forked from KptltD00M/nixy
Add new server modules and configurations for various services
- Introduced `default-creds` module for managing default credentials with Umami integration. - Added `fail2ban` module for brute-force attack protection with configurable ban times. - Created `firewall` module to enable and configure basic firewall settings. - Implemented `gitea` module for self-hosted Git service with PostgreSQL backend. - Developed `glance` module for a customizable dashboard with various widgets and themes. - Added `iknowyou` module for a self-hosted password manager with production and demo environments. - Introduced `kernel-hardening` module for enhancing kernel security settings. - Created `mazanoke` module for a simple web application with Nginx integration. - Added `mealie` module for a self-hosted meal planning application. - Implemented `stirling-pdf` module for PDF generation service. - Developed `umami` module for self-hosted analytics with secret management. - Added `ssh` module for secure SSH configuration with user restrictions. - Introduced `nixy` theme for a customized aesthetic experience across services.
This commit is contained in:
KptltD00M
@@ -0,0 +1,154 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit (import ../mk-container.nix {inherit lib config;}) mkContainer;
|
||||
domain = config.var.domain;
|
||||
hostIp = "10.233.12.1";
|
||||
|
||||
# Convert 6-char hex color to "H S L" string for glance (integers, no % sign)
|
||||
hexToGlanceHsl = hex: let
|
||||
h = lib.toLower hex;
|
||||
d = c:
|
||||
if c == "a"
|
||||
then 10
|
||||
else if c == "b"
|
||||
then 11
|
||||
else if c == "c"
|
||||
then 12
|
||||
else if c == "d"
|
||||
then 13
|
||||
else if c == "e"
|
||||
then 14
|
||||
else if c == "f"
|
||||
then 15
|
||||
else lib.toInt c;
|
||||
byte = pos: d (builtins.substring pos 1 h) * 16 + d (builtins.substring (pos + 1) 1 h);
|
||||
ri = byte 0;
|
||||
gi = byte 2;
|
||||
bi = byte 4;
|
||||
r = ri * 1.0 / 255.0;
|
||||
g = gi * 1.0 / 255.0;
|
||||
b = bi * 1.0 / 255.0;
|
||||
mx =
|
||||
if r >= g && r >= b
|
||||
then "r"
|
||||
else if g >= b
|
||||
then "g"
|
||||
else "b";
|
||||
mn =
|
||||
if r <= g && r <= b
|
||||
then "r"
|
||||
else if g <= b
|
||||
then "g"
|
||||
else "b";
|
||||
cmax =
|
||||
if mx == "r"
|
||||
then r
|
||||
else if mx == "g"
|
||||
then g
|
||||
else b;
|
||||
cmin =
|
||||
if mn == "r"
|
||||
then r
|
||||
else if mn == "g"
|
||||
then g
|
||||
else b;
|
||||
delta = cmax - cmin;
|
||||
l = (cmax + cmin) / 2.0;
|
||||
s =
|
||||
if delta < 0.0001
|
||||
then 0.0
|
||||
else if l <= 0.5
|
||||
then delta / (cmax + cmin)
|
||||
else delta / (2.0 - cmax - cmin);
|
||||
hue =
|
||||
if delta < 0.0001
|
||||
then 0.0
|
||||
else if mx == "r"
|
||||
then let
|
||||
raw = 60.0 * (g - b) / delta;
|
||||
in
|
||||
if raw < 0.0
|
||||
then raw + 360.0
|
||||
else raw
|
||||
else if mx == "g"
|
||||
then 60.0 * ((b - r) / delta + 2.0)
|
||||
else 60.0 * ((r - g) / delta + 4.0);
|
||||
in "${toString (builtins.floor (hue + 0.5))} ${toString (builtins.floor (s * 100.0 + 0.5))} ${
|
||||
toString (builtins.floor (l * 100.0 + 0.5))
|
||||
}";
|
||||
|
||||
c = config.stylix.base16Scheme;
|
||||
in {
|
||||
# 0444 so the glance user inside the container can read the bind-mounted file
|
||||
sops.secrets.adguard-pwd.mode = "0444";
|
||||
|
||||
imports = [
|
||||
(mkContainer {
|
||||
name = "glance";
|
||||
hostIp = hostIp;
|
||||
containerIp = "10.233.12.2";
|
||||
internet = true;
|
||||
bindMounts."/run/secrets/adguard-pwd" = {
|
||||
hostPath = config.sops.secrets.adguard-pwd.path;
|
||||
isReadOnly = true;
|
||||
};
|
||||
nixosConfig = {lib, ...}: {
|
||||
_module.args.domain = domain;
|
||||
_module.args.adguardUrl = "http://${hostIp}:3000";
|
||||
imports = [
|
||||
./home.nix
|
||||
./server.nix
|
||||
];
|
||||
|
||||
services.glance = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
port = 5678;
|
||||
host = "127.0.0.1";
|
||||
};
|
||||
theme = {
|
||||
light = false;
|
||||
background-color = hexToGlanceHsl c.base00; # background
|
||||
primary-color = hexToGlanceHsl c.base0D; # accent (iris/purple)
|
||||
positive-color = hexToGlanceHsl c.base0B; # positive (pine/teal)
|
||||
negative-color = hexToGlanceHsl c.base08; # negative (love/rose)
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
appendHttpConfig = ''
|
||||
proxy_cache_path /var/cache/nginx/glance levels=1:2 keys_zone=glance:1m inactive=30m max_size=100m;
|
||||
'';
|
||||
virtualHosts."glance" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8080;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5678";
|
||||
extraConfig = ''
|
||||
proxy_cache glance;
|
||||
proxy_cache_valid 200 30m;
|
||||
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
|
||||
add_header X-Cache-Status $upstream_cache_status;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [8080];
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
services.cloudflared.tunnels."${config.var.tunnelId}".ingress."home.${domain}" = "http://10.233.12.2:8080";
|
||||
}
|
||||
Reference in New Issue
Block a user