Closer

flake.lock

@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1783430736,
-        "narHash": "sha256-X8WX1ktiK9Qn3O/xefUA5zBnjQ9mvB1gHNaRyZTdAIc=",
+        "lastModified": 1783468284,
+        "narHash": "sha256-no8aODMs+tYEnEShJPHKap2imToiA++joPFL+o/ZAmg=",
         "owner": "ogulcancelik",
         "repo": "herdr",
-        "rev": "d190c1f55e05419b299fc68f60ea0aabc1ff7379",
+        "rev": "77f0339c3cd387c4ca3f4f240ff8b88065d66a22",
         "type": "github"
       },
       "original": {
@@ -57,11 +57,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1783148766,
-        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
-        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
+        "lastModified": 1783389287,
+        "narHash": "sha256-R5cxRkQCq5wIM91F9OkIEgu8YoSGjlMeTjYl9o4gpKw=",
+        "rev": "0ad6f47ea4fe188f4bc8f0380f93ae8523337c6c",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4364.0ad6f47ea4fe/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",

hosts/nixserve/default.nix

@@ -1,14 +1,19 @@
 { config, pkgs, ... }:
 
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [ ./hardware-configuration.nix ./services.nix ];
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
   networking.hostName = "nixserve";
+  networking.hostId = "941b956b";
   networking.networkmanager.enable = true;
 
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.zfs.forceImportRoot = false;
+  boot.zfs.extraPools = [ "media" ];
+
   time.timeZone = "Europe/Stockholm";
 
   i18n.defaultLocale = "en_US.UTF-8";
@@ -31,9 +36,14 @@
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpiU4gStAtrJOBSkQA2YJh98fpWPpxWtWgwAGzVa/wc johansson.olov@gmail.com"
     ];
     description = "ulve";
-    extraGroups = [ "networkmanager" "wheel" ];
+    extraGroups = [ "networkmanager" "wheel" "media" "docker" ];
   };
 
+  users.groups.media = {};
+  users.users.jellyfin.extraGroups = [ "media" ];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
   programs.zsh.enable = true;
   security.polkit.enable = true;
 
@@ -41,6 +51,7 @@
     wget
     curl
     git
+    transmission_4
   ];
 
   nixpkgs.config.allowUnfree = true;

hosts/nixserve/home.nix

@@ -1,4 +1,8 @@
 {config, pkgs, ...}:
 {
   imports = [ ../../modules/home-common.nix ];
+
+  programs.zsh.shellAliases = {
+    transfer = "transmission-remote localhost:9091";
+  };
 }

hosts/nixserve/services.nix

@@ -0,0 +1,94 @@
+{ pkgs, ... }:
+
+let
+  proxyVhost = { upstream, websockets ? true, maxBodySize ? "1g" }: {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = upstream;
+      proxyWebsockets = websockets;
+      extraConfig = ''
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 3600;
+        proxy_send_timeout 3600;
+        proxy_buffering off;
+        client_max_body_size ${maxBodySize};
+      '';
+    };
+  };
+
+  dockerService = { name, description, dir }: {
+    inherit description;
+    after = [ "docker.service" "network.target" ];
+    requires = [ "docker.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      WorkingDirectory = dir;
+      ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build";
+      ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
+    };
+  };
+in
+{
+  services.jellyfin.enable = true;
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    useRoutingFeatures = "server";
+  };
+
+  services.immich = {
+    enable = true;
+    mediaLocation = "/media/immich";
+  };
+
+  virtualisation.docker = {
+    enable = true;
+    enableOnBoot = true;
+  };
+
+  systemd.services.transmission = dockerService {
+    name = "transmission";
+    description = "Transmission via Mullvad VPN";
+    dir = "/home/ulve/code/transmission";
+  };
+
+  systemd.services.aftersummer = dockerService {
+    name = "aftersummer";
+    description = "Aftersummer";
+    dir = "/home/ulve/code/aftersummer";
+  };
+
+  systemd.services.spine = dockerService {
+    name = "spine";
+    description = "Spine ebook server";
+    dir = "/home/ulve/code/wargaming";
+  };
+
+  systemd.services.bookthing = dockerService {
+    name = "bookthing";
+    description = "Bookthing audiobook server";
+    dir = "/home/ulve/code/bookthing";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "johansson.olov@gmail.com";
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."transmission.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:9091"; };
+    virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.1:5588"; };
+    virtualHosts."spine.maybec.at"       = proxyVhost { upstream = "http://localhost:3000"; };
+    virtualHosts."bookthing.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:8000"; };
+    virtualHosts."jelly.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8096"; };
+    virtualHosts."photos.maybec.at"      = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; };
+  };
+}