXAHTZ-TCCNREQ-Q5TSC7K-ZXPWC4L-5ELGKQX-4I2P47O-2FT5QAU";
|
|
"onizuka".id = "5S6QMND-MHD2HYR-DR6KQD4-6AWJTRL-FQUCR7W-FD2KBT3-AF6RE6R-F47KBQC";
|
|
"kobayashi".id = "4JPJHO4-RZHZZYE-ZUDFCZ4-KLBTMLJ-CNZBWWB-NTESYNA-X3EDAZ6-OMKHQAT";
|
|
"jibril".id = "EWGTILX-AJPLRZ7-UNGM3DJ-5EXGBTB-SHEZKMB-7A6QSER-H6O73FH-JSXCZQL";
|
|
};
|
|
|
|
folders = {
|
|
"wiki" = {
|
|
path = "/var/lib/wiki";
|
|
devices = [ "homura" "onizuka" "kobayashi" "jibril" ];
|
|
};
|
|
};
|
|
};
|
|
systemd.tmpfiles.rules = [ "d /var/lib/wiki 0755 syncthing syncthing -" ];
|
|
|
|
postgres.enable = true;
|
|
|
|
shell.enabledShells = [ "fish" ];
|
|
shell.defaultShell = "fish";
|
|
|
|
tailscale.enable = true;
|
|
sshd.enable = true;
|
|
}
|