Merge pull request 'merge-box' (#3) from merge-box into devos

Reviewed-on: aynish/nix-garden#3

flake.nix

@@ -107,7 +107,7 @@
             cube = {
               modules = [ basant.nixosModule ];
             };
-            # box = { };
+            box = { channelName = "nixos" };
             # hypercube = { };
             # work = { };
           };
@@ -118,7 +118,7 @@
             suites = with profiles; rec {
               base = [ core users.root users.anish ];
               sealight = [ base server ]; # matrix rsshub backup wireguard
-              mossnet = [ base server ]; # shaarli wallabag nextcloud taskwarrior headphones 
+              mossnet = [ base server taskd nextcloud networking wireguard-box shaarli wallabag headphones dns backup monitoring dev gonic cron nfs]; 
               cube = [ base site server ];
               graphical = [ base bluetooth music sync wireguard wifi desktop ];
               curve = [ graphical secrets ];

hosts/box/configuration.nix

@@ -0,0 +1,96 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+  
+  # Use the GRUB 2 boot loader.
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.loader.grub = {
+    enable = true;
+    device = "nodev";
+    version = 2;
+    efiSupport = true;
+    enableCryptodisk = true;
+    efiInstallAsRemovable = true;
+  };
+  
+  boot.initrd.secrets = {
+    "/keyfile0.bin" = /etc/secrets/initrd/keyfile0.bin;
+    "/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin;
+  };
+
+  boot.initrd.luks.devices = {
+    "root" = { 
+      #name = "root";
+      device = "/dev/disk/by-uuid/f37f3222-47d7-42d8-b400-363320a31853"; # UUID for /dev/nvme01np2 
+      preLVM = true;
+      allowDiscards = true;
+      keyFile = "/keyfile0.bin";
+    };
+	};
+
+  # Data mount
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; # UUID for /dev/mapper/crypted-data
+    encrypted = {
+      enable = true;
+      label = "crypted-data";
+      blkDev = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; # UUID for /dev/sda1
+      keyFile = "/keyfile1.bin";
+    };
+  };
+
+  networking.interfaces.enp2s0 =  {
+    ipv4.addresses = [{
+      address = "192.168.1.240";
+      prefixLength = 24;
+    } ];
+    ipv4.routes = [ { address = "192.168.1.0"; prefixLength = 24; via = "192.168.1.1"; }];
+    useDHCP = false;
+   };
+   #networking.nameservers = [ "172.16.11.240" ];
+   networking.nameservers = [ "192.168.1.1" ];
+   networking.defaultGateway = {
+     address = "192.168.1.1";
+     interface = "enp2s0";
+   };
+
+  networking.hostName = "box"; # Define your hostname.
+  networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.wlp3s0.useDHCP = true;
+  networking.interfaces.enp2s0.useDHCP = false;
+
+  # Set your time zone.
+  time.timeZone = "Australia/Brisbane";
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "yes";
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  sound.enable = false;
+
+  programs.gnupg.agent.enable = true;
+  programs.gnupg.agent.pinentryFlavor = "curses";
+  programs.gnupg.agent.enableSSHSupport = true;
+
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "19.09"; # Did you read the comment?
+
+}
+

hosts/box/hardware-configuration.nix

@@ -0,0 +1,38 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/ade0752d-84d3-4e39-865b-9027ba2d5c67";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot/efi" =
+    { device = "/dev/disk/by-uuid/1715-278E";
+      fsType = "vfat";
+    };
+
+  fileSystems."/data" =
+    { device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06";
+      fsType = "ext4";
+    };
+
+  boot.initrd.luks.devices."crypted-data".device = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e";
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/b790abb4-ba5f-4476-8f09-b0fc575414aa"; }
+    ];
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+}

