Add new server modules and configurations for various services
/ update-readme (push) Has been cancelled
/ update-readme (push) Has been cancelled
- Introduced `default-creds` module for managing default credentials with Umami integration. - Added `fail2ban` module for brute-force attack protection with configurable ban times. - Created `firewall` module to enable and configure basic firewall settings. - Implemented `gitea` module for self-hosted Git service with PostgreSQL backend. - Developed `glance` module for a customizable dashboard with various widgets and themes. - Added `iknowyou` module for a self-hosted password manager with production and demo environments. - Introduced `kernel-hardening` module for enhancing kernel security settings. - Created `mazanoke` module for a simple web application with Nginx integration. - Added `mealie` module for a self-hosted meal planning application. - Implemented `stirling-pdf` module for PDF generation service. - Developed `umami` module for self-hosted analytics with secret management. - Added `ssh` module for secure SSH configuration with user restrictions. - Introduced `nixy` theme for a customized aesthetic experience across services.
This commit is contained in:
KptltD00M
@@ -0,0 +1,42 @@
|
||||
{config, ...}: {
|
||||
imports = [
|
||||
# NixOS module
|
||||
../../nixos/home-manager.nix
|
||||
../../nixos/nix.nix
|
||||
../../nixos/systemd-boot.nix
|
||||
../../nixos/users.nix
|
||||
../../nixos/utils.nix
|
||||
../../nixos/amd-graphics.nix
|
||||
|
||||
# NixOS server modules
|
||||
../../server-modules/ssh.nix
|
||||
../../server-modules/firewall.nix
|
||||
../../server-modules/cloudflared.nix
|
||||
../../server-modules/glance
|
||||
../../server-modules/adguardhome.nix
|
||||
../../server-modules/arr.nix
|
||||
../../server-modules/blog.nix
|
||||
../../server-modules/awesome-wallpapers.nix
|
||||
../../server-modules/iknowyou.nix
|
||||
../../server-modules/stirling-pdf.nix
|
||||
../../server-modules/cyberchef.nix
|
||||
../../server-modules/mazanoke.nix
|
||||
../../server-modules/kernel-hardening.nix
|
||||
../../server-modules/fail2ban.nix
|
||||
../../server-modules/default-creds.nix
|
||||
../../server-modules/umami.nix
|
||||
../../server-modules/gitea.nix
|
||||
../../server-modules/mealie.nix
|
||||
|
||||
# You should let those lines as is
|
||||
./hardware-configuration.nix
|
||||
./variables.nix
|
||||
|
||||
./secrets
|
||||
];
|
||||
|
||||
home-manager.users."${config.var.username}" = import ./home.nix;
|
||||
|
||||
# Don't touch this
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
inputs,
|
||||
nixpkgs,
|
||||
...
