136 lines
3.4 KiB
Nix
136 lines
3.4 KiB
Nix
# Server stack shared by dogma-nixos and dogma-nixos-rtx (not WSL)
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.bridge.bridge-nf-call-iptables" = 1;
|
|
"net.ipv4.conf.all.forwarding" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
"net.ipv4.conf.all.proxy_arp" = 1;
|
|
"net.ipv4.conf.ens2.proxy_arp" = 1;
|
|
};
|
|
|
|
networking.firewall.trustedInterfaces = ["br0"];
|
|
|
|
# Bridge networking - host-specific NIC may be overridden per-host
|
|
networking.interfaces.enp6s0.useDHCP = false;
|
|
networking.interfaces.br0.useDHCP = true;
|
|
networking.bridges.br0.interfaces = ["enp6s0"];
|
|
|
|
services.caddy = {
|
|
enable = true;
|
|
environmentFile = config.sops.templates."caddy.env".path;
|
|
virtualHosts."centraldogma.site:".extraConfig = ''
|
|
|
|
root /srv/root/
|
|
file_server
|
|
encode zstd gzip
|
|
|
|
redir /jellyfin /jellyfin/
|
|
reverse_proxy /jellyfin/* 127.0.0.1:8096
|
|
|
|
redir /sonarr /sonarr/
|
|
reverse_proxy /sonarr/* 127.0.0.1:8989
|
|
|
|
redir /radarr /radarr/
|
|
reverse_proxy /radarr/* 127.0.0.1:7878
|
|
|
|
'';
|
|
virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
|
|
reverse_proxy /* 127.0.0.1:8096
|
|
'';
|
|
virtualHosts."jellyfin2.centraldogma.site:".extraConfig = ''
|
|
redir /jellyfin /jellyfin/
|
|
reverse_proxy /jellyfin/* 127.0.0.1:8096
|
|
'';
|
|
virtualHosts."git.centraldogma.site:".extraConfig = ''
|
|
reverse_proxy /* 127.0.0.1:3000
|
|
'';
|
|
};
|
|
|
|
services.flaresolverr.enable = true;
|
|
|
|
services.mongodb = {
|
|
enable = true;
|
|
package = pkgs.mongodb-ce;
|
|
initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
|
|
};
|
|
services.jackett.enable = true;
|
|
|
|
services.factorio = {
|
|
enable = true;
|
|
public = true;
|
|
requireUserVerification = true;
|
|
username = "TheMaskedMan95";
|
|
admins = ["TheMaskedMan95"];
|
|
extraSettingsFile = config.sops.templates."factorio.json".path;
|
|
game-name = "Realm of the Masked Men";
|
|
description = "No Dogs allowed";
|
|
saveName = "SPACExxxx";
|
|
openFirewall = true;
|
|
};
|
|
|
|
services.radarr.enable = true;
|
|
|
|
services.ddclient = {
|
|
enable = true;
|
|
protocol = "namecheap";
|
|
server = "dynamicdns.park-your-domain.com";
|
|
ssl = true;
|
|
username = "centraldogma.site";
|
|
domains = [
|
|
"@"
|
|
"www"
|
|
"*"
|
|
];
|
|
usev4 = "webv4, webv4=ipify-ipv4";
|
|
passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
|
|
interval = "5mins";
|
|
};
|
|
|
|
services.sonarr.enable = true;
|
|
|
|
services.transmission = {
|
|
enable = true;
|
|
openRPCPort = true;
|
|
settings = {
|
|
rpc-bind-address = "0.0.0.0";
|
|
rpc-whitelist = "127.0.0.1,192.168.1.86";
|
|
download-dir = "/mnt/media/Downloads";
|
|
};
|
|
};
|
|
|
|
# services.adguardhome = {
|
|
# enable = true;
|
|
# host = "0.0.0.0";
|
|
# port = 3003;
|
|
# settings = {
|
|
# allowDHCP = true;
|
|
# dns = {
|
|
# upstream_dns = [
|
|
# "9.9.9.9#dns.quad9.net"
|
|
# "149.112.112.112#dns.quad9.net"
|
|
# ];
|
|
# };
|
|
# filtering = {
|
|
# protection_enabled = true;
|
|
# filtering_enabled = true;
|
|
# parental_enabled = true;
|
|
# safe_search.enabled = false;
|
|
# };
|
|
# filters =
|
|
# map (url: {
|
|
# enabled = true;
|
|
# url = url;
|
|
# }) [
|
|
# "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt"
|
|
# "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt"
|
|
# ];
|
|
# };
|
|
# };
|
|
}
|