mirror of
https://github.com/gensokyo-zone/infrastructure.git
synced 2026-02-09 04:19:19 -08:00
329 lines
10 KiB
Nix
329 lines
10 KiB
Nix
{
|
|
config,
|
|
meta,
|
|
lib,
|
|
access,
|
|
...
|
|
}: let
|
|
inherit (lib.modules) mkIf mkMerge;
|
|
keycloak = access.nixosFor "keycloak";
|
|
mediabox = access.nixosFor "mediabox";
|
|
tei = access.nixosFor "tei";
|
|
utsuho = access.nixosFor "utsuho";
|
|
inherit (mediabox.services) plex;
|
|
inherit (tei.services) home-assistant zigbee2mqtt;
|
|
inherit (utsuho.services) unifi mosquitto;
|
|
inherit (config.services) nginx;
|
|
inherit (nginx) virtualHosts;
|
|
in {
|
|
imports = let
|
|
inherit (meta) nixos;
|
|
in [
|
|
nixos.sops
|
|
nixos.base
|
|
nixos.reisen-ct
|
|
nixos.kyuuto
|
|
nixos.steam.account-switch
|
|
nixos.steam.beatsaber
|
|
nixos.tailscale
|
|
nixos.ipa
|
|
nixos.cloudflared
|
|
nixos.ddclient
|
|
nixos.acme
|
|
nixos.nginx
|
|
nixos.vouch
|
|
nixos.access.nginx
|
|
nixos.access.global
|
|
nixos.access.mosquitto
|
|
nixos.access.gensokyo
|
|
nixos.access.keycloak
|
|
nixos.access.vouch
|
|
nixos.access.freeipa
|
|
nixos.access.freepbx
|
|
nixos.access.unifi
|
|
nixos.access.kitchencam
|
|
nixos.access.home-assistant
|
|
nixos.access.zigbee2mqtt
|
|
nixos.access.grocy
|
|
nixos.access.barcodebuddy
|
|
nixos.access.proxmox
|
|
nixos.access.plex
|
|
nixos.access.invidious
|
|
nixos.samba
|
|
./reisen-ssh.nix
|
|
];
|
|
|
|
sops.secrets.cloudflared-tunnel-hakurei = {
|
|
owner = config.services.cloudflared.user;
|
|
};
|
|
|
|
services.cloudflared = let
|
|
inherit (nginx) defaultHTTPListenPort;
|
|
tunnelId = "964121e3-b3a9-4cc1-8480-954c4728b604";
|
|
localNginx = "http://localhost:${toString defaultHTTPListenPort}";
|
|
in {
|
|
tunnels.${tunnelId} = {
|
|
default = "http_status:404";
|
|
credentialsFile = config.sops.secrets.cloudflared-tunnel-hakurei.path;
|
|
ingress = {
|
|
${virtualHosts.prox.serverName}.service = localNginx;
|
|
${virtualHosts.gensokyoZone.serverName}.service = localNginx;
|
|
};
|
|
};
|
|
};
|
|
|
|
# configure a secondary vouch instance for local clients, but don't use it by default
|
|
services.vouch-proxy = {
|
|
authUrl = "https://${virtualHosts.keycloak'local.serverName}/realms/${config.networking.domain}";
|
|
domain = "login.local.${config.networking.domain}";
|
|
#cookie.domain = "local.${config.networking.domain}";
|
|
};
|
|
|
|
security.acme.certs = {
|
|
hakurei = {
|
|
inherit (nginx) group;
|
|
domain = config.networking.fqdn;
|
|
extraDomainNames = [
|
|
access.hostnameForNetwork.local
|
|
access.hostnameForNetwork.int
|
|
(mkIf config.services.tailscale.enable access.hostnameForNetwork.tail)
|
|
];
|
|
};
|
|
mosquitto = {
|
|
inherit (nginx) group;
|
|
domain = "mqtt.${config.networking.domain}";
|
|
extraDomainNames = [
|
|
"mqtt.local.${config.networking.domain}"
|
|
"mqtt.int.${config.networking.domain}"
|
|
(mkIf config.services.tailscale.enable "mqtt.tail.${config.networking.domain}")
|
|
];
|
|
};
|
|
samba = {
|
|
domain = "smb.${config.networking.domain}";
|
|
extraDomainNames = [
|
|
"smb.local.${config.networking.domain}"
|
|
"smb.int.${config.networking.domain}"
|
|
(mkIf config.services.tailscale.enable "smb.tail.${config.networking.domain}")
|
|
];
|
|
};
|
|
sso = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.keycloak.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.keycloak.otherServerNames
|
|
virtualHosts.keycloak'local.allServerNames
|
|
];
|
|
};
|
|
home = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.home-assistant.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.home-assistant.otherServerNames
|
|
virtualHosts.home-assistant'local.allServerNames
|
|
];
|
|
};
|
|