|
||||
}:
|
||||
nixpkgs.lib.nixosSystem {
|
||||
modules = [
|
||||
{_module.args = {inherit inputs;};}
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
inputs.stylix.nixosModules.stylix
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.nixarr.nixosModules.default
|
||||
inputs.nix-index-database.nixosModules.default
|
||||
inputs.default-creds.nixosModules.default
|
||||
./configuration.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = ["dm-snapshot"];
|
||||
boot.kernelModules = ["kvm-amd"];
|
||||
boot.extraModulePackages = [];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/350cf109-5380-4982-8a9e-279a9275ee18";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/DD15-1125";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
fileSystems."/mnt/data" = {
|
||||
device = "/dev/disk/by-uuid/0b055155-0134-448c-b1ca-e81030ff064e";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=/"
|
||||
"compress=zstd"
|
||||
]; # adapte selon si t'as des subvolumes
|
||||
};
|
||||
swapDevices = [];
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
{config, ...}: {
|
||||
imports = [
|
||||
# Mostly user-specific configuration
|
||||
./variables.nix
|
||||
|
||||
# Programs
|
||||
../../home/programs/nvf
|
||||
../../home/programs/shell
|
||||
../../home/programs/git
|
||||
../../home/programs/git/lazygit.nix
|
||||
../../home/programs/nixy
|
||||
../../home/programs/nix-utils
|
||||
../../home/programs/yazi
|
||||
|
||||
../../home/programs/group/dev.nix
|
||||
];
|
||||
|
||||
home = {
|
||||
inherit (config.var) username;
|
||||
homeDirectory = "/home/" + config.var.username;
|
||||
|
||||
# Don't touch this
|
||||
stateVersion = "24.05";
|
||||
};
|
||||
|
||||
programs.home-manager.enable = true;
|
||||
|
||||
programs.nixy = {
|
||||
enable = true;
|
||||
configDirectory = config.var.configDirectory;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{pkgs, ...}: {
|
||||
sops = {
|
||||
age.keyFile = "/home/hadi/.config/sops/age/keys.txt";
|
||||
defaultSopsFile = ./secrets.yaml;
|
||||
secrets = {
|
||||
sshconfig = {
|
||||
owner = "hadi";
|
||||
path = "/home/hadi/.ssh/config";
|
||||
mode = "0600";
|
||||
};
|
||||
github-key = {
|
||||
owner = "hadi";
|
||||
path = "/home/hadi/.ssh/github";
|
||||
mode = "0600";
|
||||
};
|
||||
signing-key = {
|
||||
