From 3f8eacc9a84c868d5b80b1b6e515d7a22af13bd5 Mon Sep 17 00:00:00 2001 From: ulve Date: Wed, 8 Jul 2026 16:24:11 +0200 Subject: [PATCH] Closer --- flake.lock | 14 +++--- hosts/nixserve/default.nix | 15 +++++- hosts/nixserve/home.nix | 4 ++ hosts/nixserve/services.nix | 94 +++++++++++++++++++++++++++++++++++++ 4 files changed, 118 insertions(+), 9 deletions(-) create mode 100644 hosts/nixserve/services.nix diff --git a/flake.lock b/flake.lock index 2a1bb17..39ff0ce 100644 --- a/flake.lock +++ b/flake.lock @@ -5,11 +5,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1783430736, - "narHash": "sha256-X8WX1ktiK9Qn3O/xefUA5zBnjQ9mvB1gHNaRyZTdAIc=", + "lastModified": 1783468284, + "narHash": "sha256-no8aODMs+tYEnEShJPHKap2imToiA++joPFL+o/ZAmg=", "owner": "ogulcancelik", "repo": "herdr", - "rev": "d190c1f55e05419b299fc68f60ea0aabc1ff7379", + "rev": "77f0339c3cd387c4ca3f4f240ff8b88065d66a22", "type": "github" }, "original": { @@ -57,11 +57,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1783148766, - "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=", - "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030", + "lastModified": 1783389287, + "narHash": "sha256-R5cxRkQCq5wIM91F9OkIEgu8YoSGjlMeTjYl9o4gpKw=", + "rev": "0ad6f47ea4fe188f4bc8f0380f93ae8523337c6c", "type": "tarball", - "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4364.0ad6f47ea4fe/nixexprs.tar.xz" }, "original": { "id": "nixpkgs", diff --git a/hosts/nixserve/default.nix b/hosts/nixserve/default.nix index adf5180..137d3c8 100644 --- a/hosts/nixserve/default.nix +++ b/hosts/nixserve/default.nix @@ -1,14 +1,19 @@ { config, pkgs, ... }: { - imports = [ ./hardware-configuration.nix ]; + imports = [ ./hardware-configuration.nix ./services.nix ]; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; networking.hostName = "nixserve"; + networking.hostId = "941b956b"; networking.networkmanager.enable = true; + boot.supportedFilesystems = [ "zfs" ]; + boot.zfs.forceImportRoot = false; + boot.zfs.extraPools = [ "media" ]; + time.timeZone = "Europe/Stockholm"; i18n.defaultLocale = "en_US.UTF-8"; @@ -31,9 +36,14 @@ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpiU4gStAtrJOBSkQA2YJh98fpWPpxWtWgwAGzVa/wc johansson.olov@gmail.com" ]; description = "ulve"; - extraGroups = [ "networkmanager" "wheel" ]; + extraGroups = [ "networkmanager" "wheel" "media" "docker" ]; }; + users.groups.media = {}; + users.users.jellyfin.extraGroups = [ "media" ]; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; + programs.zsh.enable = true; security.polkit.enable = true; @@ -41,6 +51,7 @@ wget curl git + transmission_4 ]; nixpkgs.config.allowUnfree = true; diff --git a/hosts/nixserve/home.nix b/hosts/nixserve/home.nix index da30395..0e2fd36 100644 --- a/hosts/nixserve/home.nix +++ b/hosts/nixserve/home.nix @@ -1,4 +1,8 @@ {config, pkgs, ...}: { imports = [ ../../modules/home-common.nix ]; + + programs.zsh.shellAliases = { + transfer = "transmission-remote localhost:9091"; + }; } diff --git a/hosts/nixserve/services.nix b/hosts/nixserve/services.nix new file mode 100644 index 0000000..98bb6f0 --- /dev/null +++ b/hosts/nixserve/services.nix @@ -0,0 +1,94 @@ +{ pkgs, ... }: + +let + proxyVhost = { upstream, websockets ? true, maxBodySize ? "1g" }: { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = upstream; + proxyWebsockets = websockets; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 3600; + proxy_send_timeout 3600; + proxy_buffering off; + client_max_body_size ${maxBodySize}; + ''; + }; + }; + + dockerService = { name, description, dir }: { + inherit description; + after = [ "docker.service" "network.target" ]; + requires = [ "docker.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + WorkingDirectory = dir; + ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build"; + ExecStop = "${pkgs.docker-compose}/bin/docker-compose down"; + }; + }; +in +{ + services.jellyfin.enable = true; + + services.tailscale = { + enable = true; + openFirewall = true; + useRoutingFeatures = "server"; + }; + + services.immich = { + enable = true; + mediaLocation = "/media/immich"; + }; + + virtualisation.docker = { + enable = true; + enableOnBoot = true; + }; + + systemd.services.transmission = dockerService { + name = "transmission"; + description = "Transmission via Mullvad VPN"; + dir = "/home/ulve/code/transmission"; + }; + + systemd.services.aftersummer = dockerService { + name = "aftersummer"; + description = "Aftersummer"; + dir = "/home/ulve/code/aftersummer"; + }; + + systemd.services.spine = dockerService { + name = "spine"; + description = "Spine ebook server"; + dir = "/home/ulve/code/wargaming"; + }; + + systemd.services.bookthing = dockerService { + name = "bookthing"; + description = "Bookthing audiobook server"; + dir = "/home/ulve/code/bookthing"; + }; + + security.acme = { + acceptTerms = true; + defaults.email = "johansson.olov@gmail.com"; + }; + + services.nginx = { + enable = true; + virtualHosts."transmission.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:9091"; }; + virtualHosts."aftersummer.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:5588"; }; + virtualHosts."spine.maybec.at" = proxyVhost { upstream = "http://localhost:3000"; }; + virtualHosts."bookthing.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:8000"; }; + virtualHosts."jelly.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:8096"; }; + virtualHosts."photos.maybec.at" = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; }; + }; +}