Add new server modules and configurations for various services

- Introduced `default-creds` module for managing default credentials with Umami integration.
- Added `fail2ban` module for brute-force attack protection with configurable ban times.
- Created `firewall` module to enable and configure basic firewall settings.
- Implemented `gitea` module for self-hosted Git service with PostgreSQL backend.
- Developed `glance` module for a customizable dashboard with various widgets and themes.
- Added `iknowyou` module for a self-hosted password manager with production and demo environments.
- Introduced `kernel-hardening` module for enhancing kernel security settings.
- Created `mazanoke` module for a simple web application with Nginx integration.
- Added `mealie` module for a self-hosted meal planning application.
- Implemented `stirling-pdf` module for PDF generation service.
- Developed `umami` module for self-hosted analytics with secret management.
- Added `ssh` module for secure SSH configuration with user restrictions.
- Introduced `nixy` theme for a customized aesthetic experience across services.

server-modules/cloudflared.nix

@@ -0,0 +1,37 @@
+# Cloudflared tunnel configuration for NixOS
+# It allows exposing services securely via Cloudflare Tunnel
+{
+  config,
+  pkgs,
+  ...
+}: {
+  sops.secrets.cloudflared-token.mode = "0400";
+
+  # To setup cloudflared, run:
+  # - `cloudflared tunnel login`
+  # - `cloudflared tunnel create YourTunnelName`
+  #
+  # This will create a credentials file & give you the tunnel ID to use below.
+  services.cloudflared = {
+    enable = true;
+    tunnels."${config.var.tunnelId}" = {
+      credentialsFile = config.sops.secrets."cloudflared-token".path;
+      default = "http_status:404";
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    cloudflared
+  ];
+
+  systemd.services."cloudflared-tunnel-${config.var.tunnelId}" = {
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+  };
+
+  # At the moment (2025), for support of browser rendering of the tunnels, this line is required:
+  services.openssh.settings.Macs = [
+    "hmac-sha2-256"
+  ];
+}