owner = "hadi";
|
||||
path = "/home/hadi/.ssh/key";
|
||||
mode = "0600";
|
||||
};
|
||||
signing-pub-key = {
|
||||
owner = "hadi";
|
||||
path = "/home/hadi/.ssh/key.pub";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
sops
|
||||
age
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
umami-secret: ENC[AES256_GCM,data:tImpd4sD92Omf/YFB8YE4gxAu+g801wQNR+k5rhY6AbzIIYOzpVmQL4XGjfp9Teky3olii4s3XTcmTyuMoxMWg==,iv:QFAEzYnAnxOOtrHWiM2IkvSs0Aqk3s1T5X7j5WC+tO8=,tag:FIbgHLfRVMJ2qZ6dOJ8zLw==,type:str]
|
||||
sshconfig: ENC[AES256_GCM,data:R54HVxqAyj9yGO/AYL8p6cnXgYxkQKW9XveHlBMTnDXBJ7r/4HgnefdymprnXmdlbNWcWrRqmaLEuzJs/0BfixXfMvmGTUrmJ0ASVuDrz9k6rOLADAKFikQh0dib7NU4JmPgmUzMncXc2WuCd3BCG3kwBQ==,iv:Ro9FA+MzTAp+ERQMT88z8ioCox/dTj2vWcqCDOSLag4=,tag:5XiXIyz5/pjGFOB5ZjdOVg==,type:str]
|
||||
github-key: ENC[AES256_GCM,data:NRYhcBIwGJEV13+YECLR+2IErsn/7clbnkx0Mltr7dQajSb5WHZ3QDH0KQPylEHhplE5IVS0h4I0z+Pb1B0UteCxFmJ5wZq+2BKZkvE7G3dojqBpgHcVqJV2GLEJkRjlHfRgsbq/OBe8xcsPh20P1KUyP0WIwVbpt+9dFWGxEGYkp2uSyuBIJ98kElt0zuVgl7WcYoDO7v5WmGzZfla+yZwURvMk8zcM3gopo+4KL6YnYUs+UA3VlBBn6VK4Nvbqy6X0R0+ZA5HHAXg+OFgGmfWnENZmsyQJHXEchGGgEldzThkQ4r8yMkgN/ax+AGouLyzbITapGE4sE11FFgL6Hmp4pSXxl3UAGF+cvV5pIujbb28CXmSPRMyYpoNxI93PSYz/txAzE6Cr2dgwxR4zpMelv4i6IaGnY8NgpY8jp2Y6C0uuJxJCN0RtnjQw1rM2uRnm7vMGyU7XXz9DEVfGnYpTWnykXsEjHE5DVGy80ejYQlc6dtmf3vdTWpt+YYdCPw8/cd0PIx2D6geh1c28,iv:wl+RG24mXYMklD8CBGXVD36DMhlWT/7zh8ZMvr7vgOk=,tag:OJhqF8PoXotr7IsyFW6q1g==,type:str]
|
||||
adguard-pwd: ENC[AES256_GCM,data:CAmZFpKN6FFRlCk=,iv:cz45T/z2ZYHNC46FNVp2YHmdhXD4ERhM31+Jo+9PkSk=,tag:GTUvzkYSP4flXs/HUNGYhw==,type:str]
|
||||
recyclarr: ENC[AES256_GCM,data:eJNbGHb4SZvbF7FAHMrpRynmpVyPiTpyZqNx40Fo+lanqdm7d7oRhkLD2PfqxpTcIyV6BxJk12wGUC0uWVuAihmToL/Ih2FJWIQFUOdbaov/xNWHE9mtoRX/A3gIwD8e3DoFMK/dAk2/TyvvAfxi2eYTDJvxecEttHQGxafq1jveHFDcC9e1aFk3M8O8YlX5yF3zl90mugsUVP+iaSURnY/nglZuEDzfJ6Edge7r5OSL6WYh3OUIu1yzuuKXRZ47B/gpXO/cP89JMmxdPj3FUJkk7Htf0s9ALzpVE9fRohDGcpPIkR6COCLTL+mqvVmyopA1zPoX8/X8eiuocpaT3vqJit7Bc6InzflY/5rlg1x0SyoXWQfEsperfNBeiZGngp382I7rrZ8QSwF4AIsmngNeyDRAnfasAU5OVwK+yPIVhRueEFLNrJPG3j2hpArlzpvY2EPBVJDrYwFslis8CASoUdvu6C7VxtJXFcOZR8QemwJarJFU7v1bVhQoIkarn3V7FfAXg/8RfYrn9HAIq5AiFFbQRNHWXzIceIgNKQFb5yfagtMtMq6XKhjsV07jeYt9X/YU80XRfkPm05yiLdLQHcDNmlB3R+SFPD7qjTE7LuSH1Kdc3DvxwrKfHJLsJ+nSIL1po8gDMW8BPc0g4n4dpQ6CFK5BaDFK4eovNpgAXoRC9orkGw/16YmMozp6J78VJLzu3jcYMFbySFznDUuWcFf/7dVV+7pLAj2ffWXzScLISRBhZ9RNUMaZAKAk7WTmxBhw0yzNiih8OFUkbpp1FFLuU0bnBY0iEz+8/OSwv8H7t0HYe29HO61p1huH34B/ZkPA5VLKivFh2mOPNzbvMqtIAkq1ro82Psvc6t88gVIc+VAOZ9zDLohp0FXrNVXwnrs7fxevQa0pUClDivO1ib5G4Znor7q+13jZglmh3G7nHiniO607dRoxszzVEQdTn8ku3XAfIPStsSfQwH46nXhr2kDkspcA7BqwJph0dsKKlfzf22C0OJkDY0L1DgKFvJRmmKAhOdB6XxXYwS+BcDT+8ugejTKpulyPSsbdb0m9p9lVAVu0GMxFEbUsuE+QHiAAP5Vle7swpl4h3i8uHSfKFra3qEswwRnPAHhPSdLSaSU6O6T5gN/b0hhO6dAiNR0UOkOG59fPasL0MRpeb3SkM4Nd6g5b/hY8dXaXR7pQHvh+4GmfJFWYaWm/cZ8k9JAYAw9Sn/spWnjRmpv9bnSxADGbkdV8NDHquDDDFVIIoDnWhQJpqrL61KZITx2Ete1SYdNiy++p3mOYisJgHDsRR1RNQNxhRW4EY8c5nCzgc8x+rU432pCOfMbAuGEfQXMwMGFGeoUg6EL5xEyUEJ/aqymxI+Vjk8h7KfDnOyyL/+1BKEd/GccrjeQfeZGRLI0Tu5gVgL6twc+u4av6inNMMhPFzZuVrfeo6bip5C8R0dK6Pbdz2L/fsgn3E4NNi14NM/DgLLhJRLvKQdCQx+BT+3soNRw5htTzuNS48MD2YDwZYvNfu6mo0r4j4I7Tj8zuCjddbGVa2/5XnhcfdUBx1VOd90H1RKkk8kgSoR0bgo7mLls=,iv:HT3a2YnFy0cF9qUO671kwqxuzFfNnfqynCUVGHf+3dM=,tag:nrA++7fsnc4Cx0OPSDKaRw==,type:str]
|
||||
wireguard-pia: ENC[AES256_GCM,data:2IvJARGhesMuH9RdWzsyrwA7eqrhLyacQqZ1RNEkGOPUkQGX4uimKBSzkxXRy/haZ4V2k73JdLSaB9rAuI0n65GmWHmarwZekOyhRZSNb+zvFgw5BPZmywG1wR2HiTGR/qILovAaz47q/VnohUnjbbMCUvarC4PytWGxMUH96GIgZar8HjHFtK8grCSxlvpHKiDeKx8VSXnY/Pxj1EplBtIqwmtAeZdf/VjtwOL0nY54doPwHdIAvJ0B8Cu0a1zJIGEbV1NlKIHEJ1YA7rmv1ODkBnbXbIHMxAR3jeqR/UDqhDmXe41KujhiJI7nNeO7FKo2v92jK3fSbxYKatLrzXktHpE9JsMYVBXzTK7yAXPgoDdgLXzWH0OrJGBSisPrvqmxUko7MPreuwVYfFlKpll6JLifk8sML4A+94UPR8b89guXn7kBkLg1Y1oIAyguCdKpNOD31nXBMFF0nTcmCwyshDySaGTfJDgox65/77AiN1wH,iv:cdu6lBjLnEEfSFmWMC4Vn2sLKsvpCaatzXlgRNkEMeA=,tag:y1rAeNPB+DNGTpnP94iQrA==,type:str]
|
||||
signing-key: ENC[AES256_GCM,data:FrJzuTgH/ooZkcnYL55uQcc4u+QzNnFvNVs2wDSE4nnwku+EuCJBlb8pd/6W0KPwIXzcki/8CY0YfRcRrzjExMgMa4hwxrlxS9bk3LNPzJsrRK5RJgPg3iA8L791f1zcDxNf8RuWatIqm1TCK+Vhdk/p+221zy1Gcq1dW8X+o4XzbPBzHdLagcIdB0wpjYTtIoGP2X8GoL/NJpuzIiQBK1HdGNKvUI2+ztqCQZOsxm+Fki57NteX3/Llw8AwABjdZvviOBZ62OvJ/SsOQ9NYAvKfAkog5zCn8DLvaqAPGSxRBQEYWM8GyL2imgs54YfEsOpGa4DzMiv4Sc5m398E/asaPq357eksUqh3EYpzoKZ5bIbd5+Vs3KBWKHltUCzXLHaLrIX0CuJFQFi7DCxEbYqlb04x5t3jc/c+/7uwqBHv1Y5gwAjd8JswDWmE7Q3xSk96Za57SCxWPYTo2ErsA2XdL+yxXdhmqkhDZKtUzrcHExhnYe7YLpSlBEclJ/G2BeTOFIWoAmN+1y4rh21R,iv:VaZrv5/41ZyIax702Yae4QmFKpcEaWwPmTo2Mxao3bU=,tag:HC0eqDNit7jQKeeDAKWXKg==,type:str]
|
||||
