aboutsummaryrefslogtreecommitdiff
path: root/nix/per-host
diff options
context:
space:
mode:
Diffstat (limited to 'nix/per-host')
-rw-r--r--nix/per-host/base/configuration.nix67
-rw-r--r--nix/per-host/rproxy-2/configuration.nix190
-rw-r--r--nix/per-host/torrents-2/configuration.nix64
3 files changed, 321 insertions, 0 deletions
diff --git a/nix/per-host/base/configuration.nix b/nix/per-host/base/configuration.nix
new file mode 100644
index 0000000..8b34249
--- /dev/null
+++ b/nix/per-host/base/configuration.nix
@@ -0,0 +1,67 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+ imports = [
+ (modulesPath + "/profiles/qemu-guest.nix")
+ ];
+
+ config = {
+ #Provide a default hostname
+ networking.hostName = lib.mkDefault "base";
+ networking.useDHCP = lib.mkDefault true;
+
+ # Enable QEMU Guest for Proxmox
+ services.qemuGuest.enable = lib.mkDefault true;
+
+ # Use the boot drive for grub
+ boot.loader.grub.enable = lib.mkDefault true;
+ boot.loader.grub.devices = [ "nodev" ];
+
+ boot.growPartition = lib.mkDefault true;
+
+ # Allow remote updates with flakes and non-root users
+ nix.settings.trusted-users = [ "root" "@wheel" ];
+ nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+ # Some sane packages we need on every system
+ environment.systemPackages = with pkgs; [
+ vim # for emergencies
+ git # for pulling nix flakes
+ python3 # for ansible
+ ];
+
+ # Don't ask for passwords
+ security.sudo.wheelNeedsPassword = false;
+
+ # Enable ssh
+ services.openssh = {
+ enable = true;
+ settings.PasswordAuthentication = false;
+ settings.KbdInteractiveAuthentication = false;
+ };
+ programs.ssh.startAgent = true;
+
+ # Add an admin user
+ users.users.jefe = {
+ isNormalUser = true;
+ description = "el jefe";
+ extraGroups = [ "networkmanager" "wheel" ];
+ };
+ users.users.jefe.openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAYYjB+fK4JFlJSY6Ax48p38eSuDG12VQVqP+WSrWGuO"
+ ];
+
+ users.users.root.openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAYYjB+fK4JFlJSY6Ax48p38eSuDG12VQVqP+WSrWGuO"
+ ];
+
+ # Default filesystem
+ fileSystems."/" = lib.mkDefault {
+ device = "/dev/disk/by-label/nixos";
+ autoResize = true;
+ fsType = "ext4";
+ };
+
+ system.stateVersion = lib.mkDefault "25.11";
+ };
+}
diff --git a/nix/per-host/rproxy-2/configuration.nix b/nix/per-host/rproxy-2/configuration.nix
new file mode 100644
index 0000000..d1580e8
--- /dev/null
+++ b/nix/per-host/rproxy-2/configuration.nix
@@ -0,0 +1,190 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+ config = {
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+ sops.defaultSopsFile = ../../secrets/rproxy-2.yaml;
+ sops.secrets."caddy/env" = {
+ owner = "caddy";
+ restartUnits = [ "caddy.service" ];
+ };
+
+ networking.hostName = "rproxy-2";
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+ services.caddy = {
+ enable = true;
+ package = pkgs.caddy.withPlugins {
+ plugins = [ "github.com/caddy-dns/namecheap@v1.0.0" ];
+ hash = "sha256-G+iBYwqKNB0kyQ060R9J2brbwsRl/WgvB6Tkc6MC5yU=";
+ };
+ environmentFile = config.sops.secrets."caddy/env".path;
+
+ # Test config only
+ # virtualHosts."rproxy2.kumardamani.net:80".extraConfig = ''
+ # respond "Hello, world! {$NAMECHEAP_API_USER}"
+ # tls internal
+ # '';
+
+ virtualHosts."lidarr.kumardamani.net:443".extraConfig = ''
+ reverse_proxy med-dl:8686
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."radarr.kumardamani.net:443".extraConfig = ''
+ reverse_proxy med-dl:7878
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."sonarr.kumardamani.net:443".extraConfig = ''
+ reverse_proxy med-dl:8989
