Wateir/NixServerConfig
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat : Add modular service to hostname

Browse source
This commit is contained in:
Wateir 2025-12-21 20:37:17 +01:00
parent 9453773af6
commit 1637885001
11 changed files with 112 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

9
configuration.nix
View file

@ -7,9 +7,11 @@
[
./hardware-configuration.nix
./package.nix
./module/hostname.nix
./host.nix
./default.nix
./module/nginx.nix
./module/newt.nix
./module/tailscale.nix
./module/searXNG.nix
./module/roundcube.nix
@ -59,9 +61,6 @@
variant = "azerty";
};
programs.zsh.enable = true;
users.users.manager = {
isNormalUser = true;
description = "manager";
@ -108,7 +107,7 @@
};
programs = {
zsh.enable = true;
zsh.enable = true; # Mandatory for the user manager
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.

55
default.nix Normal file
View file

@ -0,0 +1,55 @@
{ config, lib, ... }:
with lib;
let
mkServiceOption = { desc, defaultEnabled ? false, extraOpts ? {} }: mkOption {
description = desc;
default = {};
type = types.submodule {
options = {
enable = mkEnableOption desc // { default = defaultEnabled; };
} // extraOpts;
};
};
in
{
options = {
sACME = mkServiceOption { desc = "ACME DNS Challenge"; };
sROUNDCUBE = mkServiceOption {
desc = "Roundcube webapp";
extraOpts = {
port = mkOption { type = types.port; default = 1984; };
};
};
sVAULTWARDEN = mkServiceOption {
desc = "Vaultwarden service";
extraOpts = {
externalPort = mkOption { type = types.port; default = 8000; };
internalPort = mkOption { type = types.port; default = 8222; };
};
};
sSEARXNG = mkServiceOption {
desc = "SearXNG meta-search engine";
extraOpts = {
port = mkOption { type = types.port; default = 1692; };
};
};
sTAILSCALE = mkServiceOption {
desc = "Tailscale VPN";
defaultEnabled = true;
};
sNEWT = mkServiceOption { desc = "Newt custom wireguard tunnel"; };
HostName = mkOption {
type = types.str;
default = "${config.networking.hostName}.ssh.wateir.fr";
description = "Global hostname with domain for all services";
};
};
}

11
host.nix Normal file
View file

@ -0,0 +1,11 @@
{ config, lib, ... }:
{
config = lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
sVAULTWARDEN.enable = true;
sROUNDCUBE.enable = true;
sSEARXNG.enable = true;
sACME.enable = true;
sNEWT.enable = true;
};
}

8
module/acme.nix
View file

@ -1,11 +1,11 @@
{ config, ... }:
{ config, lib, ... }:
{
lib.mkIf config.sACME.enable {
security.acme = {
acceptTerms = true;
defaults.email = "admin+contact@wateir.fr";
defaults.email = config.sACME.email;
certs."wateir.fr" = {
certs."${config.sACME.domain}" = {
dnsProvider = "ovh";
environmentFile = "/etc/acme.env";
};

11
module/hostname.nix
View file

@ -1,11 +0,0 @@
{ config, lib, pkgs, ... }:
with lib;
{
options.HostName = mkOption {
type = types.str;
default = "${config.networking.hostName}.ssh.wateir.fr";
description = "Global hostname with domain for all services";
};
}

2
module/newt.nix
View file

@ -1,6 +1,6 @@
{config,lib, ... }:
{
lib.mkIf config.sNEWT.enable{
services.newt = {
enable = true;
environmentFile = "/etc/newt.env";

