nix based config

3 files changed, 321 insertions, 0 deletions

diff --git a/nix/per-host/base/configuration.nix b/nix/per-host/base/configuration.nix
new file mode 100644
index 0000000..8b34249
--- /dev/null
+++ b/nix/per-host/base/configuration.nix
@@ -0,0 +1,67 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  config = {
+    #Provide a default hostname
+    networking.hostName = lib.mkDefault "base";
+    networking.useDHCP = lib.mkDefault true;
+    
+    # Enable QEMU Guest for Proxmox
+    services.qemuGuest.enable = lib.mkDefault true;
+
+    # Use the boot drive for grub
+    boot.loader.grub.enable = lib.mkDefault true;
+    boot.loader.grub.devices = [ "nodev" ];
+
+    boot.growPartition = lib.mkDefault true;
+
+    # Allow remote updates with flakes and non-root users
+    nix.settings.trusted-users = [ "root" "@wheel" ];
+    nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+    # Some sane packages we need on every system
+    environment.systemPackages = with pkgs; [
+      vim  # for emergencies
+      git # for pulling nix flakes
+      python3 # for ansible
+    ];
+
+    # Don't ask for passwords
+    security.sudo.wheelNeedsPassword = false;
+
+    # Enable ssh
+    services.openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
+      settings.KbdInteractiveAuthentication = false;
+    };
+    programs.ssh.startAgent = true;
+
+    # Add an admin user
+    users.users.jefe = {
+      isNormalUser = true;
+      description = "el jefe";
+      extraGroups = [ "networkmanager" "wheel" ];
+    };
+    users.users.jefe.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAYYjB+fK4JFlJSY6Ax48p38eSuDG12VQVqP+WSrWGuO"
+    ];
+
+    users.users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAYYjB+fK4JFlJSY6Ax48p38eSuDG12VQVqP+WSrWGuO"
+    ];
+
+    # Default filesystem
+    fileSystems."/" = lib.mkDefault {
+      device = "/dev/disk/by-label/nixos";
+      autoResize = true;
+      fsType = "ext4";
+    };
+
+    system.stateVersion = lib.mkDefault "25.11";
+  };
+}
diff --git a/nix/per-host/rproxy-2/configuration.nix b/nix/per-host/rproxy-2/configuration.nix
new file mode 100644
index 0000000..d1580e8
--- /dev/null
+++ b/nix/per-host/rproxy-2/configuration.nix
@@ -0,0 +1,190 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+  config = {
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    sops.defaultSopsFile = ../../secrets/rproxy-2.yaml;
+    sops.secrets."caddy/env" = {
+      owner = "caddy";
+      restartUnits = [ "caddy.service" ];
+    };
+
+    networking.hostName = "rproxy-2";
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    services.caddy = {
+      enable = true;
+      package = pkgs.caddy.withPlugins {
+        plugins = [ "github.com/caddy-dns/namecheap@v1.0.0" ];
+        hash = "sha256-G+iBYwqKNB0kyQ060R9J2brbwsRl/WgvB6Tkc6MC5yU=";
+      };
+      environmentFile = config.sops.secrets."caddy/env".path;
+
+      # Test config only
+      # virtualHosts."rproxy2.kumardamani.net:80".extraConfig = ''
+      #   respond "Hello, world! {$NAMECHEAP_API_USER}"
+      #   tls internal
+      # '';
+
+      virtualHosts."lidarr.kumardamani.net:443".extraConfig = ''
+        reverse_proxy med-dl:8686
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."radarr.kumardamani.net:443".extraConfig = ''
+        reverse_proxy med-dl:7878
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."sonarr.kumardamani.net:443".extraConfig = ''
+        reverse_proxy med-dl:8989
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."namemydragon.lol:443".extraConfig = ''
+        reverse_proxy sites:84
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."www.namemydragon.lol:443".extraConfig = ''
+        reverse_proxy sites:84
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."metrics2.kumardamani.net:443".extraConfig = ''
+        reverse_proxy monitoring:9090
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."torrents.kumardamani.net:443".extraConfig = ''
+        reverse_proxy torrents:9091
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."vault.kumardamani.net:443".extraConfig = ''
+        reverse_proxy vault:8989
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."nc.kumardamani.net:443".extraConfig = ''
+        reverse_proxy nc-kumar:11000
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."kumardamani.net:443".extraConfig = ''
+        reverse_proxy sites:83
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."www.kumardamani.net:443".extraConfig = ''
+        reverse_proxy sites:83
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."damanistuff.net:443".extraConfig = ''
+        reverse_proxy sites:82
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."www.damanistuff.net:443".extraConfig = ''
+        reverse_proxy sites:82
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."kavisjourneys.com".extraConfig = ''
+        reverse_proxy sites:81
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."www.kavisjourneys.com".extraConfig = ''
+        reverse_proxy sites:81
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+
+      virtualHosts."*.min.kumardamani.net".extraConfig = ''
+        reverse_proxy minio:9000
+        tls {
+          dns namecheap {
+            api_key {$NAMECHEAP_API_KEY}
+            user {$NAMECHEAP_API_USER}
+          }
+        }
+      '';
+    };
+  };
+}
diff --git a/nix/per-host/torrents-2/configuration.nix b/nix/per-host/torrents-2/configuration.nix
new file mode 100644
index 0000000..6e7cd49
--- /dev/null
+++ b/nix/per-host/torrents-2/configuration.nix
@@ -0,0 +1,64 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+  config = {
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    sops.defaultSopsFile = ../../secrets/torrents-2.yaml;
+    # sops.secrets."foo" = {
+    #   owner = "transmission";
+    # };
+
+    networking.hostName = "torrents-2";
+    networking.firewall.allowedTCPPorts = [ 80 443 9091 ];
+
+    hardware.graphics = {
+      enable = true;
+    };
+
+    hardware.nvidia = {
+      modesetting.enable = true;
+      nvidiaPersistenced = true;
+      powerManagement.enable = false;
+      powerManagement.finegrained = false;
+      open = false;
+      nvidiaSettings = true;
+      package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+    };
+
+    nixpkgs.config.allowUnfree = true;
+
+    services.xserver.videoDrivers = [ "nvidia" ];
+
+    sops.templates."transmission-rpc-password.json" = {
+      content = ''
+        {
+          "rpc-password": "${config.sops.placeholder.foo}"
+        }
+      '';
+      owner = "transmission";
+      restartUnits = [ "transmission.service" ];
+    };
+
+    services.transmission = {
+      enable = true;
+      package = pkgs.transmission_4;
+      credentialsFile = config.sops.templates."transmission-rpc-password.json".path;
+      settings = {
+        rpc-authentication-required = true;
+        rpc-username = "kdam0";
+        # testpass
+        # rpc-password = "{b55cdbfcac290fff79d3bdb3441082dca8f278aay.bodWGn";
+        # rpc-password-file = config.sops.secrets."foo".path;
+        rpc-bind-address = "0.0.0.0";
+        # rpc-host-whitelist = "torrents2.kumardamani.net";
+        rpc-whitelist-enabled = true;
+        rpc-whitelist = "127.0.0.1,10.10.*.*";
+      };
+    };
+
+    fileSystems."/mnt/data" = {
+      device = "nas.bacala:/mnt/tank/customers/kumar/media";
+      fsType = "nfs";
+    };
+  };
+}