modules/gonic.nix

@@ -0,0 +1,109 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.gonic;
+  configFile = "/etc/gonic/config";
+  dataFolder = "/var/lib/gonic";
+in {
+  options = {
+
+    services.gonic = {
+      enable = mkEnableOption "Gonic music server and streamer";
+
+      settings = lib.mkOption {
+        type = types.str;
+        default = {};
+        example = literalExample ''
+            music-path        <path to your music dir>
+            podcast-path      <path to your podcasts dir>
+            cache-path        <path to cache dir>
+        '';
+        description = ''
+          Configuration for Gonic, see <link xlink:href="https://github.com/sentriz/gonic"/> for supported values.
+      '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "gonic";
+        description = "User account under which gonic runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "gonic";
+        description = "Group account under which gonic runs.";
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.etc."gonic/config".text = cfg.settings;
+
+    systemd.services.gonic = {
+      description = "gonic Music Server and Streamer compatible with Subsonic/Airsonic";
+      after = [ "remote-fs.target" "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        #GONIC_MUSIC_PATH
+        #GONIC_PODCAST_PATH
+        #GONIC_CACHE_PATH
+        #GONIC_DB_PATH
+        GONIC_SCAN_INTERVAL="800";
+        #...
+      };
+      serviceConfig = {
+        ExecStart = "${pkgs.gonic}/bin/gonic -config-path /etc/gonic/config";
+        WorkingDirectory = dataFolder;
+        TimeoutStopSec = "20";
+        KillMode = "process";
+        Restart = "on-failure";
+        RestartSec = "10";
+        User = cfg.user;
+        Group = cfg.group;
+        DevicePolicy = "closed";
+        NoNewPrivileges= " yes";
+        PrivateTmp = "yes";
+        PrivateUsers = "yes";
+        ProtectControlGroups = "yes";
+        ProtectKernelModules = "yes";
+        ProtectKernelTunables = "yes";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+        RestrictNamespaces = "yes";
+        RestrictRealtime = "yes";
+        SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
+        ReadWritePaths = dataFolder;
+        StateDirectory = baseNameOf dataFolder;
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "gonic") ({
+      gonic = {
+        description = "gonic service user";
+        name = cfg.user;
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    });
+
+    users.groups = optionalAttrs (cfg.group == "gonic") ({
+      gonic = {};
+    });
+    
+    services.nginx.virtualHosts."music.mossnet.lan" = {
+      enableACME = false;
+      forceSSL = false;
+
+      locations."/" = {
+        extraConfig = ''
+          proxy_pass http://localhost:4747/;
+          proxy_set_header X-Forwarded-Host $host;
+        '';
+      };
+    };
+  };
+}

modules/grasp.nix

@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ...}:
+
+{
+  systemd.services.grasp = {
+    description = "grasp server";
+    wantedBy = [ "default.target" ];
+
+    serviceConfig = {
+      ExecStart = "{$pkgs.grasp}/server/grasp_server.py --path /data/grasp/capture.org";
+    };
+  };
+}

modules/navidrome.nix

@@ -0,0 +1,101 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.navidrome;
+  configFile = "/etc/navidrome/settings.json";
+  dataFolder = "/var/lib/navidrome";
+in {
+  options = {
+
+    services.navidrome = {
+      enable = mkEnableOption "Navidrome music server and streamer";
+
+      settings = lib.mkOption {
+        type = with types; attrsOf (oneOf [ int str ]);
+        default = {};
+        example = literalExample ''
+          {
+            LogLevel = "INFO";
+            BaseURL = "/music";
+            ScanInterval = "10s";
+            TranscodingCacheSize = "15MB";
+            MusicFolder = "/data/music";
+          };
+        '';
+        description = ''
+          Configuration for Navidrome, see <link xlink:href="https://www.navidrome.org/docs/usage/configuration-options/"/> for supported values.
+      '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "navidrome";
+        description = "User account under which Navidrome runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "navidrome";
+        description = "Group account under which Navidrome runs.";
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.etc."navidrome/settings.json".text = builtins.toJSON cfg.settings;
+
+    services.navidrome.settings = {
+      DataFolder = dataFolder;
+      ConfigFile = configFile;
+    };
+    
+    systemd.services.navidrome = {
+      description = "Navidrome Music Server and Streamer compatible with Subsonic/Airsonic";
+      after = [ "remote-fs.target" "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        ND_CONFIGFILE = configFile;
+      };
+      serviceConfig = {
+        ExecStart = "${pkgs.navidrome}/bin/navidrome";
+        WorkingDirectory = dataFolder;
+        TimeoutStopSec = "20";
+        KillMode = "process";
+        Restart = "on-failure";
+        User = cfg.user;
+        Group = cfg.group;
+        DevicePolicy = "closed";
+        NoNewPrivileges= " yes";
+        PrivateTmp = "yes";
+        PrivateUsers = "yes";
+        ProtectControlGroups = "yes";
+        ProtectKernelModules = "yes";
+        ProtectKernelTunables = "yes";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+        RestrictNamespaces = "yes";
+        RestrictRealtime = "yes";
+        SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
+        ReadWritePaths = dataFolder;
+        StateDirectory = baseNameOf dataFolder;
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "navidrome") ({
+      navidrome = {
+        description = "Navidrome service user";
+        name = cfg.user;
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    });
+
+    users.groups = optionalAttrs (cfg.group == "navidrome") ({
+      navidrome = {};
+    });
+    
+  };
+}

modules/wallabag.nix

@@ -0,0 +1,220 @@
+{ config, options, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.wallabag;
+
+  poolName = "wallabag";
+
+  configFile = pkgs.writeTextFile {
+    name = "wallabag-config";
+    text = cfg.conf;
+    destination = "/config/parameters.yml";
+  };
+
+  appDir = pkgs.buildEnv {
+    name = "wallabag-app-dir";
+    ignoreCollisions = true;
+    checkCollisionContents = false;
+    paths = [ configFile "${cfg.package}/app" ];
+  };
+
+in {
+
+  options = {
+
+    services.wallabag = {
+      enable = mkEnableOption "wallabag";
+
+      user = mkOption {
+        type = types.str;
+        default = "nginx";
+        description = ''
+          User account under which both the update daemon and the web-application run.
+        '';
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/wallabag";
+        description = ''
+          Data directory.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.wallabag;
+        description = ''
+          Wallabag package to use.
+        '';
+      };
+
+      hostName = mkOption {
+        type = types.str;
+        description = ''
+          Name of the nginx virtualhost to use and setup.
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = types.lines;
+        default = ''
+          pm = dynamic
+          pm.max_children = 75
+          pm.start_servers = 1
+          pm.min_spare_servers = 1
+          pm.max_spare_servers = 20
+          pm.max_requests = 500
+          catch_workers_output = 1
+        '';
+        description = ''
+          Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
+        '';
+      };
+
+      conf = mkOption {
+        type = types.str;
+        description = ''
+          Contents of the wallabag configuration file (parameters.yml)
+        '';
+      };
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+
+    services.phpfpm.pools."${poolName}" = {
+	user = "${cfg.user}";
+	group = "nginx";
+	settings = {
+		"listen.owner" = "nginx";
+		"listen.group" = "nginx";
+		"listen.mode" = "0600";
+		"user" = "${cfg.user}";
+		"group" = "nginx";
+		"env[WALLABAG_DATA]" = "${cfg.dataDir}";
+		"pm" = "dynamic";
+		"pm.max_children" = "75";
+		"pm.min_spare_servers" = "5";
+		"pm.max_spare_servers" = "20";
+		"pm.max_requests" = "10";
+		"catch_workers_output" = "1";
+	      	"php_admin_value[error_log]" = "/var/log/nginx/${poolName}-phpfpm-error.log";
+	};
+    };
+    services.phpfpm.phpOptions = ''
+      max_execution_time = 120
+    '';
+
+    services.nginx.enable = mkDefault true;
+
+    services.nginx.virtualHosts."${cfg.hostName}" = {
+      enableACME = false;
+      forceSSL = false;
+      root = "${cfg.package}/web";
+
+      extraConfig = ''
+        add_header X-Frame-Options SAMEORIGIN;
+        add_header X-Content-Type-Options nosniff;
+        add_header X-XSS-Protection "1; mode=block";
+      '';
+
+      locations."/" = {
+        extraConfig = ''
+          try_files $uri /app.php$is_args$args;
+        '';
+      };
+
+      locations."/assets".root = "${cfg.dataDir}/web";
+
+      locations."~ ^/app\\.php(/|$)" = {
+        extraConfig = ''
+          fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
+          fastcgi_split_path_info ^(.+\.php)(/.*)$;
+
+          fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
+          fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
+          fastcgi_read_timeout 120;
+
+            fastcgi_param   QUERY_STRING            $query_string;
+            fastcgi_param   REQUEST_METHOD          $request_method;
+            fastcgi_param   CONTENT_TYPE            $content_type;
+            fastcgi_param   CONTENT_LENGTH          $content_length;
+    
+            fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name;
+            fastcgi_param   SCRIPT_NAME             $fastcgi_script_name;
+            fastcgi_param   PATH_INFO               $fastcgi_path_info;
+            fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info;
+            fastcgi_param   REQUEST_URI             $request_uri;
+            fastcgi_param   DOCUMENT_URI            $document_uri;
+            fastcgi_param   SERVER_PROTOCOL         $server_protocol;
+    
+            fastcgi_param   GATEWAY_INTERFACE       CGI/1.1;
+            fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version;
+    
+            fastcgi_param   REMOTE_ADDR             $remote_addr;
+            fastcgi_param   REMOTE_PORT             $remote_port;
+            fastcgi_param   SERVER_ADDR             $server_addr;
+            fastcgi_param   SERVER_PORT             $server_port;
+            fastcgi_param   SERVER_NAME             $server_name;
+
+          internal;
+        '';
+      };
+
+      locations."~ /(?!app)\\.php$" = {
+        extraConfig = ''
+          return 404;
+        '';
+      };
+    };
+
+    systemd.services.wallabag-install = {
+      description = "Wallabag install service";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "phpfpm-wallabag.service" ];
+      after = [ "mysql.service" "postgresql.service" ];
+      path = with pkgs; [ coreutils php phpPackages.composer ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Type = "oneshot";
+        RemainAfterExit = "yes";
+        PermissionsStartOnly = true;
+      };
+
+      preStart = ''
+        mkdir -p "${cfg.dataDir}"
+        chown ${cfg.user}:nginx "${cfg.dataDir}"
+      '';
+
+      script = ''
+        echo "Setting up wallabag files in ${cfg.dataDir} ..."
+        cd "${cfg.dataDir}"
+
+        rm -rf var/cache/*
+        rm -f app
+        ln -sf ${appDir} app
+        ln -sf ${cfg.package}/composer.{json,lock} .
+
+        export WALLABAG_DATA="${cfg.dataDir}"
+        if [ ! -f installed ]; then
+          php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction
+          php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
+          # Until https://github.com/wallabag/wallabag/issues/3662 is fixed
+          # yes no | php ${cfg.package}/bin/console --env=prod wallabag:install
+          touch installed
+        else
+          php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
+        fi
+        php ${cfg.package}/bin/console --env=prod cache:clear
+      '';
+    };
+  };
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ nadrieril ];
+  };
+}

pkgs/grasp.nix

@@ -0,0 +1,22 @@
+{ python3, fetchFromGitHub, lib }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "grasp";
+  version = "0.6.6";
+
+  src = fetchFromGitHub {
+    owner = "karlicoss";
+    repo = pname;
+    rev = "grasp-${version}";
+    sha256 = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  meta = with lib; {
+    description = "grasp server";
+    # License is complicated...
+    #license = licenses.agpl3;
+    homepage = "https://github.com/karlicoss/grasp";
+    platforms = platforms.all;
+    maintainers = with stdenv.lib.maintainers; [ chickensoupwithrice ];
+  };
+}

pkgs/wallabag.nix

@@ -0,0 +1,98 @@
+{ pkgs, config, lib, ... }:
+
+{
+  services.postgresql = {
+    enable = true;
+
+    # Ensure the database, user, and permissions always exist
+    ensureDatabases = [ "wallabag" ];
+    ensureUsers = [
+     { name = "wallabag";
+       ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
+     }
+    ];
+  };
+
+  services.wallabag = {
+    enable = true;
+    hostName = "read.mossnet.lan";
+    package = pkgs.callPackage ./pkg-wallabag.nix {};
+    conf = ''
+# This file is a "template" of what your parameters.yml file should look like
+parameters:
+    # Uncomment these settings or manually update your parameters.yml
+    # to use docker-compose
+    #
+    # database_driver: %env.database_driver%
+    # database_host: %env.database_host%
+    # database_port: %env.database_port%
+    # database_name: %env.database_name%
+    # database_user: %env.database_user%
+    # database_password: %env.database_password%
+
+    database_driver: pdo_pgsql
+    database_host: localhost
+    database_port: ~
+    database_name: wallabag
+    database_user: wallabag
+    database_password: wallabag 
+    # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
+    database_path: ~
+    database_table_prefix: wallabag_
+    database_socket: null
+    # with PostgreSQL and SQLite, you must set "utf8"
+    database_charset: utf8
+
+    domain_name: http://read.mossnet.lan
+    server_name: "mossnet wallabag instance"
+
+    mailer_transport:  smtp
+    mailer_user:       ~
+    mailer_password:   ~
+    mailer_host:       127.0.0.1
+    mailer_port:       false
+    mailer_encryption: ~
+    mailer_auth_mode:  ~
+
+    locale: en
+
+    # A secret key that's used to generate certain security-related tokens
+    secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
+
+    # two factor stuff
+    twofactor_auth: true
+    twofactor_sender: no-reply@wallabag.org
+
+    # fosuser stuff
+    fosuser_registration: true
+    fosuser_confirmation: true
+
+    # how long the access token should live in seconds for the API
+    fos_oauth_server_access_token_lifetime: 3600
+    # how long the refresh token should life in seconds for the API
+    fos_oauth_server_refresh_token_lifetime: 1209600
+
+    from_email: no-reply@wallabag.org
+
+    rss_limit: 50
+
+    # RabbitMQ processing
+    rabbitmq_host: localhost
+    rabbitmq_port: 5672
+    rabbitmq_user: guest
+    rabbitmq_password: guest
+    rabbitmq_prefetch_count: 10
+
+    # Redis processing
+    redis_scheme: tcp
+    redis_host: localhost
+    redis_port: 6379
+    redis_path: null
+    redis_password: null
+
+    # sentry logging
+    sentry_dsn: ~
+'';
+  };
+  # networking.firewall.allowedTCPPorts = [ 8080 ];
+} 

pkgs/wallabag.patch

@@ -0,0 +1,31 @@
+diff --git a/app/AppKernel.php b/app/AppKernel.php
+index 347197e..902b558 100644
+--- a/app/AppKernel.php
++++ b/app/AppKernel.php
+@@ -69,19 +69,24 @@ class AppKernel extends Kernel
+         return __DIR__;
+     }
+ 
++    public function getProjectDir()
++    {
++        return getenv('WALLABAG_DATA') ?: dirname(__DIR__);
++    }
++
+     public function getCacheDir()
+     {
+-        return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment();
++        return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment();
+     }
+ 
+     public function getLogDir()
+     {
+-        return dirname(__DIR__) . '/var/logs';
++        return $this->getProjectDir() . '/var/logs';
+     }
+ 
+     public function registerContainerConfiguration(LoaderInterface $loader)
+     {
+-        $loader->load($this->getRootDir() . '/config/config_' . $this->getEnvironment() . '.yml');
++        $loader->load($this->getProjectDir() . '/app/config/config_' . $this->getEnvironment() . '.yml');
+ 
+         $loader->load(function ($container) {

profiles/backup/backup.nix

@@ -0,0 +1,34 @@
+{
+  # Assumes the remote borg backup server has already been initialized
+  # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive>
+  services.borgbackup.jobs = {
+    backupTaskwarriorRsync = {
+      paths = [ "/var/lib/taskserver" ];
+      doInit = true;
+      repo =  "20779@hk-s020.rsync.net:taskwarrior" ;
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat /run/keys/rsync";
+      };
+      environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
+      compression = "auto,lzma";
+      startAt = "weekly";
+      extraArgs = "--remote-path=borg1";
+    };
+  };
+  services.borgbackup.jobs = {
+    backupShaarliRsync = {
+      paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ];
+      doInit = true;
+      repo =  "20779@hk-s020.rsync.net:shaarli" ;
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat /run/keys/rsync";
+      };
+      environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
+      compression = "auto,lzma";
+      startAt = "weekly";
+      extraArgs = "--remote-path=borg1";
+    };
+  };
+}

profiles/dns/defalut.nix

@@ -10,7 +10,7 @@
     addn-hosts=/ec/adblock.hosts
   '';
   services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
-  networking.hosts = { "172.16.11.240" = [ "mossnet.lan" "links.mossnet.lan" "read.mossnet.lan" "stats.mossnet.lan" "music.moss" "tasks.moss" "headphones.moss" "cloud.moss" "links.moss" "read.moss" "stats.moss" "rss.moss" ]; };
+  networking.hosts = { "172.16.11.240" = [ "mossnet.lan" "links.mossnet.lan" "read.mossnet.lan" "stats.mossnet.lan" "music.mossnet.lan" "rss.mossnet.lan" "tasks.mossnet.lan" ]; };
   networking.firewall.allowedTCPPorts = [ 53 ];
   networking.firewall.allowedUDPPorts = [ 53 ];
 }

profiles/dns/dns.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, lib, ... }:
+{
+  services.dnsmasq.enable = true;
+  services.dnsmasq.extraConfig = ''
+      domain-needed
+      no-resolv
+      local=/lan/
+      local=/moss/
+      cache-size=5000
+      addn-hosts=/ec/adblock.hosts
+    '';
+  services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
+  networking.hosts = {"192.168.1.240" = ["mossnet.lan" "links.mossnet.lan" "read.mossnet.lan" "stats.mossnet.lan" "music.moss" "tasks.moss" "headphones.moss" "cloud.moss" "links.moss" "read.moss" "stats.moss" "rss.moss"];};
+  networking.firewall.allowedTCPPorts = [ 53 ];
+  networking.firewall.allowedUDPPorts = [ 53 ];
+}

profiles/ftp/default.nix

@@ -0,0 +1,20 @@
+{ pkgs, lib, ... }:
+
+{
+  networking.firewall.allowedTCPPorts = [ 20 21 ];
+  networking.firewall.allowedTCPPortRanges = [ { from = 51000; to = 51999; } ];
+  services.vsftpd = {
+    enable = true;
+    writeEnable = true;
+    anonymousUser = true;
+    anonymousUserNoPassword = true;
+    anonymousUploadEnable = true;
+    anonymousMkdirEnable = true;
+    anonymousUserHome = "/home/ftp";
+    extraConfig = ''
+      pasv_enable=Yes
+      pasv_min_port=51000
+      pasv_max_port=51999
+    '';
+  };
+}

profiles/monitoring/default.nix

@@ -42,18 +42,18 @@
   };
 
   services.loki = {
-    enable = true;
-    configFile = /var/loki-config.yaml;
+    #enable = true;
+    #configFile = /var/loki-config.yaml;
   };
 
-  systemd.services.promtail = {
-    description = "Promtail service for Loki";
-    wantedBy = [ "multi-user.target" ];
+  #systemd.services.promtail = {
+  #  description = "Promtail service for Loki";
+  #  wantedBy = [ "multi-user.target" ];
 
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
-      '';
-    };
-  };
+  #  serviceConfig = {
+  #    ExecStart = ''
+  #      ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
+  #    '';
+  #  };
+  #};
 }

profiles/nextcloud/default.nix

@@ -1,7 +1,9 @@
 { pkgs, config, ... }:
 {
-  age.secrets.nextcloud-db.file = "/etc/nixos/secrets/nextcloud-db.age";
-  age.secrets.nextcloud-admin.file = "/etc/nixos/secrets/nextcloud-admin.age";
+  #age.secrets.nextcloud-db.file = "/etc/nixos/secrets/nextcloud-db.age";
+  #age.secrets.nextcloud-db.owner = "nextcloud";
+  #age.secrets.nextcloud-admin.file = "/etc/nixos/secrets/nextcloud-admin.age";
+  #age.secrets.nextcloud-admin.owner = "nextcloud";
   services.nextcloud = {
     enable = true;
     hostName = "mossnet.lan";
@@ -25,8 +27,9 @@
       dbuser = "nextcloud";
       dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
       dbname = "nextcloud";
-      dbpassFile = "/run/secrets/nextcloud-db";
-      adminpassFile = "/run/secrets/nextcloud-admin";
+      dbpassFile = "/var/nextcloud-db-pass";
+
+      adminpassFile = "/var/nextcloud-admin-pass";
       adminuser = "admin";
     };
   };
@@ -38,8 +41,7 @@
     # Ensure the database, user, and permissions always exist
     ensureDatabases = [ "nextcloud" ];
     ensureUsers = [
-      {
-        name = "nextcloud";
+     { name = "nextcloud";
        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
      }
     ];

profiles/nfs/default.nix

@@ -0,0 +1,32 @@
+{
+  #fileSystems."/export/" = {
+  #  device = "/mnt/mafuyu";
+  #  options = [ "bind" ];
+  #};
+
+  services.nfs.server = {
+    enable = true;
+    # fixed rpc.statd port; for firewall
+    lockdPort = 4001;
+    mountdPort = 4002;
+    statdPort = 4000;
+    extraNfsdConfig = '''';
+    exports = ''
+      /home/ftp        192.168.1.0/24(rw)
+      '';
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 111  2049 4000 4001 4002 20048 ];
+    allowedUDPPorts = [ 111 2049 4000 4001  4002 20048 ];
+  };
+
+  #systemd.services.create-mount-dir = {
+  #  serviceConfig = {
+  #    ExecStart = "mkdir /export";
+  #  };
+  #  wantedBy = [ "multi-user.target" ];
+  #  after = [ "remote-fs.target" ];
+  #  description = "Create a directory we can mount on fs";
+  #};
+}

profiles/rss-bridge/default.nix

@@ -0,0 +1,14 @@
+{pkgs, lib, config, ...}:
+{
+  services.rss-bridge = {
+    enable = true;
+    virtualHost = "rss.mossnet.lan";
+    whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"];
+    #dataDir = "/etc/rss-bridge/";
+  };
+  #environment.etc."rss-bridge/config.ini.php" = ''
+  #  [InstagramBridge]
+  #  session_id = %sessionid from step 1%
+  #  cache_timeout = %cache timeout in seconds%
+  #'';
+}

profiles/sync/get-music.nix

@@ -0,0 +1,12 @@
+{ pkgs, lib, ... }:
+
+{
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "* */24 * * * *     anish     /etc/get-music.sh"
+    ];
+  };
+  environment.etc."get-music.sh".text = builtins.readFile "./get-music.sh";
+  evironment.systemPackages = [ pkgs.rsync ];
+}

profiles/sync/get-music.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+rsync -r --ignore-existing --log-file=/data/incoming/download-log hypercube@talos.feralhosting.com:private/transmission/data/* /data/incoming
+
+# you need to set defaults for beets
+# if already imported -> Skip
+# Auto accept changes 
+# also install it lmao
+#beet import /data/incoming
+

profiles/taskd/default.nix

@@ -3,7 +3,7 @@
 {
   services.taskserver.enable = true;
   services.taskserver.fqdn = "task.moss";
-  services.taskserver.listenHost = "172.16.11.240";
+  services.taskserver.listenHost = "0.0.0.0";
   services.taskserver.listenPort = 53589;
   services.taskserver.organisations.mossnet.users = [ "anish" ];
 }

profiles/wallabag/default.nix

@@ -7,8 +7,7 @@
     # Ensure the database, user, and permissions always exist
     ensureDatabases = [ "wallabag" ];
     ensureUsers = [
-      {
-        name = "wallabag";
+     { name = "wallabag";
        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
      }
     ];

profiles/wireguard-box/default.nix

@@ -0,0 +1,61 @@
+{ config, pkgs, lib, ... }:
+
+{
+  services.tailscale.enable = true;
+  networking.firewall.allowedUDPPorts = [ 60990 ];
+
+  # Enable WireGuard
+  networking.wireguard.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP address and subnet of the client's end of the tunnel interface.
+      ips = [ "10.0.69.4/24" ];
+      listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+      # Path to the private key file.
+      #
+      # Note: The private key can also be included inline via the privateKey option,
+      # but this makes the private key world-readable; thus, using privateKeyFile is
+      # recommended.
+      privateKeyFile = "/home/anish/wg/privkey";
+
+      peers = [
+        # For a client configuration, one peer entry for the server will suffice.
+        {
+          # Public key of the server (not a file path).
+          publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
+
+          # Forward all the traffic via VPN.
+          allowedIPs = [ "10.0.69.0/24" ];
+          # Or forward only particular subnets
+          #allowedIPs = [ "10.100.0.1" "91.108.12.0/22" ];
+
+          # Set this to the server IP and port.
+          endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+
+          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+#  boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ];
+#  environment.systemPackages = [ pkgs.wireguard ];
+#  networking.wireguard.enable = true;
+#  networking.wireguard.interfaces = {
+#    wg0 = {
+#      ips = [ "10.0.69.4/32" ];
+#      privateKeyFile = "/home/anish/wg/privkey";
+#      listenPort = 60990;
+#
+#      peers = [
+#        { # helix - server
+#          publicKey = "{c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=}";
+#          allowedIPs = [ "10.0.69.1/24" ];
+#          endpoint = "sealight.xyz:60990";
+#          persistentKeepalive = 25;
+#        } ];
+#    };
+#  };
+}