hosts: make services per host
This commit is contained in:
parent
1543659f51
commit
a9b2a91b72
15 changed files with 290 additions and 2 deletions
|
@ -5,8 +5,8 @@
|
||||||
}: {
|
}: {
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
./services
|
||||||
../../modules
|
../../modules
|
||||||
../../modules/services/arr
|
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.loader = {
|
boot.loader = {
|
||||||
|
|
18
hosts/kariru/services/default.nix
Normal file
18
hosts/kariru/services/default.nix
Normal file
|
@ -0,0 +1,18 @@
|
||||||
|
{...}: {
|
||||||
|
services.radarr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
dataDir = "/var/lib/radarr";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.sonarr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
dataDir = "/var/lib/sonarr";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.prowlarr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
}
|
0
hosts/kariru/services/gluetun.nix
Normal file
0
hosts/kariru/services/gluetun.nix
Normal file
0
hosts/kariru/services/qbittorrent.nix
Normal file
0
hosts/kariru/services/qbittorrent.nix
Normal file
|
@ -5,8 +5,8 @@
|
||||||
}: {
|
}: {
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
./services
|
||||||
../../modules
|
../../modules
|
||||||
../../modules/services
|
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.loader = {
|
boot.loader = {
|
||||||
|
|
13
hosts/sakura/services/default.nix
Normal file
13
hosts/sakura/services/default.nix
Normal file
|
@ -0,0 +1,13 @@
|
||||||
|
{...}: {
|
||||||
|
imports = [
|
||||||
|
./traefik.nix
|
||||||
|
./homepage.nix
|
||||||
|
./searxng.nix
|
||||||
|
./hugo.nix
|
||||||
|
./stash.nix
|
||||||
|
./foundryvtt.nix
|
||||||
|
./forgejo.nix
|
||||||
|
./jellyfin.nix
|
||||||
|
./rustypaste.nix
|
||||||
|
];
|
||||||
|
}
|
17
hosts/sakura/services/forgejo.nix
Normal file
17
hosts/sakura/services/forgejo.nix
Normal file
|
@ -0,0 +1,17 @@
|
||||||
|
{pkgs, ...}: {
|
||||||
|
services.gitea = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.forgejo;
|
||||||
|
appName = "forgejo";
|
||||||
|
stateDir = "/sakura/forgejo";
|
||||||
|
settings = {
|
||||||
|
service.DISABLE_REGISTRATION = true;
|
||||||
|
server = {
|
||||||
|
HTTP_PORT = 3000;
|
||||||
|
DOMAIN = "git.notohh.dev";
|
||||||
|
ROOT_URL = "https://git.notohh.dev";
|
||||||
|
LANDING_PAGE = "/explore/repos";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
20
hosts/sakura/services/foundryvtt.nix
Normal file
20
hosts/sakura/services/foundryvtt.nix
Normal file
|
@ -0,0 +1,20 @@
|
||||||
|
{...}: {
|
||||||
|
sops.secrets.foundry-username = {};
|
||||||
|
sops.secrets.foundry-password = {};
|
||||||
|
virtualisation.oci-containers.containers.foundryvtt = {
|
||||||
|
image = "felddy/foundryvtt:release";
|
||||||
|
volumes = [
|
||||||
|
"/home/notoh/docker/foundryvtt:/data"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
CONTAINER_PRESERVE_CONFIG = "true";
|
||||||
|
};
|
||||||
|
environmentFiles = [
|
||||||
|
/run/secrets/foundry-username
|
||||||
|
/run/secrets/foundry-password
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"30000:30000"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
12
hosts/sakura/services/homepage.nix
Normal file
12
hosts/sakura/services/homepage.nix
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
{...}: {
|
||||||
|
virtualisation.oci-containers.containers.homepage = {
|
||||||
|
image = "ghcr.io/benphelps/homepage";
|
||||||
|
volumes = [
|
||||||
|
"/home/notoh/docker/homepage:/app/config"
|
||||||
|
"/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"3005:3000"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
13
hosts/sakura/services/hugo.nix
Normal file
13
hosts/sakura/services/hugo.nix
Normal file
|
