infra

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


diff --git a/dragonwell/atproto.nix b/dragonwell/atproto.nix
index 745413a163b5bf6964a33ea241538570279f6815..f94314d3dc48adc856fcd9637881776283db75e6 100644
--- a/dragonwell/atproto.nix
+++ b/dragonwell/atproto.nix
@@ -1,15 +1,20 @@
 { config, ... }:
 {
   age.secrets.pds.file = ../secrets/pds.age;
-  services.bluesky-pds = {
-    enable = true;
-    pdsadmin.enable = true;
-    settings = {
-      PDS_PORT = 2759;
-      PDS_HOSTNAME = "pds.jolheiser.com";
+  services = {
+    bluesky-pds = {
+      enable = true;
+      pdsadmin.enable = true;
+      settings = {
+        PDS_PORT = 2759;
+        PDS_HOSTNAME = "pds.jolheiser.com";
+      };
+      environmentFiles = [
+        config.age.secrets.pds.path
+      ];
     };
-    environmentFiles = [
-      config.age.secrets.pds.path
-    ];
+    caddy.virtualHosts."pds.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:2759
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85


diff --git a/dragonwell/caddy.nix b/dragonwell/caddy.nix
index 6a08500047fd115adf60eada0dc4d72f9ae73d77..2f4a48b902f7dbf70bdbc35ab0af754a04c6055c 100644
--- a/dragonwell/caddy.nix
+++ b/dragonwell/caddy.nix
@@ -1,7 +1,4 @@
 { inputs, pkgs, ... }:
-let
-  modules = import ./go.nix;
-in
 {
   services.caddy = {
     enable = true;
@@ -44,72 +41,6 @@           root * ${inputs.blog.packages.${pkgs.stdenv.hostPlatform.system}.default}
           file_server
         '';
       };
-      "go.jolheiser.com" = {
-        extraConfig = ''
-          header Content-Type text/html
-          ${modules}
-          respond /* `<html><head>
-            <meta name="go-import" content="go.jolheiser.com{path} git https://git.jolheiser.com{path}.git">
-            <meta http-equiv="refresh" content="3; url=https://pkg.go.dev/go.jolheiser.com{path}" />
-            </head><body>
-            Redirecting to <a href="https://pkg.go.dev/go.jolheiser.com{path}">https://pkg.go.dev/go.jolheiser.com{path}</a>
-            </body></html>`
-        '';
-      };
-      "git.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:8449
-      '';
-      "pr.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:7449
-      '';
-      "id.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:2884
-      '';
-      "recipes.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:3663
-      '';
-      "irc.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:7658
-      '';
-      "dnd.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:30000
-      '';
-      "pds.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:2759
-      '';
-      "oa2p.jolheiser.com".extraConfig = ''
-        reverse_proxy localhost:6227
-      '';
-      "wiki.jolheiser.com".extraConfig = ''
-        	handle /oauth2/* {
-        		reverse_proxy localhost:6227 {
-        			header_up X-Real-IP {remote_host}
-        			header_up X-Forwarded-Uri {uri}
-        		}
-        	}
-
-        	handle {
-        		forward_auth localhost:6227 {
-        			uri /oauth2/auth
-
-        			header_up X-Real-IP {remote_host}
-
-        			@error status 401
-        			handle_response @error {
-        				redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
-        			}
-        		}
-
-        		reverse_proxy localhost:9454
-        	}
-      '';
-      "budget.jolheiser.com".extraConfig = ''
-        handle_path /static/* {
-          root * ${inputs.mint.packages.${pkgs.stdenv.hostPlatform.system}.default}/lib/mint/static/
-          file_server
-        }
-        reverse_proxy localhost:6468
-      '';
       "dev.jolheiser.com".extraConfig = ''
         reverse_proxy localhost:3389
         handle_errors 502 503 504 {

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


diff --git a/dragonwell/default.nix b/dragonwell/default.nix
index f274c7db70b7f386c7d1dc7cbee8f1b9250f6df6..3e37cf8e8780579020aecc4a08a5e96dcee26d74 100644
--- a/dragonwell/default.nix
+++ b/dragonwell/default.nix
@@ -11,6 +11,7 @@     ./forge-lines.nix
     ./foundry.nix
     #./git-bug.nix
     ./git-pr.nix
+    ./go.nix
     ./gollum.nix
     ./horcrux.nix
     ./mealie.nix

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


diff --git a/dragonwell/foundry.nix b/dragonwell/foundry.nix
index 859ac0b78a11efad9b28f45c8cc30766327baaf0..ef110dd8b1ad98733cdabd7883b8744da8043a26 100644
--- a/dragonwell/foundry.nix
+++ b/dragonwell/foundry.nix
@@ -1,12 +1,17 @@
 { inputs, pkgs, ... }:
 {
-  services.foundryvtt = {
-    enable = true;
-    hostName = "dnd.jolheiser.com";
-    minifyStaticFiles = true;
-    proxyPort = 443;
-    proxySSL = true;
-    upnp = false;
-    package = inputs.foundry.packages.${pkgs.stdenv.hostPlatform.system}.foundryvtt_14;
+  services = {
+    foundryvtt = {
+      enable = true;
+      hostName = "dnd.jolheiser.com";
+      minifyStaticFiles = true;
+      proxyPort = 443;
+      proxySSL = true;
+      upnp = false;
+      package = inputs.foundry.packages.${pkgs.stdenv.hostPlatform.system}.foundryvtt_14;
+    };
+    caddy.virtualHosts."dnd.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:30000
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


diff --git a/dragonwell/git-pr.nix b/dragonwell/git-pr.nix
index ad540f2360a563a42206e201a5e0af8bc1d0b8bc..f5d249d359e6b7ec3412a8db60e973f7008f1bbd 100644
--- a/dragonwell/git-pr.nix
+++ b/dragonwell/git-pr.nix
@@ -1,25 +1,30 @@
 {
-  services.git-pr = {
-    enable = false;
-    openFirewall = true;
-    url = "pr.jolheiser.com";
-    admins = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXoiWcPkL5kUAqJfMxnPM/ND4qJ4kKShDhXdqnYv2ZB" ];
-    sshPort = 7448;
-    enableWeb = true;
-    webPort = 7449;
-    theme = "catppuccin-mocha";
-    timeFormat = "01/02/2006 at 03:04:05PM";
-    repos = [
-      {
-        id = "ugit";
-        cloneAddr = "https://git.jolheiser.com/ugit.git";
-        desc = "Minimal git service";
-      }
-      {
-        id = "git-pr-nix";
-        cloneAddr = "https://git.jolheiser.com/git-pr-nix.git";
-        desc = "Nix flake, package, and module for git-pr";
-      }
-    ];
+  services = {
+    git-pr = {
+      enable = false;
+      openFirewall = true;
+      url = "pr.jolheiser.com";
+      admins = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXoiWcPkL5kUAqJfMxnPM/ND4qJ4kKShDhXdqnYv2ZB" ];
+      sshPort = 7448;
+      enableWeb = true;
+      webPort = 7449;
+      theme = "catppuccin-mocha";
+      timeFormat = "01/02/2006 at 03:04:05PM";
+      repos = [
+        {
+          id = "ugit";
+          cloneAddr = "https://git.jolheiser.com/ugit.git";
+          desc = "Minimal git service";
+        }
+        {
+          id = "git-pr-nix";
+          cloneAddr = "https://git.jolheiser.com/git-pr-nix.git";
+          desc = "Nix flake, package, and module for git-pr";
+        }
+      ];
+    };
+    caddy.virtualHosts."pr.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:7449
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


