diff options
Diffstat (limited to 'modules/hosts/ltrr-block')
| -rw-r--r-- | modules/hosts/ltrr-block/configuration.nix | 219 | ||||
| -rw-r--r-- | modules/hosts/ltrr-block/secrets/rekeyed/487d0f1ce536b1c47d686f069d9215d2-stalwart-admin.age | 9 | ||||
| -rw-r--r-- | modules/hosts/ltrr-block/secrets/rekeyed/9384b05f3c1e02246b581adc35f26293-stalwart-pk.age | bin | 0 -> 583 bytes | |||
| -rw-r--r-- | modules/hosts/ltrr-block/secrets/rekeyed/d9016177ce556ace6c3b469e9e10d1e0-stalwart-cert.age | bin | 0 -> 3214 bytes | |||
| -rw-r--r-- | modules/hosts/ltrr-block/secrets/stalwart-admin.key.age | 9 | ||||
| -rw-r--r-- | modules/hosts/ltrr-block/secrets/stalwart-cert.age | bin | 0 -> 3159 bytes | |||
| -rw-r--r-- | modules/hosts/ltrr-block/secrets/stalwart-pk.age | bin | 0 -> 582 bytes |
7 files changed, 220 insertions, 17 deletions
diff --git a/modules/hosts/ltrr-block/configuration.nix b/modules/hosts/ltrr-block/configuration.nix index 5ee4711..556c852 100644 --- a/modules/hosts/ltrr-block/configuration.nix +++ b/modules/hosts/ltrr-block/configuration.nix @@ -13,6 +13,7 @@ modulesPath, pkgs, config, + lib, ... }: let domain = "kcu.su"; @@ -63,6 +64,15 @@ }; }; + users.users.git = { + group = "git"; + extraGroups = ["files"]; + home = lib.mkForce "/var/lib/git"; + createHome = true; + isSystemUser = true; + }; + users.groups.git = {}; + users.users.mc = { isNormalUser = true; packages = with pkgs; [ @@ -99,8 +109,18 @@ networking.hostName = "ltrr-block"; networking.firewall = { - allowedTCPPorts = [80 5030 2049 25565]; - allowedUDPPorts = [51820 16261 16262]; + allowedTCPPorts = [ + 80 + # mail + 25 + 465 + 993 + + 25565 # minecraft + ]; + allowedUDPPorts = [ + 51820 + ]; }; security.acme = { @@ -137,13 +157,24 @@ "tube".proxyPass = "http://127.0.0.1:5410"; "torrents".proxyPass = "http://127.0.0.1:7317"; "jellyfin".proxyPass = "http://127.0.0.1:8096"; + "books" = { + proxyPass = "http://127.0.0.1:6458"; + proxyWebsockets = true; + }; "lidarr" = { proxyPass = "http://127.0.0.1:8686"; proxyWebsockets = true; }; - - "prowlarr".proxyPass = "http://127.0.0.1:9696"; "shelfmark".proxyPass = "http://127.0.0.1:8084"; + "mail".proxyPass = "http://127.0.0.1:7845"; + }; + extraVirtualHosts = { + "navidrome.${domain}" = { + enableAuthelia = false; + }; + "git.${domain}" = { + enableAuthelia = false; + }; }; }; @@ -235,10 +266,6 @@ group = "music"; }; - services.prowlarr = { - enable = true; - }; - services.qbittorrent = { enable = true; user = "files"; @@ -410,7 +437,7 @@ # "127.0.0.1:8083:8083" # ]; # volumes = [ - # "/srv/files/books:/calibre-library" + # "/srv/files/books/library:/calibre-library" # "/srv/files/books/injest:/cwa-book-ingest" # "/var/lib/cwa:/config" # ]; @@ -441,16 +468,36 @@ "host" ]; }; - services.booklore = { + + services.audiobookshelf = { enable = true; - subdomain = "books"; - uid = "1000"; - gid = "1001"; - settings = { - timezone = "Europe/Yekaterinburg"; - booksDir = "/srv/files/books/library"; - bookdropDir = "/srv/files/books/injest"; + port = 6458; + user = "files"; + group = "books"; + }; + + createPaths."