@ -0,0 +1,13 @@
|
||||||
|
{pkgs, ...}: {
|
||||||
|
environment.systemPackages = with pkgs; [hugo];
|
||||||
|
virtualisation.oci-containers.containers.hugo = {
|
||||||
|
image = "klakegg/hugo:0.101.0";
|
||||||
|
cmd = ["server"];
|
||||||
|
volumes = [
|
||||||
|
"/home/notoh/docker/hugo:/src"
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"1313:1313"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
10
hosts/sakura/services/jellyfin.nix
Normal file
10
hosts/sakura/services/jellyfin.nix
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
{...}: {
|
||||||
|
services.jellyfin = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
services.jellyseerr = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
}
|
28
hosts/sakura/services/rustypaste.nix
Normal file
28
hosts/sakura/services/rustypaste.nix
Normal file
|
@ -0,0 +1,28 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
sops.secrets.rusty-auth-token = {};
|
||||||
|
environment.systemPackages = with pkgs; [rustypaste];
|
||||||
|
|
||||||
|
systemd.services.rustypaste = {
|
||||||
|
enable = true;
|
||||||
|
wantedBy = [
|
||||||
|
"multi-user.target"
|
||||||
|
];
|
||||||
|
description = "A minimal file upload/pastebin service.";
|
||||||
|
environment = {
|
||||||
|
# AUTH_TOKEN = config.sops.secrets.rusty-auth-token.path;
|
||||||
|
CONFIG = "/var/lib/rustypaste/config.toml";
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
User = "root";
|
||||||
|
ExecStart = "${pkgs.rustypaste}/bin/rustypaste";
|
||||||
|
Restart = "always";
|
||||||
|
RestartSec = 30;
|
||||||
|
StandardOutput = "syslog";
|
||||||
|
WorkingDirectory = "/var/lib/rustypaste";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
14
hosts/sakura/services/searxng.nix
Normal file
14
hosts/sakura/services/searxng.nix
Normal file
|
@ -0,0 +1,14 @@
|
||||||
|
{...}: {
|
||||||
|
virtualisation.oci-containers.containers.searxng = {
|
||||||
|
image = "searxng/searxng";
|
||||||
|
volumes = [
|
||||||
|
"/home/notoh/docker/searxng:/etc/searxng:rw"
|
||||||
|
];
|
||||||
|
environment = {
|
||||||
|
INSTANCE_NAME = "SearXNG";
|
||||||
|
};
|
||||||
|
ports = [
|
||||||
|
"8085:8080"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
23
hosts/sakura/services/stash.nix
Normal file
23
hosts/sakura/services/stash.nix
Normal file
|
@ -0,0 +1,23 @@
|
||||||
|
{...}: {
|
||||||
|
virtualisation.oci-containers.containers.stash = {
|
||||||
|
image = "stashapp/stash";
|
||||||
|
environment = {
|
||||||
|
STASH_STASH = "/data/";
|
||||||
|
STASH_GENERATED = "/generated/";
|
||||||
|
STASH_METADATA = "/metadata/";
|
||||||
|
STASH_CACHE = "/cache/";
|
||||||
|
STASH_PORT = "9999";
|
||||||
|
};
|
||||||
|
volumes = [
|
||||||
|
"/etc/localtime:/etc/localtime:ro"
|
||||||
|
"/home/notoh/docker/stash/.config:/root/.stash"
|
||||||
|
"/home/notoh/docker/stash/data:/data"
|
||||||
|
"/home/notoh/docker/stash/.metadata:/metadata"
|
||||||
|
"/home/notoh/docker/stash/cache:/cache"
|
||||||
|
"/home/notoh/docker/stash/generated:/generated"
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"9999:9999"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
120
hosts/sakura/services/traefik.nix
Normal file
120
hosts/sakura/services/traefik.nix
Normal file
|
@ -0,0 +1,120 @@
|
||||||
|
{config, ...}: {
|
||||||
|
sops.secrets.cloudflare-api-key = {};
|
||||||
|
networking.firewall.allowedTCPPorts = [80 443];
|
||||||
|
systemd.user.services.traefik.after = ["docker.service"];
|
||||||
|
systemd.services.traefik = {
|
||||||
|
environment = {
|
||||||
|
CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev";
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
EnvironmentFile = config.sops.secrets.cloudflare-api-key.path;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.traefik = {
