feat : Add modular service to hostname

configuration.nix

@@ -7,9 +7,11 @@
     [
       ./hardware-configuration.nix
       ./package.nix
-      ./module/hostname.nix
+      ./host.nix
+      ./default.nix
       ./module/nginx.nix
       ./module/newt.nix
+      ./module/tailscale.nix
 
       ./module/searXNG.nix
       ./module/roundcube.nix
@@ -59,9 +61,6 @@
     variant = "azerty";
   };
 
-
-  programs.zsh.enable = true;
-
   users.users.manager = {
     isNormalUser = true;
     description = "manager";
@@ -108,7 +107,7 @@
   };
 
   programs = {
-    zsh.enable = true;
+    zsh.enable = true; # Mandatory for the user manager
 
     # Some programs need SUID wrappers, can be configured further or are
     # started in user sessions.

default.nix

@@ -0,0 +1,55 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  mkServiceOption = { desc, defaultEnabled ? false, extraOpts ? {} }: mkOption {
+    description = desc;
+    default = {};
+    type = types.submodule {
+      options = {
+        enable = mkEnableOption desc // { default = defaultEnabled; };
+      } // extraOpts;
+    };
+  };
+in
+{
+  options = {
+    sACME = mkServiceOption { desc = "ACME DNS Challenge"; };
+
+    sROUNDCUBE = mkServiceOption {
+      desc = "Roundcube webapp";
+      extraOpts = {
+        port = mkOption { type = types.port; default = 1984; };
+      };
+    };
+
+    sVAULTWARDEN = mkServiceOption {
+      desc = "Vaultwarden service";
+      extraOpts = {
+        externalPort = mkOption { type = types.port; default = 8000; };
+        internalPort = mkOption { type = types.port; default = 8222; };
+      };
+    };
+
+    sSEARXNG = mkServiceOption {
+      desc = "SearXNG meta-search engine";
+      extraOpts = {
+        port = mkOption { type = types.port; default = 1692; };
+      };
+    };
+
+    sTAILSCALE = mkServiceOption {
+      desc = "Tailscale VPN";
+      defaultEnabled = true;
+    };
+
+    sNEWT = mkServiceOption { desc = "Newt custom wireguard tunnel"; };
+
+    HostName = mkOption {
+      type = types.str;
+      default = "${config.networking.hostName}.ssh.wateir.fr";
+      description = "Global hostname with domain for all services";
+    };
+  };
+}

host.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+
+{
+  config = lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
+    sVAULTWARDEN.enable = true;
+    sROUNDCUBE.enable   = true;
+    sSEARXNG.enable     = true;
+    sACME.enable        = true;
+    sNEWT.enable        = true;
+  };
+}

module/acme.nix

@@ -1,11 +1,11 @@
-  { config, ... }:
+{ config, lib, ... }:
 
-  {
+lib.mkIf config.sACME.enable {
   security.acme = {
     acceptTerms = true;
-    defaults.email = "admin+contact@wateir.fr";
+    defaults.email = config.sACME.email;
 
-    certs."wateir.fr" = {
+    certs."${config.sACME.domain}" = {
       dnsProvider = "ovh";
       environmentFile = "/etc/acme.env";
     };

module/hostname.nix

@@ -1,11 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  options.HostName = mkOption {
-    type = types.str;
-    default = "${config.networking.hostName}.ssh.wateir.fr";
-    description = "Global hostname with domain for all services";
-  };
-}

module/newt.nix

@@ -1,6 +1,6 @@
  {config,lib, ... }:
 
-{
+lib.mkIf config.sNEWT.enable{
   services.newt = {
      enable = true;
      environmentFile = "/etc/newt.env";

module/nginx.nix

@@ -1,17 +1,16 @@
 { config, pkgs, lib, ... }:
 
-lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
+with lib;
 