signing-pub-key: ENC[AES256_GCM,data:CB7uU2Q4oTEKihpTIXGLaV0fJ1cv/p4oJJ5kjaU6BZiKhsiMA1JILUw2oVIDTDb+80WPzolDzZwWM8v31d5QIrZpHcPrdRLyV0X2USfG9U4aQ/ls79QAyOOJXA==,iv:/Eb5/+p86tw3tqNiDVHGu7HS1KBtFiYIgasRYJsAiEo=,tag:dGdJlcrnuU73s+IMQ3w3hA==,type:str]
|
||||
cloudflared-token: ENC[AES256_GCM,data:7DwWFL6JbJXuc6fSyrZkMt/+DAcqDYBQOzJ1QhBL4yfCpQ57mjDV2beRZ8H7SuyoKY3caifHfAVVPDGG1YnffZ9anLRyDW383aHKmgaeztOXj44eVQcHi3evnSiH6h0HasiyO8pNzhnKpYew8CwHSvYZMraX3ITz8UKOTtsanO9/8ZD6Y9gyxfLoySqbeBy2x/0Ql5hrDfrX854C+vYuXM9VJbtQqMBa7+IBydUvddk=,iv:jZTk5ptuwc+1aP2rimqGnyCHR4/J+W4Kyn3LKXXkv/I=,tag:xr/LhoNH5aWdIJr0Py6nAg==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5Z3MzZmoyVDRtRmd3amFJ
|
||||
MWVvWlA1c3RFeVMrbHJQQmNTcG9ZN2tXSWxjClJ0L1psd1RFM1EreG1yNHdOYzZF
|
||||
aXphL0lvcGNFTFFMbkNocGNXY00xdW8KLS0tIFh2YjN0aTlRazBXSktnQWx0L3BY
|
||||
TEc5d01RaVFGNXc3dlljM0FTTHpENjQKOqwI+pl8UxVIVl43glnOYvW660/PsDGY
|
||||
yefODJGVtHrOm3yeXC2xlTi3sFW+c5wUl2yPqddbvcBt5Ud/yd4iXQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-04-12T18:24:10Z"
|
||||
mac: ENC[AES256_GCM,data:D7gWC1fxZkpG8dCr7aWhcyLT92NK1OefS4SIAq5ZImMYRJzzvhXtyJM9tzUYVWPU0ojhgOJyawlWEFk1P/DWjOrafBsBHdxUl5FtZrRb4Z/rquODhR8OT8UYFVKyAmjSfomUEDzYetJdXdAxhX3eNlT+eKI51IjqD9y1dYqcjMw=,iv:ZPIkMf/fUETeUYQdqu4TpS/ZE752079jIW9BlehhWlw=,tag:Z3i/Zc0zkEF5rsNnkmUB9A==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.2
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
# Choose your theme here:
|
||||
../../themes/nixy.nix
|
||||
];
|
||||
|
||||
config.var = {
|
||||
hostname = "jack";
|
||||
username = "hadi";
|
||||
configDirectory = "/home/" + config.var.username + "/.config/nixos"; # The path of the nixos configuration directory
|
||||
|
||||
keyboardLayout = "fr";
|
||||
|
||||
timeZone = "Europe/Paris";
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
extraLocale = "fr_FR.UTF-8";
|
||||
|
||||
git = {
|
||||
username = "Hadi";
|
||||
email = "112569860+anotherhadi@users.noreply.github.com";
|
||||
};
|
||||
|
||||
autoUpgrade = false;
|
||||
autoGarbageCollector = true;
|
||||
|
||||
domain = "hadi.icu";
|
||||
tunnelId = "a1dfa315-7fc3-4a65-8c02-8387932c35c3";
|
||||
networkInterface = "enp3s0";
|
||||
};
|
||||
|
||||
# Let this here
|
||||
options = {
|
||||
var = lib.mkOption {
|
||||
type = lib.types.attrs;
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user