progress in multi user config
This commit is contained in:
Chris Kruining
parent
f7891e1f30
commit
3a2f52f45e
68 changed files with 384 additions and 663 deletions
88
modules/system/services/auth.nix
Normal file
88
modules/system/services/auth.nix
Normal file
|
|
@ -0,0 +1,88 @@
|
|||
{ config, options, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib.modules) mkIf;
|
||||
in
|
||||
{
|
||||
options.modules.services.auth = let
|
||||
inherit (lib.options) mkEnableOption;
|
||||
in {
|
||||
enable = mkEnableOption "Auth";
|
||||
};
|
||||
|
||||
config = mkIf config.modules.services.auth.enable {
|
||||
environment.systemPackages = with pkgs; [
|
||||
authelia
|
||||
];
|
||||
|
||||
services.authelia.instances.testing = {
|
||||
enable = true;
|
||||
secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
|
||||
secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
|
||||
settings = {
|
||||
log.level = "info";
|
||||
authentication_backend.file.path = "/etc/authelia/users_database.yml";
|
||||
access_control.default_policy = "one_factor";
|
||||
session.domain = "kruining.eu";
|
||||
storage.local.path = "/tmp/db.sqlite3";
|
||||
notifier.filesystem.filename = "/tmp/notifications.txt";
|
||||
server.endpoints.authz.forward-auth.implementation = "ForwardAuth";
|
||||
identity_providers.oidc.clients = [];
|
||||
};
|
||||
};
|
||||
|
||||
# systemd.services."authelia-testing" = {
|
||||
# serviceConfig.Environment = "X_AUTHELIA_CONFIG_FILTERS=template";
|
||||
# };
|
||||
|
||||
# These should not be set from nix but through other means to not leak the secret!
|
||||
# This is purely for testing purposes!
|
||||
environment.etc."authelia/storageEncryptionKeyFile" = {
|
||||
mode = "0400";
|
||||
user = "authelia-testing";
|
||||
text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
|
||||
};
|
||||
environment.etc."authelia/jwtSecretFile" = {
|
||||
mode = "0400";
|
||||
user = "authelia-testing";
|
||||
text = "a_very_important_secret";
|
||||
};
|
||||
environment.etc."authelia/users_database.yml" = {
|
||||
mode = "0400";
|
||||
user = "authelia-testing";
|
||||
text = ''
|
||||
users:
|
||||
bob:
|
||||
disabled: false
|
||||
displayname: bob
|
||||
# password of password
|
||||
password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs
|
||||
email: bob@jim.com
|
||||
groups:
|
||||
- admin
|
||||
- dev
|
||||
'';
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"auth.kruining.eu".extraConfig = ''
|
||||
reverse_proxy :9091
|
||||
'';
|
||||
"kaas.kruining.eu".extraConfig = ''
|
||||
respond "KAAS"
|
||||
'';
|
||||
};
|
||||
extraConfig = ''
|
||||
(auth) {
|
||||
forward_auth :9091 {
|
||||
uri /api/authz/forward-auth
|
||||
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
}
|
||||
11
modules/system/services/default.nix
Normal file
11
modules/system/services/default.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
{ config, options, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib.modules) mkIf;
|
||||
in
|
||||
{
|
||||
options.modules.services = let
|
||||
inherit (lib.options) mkEnableOption;
|
||||
in {
|
||||
enable = mkEnableOption "Enable all services";
|
||||
};
|
||||
}
|
||||
165
modules/system/services/games/minecraft.nix
Normal file
165
modules/system/services/games/minecraft.nix
Normal file
|
|
@ -0,0 +1,165 @@
|
|||
{ inputs, config, options, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib.modules) mkIf;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
inputs.nix-minecraft.nixosModules.minecraft-servers
|
||||
];
|
||||
|
||||
options.modules.services.games.minecraft = let
|
||||
inherit (lib.options) mkEnableOption;
|
||||
in {
|
||||