-  services.nginx = {
+{
-    enable = true;
+  services.nginx.enable = true;
-    virtualHosts = {
+
+  services.nginx.virtualHosts = mkMerge [
+    (mkIf config.sVAULTWARDEN.enable {
       "${config.HostName}-vault" = {
-        listen = [
+        listen = [{ addr = "0.0.0.0"; port = config.sVAULTWARDEN.externalPort; }];
-          { addr = "0.0.0.0"; port = 8000; }
-        ];
-
         locations."/" = {
-          proxyPass = "http://127.0.0.1:8222";
+          proxyPass = "http://127.0.0.1:${toString config.sVAULTWARDEN.internalPort}";
           extraConfig = ''
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -20,21 +19,18 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
           '';
         };
       };
+    })
 
+    (mkIf config.sROUNDCUBE.enable {
       "${config.HostName}-roundcube" = {
-        listen = [
+        listen = [{ addr = "0.0.0.0"; port = config.sROUNDCUBE.port; }];
-          { addr = "0.0.0.0"; port = 1984; }
-        ];
-
         root = "${pkgs.roundcube}/public_html";
-
         locations."/" = {
           extraConfig = ''
             index index.php index.html;
             try_files $uri $uri/ /index.php?$args;
           '';
         };
-
         locations."~ \\.php$" = {
           extraConfig = ''
             include ${pkgs.nginx}/conf/fastcgi_params;
@@ -43,9 +39,11 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
           '';
         };
       };
-    };
+    })
-  };
+  ];
 
-
+  networking.firewall.allowedTCPPorts = concatLists [
-  networking.firewall.allowedTCPPorts = [ 1984 8000 ];
+    (if config.sVAULTWARDEN.enable then [ config.sVAULTWARDEN.externalPort ] else [])
+    (if config.sROUNDCUBE.enable   then [ config.sROUNDCUBE.port   ] else [])
+  ];
 }

module/roundcube.nix

@@ -1,16 +1,15 @@
 { config, pkgs, lib, ... }:
 
-lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
+lib.mkIf config.sROUNDCUBE.enable {
   services.roundcube = {
     enable = true;
     hostName = "${config.HostName}";
 
     plugins = [ "multiple_accounts" ];
-
     configureNginx = false;
 
     extraConfig = ''
-      # PurelyMail is the entreprise who host my mail
+      # PurelyMail configuration
       $config['default_host'] = 'ssl://imap.purelymail.com';
       $config['default_port'] = 993;
       $config['smtp_server'] = 'tls://smtp.purelymail.com';
@@ -22,5 +21,4 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004") {
 
   systemd.services.nginx.serviceConfig.ProtectHome = false;
   users.groups.roundcube.members = [ "nginx" ];
-
 }

module/searXNG.nix

@@ -1,6 +1,6 @@
 { config,lib,pkgs, ... }:
 
-lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004"){
+lib.mkIf config.sSEARXNG.enable {
   services.searx = {
       enable = true;
       redisCreateLocally = true;
@@ -9,7 +9,7 @@ lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004"){
       environmentFile = "/etc/searx.env";
       settings.server = {
         bind_address = "0.0.0.0";
-        port = 1692;
+        port = config.sSEARXNG.port;
       };
       settings.engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
         "wikidata".disabled = true;

module/tailscale.nix

@@ -1,6 +1,6 @@
- {config,lib, ... }:
+{ config, lib, pkgs, ... }:
 
-{
+lib.mkIf config.sTAILSCALE.enable {
   services.tailscale = {
     enable = true;
     extraDaemonFlags = [
@@ -10,7 +10,7 @@
     extraSetFlags = [
       "--ssh=false"
     ];
-	  useRoutingFeatures = "server";  # or "client" / "both"
+    useRoutingFeatures = "server";
   };
 
   networking.firewall = {

module/vaultWarden.nix

@@ -1,16 +1,12 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
-lib.mkIf (config.networking.hostName == "ThinkCentre-Server-004"){
+lib.mkIf config.sVAULTWARDEN.enable {
   services.vaultwarden = {
     enable = true;
-
-    backupDir = "/var/local/vaultwarden/backup";
-
-    environmentFile = "/etc/vaultwarden.env";
-
     config = {
+      ROCKET_PORT = config.sVAULTWARDEN.internalPort;
+      ROCKET_ADDRESS = "127.0.0.1";
       SIGNUPS_ALLOWED = true;
-      ROCKET_PORT = 8222;
     };
   };
 }