diff --git a/dragonwell/go.nix b/dragonwell/go.nix
index fe1f7cf41895bf96e315a5d1a3a765dfba07b170..e388f3a9dc0a0068896adce91bdba0dd89b22a6d 100644
--- a/dragonwell/go.nix
+++ b/dragonwell/go.nix
@@ -1,5 +1,5 @@
 let
-  modules = [
+  altModules = [
     {
       name = "hcaptcha";
       repo = "gitea.com/jolheiser/hcaptcha";
@@ -9,14 +9,28 @@       name = "pwn";
       repo = "gitea.com/jolheiser/pwn";
     }
   ];
+  redirects = builtins.concatStringsSep "\n" (
+    builtins.map (module: ''
+      respond /${module.name}* `<html><head>
+                <meta name="go-import" content="go.jolheiser.com/${module.name} git https://${module.repo}.git">
+                <meta http-equiv="refresh" content="3; url=https://pkg.go.dev/go.jolheiser.com/${module.name}" />
+                </head><body>
+                Redirecting to <a href="https://pkg.go.dev/go.jolheiser.com/${module.name}">https://pkg.go.dev/go.jolheiser.com/${module.name}</a>
+                </body></html>`
+    '') altModules
+  );
 in
-builtins.concatStringsSep "\n" (
-  builtins.map (module: ''
-    respond /${module.name}* `<html><head>
-              <meta name="go-import" content="go.jolheiser.com/${module.name} git https://${module.repo}.git">
-              <meta http-equiv="refresh" content="3; url=https://pkg.go.dev/go.jolheiser.com/${module.name}" />
-              </head><body>
-              Redirecting to <a href="https://pkg.go.dev/go.jolheiser.com/${module.name}">https://pkg.go.dev/go.jolheiser.com/${module.name}</a>
-              </body></html>`
-  '') modules
-)
+{
+  services.caddy.virtualHosts."go.jolheiser.com" = {
+    extraConfig = ''
+      header Content-Type text/html
+      ${redirects}
+      respond /* `<html><head>
+        <meta name="go-import" content="go.jolheiser.com{path} git https://git.jolheiser.com{path}.git">
+        <meta http-equiv="refresh" content="3; url=https://pkg.go.dev/go.jolheiser.com{path}" />
+        </head><body>
+        Redirecting to <a href="https://pkg.go.dev/go.jolheiser.com{path}">https://pkg.go.dev/go.jolheiser.com{path}</a>
+        </body></html>`
+    '';
+  };
+}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


diff --git a/dragonwell/gollum.nix b/dragonwell/gollum.nix
index 612d8dcfc7dca4d0a9f7ddbf8f9fc11ff58e206b..a1216f5260060c6d9c164e47ab8c79937891d2c4 100644
--- a/dragonwell/gollum.nix
+++ b/dragonwell/gollum.nix
@@ -1,14 +1,39 @@
 { pkgs, config, ... }:
 {
-  services.gollum = {
-    enable = true;
-    stateDir = "/var/lib/ugit/repos/wiki.git";
-    emoji = true;
-    h1-title = true;
-    port = 9454;
-    branch = "main";
-    user = "ugit";
-    group = "ugit";
+  services = {
+    gollum = {
+      enable = true;
+      stateDir = "/var/lib/ugit/repos/wiki.git";
+      emoji = true;
+      h1-title = true;
+      port = 9454;
+      branch = "main";
+      user = "ugit";
+      group = "ugit";
+    };
+    caddy.virtualHosts."wiki.jolheiser.com".extraConfig = ''
+      	handle /oauth2/* {
+      		reverse_proxy localhost:6227 {
+      			header_up X-Real-IP {remote_host}
+      			header_up X-Forwarded-Uri {uri}
+      		}
+      	}
+
+      	handle {
+      		forward_auth localhost:6227 {
+      			uri /oauth2/auth
+
+      			header_up X-Real-IP {remote_host}
+
+      			@error status 401
+      			handle_response @error {
+      				redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
+      			}
+      		}
+
+      		reverse_proxy localhost:9454
+      	}
+    '';
   };
 
   # Hack to work with bare repos

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


diff --git a/dragonwell/mealie.nix b/dragonwell/mealie.nix
index fd9b859026ad19acd81b3ecf8377e820929906d4..1f4b0e4ffd930690d0f1972d7243d1fd32e5f177 100644
--- a/dragonwell/mealie.nix
+++ b/dragonwell/mealie.nix
@@ -1,22 +1,27 @@
 { pkgs, config, ... }:
 {
   age.secrets.mealie.file = ../secrets/mealie.age;
-  services.mealie = {
-    enable = true;
-    # TODO remove this hack once mealie tests work again
-    package = pkgs.mealie.overrideAttrs (
-      _: _: {
-        doCheck = false;
-        checkPhase = ''echo "Skipping tests for mealie"'';
-        installCheckPhase = ''echo "Skipping install tests for mealie"'';
-      }
-    );
-    listenAddress = "localhost";
-    port = 3663;
-    settings = {
-      BASE_URL = "https://recipes.jolheiser.com";
-      ALLOW_PASSWORD_LOGIN = "false";
+  services = {
+    mealie = {
+      enable = true;
+      # TODO remove this hack once mealie tests work again
+      package = pkgs.mealie.overrideAttrs (
+        _: _: {
+          doCheck = false;
+          checkPhase = ''echo "Skipping tests for mealie"'';
+          installCheckPhase = ''echo "Skipping install tests for mealie"'';
+        }
+      );
+      listenAddress = "localhost";
+      port = 3663;
+      settings = {
+        BASE_URL = "https://recipes.jolheiser.com";
+        ALLOW_PASSWORD_LOGIN = "false";
+      };
+      credentialsFile = config.age.secrets.mealie.path;
     };
-    credentialsFile = config.age.secrets.mealie.path;
+    caddy.virtualHosts."recipes.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:3663
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


diff --git a/dragonwell/mint.nix b/dragonwell/mint.nix
index 6fef2695f7d3b46a9768999acf21eed459fd2e31..5d430ef2470f9fd74f25dd161ece77ed27c9e45a 100644
--- a/dragonwell/mint.nix
+++ b/dragonwell/mint.nix
@@ -1,11 +1,20 @@
-{ config, ... }:
+{ inputs, pkgs, config, ... }:
 {
   age.secrets.mint.file = ../secrets/mint.age;
-  services.mint = {
-    enable = true;
-    settings = {
-      MINT_LOG_LEVEL = "INFO";
+  services = {
+    mint = {
+      enable = true;
+      settings = {
+        MINT_LOG_LEVEL = "INFO";
+      };
+      environmentFile = config.age.secrets.mint.path;
     };
-    environmentFile = config.age.secrets.mint.path;
+    caddy.virtualHosts."budget.jolheiser.com".extraConfig = ''
+      handle_path /static/* {
+        root * ${inputs.mint.packages.${pkgs.stdenv.hostPlatform.system}.default}/lib/mint/static/
+        file_server
+      }
+      reverse_proxy localhost:6468
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


diff --git a/dragonwell/oa2p.nix b/dragonwell/oa2p.nix
index 08b18722d34b5afa7e42043e63bd972e38f7b99f..26d5e1f2bbf6446f26798b0854f8bfbccb731837 100644
--- a/dragonwell/oa2p.nix
+++ b/dragonwell/oa2p.nix
@@ -1,18 +1,23 @@
 { config, ... }:
 {
   age.secrets.oa2p.file = ../secrets/oa2p.age;
-  services.oauth2-proxy = {
-    enable = true;
-    provider = "oidc";
-    httpAddress = "localhost:6227";
-    reverseProxy = true;
-    cookie = {
-      secure = true;
-      domain = "wiki.jolheiser.com";
+  services = {
+    oauth2-proxy = {
+      enable = true;
+      provider = "oidc";
+      httpAddress = "localhost:6227";
+      reverseProxy = true;
+      cookie = {
+        secure = true;
+        domain = "wiki.jolheiser.com";
+      };
+      email.domains = [ "*" ];
+      keyFile = config.age.secrets.oa2p.path;
+      redirectURL = "https://wiki.jolheiser.com/oauth2/callback";
+      oidcIssuerUrl = "https://id.jolheiser.com";
     };
-    email.domains = [ "*" ];
-    keyFile = config.age.secrets.oa2p.path;
-    redirectURL = "https://wiki.jolheiser.com/oauth2/callback";
-    oidcIssuerUrl = "https://id.jolheiser.com";
+    caddy.virtualHosts."oa2p.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:6227
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


diff --git a/dragonwell/pocket-id.nix b/dragonwell/pocket-id.nix
index 2cb4a9031e2c179ad0dc615664683115816573ed..fc920a62fe44a0acd2a742534d9b76aa42631e7d 100644
--- a/dragonwell/pocket-id.nix
+++ b/dragonwell/pocket-id.nix
@@ -1,17 +1,22 @@
 { config, ... }:
 {
   age.secrets.pocket-id.file = ../secrets/pocket-id.age;
-  services.pocket-id = {
-    enable = true;
-    settings = {
-      APP_URL = "https://id.jolheiser.com";
-      PORT = 2884;
-      APP_NAME = "jolheiser ID";
-      EMAILS_VERIFIED = true;
-      UI_CONFIG_DISABLED = true;
-      HOST = "localhost";
-      ANALYTICS_DISABLED = true;
+  services = {
+    pocket-id = {
+      enable = true;
+      settings = {
+        APP_URL = "https://id.jolheiser.com";
+        PORT = 2884;
+        APP_NAME = "jolheiser ID";
+        EMAILS_VERIFIED = true;
+        UI_CONFIG_DISABLED = true;
+        HOST = "localhost";
+        ANALYTICS_DISABLED = true;
+      };
+      environmentFile = config.age.secrets.pocket-id.path;
     };
-    environmentFile = config.age.secrets.pocket-id.path;
+    caddy.virtualHosts."id.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:2884
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


diff --git a/dragonwell/soju.nix b/dragonwell/soju.nix
index 6f5e86c30b141cc339b38ec48f09d95cd300ccc2..516da2fdbab2ecf64ef0fe466a2c37f395a12b25 100644
--- a/dragonwell/soju.nix
+++ b/dragonwell/soju.nix
@@ -12,10 +12,15 @@       postRun = "systemctl reload soju";
       group = "soju";
     };
   };
-  services.soju = {
-    enable = true;
-    tlsCertificate = "${baseCertPath}/fullchain.pem";
-    tlsCertificateKey = "${baseCertPath}/key.pem";
+  services = {
+    soju = {
+      enable = true;
+      tlsCertificate = "${baseCertPath}/fullchain.pem";
+      tlsCertificateKey = "${baseCertPath}/key.pem";
+    };
+    caddy.virtualHosts."irc.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:7658
+    '';
   };
   systemd.services.soju.serviceConfig = {
     DynamicUser = lib.mkForce false;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


diff --git a/dragonwell/ugit.nix b/dragonwell/ugit.nix
index d92af5d68f43807e7693f5f739a0f3b2f33f9790..ab8f48cbf5947271b73ee6b07ba6b7f654807ff5 100644
--- a/dragonwell/ugit.nix
+++ b/dragonwell/ugit.nix
@@ -48,5 +48,8 @@       hostname = "git";
       port = 8447;
       authKey = "tskey-auth-kyuvaLt8pb11CNTRL-admMYrs6UWb5XaCcdWJAWbriZ6JMo7ksK"; # One-time key
     };
+    caddy.virtualHosts."git.jolheiser.com".extraConfig = ''
+      reverse_proxy localhost:8449
+    '';
   };
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


diff --git a/gunpowder/hardware.nix b/gunpowder/hardware.nix
index d2228942b378da69219c33f49acf165369fd5844..bc518b0409225f17184478670720b66df4008d1c 100644
--- a/gunpowder/hardware.nix
+++ b/gunpowder/hardware.nix
@@ -38,7 +38,8 @@       "gid=users"
     ];
   };
 
-  boot.initrd.luks.devices."luks-1f9bde68-9c4c-423c-a95f-17aa170dd2b4".device = "/dev/disk/by-uuid/1f9bde68-9c4c-423c-a95f-17aa170dd2b4";
+  boot.initrd.luks.devices."luks-1f9bde68-9c4c-423c-a95f-17aa170dd2b4".device =
+    "/dev/disk/by-uuid/1f9bde68-9c4c-423c-a95f-17aa170dd2b4";
 
   swapDevices = [ { device = "/dev/disk/by-uuid/7e84d904-b00a-4c6c-aba4-ec1dde2dff85"; } ];
 
@@ -53,4 +54,3 @@
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
-

Home