36
module/nginx.nix
View file

@ -1,17 +1,16 @@
{ config, pkgs, lib, ... }:
lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
with lib;
services.nginx = {
enable = true;
virtualHosts = {
{
services.nginx.enable = true;
services.nginx.virtualHosts = mkMerge [
(mkIf config.sVAULTWARDEN.enable {
"${config.HostName}-vault" = {
listen = [
{ addr = "0.0.0.0"; port = 8000; }
];
listen = [{ addr = "0.0.0.0"; port = config.sVAULTWARDEN.externalPort; }];
locations."/" = {
proxyPass = "http://127.0.0.1:8222";
proxyPass = "http://127.0.0.1:${toString config.sVAULTWARDEN.internalPort}";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
@ -20,21 +19,18 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
'';
};
};
})
(mkIf config.sROUNDCUBE.enable {
"${config.HostName}-roundcube" = {
listen = [
{ addr = "0.0.0.0"; port = 1984; }
];
listen = [{ addr = "0.0.0.0"; port = config.sROUNDCUBE.port; }];
root = "${pkgs.roundcube}/public_html";
locations."/" = {
extraConfig = ''
index index.php index.html;
try_files $uri $uri/ /index.php?$args;
'';
};
locations."~ \\.php$" = {
extraConfig = ''
include ${pkgs.nginx}/conf/fastcgi_params;
@ -43,9 +39,11 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
'';
};
};
};
};
})
];
networking.firewall.allowedTCPPorts = [ 1984 8000 ];
networking.firewall.allowedTCPPorts = concatLists [
(if config.sVAULTWARDEN.enable then [ config.sVAULTWARDEN.externalPort ] else [])
(if config.sROUNDCUBE.enable then [ config.sROUNDCUBE.port ] else [])
];
}

8
module/roundcube.nix
View file

@ -1,16 +1,15 @@
{ config,pkgs,lib, ... }:
{ config, pkgs, lib, ... }:
lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
lib.mkIf config.sROUNDCUBE.enable {
services.roundcube = {
enable = true;
hostName = "${config.HostName}";
plugins = [ "multiple_accounts" ];
configureNginx = false;
extraConfig = ''
# PurelyMail is the entreprise who host my mail
# PurelyMail configuration
$config['default_host'] = 'ssl://imap.purelymail.com';
$config['default_port'] = 993;
$config['smtp_server'] = 'tls://smtp.purelymail.com';
@ -22,5 +21,4 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
systemd.services.nginx.serviceConfig.ProtectHome = false;
users.groups.roundcube.members = [ "nginx" ];
}

4
module/searXNG.nix
View file

@ -1,6 +1,6 @@
{ config,lib,pkgs, ... }:
lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004"){
lib.mkIf config.sSEARXNG.enable {
services.searx = {
enable = true;
redisCreateLocally = true;
@ -9,7 +9,7 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004"){
environmentFile = "/etc/searx.env";
settings.server = {
bind_address = "0.0.0.0";
port = 1692;
port = config.sSEARXNG.port;
};
settings.engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
"wikidata".disabled = true;

22
module/tailscale.nix
View file

@ -1,17 +1,17 @@
{config,lib, ... }:
{ config, lib, pkgs, ... }:
{
lib.mkIf config.sTAILSCALE.enable {
services.tailscale = {
enable = true;
extraDaemonFlags = [
"--no-logs-no-support"
];
enable = true;
extraDaemonFlags = [
"--no-logs-no-support"
];
extraSetFlags = [
"--ssh=false"
];
useRoutingFeatures = "server"; # or "client" / "both"
};
extraSetFlags = [
"--ssh=false"
];
useRoutingFeatures = "server";
};
networking.firewall = {
allowedTCPPorts = [ 443 ];

12
module/vaultWarden.nix
View file

@ -1,16 +1,12 @@
{ config, pkgs, lib, ... }:
{ config, lib, ... }:
lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004"){
lib.mkIf config.sVAULTWARDEN.enable {
services.vaultwarden = {
enable = true;
backupDir = "/var/local/vaultwarden/backup";
environmentFile = "/etc/vaultwarden.env";
config = {
ROCKET_PORT = config.sVAULTWARDEN.internalPort;
ROCKET_ADDRESS = "127.0.0.1";
SIGNUPS_ALLOWED = true;
ROCKET_PORT = 8222;
};
};
}