|
||||||
|
enable = true;
|
||||||
|
dynamicConfigOptions = {
|
||||||
|
http = {
|
||||||
|
routers = {
|
||||||
|
api = {
|
||||||
|
rule = "PathPrefix(`/api/`)";
|
||||||
|
entryPoints = ["websecure"];
|
||||||
|
service = "api@internal";
|
||||||
|
};
|
||||||
|
homepage = {
|
||||||
|
rule = "Host(`dashboard.lab`)";
|
||||||
|
entrypoints = ["web"];
|
||||||
|
service = "homepage";
|
||||||
|
};
|
||||||
|
searxng = {
|
||||||
|
rule = "Host(`searxng.lab`)";
|
||||||
|
entrypoints = ["web"];
|
||||||
|
service = "searxng";
|
||||||
|
};
|
||||||
|
stash = {
|
||||||
|
rule = "Host(`stash.lab`)";
|
||||||
|
entrypoints = ["web"];
|
||||||
|
service = "stash";
|
||||||
|
};
|
||||||
|
jellyfin = {
|
||||||
|
rule = "Host(`jellyfin.lab`)";
|
||||||
|
entrypoints = ["web"];
|
||||||
|
service = "jellyfin";
|
||||||
|
};
|
||||||
|
hugo = {
|
||||||
|
rule = "Host(`notohh.dev`)";
|
||||||
|
entryPoints = ["websecure"];
|
||||||
|
service = "hugo";
|
||||||
|
tls.domains = [{main = "*.notohh.dev";}];
|
||||||
|
tls.certresolver = "production";
|
||||||
|
};
|
||||||
|
foundryvtt = {
|
||||||
|
rule = "Host(`foundry.notohh.dev`)";
|
||||||
|
entrypoints = ["websecure"];
|
||||||
|
service = "foundryvtt";
|
||||||
|
tls.domains = [{main = "*.notohh.dev";}];
|
||||||
|
tls.certresolver = "production";
|
||||||
|
};
|
||||||
|
gitea = {
|
||||||
|
rule = "Host(`git.notohh.dev`)";
|
||||||
|
entrypoints = ["websecure"];
|
||||||
|
service = "gitea";
|
||||||
|
tls.domains = [{main = "*.notohh.dev";}];
|
||||||
|
tls.certresolver = "production";
|
||||||
|
};
|
||||||
|
rustypaste = {
|
||||||
|
rule = "Host(`img.notohh.dev`)";
|
||||||
|
entrypoints = ["websecure"];
|
||||||
|
service = "rustypaste";
|
||||||
|
tls.domains = [{main = "*.notohh.dev";}];
|
||||||
|
tls.certresolver = "production";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services = {
|
||||||
|
homepage.loadBalancer.servers = [{url = "http://localhost:3005";}];
|
||||||
|
searxng.loadBalancer.servers = [{url = "http://localhost:8085";}];
|
||||||
|
hugo.loadBalancer.servers = [{url = "http://localhost:1313";}];
|
||||||
|
stash.loadBalancer.servers = [{url = "http://localhost:9999";}];
|
||||||
|
jellyfin.loadBalancer.servers = [{url = "http://localhost:8096";}];
|
||||||
|
foundryvtt.loadBalancer.servers = [{url = "http://localhost:30000";}];
|
||||||
|
gitea.loadBalancer.servers = [{url = "http://localhost:3000";}];
|
||||||
|
rustypaste.loadBalancer.servers = [{url = "http://localhost:8000";}];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
staticConfigOptions = {
|
||||||
|
log.level = "DEBUG";
|
||||||
|
api.dashboard = false;
|
||||||
|
api.insecure = false;
|
||||||
|
global = {
|
||||||
|
checkNewVersion = false;
|
||||||
|
sendAnonymousUsage = false;
|
||||||
|
};
|
||||||
|
entryPoints = {
|
||||||
|
websecure.address = ":443";
|
||||||
|
web.address = ":80";
|
||||||
|
};
|
||||||
|
certificatesResolvers = {
|
||||||
|
staging.acme = {
|
||||||
|
email = "x3xr6n66@notohh.dev";
|
||||||
|
storage = "/var/lib/traefik/acme.json";
|
||||||
|
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||||
|
dnsChallenge = {
|
||||||
|
provider = "cloudflare";
|
||||||
|
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
|
||||||
|
delayBeforeCheck = "0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
production.acme = {
|
||||||
|
email = "x3xr6n66@notohh.dev";
|
||||||
|
storage = "/var/lib/traefik/acme.json";
|
||||||
|
caServer = "https://acme-v02.api.letsencrypt.org/directory";
|
||||||
|
dnsChallenge = {
|
||||||
|
provider = "cloudflare";
|
||||||
|
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
|
||||||
|
delayBeforeCheck = "0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue