forked from KptltD00M/nixy
KptltD00M
5082521524
- Introduced `default-creds` module for managing default credentials with Umami integration. - Added `fail2ban` module for brute-force attack protection with configurable ban times. - Created `firewall` module to enable and configure basic firewall settings. - Implemented `gitea` module for self-hosted Git service with PostgreSQL backend. - Developed `glance` module for a customizable dashboard with various widgets and themes. - Added `iknowyou` module for a self-hosted password manager with production and demo environments. - Introduced `kernel-hardening` module for enhancing kernel security settings. - Created `mazanoke` module for a simple web application with Nginx integration. - Added `mealie` module for a self-hosted meal planning application. - Implemented `stirling-pdf` module for PDF generation service. - Developed `umami` module for self-hosted analytics with secret management. - Added `ssh` module for secure SSH configuration with user restrictions. - Introduced `nixy` theme for a customized aesthetic experience across services.
38 lines
1004 B
Nix
38 lines
1004 B
Nix
# Cloudflared tunnel configuration for NixOS
|
|
# It allows exposing services securely via Cloudflare Tunnel
|
|
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
sops.secrets.cloudflared-token.mode = "0400";
|
|
|
|
# To setup cloudflared, run:
|
|
# - `cloudflared tunnel login`
|
|
# - `cloudflared tunnel create YourTunnelName`
|
|
#
|
|
# This will create a credentials file & give you the tunnel ID to use below.
|
|
services.cloudflared = {
|
|
enable = true;
|
|
tunnels."${config.var.tunnelId}" = {
|
|
credentialsFile = config.sops.secrets."cloudflared-token".path;
|
|
default = "http_status:404";
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
cloudflared
|
|
];
|
|
|
|
systemd.services."cloudflared-tunnel-${config.var.tunnelId}" = {
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network-online.target"];
|
|
wants = ["network-online.target"];
|
|
};
|
|
|
|
# At the moment (2025), for support of browser rendering of the tunnels, this line is required:
|
|
services.openssh.settings.Macs = [
|
|
"hmac-sha2-256"
|
|
];
|
|
}
|