*actually* upload nixcloud configs

2026-03-12 05:15:14 -06:00
parent 18261a9969
commit e8b59f873b
12 changed files with 471 additions and 0 deletions
@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts."k3t.dev".extraConfig = ''
+      encode zstd gzip
+      root /var/www/k3t.dev/
+      file_server browse
+    '';
+  };
+
+}
@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+{
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;   # optional; lets you use `docker` CLI
+  };
+
+  systemd.services.minecraft-container = {
+    description = "Minecraft Server Container (GraalVM JVM 21)";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.podman}/bin/podman run \
+          --rm \
+          --name minecraft-server \
+          -v /var/lib/minecraft:/data \
+          -p 25565:25565 \
+          -p 24454:24454/udp \
+          ghcr.io/graalvm/graalvm-community:25 \
+          /data/run.sh
+      '';
+      ExecStop = "${pkgs.podman}/bin/podman stop minecraft-server";
+      Restart = "always";
+      RestartSec = "10s";
+    };
+
+    # Ensure the directory exists
+    preStart = ''
+      mkdir -p /var/lib/minecraft
+    '';
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  # Give Podman permission to access persistent storage
+  systemd.tmpfiles.rules = [
+    "d /var/lib/minecraft 0755 root root"
+  ];
+}
@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.vaultwarden = {
+      enable = true;
+      backupDir = "/var/local/vaultwarden/backup";
+      # in order to avoid having  ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
+      # be aware that this file must be created by hand (or via secrets management like sops)
+      environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
+      config = {
+        # Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
+        DOMAIN = "https://bitwarden.k3t.dev";
+        SIGNUPS_ALLOWED = true;
+
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT = 8222;
+        ROCKET_LOG = "critical";
+
+        # This example assumes a mailserver running on localhost,
+        # thus without transport encryption.
+        # If you use an external mail server, follow:
+        #   https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration
+        #SMTP_HOST = "127.0.0.1";
+        #SMTP_PORT = 25;
+        #SMTP_SSL = false;
+
+        #SMTP_FROM = "admin@bitwarden.example.com";
+        #SMTP_FROM_NAME = "example.com Bitwarden server";
+      };
+  };
+  services.caddy.virtualHosts."bitwarden.k3t.dev".extraConfig = ''
+    encode zstd gzip
+
+    reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
+        header_up X-Real-IP {remote_host}
+    }
+  '';
+}