z2m = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.zigbee2mqtt.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.zigbee2mqtt.otherServerNames
|
|
virtualHosts.zigbee2mqtt'local.allServerNames
|
|
];
|
|
};
|
|
grocy = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.grocy.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.grocy.otherServerNames
|
|
virtualHosts.grocy'local.allServerNames
|
|
];
|
|
};
|
|
bbuddy = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.barcodebuddy.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.barcodebuddy.otherServerNames
|
|
virtualHosts.barcodebuddy'local.allServerNames
|
|
];
|
|
};
|
|
login = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.vouch.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.vouch.otherServerNames
|
|
virtualHosts.vouch'local.allServerNames
|
|
(mkIf virtualHosts.vouch'tail.enable virtualHosts.vouch'tail.allServerNames)
|
|
];
|
|
};
|
|
unifi = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.unifi.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.unifi.otherServerNames
|
|
virtualHosts.unifi'local.allServerNames
|
|
];
|
|
};
|
|
idp = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.freeipa.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.freeipa.otherServerNames
|
|
virtualHosts.freeipa'web.allServerNames
|
|
virtualHosts.freeipa'web'local.allServerNames
|
|
virtualHosts.freeipa'ldap.allServerNames
|
|
virtualHosts.freeipa'ldap'local.allServerNames
|
|
(mkIf virtualHosts.freeipa'ldap'tail.enable virtualHosts.freeipa'ldap'tail.allServerNames)
|
|
];
|
|
};
|
|
pbx = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.freepbx.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.freepbx.otherServerNames
|
|
virtualHosts.freepbx'local.allServerNames
|
|
];
|
|
};
|
|
prox = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.prox.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.prox.otherServerNames
|
|
virtualHosts.prox'local.allServerNames
|
|
(mkIf virtualHosts.prox'tail.enable virtualHosts.prox'tail.allServerNames)
|
|
];
|
|
};
|
|
plex = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.plex.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.plex.otherServerNames
|
|
virtualHosts.plex'local.allServerNames
|
|
];
|
|
};
|
|
kitchen = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.kitchencam.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.kitchencam.otherServerNames
|
|
virtualHosts.kitchencam'local.allServerNames
|
|
];
|
|
};
|
|
yt = {
|
|
inherit (nginx) group;
|
|
domain = virtualHosts.invidious.serverName;
|
|
extraDomainNames = mkMerge [
|
|
virtualHosts.invidious.otherServerNames
|
|
virtualHosts.invidious'local.allServerNames
|
|
];
|
|
};
|
|
};
|
|
|
|
services.nginx = let
|
|
inherit (nginx) access;
|
|
#inherit (config.lib.access) getHostnameFor;
|
|
getHostnameFor = config.lib.access.getAddress4For;
|
|
in {
|
|
vouch.enableLocal = false;
|
|
access.mosquitto = assert mosquitto.enable; {
|
|
host = getHostnameFor "utsuho" "lan";
|
|
};
|
|
access.plex = assert plex.enable; {
|
|
url = "http://${getHostnameFor "mediabox" "lan"}:${toString plex.port}";
|
|
externalPort = 41324;
|
|
};
|
|
access.unifi = assert unifi.enable; {
|
|
host = getHostnameFor "utsuho" "lan";
|
|
};
|
|
access.freeipa = {
|
|
host = getHostnameFor "freeipa" "lan";
|
|
kerberos.ports.kpasswd = 464;
|
|
};
|
|
access.kitchencam = {
|
|
streamPort = 41081;
|
|
};
|
|
stream.servers = {
|
|
mosquitto.ssl.cert.name = "mosquitto";
|
|
};
|
|
virtualHosts = {
|
|
fallback.ssl.cert.name = "hakurei";
|
|
gensokyoZone.proxied.enable = "cloudflared";
|
|
freeipa = {
|
|
ssl.cert.enable = true;
|
|
};
