Noratrieb/vps
1
0
Fork 0
mirror of https://github.com/Noratrieb/vps.git synced 2026-07-12 08:17:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

gaming

Browse source
This commit is contained in:
nora 2026-05-31 13:22:40 +02:00
parent 8479644fc4
commit 70d8a0e941
53 changed files with 273 additions and 168 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/modules/caddy-acme-dns/default.nix Normal file
View file

@ -0,0 +1,13 @@
{ config, ... }: {
age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
services.caddy.globalConfig = ''
acme_dns rfc2136 {
key_name "acme-dns-01"
key_alg "hmac-sha256"
key "{$CADDY_DNS_RFC2136_KEY}"
server "dns1.local:53"
}
'';
}

3
nix/modules/caddy-base/default.nix
View file

@ -6,7 +6,7 @@ let
"github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
"github.com/caddy-dns/rfc2136@v1.0.0"
];
hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
};
in
{
@ -32,6 +32,7 @@ in
format json
'';
globalConfig = ''
email tls@noratrieb.dev
auto_https disable_redirects
servers {

18
nix/modules/caddy/default.nix
View file

@ -7,9 +7,6 @@
systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
services.caddy = {
globalConfig = ''
email tls@noratrieb.dev
auto_https disable_redirects
storage s3 {
host "localhost:3900"
bucket "caddy-store"
@ -18,21 +15,6 @@
insecure true
}
acme_dns rfc2136 {
key_name "test"
key_alg "hmac-sha256"
key ""
server "dns1.local:53"
}
tls {
dns_challenge_override_domain "nilstrieb.dev"
}
servers {
metrics
}
'';
virtualHosts = {
"http://" = {

85
nix/modules/dns/default.nix
View file

@ -1,9 +1,9 @@
{ pkgs, lib, networkingConfig, config, ... }:
{ pkgs, lib, networkingConfig, config, name, ... }:
let metricsPort = 9433; in
{
age.secrets.knot_dns_rfc2136_key_config = {
age.secrets.knot_dns_acme_dns_01_key_config = {
file =
../../secrets/knot_dns_rfc2136_key_config.age;
../../secrets/knot_dns_acme_dns_01_key_config.age;
owner = "knot";
};
@ -27,42 +27,57 @@ let metricsPort = 9433; in
services.knot = {
enable = true;
keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
settingsFile = pkgs.writeTextFile {
name = "knot.conf";
text = ''
server:
listen: 0.0.0.0@53
listen: ::@53
key:
- id: rfc2136-update
algorithm: hmac-sha256
secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
acl:
- id: update_acl
address: 10.0.0.0/24
key: rfc2136-update
action: update
update-type: [TXT]
keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
settings = {
server.listen = [ "0.0.0.0@53" "::@53" ];
acl = [
{
id = "update_acl";
address = "10.0.0.0/16";
key = "acme-dns-01";
action = "update";
update-type = [ "TXT" ];
}
];
zone = [
{
domain = "noratrieb.dev";
file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
}
zone:
- domain: noratrieb.dev
storage: /var/lib/knot/zones/
file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
- domain: nilstrieb.dev
storage: /var/lib/knot/zones/
file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
acl: update_acl
log:
- target: syslog
any: info
'';
] ++ (if name == "dns1" then [
{
domain = "nilstrieb.dev";
file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
}
{
domain = "noratrieb-acme-delegate.dev";
storage = "/var/lib/knot/zones/";
file = "noratrieb-acme-delegate.dev.zone";
acl = "update_acl";
}
] else [ ]);
log = [{
target = "syslog";
any = "info";
}];
};
};
networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
systemd.services.knot.preStart =
lib.mkIf (name == "dns1")
(lib.getExe
(pkgs.writeShellApplication {
name = "knot-prestart.sh";
text = ''
mkdir -p /var/lib/knot/zones/
cp ${
import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
} /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
'';
}));
networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
services.prometheus.exporters.knot = {
enable = true;
port = metricsPort;

5
nix/modules/dns/nilstrieb.dev.nix
View file

@ -29,14 +29,11 @@ let
];
NS = [
"ns1.nilstrieb.dev."
"ns2.nilstrieb.dev."
"ns.nilstrieb.dev."
];
subdomains = {
ns = dns1;
ns1 = dns1;
ns2 = dns2;
localhost.A = [ (a "127.0.0.1") ];

39
nix/modules/dns/noratrieb-acme-delegate.dev.nix Normal file
View file

@ -0,0 +1,39 @@
# https://github.com/nix-community/dns.nix
{ pkgs, lib, networkingConfig, ... }:
let
data = with pkgs.nix-dns.lib.combinators;
let
hour1 = 3600;
hostsToDns = builtins.mapAttrs
(name: { publicIPv4, publicIPv6, ... }:
lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
networkingConfig;
in
with hostsToDns;
{
TTL = hour1;
SOA = {
nameServer = "ns.noratrieb-acme-delegate.dev.";
adminEmail = "void@noratrieb.dev";
serial = 2024072601;
};
CAA = [
{ issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
{ issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
];
NS = [
"ns.noratrieb-acme-delegate.dev."
];
subdomains = {
ns = dns1;
};
};
in
pkgs.writeTextFile {
name = "noratrieb-acme-delegate.dev.zone";
text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
}

13
nix/modules/dns/noratrieb.dev.nix
View file

@ -97,10 +97,15 @@ let
infra.subdomains = hostsToDns;
# --- internal stuff
internal.subdomains = {
immich = minipc;
paperless = minipc;
};
internal.subdomains = builtins.listToAttrs (builtins.map
(name: {
inherit name;
value = minipc // {
subdomains = {
_acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
};
};
}) [ "immich" "paperless" "home-assistant" ]);
# --- other verification
_discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];

26
nix/modules/home-assistant/default.nix Normal file
View file

@ -0,0 +1,26 @@
{ config, ... }: {
services.home-assistant = {
enable = true;
extraComponents = [
# Recommended for fast zlib compression
# https://www.home-assistant.io/integrations/isal
"isal"
];
config = {
default_config = { };
http = {
use_x_forwarded_for = true;
trusted_proxies = [ "::1" ];
};
};
};
services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
extraConfig = ''
tls {
dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
}
reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
'';
};
}

10
nix/modules/immich/default.nix
View file

@ -13,7 +13,6 @@
environment = {
IMMICH_TELEMETRY_INCLUDE = "all";
};
openFirewall = true;
};
services.postgresql = {
@ -30,5 +29,14 @@
'';
};
services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
extraConfig = ''
tls {
dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
}
reverse_proxy * localhost:${builtins.toString config.services.immich.port}
'';
};
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
}

10
nix/modules/paperless/default.nix
View file

@ -12,6 +12,7 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
PAPERLESS_TIME_ZONE = "Europe/Zurich";
PAPERLESS_ADMIN_USER = "nora";
PAPERLESS_OCR_LANGUAGE = "deu+eng";
PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
};
exporter = {
enable = true;
@ -20,5 +21,12 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
};
};
networking.firewall.allowedTCPPorts = [ 8010 ];
services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
extraConfig = ''
tls {
dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
}
reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
'';
};
}