/var/lib/stump" = { + owner = "files"; + group = "books"; + permissions = "0750"; + }; + + virtualisation.oci-containers.containers.stump = { + image = "aaronleopold/stump:nightly"; + volumes = [ + "/var/lib/stump:/config" + "/srv/files/books/library:/data" + ]; + ports = [ + "127.0.0.1:10821:10801" + ]; + environment = { + PUID = "1000"; + PGID = "1001"; }; + networks = [ + "host" + ]; }; services.watcharr = { @@ -458,6 +505,144 @@ subdomain = "watched"; }; + age.secrets.stalwart-admin = { + rekeyFile = ./secrets/stalwart-admin.key.age; + }; + age.secrets.stalwart-cert = { + rekeyFile = ./secrets/stalwart-cert.age; + }; + age.secrets.stalwart-pk = { + rekeyFile = ./secrets/stalwart-pk.age; + }; + + services.stalwart-mail = { + enable = true; + settings = { + server = { + hostname = "mail.kcu.su"; + listener = { + smtp = { + bind = ["[::]:25"]; + protocol = "smtp"; + }; + submissions = { + bind = ["[::]:465"]; + protocol = "smtp"; + tls.implicit = true; + }; + imaptls = { + bind = ["[::]:993"]; + protocol = "imap"; + tls.implicit = true; + }; + management = { + bind = ["127.0.0.1:7845"]; + protocol = "http"; + }; + }; + }; + storage = { + data = "rocksdb"; + fts = "rocksdb"; + blob = "rocksdb"; + lookup = "rocksdb"; + directory = "internal"; + }; + store.rocksdb = { + type = "rocksdb"; + path = "${config.services.stalwart-mail.dataDir}/data"; + compression = "lz4"; + }; + directory.internal = { + type = "internal"; + store = "rocksdb"; + }; + tracer.stdout = { + type = "stdout"; + level = "info"; + ansi = false; + enable = true; + }; + authentication.fallback-admin = { + user = "admin_fallback"; + secret = "%{file:/run/credentials/stalwart-mail.service/admin_secret}%"; + }; + config = { + local-keys = [ + "store.*" + "directory.*" + "tracer.*" + "!server.blocked-ip.*" + "!server.allowed-ip.*" + "server.*" + "authentication.fallback-admin.*" + "cluster.*" + "config.local-keys.*" + "storage.data" + "storage.blob" + "storage.lookup" + "storage.fts" + "storage.directory" + "certificate.*" + ]; + }; + certificate.default = { + cert = "%{file:/run/credentials/stalwart-mail.service/cert}%"; + private-key = "%{file:/run/credentials/stalwart-mail.service/pk}%"; + default = true; + }; + }; + credentials = { + cert = config.age.secrets.stalwart-cert.path; + pk = config.age.secrets.stalwart-pk.path; + admin_secret = config.age.secrets.stalwart-admin.path; + }; + }; + + createPaths."/srv/files/git" = { + owner = "git"; + group = "git"; + permissions = "0770"; + }; + services.cgit.kcu = { + enable = true; + user = "git"; + group = "git"; + scanPath = "/srv/files/git"; + gitHttpBackend = { + enable = true; + checkExportOkFiles = false; + }; + nginx.virtualHost = "git.${domain}"; + + settings = { + root-title = "kcu.su git"; + root-desc = "this is where i keep my (dead) projects"; + + enable-git-config = 1; + + about-filter = "${pkgs.cgit}/lib/filters/about-formatting.sh"; + source-filter = "${pkgs.cgit}/lib/filters/syntax-highlighting.py"; + readme = [ + "master:README.md" + "master:README.org" + ]; + project-list = "/var/lib/git/projects.list"; + }; + }; + + services.gitolite = { + enable = true; + user = "git"; + description = ""; + group = "git"; + adminPubkey = ""; + extraGitoliteRc = '' + $RC{GIT_CONFIG_KEYS} = ".