enable = mkEnableOption "Minecraft";
|
||||
};
|
||||
|
||||
config = mkIf config.modules.services.games.minecraft.enable {
|
||||
services = {
|
||||
minecraft-servers = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
|
||||
user = "chris";
|
||||
dataDir = "/var/lib/minecraft";
|
||||
|
||||
managementSystem = {
|
||||
tmux.enable = false;
|
||||
systemd-socket.enable = true;
|
||||
};
|
||||
|
||||
servers = let
|
||||
whitelist = {
|
||||
ChrisPBacon = "e6128495-075b-44a9-87f6-8d844d5ea0e4";
|
||||
satanjr616 = "1718f9d5-df1d-4aac-b10c-3229a0f1e8b2";
|
||||
Ono95 = "010e7652-6d5d-4f9e-af89-438c8fe694ca";
|
||||
JackLeLumber = "41910a94-8c8e-4528-a8ca-a2d7043f069d";
|
||||
DarkyLink = "6faddb7f-12a9-4aac-bc08-dd6db892a380";
|
||||
Archonite86 = "b5ab594d-de1c-4453-ba32-9107452be51b";
|
||||
NotACultist86 = "44ac3f7c-0e18-4234-bb04-11a0652cdaeb";
|
||||
};
|
||||
ops = [
|
||||
{
|
||||
uuid = "e6128495-075b-44a9-87f6-8d844d5ea0e4";
|
||||
name = "ChrisPBacon";
|
||||
level = 4;
|
||||
bypassesPlayerLimit = false;
|
||||
}
|
||||
{
|
||||
uuid = "6faddb7f-12a9-4aac-bc08-dd6db892a380";
|
||||
name = "DarkyLink";
|
||||
level = 4;
|
||||
bypassesPlayerLimit = false;
|
||||
}
|
||||
];
|
||||
jvmOpts = "-Xms2048M -Xmx2048M -XX:+UseG1GC";
|
||||
in {
|
||||
vanilla = {
|
||||
enable = true;
|
||||
autoStart = true;
|
||||
restart = "always";
|
||||
inherit whitelist;
|
||||
inherit jvmOpts;
|
||||
|
||||
package = pkgs.fabricServers.fabric-1_21_4.override { loaderVersion = "0.16.10"; };
|
||||
|
||||
serverProperties = {
|
||||
gamemode = "survival";
|
||||
difficulty = 3;
|
||||
motd = "Chris' vanilla server";
|
||||
white-list = true;
|
||||
simulation-distance = 10;
|
||||
server-port = 25501;
|
||||
level-name = "world";
|
||||
|
||||
allow-flight = true;
|
||||
enable-command-block = true;
|
||||
enforce-whitelist = true;
|
||||
spawn-protection = 0;
|
||||
};
|
||||
|
||||
files."ops.json" = {
|
||||
value = ops;
|
||||
};
|
||||
|
||||
symlinks = let
|
||||
inherit (builtins) attrValues;
|
||||
inherit (pkgs) linkFarmFromDrvs fetchurl;
|
||||
in {
|
||||
mods = linkFarmFromDrvs "mods" (attrValues {
|
||||
FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; };
|
||||
Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; };
|
||||
# DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; };
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
tekxit = let
|
||||
inherit (pkgs) fetchzip;
|
||||
|
||||
src = fetchzip {
|
||||
url = "https://tekxit.b-cdn.net/downloads/tekxit4/12.0.0Tekxit4Server.zip";
|
||||
hash = "sha256-4NqeMGOpji/gMH8XX8RemkBAOB9ID/i1S3/xXgD23to=";
|
||||
stripRoot = true;
|
||||
};
|
||||
in {
|
||||
enable = true;
|
||||
autoStart = true;
|
||||
restart = "no";
|
||||
inherit whitelist;
|
||||
inherit jvmOpts;
|
||||
|
||||
package = pkgs.fabricServers.fabric-1_19_2.override { loaderVersion = "0.16.9"; };
|
||||
|
||||
serverProperties = {
|
||||
gamemode = "survival";
|
||||
difficulty = 3;
|
||||
motd = "Chris' vanilla server";
|
||||
white-list = true;
|
||||
simulation-distance = 10;
|
||||
server-port = 25502;
|
||||
level-name = "world";
|
||||
|
||||
allow-flight = true;
|
||||
enable-command-block = true;
|
||||
enforce-whitelist = true;
|
||||
spawn-protection = 0;
|
||||
};
|
||||
|
||||
files = let
|
||||
inherit (builtins) readFile listToAttrs attrNames readDir mapAttrs;
|
||||
inherit (lib.attrsets) nameValuePair;
|
||||
inherit (lib) concatMapAttrs;
|
||||
inherit (lib.my) mapFilterAttrs;
|
||||
|
||||
readDirRec = src: dir: fn:
|
||||
concatMapAttrs (name: type: if type == "directory"
|
||||
then (readDirRec src "${dir}/${name}" fn)
|
||||
else { "${dir}/${name}" = (fn "${dir}/${name}"); }