|
|
keycloak = {
|
|
# we're not the real sso record-holder, so don't respond globally..
|
|
local.denyGlobal = true;
|
|
ssl.cert.enable = true;
|
|
locations."/".proxyPass = "https://${getHostnameFor "keycloak" "lan"}:8443";
|
|
};
|
|
vouch = let
|
|
inherit (keycloak.services) vouch-proxy;
|
|
in assert vouch-proxy.enable; {
|
|
ssl.cert.enable = true;
|
|
locations."/".proxyPass = "http://${getHostnameFor "keycloak" "lan"}:${toString vouch-proxy.settings.vouch.port}";
|
|
};
|
|
vouch'local = let
|
|
vouch-proxy = config.services.vouch-proxy;
|
|
in assert vouch-proxy.enable; {
|
|
locations."/".proxyPass = "http://localhost:${toString vouch-proxy.settings.vouch.port}";
|
|
# we're not running another for tailscale sorry...
|
|
name.includeTailscale = true;
|
|
};
|
|
unifi = {
|
|
# we're not the real unifi record-holder, so don't respond globally..
|
|
local.denyGlobal = true;
|
|
ssl.cert.enable = true;
|
|
};
|
|
home-assistant = assert home-assistant.enable; {
|
|
# not the real hass record-holder, so don't respond globally..
|
|
local.denyGlobal = true;
|
|
ssl.cert.enable = true;
|
|
locations."/".proxyPass = "http://${getHostnameFor "tei" "lan"}:${toString home-assistant.config.http.server_port}";
|
|
};
|
|
zigbee2mqtt = assert zigbee2mqtt.enable; {
|
|
# not the real z2m record-holder, so don't respond globally..
|
|
local.denyGlobal = true;
|
|
ssl.cert.enable = true;
|
|
locations."/".proxyPass = "http://${getHostnameFor "tei" "lan"}:${toString zigbee2mqtt.settings.frontend.port}";
|
|
};
|
|
grocy = {
|
|
# not the real grocy record-holder, so don't respond globally..
|
|
local.denyGlobal = true;
|
|
ssl.cert.enable = true;
|
|
locations."/".proxyPass = "http://${getHostnameFor "tei" "lan"}";
|
|
};
|
|
barcodebuddy = {
|
|
# not the real bbuddy record-holder, so don't respond globally..
|
|
local.denyGlobal = true;
|
|
ssl.cert.enable = true;
|
|
locations."/".proxyPass = "http://${getHostnameFor "tei" "lan"}";
|
|
};
|
|
freepbx = {
|
|
ssl.cert.enable = true;
|
|
};
|
|
prox = {
|
|
proxied.enable = "cloudflared";
|
|
ssl.cert.enable = true;
|
|
};
|
|
plex.ssl.cert.enable = true;
|
|
kitchencam.ssl.cert.enable = true;
|
|
invidious = {
|
|
ssl.cert.enable = true;
|
|
};
|
|
invidious'int = {
|
|
locations."/".proxyPass = "http://${getHostnameFor "mediabox" "lan"}:${toString mediabox.services.invidious.port}";
|
|
};
|
|
};
|
|
};
|
|
services.samba.tls = {
|
|
useACMECert = "samba";
|
|
};
|
|
|
|
services.tailscale.advertiseExitNode = true;
|
|
|
|
services.samba.openFirewall = true;
|
|
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
|
|
system.stateVersion = "23.11";
|
|
}
|