*"; + $RC{GL_REPO_BASE} = "/srv/files/git"; + ''; + }; + services.immich = { enable = true; }; diff --git a/modules/hosts/ltrr-block/secrets/rekeyed/487d0f1ce536b1c47d686f069d9215d2-stalwart-admin.age b/modules/hosts/ltrr-block/secrets/rekeyed/487d0f1ce536b1c47d686f069d9215d2-stalwart-admin.age new file mode 100644 index 0000000..90ca528 --- /dev/null +++ b/modules/hosts/ltrr-block/secrets/rekeyed/487d0f1ce536b1c47d686f069d9215d2-stalwart-admin.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 ptoveQ vDi/rd7OWJyvz4nnM2kwX+8f9Vvru1lgvEXXHoD5TgQ +qMckZ4SxsRksF8Yg8MtSlZtvn/sm73xskjI9DSmIQtE +-> 8-grease k# SA{/ =I;)gK +844hA/7PS0QSd1dP16JX7JTJW8NWhSouyEF7VBpa8+uIZSrfUOwJDs+Af7dtIEd2 + +--- TLscAo6DhT5qKf7AAH7GqpigW8L/bMsoSBpoDWmVRtI +7+"Ry& ( _(Hk VLNm8WCg[pZkΗK`o" eV#KܰDyyRċTiB
|uW + d%vPH& ۻ:z
\ No newline at end of file diff --git a/modules/hosts/ltrr-block/secrets/rekeyed/9384b05f3c1e02246b581adc35f26293-stalwart-pk.age b/modules/hosts/ltrr-block/secrets/rekeyed/9384b05f3c1e02246b581adc35f26293-stalwart-pk.age Binary files differnew file mode 100644 index 0000000..8a778bf --- /dev/null +++ b/modules/hosts/ltrr-block/secrets/rekeyed/9384b05f3c1e02246b581adc35f26293-stalwart-pk.age diff --git a/modules/hosts/ltrr-block/secrets/rekeyed/d9016177ce556ace6c3b469e9e10d1e0-stalwart-cert.age b/modules/hosts/ltrr-block/secrets/rekeyed/d9016177ce556ace6c3b469e9e10d1e0-stalwart-cert.age Binary files differnew file mode 100644 index 0000000..4279838 --- /dev/null +++ b/modules/hosts/ltrr-block/secrets/rekeyed/d9016177ce556ace6c3b469e9e10d1e0-stalwart-cert.age diff --git a/modules/hosts/ltrr-block/secrets/stalwart-admin.key.age b/modules/hosts/ltrr-block/secrets/stalwart-admin.key.age new file mode 100644 index 0000000..8ae6dd3 --- /dev/null +++ b/modules/hosts/ltrr-block/secrets/stalwart-admin.key.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> X25519 5YBERzwh+Vis6esJiMwoUQbRSeB3XqufSnpOLvx8qRw +0tgBOtYD7n5C8yMluNij1rimPAxc4k8/WLWcxdvR7A8 +-> ?&'/-grease bm}^I5I uJ~R_S '/<ECm +l6zIQMmDjFRA8hqVXsfu+6Qmn9LHQu8X3axNNMSIoId2FCG38gd/xbSq80z3BWhg +2t1sXRD7+msi8Vxghdh56e++atH5oli36/vQOoyhfcM +--- fq2O9hy5sEtEpHrayYJ5c6Z6UmN+fW/iukMQJeAjVt4 ++WqJ23DȘ(By 0 +1ÅRNn
W634A&ZA-|E3hry ֏L0HYNe^ImBnԮ0Ln^hY̴agVӰu
\ No newline at end of file diff --git a/modules/hosts/ltrr-block/secrets/stalwart-cert.age b/modules/hosts/ltrr-block/secrets/stalwart-cert.age Binary files differnew file mode 100644 index 0000000..88ae1b9 --- /dev/null +++ b/modules/hosts/ltrr-block/secrets/stalwart-cert.age diff --git a/modules/hosts/ltrr-block/secrets/stalwart-pk.age b/modules/hosts/ltrr-block/secrets/stalwart-pk.age Binary files differnew file mode 100644 index 0000000..b0f092a --- /dev/null +++ b/modules/hosts/ltrr-block/secrets/stalwart-pk.age |