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."namemydragon.lol:443".extraConfig = ''
+ reverse_proxy sites:84
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."www.namemydragon.lol:443".extraConfig = ''
+ reverse_proxy sites:84
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."metrics2.kumardamani.net:443".extraConfig = ''
+ reverse_proxy monitoring:9090
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."torrents.kumardamani.net:443".extraConfig = ''
+ reverse_proxy torrents:9091
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."vault.kumardamani.net:443".extraConfig = ''
+ reverse_proxy vault:8989
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."nc.kumardamani.net:443".extraConfig = ''
+ reverse_proxy nc-kumar:11000
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."kumardamani.net:443".extraConfig = ''
+ reverse_proxy sites:83
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."www.kumardamani.net:443".extraConfig = ''
+ reverse_proxy sites:83
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."damanistuff.net:443".extraConfig = ''
+ reverse_proxy sites:82
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."www.damanistuff.net:443".extraConfig = ''
+ reverse_proxy sites:82
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."kavisjourneys.com".extraConfig = ''
+ reverse_proxy sites:81
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."www.kavisjourneys.com".extraConfig = ''
+ reverse_proxy sites:81
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+
+ virtualHosts."*.min.kumardamani.net".extraConfig = ''
+ reverse_proxy minio:9000
+ tls {
+ dns namecheap {
+ api_key {$NAMECHEAP_API_KEY}
+ user {$NAMECHEAP_API_USER}
+ }
+ }
+ '';
+ };
+ };
+}
diff --git a/nix/per-host/torrents-2/configuration.nix b/nix/per-host/torrents-2/configuration.nix
new file mode 100644
index 0000000..6e7cd49
--- /dev/null
+++ b/nix/per-host/torrents-2/configuration.nix
@@ -0,0 +1,64 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+ config = {
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+ sops.defaultSopsFile = ../../secrets/torrents-2.yaml;
+ # sops.secrets."foo" = {
+ # owner = "transmission";
+ # };
+
+ networking.hostName = "torrents-2";
+ networking.firewall.allowedTCPPorts = [ 80 443 9091 ];
+
+ hardware.graphics = {
+ enable = true;
+ };
+
+ hardware.nvidia = {
+ modesetting.enable = true;
+ nvidiaPersistenced = true;
+ powerManagement.enable = false;
+ powerManagement.finegrained = false;
+ open = false;
+ nvidiaSettings = true;
+ package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+ };
+
+ nixpkgs.config.allowUnfree = true;
+
+ services.xserver.videoDrivers = [ "nvidia" ];
+
+ sops.templates."transmission-rpc-password.json" = {
+ content = ''
+ {
+ "rpc-password": "${config.sops.placeholder.foo}"
+ }
+ '';
+ owner = "transmission";
+ restartUnits = [ "transmission.service" ];
+ };
+
+ services.transmission = {
+ enable = true;
+ package = pkgs.transmission_4;
+ credentialsFile = config.sops.templates."transmission-rpc-password.json".path;
+ settings = {
+ rpc-authentication-required = true;
+ rpc-username = "kdam0";
+ # testpass
+ # rpc-password = "{b55cdbfcac290fff79d3bdb3441082dca8f278aay.bodWGn";
+ # rpc-password-file = config.sops.secrets."foo".path;
+ rpc-bind-address = "0.0.0.0";
+ # rpc-host-whitelist = "torrents2.kumardamani.net";
+ rpc-whitelist-enabled = true;
+ rpc-whitelist = "127.0.0.1,10.10.*.*";
+ };
+ };
+
+ fileSystems."/mnt/data" = {
+ device = "nas.bacala:/mnt/tank/customers/kumar/media";
+ fsType = "nfs";
+ };
+ };
+}
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-02 08:04:03 +0000