KptltD00M
5082521524
/ update-readme (push) Has been cancelled
- Introduced `default-creds` module for managing default credentials with Umami integration. - Added `fail2ban` module for brute-force attack protection with configurable ban times. - Created `firewall` module to enable and configure basic firewall settings. - Implemented `gitea` module for self-hosted Git service with PostgreSQL backend. - Developed `glance` module for a customizable dashboard with various widgets and themes. - Added `iknowyou` module for a self-hosted password manager with production and demo environments. - Introduced `kernel-hardening` module for enhancing kernel security settings. - Created `mazanoke` module for a simple web application with Nginx integration. - Added `mealie` module for a self-hosted meal planning application. - Implemented `stirling-pdf` module for PDF generation service. - Developed `umami` module for self-hosted analytics with secret management. - Added `ssh` module for secure SSH configuration with user restrictions. - Introduced `nixy` theme for a customized aesthetic experience across services.
30 lines
1.7 KiB
Markdown
30 lines
1.7 KiB
Markdown
# SERVER
|
|
|
|
## Overview
|
|
|
|
This document describes the architecture and setup of the self-hosted **NixOS server**, which is securely accessible via **a Cloudflare Tunnel**.
|
|
The server is designed for private, secure, and easily manageable self-hosting of various services.
|
|
|
|
|
|
|
|
## **Why This Setup?**
|
|
|
|
- **Private & Secure**: Services are only accessible through Cloudflare's access control, preventing exposure to the "public internet".
|
|
- **Domain-based Access**: A custom domain maps to the server's tunnel, making service access simple and consistent.
|
|
- **Modular & Declarative**: Everything is managed through NixOS modules (except for access control), ensuring reproducibility and easy configuration.
|
|
|
|
## **Self-Hosted Services**
|
|
|
|
The server hosts several key applications:
|
|
|
|
- **NGINX**: Reverse proxy for routing traffic to services via my domain name.
|
|
- **AdGuard Home**: A self-hosted DNS ad blocker for network-wide ad and tracker filtering.
|
|
- **Glance**: An awesome dashboard! (See the screenshot above)
|
|
- **Arr Stack (Radarr, Sonarr, etc.)**: Automated media management tools for handling movies and TV shows. (legaly ofc)
|
|
- **Mealie**: A self-hosted recipe manager and meal planner with a clean user interface.
|
|
- **Stirling-PDF**: A powerful, locally hosted web application for editing, merging, and converting PDF files.
|
|
- **CyberChef**: The "Cyber Swiss Army Knife" for data analysis, decoding, and encryption tasks.
|
|
- **Mazanoke**: A utility service for image processing, specialized in format conversion and downgrading/optimization.
|
|
- **SSH**: Secure remote access configuration for server management. (via browser too)
|
|
- **Security related stuff**: Cloudflared, Fail2Ban, Firewall
|