|
||||
) (readDir "${src}/${dir}");
|
||||
|
||||
copyDir = dir: readDirRec src dir (x: "${src}/${x}");
|
||||
in {
|
||||
"ops.json" = {
|
||||
value = ops;
|
||||
};
|
||||
}
|
||||
// (copyDir "config");
|
||||
|
||||
symlinks = let
|
||||
inherit (builtins) attrNames readDir map;
|
||||
inherit (pkgs) linkFarm fetchzip;
|
||||
|
||||
linkFarmFromDir = name: dir: linkFarm name (map (x: { name = x; path = "${src}/${dir}/${x}"; }) (attrNames (readDir "${src}/${dir}")));
|
||||
in {
|
||||
Deftu = linkFarmFromDir "tekxit-deftu" "Deftu";
|
||||
TKXAddons = linkFarmFromDir "tekxit-TKXAddons" "TKXAddons";
|
||||
mods = linkFarmFromDir "tekxit-mods" "mods";
|
||||
scripts = linkFarmFromDir "tekxit-scripts" "scripts";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
25
modules/system/services/games/palworld.nix
Normal file
25
modules/system/services/games/palworld.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{ config, options, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib.modules) mkIf;
|
||||
in
|
||||
{
|
||||
options.modules.services.games.palworld = let
|
||||
inherit (lib.options) mkEnableOption;
|
||||
in {
|
||||
enable = mkEnableOption "Palworld";
|
||||
};
|
||||
|
||||
config = mkIf config.modules.services.games.palworld.enable {
|
||||
# kaas = (pkgs.mkSteamServer rec {
|
||||
# name = "Palworld";
|
||||
# src = pkgs.fetchSteam {
|
||||
# inherit name;
|
||||
# appId = "2394010";
|
||||
# hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
# };
|
||||
#
|
||||
# sartCmd = "PalServer.sh";
|
||||
# hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
# });
|
||||
};
|
||||
}
|
||||
156
modules/system/services/media.nix
Normal file
156
modules/system/services/media.nix
Normal file
|
|
@ -0,0 +1,156 @@
|
|||
{ config, options, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib.attrsets) attrValues;
|
||||
inherit (lib.modules) mkIf mkMerge mkForce;
|
||||
inherit (lib.meta) getExe;
|
||||
|
||||
user = "media";
|
||||
group = "media";
|
||||
directory = "/var/media";
|
||||
in
|
||||
{
|
||||
options.modules.services.media = let
|
||||
inherit (lib.options) mkEnableOption;
|
||||
in {
|
||||
enable = mkEnableOption "Media tools";
|
||||
};
|
||||
|
||||
config = mkIf config.modules.services.media.enable {
|
||||
environment.systemPackages = with pkgs; [
|
||||
podman-tui
|
||||
jellyfin
|
||||
jellyfin-ffmpeg
|
||||
jellyseerr
|
||||
mediainfo
|
||||
id3v2
|
||||
yt-dlp
|
||||
];
|
||||
|
||||
users = {
|
||||
users."${user}" = {
|
||||
isSystemUser = true;
|
||||
group = group;
|
||||
};
|
||||
groups."${group}" = {};
|
||||
};
|
||||
|
||||
system.activationScripts.var = mkForce ''
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/series
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/movies
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/qbittorrent
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/sabnzbd
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/reiverr/config
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/downloads/incomplete
|
||||
install -d -m 0755 -o ${user} -g ${group} ${directory}/downloads/done
|
||||
'';
|
||||
|
||||
services = let
|
||||
serviceConf = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
user = user;
|
||||
group = group;
|
||||
};
|
||||
in {
|
||||
jellyfin = serviceConf;
|
||||
radarr = serviceConf;
|
||||
sonarr = serviceConf;
|
||||
bazarr = serviceConf;
|
||||
lidarr = serviceConf;
|
||||
|
||||
jellyseerr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
prowlarr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
qbittorrent = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
dataDir = "${directory}/qbittorrent";
|
||||
port = 5000;
|
||||
|
||||
user = user;
|
||||
group = group;
|
||||
};
|
||||
|
||||
sabnzbd = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
configFile = "${directory}/sabnzbd/config.ini";
|
||||
|
||||
user = user;
|
||||
group = group;
|
||||
};
|
||||
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"ping.kruining.eu".extraConfig = ''
|
||||
respond "OK"
|
||||
'';
|
||||
"media.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:9494
|
||||
'';
|
||||
"series.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:8989
|
||||
'';
|
||||
"movies.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:7878
|
||||
'';
|
||||
"jellyfin.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:8096
|
||||
'';
|
||||
"indexer.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:9696
|
||||
'';
|
||||
"torrents.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:58080
|
||||
'';
|
||||
"usenet.kruining.eu".extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:8080
|
||||
'';
|
||||
"cloud.kruining.eu".extraConfig = ''
|
||||
php_fastcgi unix//run/phpfpm/nextcloud.sock {
|
||||
env front_controller_active true
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
modules.virtualisation = {
|
||||
enable = true;
|
||||
podman.enable = true;
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
oci-containers = {
|
||||
backend = "podman";
|
||||
|
||||
containers = {
|
||||
flaresolverr = {
|
||||
image = "flaresolverr/flaresolverr";
|
||||
autoStart = true;
|
||||
ports = [ "127.0.0.1:8191:8191" ];
|
||||
};
|
||||
|
||||
reiverr = {
|
||||
image = "ghcr.io/aleksilassila/reiverr:v2.0.0-alpha.6";
|
||||
autoStart = true;
|
||||
ports = [ "127.0.0.1:9494:9494" ];
|
||||
volumes = [ "${directory}/reiverr/config:/config" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.jellyfin.serviceConfig.killSignal = lib.mkForce "SIGKILL";
|
||||
};
|
||||
}
|
||||
41
modules/system/services/nextcloud.nix
Normal file
41
modules/system/services/nextcloud.nix
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
{ config, options, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib.modules) mkIf;
|
||||
in
|
||||
{
|
||||
options.modules.services.nextcloud = let
|
||||
inherit (lib.options) mkEnableOption;
|
||||
in {
|
||||
enable = mkEnableOption "Nextcloud";
|
||||
};
|
||||
|
||||
config = mkIf config.modules.services.nextcloud.enable {
|
||||
home.file.".netrc".text = ''
|
||||
login root
|
||||
password KaasIsAwesome!
|
||||
'';
|
||||
|
||||
systemd.user = {
|
||||
services.nextcloud-autosync = {
|
||||
Unit = {
|
||||
Description = "Automatic nextcloud sync";
|
||||
After = "network-online.target";
|
||||
};
|
||||
Service = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.nextcloud-client}/bin/nextcloudcmd -h -n --path /var/music /home/chris/Music https://cloud.kruining.eu";
|
||||
TimeoutStopSec = "180";
|
||||
KillMode = "process";
|
||||
KillSignal = "SIGINT";
|
||||
};
|
||||
Install.WantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
timers.nextcloud-autosync = {
|
||||
Unit.Description = "Automatic nextcloud sync";
|
||||
Timer.OnBootSec = "5min";
|
||||
Timer.OnUnitActiveSec = "60min";
|
||||
Install.WantedBy = [ "multi-user.target" "timers.target" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
5
modules/system/services/oidc_clients.yml
Normal file
5
modules/system/services/oidc_clients.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
# Hashed client secrets go here, and unhashed ones go in the client configurations
|
||||
|
||||
identity_providers:
|
||||
oidc:
|
||||
clients:
|
||||
Loading…
Add table
Add a link
Reference in a new issue